Repository navigation
fix(weixin-mp): bind REST auth to declared config - #163
Merged
Merged
Conversation
Why: YAML-driven REST commands resolve authentication from Host-declared appId/appSecret fields, while the migrated limb still referenced legacy environment-style names and sent an empty appid. Align the templates, add a configuration-reference regression guard, and prepare immutable alpha.7 package coordinates. [小太阳·砚砚/GPT-5.6 Sol🐾] Thread-Context: threadId=thread_mrim7yy252i9rab1 invocationId=789a5b3e-a510-4d9a-972a-ac74de16d784 catId=codex-sol
zts212653
added a commit
that referenced
this pull request
Oct 29, 2026
Why: the appId binding repair (#163) is published as @clowder-ai/weixin-mp 0.1.0-alpha.7, but Host discovery still offered alpha.5. This scoped activation makes the verified repair installable without advancing any other plugin. Adds the already-published alpha.7 and alpha.6 rows to official.weixin-mp only; existing alpha.5/alpha.3/alpha.2 rows are retained verbatim. Output is byte-identical to a fresh `activateCatalog({ pluginIds: ['official.weixin-mp'] })` run over the same catalog.json + candidate.json, and npm integrity/shasum for alpha.6/alpha.7 match. Independent non-author review (typed APPROVE) and non-author merge, both bound to exact HEAD 4f8a4eb. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Failure and fix
check_status used the package runtime path and succeeded, while list_drafts/list_articles used the generic Limb token manager and sent an empty appid because the YAML still referenced legacy WEIXIN_MP_* names.
Evidence
Risk
Behavior + configuration/security contract. No credential values are read, changed, or committed. This hotfix requires a non-author review and non-author merge.
Runtime verification
The actual list_drafts dogfood is structurally post-merge: main publication creates the immutable npm version, then a reviewed catalog activation and Host package update can exercise the real account without bypassing package lifecycle controls.