bdip-office-assistant-cli 1.0.0 → 1.0.1

package/README.md

@@ -1,18 +1,18 @@
-# BDIP办公助手 CLI 1.0.0
+# 毕埃慕ai助手 CLI 1.0.1
 
-BDIP5办公平台的命令行工具，由毕埃慕(上海)建筑数据技术股份有限公司提供。配合WorkBuddy的“BDIP办公助手”技能使用，也可直接运行`bdip --help`查看命令。
+BDIP5办公平台的命令行工具，由毕埃慕(上海)建筑数据技术股份有限公司提供。配合WorkBuddy的“毕埃慕ai助手”技能使用，也可直接运行`bdip --help`查看命令。
 
 ## 安装
 
 需要Node.js 18或更高版本及npm。在实际运行助手的环境安装；手机使用云电脑时需要安装在云电脑。
 
 ```text
-npm install -g bdip-office-assistant-cli@1.0.0 --registry=https://registry.npmjs.org/
+npm install -g bdip-office-assistant-cli@1.0.1 --registry=https://registry.npmjs.org/
 bdip version
 bdip --help
 ```
 
-技能与CLI首发版本均为1.0.0。安装时固定版本，升级时使用新版本对应的技能和CLI。CLI版本不匹配时手机适配器会停止。
+当前配套技能版本为 1.0.1，CLI 版本为 1.0.1。安装时固定版本，两种交付包必须使用相同源码。CLI 版本不匹配时手机适配器会停止。
 
 ## 配置
 

package/dist/auth-token.js

@@ -3,11 +3,11 @@
  *
  * 链路：
  *   loginForCookie（有头 autoFill，失败转手动；轮询 loginidweaver，60s hash-portal 兜底）
+ *   → 平台账号接口再次核验，关闭浏览器
  *   → saveCookieToProfile（存 cookie 供回退，写回 config.json 对应字段）
  *   → registerToken: GET /api/ai/agent/login/register 带 cookie → aiAgentToken（8h，加密存）
  *       成功 → { token, expireTime, expireSeconds, cookieSavedAt, noToken:false }
  *       404/异常 → { token:'', noToken:true }（回退 cookie）
- *   → promptAuthConfirm（有头，弹授权 overlay，用户点确认才 registerToken）
  *
  * token 文件：~/.bdip/tokens/<profileName>.json（AES-256-GCM 加密）。
  * profileName 由当前 baseUrl 的 hostname+port 派生（一个环境一个 token 文件）。
@@ -344,7 +344,7 @@ export async function loginForCookie(baseUrl, username, password, opts = {}) {
             // autoFill 用尽仍无 cookie → 原地提示手动登录（同一浏览器，避免二次 launchSystemBrowser）
             if (autoFill && !fellBackToManual && Date.now() >= autoFillDeadline) {
                 fellBackToManual = true;
-                console.error('  [AUTH] autoFill 未拿到登录 cookie，请在已打开的浏览器手动登录并点确认授权（最长 600s）...');
+                console.error('  [AUTH] autoFill 未拿到登录 Cookie，请在已打开的浏览器手动登录（最长 600s）...');
             }
             if (!headless && !portaled && Date.now() - t0 > 60000) {
                 // hash-portal 兜底：hash 路由切 SPA portal 设 cookie
@@ -361,11 +361,10 @@ export async function loginForCookie(baseUrl, username, password, opts = {}) {
             await sleep(200);
         }
         if (!authenticated) throw new Error('未验证到真实登录用户，不能只凭 loginidweaver Cookie 认定登录成功');
-        if (!headless) await confirmAfterNavigation(page, promptAuthConfirm);
-        if (!await browserIdentityValid(context, baseUrl)) throw new Error('授权确认后登录已失效，请重新登录');
+        if (!await browserIdentityValid(context, baseUrl)) throw new Error('登录后账号核验失败，请重新登录');
         cookies = await context.cookies(baseUrl + '/wui/index.html');
         const cookieString = cookies.map((c) => `${c.name}=${c.value}`).join('; ');
-        // Save only this OA's state after explicit consent and identity verification.
+        // Save only this OA's state after login consent and identity verification.
         try {
             ensureDir(CONFIG_DIR);
             const state = filterStorageState(await context.storageState(), baseUrl);
@@ -383,82 +382,6 @@ export async function loginForCookie(baseUrl, username, password, opts = {}) {
         catch { /* 关闭失败忽略 */ }
     }
 }
-export async function confirmAfterNavigation(page, confirm) {
-    for (let attempt = 0; ; attempt++) {
-        await page.waitForLoadState('networkidle', {timeout:10000}).catch(() => {});
-        try { await confirm(page); return; }
-        catch (error) {
-            if (attempt >= 2 || !/Execution context was destroyed|Cannot find context/.test(String(error?.message))) throw error;
-        }
-    }
-}
-/** 登录后注入授权确认 overlay；用户点「确认授权」才放行。 */
-async function promptAuthConfirm(page) {
-    const agent = getAgentInfo();
-    await page.evaluate((agentDisplay) => {
-        // 注入动画样式
-        const style = document.createElement('style');
-        style.textContent = `
-      @keyframes __e9_fade_in { from { opacity:0; } to { opacity:1; } }
-      @keyframes __e9_slide_up { from { opacity:0; transform:translateY(24px) scale(.96); } to { opacity:1; transform:translateY(0) scale(1); } }
-    `;
-        document.head.appendChild(style);
-        document.getElementById('__e9_auth_confirm__')?.remove();
-        window.__bdipExplicitConsent = false;
-        const mask = document.createElement('div');
-        mask.id = '__e9_auth_confirm__';
-        mask.style.cssText =
-            'position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(15,23,42,.55);backdrop-filter:blur(4px);z-index:2147483647;display:flex;align-items:center;justify-content:center;animation:__e9_fade_in .25s ease;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI","Microsoft YaHei",sans-serif;';
-        const card = document.createElement('div');
-        card.style.cssText =
-            'background:#fff;border-radius:16px;overflow:hidden;box-shadow:0 12px 48px rgba(0,0,0,.3);width:400px;animation:__e9_slide_up .35s cubic-bezier(.16,1,.3,1);';
-        // 顶部渐变色条
-        const topBar = document.createElement('div');
-        topBar.style.cssText = 'height:5px;background:linear-gradient(90deg,#3b82f6,#6366f1,#8b5cf6);';
-        // 内容区
-        const body = document.createElement('div');
-        body.style.cssText = 'padding:36px 36px 32px;text-align:center;';
-        // SVG 盾牌图标
-        const icon = document.createElement('div');
-        icon.style.cssText = 'width:64px;height:64px;margin:0 auto 20px;';
-        icon.innerHTML = `<svg viewBox="0 0 24 24" fill="none" width="64" height="64">
-      <defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1">
-        <stop offset="0%" stop-color="#3b82f6"/><stop offset="100%" stop-color="#6366f1"/>
-      </linearGradient></defs>
-      <path d="M12 2L4 5v6c0 5 3.5 9.5 8 11 4.5-1.5 8-6 8-11V5l-8-3z" fill="url(#g)"/>
-      <path d="M9 12l2 2 4-4" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
-    </svg>`;
-        const title = document.createElement('div');
-        title.style.cssText = 'font-size:17px;font-weight:600;color:#0f172a;margin-bottom:6px;letter-spacing:.3px;';
-        title.textContent = `【BDIP办公助手】请求授权访问BDIP系统，请确认。`;
-        const desc = document.createElement('div');
-        desc.style.cssText = 'font-size:12px;color:#94a3b8;line-height:1.6;margin-bottom:28px;';
-        desc.textContent = '确认后将以您的身份访问系统';
-        // 按钮区（只保留确认授权；关浏览器/超时不授权 → 走 cookie 回退）
-        const btnYes = document.createElement('button');
-        btnYes.id = '__e9_auth_yes__';
-        btnYes.style.cssText =
-            'width:100%;background:linear-gradient(135deg,#3b82f6,#6366f1);color:#fff;border:none;padding:12px 0;border-radius:8px;cursor:pointer;font-size:15px;font-weight:500;transition:transform .15s,box-shadow .15s;box-shadow:0 2px 8px rgba(59,130,246,.35);';
-        btnYes.textContent = '确认授权';
-        btnYes.onmouseenter = () => { btnYes.style.transform = 'translateY(-1px)'; btnYes.style.boxShadow = '0 4px 16px rgba(59,130,246,.45)'; };
-        btnYes.onmouseleave = () => { btnYes.style.transform = 'translateY(0)'; btnYes.style.boxShadow = '0 2px 8px rgba(59,130,246,.35)'; };
-        body.appendChild(icon);
-        body.appendChild(title);
-        body.appendChild(desc);
-        body.appendChild(btnYes);
-        card.appendChild(topBar);
-        card.appendChild(body);
-        mask.appendChild(card);
-        document.body.appendChild(mask);
-        btnYes.addEventListener('click', () => { window.__bdipExplicitConsent = true; mask.remove(); });
-    }, agent.display);
-    await page
-        .waitForFunction(() => window.__bdipExplicitConsent === true, null, { timeout: 180000 })
-        .catch((error) => {
-        if (/Execution context was destroyed|Cannot find context/.test(String(error?.message))) throw error;
-        throw new Error('授权确认超时（180s）、页面已变化或未点击');
-    });
-}
 /** 已知 agent 工具的 env 签名表（叶子层探测，按顺序匹配）。 */
 const KNOWN_AGENT_TOOLS = [
     // Claude Code：子进程注入 CLAUDECODE=1 / CLAUDE_CODE_SESSION_ID / CLAUDE_CODE_EXECPATH（已实跑确认）
@@ -471,7 +394,7 @@ const KNOWN_AGENT_TOOLS = [
     { keys: ['DUMATE', 'DU_MATE', 'DUMATE_SESSION_ID'], display: 'DuMate' },
 ];
 /** 无法识别实际 agent 时的兜底展示名。 */
-const FALLBACK_DISPLAY = 'BDIP办公助手';
+const FALLBACK_DISPLAY = '毕埃慕ai助手';
 function detectKnownAgent() {
     for (const tool of KNOWN_AGENT_TOOLS) {
         for (const k of tool.keys) {
@@ -511,12 +434,87 @@ export function getAgentInfo() {
         framework = FALLBACK_DISPLAY;
     return { framework: framework.toLowerCase(), display: framework };
 }
+const SKILL_AUTH_VERIFY_BASE = 'https://bim.bdip.com';
+export const SKILL_AUTH_CONTACT = [
+    '如需申请或更新授权，请联系毕埃慕：',
+    '  400咨询热线：4000-835-957',
+    '  座机：021-35081131',
+    '  企业邮箱：bim@17bim.com',
+].join('\n');
+export function userFacingSkillAuthMessage(kind = 'no_auth') {
+    if (kind === 'expired') return `授权已过期。\n${SKILL_AUTH_CONTACT}`;
+    if (kind === 'verify_failed') return `授权校验未通过。\n${SKILL_AUTH_CONTACT}`;
+    if (kind === 'no_domain') return `尚未配置办公平台地址，无法校验授权。请先提供 OA 地址；若还没有授权，\n${SKILL_AUTH_CONTACT}`;
+    return `当前办公平台未获得有效授权。\n${SKILL_AUTH_CONTACT}`;
+}
+/** Authorization is bound to the configured OA host, including a non-default port. */
+export function skillAuthDomain(baseUrl) {
+    const raw = String(baseUrl ?? '').trim();
+    if (!raw) return '';
+    try { return new URL(raw).host; }
+    catch { return raw.replace(/^https?:\/\//i, '').replace(/\/+$/, '').split('/')[0]; }
+}
+function authCodeError(kind, code, message) {
+    const error = new Error(message);
+    error.e9kind = kind;
+    error.code = code;
+    return error;
+}
+/** Check the configured OA domain without sending Cookie or login credentials. */
+export async function verifySkillAuth(baseUrl) {
+    const domain = skillAuthDomain(baseUrl);
+    if (!domain) throw authCodeError('no-auth-domain', 'AI_SKILL_NO_AUTH', userFacingSkillAuthMessage('no_domain'));
+    const url = `${SKILL_AUTH_VERIFY_BASE}/bdipCloud/api/ai/aiSkillAuth/verifyByDomain?${new URLSearchParams({ domain })}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json, text/plain, */*',
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36',
+            },
+            signal: AbortSignal.timeout(15000),
+            redirect: 'manual',
+        });
+    } catch {
+        throw authCodeError('network', 'AI_SKILL_AUTH_VERIFY_FAILED', '授权校验请求失败，请检查网络后重试。');
+    }
+    let json;
+    try { json = await response.json(); }
+    catch { throw authCodeError('auth-verify-invalid', 'AI_SKILL_AUTH_VERIFY_FAILED', userFacingSkillAuthMessage('verify_failed')); }
+    const code = Number(json?.code);
+    const msgKey = String(json?.msgKey ?? json?.msg_key ?? '');
+    const message = String(json?.message ?? json?.msg ?? '');
+    if (response.ok && (code === 200 || msgKey === 'OperOk'))
+        return { ok: true, code, msgKey: msgKey || 'OperOk', message, domain };
+    if (msgKey === 'ai_skill_auth_expired' || /授权已过期/.test(message))
+        throw authCodeError('auth-code-expired', 'AI_SKILL_AUTH_EXPIRED', userFacingSkillAuthMessage('expired'));
+    if (msgKey === 'ai_skill_no_auth' || /没有授权/.test(message))
+        throw authCodeError('no-auth-code', 'AI_SKILL_NO_AUTH', userFacingSkillAuthMessage('no_auth'));
+    throw authCodeError('auth-verify-failed', 'AI_SKILL_AUTH_VERIFY_FAILED', userFacingSkillAuthMessage('verify_failed'));
+}
+export async function ensureAgentAuth(baseUrl) {
+    const domain = skillAuthDomain(baseUrl);
+    console.error('  [AUTH] 登录前按域名校验授权...');
+    await verifySkillAuth(baseUrl);
+    console.error('  [AUTH] 域名授权有效。');
+    return { domain };
+}
+function looksAuthCodeRejected(status, json, text) {
+    const msgKey = String(json?.msgKey ?? json?.msg_key ?? '');
+    if (msgKey === 'ai_skill_no_auth' || msgKey === 'ai_skill_auth_expired') return true;
+    const msg = String(json?.msg ?? json?.message ?? text ?? '');
+    if (/授权码|authCode|auth.?code|没有授权|授权已过期|域名授权/i.test(msg)
+        && /过期|无效|失效|不存在|错误|拒绝|invalid|expired|forbidden|denied|没有授权/i.test(msg)) return true;
+    if (status === 401 || status === 403) return /授权码|authCode|auth.?code|授权/i.test(msg);
+    return /AUTH_CODE|AUTHCODE|LICENSE|AI_SKILL/i.test(String(json?.errorCode ?? ''));
+}
 /** GET /api/ai/agent/login/register 用 cookie 换 token（仿 curl 头）。失败抛带 e9kind/e9status 的错，供上层大声诊断。 */
 export async function registerToken(baseUrl, cookieString, cfg) {
     const agent = getAgentInfo();
     let resp;
     try {
-        resp = await fetch(`${baseUrl}/api/ai/agent/login/register?aiAgentType=${encodeURIComponent(agent.display)}`, {
+        resp = await fetch(`${baseUrl}/api/ai/agent/login/register?${new URLSearchParams({ aiAgentType: agent.display })}`, {
             headers: {
                 Cookie: cookieString,
                 Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
@@ -548,6 +546,11 @@ export async function registerToken(baseUrl, cookieString, cfg) {
         throw err;
     }
     rejectForcedOffline(cfg, { authenticated: false, mode: 'cookie', code: authFailureCode(status, json) }, cookieString);
+    if (looksAuthCodeRejected(status, json, text)) {
+        if (String(json?.msgKey ?? '') === 'ai_skill_auth_expired' || /授权已过期/.test(String(json?.message ?? json?.msg ?? '')))
+            throw authCodeError('auth-code-expired', 'AI_SKILL_AUTH_EXPIRED', userFacingSkillAuthMessage('expired'));
+        throw authCodeError('no-auth-code', 'AI_SKILL_NO_AUTH', userFacingSkillAuthMessage('no_auth'));
+    }
     if (!resp.ok || !json || json.status === false || json.errorCode) {
         const code = /^[\w-]{1,64}$/.test(String(json?.errorCode ?? '')) ? String(json.errorCode) : 'UNKNOWN';
         const err = new Error(`register 失败（HTTP ${status}，code=${code}）`);
@@ -635,6 +638,7 @@ export class AuthTokenSession {
     }
     /** acquireToken 真实主体（持有跨进程锁时执行）；跳过续期/未拿到 token 均返回 null。 */
     async _acquireTokenInner(reason = 'renew') {
+        await ensureAgentAuth(this.baseUrl);
         // ② 跨进程锁：重读磁盘看别的进程是否正在续期（窗口内跳过）
         this._reloadData();
         const acquiringAt = this.data.acquiringAt || 0;
@@ -650,9 +654,9 @@ export class AuthTokenSession {
             const username = this.cfg.username || '';
             // ★ #15 文案区分：续期 vs 首登（loginForCookie 的"请在浏览器登录页输入账密"是共享等待语，这里先打场景横幅）
             if (reason === 'first')
-                console.error('[AUTH] 首次登录：开浏览器拿 cookie → 换 aiAgentToken（点「确认授权」）。');
+                console.error('[AUTH] 首次登录：浏览器登录并核验账号后申请 aiAgentToken。');
             else
-                console.error('[AUTH] token 已过期，弹浏览器续期：用 cookie 换新 aiAgentToken（点「确认授权」）。');
+                console.error('[AUTH] token 已过期：浏览器登录并核验账号后申请新 aiAgentToken。');
             // autoFill 失败已在 loginForCookie 内原地转手动登录（同一浏览器会话），不再二次重开浏览器
             const cookieString = await loginForCookie(this.baseUrl, username, username ? password : '', { headless: false });
             this.saveCookieToProfile(cookieString);
@@ -669,7 +673,7 @@ export class AuthTokenSession {
                 return token;
             }
             catch (e) {
-                if (e.code === 'FORCED_OFFLINE') throw e;
+                if (e.code === 'FORCED_OFFLINE' || e.code === 'AI_SKILL_NO_AUTH' || e.code === 'AI_SKILL_AUTH_EXPIRED') throw e;
                 // 大声诊断：区分 404 不支持 / 网络不通 / 其它，不再含糊"系统可能不支持"
                 const kind = e?.e9kind || (e?.e9status === 404 ? 'unsupported' : 'other');
                 if (kind === 'unsupported')
@@ -693,6 +697,7 @@ export class AuthTokenSession {
     }
     /** Renew an expiring agent token with the live Cookie, without opening a browser. */
     async renewWithCookie() {
+        await ensureAgentAuth(this.baseUrl);
         const key = this.profileName || 'default';
         if (_renewInflight.has(key)) return _renewInflight.get(key);
         const work = async () => {
@@ -714,7 +719,7 @@ export class AuthTokenSession {
                 return token;
             }
             catch (error) {
-                if (error.code === 'FORCED_OFFLINE') throw error;
+                if (error.code === 'FORCED_OFFLINE' || error.code === 'AI_SKILL_NO_AUTH' || error.code === 'AI_SKILL_AUTH_EXPIRED') throw error;
                 this.data.cookieRenewFailedAt = Date.now();
                 this.data.acquiringAt = 0;
                 this.save();

package/dist/auth.js

@@ -4,7 +4,7 @@ import { endpointFor, profileNameFromBaseUrl, updateConfigCookie } from './confi
 import { passwordLogin, assertPasswordLoginTransport } from './password-login.js';
 import { promptCaptcha } from './captcha-display.js';
 import { PASSWORD_RISK_NOTICE, assertNoCredentialArguments, readPasswordCredentials } from './password-input.js';
-import { AuthTokenSession, ensurePlaywright, canReach } from './auth-token.js';
+import { AuthTokenSession, ensurePlaywright, canReach, loginForCookie, ensureAgentAuth, verifySkillAuth, skillAuthDomain } from './auth-token.js';
 import { probeCookieSession, sessionOptions, refreshCookie, assertSessionNotForcedOffline, latchForcedOffline } from './session.js';
 import { parseDuration, keepaliveStatus, stopKeepalive, startBackgroundKeepalive, runForegroundKeepalive } from './keepalive.js';
 /** 登录前隐私确认（硬门槛）：未持久化同意且未带 --consent 时拒绝执行登录/鉴权。
@@ -32,13 +32,44 @@ function loginError(code, message) { const error = new Error(message); error.cod
 export function browserEnvironmentUnavailable(platform = process.platform, env = process.env) {
     return platform === 'linux' && !env.DISPLAY && !env.WAYLAND_DISPLAY;
 }
+/** Interactive browser login for sites without the aiAgentToken authorization page. */
+export async function cmdCookieBrowserLogin(cfg, args, dependencies = {}) {
+    ensureLlmConsent(cfg, args);
+    refreshCookie(cfg);
+    assertSessionNotForcedOffline(cfg);
+    const ep = endpointFor(cfg);
+    if (!ep.baseUrl || ep.baseUrl.replace(/\/+$/, '') === 'http://localhost:8080')
+        throw loginError('LOGIN_CONFIG_MISSING', '请先配置 BDIP 平台地址');
+    await (dependencies.verifyAuth ?? ensureAgentAuth)(ep.baseUrl);
+    const reachable = dependencies.reachable ?? canReach;
+    if (!await reachable(ep.baseUrl, 8000))
+        throw loginError('LOGIN_NETWORK_ERROR', '平台地址不可达，请检查地址与网络');
+    const ensureBrowser = dependencies.ensureBrowser ?? ensurePlaywright;
+    await ensureBrowser();
+    const login = dependencies.login ?? loginForCookie;
+    const expectedCookie = cfg.cookie ?? '';
+    console.log('请在打开的 BDIP 页面完成登录；验证成功后自动保存 Cookie。');
+    const cookie = await login(ep.baseUrl, '', '', {headless: false});
+    const candidate = {...cfg, cookie, _configPath: undefined};
+    const probe = dependencies.probe ?? probeCookieSession;
+    const verified = await probe(candidate, {refresh: false});
+    if (!verified.authenticated) throw loginError('IDENTITY_UNVERIFIED', '未验证到当前账号，未保存登录态');
+    if (!updateConfigCookie(cfg, candidate.cookie, expectedCookie))
+        throw loginError('PROFILE_CHANGED', '登录期间本地配置变化，未覆盖新登录态');
+    const session = AuthTokenSession.fromProfile(cfg);
+    session.data = {token: '', expireTime: '', expireSeconds: 0, cookieSavedAt: Date.now(), noToken: true,
+        userId: String(verified.userId), acquiringAt: 0, acquireFailedAt: 0};
+    session.save();
+    console.log(`✔ Cookie 登录已验证并保存；当前用户 ${verified.userId}。`);
+    return {mode: 'browser-cookie', userId: String(verified.userId)};
+}
 /** Test seams are explicit function dependencies, never user-controlled command flags. */
 export async function cmdTokenLogin(cfg, args, dependencies = {}) {
     assertNoCredentialArguments(args);
     ensureLlmConsent(cfg, args);
     const deps = { probe: probeCookieSession, reachable: canReach, ensureBrowser: ensurePlaywright,
         browserUnavailable: browserEnvironmentUnavailable, getTokenSession: () => AuthTokenSession.fromProfile(cfg),
-        readCredentials: readPasswordCredentials, promptCaptcha, passwordLogin, ...dependencies };
+        readCredentials: readPasswordCredentials, promptCaptcha, passwordLogin, verifyAuth: ensureAgentAuth, ...dependencies };
     const flags = args?.flags ?? {};
     if (flags['allow-insecure-password-input'] !== undefined && flags['allow-insecure-password-input'] !== true
         || flags['credentials-stdin'] !== undefined && flags['credentials-stdin'] !== true) {
@@ -51,6 +82,7 @@ export async function cmdTokenLogin(cfg, args, dependencies = {}) {
         console.error('✗ baseUrl 未配置，先跑 bdip config set baseUrl <你的E9地址>');
         process.exit(1);
     }
+    await deps.verifyAuth(ep.baseUrl);
     if (cfg.cookie) {
         let checkedCookie = cfg.cookie;
         const existing = await deps.probe(cfg, { onCredential: cookie => { checkedCookie = cookie; } });
@@ -145,7 +177,7 @@ export async function cmdTokenLogin(cfg, args, dependencies = {}) {
     // ── 第3步：开浏览器登录拿 token ──
     console.log(`[3/3] 为环境 "${profileName}" (${cfg.username || '?'}@${ep.baseUrl}) 开浏览器登录拿 aiAgentToken ...`);
     if (!cfg.username || !cfg.encPassword) {
-        console.log('⚠ 未配置 username/encPassword，将启动有头浏览器手动登录（输账密并点「确认授权」）');
+        console.log('⚠ 未配置 username/encPassword，将启动浏览器手动登录；账号核验成功后自动关闭窗口。');
         console.log('  （在 .bdip/config.json 配置后可 autoFill 自动填）');
     }
     const session = deps.getTokenSession();
@@ -164,13 +196,14 @@ export async function cmdTokenLogin(cfg, args, dependencies = {}) {
  * 手动导入 cookie 走 cookie 鉴权（无需浏览器，给无桌面/无 playwright 机器的后路）。
  * 接受 --cookie <串> / --file <路径>，缺省交互式提示粘贴。
  */
-export async function cmdCookieLogin(cfg, args) {
+export async function cmdCookieLogin(cfg, args, dependencies = {}) {
     ensureLlmConsent(cfg, args);
     const ep = endpointFor(cfg);
     if (!ep.baseUrl || ep.baseUrl.replace(/\/+$/, '') === 'http://localhost:8080') {
         console.error('✗ baseUrl 未配置，先跑 bdip config set baseUrl <你的E9地址>');
         process.exit(1);
     }
+    await (dependencies.verifyAuth ?? ensureAgentAuth)(ep.baseUrl);
     let cookie = '';
     if (args?.flags && typeof args.flags.cookie === 'string' && args.flags.cookie)
         cookie = args.flags.cookie;
@@ -206,6 +239,14 @@ export async function cmdCookieLogin(cfg, args) {
     console.log(`  已验证当前用户：${verified.userId}${verified.loginId ? ` (${verified.loginId})` : ''}；${verified.mode === 'extension' ? `空闲超时 ${verified.idleTimeoutSeconds} 秒` : verified.message}`);
     console.log('  业务命令运行期间会自动心跳；跨多次命令的长任务请运行 `bdip auth keepalive --duration 8h --background`。');
 }
+export async function cmdSkillAuthVerify(cfg) {
+    const baseUrl = endpointFor(cfg).baseUrl;
+    if (!baseUrl || baseUrl.replace(/\/+$/, '') === 'http://localhost:8080')
+        throw loginError('AI_SKILL_NO_AUTH', '尚未配置办公平台地址，请先运行 bdip config set baseUrl <地址>。');
+    const result = await verifySkillAuth(baseUrl);
+    console.log(`✔ 当前办公平台授权有效：${skillAuthDomain(baseUrl)}`);
+    return result;
+}
 /** 读 stdin 第一条非空行（交互式粘贴 cookie）。5 分钟兜底超时。 */
 function readCookieLine() {
     return new Promise((resolve) => {

package/dist/browser-links.js

@@ -12,6 +12,7 @@ let warnedInvalidConfig = false;
 const PAGE_PATHS = new Set([
     '/wui/index.html', '/spa/workflow/static4form/index.html', '/spa/workflow/static4mobileform/index.html', '/spa/cube/index.html',
     '/spa/email/static/index.html', '/spa/workplan/static/index.html', '/spa/hrm/index_mobx.html',
+    '/spa/document/index.jsp',
 ]);
 
 function plain(targetUrl, status, reason = null) {

package/dist/cli.js

@@ -24,7 +24,7 @@ import { getMyBlogList, getMyBlogAll, isBlogRecalled, createBlog, getBlogWorkInd
 import { getCreateWfList, buildCreateWfUrl, buildRequestFormUrl, findCreateWfByName } from './wfcreate.js';
 import { describeFormFields, VIEWATTR_LABEL } from './wfform.js';
 import { getStartableFields, prepareCreateSubmission, submitCreateRequest, resolveWorkflowId, getOdocNextNodes, odocFlowNext } from './wfstart.js';
-import { cmdTokenLogin, cmdCookieLogin, cmdAuthStatus, cmdKeepAlive } from './auth.js';
+import { cmdTokenLogin, cmdCookieBrowserLogin, cmdCookieLogin, cmdSkillAuthVerify, cmdAuthStatus, cmdKeepAlive } from './auth.js';
 import { resolveBrowserLink, resolveBrowserLinks, browserLinkNote } from './browser-links.js';
 import { getEmailList, getEmailView, setMailReadStatus, resolveDateRange, sendEmail, setEmailStar, deleteEmails, moveEmails, getEmailLabels, addEmailLabel, applyEmailLabel, setEmailWaitdeal, recallEmail, uploadEmailAttachment, getEmailAttachmentList, getEmailSize, getEmailReciveAccounts } from './email.js';
 import { searchWorkplan, createWorkplan, getMyCalendar, getAttentionData, getBaseData, getCalendarData, getSelectType, getWorkplanSearchCondition, viewWorkplan, deleteWorkplan, finishWorkplan, downloadWorkplanImportTemplate, importWorkplanExcel, exportWorkplanExcel } from './workplan.js';
@@ -38,6 +38,7 @@ import { getCurrentUser, getCurrentUserIsAdmin } from './wfuser.js';
 import { getSubordinates, assertUserIdsInScope, assertNamesInScope, resolveNameToUid, isScopeEnforced } from './subordinate.js';
 import { resolveHrmTab, getHrmTabs, getHrmConditions, resolveHrmCondition, hrmList, buildHrmCardUrl, findHrmOrgNode, applyResolvedPersonIds, expandHrmOrgTree } from './hrm.js';
 import { parseArgs, flagStr, flagBool } from './args.js';
+import { uploadFile as uploadWorkflowFile } from './wfupload.js';
 import { todayStr } from './util.js';
 import { BOX_TOP, DIVIDER } from './render.js';
 function usage() {
@@ -49,6 +50,8 @@ function usage() {
         '  bdip link <url> [--json]      为当前账号生成浏览器免登录链接',
         '  bdip auth keepalive [--duration 8h] [--background] [--json]',
         '  bdip auth keepalive --status | --stop [--json]',
+        '  bdip auth cookie-browser-login --consent    交互式网页登录并验证 Cookie，不申请 aiAgentToken',
+        '  bdip auth skill-verify                  校验当前办公平台域名授权',
         '  bdip account list [--json]  查看关联账号与当前身份',
         '  bdip account switch --id <账号ID> [--json]  切换并验证关联账号',
         '  bdip whoami                  查看当前登录人（userid/用户名/是否系统管理员 isAdmin）',
@@ -104,6 +107,7 @@ function usage() {
         '  bdip create open --requestid <请求id> [--id <wf>]      生成已有请求表单 URL（处理/提交待办用，手动填+提交）',
         '  bdip create fields --id <流程id>                        模拟打开发起表单，列出字段（可编辑/只读/隐藏/控件类型）',
         '  bdip create start [--id <id>|--name <名>] [--values <json>|--values-file <path>] [--detail-file <path>] [--requestname <名>] [--yes --plan <id>]  预览生成确认计划；提交复用确认字段',
+        '  bdip create upload --id <流程id> --field-id <附件字段id> --file <本地路径> --receipt <新回执路径> --confirm  先上传附件取得文件ID，再纳入流程预览',
         '  bdip create flow --requestid <请求id> --workflowid <流程id> [--next-user <uid>] [--yes]  公文流转：取可流转候选→确认→推送下一节点（公文 create start 后续步骤）',
         '  bdip page-open --page todo|done|mine|center|newflow|view [--request-id <id>]   生成流程中心页面链接',
         '  bdip email list [--page <n>] [--subject <text>] [--from <text>] [--to <text>] [--date <语义>] [--datetype <n>] [--startdate <YYYY-MM-DD>] [--enddate <YYYY-MM-DD>] [--folder inbox|sent|<id>]   收件箱/已发送邮件列表（单步 GET）',
@@ -627,8 +631,50 @@ async function runCreateVerify(args) {
     console.log('请在 OA 中确认保留项；在确认前系统不会自动重试。');
 }
 
+async function runCreateUpload(args) {
+    const workflowId = flagStr(args, 'id');
+    const fieldId = flagStr(args, 'field-id');
+    const filePath = flagStr(args, 'file');
+    const receiptPath = flagStr(args, 'receipt');
+    if (!/^\d+$/.test(String(workflowId ?? '')) || !/^\d+$/.test(String(fieldId ?? '')) || !filePath || !receiptPath)
+        throw new Error('用法：bdip create upload --id <流程ID> --field-id <附件字段ID> --file <本地路径> --receipt <新回执路径> [--confirm]');
+    const cfg = loadConfig(flagStr(args, 'config'));
+    const form = await getStartableFields(cfg, workflowId);
+    const field = form.fields.find(item => String(item.id) === String(fieldId));
+    if (!form.verifyRight || !field || Number(field.htmltype) !== 4 || Number(field.viewattr) === 1 || Number(field.viewattr) === 4)
+        throw new Error('当前流程没有可上传的该主表附件字段，或字段不可编辑');
+    const accounts = await listAccounts(cfg);
+    const current = accounts.find(item => item.current);
+    if (!current || accounts.filter(item => item.current).length !== 1) throw new Error('当前账号未核验');
+    const stat = fs.statSync(filePath);
+    if (!stat.isFile() || stat.size === 0) throw new Error('待上传文件为空或不是普通文件');
+    if (!args.flags.confirm) {
+        console.log(`附件上传预览：流程 ${form.workflowName ?? workflowId}；字段 ${field.label ?? fieldId}；文件 ${filePath}；账号 ${current.name}(${current.id})。确认后单独加 --confirm 上传，取得文件 ID 后再运行 create start 预览。`);
+        return;
+    }
+    const receipt = {state: 'uploading', baseUrl: cfg.baseUrl, workflowId: String(workflowId), fieldId: String(fieldId), filePath, accountId: current.id};
+    fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2), {flag: 'wx'});
+    try {
+        const result = await uploadWorkflowFile(cfg, {workflowId, fieldId, filePath, loginuserid: current.id});
+        if (!/^\d+$/.test(result.imagefileid)) throw new Error('上传响应缺少可用于表单的 imagefileid');
+        receipt.state = 'uploaded';
+        receipt.fileId = result.imagefileid;
+        receipt.uploadId = result.fileid;
+        fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2));
+        console.log(`附件已上传，尚未发起流程。将字段 ${fieldId} 的值设为 ${result.imagefileid}，重新运行 create start 预览。回执：${receiptPath}`);
+    } catch (error) {
+        receipt.state = 'verification-required';
+        fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2));
+        throw error;
+    }
+}
+
 async function runCreate(args) {
     const sub = args._[1] ?? 'list';
+    if (sub === 'upload') {
+        await runCreateUpload(args);
+        return;
+    }
     if (sub === 'workflows') {
         await runCreateWorkflows(args);
         return;
@@ -1246,6 +1292,10 @@ async function runCreateOpen(args) {
 async function runAuth(args) {
     const sub = args._[1] ?? 'status';
     const cfg = loadConfig(flagStr(args, 'config'));
+    if (sub === 'skill-verify') {
+        await cmdSkillAuthVerify(cfg);
+        return;
+    }
     if (sub === 'keepalive') {
         await cmdKeepAlive(cfg, args);
         return;
@@ -1254,6 +1304,10 @@ async function runAuth(args) {
         await cmdTokenLogin(cfg, args);
         return;
     }
+    if (sub === 'cookie-browser-login') {
+        await cmdCookieBrowserLogin(cfg, args);
+        return;
+    }
     if (sub === 'cookie-login') {
         await cmdCookieLogin(cfg, args);
         return;
@@ -1275,7 +1329,7 @@ async function runAuth(args) {
             : '⚠ 已撤销隐私同意：后续登录需重新确认（--consent）。');
         return;
     }
-    console.error(`auth 暂只支持 token-login / cookie-login / status / consent / keepalive，收到: ${sub}`);
+    console.error(`auth 暂只支持 skill-verify / token-login / cookie-browser-login / cookie-login / status / consent / keepalive，收到: ${sub}`);
     process.exit(1);
 }
 async function runBlog(args) {
@@ -4926,7 +4980,7 @@ async function main() {
     }
     if (cmd === 'version') {
         const buildHash = createHash('sha256').update(fs.readFileSync(new URL(import.meta.url))).digest('hex').slice(0, 12);
-        console.log(JSON.stringify({ name: 'bdip-office-assistant-cli', version: '1.0.0', buildHash }, null, 2));
+        console.log(JSON.stringify({ name: 'bdip-office-assistant-cli', version: '1.0.1', buildHash }, null, 2));
         return;
     }
     if (cmd === 'whoami') {
@@ -5446,7 +5500,7 @@ function runConfig(args) {
     if (sub === 'init') {
         console.log('BDIP5 首次配置：');
         console.log('  1) bdip config set baseUrl http://你的E9地址:端口');
-        console.log('  2) bdip auth token-login   （有头浏览器登录 BDIP5 + 点确认授权，拿 aiAgentToken，cookie 自动写回）');
+        console.log('  2) bdip auth token-login   （浏览器登录 BDIP5，账号核验成功后保存 Cookie 并申请 aiAgentToken）');
         console.log('  3) bdip blog check / bdip todo list / bdip create list   验证');
         return;
     }

package/dist/documents.js

@@ -0,0 +1,98 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {resolveBrowserLinks} from './browser-links.js';
+
+export function directories(tree) {
+  const rows=[];
+  const walk=(value,parent='')=>{
+    if(Array.isArray(value)){for(const v of value)walk(v,parent);return;}
+    if(!value||typeof value!=='object')return;
+    const full=value.categoryid!=null&&value.name?[parent,value.name].filter(Boolean).join('/'):parent;
+    if(value.categoryid!=null&&value.name)rows.push({id:String(value.categoryid),name:value.name,path:full,hasRight:value.hasRight});
+    for(const [key,v]of Object.entries(value))if(v&&typeof v==='object')walk(v,full);
+  };
+  walk(tree);return rows;
+}
+export async function request(api,method,route,body) {
+  const multipart=body instanceof FormData;
+  const headers=await api.getHeaders(method==='POST'&&!multipart?'application/x-www-form-urlencoded; charset=utf-8':undefined,{forceCookie:true});
+  const response=await fetch(new URL(route,api.baseUrl),{method,headers,body:method==='GET'?undefined:multipart?body:new URLSearchParams(body),signal:AbortSignal.timeout(120000)});
+  if(!response.ok)throw Error('文档接口HTTP '+response.status);
+  const json=await response.json();
+  if(json.api_status===false||json.status===false)throw Error('文档接口失败');
+  return json;
+}
+const plain=s=>String(s??'').replace(/<[^>]*>/g,'');
+export async function listDocuments(api,id) {
+  const init=await request(api,'GET','/api/doc/searchlist/list?'+new URLSearchParams({seccategory:id,secid:id}));
+  if(String(init.seccategoryid)!==String(id)||!init.sessionkey)throw Error('文档列表目录范围未验证');
+  const items=[],seen=new Set();
+  for(let page=1;page<=1000;page++){
+    const result=await request(api,'POST','/api/ec/dev/table/datas',{dataKey:init.sessionkey,current:String(page),pageSize:'50'});
+    if(!Array.isArray(result.datas))throw Error('文档列表响应缺失');
+    for(const row of result.datas){
+      if(String(row.seccategory)!==String(id)||!row.id||seen.has(String(row.id)))throw Error('文档分页重复或范围不符');
+      seen.add(String(row.id));
+      const browser=result.browser?.find(b=>String(b.linkvaluecolumn)===String(row.id));
+      const link=String(row.idspan??'').match(/(\/spa\/document\/[^"'<>\s]+)/)?.[1];
+      items.push({id:String(row.id),title:plain(row.docsubject??row.idspan),directoryId:String(row.seccategory),ownerId:String(row.ownerid),creatorId:String(row.doccreaterid),attachmentCount:Number(row.accessorycount),status:plain(browser?.list?.find(v=>v.t_text==='状态')?.t_column)||null,url:link?new URL(link,api.baseUrl).href:null});
+    }
+    // 服务端可能缩小pageSize；只在空页终止，不能把不足请求大小当作末页。
+    if(result.datas.length===0)return items;
+  }
+  throw Error('文档分页超过上限，不能声明完整');
+}
+export async function withDocumentLinks(cfg, rows) {
+  const links=await resolveBrowserLinks(cfg,rows.map(row=>row.url));
+  return rows.map((row,index)=>{
+    const link=links[index];
+    return {...row,...link};
+  });
+}
+export function uploadDefaults(init,file) {
+  if(init.canEdit!==true)throw Error('目录不允许上传');
+  const size=fs.statSync(file).size;
+  const max=Number(init.maxUploadFileSize),min=Number(init.mixUploadFileSize);
+  if(!Number.isFinite(max)||!Number.isFinite(min))throw Error('目录大小规则未知');
+  if((max>0&&size>max*1024)||size<min*1024)throw Error('文件大小不符合目录限制');
+  const ext=path.extname(file).slice(1).toLowerCase(),allowed=String(init.uploadext??'').toLowerCase();
+  if(!['*.*','*'].includes(allowed)&&!allowed.split(/[;,\s]+/).map(x=>x.replace(/^\*?\./,'')).includes(ext))throw Error('扩展名不允许或规则未识别');
+  const defaults={};
+  const walk=values=>{for(const c of values??[]){if(c.items){walk(c.items);continue;}const key=c.domkey?.[0];if(!key)throw Error('未知文档初始化字段');const value=c.otherParams?.value??c.browserConditionParam?.replaceDatas?.map(x=>x.id).join(',')??c.value;if(value!=null&&value!=='')defaults[key]=String(value);else if(Number(c.viewAttr)===3)throw Error('缺少必填文档属性：'+key);}};
+  walk(init.conditions);
+  if(!defaults.ownerid)throw Error('未取得默认所有者');
+  return defaults;
+}
+export async function documentMain(api,args,accountId,cfg) {
+  const [action,id,file,receipt]=args;
+  if(action==='directories')return directories((await request(api,'GET','/api/doc/console/category/tree')).treeDatas).filter(r=>!id||r.name.includes(id)||r.path.includes(id));
+  if(!/^\d+$/.test(id??''))throw Error('请先按名查询并选择目录ID');
+  if(action==='list')return withDocumentLinks(cfg,await listDocuments(api,id));
+  if(action==='init')return request(api,'GET','/api/doc/console/multi/init?'+new URLSearchParams({secCategoryId:id}));
+  if(action==='upload'){
+    if(!file||!receipt||!args.includes('--confirm'))throw Error('上传需要文件、全新回执路径和--confirm；仅保存，不发布');
+    const init=await request(api,'GET','/api/doc/console/multi/init?'+new URLSearchParams({secCategoryId:id}));
+    const defaults=uploadDefaults(init,file);
+    const before=await listDocuments(api,id),beforeIds=new Set(before.map(r=>r.id));
+    const state={state:'prepared',directoryId:id,accountId,file:path.resolve(file),ownerId:defaults.ownerid};
+    fs.writeFileSync(receipt,JSON.stringify(state,null,2),{flag:'wx'});
+    const saveState=()=>fs.writeFileSync(receipt,JSON.stringify(state,null,2));
+    try{
+      state.state='uploading';saveState();
+      const form=new FormData();form.append('category','document');form.append('file',new Blob([fs.readFileSync(file)]),path.basename(file));
+      const up=await request(api,'POST','/api/doc/upload/uploadFile',form);
+      if(String(up.status)!=='1'||!up.data?.fileid)throw Error('附件上传未确认');
+      state.attachmentId=String(up.data.fileid);state.state='saving';saveState();
+      const identity=await request(api,'GET','/api/hrm/login/getAccountList');
+      const current=identity.data?.accountlist?.filter(a=>String(a.iscurrent)==='1');
+      if(current?.length!==1||String(current[0].userid)!==accountId)throw Error('上传期间账号变化，停止保存');
+      const saved=await request(api,'POST','/api/doc/console/multi/saveUpload',{...defaults,secCategoryId:id,seccategory:id,fileIds:state.attachmentId});
+      if(saved.api_status!==true)throw Error('文档保存未确认');
+      const title=path.parse(up.data.filename||path.basename(file)).name;
+      const matches=(await listDocuments(api,id)).filter(r=>!beforeIds.has(r.id)&&r.title===title&&r.ownerId===defaults.ownerid&&r.creatorId===accountId&&r.attachmentCount===1&&r.status==='草稿');
+      if(matches.length!==1)throw Error('保存后文档回查不唯一或属性不一致');
+      state.state='draft-verified';state.document=(await withDocumentLinks(cfg,matches))[0];saveState();return state;
+    }catch(error){state.state='uncertain';state.error=error.message;saveState();throw Error(error.message+'；查阅回执并查询目录核验，禁止自动重复上传/保存');}
+  }
+  throw Error('文档命令：directories [名称] | list <目录ID> | init <目录ID> | upload <目录ID> <文件> <新回执路径> --confirm');
+}