bdip-office-assistant-cli 0.0.0-stage → 1.0.1

package/dist/auth-token.js

@@ -0,0 +1,783 @@
+/**
+ * aiAgentToken 认证核心（对标 e9-cli lib/auth-token.js）。
+ *
+ * 链路：
+ *   loginForCookie（有头 autoFill，失败转手动；轮询 loginidweaver，60s hash-portal 兜底）
+ *   → 平台账号接口再次核验，关闭浏览器
+ *   → saveCookieToProfile（存 cookie 供回退，写回 config.json 对应字段）
+ *   → registerToken: GET /api/ai/agent/login/register 带 cookie → aiAgentToken（8h，加密存）
+ *       成功 → { token, expireTime, expireSeconds, cookieSavedAt, noToken:false }
+ *       404/异常 → { token:'', noToken:true }（回退 cookie）
+ *
+ * token 文件：~/.bdip/tokens/<profileName>.json（AES-256-GCM 加密）。
+ * profileName 由当前 baseUrl 的 hostname+port 派生（一个环境一个 token 文件）。
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execSync, spawn } from 'node:child_process';
+import { encrypt, decrypt } from './crypto.js';
+import { endpointFor, profileNameFromBaseUrl, updateConfigCookie } from './config.js';
+import { probeCookieSession, mergeResponseCookies, authFailureCode, latchForcedOffline } from './session.js';
+function rejectForcedOffline(cfg, state, checkedCookie = cfg?.cookie) {
+    if (state.code !== 'FORCED_OFFLINE') return;
+    if (cfg) latchForcedOffline(cfg, state, checkedCookie);
+    const error = new Error('当前会话已被强制下线（003/004），已停止续期与业务请求；请核实后重新登录。');
+    error.code = 'FORCED_OFFLINE';
+    throw error;
+}
+// token 文件固定写在 ~/.bdip/tokens/（与 storageState、config 的 ~/.bdip 回退一致），
+// 不再用 process.cwd()——否则换工作目录就找不到 token → 回退 cookie → 连锁触发续期弹浏览器
+const CONFIG_DIR = path.join(os.homedir(), '.bdip');
+const TOKEN_DIR = path.join(CONFIG_DIR, 'tokens');
+function ensureDir(p) {
+    if (!fs.existsSync(p))
+        fs.mkdirSync(p, { recursive: true });
+}
+function tokenFilePath(profileName) {
+    return path.join(TOKEN_DIR, `${profileName}.json`);
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/**
+ * 启动浏览器：优先用系统默认浏览器（注册表查），Chromium 系（Chrome/Edge/Brave）直接 executablePath 打开；
+ * 非 Chromium 系（Firefox 等）跳过 → 回退 channel chrome/msedge → 最后 Playwright 自带 chromium
+ * （自带内核未下载时才懒下载一次——见末尾兜底）。
+ */
+async function launchSystemBrowser(chromium, headless, args) {
+    // 1. 查系统默认浏览器路径
+    const defaultPath = getDefaultBrowserPath();
+    if (defaultPath) {
+        const lower = defaultPath.toLowerCase();
+        // Chromium 系浏览器可直接用 executablePath 打开
+        if (/chrome|msedge|edge|brave|chromium/i.test(lower)) {
+            try {
+                return await chromium.launch({ executablePath: defaultPath, headless, args });
+            }
+            catch {
+                /* 路径无效，试下一个 */
+            }
+        }
+        // Firefox 等非 Chromium 系：跳过（Playwright chromium 模块不支持），走下面的 channel 回退
+    }
+    // 2. 回退：试 channel chrome → msedge → Playwright 自带 chromium
+    for (const channel of ['chrome', 'msedge']) {
+        try {
+            return await chromium.launch({ channel, headless, args });
+        }
+        catch {
+            /* 未安装，试下一个 */
+        }
+    }
+    try {
+        return await chromium.launch({ headless, args });
+    }
+    catch (e) {
+        // 前两条都失败（系统无 Chrome/Edge/Brave）才走到这里：此时才需要 Playwright 自带内核。
+        // 懒加载：仅当这次 launch 是因为缺内核失败，才去下载；下载成功再重试一次。
+        const msg = String(e?.message || e);
+        const missingCore = /Executable doesn't exist|executablePath.*(exist|found)|not found.*browser|download.*chromium|Please run the following command|playwright install/i.test(msg);
+        if (!missingCore)
+            throw new Error(`无法启动浏览器（系统浏览器与 Playwright 自带内核均不可用）：${msg}`);
+        console.log('  [AUTH] 系统未检测到 Chrome/Edge/Brave，需下载 Playwright chromium 内核（约 120-200 MiB，仅此情况才需要）...');
+        const dl = await runCmd('npx playwright install chromium', 300000);
+        if (dl.code !== 0) {
+            throw new Error(`chromium 内核下载失败（exit ${dl.code}，网络可能拦截）。可手动 \`npx playwright install chromium\`，或改用 \`bdip auth cookie-login\`。`);
+        }
+        try {
+            return await chromium.launch({ headless, args });
+        }
+        catch (e2) {
+            throw new Error(`无法启动浏览器：${String(e2?.message || e2)}`);
+        }
+    }
+}
+/** 查系统默认浏览器可执行路径。Windows 用注册表；macOS 用 Launch Services；Linux 用 xdg-mime。 */
+function getDefaultBrowserPath() {
+    const tryExec = (cmd) => {
+        try {
+            return execSync(cmd, { encoding: 'utf8', timeout: 5000 }).trim();
+        }
+        catch {
+            return null;
+        }
+    };
+    if (process.platform === 'win32') {
+        // Windows: 注册表两步（ProgId → command → exe）
+        const out1 = tryExec('reg query "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice" /v ProgId');
+        const progIdMatch = out1?.match(/ProgId\s+REG_SZ\s+(\S+)/);
+        if (!progIdMatch)
+            return null;
+        const out2 = tryExec(`reg query "HKEY_CLASSES_ROOT\\${progIdMatch[1]}\\shell\\open\\command" /ve`);
+        const exeMatch = out2?.match(/"([^"]+\.exe)"/i);
+        return exeMatch ? exeMatch[1] : null;
+    }
+    if (process.platform === 'darwin') {
+        // macOS: Launch Services 查 http handler 的 bundle ID → mdfind 取 app 路径
+        const out = tryExec('defaults read com.apple.LaunchServices/com.apple.launchservices.secure LSHandlers 2>/dev/null');
+        if (!out)
+            return null;
+        const lines = out.split('\n');
+        let inHttps = false;
+        let bundleId = null;
+        for (const line of lines) {
+            if (line.includes('"https"'))
+                inHttps = true;
+            if (inHttps && line.includes('LSHandlerRoleViewer')) {
+                const m = line.match(/=\s*"([^"]+)"/);
+                if (m)
+                    bundleId = m[1];
+                inHttps = false;
+            }
+        }
+        if (!bundleId)
+            return null;
+        const appPath = tryExec(`mdfind "kMDItemCFBundleIdentifier == '${bundleId}'" 2>/dev/null | head -1`);
+        return appPath || null;
+    }
+    if (process.platform === 'linux') {
+        // Linux: xdg-mime 查默认 http handler → which 取路径
+        const handler = tryExec('xdg-mime query default x-scheme-handler/http 2>/dev/null');
+        if (!handler)
+            return null;
+        const exe = tryExec(`which ${handler} 2>/dev/null`) || tryExec(`which ${handler.split('.')[0]} 2>/dev/null`);
+        return exe || null;
+    }
+    return null;
+}
+/**
+ * 探测当前是否处于非交互式环境（cron/CI/无显示/BDIP_NO_REAUTH）。保守判定，避免误杀交互式终端。
+ * 用于 ensureValid 跳过会弹浏览器的续期——非交互式下 acquireToken 必失败，直接回退 cookie。
+ */
+export function looksNonInteractive() {
+    if (process.env.BDIP_NO_REAUTH)
+        return true;
+    if (process.env.CI)
+        return true;
+    if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
+/** 探测 URL 是否可连（短超时），忽略 HTTPS 错误，只看能否拿到 <500 响应。 */
+export async function canReach(url, timeoutMs = 6000) {
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+        return res.status < 500;
+    }
+    catch {
+        return false;
+    }
+}
+/** 继承 stdio 跑 shell 命令，超时强杀。返回 { code }。 */
+function runCmd(cmd, timeoutMs) {
+    return new Promise((resolve) => {
+        const p = spawn(cmd, { stdio: 'inherit', shell: true, timeout: timeoutMs });
+        const t = setTimeout(() => { try {
+            p.kill('SIGKILL');
+        }
+        catch { /* ignore */ } }, timeoutMs);
+        p.on('exit', (code) => { clearTimeout(t); resolve({ code: code ?? -1 }); });
+        p.on('error', (e) => { clearTimeout(t); console.error(`  [AUTH] 命令执行失败: ${e.message}`); resolve({ code: -1 }); });
+    });
+}
+/**
+ * 确保 playwright 可用：能 import 返回 chromium；不能 import 则探网→能联网就自动装模块（不装内核）。
+ * 内核改为懒加载：launchSystemBrowser 优先用系统 Chrome/Edge/Brave，只有系统里确实没有时才下载自带 chromium。
+ * 装不上抛清晰错并引导 cookie-login。**仅在 token-login（用户主动触发）调，勿在 ensureValid 运行时调**
+ * （否则每次请求过期都会触发安装）。
+ */
+export async function ensurePlaywright() {
+    try {
+        // @ts-ignore
+        return (await import('playwright')).chromium;
+    }
+    catch { /* 未装，尝试自动安装 */ }
+    const online = await canReach('https://registry.npmjs.org', 5000);
+    if (!online) {
+        throw new Error('playwright 未安装且当前环境无法联网安装。请先 `npm install playwright`，或改用 `bdip auth cookie-login` 手动导入 cookie（无需浏览器）。');
+    }
+    console.log('  [AUTH] playwright 未安装，联网自动安装模块（chromium 内核按需懒下载，通常无需）...');
+    const r1 = await runCmd('npm install playwright', 120000);
+    if (r1.code !== 0) {
+        throw new Error(`playwright 模块安装失败（npm exit ${r1.code}）。可手动 \`npm install playwright\`，或改用 \`bdip auth cookie-login\`。`);
+    }
+    try {
+        // @ts-ignore
+        return (await import('playwright')).chromium;
+    }
+    catch {
+        throw new Error('playwright 安装后仍无法 import，请检查 node_modules，或改用 `bdip auth cookie-login`。');
+    }
+}
+/** 跨进程续期锁窗口（ms）：窗口内其他进程检测到 acquiringAt 即跳过续期走 cookie，防并发弹多个浏览器。 */
+const ACQUIRING_WINDOW_MS = 120_000;
+/** 进程内续期共享锁表：key=profileName → 进行中的 acquireToken promise（同进程同环境只弹一个浏览器）。 */
+const _renewInflight = new Map();
+const EMPTY_DATA = { token: '', expireTime: '', expireSeconds: 0, cookieSavedAt: 0, acquireFailedAt: 0, acquiringAt: 0 };
+/** 读 token 文件（加密信封 → decrypt → JSON；兼容明文 {token}）。 */
+function loadTokenFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const raw = fs.readFileSync(filePath, 'utf8').trim();
+        const j = JSON.parse(raw);
+        if (j && j.enc === true && typeof j.data === 'string') {
+            return JSON.parse(decrypt(j.data));
+        }
+        if (j && typeof j.token === 'string')
+            return j; // 明文兼容
+    }
+    catch {
+        /* 损坏，视为无 */
+    }
+    return null;
+}
+/**
+ * 双模式浏览器登录拿 cookie（对标 e9-cli loginForCookie）。
+ * 有 username+password → 有头 autoFill（wui headless 不渲染登录框）；失败转手动。
+ * 轮询 loginidweaver（200ms），60s hash-portal 兜底（导航 /wui/index.html#/main/portal）。
+ * 返回 "name=value; name=value; ..." 形式的 cookie 串；缺 loginidweaver 抛错。
+ */
+/** Keep only this OA origin's persisted state, never send other sites' cookies to E9. */
+export function filterStorageState(state, baseUrl) {
+    const target = new URL(baseUrl);
+    return {
+        cookies: Array.isArray(state?.cookies) ? state.cookies.filter(c => {
+            const domain = String(c.domain ?? '').replace(/^\./, '').toLowerCase();
+            return domain && (target.hostname === domain || target.hostname.endsWith('.' + domain)) &&
+                (c.expires === -1 || !c.expires || c.expires * 1000 > Date.now()) &&
+                (!c.secure || target.protocol === 'https:');
+        }) : [],
+        origins: Array.isArray(state?.origins) ? state.origins.filter(o => o.origin === target.origin) : [],
+    };
+}
+async function browserIdentityValid(context, baseUrl) {
+    try {
+        const r = await context.request.get(baseUrl + '/api/hrm/login/getAccountList', { timeout: 4000, maxRedirects: 0 });
+        if (r.status() !== 200) return false;
+        const j = await r.json();
+        if (j.status === false || j.errorCode) return false;
+        const rows = j.data?.accountlist;
+        const current = Array.isArray(rows) ? rows.filter(a => String(a.iscurrent) === '1') : [];
+        return current.length === 1 && /^[1-9]\d*$/.test(String(current[0].userid));
+    } catch { return false; }
+}
+
+export async function loginForCookie(baseUrl, username, password, opts = {}) {
+    const headless = opts.headless ?? false;
+    let chromium;
+    try {
+        // @ts-ignore
+        chromium = (await import('playwright')).chromium;
+    }
+    catch {
+        const error = new Error('浏览器登录组件不可用；可手动安装 Playwright，或在主动登录流程中查看临时兼容方式。');
+        error.code = 'BROWSER_ENV_UNAVAILABLE';
+        throw error;
+    }
+    const autoFill = !!(username && password);
+    const args = headless ? ['--disable-blink-features=AutomationControlled'] : ['--start-maximized'];
+    let browser;
+    let context;
+    const statePath = path.join(CONFIG_DIR, `storageState_${profileNameFromBaseUrl(baseUrl)}.json`);
+    let storageState;
+    if (opts.reuseStorageState !== false) {
+        try { storageState = filterStorageState(JSON.parse(fs.readFileSync(statePath, 'utf8')), baseUrl); } catch { /* first login */ }
+    }
+    // 启动浏览器会话；开不出窗口（内核缺/无桌面）抛清晰错并引导 cookie-login，不让 Playwright 天书外泄
+    try {
+        browser = await launchSystemBrowser(chromium, headless, args);
+        context = await browser.newContext({
+            storageState,
+            ignoreHTTPSErrors: true,
+            viewport: { width: 1280, height: 800 },
+        });
+    }
+    catch (launchErr) {
+        // Only transport setup failure is classified as an unavailable environment.
+        // Navigation, rejected login and user consent failures below never receive this code.
+        try { await browser?.close(); } catch { /* release partially started browser */ }
+        const error = new Error('无法启动浏览器会话：当前环境缺少可用浏览器、桌面或运行依赖；可查看主动登录的临时兼容方式。');
+        error.code = 'BROWSER_ENV_UNAVAILABLE';
+        throw error;
+    }
+    await context.addInitScript(() => {
+        Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+    });
+    const page = await context.newPage();
+    try {
+        await page.goto(baseUrl, { waitUntil: 'domcontentloaded', timeout: 60000 }).catch((e) => {
+            if (headless)
+                throw e;
+            console.error(`  ⚠ 首页加载失败: ${e.message}，请在浏览器手动访问登录`);
+        });
+        const reusedLogin = await browserIdentityValid(context, baseUrl);
+        if (autoFill && !reusedLogin) {
+            // 有头 autoFill：等待登录输入框渲染；headless 不渲染会超时抛错降级
+            await page.waitForSelector('#loginid, input[name=loginid], input[type=text]', { timeout: 10000 }).catch(() => { });
+            await page.fill('#loginid, input[name=loginid], input[type=text]', username).catch(() => { });
+            await page.fill('#userpassword, input[type=password]', password).catch(() => { });
+            await Promise.all([
+                page.waitForNavigation({ waitUntil: 'networkidle', timeout: 15000 }).catch(() => { }),
+                page.click('button#submit, button[type=submit], button, input[type=submit]').catch(() => { }),
+            ]);
+        }
+        else if (!headless && !reusedLogin) {
+            console.log('  请在浏览器登录页输入账密并点登录（最长 600s）...');
+        }
+        // 轮询 loginidweaver。autoFill 未拿到 cookie 时原地转手动登录（复用同一浏览器会话，不重开）
+        const t0 = Date.now();
+        const autoFillDeadline = t0 + (autoFill ? 45000 : 0);
+        const deadline = t0 + (headless ? 30000 : 600000);
+        let cookies = [];
+        let prompted = false;
+        let portaled = false;
+        let fellBackToManual = false;
+        let authenticated = false;
+        while (Date.now() < deadline) {
+            cookies = await context.cookies(baseUrl + '/wui/index.html');
+            if (cookies.some((c) => c.name === 'loginidweaver') && (reusedLogin || await browserIdentityValid(context, baseUrl))) {
+                authenticated = true;
+                break;
+            }
+            // autoFill 用尽仍无 cookie → 原地提示手动登录（同一浏览器，避免二次 launchSystemBrowser）
+            if (autoFill && !fellBackToManual && Date.now() >= autoFillDeadline) {
+                fellBackToManual = true;
+                console.error('  [AUTH] autoFill 未拿到登录 Cookie，请在已打开的浏览器手动登录（最长 600s）...');
+            }
+            if (!headless && !portaled && Date.now() - t0 > 60000) {
+                // hash-portal 兜底：hash 路由切 SPA portal 设 cookie
+                await page
+                    .goto(`${baseUrl}/wui/index.html#/main/portal`, { waitUntil: 'commit', timeout: 30000 })
+                    .catch(() => { });
+                await sleep(3000);
+                portaled = true;
+            }
+            if (!headless && !prompted && Date.now() - t0 > 30000) {
+                console.log('  ⏳ 仍在等待 loginidweaver cookie...');
+                prompted = true;
+            }
+            await sleep(200);
+        }
+        if (!authenticated) throw new Error('未验证到真实登录用户，不能只凭 loginidweaver Cookie 认定登录成功');
+        if (!await browserIdentityValid(context, baseUrl)) throw new Error('登录后账号核验失败，请重新登录');
+        cookies = await context.cookies(baseUrl + '/wui/index.html');
+        const cookieString = cookies.map((c) => `${c.name}=${c.value}`).join('; ');
+        // Save only this OA's state after login consent and identity verification.
+        try {
+            ensureDir(CONFIG_DIR);
+            const state = filterStorageState(await context.storageState(), baseUrl);
+            fs.writeFileSync(statePath, JSON.stringify(state), { mode: 0o600 });
+            try { fs.chmodSync(statePath, 0o600); } catch { /* Windows ACL applies */ }
+        }
+        catch { /* Cookie login still works if state persistence is unavailable */ }
+        return cookieString;
+    }
+    finally {
+        try {
+            if (browser)
+                await browser.close();
+        }
+        catch { /* 关闭失败忽略 */ }
+    }
+}
+/** 已知 agent 工具的 env 签名表（叶子层探测，按顺序匹配）。 */
+const KNOWN_AGENT_TOOLS = [
+    // Claude Code：子进程注入 CLAUDECODE=1 / CLAUDE_CODE_SESSION_ID / CLAUDE_CODE_EXECPATH（已实跑确认）
+    { keys: ['CLAUDECODE', 'CLAUDE_CODE_SESSION_ID', 'CLAUDE_CODE_EXECPATH'], display: 'Claude-Code' },
+    // Kimi Work：签名待该工具实跑 env 确认；未命中时走 AI_AGENT 或产品名兜底。
+    { keys: ['KIMI_WORK', 'KIMI', 'MOONSHOT_SESSION_ID'], display: 'Kimi-Work' },
+    // TRAE Work（字节 Trae）：签名待确认（猜 TRAE_WORK/TRAE/TRAE_SESSION_ID）
+    { keys: ['TRAE_WORK', 'TRAE', 'TRAE_SESSION_ID'], display: 'Trae-Work' },
+    // DuMate：签名待确认（猜 DUMATE/DU_MATE/DUMATE_SESSION_ID）
+    { keys: ['DUMATE', 'DU_MATE', 'DUMATE_SESSION_ID'], display: 'DuMate' },
+];
+/** 无法识别实际 agent 时的兜底展示名。 */
+const FALLBACK_DISPLAY = '毕埃慕ai助手';
+function detectKnownAgent() {
+    for (const tool of KNOWN_AGENT_TOOLS) {
+        for (const k of tool.keys) {
+            const v = process.env[k];
+            if (v !== undefined && v !== '')
+                return tool.display;
+        }
+    }
+    return null;
+}
+export function getAgentInfo() {
+    // 0. 通用覆盖：任何 agent 工具/宿主都可设 E9_AGENT_DISPLAY=<名> 自报家门（免改代码）
+    const override = process.env.E9_AGENT_DISPLAY;
+    if (override) {
+        const display = override.trim();
+        return { framework: display.toLowerCase(), display };
+    }
+    // 1. 叶子层：已知 agent 工具 env 签名探测
+    const known = detectKnownAgent();
+    if (known)
+        return { framework: known.toLowerCase(), display: known };
+    // 2. 回退：AI_AGENT 宿主/注册名解析
+    const aiAgent = process.env.AI_AGENT || '';
+    // claude-code_2-1-218_agent → "Claude-Code"（取下划线前的框架名，分段首字母大写，保留 "-" 分隔）
+    let framework = '';
+    if (aiAgent) {
+        const m = aiAgent.match(/^([a-zA-Z]+(?:-[a-zA-Z]+)*)_/);
+        if (m) {
+            framework = m[1]
+                .split('-')
+                .map((s) => (s ? s.charAt(0).toUpperCase() + s.slice(1) : s))
+                .join('-');
+        }
+    }
+    // 都识别不出 → 使用产品名，避免向最终用户暴露历史内部 CLI 名称。
+    if (!framework)
+        framework = FALLBACK_DISPLAY;
+    return { framework: framework.toLowerCase(), display: framework };
+}
+const SKILL_AUTH_VERIFY_BASE = 'https://bim.bdip.com';
+export const SKILL_AUTH_CONTACT = [
+    '如需申请或更新授权，请联系毕埃慕：',
+    '  400咨询热线：4000-835-957',
+    '  座机：021-35081131',
+    '  企业邮箱：bim@17bim.com',
+].join('\n');
+export function userFacingSkillAuthMessage(kind = 'no_auth') {
+    if (kind === 'expired') return `授权已过期。\n${SKILL_AUTH_CONTACT}`;
+    if (kind === 'verify_failed') return `授权校验未通过。\n${SKILL_AUTH_CONTACT}`;
+    if (kind === 'no_domain') return `尚未配置办公平台地址，无法校验授权。请先提供 OA 地址；若还没有授权，\n${SKILL_AUTH_CONTACT}`;
+    return `当前办公平台未获得有效授权。\n${SKILL_AUTH_CONTACT}`;
+}
+/** Authorization is bound to the configured OA host, including a non-default port. */
+export function skillAuthDomain(baseUrl) {
+    const raw = String(baseUrl ?? '').trim();
+    if (!raw) return '';
+    try { return new URL(raw).host; }
+    catch { return raw.replace(/^https?:\/\//i, '').replace(/\/+$/, '').split('/')[0]; }
+}
+function authCodeError(kind, code, message) {
+    const error = new Error(message);
+    error.e9kind = kind;
+    error.code = code;
+    return error;
+}
+/** Check the configured OA domain without sending Cookie or login credentials. */
+export async function verifySkillAuth(baseUrl) {
+    const domain = skillAuthDomain(baseUrl);
+    if (!domain) throw authCodeError('no-auth-domain', 'AI_SKILL_NO_AUTH', userFacingSkillAuthMessage('no_domain'));
+    const url = `${SKILL_AUTH_VERIFY_BASE}/bdipCloud/api/ai/aiSkillAuth/verifyByDomain?${new URLSearchParams({ domain })}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json, text/plain, */*',
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36',
+            },
+            signal: AbortSignal.timeout(15000),
+            redirect: 'manual',
+        });
+    } catch {
+        throw authCodeError('network', 'AI_SKILL_AUTH_VERIFY_FAILED', '授权校验请求失败，请检查网络后重试。');
+    }
+    let json;
+    try { json = await response.json(); }
+    catch { throw authCodeError('auth-verify-invalid', 'AI_SKILL_AUTH_VERIFY_FAILED', userFacingSkillAuthMessage('verify_failed')); }
+    const code = Number(json?.code);
+    const msgKey = String(json?.msgKey ?? json?.msg_key ?? '');
+    const message = String(json?.message ?? json?.msg ?? '');
+    if (response.ok && (code === 200 || msgKey === 'OperOk'))
+        return { ok: true, code, msgKey: msgKey || 'OperOk', message, domain };
+    if (msgKey === 'ai_skill_auth_expired' || /授权已过期/.test(message))
+        throw authCodeError('auth-code-expired', 'AI_SKILL_AUTH_EXPIRED', userFacingSkillAuthMessage('expired'));
+    if (msgKey === 'ai_skill_no_auth' || /没有授权/.test(message))
+        throw authCodeError('no-auth-code', 'AI_SKILL_NO_AUTH', userFacingSkillAuthMessage('no_auth'));
+    throw authCodeError('auth-verify-failed', 'AI_SKILL_AUTH_VERIFY_FAILED', userFacingSkillAuthMessage('verify_failed'));
+}
+export async function ensureAgentAuth(baseUrl) {
+    const domain = skillAuthDomain(baseUrl);
+    console.error('  [AUTH] 登录前按域名校验授权...');
+    await verifySkillAuth(baseUrl);
+    console.error('  [AUTH] 域名授权有效。');
+    return { domain };
+}
+function looksAuthCodeRejected(status, json, text) {
+    const msgKey = String(json?.msgKey ?? json?.msg_key ?? '');
+    if (msgKey === 'ai_skill_no_auth' || msgKey === 'ai_skill_auth_expired') return true;
+    const msg = String(json?.msg ?? json?.message ?? text ?? '');
+    if (/授权码|authCode|auth.?code|没有授权|授权已过期|域名授权/i.test(msg)
+        && /过期|无效|失效|不存在|错误|拒绝|invalid|expired|forbidden|denied|没有授权/i.test(msg)) return true;
+    if (status === 401 || status === 403) return /授权码|authCode|auth.?code|授权/i.test(msg);
+    return /AUTH_CODE|AUTHCODE|LICENSE|AI_SKILL/i.test(String(json?.errorCode ?? ''));
+}
+/** GET /api/ai/agent/login/register 用 cookie 换 token（仿 curl 头）。失败抛带 e9kind/e9status 的错，供上层大声诊断。 */
+export async function registerToken(baseUrl, cookieString, cfg) {
+    const agent = getAgentInfo();
+    let resp;
+    try {
+        resp = await fetch(`${baseUrl}/api/ai/agent/login/register?${new URLSearchParams({ aiAgentType: agent.display })}`, {
+            headers: {
+                Cookie: cookieString,
+                Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36',
+            },
+            signal: AbortSignal.timeout(15000), redirect: 'manual',
+        });
+    }
+    catch (e) {
+        const err = new Error(`register 请求失败（${e.message}）。可能 baseUrl 不可达或网络不通。`);
+        err.e9kind = 'network';
+        throw err;
+    }
+    const status = resp.status;
+    const text = await resp.text();
+    if (status === 404) {
+        const err = new Error(`此 BDIP5 无 /api/ai/agent/login/register 接口（HTTP 404），该环境不支持 aiAgentToken。`);
+        err.e9kind = 'unsupported';
+        err.e9status = status;
+        throw err;
+    }
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        const err = new Error(`register 返回非 JSON（HTTP ${status}），未输出可能含凭据的响应正文`);
+        err.e9status = status;
+        throw err;
+    }
+    rejectForcedOffline(cfg, { authenticated: false, mode: 'cookie', code: authFailureCode(status, json) }, cookieString);
+    if (looksAuthCodeRejected(status, json, text)) {
+        if (String(json?.msgKey ?? '') === 'ai_skill_auth_expired' || /授权已过期/.test(String(json?.message ?? json?.msg ?? '')))
+            throw authCodeError('auth-code-expired', 'AI_SKILL_AUTH_EXPIRED', userFacingSkillAuthMessage('expired'));
+        throw authCodeError('no-auth-code', 'AI_SKILL_NO_AUTH', userFacingSkillAuthMessage('no_auth'));
+    }
+    if (!resp.ok || !json || json.status === false || json.errorCode) {
+        const code = /^[\w-]{1,64}$/.test(String(json?.errorCode ?? '')) ? String(json.errorCode) : 'UNKNOWN';
+        const err = new Error(`register 失败（HTTP ${status}，code=${code}）`);
+        err.e9status = status;
+        throw err;
+    }
+    const data = json.data || {};
+    if (typeof data.aiAgentToken !== 'string' || !data.aiAgentToken || /[\r\n]/.test(data.aiAgentToken)) {
+        const err = new Error(`register 未返回有效 aiAgentToken（HTTP ${status}）`);
+        err.e9status = status;
+        throw err;
+    }
+    if (cfg) mergeResponseCookies(cfg, resp.headers, cookieString);
+    return { token: data.aiAgentToken, expireTime: data.expireTime || '', expireSeconds: data.expireSeconds || 0 };
+}
+/**
+ * 当前环境的 token 会话（单一端点）。持有 cfg/endpoint（回写 cookie 到 config）、token 文件路径与缓存数据。
+ */
+export class AuthTokenSession {
+    cfg;
+    endpoint;
+    filePath;
+    data;
+    constructor(cfg, endpoint, filePath, data, profileName) {
+        this.cfg = cfg;
+        this.endpoint = endpoint;
+        this.filePath = filePath;
+        this.data = data || { ...EMPTY_DATA };
+        this.profileName = profileName || path.basename(filePath, '.json');
+    }
+    get token() {
+        return this.data.token || '';
+    }
+    get baseUrl() {
+        return this.endpoint.baseUrl.replace(/\/+$/, '');
+    }
+    get isExpired() {
+        if (!this.data.token)
+            return true;
+        const savedAt = this.data.cookieSavedAt || 0;
+        const ttl = (this.data.expireSeconds || 0) * 1000;
+        if (savedAt && ttl)
+            return Date.now() > savedAt + ttl - 60000;
+        if (this.data.expireTime)
+            return Date.now() > new Date(this.data.expireTime).getTime() - 60000;
+        return false; // 缺过期信息时信任本地 token，由 reactive 重试（requestWithRetry）兜底服务端吊销
+    }
+    static fromProfile(cfg) {
+        ensureDir(TOKEN_DIR);
+        const endpoint = endpointFor(cfg);
+        const profileName = profileNameFromBaseUrl(endpoint.baseUrl);
+        const filePath = tokenFilePath(profileName);
+        const data = loadTokenFile(filePath) || { ...EMPTY_DATA };
+        return new AuthTokenSession(cfg, endpoint, filePath, data, profileName);
+    }
+    /** 从磁盘重新加载 token 数据（跨进程锁检测需要最新快照，避免读到旧 data 而忽略别的进程的 acquiringAt）。 */
+    _reloadData() {
+        const fresh = loadTokenFile(this.filePath);
+        if (fresh)
+            this.data = { ...EMPTY_DATA, ...fresh };
+    }
+    /** 把浏览器登录拿到的刷新 cookie 写回 config.json 的 cookie 字段（供回退）。 */
+    saveCookieToProfile(cookieString) {
+        if (!cookieString)
+            return;
+        if (!updateConfigCookie(this.cfg, cookieString)) throw new Error('未保存 Cookie：平台配置已变更或 Cookie 格式无效');
+    }
+    /** 申请/续期 token：loginForCookie → saveCookieToProfile → registerToken。register 失败标记 noToken 返回 null。
+     *  双层互斥防「同时弹很多个登录页」：
+     *    ① 进程内锁：同 profile 已有续期在跑 → 其余调用 await 同一个 promise（report collect 7 路并发只弹 1 个）；
+     *    ② 跨进程锁：token 文件写 acquiringAt 时间戳，其他进程见窗口内标记 → 跳过续期走 cookie。
+     *  reason: 'first'（cmdTokenLogin 首次登录）/ 'renew'（ensureValid/reactive 续期，默认）—— 区分文案。 */
+    async acquireToken(reason = 'renew') {
+        const key = this.profileName || 'default';
+        if (_renewInflight.has(key))
+            return _renewInflight.get(key); // 同进程已在续期：等同一个结果，不重复弹浏览器
+        const p = this._acquireTokenInner(reason);
+        _renewInflight.set(key, p);
+        try {
+            return await p;
+        }
+        finally {
+            _renewInflight.delete(key);
+        }
+    }
+    /** acquireToken 真实主体（持有跨进程锁时执行）；跳过续期/未拿到 token 均返回 null。 */
+    async _acquireTokenInner(reason = 'renew') {
+        await ensureAgentAuth(this.baseUrl);
+        // ② 跨进程锁：重读磁盘看别的进程是否正在续期（窗口内跳过）
+        this._reloadData();
+        const acquiringAt = this.data.acquiringAt || 0;
+        if (acquiringAt && Date.now() - acquiringAt < ACQUIRING_WINDOW_MS) {
+            console.error(`  [AUTH] 另一进程正在续期（${Math.round((Date.now() - acquiringAt) / 1000)}s 前开始），本进程跳过续期，走 cookie 回退。`);
+            return null;
+        }
+        // 抢跨进程锁
+        this.data.acquiringAt = Date.now();
+        this.save();
+        try {
+            const password = this.cfg.encPassword ? decrypt(this.cfg.encPassword) : '';
+            const username = this.cfg.username || '';
+            // ★ #15 文案区分：续期 vs 首登（loginForCookie 的"请在浏览器登录页输入账密"是共享等待语，这里先打场景横幅）
+            if (reason === 'first')
+                console.error('[AUTH] 首次登录：浏览器登录并核验账号后申请 aiAgentToken。');
+            else
+                console.error('[AUTH] token 已过期：浏览器登录并核验账号后申请新 aiAgentToken。');
+            // autoFill 失败已在 loginForCookie 内原地转手动登录（同一浏览器会话），不再二次重开浏览器
+            const cookieString = await loginForCookie(this.baseUrl, username, username ? password : '', { headless: false });
+            this.saveCookieToProfile(cookieString);
+            let checkedCookie = this.cfg.cookie;
+            const sessionState = await probeCookieSession(this.cfg, { onCredential: cookie => { checkedCookie = cookie; } });
+            rejectForcedOffline(this.cfg, sessionState, checkedCookie);
+            if (sessionState.code === 'SESSION_EXPIRED') throw new Error(sessionState.message);
+            if (sessionState.authenticated) console.error(`[AUTH] 已验证 Cookie 当前用户 ${sessionState.userId}；${sessionState.mode === 'extension' ? `空闲超时 ${sessionState.idleTimeoutSeconds} 秒` : '当前以原生会话保活'}`);
+            try {
+                const { token, expireTime, expireSeconds } = await registerToken(this.baseUrl, this.cfg.cookie, this.cfg);
+                this.data = { token, expireTime, expireSeconds, cookieSavedAt: Date.now(), noToken: false,
+                    userId: sessionState.authenticated ? sessionState.userId : undefined, acquireFailedAt: 0, acquiringAt: 0 };
+                this.save();
+                return token;
+            }
+            catch (e) {
+                if (e.code === 'FORCED_OFFLINE' || e.code === 'AI_SKILL_NO_AUTH' || e.code === 'AI_SKILL_AUTH_EXPIRED') throw e;
+                // 大声诊断：区分 404 不支持 / 网络不通 / 其它，不再含糊"系统可能不支持"
+                const kind = e?.e9kind || (e?.e9status === 404 ? 'unsupported' : 'other');
+                if (kind === 'unsupported')
+                    console.error(`  [AUTH] 此 BDIP5 不支持 aiAgentToken（${e.message}）。已切到 cookie 鉴权备胎。`);
+                else if (kind === 'network')
+                    console.error(`  [AUTH] register 请求失败：${e.message}。已切到 cookie 鉴权备胎（请用 \`bdip auth status --check\` 排查 baseUrl 可达性）。`);
+                else
+                    console.error(`  [AUTH] register 拿 token 失败：${e.message}。已切到 cookie 鉴权备胎。`);
+                console.error(`  [AUTH] cookie 有效期由服务器定，过期需重新导入；运行 \`bdip auth status\` 查看当前模式。`);
+                this.data = { token: '', expireTime: '', expireSeconds: 0, cookieSavedAt: Date.now(), noToken: true, acquireFailedAt: Date.now(), acquiringAt: 0 };
+                this.save();
+                return null;
+            }
+        }
+        finally {
+            // 释放跨进程锁（reload 拿最新快照，避免覆盖续期期间写入的 token/acquireFailedAt）
+            this._reloadData();
+            this.data.acquiringAt = 0;
+            this.save();
+        }
+    }
+    /** Renew an expiring agent token with the live Cookie, without opening a browser. */
+    async renewWithCookie() {
+        await ensureAgentAuth(this.baseUrl);
+        const key = this.profileName || 'default';
+        if (_renewInflight.has(key)) return _renewInflight.get(key);
+        const work = async () => {
+            this._reloadData();
+            if (this.data.acquiringAt && Date.now() - this.data.acquiringAt < ACQUIRING_WINDOW_MS) return null;
+            if (this.data.cookieRenewFailedAt && Date.now() - this.data.cookieRenewFailedAt < 600000) return null;
+            let checkedCookie = this.cfg.cookie;
+            const state = await probeCookieSession(this.cfg, { onCredential: cookie => { checkedCookie = cookie; } });
+            rejectForcedOffline(this.cfg, state, checkedCookie);
+            if (!state.authenticated) return null;
+            const acquiredAt = Date.now();
+            this.data.acquiringAt = acquiredAt;
+            this.save();
+            try {
+                const { token, expireTime, expireSeconds } = await registerToken(this.baseUrl, this.cfg.cookie, this.cfg);
+                this.data = { token, expireTime, expireSeconds, cookieSavedAt: Date.now(), noToken: false,
+                    userId: state.userId, acquireFailedAt: 0, acquiringAt: 0, cookieRenewFailedAt: 0 };
+                this.save();
+                return token;
+            }
+            catch (error) {
+                if (error.code === 'FORCED_OFFLINE' || error.code === 'AI_SKILL_NO_AUTH' || error.code === 'AI_SKILL_AUTH_EXPIRED') throw error;
+                this.data.cookieRenewFailedAt = Date.now();
+                this.data.acquiringAt = 0;
+                this.save();
+                return null;
+            }
+            finally {
+                this._reloadData();
+                if (this.data.acquiringAt === acquiredAt) { this.data.acquiringAt = 0; this.save(); }
+            }
+        };
+        const p = work();
+        _renewInflight.set(key, p);
+        try { return await p; } finally { _renewInflight.delete(key); }
+    }
+    async ensureValid(expectedUserId) {
+        this._reloadData();
+        if (this.data.noToken)
+            return false;
+        if (!this.data.token)
+            return false;
+        // Never mix a previous/unknown token identity with a verified Cookie account.
+        if (expectedUserId && String(this.data.userId ?? '') !== String(expectedUserId)) return !!(await this.renewWithCookie());
+        if (!this.isExpired)
+            return true;
+        // A live Cookie can renew the agent token without interrupting a long-running task.
+        if (this.cfg.cookie) return !!(await this.renewWithCookie());
+        // ★ #13 近期续期失败过 → 退避窗口内回退 cookie，不反复弹浏览器
+        if (this.data.acquireFailedAt && Date.now() - this.data.acquireFailedAt < 10 * 60 * 1000)
+            return false;
+        // 非交互式环境不弹浏览器续期（必失败且会卡住），直接回退 cookie；服务端吊销由 reactive 重试兜底
+        if (looksNonInteractive())
+            return false;
+        try {
+            // 用 acquireToken 返回值判断：跨进程锁跳过（返回 null）→ false（走 cookie），不能看 data.token 旧值
+            const t = await this.acquireToken();
+            return !!t;
+        }
+        catch (e) {
+            console.error(`[AUTH] token 续期失败: ${e.message}`);
+            // ★ #13 持久化续期失败标记，10min 退避窗口内不再弹浏览器（避免每条命令重复弹）
+            try {
+                this.data.acquireFailedAt = Date.now();
+                this.save();
+            }
+            catch { /* 写盘失败不阻断当次回退 cookie */ }
+            return false;
+        }
+    }
+    /** 加密信封写 token 文件。 */
+    save() {
+        ensureDir(TOKEN_DIR);
+        const enc = encrypt(JSON.stringify(this.data));
+        fs.writeFileSync(this.filePath, JSON.stringify({ enc: true, v: 1, data: enc }, null, 2) + '\n', 'utf8');
+        try {
+            fs.chmodSync(this.filePath, 0o600);
+        }
+        catch {
+            /* Windows 忽略 */
+        }
+    }
+}