@helixlife-ai/xiantao 0.1.6 → 0.1.7

package/README.md

@@ -6,7 +6,7 @@ Install with `npm i -g @helixlife-ai/xiantao` and run it as `xt`.
 
 `tool` is the primary product topic for bioinformatics tools. `plot` is kept as a compatibility entrypoint for the current command set and prints a migration warning when executed.
 
-`--profile` is the primary profile selector for token lookup and config isolation, for example `default` or `openclaw`. `--agent` is kept as a compatibility alias.
+`--profile` is the primary profile selector for token lookup and config isolation. If it is omitted, the CLI resolves the profile from `AGENT_NAME`, then the host runtime (`cursor`, `opencode`, `openclaw`), then `~/.config/xtz/config.json`, and finally defaults to `opencode`. `--agent` is kept as a compatibility alias.
 
 `login`, `status`, and `logout` are the primary auth entrypoints. `auth ...` is kept as a compatibility topic and prints a migration warning when executed.
 
@@ -34,7 +34,7 @@ This starts a menu-driven path for choosing a tool, selecting demo data or a loc
 ### Agent Automation
 
 ```bash
-xt tool exec violin_flat --file ./data.xlsx --profile openclaw --json
+xt tool exec violin_flat --file ./data.xlsx --profile opencode --json
 ```
 
 For machine callers, use `xt tool exec`, keep `--json`, pass an explicit profile with `--profile`, and avoid interactive-only flows.
@@ -44,8 +44,10 @@ For machine callers, use `xt tool exec`, keep `--json`, pass an explicit profile
 ### Auth
 
 - `xt login`
+- `xt bind`
 - `xt status`
 - `xt logout`
+- `xt auth bind`
 - `xt tool login`
 
 ### Tool Run
@@ -73,6 +75,8 @@ For the common Xiantao tool product, `tool search`, `tool inspect`, `tool run`,
 
 When resolving tools from `--toolProductUuid`, the CLI caches the `/tool/menus?is_all=1` result locally for 12 hours per `profile + toolProductUuid` to avoid repeated full-menu fetches.
 
+For remote-agent flows where the Xiantao web login callback cannot hit the machine running the CLI, use `xt bind --xiantao-token <token> --profile openclaw`. The bind command creates the upload auth session, calls the same `/user/skills/bind_user` API directly, waits for confirmation, and persists both the upload token and the Xiantao token locally. If you already created the auth session elsewhere, you can reuse it with `xt bind --auth-key <auth_key> --token-key <token_key> --xiantao-token <token>`.
+
 ## Development
 
 ```bash

package/dist/commands/auth/bind.js

@@ -0,0 +1,53 @@
+import { Flags } from '@oclif/core';
+import { XtzCommand } from '../../base-command.js';
+import { loginAuth, waitForAuthorizedToken } from '../../lib/auth.js';
+import { globalFlags } from '../../lib/flags.js';
+import { bindUserWithXiantaoToken } from '../../lib/xiantao-auth.js';
+import { getTokenPath, getXiantaoTokenPath, loadXiantaoToken, saveToken } from '../../lib/storage.js';
+export default class AuthBind extends XtzCommand {
+    static description = 'Bind login remotely with a Xiantao web token without the localhost callback flow';
+    static flags = {
+        ...globalFlags,
+        'auth-key': Flags.string({
+            char: 'k',
+            description: 'Existing auth key returned by the upload authorization flow',
+        }),
+        'token-key': Flags.string({
+            description: 'Existing upload token key paired with --auth-key',
+        }),
+        'xiantao-token': Flags.string({
+            description: 'Bearer token for api.helixlife.net xiantao APIs; falls back to XIANTAO_TOKEN or the stored Xiantao web token',
+        }),
+    };
+    async run() {
+        this.warnIfLegacyAuthCommand();
+        const { flags } = await this.parse(AuthBind);
+        const agent = await this.getProfile(flags.profile);
+        const token = flags['xiantao-token']?.trim() || process.env.XIANTAO_TOKEN?.trim() || await loadXiantaoToken(agent);
+        if (!token) {
+            this.error(`未找到 ${agent} 的仙桃网页 token，请传 --xiantao-token、设置 XIANTAO_TOKEN，或先准备 ${getXiantaoTokenPath(agent)}`, { exit: 1 });
+        }
+        const auth = flags['auth-key']
+            ? {
+                authKey: flags['auth-key'],
+                token: flags['token-key']?.trim(),
+                tokenPath: getTokenPath(agent),
+            }
+            : await loginAuth(agent, false);
+        if (!auth.token) {
+            this.error('传 --auth-key 时必须同时传 --token-key', { exit: 1 });
+        }
+        if (flags['auth-key']) {
+            await saveToken(agent, auth.token);
+        }
+        const result = await bindUserWithXiantaoToken(agent, auth.authKey, token);
+        await waitForAuthorizedToken(auth.token);
+        this.print(flags, {
+            agent,
+            auth_key: auth.authKey,
+            bound: true,
+            token_path: auth.tokenPath,
+            xiantao_token_path: result.tokenPath,
+        }, `profile: ${agent}\nbound: true\nauth_key: ${auth.authKey}\ntoken: ${auth.tokenPath}\nxiantao_token: ${result.tokenPath}`);
+    }
+}

package/dist/commands/bind.js

@@ -0,0 +1,3 @@
+import AuthBind from './auth/bind.js';
+export default class Bind extends AuthBind {
+}

package/dist/lib/constants.js

@@ -1,4 +1,4 @@
-export const DEFAULT_AGENT = 'openclaw';
+export const DEFAULT_AGENT = 'opencode';
 export const XTZ_CONFIG_PATH = '.config/xtz/config.json';
 export const AUTH_URL_ENDPOINT = 'https://api.helixlife.net/api/v1/user/skills/auth_url';
 export const AUTH_BIND_ENDPOINT = 'https://api.helixlife.net/api/v1/user/skills/bind_user';

package/dist/lib/storage.js

@@ -135,11 +135,16 @@ export async function readXtzConfig() {
     }
 }
 export async function resolveAgent(agentFlag) {
-    if (agentFlag) {
-        return agentFlag;
+    const cliAgent = agentFlag?.trim();
+    if (cliAgent) {
+        return cliAgent;
+    }
+    const environmentAgent = resolveAgentFromEnvironment();
+    if (environmentAgent) {
+        return environmentAgent;
     }
     const config = await readXtzConfig();
-    return config.agent ?? DEFAULT_AGENT;
+    return config.agent?.trim() || DEFAULT_AGENT;
 }
 export async function resolveXiantaoToolProductUuid(toolProductUuidFlag) {
     if (toolProductUuidFlag?.trim()) {
@@ -184,3 +189,32 @@ async function readJsonFile(filePath) {
 function isNodeError(error) {
     return error instanceof Error && 'code' in error;
 }
+function resolveAgentFromEnvironment() {
+    const agentName = process.env.AGENT_NAME?.trim();
+    if (agentName) {
+        return agentName;
+    }
+    if (isCursorEnvironment()) {
+        return 'cursor';
+    }
+    if (isNamedEnvironment('OPENCODE')) {
+        return 'opencode';
+    }
+    if (isNamedEnvironment('OPENCLAW')) {
+        return 'openclaw';
+    }
+    return undefined;
+}
+function isCursorEnvironment() {
+    return Boolean(process.env.CURSOR_TRACE_ID?.trim()
+        || process.env.CURSOR_SESSION_ID?.trim()
+        || process.env.CURSOR_AGENT?.trim()
+        || process.env.VSCODE_GIT_ASKPASS_NODE?.includes('Cursor')
+        || process.env.TERM_PROGRAM?.toLowerCase() === 'cursor');
+}
+function isNamedEnvironment(name) {
+    return Boolean(process.env[name]?.trim()
+        || process.env[`${name}_AGENT`]?.trim()
+        || process.env[`${name}_SESSION_ID`]?.trim()
+        || process.env.TERM_PROGRAM?.toLowerCase() === name.toLowerCase());
+}

package/dist/lib/xiantao-auth.js

@@ -3,7 +3,7 @@ import { AUTH_BIND_ENDPOINT, PASSPORT_JUMP_ENDPOINT } from './constants.js';
 import { openUrl } from './open-url.js';
 import { XtzError } from './errors.js';
 import { requestJson } from './http.js';
-import { getXiantaoTokenPath, loadXiantaoToken, requireXiantaoToken, saveXiantaoToken } from './storage.js';
+import { loadXiantaoToken, requireXiantaoToken, saveXiantaoToken } from './storage.js';
 export async function getXiantaoAuthContext(agent, tokenOverride) {
     const token = tokenOverride?.trim() || process.env.XIANTAO_TOKEN?.trim() || await requireXiantaoToken(agent);
     return { agent, token };
@@ -29,24 +29,34 @@ export async function loginXiantao(agent) {
         tokenPath,
     };
 }
+export async function bindUserWithXiantaoToken(agent, authKey, token) {
+    await requestJson(AUTH_BIND_ENDPOINT, {
+        body: JSON.stringify({ auth_key: authKey }),
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+            origin: 'https://www.helixlife.net',
+            platform: 'pc',
+            referer: 'https://www.helixlife.net/',
+            source: 'PC',
+        },
+        method: 'POST',
+    }, { agent, tokenKind: 'xiantao' });
+    const tokenPath = await saveXiantaoToken(agent, token);
+    return {
+        browserOpened: false,
+        reused: true,
+        token,
+        tokenPath,
+    };
+}
 export async function bindUserWithStoredXiantaoToken(agent, authKey) {
     const auth = await loadXiantaoAuthContext(agent);
     if (!auth) {
         return undefined;
     }
     try {
-        await requestJson(AUTH_BIND_ENDPOINT, {
-            body: JSON.stringify({ auth_key: authKey }),
-            headers: {
-                Authorization: `Bearer ${auth.token}`,
-                'Content-Type': 'application/json',
-                origin: 'https://www.helixlife.net',
-                platform: 'pc',
-                referer: 'https://www.helixlife.net/',
-                source: 'PC',
-            },
-            method: 'POST',
-        }, { agent, tokenKind: 'xiantao' });
+        return await bindUserWithXiantaoToken(agent, authKey, auth.token);
     }
     catch (error) {
         if (error instanceof XtzError && error.message.includes('仙桃网页授权已过期或无效')) {
@@ -54,12 +64,6 @@ export async function bindUserWithStoredXiantaoToken(agent, authKey) {
         }
         throw error;
     }
-    return {
-        browserOpened: false,
-        reused: true,
-        token: auth.token,
-        tokenPath: getXiantaoTokenPath(agent),
-    };
 }
 async function createLoginSession() {
     let resolveToken;

package/dist/xtz-help.js

@@ -6,7 +6,7 @@ export default class XtzHelp extends Help {
         this.log(this.section('MAIN FLOWS', [
             ['First use', '$ xt login\n$ xt tool search violin\n$ xt tool inspect violin_flat\n$ xt tool run violin_flat ./data.xlsx'],
             ['Interactive tool run', '$ xt tool run --interactive'],
-            ['Agent automation', '$ xt tool:prepare violin_flat --file ./data.xlsx --profile openclaw --json\n$ xt tool exec violin_flat --file ./data.xlsx --profile openclaw --json'],
+            ['Agent automation', '$ xt tool:prepare violin_flat --file ./data.xlsx --profile opencode --json\n$ xt tool exec violin_flat --file ./data.xlsx --profile opencode --json'],
         ]));
         this.log('');
         this.log(this.section('COMMON COMMANDS', this.renderCommandItems([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helixlife-ai/xiantao",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "CLI for Xiantao bioinformatics tools",
   "type": "module",
   "main": "dist/index.js",