@cdo-ai/cli 0.1.0

package/lib/git-auth.mjs

@@ -0,0 +1,343 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile, spawnSync } from "node:child_process";
+import { chmod, lstat, mkdir, open, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { parse, stringify } from "yaml";
+
+import { VERSION } from "./version.mjs";
+
+const execute = promisify(execFile);
+const hash = (value) => createHash("sha256").update(value).digest("hex").slice(0, 20);
+const FILE_LOCK_TIMEOUT_MS = 5_000;
+const FILE_LOCK_STALE_MS = 30_000;
+const GIT_CONTROLS = Object.freeze({
+  dev: "https://app-hosting.dev-agents.cdo.top",
+  staging: "https://app-hosting.s-agents.cdo.top",
+  prod: "https://app-hosting.ttdd.work",
+});
+
+export function validateGitControl(value, environmentName, source = "CDO_GIT_API_URL") {
+  if (!Object.hasOwn(GIT_CONTROLS, environmentName)) throw new Error("Git 控制面环境无效");
+  let endpoint;
+  try { endpoint = new URL(value); } catch { throw new Error(`${source} 无效`); }
+  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password
+      || endpoint.pathname !== "/" || endpoint.search || endpoint.hash) {
+    throw new Error(`${source} 必须是无凭据的 HTTP(S) origin`);
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]", "::1"].includes(endpoint.hostname.toLowerCase());
+  const normalized = endpoint.toString().replace(/\/$/, "");
+  if (loopback) {
+    if (environmentName === "dev" && endpoint.protocol === "http:" && endpoint.port) return normalized;
+    throw new Error(`${source} 与所选 ${environmentName} 环境不匹配`);
+  }
+  if (endpoint.protocol !== "https:") throw new Error(`${source} 必须使用 HTTPS`);
+  if (normalized !== GIT_CONTROLS[environmentName]) {
+    throw new Error(`${source} 与所选 ${environmentName} 环境不匹配`);
+  }
+  return normalized;
+}
+
+/** Validate every endpoint-bearing readiness fact before OAuth or local credential writes. */
+export function validateGitReadiness(facts, environmentName) {
+  let giteaUrl;
+  let sshUrl;
+  try {
+    giteaUrl = new URL(facts?.gitea_url);
+    sshUrl = new URL(facts?.ssh_url);
+  } catch {
+    throw new Error("Git 状态响应无效");
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]", "::1"].includes(giteaUrl.hostname.toLowerCase());
+  const safeGitea = ["http:", "https:"].includes(giteaUrl.protocol)
+    && !giteaUrl.username && !giteaUrl.password && giteaUrl.pathname === "/"
+    && !giteaUrl.search && !giteaUrl.hash
+    && (giteaUrl.protocol === "https:" || (environmentName === "dev" && loopback && Boolean(giteaUrl.port)));
+  const safeSsh = sshUrl.protocol === "ssh:" && sshUrl.username === "git" && !sshUrl.password
+    && /^[a-zA-Z0-9.-]+$/.test(sshUrl.hostname) && !sshUrl.search && !sshUrl.hash
+    && ["", "/"].includes(sshUrl.pathname);
+  if (!facts?.enterprise_id || !facts?.username || !safeGitea || !safeSsh) {
+    throw new Error("Git 状态响应无效");
+  }
+  return facts;
+}
+
+async function regularFile(path) {
+  try {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink()) throw new Error("认证配置不是普通文件，拒绝覆盖");
+    return true;
+  } catch (error) { if (error?.code === "ENOENT") return false; throw error; }
+}
+
+async function atomicPrivate(path, contents) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  await regularFile(path);
+  const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  await writeFile(temporary, contents, { mode: 0o600, flag: "wx" });
+  await rename(temporary, path);
+  await chmod(path, 0o600);
+}
+
+/** Serialize one short local read/merge/write without holding the lock across OAuth. */
+async function withFileLock(path, operation) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const lockPath = `${path}.cdo.lock`;
+  const deadline = Date.now() + FILE_LOCK_TIMEOUT_MS;
+  let handle;
+  while (!handle) {
+    try {
+      handle = await open(lockPath, "wx", 0o600);
+      await handle.writeFile(`${process.pid}\n`, "utf8");
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      const age = await stat(lockPath).then((info) => Date.now() - info.mtimeMs).catch(() => 0);
+      if (age > FILE_LOCK_STALE_MS) { await unlink(lockPath).catch(() => {}); continue; }
+      if (Date.now() >= deadline) throw new Error(`认证配置正被其他进程更新：${path}`);
+      await new Promise((done) => setTimeout(done, 20));
+    }
+  }
+  try { return await operation(); }
+  finally { await handle.close().catch(() => {}); await unlink(lockPath).catch(() => {}); }
+}
+
+function safeProfileIdentity(value) {
+  return String(value || "").replace(/[^a-zA-Z0-9_-]/g, "-") || "direct";
+}
+
+export function gitLocations(profileId, home = homedir()) {
+  const identity = safeProfileIdentity(profileId);
+  const key = join(home, ".config", "cdo", "git", identity, "id_ed25519");
+  return { key, sshConfig: join(home, ".ssh", "config") };
+}
+
+export function sshBlock(existing, profileId, sshUrl, key) {
+  const parsed = new URL(sshUrl);
+  const identity = safeProfileIdentity(profileId);
+  if (!profileId || parsed.protocol !== "ssh:" || parsed.username !== "git"
+      || parsed.password || !/^[a-zA-Z0-9.-]+$/.test(parsed.hostname) || /[\n\r"]/.test(key)) {
+    throw new Error("服务端 Git SSH 配置无效");
+  }
+  const alias = `cdo-${identity}`;
+  const begin = `# BEGIN cdo-git-${identity}`;
+  const end = `# END cdo-git-${identity}`;
+  const start = existing.indexOf(begin);
+  if (start >= 0) {
+    const finish = existing.indexOf(end, start);
+    if (finish < 0 || existing.indexOf(begin, start + begin.length) >= 0) throw new Error("Git SSH managed block 不完整");
+    existing = existing.slice(0, start) + existing.slice(finish + end.length).replace(/^\r?\n/, "");
+  } else if (existing.includes(end)) throw new Error("Git SSH managed block 不完整");
+  const reset = "# cdo-git: resume user configuration\nHost *\n";
+  existing = existing.replace(reset, "");
+  let managedPrefix = "";
+  while (existing.startsWith("# BEGIN cdo-git-")) {
+    const firstLineEnd = existing.indexOf("\n");
+    if (firstLineEnd < 0) throw new Error("Git SSH managed block 不完整");
+    const prefixBegin = existing.slice(0, firstLineEnd);
+    const prefixEnd = prefixBegin.replace("# BEGIN ", "# END ");
+    const prefixFinish = existing.indexOf(prefixEnd, firstLineEnd + 1);
+    if (prefixFinish < 0) throw new Error("Git SSH managed block 不完整");
+    const nextLine = existing.indexOf("\n", prefixFinish + prefixEnd.length);
+    const consumed = nextLine < 0 ? existing.length : nextLine + 1;
+    managedPrefix += existing.slice(0, consumed);
+    existing = existing.slice(consumed);
+  }
+  const block = `${begin}\nHost ${alias}\n  HostName ${parsed.hostname}\n  User git\n  Port ${parsed.port || "22"}\n  IdentityFile "${key.replaceAll("\\", "/")}"\n  UserKnownHostsFile "${join(dirname(key), "known_hosts").replaceAll("\\", "/")}"\n  IdentitiesOnly yes\n  ControlMaster no\n  ControlPath none\n  StrictHostKeyChecking accept-new\n${end}\n`;
+  // Reset to Host * before the user's original text so leading global options stay global.
+  return `${block}${managedPrefix}${reset}${existing}`;
+}
+
+function gitProfileId(context, facts) {
+  return context.profileId || context.profile?.id || `direct-${hash(`${context.environmentName}:${facts.enterprise_id}:${facts.username}`)}`;
+}
+
+async function teaConfigPath(environment = process.env, home = homedir(), platform = process.platform) {
+  const configHome = environment.XDG_CONFIG_HOME || (platform === "darwin"
+    ? join(home, "Library", "Application Support")
+    : platform === "win32" ? environment.LOCALAPPDATA || join(home, "AppData", "Local") : join(home, ".config"));
+  const modern = join(configHome, "tea", "config.yml");
+  const legacy = join(home, ".tea", "tea.yml");
+  return (await regularFile(modern)) || !(await regularFile(legacy)) ? modern : legacy;
+}
+
+async function saveTea(path, login, tokens) {
+  await withFileLock(path, async () => {
+    const config = await regularFile(path) ? parse(await readFile(path, "utf8")) : {};
+    if (!config || typeof config !== "object" || (config.logins && !Array.isArray(config.logins))) throw new Error("Tea 配置格式无效，未覆盖");
+    const logins = config.logins || [];
+    const previous = logins.find((item) => item.name === login.name);
+    if (previous && (previous.url !== login.url || previous.user !== login.user)) throw new Error("Tea 同名配置属于其他身份，未覆盖");
+    config.logins = [...logins.filter((item) => item.name !== login.name), {
+      ...login, token: tokens.access_token, refresh_token: tokens.refresh_token,
+      token_expiry: Math.floor(Date.now() / 1000) + tokens.expires_in,
+      default: previous?.default ?? logins.length === 0, version_check: true,
+    }];
+    await atomicPrivate(path, stringify(config));
+  });
+}
+
+async function responseJson(response, label) {
+  const body = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(body?.detail || body?.error?.message || `${label} (${response.status})`);
+  return body?.data || body;
+}
+
+function authenticatedSSH(result, username) {
+  return `${result?.stdout || ""}${result?.stderr || ""}`.includes(`Hi there, ${username}! You've successfully authenticated`);
+}
+
+function authenticatedTea(result, username) {
+  if (result?.error || (result?.status !== undefined && result.status !== 0)) return false;
+  try {
+    const identity = JSON.parse(result?.stdout || "");
+    return identity && identity.login === username && identity.is_admin !== true;
+  } catch {
+    return false;
+  }
+}
+
+async function teaLoginMatches({ environment, home, name, url, user }) {
+  try {
+    const path = await teaConfigPath(environment, home);
+    if (!(await regularFile(path))) return false;
+    const config = parse(await readFile(path, "utf8"));
+    if (!config || typeof config !== "object" || !Array.isArray(config.logins)) return false;
+    const login = config.logins.find((item) => item?.name === name);
+    return login?.url === url && login?.user === user;
+  } catch {
+    return false;
+  }
+}
+
+export async function inspectGitAuth({ context, environment = process.env, home = homedir(), fetchImplementation = fetch, run = spawnSync }) {
+  let control;
+  try {
+    control = validateGitControl(
+      environment.CDO_GIT_API_URL || GIT_CONTROLS[context.environmentName],
+      context.environmentName,
+      environment.CDO_GIT_API_URL ? "CDO_GIT_API_URL" : "Git 控制面地址",
+    );
+  } catch (error) {
+    return { status: "control_invalid", tea_api_ready: false, git_ssh_ready: false, error: error.message };
+  }
+  let facts;
+  try {
+    facts = await responseJson(await fetchImplementation(new URL("/api/v1/git/readiness", control), {
+      headers: { Authorization: `ApiKey ${context.profile.personal_api_key}`, "X-CDO-Client": "cdo-cli", "X-CDO-Version": VERSION },
+      redirect: "error", signal: AbortSignal.timeout(10_000),
+    }), "Git 状态读取失败");
+  } catch (error) {
+    return { status: "control_unavailable", tea_api_ready: false, git_ssh_ready: false, error: error.message };
+  }
+  let sshHost;
+  try {
+    validateGitReadiness(facts, context.environmentName);
+    sshHost = `cdo-${safeProfileIdentity(gitProfileId(context, facts))}`;
+  } catch {
+    return { status: "control_invalid", tea_api_ready: false, git_ssh_ready: false, error: "Git 状态响应无效" };
+  }
+  if (context.profile.enterprise?.id && context.profile.enterprise.id !== facts.enterprise_id) {
+    return { status: "control_invalid", tea_api_ready: false, git_ssh_ready: false, error: "Git 企业身份与 CDO 登录不一致" };
+  }
+  const teaLogin = `cdo-${safeProfileIdentity(gitProfileId(context, facts))}`;
+  const teaResult = run("tea", ["api", "--login", teaLogin, "/user"], { encoding: "utf8", timeout: 10_000 });
+  const sshResult = run("ssh", ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10", sshHost], { encoding: "utf8", timeout: 15_000 });
+  const teaBindingReady = await teaLoginMatches({
+    environment, home, name: teaLogin, url: facts.gitea_url, user: facts.username,
+  });
+  const teaApiReady = teaBindingReady && authenticatedTea(teaResult, facts.username);
+  const gitSshReady = authenticatedSSH(sshResult, facts.username);
+  return {
+    status: teaApiReady && gitSshReady ? "authenticated" : "not_authenticated",
+    tea_login: teaLogin,
+    tea_api_ready: teaApiReady,
+    git_ssh_ready: gitSshReady,
+    enterprise_id: facts.enterprise_id,
+    username: facts.username,
+  };
+}
+
+export async function gitAuth({ context, openBrowser, environment = process.env, home = homedir(), fetchImplementation = fetch, executeImplementation = execute }) {
+  await executeImplementation("git", ["--version"]);
+  await executeImplementation("tea", ["--version"]);
+  const control = validateGitControl(
+    environment.CDO_GIT_API_URL || GIT_CONTROLS[context.environmentName],
+    context.environmentName,
+    environment.CDO_GIT_API_URL ? "CDO_GIT_API_URL" : "Git 控制面地址",
+  );
+  const requestApi = async (path, init = {}) => responseJson(await fetchImplementation(new URL(path, control), {
+    ...init, headers: { Authorization: `ApiKey ${context.profile.personal_api_key}`, "X-CDO-Client": "cdo-cli", "X-CDO-Version": VERSION, "Content-Type": "application/json", ...(init.headers || {}) },
+    redirect: "error", signal: AbortSignal.timeout(20_000),
+  }), "Git 身份验证失败");
+  const expected = await requestApi("/api/v1/git/readiness");
+  validateGitReadiness(expected, context.environmentName);
+  if (context.profile.enterprise?.id && context.profile.enterprise.id !== expected.enterprise_id) throw new Error("CDO 企业身份改变，请重新登录");
+  const profileId = gitProfileId(context, expected);
+  const locations = gitLocations(profileId, home);
+  await mkdir(dirname(locations.key), { recursive: true, mode: 0o700 });
+  if (!(await regularFile(locations.key))) await executeImplementation("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-f", locations.key]);
+  await chmod(locations.key, 0o600);
+  const publicKey = (await executeImplementation("ssh-keygen", ["-y", "-f", locations.key])).stdout.trim();
+  const state = randomBytes(32).toString("base64url");
+  const verifier = randomBytes(32).toString("base64url");
+  let facts;
+  let callback;
+  const code = await new Promise((resolve, reject) => {
+    let settled = false;
+    const server = createServer((request, response) => {
+      const url = new URL(request.url || "/", "http://127.0.0.1");
+      const returned = url.searchParams.get("state") || "";
+      if (request.method !== "GET" || url.pathname !== "/" || returned.length !== state.length || !timingSafeEqual(Buffer.from(returned), Buffer.from(state))) {
+        response.writeHead(400).end("invalid OAuth callback"); return;
+      }
+      const value = url.searchParams.get("code");
+      if (!value) { response.writeHead(400).end("OAuth authorization denied"); finish(new Error("Git OAuth 授权未完成")); return; }
+      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }).end("<!doctype html><meta charset=utf-8><title>CDO Git 已授权</title><p>可以关闭此页面并返回终端。</p>");
+      finish(null, value);
+    });
+    const timer = setTimeout(() => finish(new Error("Git OAuth 等待授权超时")), 300_000);
+    const finish = (error, value) => { if (settled) return; settled = true; clearTimeout(timer); server.close(); error ? reject(error) : resolve(value); };
+    server.on("error", finish);
+    server.listen(0, "127.0.0.1", async () => {
+      try {
+        callback = `http://127.0.0.1:${server.address().port}/`;
+        facts = await requestApi("/api/v1/git/auth", { method: "POST", body: JSON.stringify({ public_key: publicKey, redirect_uri: callback, state, code_challenge: createHash("sha256").update(verifier).digest("base64url") }) });
+        validateGitReadiness(facts, context.environmentName);
+        if (facts.enterprise_id !== expected.enterprise_id || facts.username !== expected.username || facts.gitea_url !== expected.gitea_url) throw new Error("Git 认证企业不一致");
+        const browser = new URL(facts.browser_url);
+        if (browser.origin !== new URL(control).origin || browser.pathname !== "/api/v1/git/start") throw new Error("Git 认证入口不属于当前控制面");
+        await openBrowser(browser.toString());
+      } catch (error) { finish(error); }
+    });
+  });
+  const tokens = await responseJson(await fetchImplementation(`${facts.gitea_url}/login/oauth/access_token`, {
+    method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, redirect: "error", signal: AbortSignal.timeout(20_000),
+    body: new URLSearchParams({ grant_type: "authorization_code", client_id: facts.client_id, redirect_uri: callback, code_verifier: verifier, code }),
+  }), "Git OAuth 交换失败");
+  if (!tokens.access_token || !tokens.refresh_token || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0) throw new Error("Git OAuth 响应无效");
+  const headers = { Authorization: `Bearer ${tokens.access_token}` };
+  const user = await responseJson(await fetchImplementation(`${facts.gitea_url}/api/v1/user`, { headers }), "Git 身份复验失败");
+  const member = await fetchImplementation(`${facts.gitea_url}/api/v1/orgs/${facts.organization}/members/${facts.username}`, { headers });
+  if (user.login !== facts.username || user.id !== facts.id || user.is_admin || member.status !== 204) throw new Error("Gitea 身份与 CDO 企业员工不一致，未保存凭据");
+  const current = await requestApi("/api/v1/git/readiness");
+  if (current.username !== facts.username || current.enterprise_id !== facts.enterprise_id) throw new Error("CDO 身份已改变");
+  const sshHostAlias = `cdo-${safeProfileIdentity(profileId)}`;
+  await withFileLock(locations.sshConfig, async () => {
+    const existing = await regularFile(locations.sshConfig) ? await readFile(locations.sshConfig, "utf8") : "";
+    await atomicPrivate(locations.sshConfig, sshBlock(existing, profileId, facts.ssh_url, locations.key));
+  });
+  const teaLogin = `cdo-${safeProfileIdentity(profileId)}`;
+  await saveTea(await teaConfigPath(environment, home), { name: teaLogin, url: facts.gitea_url, user: facts.username, ssh_host: sshHostAlias, ssh_key: locations.key }, tokens);
+  const teaResult = await executeImplementation("tea", ["api", "--login", teaLogin, "/user"]);
+  if (!authenticatedTea(teaResult, facts.username)) throw new Error("Tea 身份复验失败");
+  let sshResult;
+  try {
+    sshResult = await executeImplementation("ssh", ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10", sshHostAlias]);
+  } catch (error) {
+    sshResult = error;
+  }
+  if (!authenticatedSSH(sshResult, facts.username)) throw new Error("Git SSH 身份复验失败");
+  return { ...current, profile_id: profileId, tea_login: teaLogin, ssh_host_alias: sshHostAlias, git_ssh_configured: true, git_ssh_ready: true, tea_api_ready: true };
+}

package/lib/login.mjs

@@ -0,0 +1,167 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+
+import {
+  apiOriginForEnvironment,
+  endpointForEnvironment,
+  upsertProfile,
+  validateEnterpriseCode,
+  validateEndpointEnvironment,
+  validateEnvironment,
+} from "./config.mjs";
+
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+
+function sameSecret(left, right) {
+  const one = Buffer.from(left || "");
+  const two = Buffer.from(right || "");
+  return one.length === two.length && timingSafeEqual(one, two);
+}
+
+function completePage() {
+  return '<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>CDO CLI 已授权</title><body style="margin:0;min-height:100vh;display:grid;place-items:center;background:#faf9f5;font:17px system-ui"><main style="padding:40px;background:white;border:1px solid #e8e6dc;border-radius:16px;text-align:center"><h1>CDO CLI 已授权</h1><p>可以关闭此页面并返回终端。</p></main></body></html>';
+}
+
+function responseError(response, body) {
+  return body?.error?.message || body?.message || `登录交换失败 (${response.status})`;
+}
+
+/** Validate the complete server identity envelope before atomically persisting a user Key. */
+export async function persistLoginResult(result, {
+  normalizedEndpoint,
+  selectedEnvironment,
+  selectedEnterprise,
+  setDefault = false,
+  environment = process.env,
+}) {
+  validateEndpointEnvironment(normalizedEndpoint, selectedEnvironment, "登录 API 地址");
+  let returnedEndpoint;
+  try {
+    returnedEndpoint = validateEndpointEnvironment(
+      result?.api_base_url,
+      selectedEnvironment,
+      "登录响应 API 地址",
+    );
+  } catch {
+    throw new Error("登录交换身份、环境或 Key 响应无效，未保存配置");
+  }
+  const returnedApiBaseUrl = returnedEndpoint.toString().replace(/\/$/, "");
+  const allowedReturnedOrigins = [
+    endpointForEnvironment(selectedEnvironment, selectedEnterprise),
+    apiOriginForEnvironment(selectedEnvironment),
+  ];
+  if (!result?.api_key || !result?.key_id
+      || !allowedReturnedOrigins.includes(returnedApiBaseUrl)
+      || result.enterprise?.abbr !== selectedEnterprise || !result.enterprise?.id || !result.user?.id) {
+    throw new Error("登录交换身份、环境或 Key 响应无效，未保存配置");
+  }
+  const profile = await upsertProfile({
+    environment: selectedEnvironment,
+    api_base_url: returnedApiBaseUrl,
+    enterprise: result.enterprise,
+    user: result.user,
+    key_id: result.key_id,
+    personal_api_key: result.api_key,
+  }, { setDefault, environment });
+  result.profile_id = profile.id;
+  result.profile_alias = profile.alias;
+  result.api_base_url = returnedApiBaseUrl;
+  return result;
+}
+
+/** Run the browser/loopback PKCE handoff and persist only the returned user Key. */
+export async function login({
+  environmentName,
+  enterpriseCode,
+  apiBaseUrl = null,
+  setDefault = false,
+  environment = process.env,
+  openBrowser,
+  fetchImplementation = fetch,
+  write = (value) => process.stdout.write(value),
+}) {
+  const selectedEnvironment = validateEnvironment(environmentName);
+  const selectedEnterprise = validateEnterpriseCode(enterpriseCode);
+  const endpoint = validateEndpointEnvironment(
+    apiBaseUrl || endpointForEnvironment(selectedEnvironment, selectedEnterprise),
+    selectedEnvironment,
+    "--api-url",
+  );
+  endpoint.pathname = "/";
+  endpoint.search = "";
+  endpoint.hash = "";
+  const normalizedEndpoint = endpoint.toString().replace(/\/$/, "");
+  // The API may use the shared official origin; interactive login always belongs to the selected enterprise host.
+  const browserEndpoint = endpointForEnvironment(selectedEnvironment, selectedEnterprise);
+  if (![browserEndpoint, apiOriginForEnvironment(selectedEnvironment)].includes(normalizedEndpoint)) {
+    throw new Error("--api-url 与 --enterprise 不匹配");
+  }
+  const state = randomBytes(32).toString("base64url");
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+
+  const { code, redirectUri } = await new Promise((resolve, reject) => {
+    let settled = false;
+    const server = createServer((request, response) => {
+      const callback = new URL(request.url || "/", "http://127.0.0.1");
+      const returnedState = callback.searchParams.get("state") || "";
+      if (request.method !== "GET" || callback.pathname !== "/auth/callback" || !sameSecret(returnedState, state)) {
+        response.writeHead(400, { "Cache-Control": "no-store" }).end("invalid login callback");
+        return;
+      }
+      const returnedCode = callback.searchParams.get("code");
+      if (!returnedCode) {
+        response.writeHead(400, { "Cache-Control": "no-store" }).end("missing authorization code");
+        finish(new Error("登录回调缺少一次性 code"));
+        return;
+      }
+      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+      response.end(completePage());
+      finish(null, { code: returnedCode, redirectUri });
+    });
+    const timer = setTimeout(() => finish(new Error("等待浏览器登录超时")), LOGIN_TIMEOUT_MS);
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server.close();
+      error ? reject(error) : resolve(value);
+    };
+    let redirectUri;
+    server.on("error", finish);
+    server.listen(0, "127.0.0.1", async () => {
+      try {
+        redirectUri = `http://127.0.0.1:${server.address().port}/auth/callback`;
+        const authorizeUrl = new URL("/cli/authorize", browserEndpoint);
+        authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+        authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+        authorizeUrl.searchParams.set("code_challenge_method", "S256");
+        authorizeUrl.searchParams.set("state", state);
+        await openBrowser(authorizeUrl.toString());
+        write(`请在浏览器完成 ${selectedEnterprise} 的 CDO 登录…\n`);
+      } catch (error) {
+        finish(error);
+      }
+    });
+  });
+
+  const response = await fetchImplementation(new URL("/api/v1/auth/cli-key-exchanges", browserEndpoint), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    redirect: "error",
+    signal: AbortSignal.timeout(20_000),
+    body: JSON.stringify({ code, redirect_uri: redirectUri, code_verifier: codeVerifier }),
+  });
+  let envelope;
+  try {
+    envelope = await response.json();
+  } catch {
+    throw new Error("登录交换响应不是有效 JSON");
+  }
+  if (!response.ok) throw new Error(responseError(response, envelope));
+  const result = await persistLoginResult(envelope?.data, {
+    normalizedEndpoint, selectedEnvironment, selectedEnterprise, setDefault, environment,
+  });
+  write(`CDO 登录成功：${result.enterprise.name}（${result.enterprise.abbr}），用户 ${result.user.name || result.user.id}；profile ${result.profile_alias} (${result.profile_id})。\n`);
+  return result;
+}