linkshell-cli 0.10.74 → 0.10.76

package/dist/wire/src/workflow.d.ts

@@ -1,14 +1,35 @@
 import { z } from "zod";
-export declare const workflowStateSchema: z.ZodEnum<["running", "paused", "completed", "failed", "stopped"]>;
+export declare const workflowStateSchema: z.ZodEnum<{
+    paused: "paused";
+    completed: "completed";
+    failed: "failed";
+    running: "running";
+    stopped: "stopped";
+}>;
 export type WorkflowState = z.infer<typeof workflowStateSchema>;
-export declare const workflowAgentStateSchema: z.ZodEnum<["pending", "running", "paused", "completed", "failed", "stopped", "unknown"]>;
+export declare const workflowAgentStateSchema: z.ZodEnum<{
+    paused: "paused";
+    unknown: "unknown";
+    pending: "pending";
+    completed: "completed";
+    failed: "failed";
+    running: "running";
+    stopped: "stopped";
+}>;
 export type WorkflowAgentState = z.infer<typeof workflowAgentStateSchema>;
 export declare const workflowAgentSchema: z.ZodObject<{
     id: z.ZodString;
-    /** Present only after the host has imported this agent's transcript. */
     toolCallId: z.ZodOptional<z.ZodString>;
     title: z.ZodString;
-    state: z.ZodEnum<["pending", "running", "paused", "completed", "failed", "stopped", "unknown"]>;
+    state: z.ZodEnum<{
+        paused: "paused";
+        unknown: "unknown";
+        pending: "pending";
+        completed: "completed";
+        failed: "failed";
+        running: "running";
+        stopped: "stopped";
+    }>;
     phaseId: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
     tokens: z.ZodOptional<z.ZodNumber>;
@@ -17,54 +38,25 @@ export declare const workflowAgentSchema: z.ZodObject<{
     startedAt: z.ZodOptional<z.ZodNumber>;
     endedAt: z.ZodOptional<z.ZodNumber>;
     result: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    title: string;
-    id: string;
-    state: "unknown" | "paused" | "pending" | "completed" | "failed" | "running" | "stopped";
-    toolCallId?: string | undefined;
-    phaseId?: string | undefined;
-    model?: string | undefined;
-    tokens?: number | undefined;
-    toolCalls?: number | undefined;
-    durationMs?: number | undefined;
-    startedAt?: number | undefined;
-    endedAt?: number | undefined;
-    result?: string | undefined;
-}, {
-    title: string;
-    id: string;
-    state: "unknown" | "paused" | "pending" | "completed" | "failed" | "running" | "stopped";
-    toolCallId?: string | undefined;
-    phaseId?: string | undefined;
-    model?: string | undefined;
-    tokens?: number | undefined;
-    toolCalls?: number | undefined;
-    durationMs?: number | undefined;
-    startedAt?: number | undefined;
-    endedAt?: number | undefined;
-    result?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type WorkflowAgent = z.infer<typeof workflowAgentSchema>;
 export declare const workflowPhaseSchema: z.ZodObject<{
     id: z.ZodString;
     title: z.ZodString;
     order: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    title: string;
-    id: string;
-    order: number;
-}, {
-    title: string;
-    id: string;
-    order: number;
-}>;
+}, z.core.$strip>;
 export type WorkflowPhase = z.infer<typeof workflowPhaseSchema>;
 /** A complete run snapshot, independent of the loaded conversation window. */
 export declare const workflowSchema: z.ZodObject<{
     runId: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
-    state: z.ZodOptional<z.ZodEnum<["running", "paused", "completed", "failed", "stopped"]>>;
-    /** Observed counts: a dynamic script may start more agents later. */
+    state: z.ZodOptional<z.ZodEnum<{
+        paused: "paused";
+        completed: "completed";
+        failed: "failed";
+        running: "running";
+        stopped: "stopped";
+    }>>;
     started: z.ZodOptional<z.ZodNumber>;
     completed: z.ZodOptional<z.ZodNumber>;
     tokens: z.ZodOptional<z.ZodNumber>;
@@ -75,21 +67,20 @@ export declare const workflowSchema: z.ZodObject<{
         id: z.ZodString;
         title: z.ZodString;
         order: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        title: string;
-        id: string;
-        order: number;
-    }, {
-        title: string;
-        id: string;
-        order: number;
-    }>, "many">>;
+    }, z.core.$strip>>>;
     agents: z.ZodOptional<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
-        /** Present only after the host has imported this agent's transcript. */
         toolCallId: z.ZodOptional<z.ZodString>;
         title: z.ZodString;
-        state: z.ZodEnum<["pending", "running", "paused", "completed", "failed", "stopped", "unknown"]>;
+        state: z.ZodEnum<{
+            paused: "paused";
+            unknown: "unknown";
+            pending: "pending";
+            completed: "completed";
+            failed: "failed";
+            running: "running";
+            stopped: "stopped";
+        }>;
         phaseId: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         tokens: z.ZodOptional<z.ZodNumber>;
@@ -98,90 +89,6 @@ export declare const workflowSchema: z.ZodObject<{
         startedAt: z.ZodOptional<z.ZodNumber>;
         endedAt: z.ZodOptional<z.ZodNumber>;
         result: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        title: string;
-        id: string;
-        state: "unknown" | "paused" | "pending" | "completed" | "failed" | "running" | "stopped";
-        toolCallId?: string | undefined;
-        phaseId?: string | undefined;
-        model?: string | undefined;
-        tokens?: number | undefined;
-        toolCalls?: number | undefined;
-        durationMs?: number | undefined;
-        startedAt?: number | undefined;
-        endedAt?: number | undefined;
-        result?: string | undefined;
-    }, {
-        title: string;
-        id: string;
-        state: "unknown" | "paused" | "pending" | "completed" | "failed" | "running" | "stopped";
-        toolCallId?: string | undefined;
-        phaseId?: string | undefined;
-        model?: string | undefined;
-        tokens?: number | undefined;
-        toolCalls?: number | undefined;
-        durationMs?: number | undefined;
-        startedAt?: number | undefined;
-        endedAt?: number | undefined;
-        result?: string | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    name?: string | undefined;
-    completed?: number | undefined;
-    state?: "paused" | "completed" | "failed" | "running" | "stopped" | undefined;
-    tokens?: number | undefined;
-    durationMs?: number | undefined;
-    startedAt?: number | undefined;
-    endedAt?: number | undefined;
-    runId?: string | undefined;
-    started?: number | undefined;
-    phases?: {
-        title: string;
-        id: string;
-        order: number;
-    }[] | undefined;
-    agents?: {
-        title: string;
-        id: string;
-        state: "unknown" | "paused" | "pending" | "completed" | "failed" | "running" | "stopped";
-        toolCallId?: string | undefined;
-        phaseId?: string | undefined;
-        model?: string | undefined;
-        tokens?: number | undefined;
-        toolCalls?: number | undefined;
-        durationMs?: number | undefined;
-        startedAt?: number | undefined;
-        endedAt?: number | undefined;
-        result?: string | undefined;
-    }[] | undefined;
-}, {
-    name?: string | undefined;
-    completed?: number | undefined;
-    state?: "paused" | "completed" | "failed" | "running" | "stopped" | undefined;
-    tokens?: number | undefined;
-    durationMs?: number | undefined;
-    startedAt?: number | undefined;
-    endedAt?: number | undefined;
-    runId?: string | undefined;
-    started?: number | undefined;
-    phases?: {
-        title: string;
-        id: string;
-        order: number;
-    }[] | undefined;
-    agents?: {
-        title: string;
-        id: string;
-        state: "unknown" | "paused" | "pending" | "completed" | "failed" | "running" | "stopped";
-        toolCallId?: string | undefined;
-        phaseId?: string | undefined;
-        model?: string | undefined;
-        tokens?: number | undefined;
-        toolCalls?: number | undefined;
-        durationMs?: number | undefined;
-        startedAt?: number | undefined;
-        endedAt?: number | undefined;
-        result?: string | undefined;
-    }[] | undefined;
-}>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
 export type Workflow = z.infer<typeof workflowSchema>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkshell-cli",
-  "version": "0.10.74",
+  "version": "0.10.76",
   "description": "Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone",
   "type": "module",
   "main": "dist/cli/src/index.js",
@@ -34,9 +34,9 @@
     "node-pty": "^1.1.0",
     "qrcode-terminal": "^0.12.0",
     "ws": "^8.21.0",
-    "@linkshell/gateway": "0.6.39",
-    "@linkshell/wire": "0.2.21",
-    "@linkshell/host": "0.4.69"
+    "@linkshell/gateway": "0.6.41",
+    "@linkshell/host": "0.4.71",
+    "@linkshell/wire": "0.2.23"
   },
   "devDependencies": {
     "@types/ws": "^8.5.14",

package/src/commands/desktop-workspace.ts

@@ -9,7 +9,9 @@ import WebSocket, { WebSocketServer } from "ws";
 import { localWebSocket } from "@linkshell/host/local-transport";
 import { isMethodName, machineInfoSchema, rpcMessageSchema, type MachineEntry } from "@linkshell/wire";
 import { getValidToken, loadAuth } from "../auth.js";
-import { runLogin } from "./login.js";
+import { runLogin, type LoginResult } from "./login.js";
+import { loginWithOAuth, loginWithPassword, openInBrowser } from "./sign-in.js";
+import { LoginError } from "./login-error.js";
 import { runLogout } from "./logout.js";
 import { followAccountGateway, refreshGateway, silenceSqliteWarning } from "./host.js";
 import { DesktopClientState, validStorageKey } from "./desktop-workspace-state.js";
@@ -68,6 +70,38 @@ async function body(request: IncomingMessage): Promise<Record<string, unknown>>
   throw new HttpError(400, "无效的 JSON 请求");
 }
 
+/** POST bodies that may be empty: an empty body is `{}` (what older pages send). */
+async function optionalBody(request: IncomingMessage): Promise<Record<string, unknown>> {
+  if (request.headers["content-type"] === undefined && !Number(request.headers["content-length"] ?? 0) && !request.headers["transfer-encoding"]) {
+    request.resume();
+    return {};
+  }
+  return body(request);
+}
+
+type LoginMethod = "web" | "password" | "github" | "google";
+const LOGIN_METHODS: readonly LoginMethod[] = ["web", "password", "github", "google"];
+
+interface LoginRequest { method: LoginMethod; email?: string; password?: string }
+
+function loginRequest(input: Record<string, unknown>): LoginRequest {
+  const method = input.method ?? "web";
+  if (typeof method !== "string" || !LOGIN_METHODS.includes(method as LoginMethod)) throw new HttpError(400, "不支持的登录方式");
+  if (method !== "password") return { method: method as LoginMethod };
+  const { email, password } = input;
+  if (typeof email !== "string" || typeof password !== "string" || !email.trim() || !password) throw new HttpError(400, "请输入邮箱和密码。");
+  if (email.length > 320 || password.length > 1024) throw new HttpError(400, "登录信息过长，请检查邮箱和密码");
+  return { method: "password", email, password };
+}
+
+interface PendingLogin {
+  method: LoginMethod;
+  abort: AbortController;
+  result: Promise<LoginResult | null>;
+  /** The provider's authorize URL, once the loopback is listening (GitHub / Google only). */
+  url?: string;
+}
+
 async function loadAssets(directory: string): Promise<Map<string, Buffer>> {
   if (!isAbsolute(directory)) throw new Error("桌面工作台资源目录必须使用绝对路径");
   const assets = new Map<string, Buffer>();
@@ -219,8 +253,20 @@ export async function startDesktopWorkspace(options: { assets: string; home?: st
   let workspaceHost = "";
   let previewOrigin = "";
   let previewHost = "";
-  let login: Promise<Awaited<ReturnType<typeof runLogin>>> | undefined;
-  let loginAbort: AbortController | undefined;
+  let login: PendingLogin | undefined;
+  const startLogin = (request: LoginRequest): PendingLogin => {
+    // One sign-in at a time: choosing another way ends the one still waiting on the browser.
+    login?.abort.abort();
+    const abort = new AbortController();
+    const pending: PendingLogin = { method: request.method, abort, result: Promise.resolve(null) };
+    const signal = abort.signal;
+    pending.result = (request.method === "web" ? runLogin({ signal })
+      : request.method === "password" ? loginWithPassword({ email: request.email!, password: request.password!, signal })
+      : loginWithOAuth({ provider: request.method, signal, open: (url) => { pending.url = url; openInBrowser(url); } }))
+      .finally(() => { if (login === pending) login = undefined; });
+    login = pending;
+    return pending;
+  };
   let stopping: Promise<void> | undefined;
   const peers = new WebSocketServer({ noServer: true, perMessageDeflate: false, maxPayload: MAX_PROXY_BYTES });
   const upstreams = new Set<WebSocket>();
@@ -261,18 +307,30 @@ export async function startDesktopWorkspace(options: { assets: string; home?: st
           json(response, 200, { ok: true }); return;
         }
         if (request.method === "POST" && path === "/desktop/login") {
-          if (!login) {
-            loginAbort = new AbortController();
-            login = runLogin({ signal: loginAbort.signal }).finally(() => { login = undefined; loginAbort = undefined; });
+          const wanted = loginRequest(await optionalBody(request));
+          // A page that reloaded while the browser was open rejoins the same sign-in.
+          const pending = login && login.method === wanted.method && wanted.method !== "password" ? login : startLogin(wanted);
+          let result: LoginResult | null;
+          try { result = await pending.result; }
+          catch (error) {
+            // Only our own messages reach the page; anything else may name paths or tokens.
+            throw new HttpError(409, error instanceof LoginError ? error.message : "登录未完成，请重试");
           }
-          const result = await login;
-          if (!result?.success) throw new HttpError(409, "登录未完成，请重试");
+          if (!result?.success) throw new HttpError(409, pending.abort.signal.aborted ? "已取消登录。" : "登录未完成，请重试");
           await accountChanged(result.plan);
           json(response, 200, await account(accountAbort.signal)); return;
         }
+        if (request.method === "GET" && path === "/desktop/login") {
+          json(response, 200, { pending: login ? { method: login.method, ...(login.url ? { url: login.url } : {}) } : null }); return;
+        }
+        if (request.method === "DELETE" && path === "/desktop/login") {
+          login?.abort.abort();
+          json(response, 200, {}); return;
+        }
         if (request.method === "POST" && path === "/desktop/logout") {
-          loginAbort?.abort();
-          await login;
+          const pending = login;
+          pending?.abort.abort();
+          await pending?.result.catch(() => undefined);
           await runLogout();
           await accountChanged();
           json(response, 200, {}); return;
@@ -328,7 +386,7 @@ export async function startDesktopWorkspace(options: { assets: string; home?: st
     stop() {
       return stopping ??= (async () => {
         accountAbort.abort();
-        loginAbort?.abort();
+        login?.abort.abort();
         for (const client of peers.clients) client.terminate();
         for (const upstream of upstreams) upstream.terminate();
         for (const socket of sockets) socket.destroy();

package/src/commands/desktop.ts

@@ -1,5 +1,6 @@
 import { loadAuth } from "../auth.js";
 import { runLogin } from "./login.js";
+import { loginWithOAuth, loginWithPassword, openInBrowser, OAUTH_PROVIDERS, type OAuthProvider } from "./sign-in.js";
 import { runLogout } from "./logout.js";
 import { followAccountGateway, joinGatewayAfterLogin, readHostConfig, writeHostConfig, refreshGateway } from "./host.js";
 import { execFile, spawn } from "node:child_process";
@@ -43,6 +44,32 @@ export async function desktopSnapshot(version: string) {
 }
 
 /** The new password, as JSON on stdin (never on the command line, where `ps` shows it). */
+/**
+ * The gateway the window chose: `off`, or the address of one's own (ws, wss, http or https; the
+ * host speaks WebSocket to either). The official one is `connect-gateway`.
+ */
+export function gatewayChoice(raw: unknown): string {
+  if (raw === "off") return "off";
+  if (typeof raw !== "string" || !raw.trim() || raw.length > 2048) throw new Error("请输入网关地址");
+  let url: URL;
+  try { url = new URL(raw.trim()); } catch { throw new Error("网关地址格式不正确，例如 wss://gateway.example.com"); }
+  if (!["ws:", "wss:", "http:", "https:"].includes(url.protocol) || !url.hostname) throw new Error("网关地址需要以 wss://、ws://、https:// 或 http:// 开头");
+  if (url.username || url.password) throw new Error("网关地址里不能带用户名或密码");
+  return url.toString().replace(/\/+$/, "");
+}
+
+async function jsonInput(input: AsyncIterable<string | Buffer>): Promise<Record<string, unknown>> {
+  const chunks: Buffer[] = [];
+  let length = 0;
+  for await (const chunk of input) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    length += buffer.length;
+    if (length > 8192) throw new Error("输入过长");
+    chunks.push(buffer);
+  }
+  try { return JSON.parse(Buffer.concat(chunks).toString("utf8")) ?? {}; } catch { return {}; }
+}
+
 async function passwordInput(input: AsyncIterable<string | Buffer>): Promise<string> {
   const chunks: Buffer[] = [];
   let length = 0;
@@ -58,6 +85,25 @@ async function passwordInput(input: AsyncIterable<string | Buffer>): Promise<str
   return password;
 }
 
+/** Email and password, as JSON on stdin like the access password: never on the command line. */
+async function credentialsInput(input: AsyncIterable<string | Buffer>): Promise<{ email: string; password: string }> {
+  const chunks: Buffer[] = [];
+  let length = 0;
+  for await (const chunk of input) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    length += buffer.length;
+    if (length > 4096) throw new Error("登录信息过长，请检查邮箱和密码");
+    chunks.push(buffer);
+  }
+  try {
+    const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (typeof value?.email === "string" && typeof value?.password === "string" && value.email.trim() && value.password) {
+      return { email: value.email, password: value.password };
+    }
+  } catch { /* Never echo an input that contains a password. */ }
+  throw new Error("请输入邮箱和密码。");
+}
+
 async function redemptionInput(input: AsyncIterable<string | Buffer>): Promise<{ code: string; userId: string }> {
   const chunks: Buffer[] = [];
   let length = 0;
@@ -74,7 +120,7 @@ async function redemptionInput(input: AsyncIterable<string | Buffer>): Promise<{
   throw new Error("激活码请求无效，请刷新账号后重试");
 }
 
-export async function runDesktop(version: string, action: string, input: AsyncIterable<string | Buffer> = process.stdin): Promise<void> {
+export async function runDesktop(version: string, action: string, input: AsyncIterable<string | Buffer> = process.stdin, options: { provider?: string } = {}): Promise<void> {
   silenceSqliteWarning();
   try {
     if (action === "redeem-pro") {
@@ -130,6 +176,23 @@ export async function runDesktop(version: string, action: string, input: AsyncIt
       if (!result) throw new Error("登录未完成或已超时，请重试。");
       await joinGatewayAfterLogin(result.plan);
     }
+    else if (action === "login-password") {
+      const result = await loginWithPassword(await credentialsInput(input));
+      await joinGatewayAfterLogin(result.plan);
+    }
+    else if (action === "login-oauth") {
+      const provider = options.provider as OAuthProvider;
+      if (!OAUTH_PROVIDERS.includes(provider)) throw new Error("不支持的登录方式");
+      const result = await loginWithOAuth({
+        provider,
+        // A line before the result: the window shows the link to reopen or copy while it waits.
+        open: (url) => {
+          process.stdout.write(`${JSON.stringify({ event: "authorize", provider, url })}\n`);
+          openInBrowser(url);
+        },
+      });
+      await joinGatewayAfterLogin(result.plan);
+    }
     else if (action === "logout") await runLogout();
     else if (action === "connect-gateway") {
       if (!loadAuth()?.userId) throw new Error("请先登录账号。");
@@ -140,6 +203,13 @@ export async function runDesktop(version: string, action: string, input: AsyncIt
       await ensureHostRunning();
       await refreshGateway(15_000);
     }
+    else if (action === "set-gateway") {
+      if (process.env.LINKSHELL_GATEWAY) throw new Error("网关由启动环境指定，请移除 LINKSHELL_GATEWAY 后重新打开 App。");
+      const gateway = gatewayChoice((await jsonInput(input)).gateway);
+      writeHostConfig(linkshellDir(), { ...readHostConfig(linkshellDir()), gateway });
+      await ensureHostRunning();
+      await refreshGateway(15_000);
+    }
     else if (action === "set-password") await applyAccessPassword(await passwordInput(input));
     else if (action === "remove-password") await applyAccessPassword(undefined);
     else if (action === "prepare-update") { await prepareDesktopUpdate(); }

package/src/commands/login-error.ts

@@ -0,0 +1,12 @@
+import { accountErrorMessage, type AccountErrorCode } from "../../../client-core/src/account-errors.js";
+
+/**
+ * A sign-in that did not finish, with a message the desktop can show as is. Kept apart from the
+ * sign-in code so callers (and their tests) can recognise one without loading the network code.
+ */
+export class LoginError extends Error {
+  constructor(readonly code: AccountErrorCode) {
+    super(accountErrorMessage(code));
+    this.name = "LoginError";
+  }
+}

package/src/commands/login.ts

@@ -1,9 +1,8 @@
 import * as http from "node:http";
 import { execFileSync } from "node:child_process";
-import { saveAuth, SUPABASE_URL, SUPABASE_ANON_KEY } from "../auth.js";
-import type { AuthTokens } from "../auth.js";
-import { cacheMembership, type DesktopMembership } from "../pro-membership.js";
-import { fetchProMembership } from "../../../client-core/src/pro-membership.js";
+import { completeLogin, type LoginResult } from "./sign-in.js";
+
+export type { LoginResult } from "./sign-in.js";
 
 const ITOOL_AUTH_URL = "https://itool.tech/en/auth/linkshell";
 
@@ -105,14 +104,6 @@ const CALLBACK_PAGE = `<!DOCTYPE html>
  * 4. iTool redirects back to localhost with Supabase tokens
  * 5. Save tokens to ~/.linkshell/auth.json
  */
-export interface LoginResult {
-  success: boolean;
-  plan: "pro" | "free";
-  email: string;
-  userId: string;
-  accessToken: string;
-}
-
 export async function runLogin(options: { signal?: AbortSignal } = {}): Promise<LoginResult | null> {
   if (options.signal?.aborted) return null;
   process.stderr.write("\n  LinkShell Login\n\n");
@@ -121,9 +112,12 @@ export async function runLogin(options: { signal?: AbortSignal } = {}): Promise<
     let timeout: ReturnType<typeof setTimeout> | undefined;
     let completion: ReturnType<typeof setTimeout> | undefined;
     let finished = false;
+    // Ends an account check still in flight, so a login that timed out or was cancelled never saves.
+    const stopped = new AbortController();
     const finish = (result: LoginResult | null) => {
       if (finished) return;
       finished = true;
+      stopped.abort();
       clearTimeout(timeout);
       clearTimeout(completion);
       options.signal?.removeEventListener("abort", abort);
@@ -154,70 +148,27 @@ export async function runLogin(options: { signal?: AbortSignal } = {}): Promise<
           return;
         }
 
-        // Fetch user info + plan
-        let userId = "";
-        let email = "";
-        let plan = "free";
-        let membership: DesktopMembership = { plan: "unknown", planExpiresAt: null };
+        let result: LoginResult;
         try {
-          const userRes = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
-            headers: {
-              Authorization: `Bearer ${accessToken}`,
-              apikey: SUPABASE_ANON_KEY,
-            },
-            signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
-          });
-          if (userRes.ok) {
-            const user = (await userRes.json()) as {
-              id: string;
-              email?: string;
-            };
-            userId = user.id;
-            email = user.email ?? "";
-
-            const profile = await fetchProMembership({ userId, accessToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON_KEY, signal: options.signal });
-            plan = profile.plan;
-            membership = { plan: profile.plan, planExpiresAt: profile.expiresAt ?? null };
-          }
-        } catch {}
-
-        if (finished || options.signal?.aborted) { res.destroy(); return; }
-
-        if (!userId) {
+          result = await completeLogin({ accessToken, refreshToken, expiresIn }, { signal: stopped.signal });
+        } catch {
+          if (finished || options.signal?.aborted) { res.destroy(); return; }
           res.writeHead(401);
           res.end("无法验证账号，请重新登录。");
           return;
         }
 
-        const tokens: AuthTokens = {
-          accessToken,
-          refreshToken,
-          expiresAt: Date.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600) * 1000,
-          userId,
-          email,
-        };
-        saveAuth(tokens);
-        try { cacheMembership(userId, membership); } catch { /* A cache write cannot invalidate a completed login. */ }
-
         res.writeHead(200);
         res.end("ok");
 
-        const planLabel = plan === "pro" ? "\x1b[32mPro\x1b[0m" : "Free";
+        const planLabel = result.plan === "pro" ? "\x1b[32mPro\x1b[0m" : "Free";
         process.stderr.write(
-          `  \x1b[32m✓\x1b[0m Logged in as ${email || userId} (${planLabel})\n\n`,
+          `  \x1b[32m✓\x1b[0m Logged in as ${result.email || result.userId} (${planLabel})\n\n`,
         );
 
         // Left pending, the five-minute limit would keep the command alive long after the login.
         clearTimeout(timeout);
-        completion = setTimeout(() => {
-          finish({
-            success: true,
-            plan: plan as "pro" | "free",
-            email,
-            userId,
-            accessToken,
-          });
-        }, 500);
+        completion = setTimeout(() => finish(result), 500);
         return;
       }