tyc-cli 0.3.6 → 0.3.8

package/README.md

@@ -61,9 +61,9 @@ tyc login
 tyc login --url "https://ai-mcp-pre.tianyancha.com/mcp"
 tyc login --url "http://localhost:8080/mcp" --issuer "http://localhost:8080/oauth"
 
-# 非阻塞 OAuth：只打印授权 URL，不占住命令行；授权后手动传回 callback code
-tyc login --no-open --no-block
-tyc login --callback-token "<callback_code_or_full_callback_url>"
+# 非阻塞 OAuth：打印授权 URL 和 6 位验证码；网页授权后恢复登录
+tyc login --no-block
+tyc login --resume
 
 # API key 兼容路径：已有天眼查 OpenAPI token 时可直接写入
 tyc init --authorization "YOUR_API_TOKEN"
@@ -77,11 +77,11 @@ tyc init --authorization "YOUR_API_TOKEN" --no-verify
 > `Authorization: Bearer <access_token>` 和 refresh token 上下文写入
 > `~/.tyc/config.json`。后续业务命令会在 access token 临期时自动刷新；
 > 如果服务端返回 401，会强制刷新一次并重试当前请求。
-> `tyc login --no-open --no-block` 会打印授权 URL 后立即退出，并把一次性 PKCE 上下文
-> 保存到 `~/.tyc/oauth_pending.json`；完成浏览器授权后，复制回调 URL 中的 `code`
-> 参数或完整 callback URL，执行
-> `tyc login --callback-token "<...>"` 完成换 token。
-> `tyc init` 保存配置后会立即校验 shared core endpoint；失败则退出码 1 并提示连通性问题。
+> `tyc login --no-block` 使用 OAuth Device Flow，打印授权 URL 和 6 位验证码后立即退出，
+> 并把一次性 `device_code` 保存到 `~/.tyc/oauth_pending.json`。在网页输入验证码并确认授权后，
+> 执行 `tyc login --resume` 完成换 token。旧版 `tyc login --callback-token "<...>"` 仍保留作兼容入口。
+> `tyc init --authorization` 保存配置后会立即校验 shared core auth ready；通过后输出与
+> OAuth 登录一致的登录成功提示。失败则退出码 1 并提示配置校验问题。
 > 加 `--no-verify` 可跳过校验。
 
 配置存于 `~/.tyc/config.json`（权限 600）：
@@ -123,8 +123,9 @@ tyc executive personnel-dishonest "..." --humanName "张三"
 | 命令 | 说明 |
 |------|------|
 | `tyc login` | 浏览器 OAuth 登录；自动发现 metadata、使用 PKCE 获取 access token / refresh token 并写入配置 |
-| `tyc login --no-open --no-block` | 打印 OAuth 授权 URL 并立即退出，等待后续手动完成 |
-| `tyc login --callback-token <code-or-url>` | 使用上一步保存的 PKCE 上下文，把回调 code 换成 access token |
+| `tyc login --no-block` | 打印 Device Flow 授权 URL 和 6 位验证码并立即退出 |
+| `tyc login --resume` | 网页输入验证码并确认授权后，使用本地 pending device_code 换取 access token |
+| `tyc login --callback-token <code-or-url>` | 兼容旧版 PKCE 非阻塞登录，把回调 code 换成 access token |
 | `tyc login --url <url>` | 对指定 MCP endpoint 发起 OAuth 登录 |
 | `tyc init --authorization <token>` | 写入 `headers.Authorization`；保存后会立即校验 shared core 连通性 |
 | `tyc init --url <url>` | 设置 MCP endpoint |

package/dist/commands/init.js

@@ -1,9 +1,10 @@
-import { DEFAULT_MCP_URL, defaultCoreURL, loadConfig, resolveConfig, saveConfig, } from "../config.js";
-import { verifyCoreEndpoint } from "../coreClient.js";
+import { DEFAULT_MCP_URL, defaultCoreURL, loadConfig, saveConfig, } from "../config.js";
+import { verifyCoreAuthEndpoint, verifyCoreEndpoint } from "../coreClient.js";
+import { printLoginSuccessBanner } from "../logo.js";
 export function registerInitCommand(program) {
     program
         .command("init")
-        .description("配置 endpoint / Authorization（保存到 ~/.tyc/config.json，并校验 shared core 连通性）")
+        .description("配置 endpoint / Authorization（保存到 ~/.tyc/config.json，并校验配置）")
         .option("--authorization <token>", "tyc OpenAPI Authorization（写入 headers.Authorization）")
         .option("--url <url>", `MCP endpoint（默认 ${DEFAULT_MCP_URL}）`)
         .option("--core-url <url>", "Shared Core HTTP endpoint（默认从 --url 推导 /v1/core/tools/call）")
@@ -52,21 +53,46 @@ export function registerInitCommand(program) {
         }
         if (resetOAuth)
             delete cfg.oauth;
+        const persistedAuthorization = cfg.headers.Authorization?.trim();
         saveConfig(cfg);
-        console.log(`已保存 ~/.tyc/config.json  (url=${cfg.url}, coreUrl=${cfg.coreUrl})`);
+        const verbose = !!program.opts().verbose;
+        if (verbose) {
+            console.error(`> config saved to ~/.tyc/config.json (url=${cfg.url}, coreUrl=${cfg.coreUrl})`);
+        }
         if (opts.verify === false) {
+            console.log(`已保存 ~/.tyc/config.json  (url=${cfg.url}, coreUrl=${cfg.coreUrl})`);
             return;
         }
         try {
-            const resolved = resolveConfig();
-            const verbose = !!program.opts().verbose;
-            await verifyCoreEndpoint(resolved, verbose);
-            console.log("Shared Core endpoint 校验通过");
+            const verifyConfig = {
+                url: cfg.url,
+                coreUrl: cfg.coreUrl || defaultCoreURL(cfg.url),
+                headers: { ...(cfg.headers || {}) },
+            };
+            if (!verifyConfig.headers.Authorization && process.env.TYC_AUTHORIZATION) {
+                verifyConfig.headers.Authorization = process.env.TYC_AUTHORIZATION;
+            }
+            if (verifyConfig.headers.Authorization?.trim()) {
+                await verifyCoreAuthEndpoint(verifyConfig, verbose);
+                if (verbose) {
+                    console.error("> Shared Core auth check passed");
+                }
+                if (persistedAuthorization) {
+                    printLoginSuccessBanner();
+                }
+                else {
+                    console.log("Authorization 校验通过（来自 TYC_AUTHORIZATION；未写入 ~/.tyc/config.json）");
+                }
+            }
+            else {
+                await verifyCoreEndpoint(verifyConfig, verbose);
+                console.log("Shared Core endpoint 校验通过");
+            }
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            console.error(`连通性校验失败：${msg}`);
-            console.error("配置已保存；确认 --url 可达后重新运行 tyc init，或加 --no-verify 跳过校验。");
+            console.error(`配置校验失败：${msg}`);
+            console.error("配置已保存；确认 --url 可达且 Authorization 有效后重新运行 tyc init，或加 --no-verify 跳过校验。");
             process.exit(1);
         }
     });

package/dist/commands/login.js

@@ -1,6 +1,6 @@
 import { DEFAULT_MCP_URL, applyOAuthTokenToConfig, defaultCoreURL, loadConfig, resolveConfig, saveConfig, } from "../config.js";
 import { verifyCoreAuthEndpoint } from "../coreClient.js";
-import { buildAuthorizationURL, createPKCE, discoverAuthorizationServer, discoverProtectedResourceMetadata, exchangeAuthorizationCode, knownOAuthDefaultsForMcpURL, openBrowser, parseAuthorizationCallbackCode, randomState, registerDynamicOAuthClient, startCallbackServer, } from "../oauth.js";
+import { buildAuthorizationURL, buildCliCallbackRedirectUri, createPKCE, DEVICE_CODE_GRANT_TYPE, discoverAuthorizationServer, discoverProtectedResourceMetadata, exchangeAuthorizationCode, exchangeDeviceCode, knownOAuthDefaultsForMcpURL, OAuthTokenEndpointError, openBrowser, parseAuthorizationCallbackCode, randomState, registerDynamicOAuthClient, requestDeviceAuthorization, startCallbackServer, } from "../oauth.js";
 import { clearPendingOAuthLogin, loadPendingOAuthLogin, savePendingOAuthLogin, } from "../oauthPending.js";
 import { printLoginSuccessBanner } from "../logo.js";
 function parsePort(raw) {
@@ -16,12 +16,6 @@ function normalizeCallbackPath(raw) {
     const path = raw || "/oauth/callback";
     return path.startsWith("/") ? path : `/${path}`;
 }
-function buildLoopbackRedirectUri(host, port, path) {
-    if (port === 0) {
-        throw new Error("--no-block 不能与 --redirect-port 0 同时使用，请指定固定回调端口。");
-    }
-    return `http://${host}:${port}${path}`;
-}
 function pickCallbackToken(opts) {
     if (opts.callbackToken && opts.token) {
         throw new Error("--callback-token 和 --token 只能指定一个。");
@@ -51,6 +45,15 @@ async function verifySavedOAuthLogin(verify, verbose) {
     }
     printLoginSuccessBanner();
 }
+function isPendingDeviceLogin(pending) {
+    return pending.version === 2;
+}
+function isPendingPKCELogin(pending) {
+    return pending.version === 1;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function completePendingOAuthLogin(pending, callbackToken, verify, verbose) {
     const code = parseAuthorizationCallbackCode(callbackToken, pending.state);
     if (verbose) {
@@ -74,6 +77,63 @@ async function completePendingOAuthLogin(pending, callbackToken, verify, verbose
     clearPendingOAuthLogin(verbose);
     await verifySavedOAuthLogin(verify, verbose);
 }
+async function completePendingDeviceLogin(pending, verify, verbose) {
+    if (pending.expiresAt <= Date.now()) {
+        clearPendingOAuthLogin(verbose);
+        throw new Error("OAuth device 授权已过期，请重新运行 tyc login --no-block。");
+    }
+    let intervalMs = Math.max(1, pending.interval || 5) * 1000;
+    const deadline = Date.now() + 30_000;
+    for (;;) {
+        try {
+            if (verbose) {
+                console.error("> polling OAuth device token endpoint");
+            }
+            const token = await exchangeDeviceCode({
+                tokenEndpoint: pending.tokenEndpoint,
+                clientId: pending.clientId,
+                clientSecret: pending.clientSecret,
+                deviceCode: pending.deviceCode,
+                resource: pending.resource,
+            });
+            saveOAuthTokenConfig(pending.mcpURL, token, {
+                tokenEndpoint: pending.tokenEndpoint,
+                clientId: pending.clientId,
+                clientSecret: pending.clientSecret,
+                resource: pending.resource,
+                scope: pending.scope,
+            }, verbose);
+            clearPendingOAuthLogin(verbose);
+            await verifySavedOAuthLogin(verify, verbose);
+            return;
+        }
+        catch (err) {
+            if (!(err instanceof OAuthTokenEndpointError)) {
+                throw err;
+            }
+            if (err.error === "authorization_pending" || err.error === "slow_down") {
+                if (err.error === "slow_down") {
+                    intervalMs += 5_000;
+                }
+                if (Date.now() + intervalMs > deadline) {
+                    throw new Error("授权尚未完成。请在网页输入 6 位验证码并确认后，再运行 tyc login --resume。");
+                }
+                await sleep(intervalMs);
+                continue;
+            }
+            if (["expired_token", "access_denied", "invalid_grant"].includes(err.error)) {
+                clearPendingOAuthLogin(verbose);
+            }
+            if (err.error === "expired_token") {
+                throw new Error("OAuth device 授权已过期，请重新运行 tyc login --no-block。");
+            }
+            if (err.error === "access_denied") {
+                throw new Error("OAuth device 授权已被拒绝，请重新运行 tyc login --no-block。");
+            }
+            throw err;
+        }
+    }
+}
 export function registerLoginCommand(program) {
     program
         .command("login")
@@ -87,21 +147,40 @@ export function registerLoginCommand(program) {
         .option("--resource-metadata-url <url>", "手动指定 MCP protected resource metadata URL")
         .option("--authorization-endpoint <url>", "手动指定 OAuth authorization endpoint")
         .option("--token-endpoint <url>", "手动指定 OAuth token endpoint")
+        .option("--device-authorization-endpoint <url>", "手动指定 OAuth device authorization endpoint")
         .option("--redirect-host <host>", "本地回调 host（默认 localhost）")
         .option("--redirect-port <port>", "本地回调端口（默认 7078）")
         .option("--callback-path <path>", "本地回调路径（默认 /oauth/callback）")
         .option("--callback-token <code-or-url>", "继续非阻塞登录：传入授权回调 code 或包含 code 的完整 callback URL")
         .option("--token <code-or-url>", "同 --callback-token（兼容别名；仍需传授权回调 code）")
+        .option("--resume", "继续 RFC 8628 device flow 非阻塞登录")
         .option("--no-open", "不自动打开浏览器，只打印授权 URL")
-        .option("--no-block", "配合 --no-open：打印授权 URL 并保存 pending 状态后立即退出")
+        .option("--no-block", "打印 Device Flow 授权 URL 和 6 位验证码并保存 pending 状态后立即退出")
         .option("--no-verify", "保存 token 后跳过 shared core 鉴权校验")
         .action(async (opts) => {
         const verbose = !!program.opts().verbose;
         const callbackToken = pickCallbackToken(opts);
+        if (opts.resume) {
+            if (callbackToken) {
+                throw new Error("--resume 不能与 --callback-token/--token 同时使用。");
+            }
+            const pending = loadPendingOAuthLogin();
+            if (!pending) {
+                throw new Error("未找到待完成的 OAuth device 登录状态。请先运行 tyc login --no-block。");
+            }
+            if (!isPendingDeviceLogin(pending)) {
+                throw new Error("当前待完成的是旧版 callback 登录，请使用 tyc login --callback-token <code-or-url>。");
+            }
+            await completePendingDeviceLogin(pending, opts.verify !== false && pending.verify !== false, verbose);
+            return;
+        }
         if (callbackToken) {
             const pending = loadPendingOAuthLogin();
             if (!pending) {
-                throw new Error("未找到待完成的 OAuth 登录状态。请先运行 tyc login --no-open --no-block。");
+                throw new Error("未找到待完成的 OAuth 登录状态。请先运行 tyc login --no-block。");
+            }
+            if (!isPendingPKCELogin(pending)) {
+                throw new Error("当前待完成的是 device 登录，请在网页确认后运行 tyc login --resume。");
             }
             if (verbose) {
                 console.error(`> loaded pending OAuth login from ~/.tyc/oauth_pending.json (url=${pending.mcpURL})`);
@@ -110,9 +189,6 @@ export function registerLoginCommand(program) {
             return;
         }
         const noBlock = opts.block === false;
-        if (noBlock && opts.open !== false) {
-            throw new Error("--no-block 需要与 --no-open 一起使用。");
-        }
         const current = loadConfig() || {};
         const mcpURL = opts.url || process.env.TYC_MCP_ENDPOINT || current.url || DEFAULT_MCP_URL;
         const knownDefaults = knownOAuthDefaultsForMcpURL(mcpURL);
@@ -164,6 +240,7 @@ export function registerLoginCommand(program) {
             endpoints = {
                 authorizationEndpoint: opts.authorizationEndpoint,
                 tokenEndpoint: opts.tokenEndpoint,
+                deviceAuthorizationEndpoint: opts.deviceAuthorizationEndpoint,
                 issuer,
             };
         }
@@ -172,11 +249,16 @@ export function registerLoginCommand(program) {
             endpoints.authorizationEndpoint =
                 opts.authorizationEndpoint || endpoints.authorizationEndpoint;
             endpoints.tokenEndpoint = opts.tokenEndpoint || endpoints.tokenEndpoint;
+            endpoints.deviceAuthorizationEndpoint =
+                opts.deviceAuthorizationEndpoint || endpoints.deviceAuthorizationEndpoint;
         }
         resource ||= endpoints.resourceDocumentation || mcpURL;
         if (verbose) {
             console.error(`> authorization endpoint: ${endpoints.authorizationEndpoint}`);
             console.error(`> token endpoint: ${endpoints.tokenEndpoint}`);
+            if (endpoints.deviceAuthorizationEndpoint) {
+                console.error(`> device authorization endpoint: ${endpoints.deviceAuthorizationEndpoint}`);
+            }
             if (endpoints.registrationEndpoint) {
                 console.error(`> registration endpoint: ${endpoints.registrationEndpoint}`);
             }
@@ -185,7 +267,7 @@ export function registerLoginCommand(program) {
         const pkce = createPKCE();
         let callback;
         const redirectUri = noBlock
-            ? buildLoopbackRedirectUri(redirectHost, redirectPort, callbackPath)
+            ? buildCliCallbackRedirectUri(issuer)
             : (callback = await startCallbackServer({
                 host: redirectHost,
                 port: redirectPort,
@@ -207,6 +289,10 @@ export function registerLoginCommand(program) {
                     registrationEndpoint: endpoints.registrationEndpoint,
                     clientName: "tyc-cli",
                     redirectUris: [redirectUri],
+                    grantTypes: noBlock
+                        ? ["authorization_code", "refresh_token", DEVICE_CODE_GRANT_TYPE]
+                        : undefined,
+                    responseTypes: ["code"],
                     tokenEndpointAuthMethod: "none",
                 });
             }
@@ -220,40 +306,55 @@ export function registerLoginCommand(program) {
                 console.error(`> registered client_id: ${clientId}`);
             }
         }
-        const authorizationURL = buildAuthorizationURL({
-            authorizationEndpoint: endpoints.authorizationEndpoint,
-            clientId,
-            redirectUri,
-            scope,
-            state,
-            codeChallenge: pkce.codeChallenge,
-            resource,
-        });
-        if (verbose) {
-            console.error(`> OAuth callback: ${redirectUri}`);
-        }
         if (noBlock) {
+            if (!endpoints.deviceAuthorizationEndpoint) {
+                throw new Error("OAuth metadata 未提供 device_authorization_endpoint，请升级授权服务或使用 --device-authorization-endpoint 指定。");
+            }
+            const device = await requestDeviceAuthorization({
+                deviceAuthorizationEndpoint: endpoints.deviceAuthorizationEndpoint,
+                clientId,
+                clientSecret,
+                scope,
+                resource,
+            });
             savePendingOAuthLogin({
-                version: 1,
+                version: 2,
+                flow: "device",
                 createdAt: Date.now(),
                 mcpURL,
                 tokenEndpoint: endpoints.tokenEndpoint,
                 clientId,
                 clientSecret,
-                redirectUri,
-                codeVerifier: pkce.codeVerifier,
+                deviceCode: device.device_code,
+                userCode: device.user_code,
+                verificationUri: device.verification_uri,
+                expiresAt: Date.now() + device.expires_in * 1000,
+                interval: device.interval || 5,
                 resource,
-                state,
+                scope,
                 verify: opts.verify !== false,
             });
             console.error("请在浏览器打开以下 URL 完成登录：");
-            console.error(authorizationURL);
+            console.error(device.verification_uri);
+            console.error("");
+            console.error(`验证码：${device.user_code}`);
             console.error("");
-            console.error("完成授权后，复制回调 URL 中的 code 参数，然后运行：");
-            console.error("tyc login --callback-token <code_or_callback_url>");
-            console.error("也可以传完整 callback URL：tyc login --callback-token \"http://localhost:7078/oauth/callback?code=...&state=...\"");
+            console.error("在网页输入 6 位验证码并确认授权后，运行：");
+            console.error("tyc login --resume");
             return;
         }
+        const authorizationURL = buildAuthorizationURL({
+            authorizationEndpoint: endpoints.authorizationEndpoint,
+            clientId,
+            redirectUri,
+            scope,
+            state,
+            codeChallenge: pkce.codeChallenge,
+            resource,
+        });
+        if (verbose) {
+            console.error(`> OAuth callback: ${redirectUri}`);
+        }
         if (opts.open === false) {
             console.error("请在浏览器打开以下 URL 完成登录：");
             console.error(authorizationURL);

package/dist/index.js

@@ -67,8 +67,9 @@ ${renderCategoryLines()}
 初始化与登录
 
   tyc login                                             OAuth 浏览器登录
-  tyc login --no-open --no-block                       打印 OAuth URL 后立即退出，手动完成
-  tyc login --callback-token <CODE_OR_CALLBACK_URL>    继续非阻塞 OAuth 登录
+  tyc login --no-block                                 打印 Device Flow URL 和 6 位验证码后立即退出
+  tyc login --resume                                   继续非阻塞 Device Flow 登录
+  tyc login --callback-token <CODE_OR_CALLBACK_URL>    继续旧版 callback OAuth 登录
   tyc login --url <MCP_URL>                             登录本地、预发或自托管 MCP
   tyc init --authorization <KEY>                        使用 API Key 兼容路径
   tyc init --url <MCP_URL> --authorization <KEY>        配置本地或自托管服务

package/dist/oauth.js

@@ -1,6 +1,19 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
+export const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+export class OAuthTokenEndpointError extends Error {
+    status;
+    error;
+    errorDescription;
+    constructor(status, error, errorDescription) {
+        super(errorDescription ? `${error}: ${errorDescription}` : error);
+        this.name = "OAuthTokenEndpointError";
+        this.status = status;
+        this.error = error;
+        this.errorDescription = errorDescription;
+    }
+}
 function trimRightSlash(v) {
     return v.replace(/\/+$/, "");
 }
@@ -123,10 +136,16 @@ export async function discoverAuthorizationServer(issuer) {
                 return {
                     authorizationEndpoint: metadata.authorization_endpoint,
                     tokenEndpoint: metadata.token_endpoint,
+                    deviceAuthorizationEndpoint: typeof metadata.device_authorization_endpoint === "string"
+                        ? metadata.device_authorization_endpoint
+                        : undefined,
                     registrationEndpoint: typeof metadata.registration_endpoint === "string"
                         ? metadata.registration_endpoint
                         : undefined,
                     issuer,
+                    grantTypesSupported: Array.isArray(metadata.grant_types_supported)
+                        ? metadata.grant_types_supported.filter((v) => typeof v === "string")
+                        : undefined,
                     resourceDocumentation: typeof metadata.resource_documentation === "string"
                         ? metadata.resource_documentation
                         : undefined,
@@ -172,6 +191,10 @@ export function createPKCE() {
 export function randomState() {
     return randomBytes(24).toString("base64url");
 }
+export function buildCliCallbackRedirectUri(issuer) {
+    const url = new URL(issuer);
+    return `${trimRightSlash(url.toString())}/cli/callback`;
+}
 function callbackHTML(title, body) {
     return `<!doctype html>
 <meta charset="utf-8">
@@ -311,6 +334,54 @@ export async function registerDynamicOAuthClient(opts) {
         clientSecret: registered.client_secret,
     };
 }
+export async function requestDeviceAuthorization(opts) {
+    const body = new URLSearchParams();
+    body.set("client_id", opts.clientId);
+    body.set("scope", opts.scope);
+    if (opts.clientSecret)
+        body.set("client_secret", opts.clientSecret);
+    if (opts.resource)
+        body.set("resource", opts.resource);
+    const resp = await fetch(opts.deviceAuthorizationEndpoint, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    const text = await resp.text();
+    if (resp.status < 200 || resp.status >= 300) {
+        throw new Error(`device authorization HTTP ${resp.status}: ${text.slice(0, 500)}`);
+    }
+    const payload = JSON.parse(text);
+    if (!payload.device_code || !payload.user_code || !payload.verification_uri) {
+        throw new Error("device authorization response missing required fields");
+    }
+    return {
+        ...payload,
+        device_code: payload.device_code,
+        user_code: payload.user_code,
+        verification_uri: payload.verification_uri,
+        expires_in: Number(payload.expires_in) > 0 ? Number(payload.expires_in) : 600,
+        interval: Number(payload.interval) > 0 ? Number(payload.interval) : 5,
+    };
+}
+function parseOAuthTokenError(status, text) {
+    try {
+        const payload = JSON.parse(text);
+        const error = typeof payload.error === "string" && payload.error
+            ? payload.error
+            : `token endpoint HTTP ${status}`;
+        const description = typeof payload.error_description === "string"
+            ? payload.error_description
+            : undefined;
+        return new OAuthTokenEndpointError(status, error, description);
+    }
+    catch {
+        return new OAuthTokenEndpointError(status, `token endpoint HTTP ${status}`, text.slice(0, 500));
+    }
+}
 export async function exchangeAuthorizationCode(opts) {
     const body = new URLSearchParams();
     body.set("grant_type", "authorization_code");
@@ -340,6 +411,33 @@ export async function exchangeAuthorizationCode(opts) {
     }
     return token;
 }
+export async function exchangeDeviceCode(opts) {
+    const body = new URLSearchParams();
+    body.set("grant_type", DEVICE_CODE_GRANT_TYPE);
+    body.set("client_id", opts.clientId);
+    body.set("device_code", opts.deviceCode);
+    if (opts.clientSecret)
+        body.set("client_secret", opts.clientSecret);
+    if (opts.resource)
+        body.set("resource", opts.resource);
+    const resp = await fetch(opts.tokenEndpoint, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    const text = await resp.text();
+    if (resp.status < 200 || resp.status >= 300) {
+        throw parseOAuthTokenError(resp.status, text);
+    }
+    const token = JSON.parse(text);
+    if (!token.access_token) {
+        throw new Error("token endpoint response missing access_token");
+    }
+    return token;
+}
 export async function exchangeRefreshToken(opts) {
     const body = new URLSearchParams();
     body.set("grant_type", "refresh_token");

package/dist/oauthPending.js

@@ -1,7 +1,8 @@
 // ~/.tyc/oauth_pending.json 读写
 //
-// 非阻塞 OAuth 登录会先保存 PKCE code_verifier、state、client_id 等一次性上下文；
-// 用户完成浏览器授权后，再用 tyc login --callback-token <code_or_callback_url> 继续换取 access token。
+// 非阻塞 OAuth 登录会保存一次性上下文：
+// - legacy PKCE 模式保存 code_verifier/state，靠 --callback-token 续接；
+// - RFC 8628 device flow 保存 device_code，靠 --resume 续接。
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "tyc-cli",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "天眼查 AI CLI — 162 个业务语义聚合工具 · 默认 Shared Core 调用 · 兼容 MCP transport",
   "main": "dist/index.js",
   "bin": {
-    "tyc": "./dist/index.js"
+    "tyc": "dist/index.js"
   },
   "scripts": {
     "build": "tsc && cp src/catalog.json dist/catalog.json",