jackwener/OpenCLI · error · AuthRequiredError

Xianyu messages requires a logged-in browser session

Error message

Xianyu messages requires a logged-in browser session

What it means

The chat-state extraction script executed inside the Goofish page reports requiresAuth when the page is not logged in (login wall / redirect detected). The CLI translates this into AuthRequiredError('www.goofish.com', ...) at clis/xianyu/messages.js:65, telling the operator the automation browser needs an authenticated www.goofish.com session before messages can be read.

Source

Thrown at clis/xianyu/messages.js:65

        const userId = hasIds ? normalizeNumericId(kwargs.user_id, 'user_id', '3650092411') : '';
        const limit = normalizeLimit(kwargs.limit, DEFAULT_MESSAGE_LIMIT, MAX_MESSAGE_LIMIT, 'messages --limit');
        let url = '';
        if (hasIds) {
            url = buildChatUrl(itemId, userId);
            await page.goto(url);
        } else {
            if (!page.getCurrentUrl || !/https:\/\/www\.goofish\.com\/im\b/.test(await page.getCurrentUrl())) {
                await page.goto('https://www.goofish.com/im');
            }
        }
        await page.wait(2);
        if (rank > 0) {
            requireClickResult(await page.evaluate(buildClickInboxConversationEvaluate(rank - 1)), 'messages rank click');
            await page.wait(2);
        }
        const state = requireEvaluateObject(await page.evaluate(buildExtractChatStateEvaluate(limit)), 'messages');
        if (state?.requiresAuth) {
            throw new AuthRequiredError('www.goofish.com', 'Xianyu messages requires a logged-in browser session');
        }
        if (!Array.isArray(state.messages)) {
            throw new CommandExecutionError('Xianyu messages returned malformed message list');
        }
        const messages = state.messages;
        if (!messages.length) {
            throw new EmptyResultError('xianyu messages', 'No visible messages were found in this Xianyu conversation');
        }
        return messages.slice(-limit).map((message, index) => ({
            index: index + 1,
            peer_name: state.peer_name || '',
            item_title: state.item_title || '',
            message: message.text || '',
            item_id: itemId,
            peer_user_id: userId,
            url: url || '',
        }));
    },

View on GitHub (pinned to 49907e53dc)

Solutions

Open www.goofish.com in the automation browser and log in manually (scan QR / enter credentials), then re-run the command.
Persist the browser profile/cookies so the login survives restarts.
If the profile was valid, re-login — session cookies on Goofish expire periodically.
Avoid headless/automation flags that trigger bot detection and forced logout; keep the profile warm with occasional authenticated visits.
Catch AuthRequiredError in wrappers and pause the pipeline until an operator re-authenticates.

Example fix

// before: fails with AuthRequiredError on a cold profile
await cli.run(['xianyu', 'messages', '--rank', '1']);

// after: check auth first and prompt for login
if (!(await isLoggedIn('www.goofish.com'))) {
  await openForManualLogin('https://www.goofish.com');
}
await cli.run(['xianyu', 'messages', '--rank', '1']);

Defensive patterns

Strategy: try-catch

Validate before calling

const cookies = await getCookies('www.goofish.com');
if (!cookies?.some(c => c.name === 'unb' || /session|login/i.test(c.name))) await openForManualLogin('https://www.goofish.com');

Try / catch

try {
  await cli.run(['xianyu', 'messages', ...args]);
} catch (e) {
  if (e instanceof AuthRequiredError) {
    await promptOperatorLogin(e.domain); // e.domain === 'www.goofish.com'
    return cli.run(['xianyu', 'messages', ...args]);
  }
  throw e;
}

Prevention

Persist the browser profile so logins survive restarts.
Check session validity before batch runs, not per command.
Schedule periodic authenticated page visits to keep cookies warm.
Avoid aggressive headless configurations that trigger forced re-login.

When it happens

Trigger: Running `xianyu messages` (any targeting mode) while the automation browser's goofish.com session is logged out, expired, or blocked — the in-page extraction returns { requiresAuth: true }.

Common situations: Fresh browser profile with no login; session cookie expired since the last run; Goofish risk-control forcing re-login; headless profile invalidated after a browser update; running from a server without completing the interactive login step.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/4123bba55fe54247. Report an issue: GitHub.