weaver-work-cli 0.1.24 → 0.1.25

package/README.md

@@ -218,11 +218,19 @@ XiaoE/erpa 换票服务地址，不是 E10 登录地址。CLI 的 Node 实现会
 系统 CA 校验，且只允许同源重定向或同主机 HTTP→HTTPS 升级。平台凭证不可用时，
 CLI 会先在内部调用 npm 包自带的 `scripts/xiaoe_env.py` 兼容路径，再按顺序尝试
 宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端当前会话
-（`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。
+（优先读取宿主注入的 `XIAOE_USER_SETTINGS_PATH`，其次查找
+`XIAOE_ROBOT_DATA_ROOT` / `XIAOE_ROBOT_ROOT`，最后回退
+`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。只要会话文件中的
+`session_id` 与 `erpa` 有效，Node 路径即可直接换票，不要求宿主存在 `tokens.py`。
 `xiaoe_env.py` 由 CLI 独占执行并解析，不放进 shared Skill，也不把 stdout 凭证暴露给
 Agent；Skill 只负责调用 `weaver-work-cli auth xiaoe`。CLI 自带脚本仅依赖 Python
 标准库，仍保持 TLS 证书校验，不会采用关闭证书校验的回退。
 
+XiaoE 桌面客户端不一定注入上述 Token 对；它会注入 `XIAOE_DATA_ROOT`、
+`XIAOE_ROBOT_DATA_ROOT`、`XIAOE_USER_SETTINGS_PATH`、`XIAOE_ROBOT_ROOT` 等精确的
+运行时路径标记，CLI 也把这些标记识别为当前 XiaoE 桌面宿主。普通 `XIAOE_SKILL_*`、
+`WEAVER_XIAOE_*` 配置或仅在磁盘上发现客户端文件仍不构成宿主身份。
+
 E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 →
 当前 profile → `https://www.e-cology.com.cn`”解析，绝不会把 `XIAOE_DOMAIN`
 当作 E10 地址。匹配成功时直接保存登录态，并固定使用 `agentType=XiaoE`。业务命令
@@ -237,6 +245,7 @@ weaver-work-cli auth xiaoe
 ```
 
 `auth login` / `auth oidc` 始终是纯浏览器 OAuth 入口。本机存在 `xiaoeUserData/tokens.py`、XiaoE 客户端目录、`XIAOE_SKILL_*` 或 `WEAVER_XIAOE_*` 配置，都不能单独证明当前智能体是 XiaoE，也不会让 WorkBuddy、Codex 或其他智能体切换到 XiaoE 登录。
+`auth xiaoe` 会先输出不含凭证的 preflight 摘要（`hostDetected`、`attempted`、`tokenScriptDetected`、`clientSettingsDetected`、`baseUrl`）；命中 `tokens.py` 或内置 Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续 `auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings` 表示未依赖 `tokens.py`，由 Node 直接换票。
 
 默认本地回调地址为 `http://127.0.0.1:19800/callback`。如果端口被占用：
 

package/dist/core/output.js

@@ -233,6 +233,58 @@ function fitEnvelope(value, leading, extraWarnings, budgetBytes) {
         warnings: [...extraWarnings, 'stdout_compacted'],
     };
 }
+/**
+ * stdout 序列化：默认 `JSON.stringify(value, null, 2)`；给了 `compactPaths` 时，**只有**命中这些
+ * 路径的子树改成单行（紧凑）输出，其余照旧缩进。
+ *
+ * 为什么需要它：像 `historyRequestData` 这种「每条都长、层级又深」的数组，缩进空白能吃掉近 1/4
+ * 体积（真机实测：该键 13,017 B → 9,835 B，整份 21,620 B → 18,438 B），而它对读模型的**可读性
+ * 收益为零**——模型要的是"哪条历史、哪个字段、什么值"，不是每层两个空格。
+ *
+ * **内容一字不改**：输出仍是合法 JSON，parse 出来的对象与全缩进版**完全一致**（只是空白不同），
+ * 消费端不需要任何改动；结构也保持数组/对象原样，不会退化成"需要再 parse 一次的字符串"。
+ *
+ * 路径口径：从信封根算起的点分路径（如 `data.historyRequestData`），**精确匹配**、不递归下钻。
+ * 实现用「占位符摘出 → 紧凑序列化 → 文本替换回填」，而**不是**自己递归拼 JSON：标量转义、
+ * `undefined` 键丢弃、数组里 `undefined` 补 `null`、`toJSON` 这些细节全部沿用 `JSON.stringify`
+ * 的原生行为，避免手写序列化器在边角上与原输出分叉。
+ */
+export function stringifyForStdout(value, compactPaths) {
+    const wanted = new Set((compactPaths ?? []).filter((path) => typeof path === 'string' && path !== ''));
+    const plain = JSON.stringify(value, null, 2);
+    if (!wanted.size || plain === undefined)
+        return plain;
+    // 占位符必须不可能与真实内容撞车：随机盐 + 对已序列化文本做一次包含检查（撞了就换一个）。
+    let salt = '';
+    do {
+        salt = `__WEAVER_COMPACT_${Math.random().toString(36).slice(2, 12)}__`;
+    } while (plain.includes(salt));
+    const compacted = [];
+    const swap = (node, path) => {
+        if (node !== null && typeof node === 'object' && wanted.has(path)) {
+            const inline = JSON.stringify(node);
+            if (inline !== undefined) {
+                compacted.push(inline);
+                return `${salt}${compacted.length - 1}__`;
+            }
+        }
+        if (Array.isArray(node))
+            return node.map((item, index) => swap(item, `${path}[${index}]`));
+        if (node !== null && typeof node === 'object') {
+            const out = {};
+            for (const [key, item] of Object.entries(node)) {
+                out[key] = swap(item, path ? `${path}.${key}` : key);
+            }
+            return out;
+        }
+        return node;
+    };
+    const swapped = JSON.stringify(swap(value, ''), null, 2);
+    if (typeof swapped !== 'string')
+        return swapped;
+    // 占位符在文本里是一个普通字符串字面量（`"__WEAVER_COMPACT_xxx__0__"`），整体替换成紧凑 JSON。
+    return swapped.replace(new RegExp(`"${salt}(\\d+)__"`, 'g'), (_match, index) => compacted[Number(index)] ?? 'null');
+}
 export class Output {
     ctx;
     constructor(ctx) {
@@ -245,7 +297,7 @@ export class Output {
             console.log(options.text);
             return;
         }
-        console.log(JSON.stringify(this.prepare(value, options), null, 2));
+        console.log(stringifyForStdout(this.prepare(value, options), options.compactPaths));
     }
     prepare(value, options) {
         const threshold = resultThresholdBytes(this.ctx);

package/dist/internal/e10/auth/commands.js

@@ -5,7 +5,7 @@ import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
-import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
+import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEClientCredential, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
 export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, shouldUseXiaoEBrowserFallback, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
 const EXPLICIT_AGENT_TYPE_ENV_KEYS = [
@@ -192,6 +192,10 @@ function formatAuthStatus(status) {
         'baseUrl: ' + status.baseUrl,
         'profile: ' + status.profile,
         'authFile: ' + status.authFile,
+        ...('loginSource' in status && status.loginSource ? ['loginSource: ' + status.loginSource] : []),
+        ...('credentialSourceStep' in status && status.credentialSourceStep ? ['credentialSourceStep: ' + status.credentialSourceStep] : []),
+        ...('credentialSourceType' in status && status.credentialSourceType ? ['credentialSourceType: ' + status.credentialSourceType] : []),
+        ...('credentialSourceLabel' in status && status.credentialSourceLabel ? ['credentialSourceLabel: ' + status.credentialSourceLabel] : []),
     ];
     if ('valid' in status) {
         lines.push('valid: ' + String(status.valid));
@@ -492,7 +496,8 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     const profileFromGlobal = globalOptions.profile;
     const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
     const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && hasXiaoEEnv(ctx.env);
+    const xiaoEHostDetected = hasXiaoEEnv(ctx.env);
+    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoEHostDetected;
     const baseUrl = useXiaoELogin
         ? resolveXiaoEPreferredBaseUrl({
             explicitBaseUrl,
@@ -508,6 +513,16 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
+    if (behavior.tryXiaoEUnifiedLogin) {
+        ctx.logger.info([
+            'XiaoE unified login preflight:',
+            `hostDetected=${String(xiaoEHostDetected)}`,
+            `attempted=${String(useXiaoELogin)}`,
+            `tokenScriptDetected=${String(hasXiaoETokenScript(ctx.env))}`,
+            `clientSettingsDetected=${String(hasXiaoEClientCredential(ctx.env))}`,
+            `baseUrl=${baseUrl || '(unresolved)'}`,
+        ].join(' '));
+    }
     if (useXiaoELogin) {
         const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
         if (xiaoEResult)

package/dist/internal/e10/auth/crypto.js

@@ -1,7 +1,7 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { resolve } from 'node:path';
-import { Entry as KeyringEntry } from '@napi-rs/keyring';
 import { writeWithRetry } from '../../../core/write-with-retry.js';
 import { getE10AuthRoot } from './paths.js';
 const ALGORITHM = 'aes-256-gcm';
@@ -9,11 +9,40 @@ const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
 const KEYCHAIN_SERVICE = 'weaver-work-cli';
 const KEYCHAIN_ACCOUNT = 'auth-key';
+const require = createRequire(import.meta.url);
 let encKey = null;
+let keyringEntryConstructor;
 function getKeyFilePath() {
     return resolve(getE10AuthRoot(), '.key');
 }
+/**
+ * Load the native keyring binding only when auth encryption actually needs it.
+ *
+ * A top-level ESM import would dlopen the platform binary while the CLI command
+ * tree is being initialized. If a native dependency is unavailable (for
+ * example VCRUNTIME140.dll on Windows), even unrelated commands such as
+ * `--version` would terminate before the file-key fallback could run.
+ */
+function loadKeyringEntryConstructor() {
+    if (keyringEntryConstructor !== undefined)
+        return keyringEntryConstructor;
+    try {
+        const module = require('@napi-rs/keyring');
+        keyringEntryConstructor = typeof module.Entry === 'function'
+            ? module.Entry
+            : null;
+    }
+    catch {
+        // Missing packages, native dlopen failures and unavailable platform
+        // backends all use the existing encrypted file-key fallback.
+        keyringEntryConstructor = null;
+    }
+    return keyringEntryConstructor;
+}
 function readKeychainKey(service) {
+    const KeyringEntry = loadKeyringEntryConstructor();
+    if (!KeyringEntry)
+        return null;
     try {
         const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
         const stored = entry.getPassword();
@@ -28,6 +57,19 @@ function readKeychainKey(service) {
     }
     return null;
 }
+function writeKeychainKey(service, key) {
+    const KeyringEntry = loadKeyringEntryConstructor();
+    if (!KeyringEntry)
+        return false;
+    try {
+        const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
+        entry.setPassword(key.toString('base64'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function readKeyFile(filePath) {
     if (!existsSync(filePath))
         return null;
@@ -47,23 +89,21 @@ function getEncKey() {
         encKey = storedKey;
         return encKey;
     }
-    try {
-        const fresh = randomBytes(32);
-        const entry = new KeyringEntry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
-        entry.setPassword(fresh.toString('base64'));
-        encKey = fresh;
-        return encKey;
-    }
-    catch {
-        // Keychain may be unavailable in headless environments; fall back to a 0600 file.
-    }
+    // Reuse a previously created fallback key before generating a new keychain
+    // value. This keeps existing auth files decryptable if keyring availability
+    // changes between CLI runs.
     const keyFile = getKeyFilePath();
     const fileKey = readKeyFile(keyFile);
     if (fileKey) {
         encKey = fileKey;
         return encKey;
     }
-    encKey = randomBytes(32);
+    const fresh = randomBytes(32);
+    if (writeKeychainKey(KEYCHAIN_SERVICE, fresh)) {
+        encKey = fresh;
+        return encKey;
+    }
+    encKey = fresh;
     mkdirSync(getE10AuthRoot(), { recursive: true });
     writeWithRetry(keyFile, encKey.toString('base64'), { mode: 0o600 });
     return encKey;

package/dist/internal/e10/auth/xiaoe.js

@@ -47,6 +47,17 @@ const XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY = 'XIAOE_TOKEN_SCRIPT_PATH';
 const XIAOE_TOKEN_SCRIPT_PYTHON_LEGACY_ENV_KEY = 'XIAOE_TOKEN_SCRIPT_PYTHON';
 const XIAOE_TOKEN_SCRIPT_TIMEOUT_MS = 15_000;
 const XIAOE_CLIENT_TOKEN_TIMEOUT_MS = 15_000;
+const XIAOE_USER_SETTINGS_PATH_ENV_KEY = 'XIAOE_USER_SETTINGS_PATH';
+const XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS = [
+    'XIAOE_ROBOT_DATA_ROOT',
+    'XIAOE_ROBOT_ROOT',
+];
+const XIAOE_DESKTOP_HOST_ENV_KEYS = [
+    'XIAOE_DATA_ROOT',
+    'XIAOE_ROBOT_DATA_ROOT',
+    'XIAOE_USER_SETTINGS_PATH',
+    'XIAOE_ROBOT_ROOT',
+];
 export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/extend/eteamId';
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
@@ -60,21 +71,35 @@ function envString(env, ...keys) {
     return '';
 }
 export function hasXiaoEEnv(env = process.env) {
-    // Current-host markers win over WEAVER_AGENT_TYPE, which can be inherited
-    // from a previously saved E10 profile by `weaver-work-cli run`.
-    if (Object.keys(env).some((key) => key.startsWith('WORKBUDDY_') || key.startsWith('CODEX_'))) {
-        return false;
-    }
-    const explicitAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE', 'WEAVER_AGENT_TYPE');
-    if (explicitAgentType) {
-        const normalized = explicitAgentType.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
+    const isXiaoEAgentType = (value) => {
+        const normalized = value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
         return ['xiaoe', 'xiaoeclient', '小e', '智能小e'].includes(normalized);
-    }
+    };
+    // A host-specific identity is authoritative. Generic WORKBUDDY_*/CODEX_*
+    // variables are only framework markers and can also be present when XiaoE
+    // launches the CLI through a shared agent runtime.
+    const explicitHostAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE');
+    if (explicitHostAgentType)
+        return isXiaoEAgentType(explicitHostAgentType);
     // XiaoE injects this pair into the command process for the current run. A
     // tokens.py path, client installation, XIAOE_SKILL_* variable, or
     // WEAVER_XIAOE_* configuration alone is credential availability, not proof
     // that the current agent is XiaoE.
-    return hasXiaoEPlatformCredential(env);
+    if (hasXiaoEPlatformCredential(env))
+        return true;
+    // The desktop XiaoE client injects these exact runtime paths even when it
+    // does not inject the web/sandbox XIAOE_USER_TOKEN + XIAOE_DOMAIN pair.
+    // They identify the current command host; unrelated XIAOE_SKILL_* variables
+    // and merely discovering local XiaoE files still do not.
+    if (XIAOE_DESKTOP_HOST_ENV_KEYS.some((key) => Boolean(envString(env, key))))
+        return true;
+    // Current-host framework markers win over WEAVER_AGENT_TYPE, which can be
+    // inherited from a previously saved E10 profile by `weaver-work-cli run`.
+    if (Object.keys(env).some((key) => key.startsWith('WORKBUDDY_') || key.startsWith('CODEX_'))) {
+        return false;
+    }
+    const explicitAgentType = envString(env, 'WEAVER_AGENT_TYPE');
+    return explicitAgentType ? isXiaoEAgentType(explicitAgentType) : false;
 }
 export function describeXiaoECredentialSource(source) {
     // Step 1 is the platform-injected credential (XIAOE_USER_TOKEN + XIAOE_DOMAIN):
@@ -537,30 +562,78 @@ export function xiaoEClientRobotsRoot(env = process.env) {
     const home = envString(env, 'HOME') || homedir();
     return home ? join(home, 'Library', 'Application Support', 'XiaoE', 'Robots') : '';
 }
-export function findXiaoEClientSettingsFile(env = process.env) {
-    const root = xiaoEClientRobotsRoot(env);
-    if (!root || !existsSync(root))
-        return '';
-    let entries = [];
+function isFile(path) {
+    if (!path || !existsSync(path))
+        return false;
     try {
-        entries = readdirSync(root);
+        return statSync(path).isFile();
     }
     catch {
-        return '';
+        return false;
+    }
+}
+function isDirectory(path) {
+    if (!path || !existsSync(path))
+        return false;
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
     }
-    const files = entries
-        .map((name) => join(root, name, 'user_settings.json'))
-        .filter((path) => {
+}
+function listXiaoEClientSettingsFiles(root) {
+    if (!root)
+        return [];
+    if (isFile(root))
+        return [root];
+    if (!isDirectory(root))
+        return [];
+    const candidates = [];
+    const addCandidate = (path) => {
+        if (isFile(path))
+            candidates.push(path);
+    };
+    const addChildSettings = (directory) => {
+        if (!isDirectory(directory))
+            return;
         try {
-            return statSync(path).isFile();
+            for (const entry of readdirSync(directory, { withFileTypes: true })) {
+                if (entry.isDirectory())
+                    addCandidate(join(directory, entry.name, 'user_settings.json'));
+            }
         }
         catch {
-            return false;
+            // Treat an unreadable host directory as an unavailable credential source.
         }
-    });
-    if (files.length === 0)
-        return '';
-    return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs)[0];
+    };
+    addCandidate(join(root, 'user_settings.json'));
+    addChildSettings(root);
+    // Some desktop hosts inject the XiaoE data root rather than the Robots
+    // directory itself. Keep discovery shallow and limited to the known layout.
+    const robotsRoot = join(root, 'Robots');
+    addCandidate(join(robotsRoot, 'user_settings.json'));
+    addChildSettings(robotsRoot);
+    return uniqueStrings(candidates);
+}
+function sortedXiaoEClientSettingsFiles(root) {
+    const files = listXiaoEClientSettingsFiles(root);
+    return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
+}
+function xiaoEClientSettingsCandidateFiles(env) {
+    const candidates = [];
+    const explicitSettingsPath = envString(env, XIAOE_USER_SETTINGS_PATH_ENV_KEY);
+    if (isFile(explicitSettingsPath))
+        candidates.push(explicitSettingsPath);
+    for (const key of XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS) {
+        const injectedRoot = envString(env, key);
+        candidates.push(...sortedXiaoEClientSettingsFiles(injectedRoot));
+    }
+    candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+    return uniqueStrings(candidates);
+}
+export function findXiaoEClientSettingsFile(env = process.env) {
+    return xiaoEClientSettingsCandidateFiles(env)[0] || '';
 }
 /**
  * Platform-injected credential: XIAOE_USER_TOKEN (+ the XiaoE service address).
@@ -587,20 +660,19 @@ export function hasXiaoEPlatformCredential(env = process.env) {
  * Kept for local desktop hosts only; sandboxes must rely on the platform credential.
  */
 export function readXiaoEClientCredential(env = process.env) {
-    const settingsFile = findXiaoEClientSettingsFile(env);
-    if (!settingsFile)
-        return null;
-    try {
-        const parsed = JSON.parse(readFileSync(settingsFile, 'utf8'));
-        const authToken = readString(parsed, 'session_id', 'sessionId');
-        const erpaUrl = normalizeUrl(readString(parsed, 'erpa', 'erpa_url', 'erpaUrl'));
-        if (!authToken || !erpaUrl)
-            return null;
-        return { authToken, erpaUrl, source: XIAOE_CLIENT_SETTINGS_SOURCE };
-    }
-    catch {
-        return null;
+    for (const settingsFile of xiaoEClientSettingsCandidateFiles(env)) {
+        try {
+            const parsed = JSON.parse(readFileSync(settingsFile, 'utf8'));
+            const authToken = readString(parsed, 'session_id', 'sessionId');
+            const erpaUrl = normalizeUrl(readString(parsed, 'erpa', 'erpa_url', 'erpaUrl'));
+            if (authToken && erpaUrl)
+                return { authToken, erpaUrl, source: XIAOE_CLIENT_SETTINGS_SOURCE };
+        }
+        catch {
+            // Continue to the next injected or default client settings candidate.
+        }
     }
+    return null;
 }
 export function hasXiaoEClientCredential(env = process.env) {
     return Boolean(findXiaoEClientSettingsFile(env));
@@ -859,6 +931,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
         // client session and exchanges it for an eteamId, so Python availability
         // no longer blocks unified login.
         if (!credential && hasXiaoEClientCredential(env)) {
+            options.logger?.info('Trying built-in XiaoE client session credential...');
             try {
                 credential = await resolveXiaoEClientCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
             }

package/dist/shortcuts/caizhilian/operations/handlers/fileops.js

@@ -3,7 +3,7 @@ import { caizhilianValidationError } from '../../errors.js';
 import { updateDocBasicField } from '../api.js';
 import { issueWriteLease } from '../confirm.js';
 import { IMAGE_ALLOWED_EXT, assertAllowedExt, assertFileUnchanged, downloadAttachment, readFileMetadata, resolveSavePathArg, uploadFileToServer, } from '../files.js';
-import { fingerprint, isPlainObject, pyBool, timestampToDateStr, validateRequiredParams } from '../shared.js';
+import { fingerprint, formatVersionTimestamp, isPlainObject, pyBool, timestampToDateStr, validateRequiredParams, } from '../shared.js';
 import { caizhilianPrepared, caizhilianSuccess } from '../types.js';
 /**
  * 文件域操作（1:1 对应源 scripts/document_plugins.py 的附件/封面部分
@@ -32,6 +32,8 @@ const QUERY_FILE_OBJECTS_PATH = '/api/file/queryFileObjects';
 const COMPARE_SUBMIT_PATH = '/api/docCompare/uploadCompared';
 const TO_PDF_CHECK_PATH = '/api/file/download/toPdf';
 const DOC_UPDATE_PATH = '/api/doc/document/update';
+/** 源 filePreview 页「附件历史版本」抽屉接口（抓包 findVersionList）。 */
+const FIND_VERSION_LIST_PATH = '/api/file/base/upload/findVersionList';
 /** 源 doc_compare_plugins._COMPARE_OPTIONS：13 个比对选项全部固定为 0（键序与源一致）。 */
 const COMPARE_OPTIONS = {
     ignoreImages: 0,
@@ -50,6 +52,7 @@ const COMPARE_OPTIONS = {
 };
 const ATTACHMENT_UPLOAD_APPLY = 'caizhilian.attachment.upload.apply';
 const ATTACHMENT_REPLACE_APPLY = 'caizhilian.attachment.replace.apply';
+const ATTACHMENT_VERSIONS_ACTION = 'caizhilian.attachment.list-versions';
 const COVER_UPLOAD_APPLY = 'caizhilian.cover.upload.apply';
 const COVER_SET_APPLY = 'caizhilian.cover.set.apply';
 const COVER_REMOVE_APPLY = 'caizhilian.cover.remove.apply';
@@ -455,6 +458,68 @@ async function listFileObjectsHandler(args, env) {
     }
     return caizhilianSuccess(LIST_FILE_OBJECTS_ACTION, { attachments }, { doc_id: docId });
 }
+// ── caizhilian.attachment.list-versions ───────────────────
+/** 源 filePreview 页「附件历史版本」抽屉请求体（抓包 findVersionList，逐字段一致）。 */
+function buildFindVersionListBody(attachmentId, docId, pageNo, pageSize) {
+    return {
+        pageNo,
+        pageSize,
+        id: attachmentId,
+        docId,
+        startTime: '',
+        endTime: '',
+        userIds: '',
+        pauuid: randomUUID().replace(/-/gu, ''),
+        endType: process.platform === 'win32' ? 'Windows' : process.platform === 'darwin' ? 'Mac' : '',
+        module: 'document',
+        maxUploadSize: '10000',
+        mobile: false,
+        enterprisePan: false,
+        customParam: FROM_PC_DOC_PARAM,
+        authModule: 'document',
+        notLoggedIn: false,
+        autoSelect: false,
+        coordinateFlag: false,
+        deepClean: false,
+        publicFileHost: '',
+        tempFileType: '1',
+        create: false,
+        batchCollaboration: false,
+        fileId: attachmentId,
+        imgType: 'imgPlug',
+    };
+}
+async function listAttachmentVersionsHandler(args, env) {
+    const action = ATTACHMENT_VERSIONS_ACTION;
+    validateRequiredParams(args, ['attachment_id']);
+    const attachmentId = pyArgStripped(args, 'attachment_id');
+    const docId = pyArgStripped(args, 'doc_id');
+    const pageNo = Number(args.page_no ?? 1);
+    const pageSize = Number(args.page_size ?? 10);
+    const response = await env.host.request({
+        method: 'POST',
+        path: FIND_VERSION_LIST_PATH,
+        body: buildFindVersionListBody(attachmentId, docId, pageNo, pageSize),
+        operation: action,
+    });
+    const rawPage = nestedValue(response, 'data', 'page');
+    const rawList = Array.isArray(nestedValue(rawPage, 'result')) ? nestedValue(rawPage, 'result') : [];
+    const hasNext = pyBool(nestedValue(rawPage, 'hasNext'));
+    const versions = [];
+    for (const item of rawList) {
+        if (!isPlainObject(item))
+            continue;
+        versions.push({
+            id: item.id ?? null,
+            name: item.name ?? null,
+            versionNumber: item.versionNumber ?? null,
+            updateTime: formatVersionTimestamp(item.updateTime),
+            describe: item.describe ?? null,
+            extName: item.extName ?? null,
+        });
+    }
+    return caizhilianSuccess(action, { versions, has_next: hasNext }, { attachment_id: attachmentId, doc_id: docId });
+}
 // ── caizhilian.compare.upload-file ────────────────────────
 /** 源 DocCompareUploadFilePlugin.execute 的入参解析。 */
 async function planCompareUpload(args) {
@@ -561,6 +626,7 @@ export const caizhilianFileopsHandlers = {
     'caizhilian.attachment.replace': attachmentReplaceHandler,
     'caizhilian.attachment.download': { execute: downloadAttachmentHandler },
     'caizhilian.attachment.download-as-pdf': { execute: downloadAsPdfHandler },
+    'caizhilian.attachment.list-versions': { execute: listAttachmentVersionsHandler },
     'caizhilian.cover.upload': coverUploadHandler,
     'caizhilian.cover.set': coverSetHandler,
     'caizhilian.cover.remove': coverRemoveHandler,