refactor: auth-cli.ts 改用 auth-rt 二进制，更新 README

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -4,17 +4,17 @@
 
 ## 认证机制：auth-cli.ts
 
-每个 skill 内置一份 `src/auth-cli.ts`，它是一个薄 wrapper，通过 subprocess 调用 `auth-runtime` CLI（`bun run ~/clawd/skills/auth-runtime/src/cli.ts`）。
+每个 skill 内置一份 `src/auth-cli.ts`，它是一个薄 wrapper，通过 subprocess 调用 `auth-rt` 二进制。
 
-**不使用 npm 依赖**，避免了 git 包缓存导致的版本不一致问题。
+**不使用 npm 依赖**，auth-runtime 更新时只需重新编译二进制，不需要改动任何 skill。
 
 ### 工作原理
 
 ```
 skill/src/index.ts
   → import { createSkillClient } from './auth-cli.ts'
-  → auth-cli.ts 通过 spawnSync 调用 bun run cli.ts
-  → auth-runtime/src/cli.ts 处理 token/session/request
+  → auth-cli.ts 通过 spawnSync 调用 auth-rt 二进制
+  → auth-rt 处理 token/session/request
 ```
 
 ### 使用方式
@@ -38,19 +38,23 @@ const session = await client.session();
 
 ### 前置条件
 
-每台运行 skill 的机器上必须有 `auth-runtime`：
+每台运行 skill 的机器上必须安装 `auth-rt` 二进制：
 
 ```bash
 git clone http://192.168.0.108:3030/agent-skills/auth-runtime.git ~/clawd/skills/auth-runtime
+cd ~/clawd/skills/auth-runtime && ./install.sh
+# 安装到 ~/.openclaw/bin/auth-rt
 ```
 
-`install.sh` 会检查此目录是否存在。
+确保 `~/.openclaw/bin` 在 PATH 中，或通过 `AUTH_RT_BIN` 环境变量指定路径。
 
-### 路径解析
+### auth-runtime 更新流程
 
-默认路径：`~/clawd/skills/auth-runtime`
-
-可通过环境变量覆盖：`AUTH_RUNTIME_DIR=/custom/path bun run scripts/run.ts ...`
+auth-runtime 代码变更后：
+```bash
+cd ~/clawd/skills/auth-runtime && git pull && ./install.sh
+```
+重新编译即可，**无需改动任何 skill 代码**。
 
 ### 新建 skill 检查清单
 
@@ -58,4 +62,4 @@ git clone http://192.168.0.108:3030/agent-skills/auth-runtime.git ~/clawd/skills
 2. 确认 `src/auth-cli.ts` 已包含（直接从模版继承）
 3. `src/index.ts` 中 `import { createSkillClient } from './auth-cli.ts'`
 4. `package.json` 中 **不要** 添加 `@clawd/auth-runtime` 依赖
-5. `install.sh` 中包含 auth-runtime 目录检查
+5. `install.sh` 中包含 auth-rt 二进制检查

install.sh

@@ -2,10 +2,10 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-# Prerequisite: auth-runtime must be cloned at ~/clawd/skills/auth-runtime
-if [ ! -d "$HOME/clawd/skills/auth-runtime/src" ]; then
-  echo "ERROR: auth-runtime not found at ~/clawd/skills/auth-runtime"
-  echo "Run: git clone http://192.168.0.108:3030/agent-skills/auth-runtime.git ~/clawd/skills/auth-runtime"
+# Prerequisite: auth-rt binary must be installed
+if ! command -v auth-rt &>/dev/null && [ ! -x "$HOME/.openclaw/bin/auth-rt" ]; then
+  echo "ERROR: auth-rt not found. Install it:"
+  echo "  cd ~/clawd/skills/auth-runtime && ./install.sh"
   exit 1
 fi
 

src/auth-cli.ts

@@ -1,9 +1,12 @@
 /**
  * Thin CLI wrapper for auth-runtime.
  *
- * Copy this file into your skill's src/ directory. It spawns
- * `bun run <auth-runtime>/src/cli.ts` as a subprocess, so the
- * skill has zero npm dependency on @clawd/auth-runtime.
+ * Copy this file into your skill's src/ directory. It calls the
+ * `auth-rt` binary (compiled from auth-runtime), so the skill has
+ * zero npm dependency on @clawd/auth-runtime.
+ *
+ * Prerequisites:
+ *   ~/.openclaw/bin/auth-rt must exist (run auth-runtime/install.sh)
  *
  * Usage:
  *   import { createSkillClient } from './auth-cli.ts';
@@ -15,9 +18,8 @@ import { spawnSync } from 'child_process';
 import * as path from 'path';
 import * as os from 'os';
 
-const AUTH_RUNTIME_DIR = process.env.AUTH_RUNTIME_DIR
-  || path.join(os.homedir(), 'clawd', 'skills', 'auth-runtime');
-const CLI_ENTRY = path.join(AUTH_RUNTIME_DIR, 'src', 'cli.ts');
+const AUTH_RT_BIN = process.env.AUTH_RT_BIN
+  || path.join(os.homedir(), '.openclaw', 'bin', 'auth-rt');
 
 export interface ApiResponse {
   status: number;
@@ -38,19 +40,16 @@ export interface SkillClientOptions {
 }
 
 function runCli(...args: string[]): string {
-  // Use the same bun binary that's running this process
-  const bun = process.execPath;
-  const result = spawnSync(bun, ['run', CLI_ENTRY, ...args], {
-    cwd: AUTH_RUNTIME_DIR,
+  const result = spawnSync(AUTH_RT_BIN, args, {
     encoding: 'utf-8',
     timeout: 60_000,
   });
 
   if (result.error) {
-    throw new Error(`auth-cli spawn failed: ${result.error.message}`);
+    throw new Error(`auth-rt spawn failed: ${result.error.message}`);
   }
   if (result.status !== 0) {
-    throw new Error(`auth-cli failed (exit ${result.status}): ${(result.stderr || '').trim()}`);
+    throw new Error(`auth-rt failed (exit ${result.status}): ${(result.stderr || '').trim()}`);
   }
   return (result.stdout || '').trim();
 }