digitalsee-ai-flow-cli 0.7.6 → 0.7.24-beta.1

package/README.md

@@ -98,7 +98,7 @@ ai-flow auth status --json
 
 `--json` 输出示例：
 ```json
-{ "ok": true, "loggedIn": true, "activeProfile": "dev", "token": "abcd****1234", "baseUrl": "https://dev.example.com" }
+{ "ok": true, "data": { "loggedIn": true, "activeProfile": "dev", "token": "abcd****1234", "baseUrl": "https://dev.example.com" } }
 ```
 
 ### auth logout
@@ -188,6 +188,22 @@ ai-flow profile show --name prod    # 指定 Profile
 ai-flow profile show --json
 ```
 
+输出示例（当前 Profile）：
+```
+==================== Profile: dev ====================
+baseUrl:       https://dev.example.com
+token:         abcd****1234
+insecure:      false
+Node Package:  支持
+```
+
+`--json` 输出示例：
+```json
+{ "ok": true, "data": { "baseUrl": "https://dev.example.com", "token": "abcd****1234", "insecure": false, "nodePackageSupported": true } }
+```
+
+> Node Package 状态在登录后自动检测缓存。查看非当前 Profile 时该字段为 `undefined`（不检测）。
+
 ### profile delete / rename
 
 删除或重命名 Profile。
@@ -1284,6 +1300,57 @@ ai-flow sync status --id <connectorId> --json
 
 ---
 
+## 运维日志
+
+查询和实时跟踪运维服务日志。
+
+### service-log search
+
+查询历史运维日志，按时间范围、级别、关键词等条件筛选。
+
+```bash
+ai-flow service-log search --time-range 1h
+ai-flow service-log search --time-range 3h --level ERROR
+ai-flow service-log search --time-range 7d --keyword "timeout" --service-type iam
+ai-flow service-log search --start-time "2026-07-01 00:00:00" --end-time "2026-07-20 23:59:59"
+ai-flow service-log search --time-range 24h --limit 100 --json
+```
+
+| 选项 | 必填 | 默认值 | 说明 |
+|------|------|--------|------|
+| `--time-range` | 二选一 | — | 相对时间范围，格式: `<N>s\|m\|h\|d`（如 `30s`, `15m`, `3h`, `7d`），与 `--start-time` 互斥 |
+| `--start-time` | 二选一 | — | 开始时间 `yyyy-MM-dd HH:mm:ss`，与 `--time-range` 互斥 |
+| `--end-time` | 否 | 请求时刻 | 结束时间 `yyyy-MM-dd HH:mm:ss` |
+| `--limit` | 否 | `50` | 最大返回条数（上限 500） |
+| `--level` | 否 | — | 日志级别：`INFO` / `WARN` / `ERROR` |
+| `--request-id` | 否 | — | 链路 trace id（精确匹配） |
+| `--keyword` | 否 | — | 日志正文关键词 |
+| `--service-type` | 否 | — | 服务类型：`iam` / `acm` / `ncm` / `adm` / `mdm` / `nginx` 等 |
+| `--json` | 否 | — | 以 JSON 格式输出 `{ ok, data, total }` |
+
+### service-log stream
+
+通过 WebSocket 实时跟随运维日志，按 `Ctrl+C` 退出。连接前自动校验 token 可用性。
+
+```bash
+ai-flow service-log stream
+ai-flow service-log stream --level ERROR --service-type iam
+ai-flow service-log stream --keyword "exception" --max 100
+ai-flow service-log stream --json   # NDJSON 输出（每行一条 { ok, data }）
+```
+
+| 选项 | 必填 | 默认值 | 说明 |
+|------|------|--------|------|
+| `--level` | 否 | — | 日志级别：`INFO` / `WARN` / `ERROR` |
+| `--request-id` | 否 | — | 链路 trace id（精确匹配） |
+| `--keyword` | 否 | — | 日志正文关键词 |
+| `--service-type` | 否 | — | 服务类型：`iam` / `acm` / `ncm` / `adm` / `mdm` / `nginx` 等 |
+| `--limit` | 否 | `20` | 单次 ES 拉取批量 |
+| `--max` | 否 | — | 收到 N 条后自动退出（默认不限） |
+| `--json` | 否 | — | NDJSON 输出，每行一条 `{ ok, data }` |
+
+---
+
 ## 知识库
 
 ### knowledge categories
@@ -1292,8 +1359,7 @@ ai-flow sync status --id <connectorId> --json
 
 ```bash
 ai-flow knowledge categories
-ai-flow knowledge categories --type action
-ai-flow knowledge categories --type trigger
+ai-flow knowledge categories --trigger
 ai-flow knowledge categories --json
 ```
 
@@ -1304,7 +1370,7 @@ ai-flow knowledge categories --json
 ```bash
 ai-flow knowledge nodes
 ai-flow knowledge nodes <category>
-ai-flow knowledge nodes --name "sql" --flow-id <flowId>
+ai-flow knowledge nodes --name "sql"
 ai-flow knowledge nodes --name "HTTP" --trigger --page 1 --size 20
 ai-flow knowledge nodes --json
 ```
@@ -1344,7 +1410,7 @@ ai-flow knowledge actions <linkId> --json        # JSON 格式输出（含 outpu
 
 ### knowledge generate-skills
 
-遍历所有分类（action / trigger / tool / mcp / model / memory）下的所有节点和动作，为每个动作生成 Markdown 文档和 JSON 结构化数据文件，按分类类型存储。
+遍历所有分类下的所有节点和动作，为每个动作生成 Markdown 文档和 JSON 结构化数据文件，按分类类型和分类名组织存储。支持 `node_schema` 模式（包含 input/output fields 详情）。
 
 ```bash
 ai-flow knowledge generate-skills ./docs
@@ -1356,26 +1422,20 @@ ai-flow knowledge generate-skills ./docs --json
 输出：
 ```
 docs/
-├── action/
-│   ├── markdown/
+├── normal/
+│   ├── HTTP/
 │   │   ├── HTTP_发送请求.md
-│   │   └── ...
-│   └── json/
-│       ├── HTTP_发送请求.json
-│       └── ...
-├── trigger/
-│   ├── markdown/
-│   │   ├── Webhook_接收数据v2.md
-│   │   └── ...
-│   └── json/
-│       └── ...
-├── tool/
-│   └── ...
+│   │   └── HTTP_发送请求.json
+│   └── MySQL/
+│       ├── MySQL_执行SQL查询.md
+│       └── MySQL_执行SQL查询.json
+├── normal-trigger/
+│   └── Webhook/
+│       ├── Webhook_接收数据v2.md
+│       └── Webhook_接收数据v2.json
 ├── mcp/
 │   └── ...
-├── model/
-│   └── ...
-└── memory/
+└── mcp-trigger/
     └── ...
 ```
 
@@ -1563,6 +1623,7 @@ src/
 │   │   ├── cancel-sync.ts
 │   │   └── status.ts
 │   ├── org.ts            # ai-flow org（组织架构）
+│   ├── service-log.ts    # ai-flow service-log（运维日志）
 │   └── knowledge.ts      # ai-flow knowledge
 ├── api/
 │   ├── client.ts         # axios 实例（SSL、Token）
@@ -1574,6 +1635,7 @@ src/
 │   ├── link.ts           # 上游连接器 API
 │   ├── mapping.ts        # 属性映射 API
 │   ├── sync.ts           # 下游连接器 API
+│   ├── service-log.ts    # 运维日志 API（search + stream）
 │   └── org.ts            # 组织架构 API
 ├── services/
 │   ├── flowAnalyzer.ts   # DAG 拓扑分析

package/dist/api/client.js

@@ -14,6 +14,7 @@ exports.apiDelete = apiDelete;
 const https_1 = __importDefault(require("https"));
 const axios_1 = __importDefault(require("axios"));
 const config_1 = require("@/utils/config");
+const refresh_1 = require("@/api/refresh");
 let clientInstance = null;
 function classifyError(error) {
     if (error && typeof error === 'object') {
@@ -116,10 +117,19 @@ function buildClient() {
         },
         timeout: 30000,
     });
-    instance.interceptors.request.use((reqConfig) => {
+    instance.interceptors.request.use(async (reqConfig) => {
         const cfg = (0, config_1.loadConfig)();
-        if (cfg.token) {
-            reqConfig.headers.Authorization = `Bearer ${cfg.token}`;
+        if (cfg.auth?.access_token) {
+            // 临近过期时主动刷新，避免发送已知过期的 token
+            if ((0, refresh_1.isTokenExpired)() && cfg.auth.refresh_token) {
+                const newAuth = await (0, refresh_1.attemptTokenRefresh)();
+                if (newAuth) {
+                    reqConfig.headers.Authorization = `${newAuth.token_type ?? 'Bearer'} ${newAuth.access_token}`;
+                    return reqConfig;
+                }
+                // 刷新失败不阻塞，继续用当前 token，401 interceptor 会再尝试
+            }
+            reqConfig.headers.Authorization = `${cfg.auth.token_type ?? 'Bearer'} ${cfg.auth.access_token}`;
         }
         return reqConfig;
     });
@@ -127,9 +137,29 @@ function buildClient() {
         const body = response.data;
         if (body && typeof body === 'object' && 'data' in body) {
             response.data = body.data;
+            //钉钉网关可能会触发 code: -1, Access Denied
+            if (body.data === null && body.code === '-1') {
+                throw new Error(humanizeError(body.message ?? body));
+            }
         }
         return response;
-    }, (error) => {
+    }, async (error) => {
+        const errObj = error;
+        const originalRequest = errObj.config;
+        if (errObj.response?.status === 401 &&
+            originalRequest &&
+            !originalRequest._retry) {
+            const cfg = (0, config_1.loadConfig)();
+            if (cfg.auth?.refresh_token) {
+                originalRequest._retry = true;
+                const newAuth = await (0, refresh_1.attemptTokenRefresh)();
+                if (newAuth) {
+                    originalRequest.headers = originalRequest.headers || {};
+                    originalRequest.headers.Authorization = `${newAuth.token_type ?? 'Bearer'} ${newAuth.access_token}`;
+                    return instance.request(originalRequest);
+                }
+            }
+        }
         throw new Error(humanizeError(error));
     });
     return instance;

package/dist/api/knowledge.js

@@ -6,21 +6,23 @@ exports.getConnectorDetail = getConnectorDetail;
 exports.getAllConnectors = getAllConnectors;
 const client_1 = require("@/api/client");
 async function getNodeCategories(params) {
-    return (0, client_1.apiGet)('/acm/links/domain/v2', { type: params?.type });
+    return (0, client_1.apiPost)('/acm/node-package/categories/connectable', {
+        scene: params?.scene || 'normal',
+        trigger: params?.trigger || false,
+    });
 }
 async function searchNodesByCategory(params) {
     const body = {
+        scene: 'normal',
         page: params.page || 1,
         size: params.size || 50,
         trigger: params.trigger,
     };
-    if (params.name)
-        body.name = params.name;
-    if (params.flow_id)
-        body.flow_id = params.flow_id;
-    if (params.app_domain_category)
-        body.app_domain_category = params.app_domain_category;
-    const data = await (0, client_1.apiPost)('/acm/links/search', body);
+    if (params.keyword)
+        body.keyword = params.keyword;
+    if (params.category_name)
+        body.category_name = params.category_name;
+    const data = await (0, client_1.apiPost)('/acm/node-package/plugins/connectable', body);
     return data || { items: [], total: 0, page: params.page || 1, size: params.size || 50 };
 }
 async function getConnectorDetail(connectorId) {

package/dist/api/node.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getActions = getActions;
+exports.searchActions = searchActions;
+exports.isNodePackageSupported = isNodePackageSupported;
 exports.getNodeDetail = getNodeDetail;
 exports.createNode = createNode;
 exports.updateNode = updateNode;
@@ -9,6 +11,7 @@ exports.deleteNode = deleteNode;
 exports.testRunNode = testRunNode;
 exports.cancelDebugNode = cancelDebugNode;
 const client_1 = require("@/api/client");
+const knowledge_1 = require("@/api/knowledge");
 const encoding_1 = require("@/utils/encoding");
 async function getActions(params) {
     const data = await (0, client_1.apiGet)('/acm/actions/v2', params);
@@ -22,6 +25,39 @@ async function getActions(params) {
         return data.data;
     return [];
 }
+async function searchActions(params) {
+    const data = await (0, client_1.apiPost)('/acm/links/search', params);
+    const actions = [];
+    if (data && data.items && Array.isArray(data.items)) {
+        for (const item of data.items) {
+            if (item.matched_actions && Array.isArray(item.matched_actions)) {
+                actions.push(...item.matched_actions);
+            }
+        }
+    }
+    return actions;
+}
+async function isNodePackageSupported() {
+    try {
+        const categories = await (0, knowledge_1.getNodeCategories)();
+        const firstName = categories[0]?.name;
+        if (!firstName)
+            return false;
+        const { items } = await (0, knowledge_1.searchNodesByCategory)({
+            category_name: firstName,
+            trigger: true,
+            size: 1,
+        });
+        const linkId = items?.[0]?.connector?.id;
+        if (!linkId)
+            return false;
+        const actions = await getActions({ linkId });
+        return actions.some((action) => action.hasOwnProperty('node_schema'));
+    }
+    catch {
+        return false;
+    }
+}
 async function getNodeDetail(nodeId) {
     return (0, client_1.apiGet)(`/acm/flows/nodes/${nodeId}`);
 }

package/dist/api/refresh.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attemptTokenRefresh = attemptTokenRefresh;
+exports.isTokenExpired = isTokenExpired;
+const https_1 = __importDefault(require("https"));
+const axios_1 = __importDefault(require("axios"));
+const config_1 = require("@/utils/config");
+/**
+ * 并发控制：多个 401 同时到达时，只发一次 refresh 请求，
+ * 其他调用复用同一个 Promise。
+ */
+let isRefreshing = false;
+let pendingRefresh = null;
+const EXPIRY_BUFFER_MS = 120000; // 提前 120 秒刷新，避免临界区过期
+/**
+ * 使用 refresh_token 向 /iam/token 获取新 access_token，
+ * 成功后自动写入 global config 并返回新的 AuthConfig。
+ * 无 refresh_token 或刷新失败返回 null。
+ */
+async function attemptTokenRefresh() {
+    const cfg = (0, config_1.loadConfig)();
+    if (!cfg.auth?.refresh_token) {
+        return null;
+    }
+    // 去重：如果已有正在进行的刷新，复用同一个 Promise
+    if (isRefreshing && pendingRefresh) {
+        return pendingRefresh;
+    }
+    isRefreshing = true;
+    pendingRefresh = (async () => {
+        try {
+            const httpsAgent = new https_1.default.Agent({ rejectUnauthorized: !cfg.insecure });
+            const res = await axios_1.default.post(`${cfg.baseUrl}/iam/token`, {
+                grant_type: 'refresh_token',
+                client_id: 'usercenter',
+                refresh_token: cfg.auth.refresh_token,
+            }, {
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                httpsAgent,
+                timeout: 15000,
+                // 不使用 getClient()，避免触发 request/response 拦截器
+            });
+            const { access_token, refresh_token: newRt, token_type, expires_in } = res.data;
+            const newAuth = {
+                access_token,
+                refresh_token: newRt || cfg.auth.refresh_token,
+                token_type: token_type || cfg.auth.token_type || 'Bearer',
+                // 使用客户端本地时间计算过期时刻，服务端不支持返回绝对过期时间
+                expires_at: Date.now() + (expires_in || 3600) * 1000,
+            };
+            (0, config_1.saveGlobalConfig)({ auth: newAuth });
+            return newAuth;
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : JSON.stringify(err);
+            process.stderr.write(`[refresh] token 刷新失败: ${detail}\n`);
+            return null;
+        }
+        finally {
+            isRefreshing = false;
+            pendingRefresh = null;
+        }
+    })();
+    return pendingRefresh;
+}
+/**
+ * 基于 config.auth.expires_at 判断 token 是否已（或即将）过期。
+ * 包含 120 秒缓冲，避免 token 在飞行期间过期。
+ * 无 expires_at 时默认返回 false（不阻塞，让 401 响应来驱动刷新）。
+ */
+function isTokenExpired() {
+    const cfg = (0, config_1.loadConfig)();
+    if (!cfg.auth?.expires_at) {
+        return false;
+    }
+    return Date.now() >= cfg.auth.expires_at - EXPIRY_BUFFER_MS;
+}
+//# sourceMappingURL=refresh.js.map

package/dist/api/service-log.js

@@ -0,0 +1,125 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyToken = verifyToken;
+exports.searchServiceLogs = searchServiceLogs;
+exports.openServiceLogStream = openServiceLogStream;
+const https_1 = __importDefault(require("https"));
+const axios_1 = __importDefault(require("axios"));
+const ws_1 = __importDefault(require("ws"));
+const config_1 = require("@/utils/config");
+const client_1 = require("@/api/client");
+const SEARCH_PATH = '/iam/api/service-log/search';
+const STREAM_PATH = '/iam/api/service-log/stream';
+/**
+ * 验证当前 token 是否可用（发起轻量 GET 请求）
+ * token 无效时抛出 axios interceptor 格式化的错误
+ */
+async function verifyToken() {
+    const client = (0, client_1.getClient)();
+    await client.get('/iam/api/connectors');
+}
+function buildHttpClient() {
+    const cfg = (0, config_1.loadConfig)();
+    return axios_1.default.create({
+        baseURL: cfg.baseUrl,
+        httpsAgent: new https_1.default.Agent({ rejectUnauthorized: !cfg.insecure }),
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `${cfg.auth?.token_type ?? 'Bearer'} ${cfg.auth?.access_token}`,
+        },
+        timeout: 30000,
+    });
+}
+/**
+ * 本地校验 envelope：现有 client.ts 拦截器只解包 data、不检查 result 字段，
+ * 而文档 2.6 规定业务错误（如 "limit 不能超过 500"）以 HTTP 200 + result=false 返回，
+ * 因此本函数不复用 apiPost，独立 POST 并自行检查 envelope。
+ */
+async function searchServiceLogs(req) {
+    const client = buildHttpClient();
+    const response = await client.post(SEARCH_PATH, req);
+    const body = response.data;
+    if (Array.isArray(body)) {
+        return body;
+    }
+    if (body && typeof body === 'object' && 'result' in body) {
+        if (body.result === false) {
+            throw new Error(body.error_description || body.error || '日志查询失败');
+        }
+        return body.data ?? [];
+    }
+    return [];
+}
+function toWsUrl(baseUrl) {
+    const trimmed = baseUrl.replace(/\/+$/, '');
+    if (trimmed.startsWith('https://')) {
+        return `wss://${trimmed.slice(8)}${STREAM_PATH}`;
+    }
+    if (trimmed.startsWith('http://')) {
+        return `ws://${trimmed.slice(7)}${STREAM_PATH}`;
+    }
+    return `${trimmed}${STREAM_PATH}`;
+}
+function openServiceLogStream(filters, handlers) {
+    const cfg = (0, config_1.loadConfig)();
+    if (!cfg.auth?.access_token) {
+        throw new Error('未登录，请先执行 ai-flow auth login');
+    }
+    const url = toWsUrl(cfg.baseUrl);
+    const ws = new ws_1.default(url, {
+        headers: { Authorization: `${cfg.auth.token_type ?? 'Bearer'} ${cfg.auth.access_token}` },
+        rejectUnauthorized: !cfg.insecure,
+    });
+    let cancelled = false;
+    ws.on('open', () => {
+        const subscribeFrame = {
+            action: 'subscribe',
+            ...filters,
+        };
+        ws.send(JSON.stringify(subscribeFrame));
+        handlers.onOpen?.();
+    });
+    ws.on('message', (raw) => {
+        let msg;
+        try {
+            msg = JSON.parse(raw.toString());
+        }
+        catch {
+            return;
+        }
+        if (msg.type === 'log' && msg.data) {
+            handlers.onLog(msg.data);
+            return;
+        }
+        if (msg.type === 'error' && msg.message) {
+            handlers.onError(msg.message);
+        }
+    });
+    ws.on('close', (code, reasonBuf) => {
+        const reason = reasonBuf?.toString?.() ?? '';
+        handlers.onClose(code, reason);
+    });
+    ws.on('error', (err) => {
+        handlers.onError(err.message || 'WebSocket 连接错误');
+    });
+    return {
+        cancel() {
+            if (cancelled)
+                return;
+            cancelled = true;
+            if (ws.readyState === ws_1.default.OPEN) {
+                ws.send(JSON.stringify({ action: 'cancel' }));
+            }
+            try {
+                ws.close();
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+//# sourceMappingURL=service-log.js.map

package/dist/commands/auth.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAuthCommand = registerAuthCommand;
 const config_1 = require("@/utils/config");
+const nodePackage_1 = require("@/utils/nodePackage");
 const oauth_1 = require("@/utils/oauth");
 const output_1 = require("@/utils/output");
 const chalk_1 = __importDefault(require("chalk"));
@@ -29,14 +30,14 @@ function registerAuthCommand(program) {
             (0, output_1.printInfo)(`使用 Profile: ${(0, config_1.getActiveProfile)()}`);
             const protocol = options.https ? 'https' : 'http';
             (0, output_1.printInfo)(`正在准备 OAuth 登录 (${protocol.toUpperCase()})...`);
-            const { server, port, waitForCode } = options.https
+            const { server, port, waitForResult } = options.https
                 ? await (0, oauth_1.createAuthServerHttps)()
                 : await (0, oauth_1.createAuthServer)();
             const authorizeUrl = (0, oauth_1.buildAuthorizeUrl)(config.baseUrl, port, protocol);
             (0, output_1.printHeader)('OAuth 2 登录');
             (0, output_1.printInfo)('打开下方链接，授权登录');
             console.log(`\n${chalk_1.default.cyan(authorizeUrl)}\n`);
-            const codePromise = waitForCode();
+            const resultPromise = waitForResult();
             (0, output_1.printInfo)('等待授权回调...');
             rl = readline.createInterface({ input, output });
             rl.question('按 Enter 在浏览器中打开...\n', () => {
@@ -50,12 +51,21 @@ function registerAuthCommand(program) {
                     rl.close();
                 }
             });
-            const token = await codePromise;
+            const { access_token, refresh_token, id_token, token_type, expires_in } = await resultPromise;
+            // 使用客户端本地时间计算过期时刻，服务端不支持返回绝对过期时间
+            const expires_at = new Date().getTime() + expires_in * 1000;
             const saveData = {
-                token,
+                auth: {
+                    access_token,
+                    refresh_token,
+                    id_token,
+                    token_type,
+                    expires_at,
+                },
             };
             (0, config_1.saveGlobalConfig)(saveData);
             (0, output_1.printSuccess)('登录成功');
+            (0, nodePackage_1.checkAndCacheNodePackageSupport)().catch(() => { });
             server.close();
         }
         catch (error) {
@@ -75,11 +85,20 @@ function registerAuthCommand(program) {
             if (options.json)
                 (0, output_1.setJsonMode)(true);
             const scope = options.project ? 'project' : 'global';
+            const defaultConfig = {
+                auth: {
+                    access_token: '',
+                    refresh_token: '',
+                    id_token: '',
+                    token_type: '',
+                    expires_at: 0,
+                },
+            };
             if (options.project) {
-                (0, config_1.saveProjectConfig)({ token: '' });
+                (0, config_1.saveProjectConfig)(defaultConfig);
             }
             else {
-                (0, config_1.saveGlobalConfig)({ token: '' });
+                (0, config_1.saveGlobalConfig)(defaultConfig);
             }
             if (options.json) {
                 (0, output_1.printStructuredResult)({ ok: true, scope, activeProfile: (0, config_1.getActiveProfile)() });
@@ -105,9 +124,12 @@ function registerAuthCommand(program) {
             if (options.json)
                 (0, output_1.setJsonMode)(true);
             const config = (0, config_1.loadConfig)();
-            if (!config.token) {
+            if (!config.auth || !config.auth.access_token) {
                 if (options.json) {
-                    (0, output_1.printStructuredResult)({ ok: true, loggedIn: false, activeProfile: (0, config_1.getActiveProfile)() });
+                    (0, output_1.printStructuredResult)({
+                        ok: true,
+                        data: { loggedIn: false, activeProfile: (0, config_1.getActiveProfile)() },
+                    });
                     return;
                 }
                 (0, output_1.printHeader)('认证状态');
@@ -116,18 +138,20 @@ function registerAuthCommand(program) {
                 (0, output_1.printInfo)('请执行 ai-flow auth login 登录');
                 return;
             }
-            const maskedToken = config.token.length > 8
-                ? config.token.substring(0, 4) +
+            const maskedToken = config.auth.access_token.length > 8
+                ? config.auth.access_token.substring(0, 4) +
                     '****' +
-                    config.token.substring(config.token.length - 4)
+                    config.auth.access_token.substring(config.auth.access_token.length - 4)
                 : '****';
             if (options.json) {
                 (0, output_1.printStructuredResult)({
                     ok: true,
-                    loggedIn: true,
-                    activeProfile: (0, config_1.getActiveProfile)(),
-                    token: maskedToken,
-                    baseUrl: config.baseUrl,
+                    data: {
+                        loggedIn: true,
+                        activeProfile: (0, config_1.getActiveProfile)(),
+                        token: maskedToken,
+                        baseUrl: config.baseUrl,
+                    },
                 });
                 return;
             }

package/dist/commands/config.js

@@ -15,7 +15,7 @@ function registerConfigCommand(program) {
         (0, output_1.printKeyValue)([
             ['Profile', (0, config_1.getActiveProfile)()],
             ['baseUrl', config.baseUrl],
-            ['token', (0, output_1.truncateToken)(config.token) || '(未设置)'],
+            ['token', (0, output_1.truncateToken)((0, config_1.getAccessToken)(config)) || '(未设置)'],
             ['insecure', String(config.insecure)],
         ]);
     });
@@ -31,8 +31,10 @@ function registerConfigCommand(program) {
         const updates = {};
         if (options.baseUrl)
             updates.baseUrl = options.baseUrl.replace(/\/+$/, '');
-        if (options.token)
-            updates.token = options.token;
+        if (options.token) {
+            const currentConfig = (0, config_1.loadConfig)(options.profile || undefined);
+            updates.auth = { ...(currentConfig.auth || {}), access_token: options.token };
+        }
         if (options.insecure !== undefined)
             updates.insecure = true;
         if (Object.keys(updates).length === 0) {