weaver-work-cli 0.1.24 → 0.1.26

package/README.md

@@ -211,32 +211,41 @@ weaver-work-cli auth login --base-url "https://weapp.xxx.cn"
 weaver-work-cli auth oidc --base-url "https://weapp.xxx.cn"
 ```
 
-只有当前智能体身份明确为 XiaoE 时，`auth xiaoe` 和未显式指定认证来源的业务命令才会优先使用平台注入的
-`XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 换取 ETEAMSID：其中 `XIAOE_DOMAIN` 是
-XiaoE/erpa 换票服务地址，不是 E10 登录地址。CLI 的 Node 实现会直接调用与
-`xiaoe_env.py` / `tokens.py` 相同的换票接口，并校验业务码和 `data.eteamId`；它保留
-系统 CA 校验，且只允许同源重定向或同主机 HTTP→HTTPS 升级。平台凭证不可用时，
-CLI 会先在内部调用 npm 包自带的 `scripts/xiaoe_env.py` 兼容路径，再按顺序尝试
-宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端当前会话
-（`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。
-`xiaoe_env.py` 由 CLI 独占执行并解析，不放进 shared Skill，也不把 stdout 凭证暴露给
-Agent；Skill 只负责调用 `weaver-work-cli auth xiaoe`。CLI 自带脚本仅依赖 Python
-标准库，仍保持 TLS 证书校验，不会采用关闭证书校验的回退。
-
-E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 →
-当前 profile → `https://www.e-cology.com.cn`”解析，绝不会把 `XIAOE_DOMAIN`
-当作 E10 地址。匹配成功时直接保存登录态，并固定使用 `agentType=XiaoE`。业务命令
-在已确认的 XiaoE 智能体环境中且未显式指定 `--auth` / `--profile` 时，也会自动优先尝试 XiaoE 统一登录。
-`auth xiaoe` 失败后仅在 macOS/Windows 桌面宿主自动降级浏览器 OAuth；Web/Linux
-环境会返回结构化的 `authentication/xiaoe_web_credential_unavailable` 错误，不再
-启动无法回调的 localhost 浏览器登录。确需浏览器授权时，应在可接收本地回调的宿主
-显式运行 `auth login`。也可以显式使用：
+XiaoE 环境保留两种识别入口：桌面客户端由 Agent 根据宿主/任务的明确上下文判断，并在
+业务命令上传 `--runtime-agent xiaoe`；网页端沿用原有环境变量规则，成对的
+`XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 会被识别为 XiaoE。判定为 XiaoE 后，Agent 显式执行：
 
 ```text
 weaver-work-cli auth xiaoe
 ```
 
-`auth login` / `auth oidc` 始终是纯浏览器 OAuth 入口。本机存在 `xiaoeUserData/tokens.py`、XiaoE 客户端目录、`XIAOE_SKILL_*` 或 `WEAVER_XIAOE_*` 配置，都不能单独证明当前智能体是 XiaoE，也不会让 WorkBuddy、Codex 或其他智能体切换到 XiaoE 登录。
+`auth xiaoe` 本身就是认证方式的显式选择。`hasXiaoEEnv` 通过桌面端显式参数或网页端原有
+环境变量规则判断；工作目录、客户端文件或历史登录仍不作为依据。CLI 按顺序消费平台凭据、CLI 自带兼容脚本、宿主 `tokens.py`、
+桌面 XiaoE 客户端会话和 `WEAVER_XIAOE_*` 映射。`XIAOE_DOMAIN` 是 XiaoE/erpa 换票
+服务地址，不是 E10 地址。E10 目标按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*`
+E10 配置/映射 → 当前 profile → `https://www.e-cology.com.cn`”解析。
+
+统一登录失败时，所有操作系统都返回结构化的
+`authentication/xiaoe_credential_unavailable`，不会自动打开浏览器或降级到
+`auth login`。确需浏览器授权时，调用方必须另行显式执行 `auth login`。
+
+业务命令不会自动建立 XiaoE 登录态。桌面客户端需要 XiaoE 专属业务行为时，把全局参数
+放在业务子命令之前，例如：
+
+```text
+weaver-work-cli --runtime-agent xiaoe workflow ...
+```
+
+网页端不要求补这个参数，仍由环境变量规则识别。`--runtime-agent` 只表示当前运行时类型，
+不携带也不选择凭据。`auth login` / `auth oidc`
+始终是纯浏览器 OAuth 入口，不会读取 XiaoE 凭据。
+
+`auth xiaoe` 会先输出不含凭证的 preflight 摘要，显示 `authMode=xiaoe`、
+`credentialSourceDetected`、`attempted` 及各凭据源检测结果；命中 `tokens.py` 或内置
+Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续
+`auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、
+`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings`
+表示未依赖 `tokens.py`，由 Node 直接换票。
 
 默认本地回调地址为 `http://127.0.0.1:19800/callback`。如果端口被占用：
 

package/dist/cmd/root.js

@@ -29,6 +29,7 @@ export function createProgram() {
         .option('--config <path>', 'use a custom weaver-work-cli config file')
         .option('--auth <path>', 'use a specific E10 auth file')
         .option('--profile <name>', 'use a specific E10 profile')
+        .option('--runtime-agent <name>', 'identify the current agent runtime (for example: xiaoe)')
         .option('--is-connector [value]', 'run as the WorkBuddy connector: use the fixed E10 profile managed by the connector')
         .option('--base-url <url>', 'override E10 base URL')
         .option('--passport-url <url>', 'override E10 passport URL');

package/dist/core/output.js

@@ -233,6 +233,58 @@ function fitEnvelope(value, leading, extraWarnings, budgetBytes) {
         warnings: [...extraWarnings, 'stdout_compacted'],
     };
 }
+/**
+ * stdout 序列化：默认 `JSON.stringify(value, null, 2)`；给了 `compactPaths` 时，**只有**命中这些
+ * 路径的子树改成单行（紧凑）输出，其余照旧缩进。
+ *
+ * 为什么需要它：像 `historyRequestData` 这种「每条都长、层级又深」的数组，缩进空白能吃掉近 1/4
+ * 体积（真机实测：该键 13,017 B → 9,835 B，整份 21,620 B → 18,438 B），而它对读模型的**可读性
+ * 收益为零**——模型要的是"哪条历史、哪个字段、什么值"，不是每层两个空格。
+ *
+ * **内容一字不改**：输出仍是合法 JSON，parse 出来的对象与全缩进版**完全一致**（只是空白不同），
+ * 消费端不需要任何改动；结构也保持数组/对象原样，不会退化成"需要再 parse 一次的字符串"。
+ *
+ * 路径口径：从信封根算起的点分路径（如 `data.historyRequestData`），**精确匹配**、不递归下钻。
+ * 实现用「占位符摘出 → 紧凑序列化 → 文本替换回填」，而**不是**自己递归拼 JSON：标量转义、
+ * `undefined` 键丢弃、数组里 `undefined` 补 `null`、`toJSON` 这些细节全部沿用 `JSON.stringify`
+ * 的原生行为，避免手写序列化器在边角上与原输出分叉。
+ */
+export function stringifyForStdout(value, compactPaths) {
+    const wanted = new Set((compactPaths ?? []).filter((path) => typeof path === 'string' && path !== ''));
+    const plain = JSON.stringify(value, null, 2);
+    if (!wanted.size || plain === undefined)
+        return plain;
+    // 占位符必须不可能与真实内容撞车：随机盐 + 对已序列化文本做一次包含检查（撞了就换一个）。
+    let salt = '';
+    do {
+        salt = `__WEAVER_COMPACT_${Math.random().toString(36).slice(2, 12)}__`;
+    } while (plain.includes(salt));
+    const compacted = [];
+    const swap = (node, path) => {
+        if (node !== null && typeof node === 'object' && wanted.has(path)) {
+            const inline = JSON.stringify(node);
+            if (inline !== undefined) {
+                compacted.push(inline);
+                return `${salt}${compacted.length - 1}__`;
+            }
+        }
+        if (Array.isArray(node))
+            return node.map((item, index) => swap(item, `${path}[${index}]`));
+        if (node !== null && typeof node === 'object') {
+            const out = {};
+            for (const [key, item] of Object.entries(node)) {
+                out[key] = swap(item, path ? `${path}.${key}` : key);
+            }
+            return out;
+        }
+        return node;
+    };
+    const swapped = JSON.stringify(swap(value, ''), null, 2);
+    if (typeof swapped !== 'string')
+        return swapped;
+    // 占位符在文本里是一个普通字符串字面量（`"__WEAVER_COMPACT_xxx__0__"`），整体替换成紧凑 JSON。
+    return swapped.replace(new RegExp(`"${salt}(\\d+)__"`, 'g'), (_match, index) => compacted[Number(index)] ?? 'null');
+}
 export class Output {
     ctx;
     constructor(ctx) {
@@ -245,7 +297,7 @@ export class Output {
             console.log(options.text);
             return;
         }
-        console.log(JSON.stringify(this.prepare(value, options), null, 2));
+        console.log(stringifyForStdout(this.prepare(value, options), options.compactPaths));
     }
     prepare(value, options) {
         const threshold = resultThresholdBytes(this.ctx);

package/dist/core/runtime-agent.js

@@ -0,0 +1,19 @@
+const XIAOE_RUNTIME_AGENT_ALIASES = new Set([
+    'xiaoe',
+    'xiaoeclient',
+    '小e',
+    '小e客户端',
+    '智能小e',
+    '智能小e客户端',
+]);
+export function normalizeRuntimeAgent(value) {
+    if (typeof value !== 'string')
+        return '';
+    return value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
+}
+export function isXiaoERuntimeAgent(value) {
+    return XIAOE_RUNTIME_AGENT_ALIASES.has(normalizeRuntimeAgent(value));
+}
+export function isXiaoERuntime(options) {
+    return isXiaoERuntimeAgent(options?.runtimeAgent);
+}

package/dist/internal/e10/auth/commands.js

@@ -5,8 +5,8 @@ import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
-import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
-export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, shouldUseXiaoEBrowserFallback, } from './xiaoe.js';
+import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, inspectXiaoEUnifiedLoginSources, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
+export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, hasXiaoEUnifiedLoginSource, inspectXiaoEUnifiedLoginSources, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
 const EXPLICIT_AGENT_TYPE_ENV_KEYS = [
     'WORKBUDDY_AGENT_TYPE',
@@ -192,6 +192,10 @@ function formatAuthStatus(status) {
         'baseUrl: ' + status.baseUrl,
         'profile: ' + status.profile,
         'authFile: ' + status.authFile,
+        ...('loginSource' in status && status.loginSource ? ['loginSource: ' + status.loginSource] : []),
+        ...('credentialSourceStep' in status && status.credentialSourceStep ? ['credentialSourceStep: ' + status.credentialSourceStep] : []),
+        ...('credentialSourceType' in status && status.credentialSourceType ? ['credentialSourceType: ' + status.credentialSourceType] : []),
+        ...('credentialSourceLabel' in status && status.credentialSourceLabel ? ['credentialSourceLabel: ' + status.credentialSourceLabel] : []),
     ];
     if ('valid' in status) {
         lines.push('valid: ' + String(status.valid));
@@ -476,13 +480,16 @@ async function oidcExchange(code, redirectUri, baseUrl, tenantKeyFallback, agent
         version,
     };
 }
-function xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser) {
+function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
     return [
-        willOpenBrowser
-            ? '未获取到可用的 XiaoE 统一登录信息，准备降级打开网页登录。'
-            : '未获取到可用的 XiaoE 统一登录信息；当前 Web/Linux 环境不支持本机浏览器回调，已停止自动降级。',
+        attempted
+            ? 'XiaoE 统一登录已尝试，但未获取到可用会话。'
+            : '未检测到可用的 XiaoE 统一登录凭据源，本次未尝试统一登录。',
+        '`auth xiaoe` 不会降级到浏览器 OAuth。',
         baseUrl ? `当前 E10 baseUrl: ${baseUrl}。` : '未从 XiaoE 凭证中解析到 E10 baseUrl。',
-        'CLI 已依次尝试平台注入凭证的 Node 换票、CLI 内置 xiaoe_env.py 兼容换票、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。',
+        attempted
+            ? 'CLI 已依次尝试平台注入凭证的 Node 换票、CLI 内置 xiaoe_env.py 兼容换票、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。'
+            : 'CLI 已检查平台注入凭证、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。',
         'CLI 会优先使用 XiaoE 客户端内置 Python 执行 tokens.py；自动发现不可用时，可用 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON 指定兼容解释器。',
     ].join(' ');
 }
@@ -492,32 +499,60 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     const profileFromGlobal = globalOptions.profile;
     const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
     const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && hasXiaoEEnv(ctx.env);
-    const baseUrl = useXiaoELogin
-        ? resolveXiaoEPreferredBaseUrl({
-            explicitBaseUrl,
-            profileBaseUrl: cfg.baseUrl,
+    const preferredXiaoEBaseUrl = resolveXiaoEPreferredBaseUrl({
+        explicitBaseUrl,
+        profileBaseUrl: cfg.baseUrl,
+        env: ctx.env,
+    });
+    const xiaoESources = behavior.tryXiaoEUnifiedLogin === true
+        ? inspectXiaoEUnifiedLoginSources({
             env: ctx.env,
+            baseUrl: preferredXiaoEBaseUrl,
+            profileBaseUrl: cfg.baseUrl,
+            allowTokenScript: behavior.allowXiaoETokenScript === true,
         })
+        : {
+            platformCredential: false,
+            tokenScript: false,
+            clientCredential: false,
+            environmentCredential: false,
+            any: false,
+        };
+    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
+    const baseUrl = behavior.tryXiaoEUnifiedLogin
+        ? preferredXiaoEBaseUrl
         : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
     const explicitAgentType = optionString(commandOpts, 'agentType', 'agent_type');
-    const agentType = resolveAgentType(commandOpts, ctx.env);
+    const agentType = useXiaoELogin
+        ? optionString(commandOpts, 'agentType', 'agent_type') || XIAOE_AGENT_TYPE
+        : resolveAgentType(commandOpts, ctx.env);
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
+    if (behavior.tryXiaoEUnifiedLogin) {
+        ctx.logger.info([
+            'XiaoE unified login preflight:',
+            'authMode=xiaoe',
+            `credentialSourceDetected=${String(xiaoESources.any)}`,
+            `attempted=${String(useXiaoELogin)}`,
+            `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+            `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+            `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+            `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+            `baseUrl=${baseUrl || '(unresolved)'}`,
+        ].join(' '));
+    }
     if (useXiaoELogin) {
         const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
         if (xiaoEResult)
             return xiaoEResult;
     }
-    const willOpenBrowser = !useXiaoELogin
-        || behavior.browserFallback !== 'desktop-only'
-        || shouldUseXiaoEBrowserFallback();
-    if (useXiaoELogin && behavior.explainXiaoEFallback) {
-        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser));
+    const willOpenBrowser = behavior.browserFallback !== 'never';
+    if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
+        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
     }
     if (!willOpenBrowser) {
         throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
@@ -699,15 +734,15 @@ function formatWhoami(title, data) {
     ].join('\n');
 }
 function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
-    auth.command(name)
+    const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
         .option('--tenant-key <key>', 'Tenant key fallback after login')
         .option('--port <n>', 'Local OAuth callback port', '19800')
         .option('--agent_type <value>', 'Agent type sent to E10 authorize endpoint')
         .option('--agent-type <value>', 'Alias of --agent_type')
-        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page')
-        .action(action(async (ctx, options) => {
+        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
+    command.action(action(async (ctx, options) => {
         const result = await runBrowserLogin(ctx, options, behavior);
         ctx.output.write(result, { text: formatLoginResult(result) });
     }));
@@ -793,11 +828,11 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
-    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Try XiaoE unified login and explain before browser OAuth fallback', {
+    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Use XiaoE unified login without browser OAuth fallback', {
         tryXiaoEUnifiedLogin: true,
         allowXiaoETokenScript: true,
         explainXiaoEFallback: true,
-        browserFallback: 'desktop-only',
+        browserFallback: 'never',
     });
     auth.command('logout')
         .alias('clear')

package/dist/internal/e10/auth/crypto.js

@@ -1,7 +1,7 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { resolve } from 'node:path';
-import { Entry as KeyringEntry } from '@napi-rs/keyring';
 import { writeWithRetry } from '../../../core/write-with-retry.js';
 import { getE10AuthRoot } from './paths.js';
 const ALGORITHM = 'aes-256-gcm';
@@ -9,11 +9,40 @@ const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
 const KEYCHAIN_SERVICE = 'weaver-work-cli';
 const KEYCHAIN_ACCOUNT = 'auth-key';
+const require = createRequire(import.meta.url);
 let encKey = null;
+let keyringEntryConstructor;
 function getKeyFilePath() {
     return resolve(getE10AuthRoot(), '.key');
 }
+/**
+ * Load the native keyring binding only when auth encryption actually needs it.
+ *
+ * A top-level ESM import would dlopen the platform binary while the CLI command
+ * tree is being initialized. If a native dependency is unavailable (for
+ * example VCRUNTIME140.dll on Windows), even unrelated commands such as
+ * `--version` would terminate before the file-key fallback could run.
+ */
+function loadKeyringEntryConstructor() {
+    if (keyringEntryConstructor !== undefined)
+        return keyringEntryConstructor;
+    try {
+        const module = require('@napi-rs/keyring');
+        keyringEntryConstructor = typeof module.Entry === 'function'
+            ? module.Entry
+            : null;
+    }
+    catch {
+        // Missing packages, native dlopen failures and unavailable platform
+        // backends all use the existing encrypted file-key fallback.
+        keyringEntryConstructor = null;
+    }
+    return keyringEntryConstructor;
+}
 function readKeychainKey(service) {
+    const KeyringEntry = loadKeyringEntryConstructor();
+    if (!KeyringEntry)
+        return null;
     try {
         const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
         const stored = entry.getPassword();
@@ -28,6 +57,19 @@ function readKeychainKey(service) {
     }
     return null;
 }
+function writeKeychainKey(service, key) {
+    const KeyringEntry = loadKeyringEntryConstructor();
+    if (!KeyringEntry)
+        return false;
+    try {
+        const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
+        entry.setPassword(key.toString('base64'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function readKeyFile(filePath) {
     if (!existsSync(filePath))
         return null;
@@ -47,23 +89,21 @@ function getEncKey() {
         encKey = storedKey;
         return encKey;
     }
-    try {
-        const fresh = randomBytes(32);
-        const entry = new KeyringEntry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
-        entry.setPassword(fresh.toString('base64'));
-        encKey = fresh;
-        return encKey;
-    }
-    catch {
-        // Keychain may be unavailable in headless environments; fall back to a 0600 file.
-    }
+    // Reuse a previously created fallback key before generating a new keychain
+    // value. This keeps existing auth files decryptable if keyring availability
+    // changes between CLI runs.
     const keyFile = getKeyFilePath();
     const fileKey = readKeyFile(keyFile);
     if (fileKey) {
         encKey = fileKey;
         return encKey;
     }
-    encKey = randomBytes(32);
+    const fresh = randomBytes(32);
+    if (writeKeychainKey(KEYCHAIN_SERVICE, fresh)) {
+        encKey = fresh;
+        return encKey;
+    }
+    encKey = fresh;
     mkdirSync(getE10AuthRoot(), { recursive: true });
     writeWithRetry(keyFile, encKey.toString('base64'), { mode: 0o600 });
     return encKey;