weaver-work-cli 0.1.20 → 0.1.22

package/dist/internal/e10/auth/xiaoe.js

@@ -1,9 +1,10 @@
 import { execFile } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { accessSync, constants as fsConstants, existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { CliError, ExitCode } from '../../../core/errors.js';
-import { buildE10CookieHeader, E10AuthSession, profileNameFromUrl, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
+import { buildE10CookieHeader, E10AuthSession, extractRawSetCookie, extractSessionTicket, profileNameFromUrl, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
 export const DEFAULT_E10_BASE_URL = 'https://www.e-cology.com.cn';
 export const XIAOE_AGENT_TYPE = 'XiaoE';
 // `XIAOE_` 是宿主/平台保留前缀（XIAOE_DOMAIN、XIAOE_USER_TOKEN、XIAOE_SKILL_* 等）。
@@ -20,7 +21,6 @@ const XIAOE_UNIFIED_LOGIN_MAP_ENV_KEYS = [
     'XIAOE_UNIFIED_LOGIN_MAP',
 ];
 const XIAOE_SINGLE_DOMAIN_ENV_KEYS = [
-    'XIAOE_DOMAIN',
     'WEAVER_XIAOE_E10_DOMAIN',
     'WEAVER_XIAOE_BASE_URL',
     'WEAVER_XIAOE_E10_BASE_URL',
@@ -50,6 +50,7 @@ const XIAOE_CLIENT_TOKEN_TIMEOUT_MS = 15_000;
 export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/extend/eteamId';
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
+export const XIAOE_BUNDLED_ENV_SCRIPT_SOURCE = 'bundled scripts/xiaoe_env.py';
 function envString(env, ...keys) {
     for (const key of keys) {
         const value = env[key];
@@ -69,11 +70,13 @@ export function hasXiaoEEnv(env = process.env) {
 export function describeXiaoECredentialSource(source) {
     // Step 1 is the platform-injected credential (XIAOE_USER_TOKEN + XIAOE_DOMAIN):
     // it is available in every sandbox run and needs no local desktop client.
-    if (source === XIAOE_USER_TOKEN_SOURCE) {
+    if (source === XIAOE_USER_TOKEN_SOURCE || source === XIAOE_BUNDLED_ENV_SCRIPT_SOURCE) {
         return {
             credentialSourceStep: 1,
             credentialSourceType: 'xiaoe_platform',
-            credentialSourceLabel: 'XiaoE platform user token',
+            credentialSourceLabel: source === XIAOE_BUNDLED_ENV_SCRIPT_SOURCE
+                ? 'XiaoE platform user token (bundled Python fallback)'
+                : 'XiaoE platform user token',
         };
     }
     if (source === 'xiaoeUserData/tokens.py') {
@@ -256,18 +259,24 @@ function normalizeBaseUrlValue(value) {
         return '';
     return /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
 }
-export function resolveXiaoEDefaultBaseUrl(env = process.env) {
+function resolveXiaoEConfiguredBaseUrl(env) {
     const explicitDefault = envString(env, ...XIAOE_DEFAULT_DOMAIN_ENV_KEYS);
     if (explicitDefault)
         return normalizeBaseUrlValue(explicitDefault);
-    // The injected XIAOE_DOMAIN (XIAOE_USER_TOKEN's target domain) is a fact
-    // about the current host and must win over the CLI's built-in fallback.
+    // XIAOE_DOMAIN is the XiaoE/erpa service address used to exchange
+    // XIAOE_USER_TOKEN. Only dedicated E10 variables may select the target E10.
     const singleDomain = envString(env, ...XIAOE_SINGLE_DOMAIN_ENV_KEYS);
     if (singleDomain)
         return normalizeBaseUrlValue(singleDomain);
     const firstCredential = listXiaoEUnifiedLoginCredentials(env)[0];
     if (firstCredential?.baseUrl)
         return normalizeUrl(firstCredential.baseUrl);
+    return '';
+}
+export function resolveXiaoEDefaultBaseUrl(env = process.env) {
+    const configured = resolveXiaoEConfiguredBaseUrl(env);
+    if (configured)
+        return configured;
     return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
 }
 function uniqueStrings(values) {
@@ -294,7 +303,7 @@ function xiaoETokenScriptCandidatePaths(env = process.env) {
         ]);
     }
     const envHome = envString(env, 'HOME');
-    const nodeHome = homedir();
+    const nodeHome = envHome ? '' : homedir();
     return uniqueStrings([
         envHome ? join(envHome, 'Library', 'Application Support', 'xiaoeUserData', 'tokens.py') : '',
         nodeHome ? join(nodeHome, 'Library', 'Application Support', 'xiaoeUserData', 'tokens.py') : '',
@@ -303,6 +312,10 @@ function xiaoETokenScriptCandidatePaths(env = process.env) {
 function xiaoETokenScriptPath(env = process.env) {
     return xiaoETokenScriptCandidatePaths(env).find((path) => existsSync(path)) || '';
 }
+export function xiaoEBundledEnvScriptPath() {
+    const scriptPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../../../scripts/xiaoe_env.py');
+    return existsSync(scriptPath) ? scriptPath : '';
+}
 export function hasXiaoETokenScript(env = process.env) {
     const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY, XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY);
     if (explicit)
@@ -310,22 +323,114 @@ export function hasXiaoETokenScript(env = process.env) {
     const scriptPath = xiaoETokenScriptPath(env);
     return Boolean(scriptPath && existsSync(scriptPath));
 }
-function xiaoETokenScriptPythonCandidates(env = process.env) {
+function isExecutableFile(path) {
+    try {
+        if (!statSync(path).isFile())
+            return false;
+        accessSync(path, fsConstants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function listXiaoEPythonRuntimeDirectories(resourcesRoot) {
+    if (!resourcesRoot || !existsSync(resourcesRoot))
+        return [];
+    try {
+        return readdirSync(resourcesRoot, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory() && /^Python3(?:[-_.]\d[\d.]*)?$/iu.test(entry.name))
+            .map((entry) => join(resourcesRoot, entry.name))
+            .sort((left, right) => right.localeCompare(left, undefined, { numeric: true }));
+    }
+    catch {
+        return [];
+    }
+}
+function listExecutablePythonFiles(directory, platform) {
+    if (!directory || !existsSync(directory))
+        return [];
+    try {
+        const pattern = platform === 'win32' ? /^python(?:3(?:\.\d+)*)?\.exe$/iu : /^python3(?:\.\d+)*$/u;
+        return readdirSync(directory, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && pattern.test(entry.name))
+            .map((entry) => join(directory, entry.name))
+            .filter(isExecutableFile)
+            .sort((left, right) => right.localeCompare(left, undefined, { numeric: true }));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Locate the Python runtime bundled with the desktop XiaoE client. The client
+ * ships the runtime expected by xiaoeUserData/tokens.py; the system Python may
+ * still be unavailable or incompatible with a host-provided script.
+ */
+export function xiaoEClientPythonCandidates(env = process.env, platform = process.platform) {
+    const appRoots = [];
+    if (platform === 'darwin') {
+        const envHome = envString(env, 'HOME');
+        const nodeHome = homedir();
+        for (const home of uniqueStrings([envHome, nodeHome])) {
+            appRoots.push(join(home, 'Applications', '智能小e.app'));
+        }
+        appRoots.push('/Applications/智能小e.app');
+    }
+    else if (platform === 'win32') {
+        const localAppData = envString(env, 'LOCALAPPDATA');
+        const programFiles = uniqueStrings([
+            envString(env, 'ProgramW6432'),
+            envString(env, 'ProgramFiles'),
+            envString(env, 'ProgramFiles(x86)'),
+        ]);
+        const appNames = ['智能小e', 'XiaoE', 'XiaoEClient', 'XiaoEAI'];
+        if (localAppData) {
+            for (const appName of appNames) {
+                appRoots.push(join(localAppData, 'Programs', appName), join(localAppData, appName));
+            }
+        }
+        for (const programFilesRoot of programFiles) {
+            for (const appName of appNames)
+                appRoots.push(join(programFilesRoot, appName));
+        }
+    }
+    const candidates = [];
+    for (const appRoot of uniqueStrings(appRoots)) {
+        const resourcesRoots = platform === 'darwin'
+            ? [join(appRoot, 'Contents', 'Resources')]
+            : [join(appRoot, 'Resources'), appRoot];
+        for (const resourcesRoot of resourcesRoots) {
+            for (const runtimeRoot of listXiaoEPythonRuntimeDirectories(resourcesRoot)) {
+                const executableDirectories = platform === 'win32'
+                    ? [runtimeRoot, join(runtimeRoot, 'bin')]
+                    : [join(runtimeRoot, 'bin')];
+                for (const executableDirectory of executableDirectories) {
+                    candidates.push(...listExecutablePythonFiles(executableDirectory, platform));
+                }
+            }
+        }
+    }
+    return uniqueStrings(candidates);
+}
+export function xiaoETokenScriptPythonCandidates(env = process.env, platform = process.platform) {
     const explicit = envString(env, XIAOE_TOKEN_SCRIPT_PYTHON_ENV_KEY, XIAOE_TOKEN_SCRIPT_PYTHON_LEGACY_ENV_KEY);
     if (explicit)
         return [explicit];
-    return uniqueStrings(process.platform === 'win32'
-        ? ['python', 'python3', 'py']
-        : ['python3', '/usr/bin/python3', 'python']);
+    return uniqueStrings(platform === 'win32'
+        ? [...xiaoEClientPythonCandidates(env, platform), 'python', 'python3', 'py']
+        : [...xiaoEClientPythonCandidates(env, platform), 'python3', '/usr/bin/python3', 'python']);
 }
 function isXiaoETokenScriptEnvFailure(message) {
-    return /No module named|ModuleNotFoundError|ENOENT|command not found|not recognized as an internal|cannot find the file/i
+    return /No module named|ModuleNotFoundError|ENOENT|EACCES|permission denied|command not found|not recognized as an internal|cannot find the file/i
         .test(message);
 }
-async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, env) {
+async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, baseUrl, env) {
     const wrapper = [
         'import ast,contextlib,io,json,runpy,sys',
         `path = ${JSON.stringify(scriptPath)}`,
+        `base_url = ${JSON.stringify(baseUrl)}`,
+        'sys.argv = [path, base_url]',
         'buf = io.StringIO()',
         'data = None',
         'with contextlib.redirect_stdout(buf):',
@@ -347,9 +452,9 @@ async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, env) {
         '        except Exception as exc:',
         '            last_error = exc',
         '    if data is None:',
-        '        raise SystemExit("tokens.py stdout is not valid JSON object")',
+        '        raise SystemExit("XiaoE credential script stdout is not valid JSON object")',
         'else:',
-        '    raise SystemExit("tokens.py produced empty stdout")',
+        '    raise SystemExit("XiaoE credential script produced empty stdout")',
         'print(json.dumps(data, ensure_ascii=False))',
     ].join('\n');
     return await new Promise((resolve, reject) => {
@@ -360,12 +465,12 @@ async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, env) {
         }, (error, stdout, stderr) => {
             if (error) {
                 const detail = (stderr || error.message || 'unknown error').trim().split('\n').slice(-1)[0];
-                reject(new CliError('XiaoE token script failed: ' + detail, ExitCode.AuthError));
+                reject(new CliError('XiaoE credential script failed: ' + detail, ExitCode.AuthError));
                 return;
             }
             const text = stdout.trim();
             if (!text) {
-                reject(new CliError('XiaoE token script returned empty stdout.', ExitCode.AuthError));
+                reject(new CliError('XiaoE credential script returned empty stdout.', ExitCode.AuthError));
                 return;
             }
             try {
@@ -373,19 +478,18 @@ async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, env) {
                 resolve(parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null);
             }
             catch {
-                reject(new CliError('XiaoE token script stdout is not valid JSON.', ExitCode.AuthError));
+                reject(new CliError('XiaoE credential script stdout is not valid JSON.', ExitCode.AuthError));
             }
         });
     });
 }
-async function runXiaoETokenScript(env = process.env) {
-    const scriptPath = xiaoETokenScriptPath(env);
+async function runXiaoEPythonCredentialScript(scriptPath, baseUrl, env) {
     if (!scriptPath || !existsSync(scriptPath))
         return null;
     let lastError = null;
     for (const pythonCommand of xiaoETokenScriptPythonCandidates(env)) {
         try {
-            return await runXiaoETokenScriptOnce(pythonCommand, scriptPath, env);
+            return await runXiaoETokenScriptOnce(pythonCommand, scriptPath, baseUrl, env);
         }
         catch (error) {
             lastError = error;
@@ -396,14 +500,26 @@ async function runXiaoETokenScript(env = process.env) {
                 break;
         }
     }
-    throw lastError instanceof Error ? lastError : new CliError('XiaoE token script failed.', ExitCode.AuthError);
+    throw lastError instanceof Error ? lastError : new CliError('XiaoE credential script failed.', ExitCode.AuthError);
+}
+async function runXiaoETokenScript(baseUrl, env = process.env) {
+    return runXiaoEPythonCredentialScript(xiaoETokenScriptPath(env), baseUrl, env);
 }
 async function resolveXiaoETokenScriptCredential(baseUrl, env = process.env) {
-    const tokenData = await runXiaoETokenScript(env);
+    const tokenData = await runXiaoETokenScript(baseUrl, env);
     if (!tokenData)
         return null;
     return readXiaoECredentialRecord(tokenData, 'xiaoeUserData/tokens.py', baseUrl);
 }
+async function resolveXiaoEBundledEnvScriptCredential(baseUrl, env = process.env) {
+    const scriptPath = xiaoEBundledEnvScriptPath();
+    if (!scriptPath)
+        return null;
+    const tokenData = await runXiaoEPythonCredentialScript(scriptPath, baseUrl, env);
+    if (!tokenData)
+        return null;
+    return readXiaoECredentialRecord(tokenData, XIAOE_BUNDLED_ENV_SCRIPT_SOURCE, baseUrl);
+}
 export function xiaoEClientRobotsRoot(env = process.env) {
     if (process.platform === 'win32') {
         const localAppData = envString(env, 'LOCALAPPDATA');
@@ -437,10 +553,6 @@ export function findXiaoEClientSettingsFile(env = process.env) {
         return '';
     return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs)[0];
 }
-/**
- * Mirror of the host `xiaoeUserData/tokens.py` credential chain, implemented in
- * Node so the CLI does not depend on a Python runtime that has `requests`.
- */
 /**
  * Platform-injected credential: XIAOE_USER_TOKEN (+ the XiaoE service address).
  * This is the only source that works in a Linux sandbox with no desktop client
@@ -488,21 +600,57 @@ async function fetchXiaoEClientEteamId(credential, domain) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), XIAOE_CLIENT_TOKEN_TIMEOUT_MS);
     try {
-        const resp = await fetch(`${credential.erpaUrl}${XIAOE_SKILL_ETEAMID_API_PATH}`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                authorization: credential.authToken,
-            },
-            body: JSON.stringify({ domain: domain || DEFAULT_E10_BASE_URL }),
-            redirect: 'manual',
-            signal: controller.signal,
-        });
-        if (!resp.ok) {
-            throw new CliError(`XiaoE client token endpoint returned HTTP ${resp.status}.`, ExitCode.AuthError);
+        let endpoint = new URL(`${credential.erpaUrl}${XIAOE_SKILL_ETEAMID_API_PATH}`);
+        let resp = null;
+        for (let redirects = 0; redirects <= 5; redirects += 1) {
+            resp = await fetch(endpoint, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    authorization: credential.authToken,
+                },
+                body: JSON.stringify({ domain: domain || DEFAULT_E10_BASE_URL }),
+                redirect: 'manual',
+                signal: controller.signal,
+            });
+            if (resp.status < 300 || resp.status >= 400)
+                break;
+            if (redirects === 5) {
+                throw new CliError('XiaoE client token endpoint redirected too many times.', ExitCode.AuthError);
+            }
+            const location = resp.headers.get('location');
+            if (!location) {
+                throw new CliError('XiaoE client token endpoint returned a redirect without Location.', ExitCode.AuthError);
+            }
+            const next = new URL(location, endpoint);
+            const sameOrigin = next.origin === endpoint.origin;
+            const sameHostHttpsUpgrade = endpoint.protocol === 'http:'
+                && next.protocol === 'https:'
+                && next.hostname === endpoint.hostname;
+            const safeProtocol = next.protocol === 'http:' || next.protocol === 'https:';
+            if (!safeProtocol || next.username || next.password || (!sameOrigin && !sameHostHttpsUpgrade)) {
+                throw new CliError('XiaoE client token endpoint attempted an unsafe cross-origin redirect.', ExitCode.AuthError);
+            }
+            await resp.body?.cancel().catch(() => undefined);
+            endpoint = next;
+        }
+        if (!resp?.ok) {
+            throw new CliError(`XiaoE client token endpoint returned HTTP ${resp?.status || 0}.`, ExitCode.AuthError);
         }
         const data = await resp.json().catch(() => null);
-        return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+        if (!data || typeof data !== 'object' || Array.isArray(data)) {
+            throw new CliError('XiaoE client token endpoint returned invalid JSON.', ExitCode.AuthError);
+        }
+        const payload = data;
+        const businessCode = payload.code;
+        const businessData = payload.data && typeof payload.data === 'object' && !Array.isArray(payload.data)
+            ? payload.data
+            : {};
+        if ((businessCode !== '0000' && businessCode !== 0 && businessCode !== 200) || !readString(businessData, 'eteamId')) {
+            const codeText = businessCode === undefined ? 'missing' : String(businessCode);
+            throw new CliError(`XiaoE client token exchange failed with business code ${codeText}.`, ExitCode.AuthError);
+        }
+        return payload;
     }
     finally {
         clearTimeout(timer);
@@ -511,7 +659,11 @@ async function fetchXiaoEClientEteamId(credential, domain) {
 async function resolveXiaoETokenCredential(credential, baseUrl) {
     const targetBaseUrl = baseUrl || DEFAULT_E10_BASE_URL;
     const payload = await fetchXiaoEClientEteamId(credential, targetBaseUrl);
-    return readXiaoECredentialRecord(payload, credential.source, targetBaseUrl);
+    // The legacy gateway contract uses numeric code 0 and serves the E10 APIs
+    // from the same origin as the token exchange. Newer 0000/200 responses keep
+    // the XiaoE service origin separate and use the requested E10 target.
+    const resolvedBaseUrl = payload.code === 0 ? credential.erpaUrl : targetBaseUrl;
+    return readXiaoECredentialRecord(payload, credential.source, resolvedBaseUrl);
 }
 async function resolveXiaoEPlatformCredential(baseUrl, env = process.env) {
     const credential = readXiaoEPlatformCredential(env);
@@ -530,10 +682,31 @@ export function resolveXiaoEPreferredBaseUrl(options) {
     const explicit = normalizeUrl(options.explicitBaseUrl || '');
     if (explicit)
         return explicit;
-    const xiaoEDefault = resolveXiaoEDefaultBaseUrl(env);
-    if (hasXiaoEEnv(env))
-        return xiaoEDefault || normalizeUrl(options.profileBaseUrl || '');
-    return normalizeUrl(options.profileBaseUrl || '') || xiaoEDefault;
+    const configured = resolveXiaoEConfiguredBaseUrl(env);
+    if (configured)
+        return configured;
+    const profileBaseUrl = normalizeUrl(options.profileBaseUrl || '');
+    if (profileBaseUrl)
+        return profileBaseUrl;
+    return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
+}
+export function shouldUseXiaoEBrowserFallback(platform = process.platform) {
+    return platform === 'darwin' || platform === 'win32';
+}
+export function createXiaoEUnifiedLoginUnavailableError(baseUrl = '') {
+    const target = normalizeUrl(baseUrl);
+    const message = [
+        'XiaoE unified login did not return a usable E10 session.',
+        target ? `Resolved E10 baseUrl: ${target}.` : 'No E10 baseUrl could be resolved.',
+        'This web/Linux host cannot complete a localhost browser OAuth callback.',
+        'Refresh the XiaoE web session or restore host credential injection before retrying.',
+    ].join(' ');
+    return Object.assign(new CliError(message, ExitCode.AuthError), {
+        type: 'authentication',
+        subtype: 'xiaoe_web_credential_unavailable',
+        retryable: false,
+        stage: 'xiaoe_unified_login',
+    });
 }
 async function resolveUserInfo(baseUrl, eteamsId, rawCookie = '', agentType = '') {
     const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
@@ -549,11 +722,11 @@ async function resolveUserInfo(baseUrl, eteamsId, rawCookie = '', agentType = ''
         redirect: 'manual',
     });
     const data = await resp.json().catch(() => ({}));
-    return readTeamsCheckUserInfo(resp, data);
+    return { userInfo: readTeamsCheckUserInfo(resp, data), setCookie: extractRawSetCookie(resp) };
 }
 async function saveXiaoEUnifiedLogin(input) {
     const baseUrl = normalizeUrl(input.baseUrl);
-    const userInfo = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || '', XIAOE_AGENT_TYPE);
+    const { userInfo, setCookie } = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || '', XIAOE_AGENT_TYPE);
     if (!userInfo.userId) {
         throw new CliError('Could not resolve userId. Check whether XiaoE unified login is valid for this E10 domain.', ExitCode.AuthError);
     }
@@ -563,6 +736,7 @@ async function saveXiaoEUnifiedLogin(input) {
     const cookies = { ETEAMSID: input.eteamsId };
     if (input.rawCookie)
         cookies.raw = input.rawCookie;
+    const ztSession = extractSessionTicket(setCookie, input.rawCookie || '');
     const authData = {
         cookies,
         userId: userInfo.userId,
@@ -580,6 +754,7 @@ async function saveXiaoEUnifiedLogin(input) {
         credentialSourceStep: input.credentialSource.credentialSourceStep,
         credentialSourceType: input.credentialSource.credentialSourceType,
         credentialSourceLabel: input.credentialSource.credentialSourceLabel,
+        ...(ztSession ? { ztSession } : {}),
     };
     const authFile = saveAuthFile(authData, profile);
     saveProfileConfig(baseUrl, baseUrl, profile, tenantKey);
@@ -606,6 +781,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
     const explicitBaseUrl = normalizeUrl(options.baseUrl || '');
     const baseUrl = resolveXiaoEPreferredBaseUrl({
         explicitBaseUrl,
+        profileBaseUrl: options.profileBaseUrl,
         env,
     });
     const mayUseTokenScript = options.allowTokenScript || hasXiaoEEnv(env);
@@ -624,7 +800,31 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
             options.logger?.warn('XiaoE platform credential failed. ' + message);
         }
         if (!credential) {
-            options.logger?.warn('XiaoE platform credential did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.');
+            options.logger?.warn(options.allowBundledEnvScript
+                ? 'XiaoE platform credential did not return usable ETEAMSID; will try the CLI-bundled xiaoe_env.py compatibility path next.'
+                : 'XiaoE platform credential did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.');
+        }
+    }
+    // Step 1b — compatibility path used by the reference login package. The
+    // script is shipped with the CLI npm package (never with a Skill) and its
+    // stdout stays inside this process so credentials are not exposed to agents.
+    if (!credential && options.allowBundledEnvScript && hasXiaoEPlatformCredential(env)) {
+        const scriptPath = xiaoEBundledEnvScriptPath();
+        if (!scriptPath) {
+            options.logger?.warn('CLI-bundled xiaoe_env.py was not found; will try desktop XiaoE credential sources next.');
+        }
+        else {
+            options.logger?.info('Trying CLI-bundled xiaoe_env.py compatibility credential...');
+            try {
+                credential = await resolveXiaoEBundledEnvScriptCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                options.logger?.warn('CLI-bundled xiaoe_env.py failed. ' + message);
+            }
+            if (!credential) {
+                options.logger?.warn('CLI-bundled xiaoe_env.py did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.');
+            }
         }
     }
     // Step 2 — host tokens.py (desktop host only; Linux sandboxes have no such path).
@@ -647,8 +847,8 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
             }
         }
         // Step 3 — built-in Node equivalent of tokens.py: reads the local XiaoE
-        // client session and exchanges it for an eteamId, so a Python runtime
-        // without `requests` no longer blocks unified login.
+        // client session and exchanges it for an eteamId, so Python availability
+        // no longer blocks unified login.
         if (!credential && hasXiaoEClientCredential(env)) {
             try {
                 credential = await resolveXiaoEClientCredential(baseUrl || DEFAULT_E10_BASE_URL, env);

package/dist/internal/e10/context.js

@@ -1,16 +1,19 @@
 import { CliError, ExitCode } from '../../core/errors.js';
-import { E10AuthSession } from './auth/session.js';
-import { hasXiaoEEnv, hasXiaoETokenScript, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
+import { E10AuthSession, getActiveProfile, readProfileConfig } from './auth/session.js';
+import { createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin, } from './auth/xiaoe.js';
 import { E10ApiClient } from './client.js';
 function shouldPreferXiaoEUnifiedLogin(options, env) {
     return !options.auth && !options.profile && (hasXiaoEEnv(env) || hasXiaoETokenScript(env));
 }
-export async function getE10Session(ctx) {
+export async function getE10Session(ctx, load = {}) {
     const options = ctx.getGlobalOptions();
     if (shouldPreferXiaoEUnifiedLogin(options, ctx.env)) {
+        const profileBaseUrl = readProfileConfig(getActiveProfile()).baseUrl;
         const xiaoELogin = await tryXiaoEUnifiedLogin({
             env: ctx.env,
             baseUrl: options.baseUrl,
+            profileBaseUrl,
+            allowBundledEnvScript: true,
             allowTokenScript: true,
             logger: ctx.logger,
         });
@@ -18,11 +21,20 @@ export async function getE10Session(ctx) {
             return xiaoELogin.session;
         return null;
     }
-    return E10AuthSession.fromOptions(options, ctx.cwd);
+    return E10AuthSession.fromOptions(options, ctx.cwd, load);
 }
-export async function requireE10Session(ctx) {
-    const session = await getE10Session(ctx);
+export async function requireE10Session(ctx, load = {}) {
+    const session = await getE10Session(ctx, load);
     if (!session) {
+        const options = ctx.getGlobalOptions();
+        if ((hasXiaoEEnv(ctx.env) || hasXiaoETokenScript(ctx.env)) && !shouldUseXiaoEBrowserFallback()) {
+            const baseUrl = resolveXiaoEPreferredBaseUrl({
+                explicitBaseUrl: options.baseUrl,
+                profileBaseUrl: readProfileConfig(getActiveProfile()).baseUrl,
+                env: ctx.env,
+            });
+            throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+        }
         throw new CliError('E10 auth not found. In XiaoE, run weaver-work-cli auth xiaoe first; if unified login is unavailable, ask the user for the E10 login domain (base URL), then run: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>.', ExitCode.AuthError);
     }
     return session;

package/dist/internal/e10/request-runtime.js

@@ -28,10 +28,12 @@ export class E10RequestRuntime {
     session;
     interceptors;
     fetchFn;
+    attachSessionTicket;
     constructor(ctx, session, dependencies = {}) {
         this.ctx = ctx;
         this.session = session;
         this.fetchFn = dependencies.fetch || globalThis.fetch;
+        this.attachSessionTicket = dependencies.attachSessionTicket === true;
         this.interceptors = [
             ...(this.ctx.hooks?.getE10RequestInterceptors?.() || []),
             ...(dependencies.interceptors || []),
@@ -137,7 +139,7 @@ export class E10RequestRuntime {
             langType: 'zh_CN',
             timeZoneOffset: String(new Date().getTimezoneOffset()),
             ...request.headers,
-            Cookie: this.session.cookieHeader(),
+            Cookie: this.attachSessionTicket ? this.session.cookieHeaderWithSessionTicket() : this.session.cookieHeader(),
             eteamsid: this.session.eteamsId,
             'User-Agent': this.session.uaHeader(),
             Origin: this.session.getBaseUrl(),

package/dist/shortcuts/caizhilian/operations/confirm.js

@@ -30,7 +30,7 @@ export async function verifyLease(args, action, env) {
     }
     const lease = await env.continuation.verify(args.continuation.trim(), action);
     const session = await env.host.getSession();
-    if (lease.baseUrl !== session.baseUrl || lease.userId !== session.userId) {
+    if ((lease.baseUrl && lease.baseUrl !== session.baseUrl) || (lease.userId && lease.userId !== session.userId)) {
         throw caizhilianValidationError('continuation_context_mismatch', '确认上下文已变化（环境或登录账号不同），请重新执行 prepare');
     }
     return lease;