What causes "Xianyu reply requires a logged-in browser session" in jackwener/OpenCLI?

Re-login to www.goofish.com in the browser/Browser Bridge profile and refresh stored cookies, then retry.

jackwener/OpenCLI · error · AuthRequiredError

Xianyu reply requires a logged-in browser session

Error message

Xianyu reply requires a logged-in browser session

What it means

After loading the chat page, reply extracts chat state via buildExtractChatStateEvaluate(); if the page reports requiresAuth, the CLI throws AuthRequiredError for www.goofish.com. Goofish chat requires a logged-in session, and the injected cookie/browser session is not authenticated.

Source

Thrown at clis/xianyu/reply.js:54

        const itemId = hasIds ? normalizeNumericId(kwargs.item_id, 'item_id', '1038951278192') : '';
        const userId = hasIds ? normalizeNumericId(kwargs.user_id, 'user_id', '3650092411') : '';
        const text = requireText(kwargs.text, 'xianyu reply --text');
        const url = hasIds ? buildChatUrl(itemId, userId) : '';
        if (hasIds) {
            await page.goto(url);
        } else {
            if (!page.getCurrentUrl || !/https:\/\/www\.goofish\.com\/im\b/.test(await page.getCurrentUrl())) {
                await page.goto('https://www.goofish.com/im');
            }
        }
        await page.wait(2);
        if (rank > 0) {
            requireClickResult(await page.evaluate(buildClickInboxConversationEvaluate(rank - 1)), 'reply rank click');
            await page.wait(2);
        }
        const state = requireEvaluateObject(await page.evaluate(buildExtractChatStateEvaluate()), 'reply');
        if (state?.requiresAuth) {
            throw new AuthRequiredError('www.goofish.com', 'Xianyu reply requires a logged-in browser session');
        }
        if (!state?.can_input) {
            throw selectorError('闲鱼聊天输入框', '未找到可用的聊天输入框，请确认该会话页已正确加载');
        }
        const sent = requireEvaluateObject(await page.evaluate(buildSendMessageEvaluate(text)), 'reply send');
        if (!sent?.ok) {
            throw new CommandExecutionError(`Xianyu reply did not observe the sent message: ${sent?.reason || 'unknown-reason'}`);
        }
        await page.wait(1);
        return [{
            status: 'sent',
            peer_name: state.peer_name || '',
            item_title: state.item_title || '',
            price: state.price || '',
            location: state.location || '',
            message: text,
            peer_user_id: userId,
            item_id: itemId,

View on GitHub (pinned to 49907e53dc)

Solutions

Re-login to www.goofish.com in the browser/Browser Bridge profile and refresh stored cookies, then retry.
Refresh the cookie file used by Strategy.COOKIE with cookies exported from a logged-in session.
If risk-control logged you out, complete verification in a visible browser before retrying headless.

Example fix

// before: stale cookies
await opencli.run('xianyu', 'reply', { item_id, user_id, text });
// after: re-import fresh cookies after re-login
await importCookiesFromBrowser('www.goofish.com', 'cookies.json');
await opencli.run('xianyu', 'reply', { item_id, user_id, text });

Defensive patterns

Strategy: try-catch

Validate before calling

// verify the goofish session is logged in before replying
const loggedIn = await page.evaluate(() => !document.querySelector('[class*="login"], .login-dialog') && !!document.cookie.includes('unb'));
if (!loggedIn) throw new Error('Goofish session expired; re-login before replying.');

Try / catch

try {
  return await reply(kwargs);
} catch (e) {
  if (e.name === 'AuthRequiredError' || String(e.message).includes('logged-in browser session')) {
    await refreshGoofishSession(); // re-login / re-import cookies
    return reply(kwargs); // retry once with fresh session
  }
  throw e;
}

Prevention

Refresh goofish cookies regularly; sessions expire and rotate tokens.
Run a cheap authenticated read (e.g. xianyu inbox) to probe session health before writes.
Complete any risk-control verification in a visible browser before headless runs.
Keep a stable logged-in browser profile dedicated to automation.

When it happens

Trigger: `xianyu reply` (IDs or --rank mode) where the extracted state has requiresAuth true — expired goofish login cookies, navigating before login, or the session was logged out / invalidated server-side.

Common situations: Cookie-based (Strategy.COOKIE) sessions expiring after goofish rotates tokens; running headless with stale cookie files; goofish forcing re-login after risk-control detection; never having logged in on the browser profile used.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/d64d1c69fa8deb65. Report an issue: GitHub.