weaver-work-cli 0.1.23 → 0.1.25

package/dist/internal/e10/auth/xiaoe.js

@@ -47,6 +47,17 @@ const XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY = 'XIAOE_TOKEN_SCRIPT_PATH';
 const XIAOE_TOKEN_SCRIPT_PYTHON_LEGACY_ENV_KEY = 'XIAOE_TOKEN_SCRIPT_PYTHON';
 const XIAOE_TOKEN_SCRIPT_TIMEOUT_MS = 15_000;
 const XIAOE_CLIENT_TOKEN_TIMEOUT_MS = 15_000;
+const XIAOE_USER_SETTINGS_PATH_ENV_KEY = 'XIAOE_USER_SETTINGS_PATH';
+const XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS = [
+    'XIAOE_ROBOT_DATA_ROOT',
+    'XIAOE_ROBOT_ROOT',
+];
+const XIAOE_DESKTOP_HOST_ENV_KEYS = [
+    'XIAOE_DATA_ROOT',
+    'XIAOE_ROBOT_DATA_ROOT',
+    'XIAOE_USER_SETTINGS_PATH',
+    'XIAOE_ROBOT_ROOT',
+];
 export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/extend/eteamId';
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
@@ -59,13 +70,36 @@ function envString(env, ...keys) {
     }
     return '';
 }
-function hasEnvPrefix(env, prefix) {
-    return Object.keys(env).some((key) => key === prefix || key.startsWith(`${prefix}_`));
-}
 export function hasXiaoEEnv(env = process.env) {
-    // `XIAOE_*` are the platform-injected variables; `WEAVER_XIAOE_*` are this
-    // CLI's own host-integration variables. Either one marks a XiaoE host.
-    return hasEnvPrefix(env, 'XIAOE') || hasEnvPrefix(env, 'WEAVER_XIAOE');
+    const isXiaoEAgentType = (value) => {
+        const normalized = value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
+        return ['xiaoe', 'xiaoeclient', '小e', '智能小e'].includes(normalized);
+    };
+    // A host-specific identity is authoritative. Generic WORKBUDDY_*/CODEX_*
+    // variables are only framework markers and can also be present when XiaoE
+    // launches the CLI through a shared agent runtime.
+    const explicitHostAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE');
+    if (explicitHostAgentType)
+        return isXiaoEAgentType(explicitHostAgentType);
+    // XiaoE injects this pair into the command process for the current run. A
+    // tokens.py path, client installation, XIAOE_SKILL_* variable, or
+    // WEAVER_XIAOE_* configuration alone is credential availability, not proof
+    // that the current agent is XiaoE.
+    if (hasXiaoEPlatformCredential(env))
+        return true;
+    // The desktop XiaoE client injects these exact runtime paths even when it
+    // does not inject the web/sandbox XIAOE_USER_TOKEN + XIAOE_DOMAIN pair.
+    // They identify the current command host; unrelated XIAOE_SKILL_* variables
+    // and merely discovering local XiaoE files still do not.
+    if (XIAOE_DESKTOP_HOST_ENV_KEYS.some((key) => Boolean(envString(env, key))))
+        return true;
+    // Current-host framework markers win over WEAVER_AGENT_TYPE, which can be
+    // inherited from a previously saved E10 profile by `weaver-work-cli run`.
+    if (Object.keys(env).some((key) => key.startsWith('WORKBUDDY_') || key.startsWith('CODEX_'))) {
+        return false;
+    }
+    const explicitAgentType = envString(env, 'WEAVER_AGENT_TYPE');
+    return explicitAgentType ? isXiaoEAgentType(explicitAgentType) : false;
 }
 export function describeXiaoECredentialSource(source) {
     // Step 1 is the platform-injected credential (XIAOE_USER_TOKEN + XIAOE_DOMAIN):
@@ -528,30 +562,78 @@ export function xiaoEClientRobotsRoot(env = process.env) {
     const home = envString(env, 'HOME') || homedir();
     return home ? join(home, 'Library', 'Application Support', 'XiaoE', 'Robots') : '';
 }
-export function findXiaoEClientSettingsFile(env = process.env) {
-    const root = xiaoEClientRobotsRoot(env);
-    if (!root || !existsSync(root))
-        return '';
-    let entries = [];
+function isFile(path) {
+    if (!path || !existsSync(path))
+        return false;
     try {
-        entries = readdirSync(root);
+        return statSync(path).isFile();
     }
     catch {
-        return '';
+        return false;
+    }
+}
+function isDirectory(path) {
+    if (!path || !existsSync(path))
+        return false;
+    try {
+        return statSync(path).isDirectory();
     }
-    const files = entries
-        .map((name) => join(root, name, 'user_settings.json'))
-        .filter((path) => {
+    catch {
+        return false;
+    }
+}
+function listXiaoEClientSettingsFiles(root) {
+    if (!root)
+        return [];
+    if (isFile(root))
+        return [root];
+    if (!isDirectory(root))
+        return [];
+    const candidates = [];
+    const addCandidate = (path) => {
+        if (isFile(path))
+            candidates.push(path);
+    };
+    const addChildSettings = (directory) => {
+        if (!isDirectory(directory))
+            return;
         try {
-            return statSync(path).isFile();
+            for (const entry of readdirSync(directory, { withFileTypes: true })) {
+                if (entry.isDirectory())
+                    addCandidate(join(directory, entry.name, 'user_settings.json'));
+            }
         }
         catch {
-            return false;
+            // Treat an unreadable host directory as an unavailable credential source.
         }
-    });
-    if (files.length === 0)
-        return '';
-    return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs)[0];
+    };
+    addCandidate(join(root, 'user_settings.json'));
+    addChildSettings(root);
+    // Some desktop hosts inject the XiaoE data root rather than the Robots
+    // directory itself. Keep discovery shallow and limited to the known layout.
+    const robotsRoot = join(root, 'Robots');
+    addCandidate(join(robotsRoot, 'user_settings.json'));
+    addChildSettings(robotsRoot);
+    return uniqueStrings(candidates);
+}
+function sortedXiaoEClientSettingsFiles(root) {
+    const files = listXiaoEClientSettingsFiles(root);
+    return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
+}
+function xiaoEClientSettingsCandidateFiles(env) {
+    const candidates = [];
+    const explicitSettingsPath = envString(env, XIAOE_USER_SETTINGS_PATH_ENV_KEY);
+    if (isFile(explicitSettingsPath))
+        candidates.push(explicitSettingsPath);
+    for (const key of XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS) {
+        const injectedRoot = envString(env, key);
+        candidates.push(...sortedXiaoEClientSettingsFiles(injectedRoot));
+    }
+    candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+    return uniqueStrings(candidates);
+}
+export function findXiaoEClientSettingsFile(env = process.env) {
+    return xiaoEClientSettingsCandidateFiles(env)[0] || '';
 }
 /**
  * Platform-injected credential: XIAOE_USER_TOKEN (+ the XiaoE service address).
@@ -578,20 +660,19 @@ export function hasXiaoEPlatformCredential(env = process.env) {
  * Kept for local desktop hosts only; sandboxes must rely on the platform credential.
  */
 export function readXiaoEClientCredential(env = process.env) {
-    const settingsFile = findXiaoEClientSettingsFile(env);
-    if (!settingsFile)
-        return null;
-    try {
-        const parsed = JSON.parse(readFileSync(settingsFile, 'utf8'));
-        const authToken = readString(parsed, 'session_id', 'sessionId');
-        const erpaUrl = normalizeUrl(readString(parsed, 'erpa', 'erpa_url', 'erpaUrl'));
-        if (!authToken || !erpaUrl)
-            return null;
-        return { authToken, erpaUrl, source: XIAOE_CLIENT_SETTINGS_SOURCE };
-    }
-    catch {
-        return null;
+    for (const settingsFile of xiaoEClientSettingsCandidateFiles(env)) {
+        try {
+            const parsed = JSON.parse(readFileSync(settingsFile, 'utf8'));
+            const authToken = readString(parsed, 'session_id', 'sessionId');
+            const erpaUrl = normalizeUrl(readString(parsed, 'erpa', 'erpa_url', 'erpaUrl'));
+            if (authToken && erpaUrl)
+                return { authToken, erpaUrl, source: XIAOE_CLIENT_SETTINGS_SOURCE };
+        }
+        catch {
+            // Continue to the next injected or default client settings candidate.
+        }
     }
+    return null;
 }
 export function hasXiaoEClientCredential(env = process.env) {
     return Boolean(findXiaoEClientSettingsFile(env));
@@ -850,6 +931,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
         // client session and exchanges it for an eteamId, so Python availability
         // no longer blocks unified login.
         if (!credential && hasXiaoEClientCredential(env)) {
+            options.logger?.info('Trying built-in XiaoE client session credential...');
             try {
                 credential = await resolveXiaoEClientCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
             }

package/dist/internal/e10/context.js

@@ -1,9 +1,9 @@
 import { CliError, ExitCode } from '../../core/errors.js';
 import { E10AuthSession, getActiveProfile, readProfileConfig } from './auth/session.js';
-import { createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin, } from './auth/xiaoe.js';
+import { createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin, } from './auth/xiaoe.js';
 import { E10ApiClient } from './client.js';
 function shouldPreferXiaoEUnifiedLogin(options, env) {
-    return !options.auth && !options.profile && (hasXiaoEEnv(env) || hasXiaoETokenScript(env));
+    return !options.auth && !options.profile && hasXiaoEEnv(env);
 }
 export async function getE10Session(ctx, load = {}) {
     const options = ctx.getGlobalOptions();
@@ -27,7 +27,7 @@ export async function requireE10Session(ctx, load = {}) {
     const session = await getE10Session(ctx, load);
     if (!session) {
         const options = ctx.getGlobalOptions();
-        if ((hasXiaoEEnv(ctx.env) || hasXiaoETokenScript(ctx.env)) && !shouldUseXiaoEBrowserFallback()) {
+        if (hasXiaoEEnv(ctx.env) && !shouldUseXiaoEBrowserFallback()) {
             const baseUrl = resolveXiaoEPreferredBaseUrl({
                 explicitBaseUrl: options.baseUrl,
                 profileBaseUrl: readProfileConfig(getActiveProfile()).baseUrl,

package/dist/internal/e10/request-runtime.js

@@ -62,7 +62,7 @@ export class E10RequestRuntime {
             const headers = this.composeHeaders(mutable, request.trustedHeaders);
             const init = this.buildFetchInit(mutable, headers);
             const response = await this.fetchWithTimeout(url, init, mutable.timeoutMs);
-            const parsed = await this.readResponse(response, mutable.responseType, mutable.bigIntStrings);
+            const parsed = await this.readResponse(response, mutable.responseType, mutable.bigIntStrings, mutable.maxResponseBytes, mutable.timeoutMs);
             await this.runAfterResponse(mutable, sessionContext, parsed);
             return parsed;
         }
@@ -82,6 +82,8 @@ export class E10RequestRuntime {
             body: request.body,
             form: request.form,
             formData: request.formData,
+            streamBody: request.streamBody,
+            maxResponseBytes: request.maxResponseBytes,
             timeoutMs: request.timeoutMs || DEFAULT_TIMEOUT_MS,
             responseType: request.responseType || 'json',
             bigIntStrings: request.bigIntStrings ?? DEFAULT_BIG_INT_STRINGS,
@@ -156,7 +158,11 @@ export class E10RequestRuntime {
             headers,
             redirect: 'manual',
         };
-        if (request.formData) {
+        if (request.streamBody) {
+            init.body = request.streamBody;
+            init.duplex = 'half';
+        }
+        else if (request.formData) {
             init.body = request.formData;
         }
         else if (request.form !== undefined) {
@@ -192,7 +198,7 @@ export class E10RequestRuntime {
             clearTimeout(timer);
         }
     }
-    async readResponse(response, responseType, bigIntStrings = DEFAULT_BIG_INT_STRINGS) {
+    async readResponse(response, responseType, bigIntStrings = DEFAULT_BIG_INT_STRINGS, maxResponseBytes, timeoutMs = DEFAULT_TIMEOUT_MS) {
         if (responseType === 'binary') {
             return {
                 status: response.status,
@@ -201,7 +207,8 @@ export class E10RequestRuntime {
                 contentType: response.headers.get('content-type') || 'application/octet-stream',
             };
         }
-        const text = await response.text();
+        const text = maxResponseBytes === undefined ? await response.text()
+            : await readBoundedText(response, maxResponseBytes, timeoutMs);
         let value = {};
         let parseError;
         try {
@@ -304,6 +311,40 @@ function withQuery(baseUrl, requestPath, query = {}) {
     }
     return url;
 }
+async function readBoundedText(response, limit, timeoutMs) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    let expired = false;
+    const timer = setTimeout(() => { expired = true; void reader.cancel().catch(() => undefined); }, timeoutMs);
+    try {
+        while (true) {
+            const next = await reader.read();
+            if (expired)
+                throw new E10ApiError('network', 'timeout', '文件服务响应读取超时', { retryable: false });
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > limit) {
+                await reader.cancel().catch(() => undefined);
+                throw new E10ApiError('network', 'response_too_large', '文件服务响应超过大小上限', { retryable: false });
+            }
+            chunks.push(next.value);
+        }
+        return Buffer.concat(chunks, size).toString('utf8');
+    }
+    catch (error) {
+        if (error instanceof E10ApiError)
+            throw error;
+        throw new E10ApiError('network', 'response_read_failed', '文件服务响应读取失败', { retryable: false });
+    }
+    finally {
+        clearTimeout(timer);
+        reader.releaseLock();
+    }
+}
 function sanitizePublicHeaders(headers) {
     const next = { ...headers };
     stripReservedHeaders(next);
@@ -338,6 +379,7 @@ function requestForHook(request) {
         query: { ...request.query },
         headers: { ...request.headers },
         body: cloneForHook(request.body),
+        streamBody: undefined,
     };
 }
 function cloneForHook(value) {

package/dist/shortcuts/caizhilian/file-upload/metadata.js

@@ -0,0 +1,124 @@
+/** Port of weaver-file-upload's local inspection/context contract. Never buffer a complete upload file. */
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, readFile } from 'node:fs/promises';
+import { basename, extname, isAbsolute } from 'node:path';
+import { caizhilianValidationError } from '../errors.js';
+import { assertNoLossyIntegers } from '../operations/shared.js';
+export const RESERVED_CONTEXT_FIELDS = ['sf_request_type', 'compressImg', 'module', 'name', 'size', 'MD5',
+    'lastModified', 'lastModifiedDate', 'preUploadId', 'uploadType', 'uploadShardSize', 'chunk', 'chunks', 'file'];
+const RESERVED = new Set(RESERVED_CONTEXT_FIELDS.map((key) => key.toLowerCase()));
+const PRIVATE_KEYS = /^(cookie|eteamsid|eteams_id|authorization|token|access_token|password|ticket|__proto__|prototype|constructor)$/i;
+const MIME = { txt: 'text/plain', pdf: 'application/pdf', png: 'image/png',
+    jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation' };
+export const READ_FLAGS = constants.O_RDONLY | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW);
+async function regularFile(value, label) {
+    if (typeof value !== 'string' || !isAbsolute(value) || value.includes('\0')) {
+        throw caizhilianValidationError('file_path_invalid', `${label} 必须是本地文件绝对路径`);
+    }
+    const info = await lstat(value).catch(() => {
+        throw caizhilianValidationError('file_not_found', `${label} 不存在或不可访问`);
+    });
+    if (!info.isFile() || info.isSymbolicLink()) {
+        throw caizhilianValidationError('file_not_regular', `${label} 必须是非符号链接的普通文件`);
+    }
+    if (!Number.isSafeInteger(info.size))
+        throw caizhilianValidationError('file_size_invalid', '文件大小超出支持范围');
+    return { path: value, info };
+}
+export async function inspectUploadFile(value) {
+    const { path, info } = await regularFile(value, 'file_path');
+    const md5 = createHash('md5');
+    const sha256 = createHash('sha256');
+    try {
+        const handle = await open(path, READ_FLAGS);
+        try {
+            for await (const bytes of handle.createReadStream({ autoClose: false })) {
+                md5.update(bytes);
+                sha256.update(bytes);
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        throw caizhilianValidationError('file_unreadable', '上传文件不可读取');
+    }
+    const after = await lstat(path);
+    if (info.size !== after.size || info.mtimeMs !== after.mtimeMs || info.ctimeMs !== after.ctimeMs
+        || info.ino !== after.ino || after.isSymbolicLink()) {
+        throw caizhilianValidationError('file_changed', '文件在校验过程中发生变化，请重新准备上传');
+    }
+    const extension = extname(path).slice(1).toLowerCase();
+    const mimeType = MIME[extension] ?? 'application/octet-stream';
+    return { path, name: basename(path), extension, mime_type: mimeType, is_image: mimeType.startsWith('image/'),
+        size: info.size, mtime_ms: info.mtimeMs, ctime_ms: info.ctimeMs, inode: info.ino,
+        md5: md5.digest('hex'), sha256: sha256.digest('hex') };
+}
+export function assertUploadSnapshot(file, info) {
+    if (!info.isFile() || info.size !== file.size || info.mtimeMs !== file.mtime_ms
+        || info.ctimeMs !== file.ctime_ms || info.ino !== file.inode) {
+        throw caizhilianValidationError('file_changed', '文件在上传过程中发生变化，请停止并重新准备上传');
+    }
+}
+function validateContext(value, depth = 0) {
+    if (depth > 12)
+        throw caizhilianValidationError('context_invalid', '业务上下文嵌套不能超过 12 层');
+    if (value === null || typeof value !== 'object')
+        return;
+    for (const [key, item] of Object.entries(value)) {
+        if (PRIVATE_KEYS.test(key) || /[\r\n\0]/.test(key) || (depth === 0 && RESERVED.has(key.toLowerCase()))) {
+            throw caizhilianValidationError('context_forbidden_field', '业务上下文包含凭证、危险字段或协议保留字段');
+        }
+        validateContext(item, depth + 1);
+    }
+}
+export async function readUploadContext(value) {
+    let fields = {};
+    if (value !== undefined && value !== '') {
+        const { path, info } = await regularFile(value, 'context_file');
+        if (info.size > 64 * 1024)
+            throw caizhilianValidationError('context_too_large', '业务上下文不能超过 64 KiB');
+        const content = await readFile(path, { flag: READ_FLAGS });
+        if (content.length > 64 * 1024)
+            throw caizhilianValidationError('context_too_large', '业务上下文不能超过 64 KiB');
+        try {
+            fields = JSON.parse(content.toString('utf8'));
+        }
+        catch {
+            throw caizhilianValidationError('context_invalid', 'context_file 必须是合法 JSON 对象');
+        }
+        if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+            throw caizhilianValidationError('context_invalid', 'context_file 必须是 JSON 对象');
+        }
+        validateContext(fields);
+        assertNoLossyIntegers(fields, 'context_file');
+    }
+    const keys = Object.keys(fields).sort();
+    const ordered = Object.fromEntries(keys.map((key) => [key, fields[key]]));
+    return { fields: ordered, keys, sha256: createHash('sha256').update(JSON.stringify(ordered)).digest('hex') };
+}
+export function uploadModule(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_.-]{1,64}$/.test(value)) {
+        throw caizhilianValidationError('module_invalid', 'module 必须来自真实业务上下文，且为 1–64 个字母、数字或 ._-');
+    }
+    return value;
+}
+export function uploadChatId(value) {
+    const id = value ?? 'cli';
+    if (typeof id !== 'string' || !/^[A-Za-z0-9_.-]{1,128}$/.test(id) || id === '.' || id === '..') {
+        throw caizhilianValidationError('chat_id_invalid', 'chat_id 必须为 1–128 个字母、数字或 ._-');
+    }
+    return id;
+}
+export function uploadTimeout(value) {
+    const seconds = value ?? 300;
+    if (typeof seconds !== 'number' || !Number.isInteger(seconds) || seconds < 1 || seconds > 3600) {
+        throw caizhilianValidationError('timeout_invalid', 'timeout_seconds 必须为 1–3600 的整数');
+    }
+    return seconds * 1000;
+}

package/dist/shortcuts/caizhilian/file-upload/multipart.js

@@ -0,0 +1,47 @@
+/** Exact-length multipart body with bounded file slices and RFC 5987 UTF-8 filenames. */
+import { randomBytes } from 'node:crypto';
+import { open } from 'node:fs/promises';
+import { Readable } from 'node:stream';
+import { assertUploadSnapshot, READ_FLAGS } from './metadata.js';
+function quoted(value) { return value.replace(/[\r\n\0]/g, '_').replace(/\\/g, '\\\\').replace(/"/g, '\\"'); }
+function encodedFilename(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+export function uploadMultipart(fields, file) {
+    const boundary = `weaver-${randomBytes(16).toString('hex')}`;
+    const parts = [];
+    for (const [key, value] of Object.entries(fields)) {
+        const text = value === null || value === undefined ? '' : typeof value === 'string' ? value : JSON.stringify(value);
+        parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${quoted(key)}"\r\n\r\n${text}\r\n`));
+    }
+    if (file) {
+        const fallback = quoted(file.meta.name.replace(/[^\x20-\x7e]/g, '_'));
+        parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${fallback}"; `
+            + `filename*=UTF-8''${encodedFilename(file.meta.name)}\r\nContent-Type: ${file.meta.mime_type}\r\n\r\n`));
+    }
+    const tail = Buffer.from(`${file ? '\r\n' : ''}--${boundary}--\r\n`);
+    const body = Readable.from((async function* () {
+        yield* parts;
+        if (file && file.size > 0) {
+            const handle = await open(file.meta.path, READ_FLAGS);
+            try {
+                assertUploadSnapshot(file.meta, await handle.stat());
+                const stream = handle.createReadStream({ start: file.start, end: file.start + file.size - 1, autoClose: false });
+                try {
+                    for await (const bytes of stream)
+                        yield bytes;
+                    assertUploadSnapshot(file.meta, await handle.stat());
+                }
+                finally {
+                    stream.destroy();
+                }
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        yield tail;
+    })(), { objectMode: false });
+    return { body, contentType: `multipart/form-data; boundary=${boundary}`,
+        contentLength: parts.reduce((total, bytes) => total + bytes.length, tail.length + (file?.size ?? 0)) };
+}

package/dist/shortcuts/caizhilian/file-upload/protocol.js

@@ -0,0 +1,116 @@
+/** Upload strategy owner, adapted from weaver-file-upload to the CLI-owned authenticated host. */
+import { CaizhilianCliError, caizhilianValidationError } from '../errors.js';
+import { ExitCode } from '../../../core/errors.js';
+import { uploadMultipart } from './multipart.js';
+const object = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const invalid = (subtype, message) => { throw caizhilianValidationError(subtype, message); };
+function checkedData(response) {
+    const envelope = object(response);
+    const data = object(envelope.data);
+    const code = envelope.code === undefined || envelope.code === null ? '' : String(envelope.code).toLowerCase();
+    if (code && !['0', '200', 'success'].includes(code))
+        invalid('upload_business_failed', '文件服务未确认操作成功');
+    for (const record of [envelope, data]) {
+        if (record.status === false || record.success === false || record.fail === true) {
+            invalid('upload_business_failed', '文件服务未确认操作成功');
+        }
+    }
+    if (!envelope.data || typeof envelope.data !== 'object' || Array.isArray(envelope.data)) {
+        invalid('upload_response_invalid', '文件服务响应缺少有效数据对象');
+    }
+    return data;
+}
+function fileRecord(data) {
+    const candidates = [[data], [object(data.fileObj)], [object(data.uploadModuleDto)],
+        [object(data.uploadModuleDto?.fileObj), object(data.uploadModuleDto)], [object(data.imUploadInfoDto)],
+        [object(data.imUploadInfoDto?.fileObj), object(data.imUploadInfoDto)]];
+    for (const [record, parent] of candidates) {
+        const id = record.fileId ?? record.fileid;
+        if (typeof id === 'number' && !Number.isSafeInteger(id))
+            invalid('file_id_invalid', '文件 ID 精度不可靠');
+        if ((typeof id === 'string' || typeof id === 'number') && String(id).trim()) {
+            return { id: String(id).trim(), sizes: [record.size, parent?.size, data.size] };
+        }
+    }
+    return undefined;
+}
+function terminal(data, file) {
+    const record = fileRecord(data);
+    if (!record || data.endChunk === false)
+        invalid('upload_not_terminal', '上传未返回已完成的非空文件 ID');
+    for (const reported of record.sizes) {
+        if (reported === undefined || reported === null || reported === '')
+            continue;
+        const size = Number(reported);
+        if (!Number.isSafeInteger(size) || size < 0 || (size !== 0 && size !== file.size)) {
+            invalid('upload_size_mismatch', '服务端文件大小与本地文件不一致');
+        }
+    }
+    return record.id;
+}
+async function send(host, path, fields, timeoutMs, file) {
+    const multipart = uploadMultipart(fields, file);
+    try {
+        return checkedData(await host.request({ method: 'POST', path, query: { sf_request_type: 'ajax' },
+            streamMultipart: multipart, timeoutMs, maxResponseBytes: 4 * 1024 * 1024, requireHttp200: true,
+            tolerateBusinessError: true,
+            operation: 'caizhilian.file-upload.upload.apply' }));
+    }
+    catch (error) {
+        const failure = error;
+        if (file && (failure?.type === 'network' || failure?.subtype === 'http_error')) {
+            throw new CaizhilianCliError('partial', 'write_uncertain', '上传请求已发出，但未确认结果；请勿自动重复上传', {
+                retryable: false, details: { execution_state: 'unknown', retry_safe: false }, exitCode: ExitCode.Partial,
+            });
+        }
+        throw error;
+    }
+    finally {
+        multipart.body.destroy();
+    }
+}
+export async function uploadToFileService(host, file, module, context, timeoutMs) {
+    // Node stat retains fractional milliseconds; E10 parses these fields as integer milliseconds.
+    const lastModified = String(Math.floor(file.mtime_ms));
+    const fields = { ...context.fields, compressImg: 'false', module, name: file.name, size: String(file.size),
+        MD5: file.md5, lastModified, lastModifiedDate: lastModified };
+    const pre = await send(host, '/api/file/preUploadCheck', fields, timeoutMs);
+    const type = pre.uploadType;
+    if (!['second', 'common', 'chunk'].includes(type))
+        invalid('upload_type_invalid', '文件服务返回未知上传策略');
+    if (type === 'second')
+        return { file_id: terminal(pre, file), upload_type: type };
+    if (typeof pre.preUploadId !== 'string' || !pre.preUploadId.trim()) {
+        // E10 may return preUploadId as a safe numeric ID.
+        if (typeof pre.preUploadId !== 'number' || !Number.isSafeInteger(pre.preUploadId) || pre.preUploadId <= 0) {
+            invalid('upload_precheck_invalid', '预上传检查未返回有效 preUploadId');
+        }
+    }
+    const uploadFields = { ...fields, preUploadId: String(pre.preUploadId), uploadType: type };
+    if (type === 'common') {
+        const data = await send(host, '/api/file/module/upload', uploadFields, timeoutMs, { meta: file, start: 0, size: file.size });
+        return { file_id: terminal(data, file), upload_type: type };
+    }
+    const chunkMiB = Number(pre.chunkDto?.chunkSize);
+    if (!Number.isSafeInteger(chunkMiB) || chunkMiB <= 0 || file.size <= 0) {
+        invalid('chunk_size_invalid', '分片上传需要非空文件和正整数 MiB 分片大小');
+    }
+    const chunkSize = chunkMiB * 1024 * 1024;
+    if (!Number.isSafeInteger(chunkSize) || chunkSize <= 0)
+        invalid('chunk_size_invalid', '分片大小必须是有效的正 MiB 值');
+    const count = Math.max(1, Math.ceil(file.size / chunkSize));
+    if (pre.chunkDto?.chunkCount !== undefined && Number(pre.chunkDto.chunkCount) !== count) {
+        invalid('chunk_count_mismatch', '服务端分片数量与本地计算不一致');
+    }
+    for (let index = 0; index < count; index++) {
+        const start = index * chunkSize;
+        const size = Math.min(chunkSize, file.size - start);
+        const data = await send(host, '/api/file/module/upload', { ...uploadFields, chunk: index, chunks: count,
+            uploadShardSize: String(size) }, timeoutMs, { meta: file, start, size });
+        if (index === count - 1)
+            return { file_id: terminal(data, file), upload_type: 'chunk' };
+        if (data.endChunk !== false || fileRecord(data))
+            invalid('chunk_terminal_early', '中间分片缺少明确未完成状态或提前返回文件 ID');
+    }
+    return invalid('upload_not_terminal', '分片上传未确认完成');
+}

package/dist/shortcuts/caizhilian/file-upload/receipt.js

@@ -0,0 +1,37 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import { CaizhilianCliError } from '../errors.js';
+import { ExitCode } from '../../../core/errors.js';
+export async function writeUploadReceipt(env, chatId, module, file, context, verified) {
+    const session = await env.host.getSession();
+    const identity = JSON.stringify({ baseUrl: session.baseUrl, userId: session.userId, tenantKey: session.tenantKey });
+    const result = { version: 'weaver_file_upload_result.v1', status: 'completed', business_verified: true,
+        upload_type: verified.upload_type, file: { file_id: verified.file_id, name: file.name, size: file.size,
+            mime_type: file.mime_type, extension: file.extension, is_image: file.is_image },
+        integrity: { md5: file.md5, sha256: file.sha256 },
+        request_evidence: { module, context_keys: context.keys, context_sha256: context.sha256,
+            environment_identity_sha256: createHash('sha256').update(identity).digest('hex'),
+            login_mode: 'weaver-work-cli', automatic_fallback: false } };
+    const configPath = env.ctx.config?.path();
+    const stateRoot = configPath ? dirname(configPath) : env.ctx.env?.WEAVER_WORK_CLI_HOME
+        || env.ctx.env?.WORK_CLI_HOME || resolve(homedir(), '.weaver-work-cli');
+    const directory = resolve(stateRoot, 'caizhilian', 'file-upload', 'runs', chatId, 'receipts');
+    const filename = resolve(directory, `upload-${randomUUID()}.json`);
+    const content = `${JSON.stringify(result, null, 2)}\n`;
+    try {
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32')
+            await chmod(directory, 0o700);
+        await writeFile(filename, content, { flag: 'wx', mode: 0o600 });
+    }
+    catch {
+        throw new CaizhilianCliError('partial', 'receipt_write_failed', '文件已上传，但本地回执保存失败；请勿重复上传', {
+            retryable: false, partialData: { file_id: verified.file_id, upload_type: verified.upload_type },
+            details: { execution_state: 'completed', retry_safe: false }, exitCode: ExitCode.Partial,
+        });
+    }
+    return { ...result, file_id: verified.file_id, file_name: file.name, size: file.size, ext: file.extension,
+        receipt_ref: filename, receipt_sha256: createHash('sha256').update(content).digest('hex') };
+}