@puyinkai/xiaobao-cli 0.1.6 → 0.1.8

package/dist/{api-JZnABA4y.mjs → api-CX99_4K7.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { t as loadActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";
@@ -60,9 +60,10 @@ var api_default = defineCommand({
 			type: "string",
 			description: "自定义 headers，`K1=V1&K2=V2` 或 `K=V,K=V`。与默认注入的 tenant/project headers 合并（同名 key 用户传入优先）"
 		},
-		"no-default-headers": {
+		"default-headers": {
 			type: "boolean",
-			description: "不要默认注入 X-Tenant-Id / X-Project-Id headers（默认会按当前激活项目自动注入，调 /ai-open/* 开箱即用）"
+			default: true,
+			description: "默认按当前激活项目自动注入 X-Tenant-Id / X-Project-Id headers（调 /ai-open/* 开箱即用）；`--no-default-headers` 关闭注入"
 		},
 		"api-base": { type: "string" },
 		"auth-base": { type: "string" },
@@ -93,7 +94,7 @@ var api_default = defineCommand({
 			}
 			let mergedHeaders;
 			const userHeaders = parseKV(args.headers);
-			if (!args["no-default-headers"]) {
+			if (args["default-headers"]) {
 				const active = await loadActiveProject();
 				if (active) mergedHeaders = {
 					...tenantProjectHeaders(active),

package/dist/{api-client-DWbwtQbl.mjs → api-client-zDBFgk0y.mjs}

@@ -1,5 +1,5 @@
 import { r as refreshToken } from "./device-flow-D6JVcEap.mjs";
-import { a as writeToken, i as readToken, r as isAccessTokenValid } from "./token-store-D2umpIk-.mjs";
+import { a as isAccessTokenValid, l as writeToken, s as readToken } from "./token-store-CXizLE2_.mjs";
 //#region src/core/api-client.ts
 /**
 * HTTP client for wangxiaobao open API endpoints.

package/dist/{audio-BHWH6uhw.mjs → audio-ShfvRomP.mjs}

@@ -6,8 +6,8 @@ var audio_default = defineCommand({
 		description: "录音元数据分页 / 单条文本查询"
 	},
 	subCommands: {
-		list: () => import("./list-VpZkzTEE.mjs").then((m) => m.default),
-		text: () => import("./text-5q8lIWi8.mjs").then((m) => m.default)
+		list: () => import("./list-DCcCS6LM.mjs").then((m) => m.default),
+		text: () => import("./text-C3jhdPoe.mjs").then((m) => m.default)
 	}
 });
 //#endregion

package/dist/{auth-BpzWivxf.mjs → auth-DpK81Vp5.mjs}

@@ -6,9 +6,9 @@ var auth_default = defineCommand({
 		description: "OAuth 登录 / 身份查询 / 登出（device flow）"
 	},
 	subCommands: {
-		login: () => import("./login-DtDxISE8.mjs").then((m) => m.default),
-		whoami: () => import("./whoami-Uv7GBtGB.mjs").then((m) => m.default),
-		logout: () => import("./logout-DVJX8_x6.mjs").then((m) => m.default)
+		login: () => import("./login-CUUcjWPd.mjs").then((m) => m.default),
+		whoami: () => import("./whoami-CZVez-rm.mjs").then((m) => m.default),
+		logout: () => import("./logout-DP7REhCd.mjs").then((m) => m.default)
 	}
 });
 //#endregion

package/dist/cli.mjs

@@ -18,16 +18,16 @@ runMain(defineCommand({
 		description: "旺小宝 CLI — host-agnostic 14 tools (openclaw-xiaobao plugin 的 CLI 等价物)"
 	},
 	subCommands: {
-		auth: () => import("./auth-BpzWivxf.mjs").then((m) => m.default),
-		project: () => import("./project-CJkTgGOq.mjs").then((m) => m.default),
-		consultant: () => import("./consultant-kV5r8Wj8.mjs").then((m) => m.default),
-		audio: () => import("./audio-BHWH6uhw.mjs").then((m) => m.default),
-		customer: () => import("./customer-B2OV8BTR.mjs").then((m) => m.default),
-		visit: () => import("./visit-CUI2ov-H.mjs").then((m) => m.default),
-		focus: () => import("./focus-BjWD5PRV.mjs").then((m) => m.default),
-		resistance: () => import("./resistance-Ss-eUZoN.mjs").then((m) => m.default),
-		qa: () => import("./qa-CQDRFw-g.mjs").then((m) => m.default),
-		api: () => import("./api-JZnABA4y.mjs").then((m) => m.default)
+		auth: () => import("./auth-DpK81Vp5.mjs").then((m) => m.default),
+		project: () => import("./project-BuQQewOs.mjs").then((m) => m.default),
+		consultant: () => import("./consultant-CS9B42d3.mjs").then((m) => m.default),
+		audio: () => import("./audio-ShfvRomP.mjs").then((m) => m.default),
+		customer: () => import("./customer-B1cxRbJ9.mjs").then((m) => m.default),
+		visit: () => import("./visit-CX0Mc1n6.mjs").then((m) => m.default),
+		focus: () => import("./focus-DfNPPhm5.mjs").then((m) => m.default),
+		resistance: () => import("./resistance-DsE-Ha6Y.mjs").then((m) => m.default),
+		qa: () => import("./qa-CKsKiQIm.mjs").then((m) => m.default),
+		api: () => import("./api-CX99_4K7.mjs").then((m) => m.default)
 	}
 }));
 //#endregion

package/dist/{consultant-kV5r8Wj8.mjs → consultant-CS9B42d3.mjs}

@@ -5,7 +5,7 @@ var consultant_default = defineCommand({
 		name: "consultant",
 		description: "查询有权限的置业顾问列表"
 	},
-	subCommands: { list: () => import("./list-CVMSGK08.mjs").then((m) => m.default) }
+	subCommands: { list: () => import("./list-Cu6WzPpA.mjs").then((m) => m.default) }
 });
 //#endregion
 export { consultant_default as default };

package/dist/{customer-B2OV8BTR.mjs → customer-B1cxRbJ9.mjs}

@@ -5,7 +5,7 @@ var customer_default = defineCommand({
 		name: "customer",
 		description: "客户画像分页查询"
 	},
-	subCommands: { list: () => import("./list-h1nuSJiN.mjs").then((m) => m.default) }
+	subCommands: { list: () => import("./list-CnlFIFiY.mjs").then((m) => m.default) }
 });
 //#endregion
 export { customer_default as default };

package/dist/{focus-BjWD5PRV.mjs → focus-DfNPPhm5.mjs}

@@ -5,7 +5,7 @@ var focus_default = defineCommand({
 		name: "focus",
 		description: "客户关注点标签分页查询"
 	},
-	subCommands: { list: () => import("./list-Bw8dFf8a.mjs").then((m) => m.default) }
+	subCommands: { list: () => import("./list-D56gEqiB.mjs").then((m) => m.default) }
 });
 //#endregion
 export { focus_default as default };

package/dist/{list-CHububT5.mjs → list-CD08BRLk.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{list-FM3vkQJa.mjs → list-CKlx8YuL.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{list-h1nuSJiN.mjs → list-CnlFIFiY.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{list-CVMSGK08.mjs → list-Cu6WzPpA.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{list-Bw8dFf8a.mjs → list-D56gEqiB.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{list-VpZkzTEE.mjs → list-DCcCS6LM.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{list-C30zFN6h.mjs → list-DI1OD95x.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/project/list.ts

package/dist/login-CUUcjWPd.mjs

@@ -0,0 +1,156 @@
+import { a as resolveConfig, n as pollForToken, r as refreshToken, t as initiateDeviceAuthorization } from "./device-flow-D6JVcEap.mjs";
+import { a as isAccessTokenValid, c as writePendingAuth, l as writeToken, n as clearPendingAuth, o as readPendingAuth, r as clearToken, s as readToken, t as NoPendingAuthError } from "./token-store-CXizLE2_.mjs";
+import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";
+import { defineCommand } from "citty";
+//#region src/commands/auth/login.ts
+/**
+* `xiaobao-cli auth login` — OAuth 2.0 Device Authorization Grant.
+*
+* Three modes:
+*
+*   1. Default (blocking)  — cache hit / refresh / else initiate the device
+*      flow and synchronously poll until success/denial/expiry. Best for a
+*      human running it directly in a terminal.
+*
+*   2. `--no-wait` (non-blocking, agent-friendly split-flow step 1) — cache
+*      hit / refresh as usual; otherwise initiate the device flow, persist
+*      the device_code locally (~/.xiaobao/pending-auth.json, mode 0600) and
+*      return immediately with the verification URL — WITHOUT polling and
+*      WITHOUT exposing the credential-grade device_code on stdout. The agent
+*      forwards the URL to the user, ends its turn, then runs step 2.
+*
+*   3. `--resume` (split-flow step 2) — read the locally-saved device_code
+*      and exchange it for a token; no argument needed. `--device-code <code>`
+*      remains as an explicit escape hatch and takes precedence when given.
+*/
+var login_default = defineCommand({
+	meta: {
+		name: "login",
+		description: "走 OAuth device flow 登录（--no-wait 非阻塞发起 / --resume 完成）"
+	},
+	args: {
+		force: {
+			type: "boolean",
+			description: "强制清除缓存并重新发起设备授权流程"
+		},
+		wait: {
+			type: "boolean",
+			default: true,
+			description: "默认阻塞轮询直到授权完成。`--no-wait` 则发起 device flow 后立即返回 verification_uri 不轮询（device_code 安全存本地，不进 stdout）；用户授权后 再用 `auth login --resume` 完成换 token。"
+		},
+		resume: {
+			type: "boolean",
+			description: "split-flow 第二步：用上次 `--no-wait` 本地保存的 device_code 换 token，用户在浏览器授权后跑，无需手动传 device_code。"
+		},
+		"device-code": {
+			type: "string",
+			description: "（高级 escape hatch）显式传入 device_code 换 token；一般用 `--resume` 即可，CLI 会自动读取本地保存的 device_code。"
+		},
+		"api-base": {
+			type: "string",
+			description: "覆盖 API base URL"
+		},
+		"auth-base": {
+			type: "string",
+			description: "覆盖 auth base URL"
+		},
+		format: {
+			type: "string",
+			default: "json"
+		}
+	},
+	async run({ args }) {
+		const config = resolveConfig({
+			apiBase: args["api-base"],
+			authBase: args["auth-base"]
+		});
+		const fmt = args.format;
+		try {
+			if (args.resume || args["device-code"]) {
+				let deviceCode;
+				let remainingSeconds = 300;
+				if (args["device-code"]) deviceCode = String(args["device-code"]);
+				else {
+					const pending = await readPendingAuth();
+					if (!pending) throw new NoPendingAuthError();
+					if (pending.expires_at <= Date.now()) {
+						await clearPendingAuth();
+						throw new NoPendingAuthError("设备授权已过期，device_code 失效");
+					}
+					deviceCode = pending.device_code;
+					remainingSeconds = Math.max(1, Math.ceil((pending.expires_at - Date.now()) / 1e3));
+				}
+				const saved = await writeToken(await pollForToken(config, deviceCode, 2, remainingSeconds));
+				await clearPendingAuth();
+				writeResult({
+					source: "device-flow",
+					expires_at: saved.expires_at,
+					scope: saved.scope,
+					message: "登录成功，可以正常使用别的命令了"
+				}, fmt);
+				return;
+			}
+			if (!args.force) {
+				const cached = await readToken();
+				if (isAccessTokenValid(cached)) {
+					writeResult({
+						source: "cache",
+						expires_at: cached.expires_at,
+						scope: cached.scope
+					}, fmt);
+					return;
+				}
+				if (cached?.refresh_token) try {
+					const saved = await writeToken(await refreshToken(config, cached.refresh_token));
+					writeResult({
+						source: "refresh",
+						expires_at: saved.expires_at,
+						scope: saved.scope
+					}, fmt);
+					return;
+				} catch {
+					await clearToken();
+				}
+			} else await clearToken();
+			const init = await initiateDeviceAuthorization(config);
+			const verificationUri = init.verification_uri_complete || init.verification_uri;
+			const expiresMinutes = Math.max(1, Math.round(init.expires_in / 60));
+			const interval = init.interval ?? 5;
+			if (!args.wait) {
+				await writePendingAuth({
+					device_code: init.device_code,
+					user_code: init.user_code,
+					verification_uri: verificationUri,
+					interval,
+					expires_at: Date.now() + init.expires_in * 1e3
+				});
+				writeResult({
+					awaiting_authorization: true,
+					verification_uri: verificationUri,
+					user_code: init.user_code,
+					expires_in: init.expires_in,
+					interval,
+					message: "请在浏览器打开 verification_uri 完成授权，然后跑 `xiaobao-cli auth login --resume` 完成登录。device_code 已安全保存在本地，无需手动传。"
+				}, fmt);
+				return;
+			}
+			process.stderr.write(`
+请在浏览器中打开以下链接完成登录并授权访问你的旺小宝账号:
+\n  🔗 ${verificationUri}\n\n  设备验证码: ${init.user_code}\n  有效期约 ${expiresMinutes} 分钟\n\n等待你在浏览器中确认 ...
+`);
+			const saved = await writeToken(await pollForToken(config, init.device_code, interval, init.expires_in));
+			await clearPendingAuth();
+			writeResult({
+				source: "device-flow",
+				expires_at: saved.expires_at,
+				scope: saved.scope,
+				message: "登录成功，token 已缓存到 ~/.xiaobao/token.json"
+			}, fmt);
+		} catch (err) {
+			writeError(err, fmt);
+			process.exit(1);
+		}
+	}
+});
+//#endregion
+export { login_default as default };

package/dist/{logout-DVJX8_x6.mjs → logout-DP7REhCd.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig, i as revokeRefreshToken } from "./device-flow-D6JVcEap.mjs";
-import { i as readToken, t as clearToken } from "./token-store-D2umpIk-.mjs";
+import { n as clearPendingAuth, r as clearToken, s as readToken } from "./token-store-CXizLE2_.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/auth/logout.ts
@@ -33,6 +33,7 @@ var logout_default = defineCommand({
 			let revoked = false;
 			if (cached?.refresh_token) revoked = await revokeRefreshToken(config, cached.refresh_token);
 			await clearToken();
+			await clearPendingAuth();
 			writeResult({
 				message: "Logged out",
 				remote_revoked: revoked,

package/dist/{project-CJkTgGOq.mjs → project-BuQQewOs.mjs}

@@ -6,7 +6,7 @@ var project_default = defineCommand({
 		description: "查询 / 切换激活项目"
 	},
 	subCommands: {
-		list: () => import("./list-C30zFN6h.mjs").then((m) => m.default),
+		list: () => import("./list-DI1OD95x.mjs").then((m) => m.default),
 		use: () => import("./use-BZES4FZC.mjs").then((m) => m.default),
 		current: () => import("./current-CfDExInT.mjs").then((m) => m.default)
 	}

package/dist/{qa-CQDRFw-g.mjs → qa-CKsKiQIm.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{resistance-Ss-eUZoN.mjs → resistance-DsE-Ha6Y.mjs}

@@ -5,7 +5,7 @@ var resistance_default = defineCommand({
 		name: "resistance",
 		description: "客户抗性点标签分页查询"
 	},
-	subCommands: { list: () => import("./list-FM3vkQJa.mjs").then((m) => m.default) }
+	subCommands: { list: () => import("./list-CKlx8YuL.mjs").then((m) => m.default) }
 });
 //#endregion
 export { resistance_default as default };

package/dist/{text-5q8lIWi8.mjs → text-C3jhdPoe.mjs}

@@ -1,5 +1,5 @@
 import { a as resolveConfig } from "./device-flow-D6JVcEap.mjs";
-import { t as xbApiFetch } from "./api-client-DWbwtQbl.mjs";
+import { t as xbApiFetch } from "./api-client-zDBFgk0y.mjs";
 import { n as requireActiveProject } from "./project-store-CKVJa54T.mjs";
 import { t as tenantProjectHeaders } from "./headers-DSnR4sjk.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";

package/dist/{token-store-D2umpIk-.mjs → token-store-CXizLE2_.mjs}

@@ -19,6 +19,7 @@ import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 const PRIMARY_DIR = join(homedir(), ".xiaobao");
 const PRIMARY_TOKEN_FILE = join(PRIMARY_DIR, "token.json");
 const LEGACY_TOKEN_FILE = join(homedir(), ".openclaw", "state", "wangxiaobao", "token.json");
+const PENDING_AUTH_FILE = join(PRIMARY_DIR, "pending-auth.json");
 /**
 * Read order: primary → legacy fallback. Returns null if both missing.
 */
@@ -85,5 +86,40 @@ function decodeJwtPayload(jwt) {
 		return null;
 	}
 }
+async function writePendingAuth(p) {
+	await mkdir(PRIMARY_DIR, {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(PENDING_AUTH_FILE, JSON.stringify(p, null, 2), { mode: 384 });
+	try {
+		await chmod(PENDING_AUTH_FILE, 384);
+	} catch {}
+}
+async function readPendingAuth() {
+	if (!existsSync(PENDING_AUTH_FILE)) return null;
+	try {
+		return JSON.parse(await readFile(PENDING_AUTH_FILE, "utf-8"));
+	} catch (e) {
+		if (e.code === "ENOENT") return null;
+		throw e;
+	}
+}
+async function clearPendingAuth() {
+	try {
+		await unlink(PENDING_AUTH_FILE);
+	} catch (e) {
+		if (e.code !== "ENOENT") throw e;
+	}
+}
+/** Thrown by `auth login --resume` when there is no usable pending device_code. */
+var NoPendingAuthError = class extends Error {
+	code = "NO_PENDING_AUTH";
+	hint = "先跑 `xiaobao-cli auth login --no-wait` 发起设备授权，在浏览器完成授权后再跑 `xiaobao-cli auth login --resume`。";
+	constructor(message = "没有待完成的设备授权（从未发起，或 device_code 已过期）") {
+		super(message);
+		this.name = "NoPendingAuthError";
+	}
+};
 //#endregion
-export { writeToken as a, readToken as i, decodeJwtPayload as n, isAccessTokenValid as r, clearToken as t };
+export { isAccessTokenValid as a, writePendingAuth as c, decodeJwtPayload as i, writeToken as l, clearPendingAuth as n, readPendingAuth as o, clearToken as r, readToken as s, NoPendingAuthError as t };

package/dist/{visit-CUI2ov-H.mjs → visit-CX0Mc1n6.mjs}

@@ -5,7 +5,7 @@ var visit_default = defineCommand({
 		name: "visit",
 		description: "客户来访分页查询"
 	},
-	subCommands: { list: () => import("./list-CHububT5.mjs").then((m) => m.default) }
+	subCommands: { list: () => import("./list-CD08BRLk.mjs").then((m) => m.default) }
 });
 //#endregion
 export { visit_default as default };

package/dist/{whoami-Uv7GBtGB.mjs → whoami-CZVez-rm.mjs}

@@ -1,4 +1,4 @@
-import { i as readToken, n as decodeJwtPayload } from "./token-store-D2umpIk-.mjs";
+import { i as decodeJwtPayload, s as readToken } from "./token-store-CXizLE2_.mjs";
 import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/auth/whoami.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@puyinkai/xiaobao-cli",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "旺小宝 CLI — host-agnostic 14 tools (openclaw-xiaobao plugin 的 CLI 等价物)",
   "type": "module",
   "bin": {

package/skills/wangxiaobao-shared/SKILL.md

@@ -30,8 +30,8 @@ npx -y @puyinkai/xiaobao-cli <subcommand>...
 任何 xiaobao-cli 命令的**前置 3 步**：
 
 ```bash
-# 1. 登录（OAuth device flow，5 分钟内浏览器授权一次，token 自动缓存）
-xiaobao-cli auth login
+# 1. 登录（OAuth device flow 非阻塞 split-flow，token 自动缓存）—— 见下方
+xiaobao-cli auth login --no-wait
 
 # 2. 选激活项目（多租户 / 多项目场景必做；旺小宝是多租户业务）
 xiaobao-cli project list                # 列可选
@@ -44,6 +44,34 @@ xiaobao-cli customer list --portrait 高意向
 # ...
 ```
 
+### 登录 —— 用 `--no-wait` split-flow（两步、不阻塞）
+
+登录走 OAuth device flow，固定用下面的两步、全程不阻塞。**不要跑裸
+`xiaobao-cli auth login`** —— 它会阻塞轮询、卡满一整轮对话。
+
+```bash
+# 步骤 A：发起，立即返回（约 0.5s），拿到 verification_uri
+xiaobao-cli auth login --no-wait
+# stdout: { "awaiting_authorization": true, "verification_uri": "...",
+#           "user_code": "...", "expires_in": 300, "interval": 5, ... }
+# device_code 不在 stdout —— 已安全存到 ~/.xiaobao/pending-auth.json（0600）
+```
+
+agent 拿到后：把 `verification_uri` **原样**发给用户（放进只含 URL 的代码块，
+不要改写不要做 URL 编码），让用户浏览器打开授权，然后**结束本轮**，把控制权
+交还用户。
+
+```bash
+# 步骤 B：用户回复"授权完成"后，直接换 token（秒级）——
+# device_code 已由步骤 A 存在本地，--resume 自动读取，agent 无需持有 / 传递它
+xiaobao-cli auth login --resume
+# stdout: { "source": "device-flow", "expires_at": ..., "scope": "..." }
+```
+
+device_code 有效期 `expires_in` 秒（约 5 分钟）。超时就重跑步骤 A。
+若 token 仍有效 / refresh_token 可用，`--no-wait` 会直接走 cache/refresh
+快速返回（`source: cache` / `refresh`），不发起新的 device flow，也无需步骤 B。
+
 查身份 / 当前激活项目（任何时候都可以）：
 
 ```bash
@@ -106,6 +134,11 @@ Agent 消费时**只 parse stdout JSON**，stderr 是辅助。
 | OAuth tokens | access_token + refresh_token + id_token + expires_at | `~/.xiaobao/token.json` | 0600 |
 | Active project | tenantId / tenantName / projectId / projectName / updatedAt | `~/.xiaobao/active-project.json` | 0600 |
 | User config（可选） | 覆盖 authBase / apiBase / scopes | `~/.xiaobao/config.json` | 0600 |
+| Pending auth（临时） | `--no-wait` split-flow 进行中的 device_code / user_code / 过期时间 | `~/.xiaobao/pending-auth.json` | 0600 |
+
+`pending-auth.json` 是 split-flow 的临时凭据中转：`--no-wait` 写入、`--resume`
+成功换到 token 后删除，`auth logout` 或 device_code 过期时也会清掉。device_code
+属凭据级数据，**只落本地文件、绝不进 stdout / agent 上下文**。
 
 ### `~/.openclaw/state/wangxiaobao/` fallback（向后兼容 openclaw-xiaobao plugin 用户）
 

package/dist/login-DtDxISE8.mjs

@@ -1,91 +0,0 @@
-import { a as resolveConfig, n as pollForToken, r as refreshToken, t as initiateDeviceAuthorization } from "./device-flow-D6JVcEap.mjs";
-import { a as writeToken, i as readToken, r as isAccessTokenValid, t as clearToken } from "./token-store-D2umpIk-.mjs";
-import { n as writeResult, t as writeError } from "./format-yjmxrbNm.mjs";
-import { defineCommand } from "citty";
-//#region src/commands/auth/login.ts
-/**
-* `xiaobao-cli auth login` — OAuth 2.0 Device Authorization Grant.
-*
-* Behaviour:
-*   1. Cache hit (valid access_token, no --force) → return immediately.
-*   2. Refresh path (cached refresh_token, no --force) → refresh & store.
-*   3. Device flow → print verification URL + user_code to stderr (humans see
-*      it in the terminal), and synchronously poll until success/denial/expiry.
-*      Polls foreground so the CLI exits with a final structured result on
-*      stdout (agents waiting on stdout JSON get a definitive answer).
-*/
-var login_default = defineCommand({
-	meta: {
-		name: "login",
-		description: "走 OAuth device flow 登录"
-	},
-	args: {
-		force: {
-			type: "boolean",
-			description: "强制清除缓存并重新发起设备授权流程"
-		},
-		"api-base": {
-			type: "string",
-			description: "覆盖 API base URL"
-		},
-		"auth-base": {
-			type: "string",
-			description: "覆盖 auth base URL"
-		},
-		format: {
-			type: "string",
-			default: "json"
-		}
-	},
-	async run({ args }) {
-		const config = resolveConfig({
-			apiBase: args["api-base"],
-			authBase: args["auth-base"]
-		});
-		const fmt = args.format;
-		try {
-			if (!args.force) {
-				const cached = await readToken();
-				if (isAccessTokenValid(cached)) {
-					writeResult({
-						source: "cache",
-						expires_at: cached.expires_at,
-						scope: cached.scope
-					}, fmt);
-					return;
-				}
-				if (cached?.refresh_token) try {
-					const saved = await writeToken(await refreshToken(config, cached.refresh_token));
-					writeResult({
-						source: "refresh",
-						expires_at: saved.expires_at,
-						scope: saved.scope
-					}, fmt);
-					return;
-				} catch {
-					await clearToken();
-				}
-			} else await clearToken();
-			const init = await initiateDeviceAuthorization(config);
-			const verificationUri = init.verification_uri_complete || init.verification_uri;
-			const expiresMinutes = Math.max(1, Math.round(init.expires_in / 60));
-			const interval = init.interval ?? 5;
-			process.stderr.write(`
-请在浏览器中打开以下链接完成登录并授权访问你的旺小宝账号:
-\n  🔗 ${verificationUri}\n\n  设备验证码: ${init.user_code}\n  有效期约 ${expiresMinutes} 分钟\n\n等待你在浏览器中确认 ...
-`);
-			const saved = await writeToken(await pollForToken(config, init.device_code, interval, init.expires_in));
-			writeResult({
-				source: "device-flow",
-				expires_at: saved.expires_at,
-				scope: saved.scope,
-				message: "登录成功，token 已缓存到 ~/.xiaobao/token.json"
-			}, fmt);
-		} catch (err) {
-			writeError(err, fmt);
-			process.exit(1);
-		}
-	}
-});
-//#endregion
-export { login_default as default };