weaver-work-cli 0.1.23 → 0.1.25

package/README.md

@@ -211,22 +211,30 @@ weaver-work-cli auth login --base-url "https://weapp.xxx.cn"
 weaver-work-cli auth oidc --base-url "https://weapp.xxx.cn"
 ```
 
-在 XiaoE 宿主环境中，`auth login` / `auth oidc` / `auth xiaoe` 会优先使用平台注入的
+只有当前智能体身份明确为 XiaoE 时，`auth xiaoe` 和未显式指定认证来源的业务命令才会优先使用平台注入的
 `XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 换取 ETEAMSID：其中 `XIAOE_DOMAIN` 是
 XiaoE/erpa 换票服务地址，不是 E10 登录地址。CLI 的 Node 实现会直接调用与
 `xiaoe_env.py` / `tokens.py` 相同的换票接口，并校验业务码和 `data.eteamId`；它保留
 系统 CA 校验，且只允许同源重定向或同主机 HTTP→HTTPS 升级。平台凭证不可用时，
 CLI 会先在内部调用 npm 包自带的 `scripts/xiaoe_env.py` 兼容路径，再按顺序尝试
 宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端当前会话
-（`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。
+（优先读取宿主注入的 `XIAOE_USER_SETTINGS_PATH`，其次查找
+`XIAOE_ROBOT_DATA_ROOT` / `XIAOE_ROBOT_ROOT`，最后回退
+`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。只要会话文件中的
+`session_id` 与 `erpa` 有效，Node 路径即可直接换票，不要求宿主存在 `tokens.py`。
 `xiaoe_env.py` 由 CLI 独占执行并解析，不放进 shared Skill，也不把 stdout 凭证暴露给
 Agent；Skill 只负责调用 `weaver-work-cli auth xiaoe`。CLI 自带脚本仅依赖 Python
 标准库，仍保持 TLS 证书校验，不会采用关闭证书校验的回退。
 
+XiaoE 桌面客户端不一定注入上述 Token 对；它会注入 `XIAOE_DATA_ROOT`、
+`XIAOE_ROBOT_DATA_ROOT`、`XIAOE_USER_SETTINGS_PATH`、`XIAOE_ROBOT_ROOT` 等精确的
+运行时路径标记，CLI 也把这些标记识别为当前 XiaoE 桌面宿主。普通 `XIAOE_SKILL_*`、
+`WEAVER_XIAOE_*` 配置或仅在磁盘上发现客户端文件仍不构成宿主身份。
+
 E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 →
 当前 profile → `https://www.e-cology.com.cn`”解析，绝不会把 `XIAOE_DOMAIN`
 当作 E10 地址。匹配成功时直接保存登录态，并固定使用 `agentType=XiaoE`。业务命令
-在未显式指定 `--auth` / `--profile` 时，也会自动优先尝试 XiaoE 统一登录。
+在已确认的 XiaoE 智能体环境中且未显式指定 `--auth` / `--profile` 时，也会自动优先尝试 XiaoE 统一登录。
 `auth xiaoe` 失败后仅在 macOS/Windows 桌面宿主自动降级浏览器 OAuth；Web/Linux
 环境会返回结构化的 `authentication/xiaoe_web_credential_unavailable` 错误，不再
 启动无法回调的 localhost 浏览器登录。确需浏览器授权时，应在可接收本地回调的宿主
@@ -236,6 +244,9 @@ E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置
 weaver-work-cli auth xiaoe
 ```
 
+`auth login` / `auth oidc` 始终是纯浏览器 OAuth 入口。本机存在 `xiaoeUserData/tokens.py`、XiaoE 客户端目录、`XIAOE_SKILL_*` 或 `WEAVER_XIAOE_*` 配置，都不能单独证明当前智能体是 XiaoE，也不会让 WorkBuddy、Codex 或其他智能体切换到 XiaoE 登录。
+`auth xiaoe` 会先输出不含凭证的 preflight 摘要（`hostDetected`、`attempted`、`tokenScriptDetected`、`clientSettingsDetected`、`baseUrl`）；命中 `tokens.py` 或内置 Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续 `auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings` 表示未依赖 `tokens.py`，由 Node 直接换票。
+
 默认本地回调地址为 `http://127.0.0.1:19800/callback`。如果端口被占用：
 
 ```text
@@ -252,6 +263,25 @@ weaver-work-cli auth login --base-url "https://weapp.xxx.cn" --port 19801
 weaver-work-cli auth login --base-url "https://weapp.xxx.cn" --agent_type workbuddy
 ```
 
+浏览器授权成功后，本地回调页会为已识别的桌面智能体显示应用打开弹层。CLI 内置
+WorkBuddy（`workbuddy://`）、智能小 E（`xiaoe-client://`）和 Codex（`codex://`）映射；
+其他智能体在 `agent_type` 本身是合法协议名时，默认按 `<agent_type>://` 唤起。弹层显示
+“打开客户端 / 始终打开客户端 / 取消”。用户确认后，页面通过一次性令牌请求本地 CLI，
+由 CLI 调用系统注册的桌面协议；浏览器不直接访问自定义
+协议，因此不会再出现 Chrome/Edge 无法定制的外部协议确认框。Windows/macOS 安装包都
+需要注册该协议。如果宿主要返回当前会话等更精确的位置，可传入宿主
+注册的深链（仅接受桌面应用自定义协议，不接受网页、脚本或本地文件 URL）：
+
+```text
+weaver-work-cli auth login --base-url "https://weapp.xxx.cn" --agent_type workbuddy --agent-return-url "workbuddy://<宿主提供的路径>"
+```
+
+宿主也可以注入 `WEAVER_AGENT_RETURN_URL`，命令行参数优先于环境变量；客户端协议名与
+`agent_type` 不一致时也应使用该覆盖。“始终打开”偏好
+保存在当前本地回调地址的浏览器存储中；未识别到可用返回协议时，回调页保持原有提示，
+不显示应用打开弹层。本地 CLI 打开通道默认保留 15 分钟；超过时间再点击时会自动退回
+浏览器自定义协议打开方式，仍可打开应用，但浏览器可能重新显示原生协议确认框。
+
 方式二：手动写入浏览器中的 `ETEAMSID`。
 
 ```text

package/dist/core/output.js

@@ -233,6 +233,58 @@ function fitEnvelope(value, leading, extraWarnings, budgetBytes) {
         warnings: [...extraWarnings, 'stdout_compacted'],
     };
 }
+/**
+ * stdout 序列化：默认 `JSON.stringify(value, null, 2)`；给了 `compactPaths` 时，**只有**命中这些
+ * 路径的子树改成单行（紧凑）输出，其余照旧缩进。
+ *
+ * 为什么需要它：像 `historyRequestData` 这种「每条都长、层级又深」的数组，缩进空白能吃掉近 1/4
+ * 体积（真机实测：该键 13,017 B → 9,835 B，整份 21,620 B → 18,438 B），而它对读模型的**可读性
+ * 收益为零**——模型要的是"哪条历史、哪个字段、什么值"，不是每层两个空格。
+ *
+ * **内容一字不改**：输出仍是合法 JSON，parse 出来的对象与全缩进版**完全一致**（只是空白不同），
+ * 消费端不需要任何改动；结构也保持数组/对象原样，不会退化成"需要再 parse 一次的字符串"。
+ *
+ * 路径口径：从信封根算起的点分路径（如 `data.historyRequestData`），**精确匹配**、不递归下钻。
+ * 实现用「占位符摘出 → 紧凑序列化 → 文本替换回填」，而**不是**自己递归拼 JSON：标量转义、
+ * `undefined` 键丢弃、数组里 `undefined` 补 `null`、`toJSON` 这些细节全部沿用 `JSON.stringify`
+ * 的原生行为，避免手写序列化器在边角上与原输出分叉。
+ */
+export function stringifyForStdout(value, compactPaths) {
+    const wanted = new Set((compactPaths ?? []).filter((path) => typeof path === 'string' && path !== ''));
+    const plain = JSON.stringify(value, null, 2);
+    if (!wanted.size || plain === undefined)
+        return plain;
+    // 占位符必须不可能与真实内容撞车：随机盐 + 对已序列化文本做一次包含检查（撞了就换一个）。
+    let salt = '';
+    do {
+        salt = `__WEAVER_COMPACT_${Math.random().toString(36).slice(2, 12)}__`;
+    } while (plain.includes(salt));
+    const compacted = [];
+    const swap = (node, path) => {
+        if (node !== null && typeof node === 'object' && wanted.has(path)) {
+            const inline = JSON.stringify(node);
+            if (inline !== undefined) {
+                compacted.push(inline);
+                return `${salt}${compacted.length - 1}__`;
+            }
+        }
+        if (Array.isArray(node))
+            return node.map((item, index) => swap(item, `${path}[${index}]`));
+        if (node !== null && typeof node === 'object') {
+            const out = {};
+            for (const [key, item] of Object.entries(node)) {
+                out[key] = swap(item, path ? `${path}.${key}` : key);
+            }
+            return out;
+        }
+        return node;
+    };
+    const swapped = JSON.stringify(swap(value, ''), null, 2);
+    if (typeof swapped !== 'string')
+        return swapped;
+    // 占位符在文本里是一个普通字符串字面量（`"__WEAVER_COMPACT_xxx__0__"`），整体替换成紧凑 JSON。
+    return swapped.replace(new RegExp(`"${salt}(\\d+)__"`, 'g'), (_match, index) => compacted[Number(index)] ?? 'null');
+}
 export class Output {
     ctx;
     constructor(ctx) {
@@ -245,7 +297,7 @@ export class Output {
             console.log(options.text);
             return;
         }
-        console.log(JSON.stringify(this.prepare(value, options), null, 2));
+        console.log(stringifyForStdout(this.prepare(value, options), options.compactPaths));
     }
     prepare(value, options) {
         const threshold = resultThresholdBytes(this.ctx);

package/dist/internal/e10/auth/commands.js

@@ -1,16 +1,54 @@
 import { execFile } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import { createServer } from 'node:http';
 import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
-import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
+import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEClientCredential, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
 export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, shouldUseXiaoEBrowserFallback, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
 const EXPLICIT_AGENT_TYPE_ENV_KEYS = [
-    'WEAVER_AGENT_TYPE',
     'WORKBUDDY_AGENT_TYPE',
     'CODEX_AGENT_TYPE',
+    'WEAVER_AGENT_TYPE',
+];
+const AGENT_RETURN_URL_ENV_KEY = 'WEAVER_AGENT_RETURN_URL';
+const AGENT_RETURN_PATH = '/agent-return';
+const AGENT_RETURN_TOKEN_HEADER = 'x-weaver-agent-return-token';
+const AGENT_RETURN_TIMEOUT_MS = 900_000;
+const UNSAFE_AGENT_RETURN_PROTOCOLS = new Set([
+    'about:',
+    'blob:',
+    'data:',
+    'file:',
+    'ftp:',
+    'http:',
+    'https:',
+    'javascript:',
+    'mailto:',
+    'sms:',
+    'tel:',
+    'vbscript:',
+    'ws:',
+    'wss:',
+]);
+const BUILT_IN_AGENT_RETURN_TARGETS = [
+    {
+        aliases: ['workbuddy'],
+        label: 'WorkBuddy',
+        url: 'workbuddy://',
+    },
+    {
+        aliases: ['xiaoe', 'xiaoeclient', '小e', '智能小e'],
+        label: '智能小 E',
+        url: 'xiaoe-client://',
+    },
+    {
+        aliases: ['codex', 'openaicodex'],
+        label: 'Codex',
+        url: 'codex://',
+    },
 ];
 function asOptions(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -49,6 +87,59 @@ export function resolveAgentType(options = {}, env = process.env) {
         || inferAgentTypeFromEnv(env)
         || DEFAULT_AGENT_TYPE;
 }
+function normalizeAgentKey(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/gu, '');
+}
+function normalizeAgentAlias(value) {
+    return value.trim().toLowerCase().replace(/[^\p{Letter}\p{Number}]+/gu, '');
+}
+function builtInAgentReturnTarget(agentType) {
+    const alias = normalizeAgentAlias(agentType);
+    const target = BUILT_IN_AGENT_RETURN_TARGETS.find((candidate) => candidate.aliases.includes(alias));
+    return target ? { label: target.label, url: target.url } : null;
+}
+function conventionalAgentReturnUrl(agentType) {
+    const scheme = agentType.trim().toLowerCase();
+    if (normalizeAgentAlias(agentType) === normalizeAgentAlias(DEFAULT_AGENT_TYPE)
+        || scheme.length > 64
+        || !/^[a-z][a-z0-9+.-]*$/u.test(scheme)
+        || UNSAFE_AGENT_RETURN_PROTOCOLS.has(`${scheme}:`)) {
+        return '';
+    }
+    return `${scheme}://`;
+}
+function validateAgentReturnUrl(value) {
+    if (value.length > 2048
+        || /[\u0000-\u001f\u007f\s]/u.test(value)
+        || !/^[a-z][a-z0-9+.-]*:\/\//iu.test(value)) {
+        throw new CliError('Invalid --agent-return-url value', ExitCode.UsageError);
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError('Invalid --agent-return-url value', ExitCode.UsageError);
+    }
+    if (UNSAFE_AGENT_RETURN_PROTOCOLS.has(url.protocol)) {
+        throw new CliError('--agent-return-url must use a registered desktop application URL scheme.', ExitCode.UsageError);
+    }
+    return value;
+}
+export function resolveAgentReturnTarget(options = {}, env = process.env, agentType = resolveAgentType(options, env)) {
+    const builtInTarget = builtInAgentReturnTarget(agentType);
+    const explicitUrl = optionString(options, 'agentReturnUrl') || envString(env, AGENT_RETURN_URL_ENV_KEY);
+    if (explicitUrl) {
+        return {
+            label: builtInTarget?.label || agentType,
+            url: validateAgentReturnUrl(explicitUrl),
+        };
+    }
+    if (builtInTarget)
+        return builtInTarget;
+    const conventionalUrl = conventionalAgentReturnUrl(agentType);
+    return conventionalUrl ? { label: agentType, url: conventionalUrl } : null;
+}
 function normalizeUrl(value) {
     return value.replace(/\/+$/, '');
 }
@@ -101,6 +192,10 @@ function formatAuthStatus(status) {
         'baseUrl: ' + status.baseUrl,
         'profile: ' + status.profile,
         'authFile: ' + status.authFile,
+        ...('loginSource' in status && status.loginSource ? ['loginSource: ' + status.loginSource] : []),
+        ...('credentialSourceStep' in status && status.credentialSourceStep ? ['credentialSourceStep: ' + status.credentialSourceStep] : []),
+        ...('credentialSourceType' in status && status.credentialSourceType ? ['credentialSourceType: ' + status.credentialSourceType] : []),
+        ...('credentialSourceLabel' in status && status.credentialSourceLabel ? ['credentialSourceLabel: ' + status.credentialSourceLabel] : []),
     ];
     if ('valid' in status) {
         lines.push('valid: ' + String(status.valid));
@@ -160,8 +255,18 @@ function esc(value) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
-export function renderE10LoginSuccessPage(userId) {
-    return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>weaver-work-cli 登录成功</title><style>body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Arial,sans-serif;background:#f6f7f9;color:#20242a;display:grid;place-items:center;min-height:100vh;margin:0}.card{background:#fff;border:1px solid #e6e8ec;border-radius:8px;padding:28px 32px;box-shadow:0 8px 32px rgba(18,24,40,.08);min-width:320px;text-align:center}.title{font-size:20px;font-weight:600;margin-bottom:8px}.desc{color:#667085;font-size:14px;line-height:22px}.user{color:#98a2b3;font-size:12px;margin-top:12px}</style></head><body><main class="card"><div class="title">登录授权成功</div><div class="desc">你可以关闭此页面，返回智能体或终端继续使用。</div><div class="user">${esc(userId)}</div></main></body></html>`;
+export function renderE10LoginSuccessPage(userId, returnTarget = null, launchToken = '') {
+    const safeReturnTarget = returnTarget
+        ? { ...returnTarget, url: validateAgentReturnUrl(returnTarget.url) }
+        : null;
+    const agentKey = safeReturnTarget ? normalizeAgentKey(safeReturnTarget.label) || 'agent' : '';
+    const returnAction = safeReturnTarget && launchToken
+        ? `<div class="overlay" data-agent-return data-token="${esc(launchToken)}" data-agent-key="${esc(agentKey)}" data-agent-label="${esc(safeReturnTarget.label)}" data-fallback-url="${esc(safeReturnTarget.url)}"><section class="prompt" role="dialog" aria-modal="true" aria-labelledby="agent-return-title"><div class="app-icon" aria-hidden="true"><svg viewBox="0 0 64 64"><defs><linearGradient id="app-gradient" x1="8" y1="4" x2="56" y2="60" gradientUnits="userSpaceOnUse"><stop stop-color="#24d3b5"/><stop offset="1" stop-color="#08aa82"/></linearGradient></defs><rect width="64" height="64" rx="16" fill="url(#app-gradient)"/><path d="M18 21.5 32 13l14 8.5v17L32 47 18 38.5v-17Z" fill="#fff" fill-opacity=".96"/><rect x="23" y="25" width="18" height="15" rx="6" fill="#12b991"/><circle cx="28.5" cy="32.5" r="1.8" fill="#fff"/><circle cx="35.5" cy="32.5" r="1.8" fill="#fff"/></svg></div><h1 id="agent-return-title">是否打开“${esc(safeReturnTarget.label)}”？</h1><p>登录授权已完成，返回 ${esc(safeReturnTarget.label)} 继续使用。</p><button class="primary" type="button" data-action="open">打开“${esc(safeReturnTarget.label)}”</button><button class="secondary" type="button" data-action="always">始终打开“${esc(safeReturnTarget.label)}”</button><button class="secondary" type="button" data-action="cancel">取消</button><div class="status" role="status" aria-live="polite"></div></section></div>`
+        : '';
+    const returnScript = safeReturnTarget && launchToken
+        ? `<script nonce="${esc(launchToken)}">(()=>{const root=document.querySelector('[data-agent-return]');if(!root)return;const status=root.querySelector('.status');const buttons=[...root.querySelectorAll('button')];const agentLabel=root.dataset.agentLabel||'应用';const fallbackUrl=root.dataset.fallbackUrl||'';const storageKey='weaver-work-cli.agent-return.'+root.dataset.agentKey;let busy=false;const setBusy=value=>{busy=value;buttons.forEach(button=>{button.disabled=value;});};const closePrompt=()=>{root.hidden=true;};const savePreference=()=>{try{localStorage.setItem(storageKey,'1');}catch{}};const clearPreference=()=>{try{localStorage.removeItem(storageKey);}catch{}};const hasPreference=()=>{try{return localStorage.getItem(storageKey)==='1';}catch{return false;}};const post=async action=>{let response;try{response=await fetch('${AGENT_RETURN_PATH}?action='+encodeURIComponent(action),{method:'POST',headers:{'${AGENT_RETURN_TOKEN_HEADER}':root.dataset.token}});}catch{return false;}if(!response.ok)throw new Error(await response.text()||'请求失败');return true;};const openAgent=async persist=>{if(busy)return;setBusy(true);status.textContent='正在打开 '+agentLabel+'…';try{const openedLocally=await post('open');if(persist)savePreference();if(!openedLocally){closePrompt();window.location.href=fallbackUrl;return;}closePrompt();}catch(error){if(persist)clearPreference();status.textContent=error instanceof Error?error.message:'无法打开应用，请稍后重试。';setBusy(false);}};root.querySelector('[data-action="open"]').addEventListener('click',()=>openAgent(false));root.querySelector('[data-action="always"]').addEventListener('click',()=>openAgent(true));root.querySelector('[data-action="cancel"]').addEventListener('click',()=>{if(busy)return;clearPreference();closePrompt();post('cancel').catch(()=>{});});if(hasPreference())openAgent(false);})();</script>`
+        : '';
+    return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>weaver-work-cli 登录成功</title><style>:root{color-scheme:light}*{box-sizing:border-box}body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Arial,sans-serif;background:radial-gradient(circle at 50% 18%,#eefbf8 0,#f6f7f9 42%,#eef1f5 100%);color:#20242a;display:grid;place-items:center;min-height:100vh;margin:0}.card{background:rgba(255,255,255,.88);border:1px solid #e6e8ec;border-radius:18px;padding:34px 38px;box-shadow:0 18px 55px rgba(18,24,40,.09);width:min(560px,calc(100vw - 40px));text-align:center}.title{font-size:24px;font-weight:700;margin-bottom:10px}.desc{color:#667085;font-size:15px;line-height:24px}.user{color:#98a2b3;font-size:12px;margin-top:18px}.overlay{position:fixed;inset:0;z-index:10;display:grid;place-items:center;padding:20px;background:rgba(28,34,41,.36);backdrop-filter:blur(5px)}.overlay[hidden]{display:none}.prompt{width:min(410px,calc(100vw - 32px));padding:32px 28px 26px;border:1px solid rgba(255,255,255,.75);border-radius:24px;background:rgba(250,250,251,.97);box-shadow:0 24px 70px rgba(15,23,42,.28);text-align:center}.app-icon{width:74px;height:74px;margin:0 auto 24px;filter:drop-shadow(0 8px 14px rgba(8,170,130,.22))}.app-icon svg{display:block;width:100%;height:100%}.prompt h1{margin:0;font-size:20px;line-height:30px;font-weight:700;letter-spacing:-.2px}.prompt p{margin:10px 0 24px;color:#667085;font-size:14px;line-height:22px}.prompt button{display:block;width:100%;min-height:40px;border:0;border-radius:12px;font:600 16px/22px inherit;cursor:pointer;transition:transform .12s ease,filter .12s ease}.prompt button+button{margin-top:10px}.prompt button:hover{filter:brightness(.98)}.prompt button:active{transform:scale(.99)}.prompt button:disabled{cursor:wait;opacity:.62}.primary{background:linear-gradient(180deg,#2f91ff,#0b74e5);color:#fff;box-shadow:0 8px 18px rgba(11,116,229,.2)}.secondary{background:#e9eaec;color:#22252a}.status{min-height:18px;margin-top:14px;color:#667085;font-size:12px;line-height:18px}</style></head><body><main class="card"><div class="title">登录授权成功</div><div class="desc">你可以关闭此页面，返回智能体或终端继续使用。</div><div class="user">${esc(userId)}</div></main>${returnAction}${returnScript}</body></html>`;
 }
 export function resolveBrowserOpenCommand(url, platform = process.platform) {
     if (platform === 'win32') {
@@ -179,6 +284,17 @@ function openUrlInBrowser(url, ctx) {
         }
     });
 }
+function openUrlWithSystemHandler(url) {
+    const command = resolveBrowserOpenCommand(url);
+    return new Promise((resolve, reject) => {
+        execFile(command.file, command.args, (error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
 export function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
     const authorizeParams = new URLSearchParams({
         redirect_uri: redirectUri,
@@ -380,11 +496,15 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     const profileFromGlobal = globalOptions.profile;
     const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
     const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
-    const baseUrl = resolveXiaoEPreferredBaseUrl({
-        explicitBaseUrl,
-        profileBaseUrl: cfg.baseUrl,
-        env: ctx.env,
-    });
+    const xiaoEHostDetected = hasXiaoEEnv(ctx.env);
+    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoEHostDetected;
+    const baseUrl = useXiaoELogin
+        ? resolveXiaoEPreferredBaseUrl({
+            explicitBaseUrl,
+            profileBaseUrl: cfg.baseUrl,
+            env: ctx.env,
+        })
+        : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
@@ -393,11 +513,25 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
-    const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
-    if (xiaoEResult)
-        return xiaoEResult;
-    const willOpenBrowser = behavior.browserFallback !== 'desktop-only' || shouldUseXiaoEBrowserFallback();
-    if (behavior.explainXiaoEFallback) {
+    if (behavior.tryXiaoEUnifiedLogin) {
+        ctx.logger.info([
+            'XiaoE unified login preflight:',
+            `hostDetected=${String(xiaoEHostDetected)}`,
+            `attempted=${String(useXiaoELogin)}`,
+            `tokenScriptDetected=${String(hasXiaoETokenScript(ctx.env))}`,
+            `clientSettingsDetected=${String(hasXiaoEClientCredential(ctx.env))}`,
+            `baseUrl=${baseUrl || '(unresolved)'}`,
+        ].join(' '));
+    }
+    if (useXiaoELogin) {
+        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
+        if (xiaoEResult)
+            return xiaoEResult;
+    }
+    const willOpenBrowser = !useXiaoELogin
+        || behavior.browserFallback !== 'desktop-only'
+        || shouldUseXiaoEBrowserFallback();
+    if (useXiaoELogin && behavior.explainXiaoEFallback) {
         ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser));
     }
     if (!willOpenBrowser) {
@@ -405,6 +539,8 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     }
     if (!baseUrl)
         throw new CliError('Missing --base-url', ExitCode.UsageError);
+    const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
+    const agentReturnToken = agentReturnTarget ? randomBytes(24).toString('base64url') : '';
     const redirectUri = `http://127.0.0.1:${port}/callback`;
     const loginUrl = buildE10AuthorizeUrl(baseUrl, redirectUri, agentType);
     ctx.logger.info('Open browser login: ' + loginUrl);
@@ -412,6 +548,7 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     return await new Promise((resolve, reject) => {
         let settled = false;
         let timer = null;
+        let pendingLoginResult = null;
         const finish = (error, result) => {
             if (settled)
                 return;
@@ -433,6 +570,43 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         };
         const server = createServer(async (req, res) => {
             const callbackUrl = new URL(req.url || '/', `http://127.0.0.1:${port}`);
+            if (callbackUrl.pathname === AGENT_RETURN_PATH) {
+                const requestToken = req.headers[AGENT_RETURN_TOKEN_HEADER];
+                if (req.method !== 'POST'
+                    || !agentReturnTarget
+                    || !pendingLoginResult
+                    || requestToken !== agentReturnToken) {
+                    res.writeHead(403, { 'cache-control': 'no-store', 'content-type': 'text/plain; charset=utf-8' });
+                    res.end('Forbidden');
+                    return;
+                }
+                const action = callbackUrl.searchParams.get('action');
+                if (action === 'cancel') {
+                    const result = pendingLoginResult;
+                    res.writeHead(204, { 'cache-control': 'no-store' });
+                    res.end();
+                    finish(null, result);
+                    return;
+                }
+                if (action !== 'open') {
+                    res.writeHead(400, { 'cache-control': 'no-store', 'content-type': 'text/plain; charset=utf-8' });
+                    res.end('Invalid action');
+                    return;
+                }
+                try {
+                    await openUrlWithSystemHandler(agentReturnTarget.url);
+                    const result = pendingLoginResult;
+                    res.writeHead(200, { 'cache-control': 'no-store', 'content-type': 'application/json; charset=utf-8' });
+                    res.end('{"ok":true}');
+                    finish(null, result);
+                }
+                catch {
+                    ctx.logger.warn(`Could not open ${agentReturnTarget.label} automatically.`);
+                    res.writeHead(500, { 'cache-control': 'no-store', 'content-type': 'text/plain; charset=utf-8' });
+                    res.end(`无法打开 ${agentReturnTarget.label}，请确认应用已安装。`);
+                }
+                return;
+            }
             if (callbackUrl.pathname !== '/callback') {
                 res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
                 res.end('Not found');
@@ -460,9 +634,26 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
             }
             try {
                 const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
-                res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
-                res.end(renderE10LoginSuccessPage(result.userId));
-                finish(null, result);
+                const responseHeaders = {
+                    'cache-control': 'no-store',
+                    'content-security-policy': agentReturnTarget
+                        ? `default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${agentReturnToken}'; connect-src 'self'`
+                        : `default-src 'none'; style-src 'unsafe-inline'`,
+                    'content-type': 'text/html; charset=utf-8',
+                    'referrer-policy': 'no-referrer',
+                    'x-content-type-options': 'nosniff',
+                    'x-frame-options': 'DENY',
+                };
+                res.writeHead(200, responseHeaders);
+                res.end(renderE10LoginSuccessPage(result.userId, agentReturnTarget, agentReturnToken));
+                if (!agentReturnTarget) {
+                    finish(null, result);
+                    return;
+                }
+                pendingLoginResult = result;
+                if (timer)
+                    clearTimeout(timer);
+                timer = setTimeout(() => finish(null, result), AGENT_RETURN_TIMEOUT_MS);
             }
             catch (exchangeError) {
                 const message = exchangeError instanceof Error ? exchangeError.message : String(exchangeError);
@@ -530,6 +721,7 @@ function registerBrowserLoginCommand(auth, action, name, description, behavior =
         .option('--port <n>', 'Local OAuth callback port', '19800')
         .option('--agent_type <value>', 'Agent type sent to E10 authorize endpoint')
         .option('--agent-type <value>', 'Alias of --agent_type')
+        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page')
         .action(action(async (ctx, options) => {
         const result = await runBrowserLogin(ctx, options, behavior);
         ctx.output.write(result, { text: formatLoginResult(result) });
@@ -617,6 +809,7 @@ export function registerE10AuthCommands(parent, action) {
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
     registerBrowserLoginCommand(auth, action, 'xiaoe', 'Try XiaoE unified login and explain before browser OAuth fallback', {
+        tryXiaoEUnifiedLogin: true,
         allowXiaoETokenScript: true,
         explainXiaoEFallback: true,
         browserFallback: 'desktop-only',

package/dist/internal/e10/auth/crypto.js

@@ -1,7 +1,7 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { resolve } from 'node:path';
-import { Entry as KeyringEntry } from '@napi-rs/keyring';
 import { writeWithRetry } from '../../../core/write-with-retry.js';
 import { getE10AuthRoot } from './paths.js';
 const ALGORITHM = 'aes-256-gcm';
@@ -9,11 +9,40 @@ const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
 const KEYCHAIN_SERVICE = 'weaver-work-cli';
 const KEYCHAIN_ACCOUNT = 'auth-key';
+const require = createRequire(import.meta.url);
 let encKey = null;
+let keyringEntryConstructor;
 function getKeyFilePath() {
     return resolve(getE10AuthRoot(), '.key');
 }
+/**
+ * Load the native keyring binding only when auth encryption actually needs it.
+ *
+ * A top-level ESM import would dlopen the platform binary while the CLI command
+ * tree is being initialized. If a native dependency is unavailable (for
+ * example VCRUNTIME140.dll on Windows), even unrelated commands such as
+ * `--version` would terminate before the file-key fallback could run.
+ */
+function loadKeyringEntryConstructor() {
+    if (keyringEntryConstructor !== undefined)
+        return keyringEntryConstructor;
+    try {
+        const module = require('@napi-rs/keyring');
+        keyringEntryConstructor = typeof module.Entry === 'function'
+            ? module.Entry
+            : null;
+    }
+    catch {
+        // Missing packages, native dlopen failures and unavailable platform
+        // backends all use the existing encrypted file-key fallback.
+        keyringEntryConstructor = null;
+    }
+    return keyringEntryConstructor;
+}
 function readKeychainKey(service) {
+    const KeyringEntry = loadKeyringEntryConstructor();
+    if (!KeyringEntry)
+        return null;
     try {
         const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
         const stored = entry.getPassword();
@@ -28,6 +57,19 @@ function readKeychainKey(service) {
     }
     return null;
 }
+function writeKeychainKey(service, key) {
+    const KeyringEntry = loadKeyringEntryConstructor();
+    if (!KeyringEntry)
+        return false;
+    try {
+        const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
+        entry.setPassword(key.toString('base64'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function readKeyFile(filePath) {
     if (!existsSync(filePath))
         return null;
@@ -47,23 +89,21 @@ function getEncKey() {
         encKey = storedKey;
         return encKey;
     }
-    try {
-        const fresh = randomBytes(32);
-        const entry = new KeyringEntry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
-        entry.setPassword(fresh.toString('base64'));
-        encKey = fresh;
-        return encKey;
-    }
-    catch {
-        // Keychain may be unavailable in headless environments; fall back to a 0600 file.
-    }
+    // Reuse a previously created fallback key before generating a new keychain
+    // value. This keeps existing auth files decryptable if keyring availability
+    // changes between CLI runs.
     const keyFile = getKeyFilePath();
     const fileKey = readKeyFile(keyFile);
     if (fileKey) {
         encKey = fileKey;
         return encKey;
     }
-    encKey = randomBytes(32);
+    const fresh = randomBytes(32);
+    if (writeKeychainKey(KEYCHAIN_SERVICE, fresh)) {
+        encKey = fresh;
+        return encKey;
+    }
+    encKey = fresh;
     mkdirSync(getE10AuthRoot(), { recursive: true });
     writeWithRetry(keyFile, encKey.toString('base64'), { mode: 0o600 });
     return encKey;