weaver-work-cli 0.1.24 → 0.1.26

package/docs/caizhilian.md

@@ -155,7 +155,7 @@ weaver-work-cli --json caizhilian run caizhilian.folder.query-by-name --input-js
 | `caizhilian.share.add.prepare/apply` | prepare=写前回查，apply=高风险写 | prepare → apply | `add_doc_share` | 添加文档共享 |
 | `caizhilian.share.delete.prepare/apply` | prepare=写前回查，apply=高风险写 | prepare → apply | `delete_doc_share` | 删除文档共享 |
 
-### attachment（6 条对外 operation）
+### attachment（7 条对外 operation）
 
 附件
 
@@ -165,6 +165,7 @@ weaver-work-cli --json caizhilian run caizhilian.folder.query-by-name --input-js
 | `caizhilian.attachment.replace.prepare/apply` | prepare=写前回查，apply=上传写 | prepare → apply | `replace_document_attachment` | 替换文档附件（reUpload，保留附件 ID） |
 | `caizhilian.attachment.download` | 本地落盘 | — | `download_doc_attachment` | 下载文档附件到本地（写本地磁盘，不改服务端） |
 | `caizhilian.attachment.download-as-pdf` | 本地落盘 | — | `download_doc_attachment_to_pdf` | 下载文档附件的 PDF 转换版本（写本地磁盘） |
+| `caizhilian.attachment.list-versions` | 只读 | — | `find_version_list` | 按附件 ID 查询附件历史版本（源 filePreview 历史版本抽屉接口，HAR 抓包迁入） |
 
 ### cover（6 条对外 operation）
 
@@ -195,7 +196,7 @@ weaver-work-cli --json caizhilian run caizhilian.folder.query-by-name --input-js
 | --- | --- | --- | --- | --- |
 | `caizhilian.system.health` | 只读 | — | `check_system_health` | 采知连接口连通性与登录态自检 |
 
-合计 87 条对外 operation，来自 60 个 canonical 操作（源 Skill 60 条操作规格中的写操作展开为 prepare/apply）。
+合计 180 条对外 operation，由 canonical 操作的写规格展开 prepare/apply 而成。
 
 ## 常用命令
 
@@ -288,7 +289,7 @@ weaver-work-cli --json caizhilian run caizhilian.attachment.download --input-jso
 
 | 模块 | CLI 操作 | 功能 |
 | --- | --- | --- |
-| 附件设置 | `caizhilian.setting-attach.*` | 上传最大、格式控制、批量下载等 11 项配置 |
+| 附件设置 | `caizhilian.setting-attach.*` | 上传最大、格式控制、批量下载等 11 项配置；按审批流程 ID 查附件上传目录（`list-upload-folders`，合并通用设置与附件字段配置去重返回）；按名称搜索审批流程拿流程 ID（`search-workflows`） |
 | 备份设置 | `caizhilian.setting-backup.*` | 备份开关、规则 CRUD、启停 |
 | 加解密设置 | `caizhilian.setting-encrypt.*` | 8 项加解密配置 |
 | 存储设置 | `caizhilian.setting-storage.*` | 存储实例与规则管理 |

package/docs/e10-auth.md

@@ -10,6 +10,11 @@ E10 适配模块刻意与核心 CLI 框架隔离，避免平台逻辑污染通
 - Keychain service/account：`weaver-work-cli` / `auth-key`
 - 发票业务 Token Keychain service：`cn.weaver.weaver-work-cli.invoice-token`
 
+登录态加密使用的 Keychain 原生模块按需加载。模块缺失、原生依赖无法加载或系统
+Keychain 不可用时，CLI 仍可启动，并回退到鉴权根目录下的 `.key` 文件继续完成
+登录态加解密。该文件会请求 `0600` 模式；但 Windows 不提供完整的 POSIX 文件权限
+语义，因此文件回退属于可用性保障，安全隔离强度不等同于 Windows 凭据管理器。
+
 发票业务 Token 的 Keychain 缓存是可选的性能优化。在没有系统密钥环的
 Web/Linux 环境中，CLI 不会把 Token 写入明文文件，而是仅在当前命令进程内保存并
 继续完成业务请求；下一次命令会重新向 E10 获取 Token。
@@ -52,16 +57,19 @@ Chrome/Edge 原生确认框。宿主需要返回特定会话时，可以传
 返回地址只接受桌面应用自定义协议，不接受 `http(s)`、脚本或本地文件 URL。“始终打开”
 偏好保存在当前本地回调地址的浏览器存储中。本地 CLI 打开通道默认保留 15 分钟；通道
 结束后页面会自动退回浏览器自定义协议打开方式，不直接显示网络请求错误。
-智能小 E 统一登录成功时不会经过浏览器；只有统一登录不可用并降级为桌面浏览器 OAuth 时，
-才显示“返回智能小 E”弹层。
+智能小 E 统一登录不会经过浏览器，也不会显示“返回智能小 E”弹层；该弹层只属于用户另行显式发起的 `auth login` 浏览器 OAuth。
+
+XiaoE 宿主身份有两种判定入口：桌面客户端由 Agent 根据“智能小 e 客户端”“小 E”、`XiaoE`、`xiaoe-client` 等明确上下文判断，并传入 `--runtime-agent xiaoe`；网页端沿用原有环境变量规则，成对的 `XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 会被识别为 XiaoE。工作目录、客户端文件、内置 Node.js、历史登录、路径变量或单个凭据变量都不能单独用于判定。判定为 XiaoE 后，Agent 显式执行 `weaver-work-cli auth xiaoe`。
 
-只有当前智能体身份明确为 XiaoE 时，`auth xiaoe` 和未显式指定认证来源的业务命令才先使用平台注入的 `XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 换取 ETEAMSID（沙箱/Linux 环境唯一可用来源）。这里的 `XIAOE_DOMAIN` 是 XiaoE/erpa 换票服务地址，不是 E10 登录地址。Node 主路径调用与 `xiaoe_env.py` / `tokens.py` 相同的接口，校验业务 `code`（`"0000"` 或 `200`）及 `data.eteamId`，保留系统 CA 校验，并只跟随同源重定向或同主机 HTTP→HTTPS 升级。Node 路径失败时，CLI 会在内部执行 npm 包自带的 `scripts/xiaoe_env.py` 兼容路径；它只依赖 Python 标准库，凭证 stdout 由 CLI 内部消费，不进入 Agent 上下文，也不会关闭 TLS 证书校验。之后才依次读取宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端本地会话（macOS `~/Library/Application Support/XiaoE/Robots/<id>/user_settings.json`，Windows `%LOCALAPPDATA%/XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` ETEAMSID 映射。宿主不会注入 ETEAMSID 环境变量，CLI 也不读取 `XIAOE_ETEAMSID`。仅本机存在这些文件或配置不足以触发 XiaoE 登录。
+CLI 依次尝试成对的平台凭据、npm 包自带的 `scripts/xiaoe_env.py` 兼容路径、宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端本地会话和 `WEAVER_XIAOE_*` ETEAMSID 映射。客户端会话优先读取 `XIAOE_USER_SETTINGS_PATH`，再从 `XIAOE_ROBOT_DATA_ROOT` / `XIAOE_ROBOT_ROOT` 查找，最后回退 macOS `~/Library/Application Support/XiaoE/Robots/<id>/user_settings.json` 或 Windows `%LOCALAPPDATA%/XiaoE/Robots/<id>/user_settings.json`。这些变量和文件只用于定位凭据，不能用于识别宿主。`XIAOE_DOMAIN` 是 XiaoE/erpa 换票服务地址，不是 E10 登录地址。
 
-E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 → 当前 profile → `https://www.e-cology.com.cn`”解析，绝不会把 `XIAOE_DOMAIN` 当作 E10 地址。凭证可用时，CLI 直接保存登录态，保存的 `agentType` 固定为 `XiaoE`；业务命令在未显式指定 `--auth` / `--profile` 时，也会自动优先尝试 XiaoE 统一登录。统一登录失败后，`auth xiaoe` 仅在 macOS/Windows 桌面宿主自动降级浏览器 OAuth；Web/Linux 环境直接返回 `authentication/xiaoe_web_credential_unavailable`，不再启动无法回调的 localhost 登录。用户明确希望浏览器授权且宿主能够接收本地回调时，可以显式运行 `auth login`。
+E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 → 当前 profile → `https://www.e-cology.com.cn`”解析。凭证可用时，CLI 直接保存登录态，保存的 `agentType` 固定为 `XiaoE`。统一登录失败时，所有操作系统都返回 `authentication/xiaoe_credential_unavailable`，不启动浏览器 OAuth。需要浏览器授权时必须另行显式执行 `auth login`。
 
 脚本兼容链路会先自动发现桌面 XiaoE 客户端内置 Python（macOS 应用包与 Windows 按用户/全局安装均支持），再回退到系统 `python3`、`/usr/bin/python3`、`python`；Windows 的系统回退顺序为 `python`、`python3`、`py`。可用 `WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON` 精确指定解释器，用 `WEAVER_XIAOE_TOKEN_SCRIPT_PATH` 指定桌面宿主脚本路径（旧名 `XIAOE_TOKEN_SCRIPT_PYTHON` / `XIAOE_TOKEN_SCRIPT_PATH` 仍兼容）。CLI 自带的 `xiaoe_env.py` 位于 npm 包 `scripts/`，不会放入 `weaver-e10-shared` Skill；Skill 包禁止携带或直接执行 Token 脚本。`XIAOE_` 是平台保留前缀，本 CLI 的自定义变量统一使用 `WEAVER_XIAOE_*`。
 
-上述“业务命令自动优先尝试”仅适用于当前智能体身份明确为 XiaoE 的进程。WorkBuddy、Codex 及其他智能体不会因为本机存在 XiaoE 文件或配置而进入该分支，并必须使用 `auth login --base-url <url> --agent_type <agent_type>` 的浏览器 OAuth 流程。
+`auth xiaoe` 会先打印不含凭证的 preflight 摘要，给出 `authMode=xiaoe`、`credentialSourceDetected`、`attempted`、各凭据源检测结果和目标 `baseUrl`。进入脚本分支时会打印 `Trying XiaoE token script credential...`；进入内置 Node 会话分支时会打印 `Trying built-in XiaoE client session credential...`。成功结果和后续 `auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、`credentialSourceLabel`。
+
+业务命令不会自动建立 XiaoE 登录态。桌面客户端需要 XiaoE 专属业务行为时，Agent 必须显式传全局参数，例如 `weaver-work-cli --runtime-agent xiaoe workflow ...`；网页端由原有环境变量规则自动识别，不要求补这个参数。`--runtime-agent` 只控制运行时行为，不携带也不选择凭据。WorkBuddy、Codex 及其他智能体使用 `auth login --base-url <url> --agent_type <agent_type>` 的浏览器 OAuth 流程。
 
 无法使用浏览器回调时，可以用 `auth set` 直接写入浏览器中复制到的
 `ETEAMSID`。命令会调用 `teamsCheck` 解析当前用户、租户和组织信息，并写入

package/node_modules/@napi-rs/keyring/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 N-API for Rust
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@napi-rs/keyring/README.md

@@ -0,0 +1,19 @@
+# `@napi-rs/keyring`
+
+![https://github.com/Brooooooklyn/keyring-node/actions](https://github.com/Brooooooklyn/keyring-node/workflows/CI/badge.svg)
+[![install size](https://packagephobia.com/badge?p=@napi-rs/keyring)](https://packagephobia.com/result?p=@napi-rs/keyring)
+[![Downloads](https://img.shields.io/npm/dm/@napi-rs/keyring.svg?sanitize=true)](https://npmcharts.com/compare/@napi-rs/keyring?minimal=true)
+
+> https://github.com/hwchen/keyring-rs Node.js binding via https://napi.rs
+
+# Usage
+
+```js
+import { Entry } from '@napi-rs/keyring'
+
+const entry = new Entry('my_service', 'my_name')
+entry.setPassword('topS3cr3tP4$$w0rd')
+const password = entry.getPassword()
+console.log('My password is ', password)
+entry.deletePassword()
+```

package/node_modules/@napi-rs/keyring/index.d.ts

@@ -0,0 +1,166 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+export declare class AsyncEntry {
+  /**
+   * Create an entry for the given service and username.
+   *
+   * The default credential builder is used.
+   */
+  constructor(service: string, username: string)
+  /**
+   * Create an entry for the given target, service, and username.
+   *
+   * The default credential builder is used.
+   */
+  static withTarget(target: string, service: string, username: string): AsyncEntry
+  /**
+   * Set the password for this entry.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  setPassword(password: string, signal?: AbortSignal | undefined | null): Promise<void>
+  /**
+   * Set the secret for this entry.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  setSecret(secret: Uint8Array, signal?: AbortSignal | undefined | null): Promise<void>
+  /**
+   * Retrieve the password saved for this entry.
+   *
+   * Returns a [NoEntry](Error::NoEntry) error if there isn't one.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  getPassword(signal?: AbortSignal | undefined | null): Promise<string | undefined>
+  /**
+   * Retrieve the secret saved for this entry.
+   *
+   * Returns a [NoEntry](Error::NoEntry) error if there isn't one.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  getSecret(signal?: AbortSignal | undefined | null): Promise<Uint8Array | undefined>
+  /**
+   * Delete the underlying credential for this entry.
+   *
+   * Returns a [NoEntry](Error::NoEntry) error if there isn't one.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   *
+   * Note: This does _not_ affect the lifetime of the [Entry]
+   * structure, which is controlled by Rust.  It only
+   * affects the underlying credential store.
+   */
+  deleteCredential(signal?: AbortSignal | undefined | null): Promise<boolean>
+  /** Alias for `deleteCredential` */
+  deletePassword(signal?: AbortSignal | undefined | null): Promise<unknown>
+}
+
+export declare class Entry {
+  /**
+   * Create an entry for the given service and username.
+   *
+   * The default credential builder is used.
+   */
+  constructor(service: string, username: string)
+  /**
+   * Create an entry for the given target, service, and username.
+   *
+   * The default credential builder is used.
+   */
+  static withTarget(target: string, service: string, username: string): Entry
+  /**
+   * Set the password for this entry.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  setPassword(password: string): void
+  /**
+   * Set the secret for this entry.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  setSecret(secret: Uint8Array): void
+  /**
+   * Retrieve the password saved for this entry.
+   *
+   * Returns a [NoEntry](Error::NoEntry) error if there isn't one.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  getPassword(): string | null
+  /**
+   * Retrieve the secret saved for this entry.
+   *
+   * Returns a [NoEntry](Error::NoEntry) error if there isn't one.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   */
+  getSecret(): Array<number> | null
+  /**
+   * Delete the underlying credential for this entry.
+   *
+   * Returns a [NoEntry](Error::NoEntry) error if there isn't one.
+   *
+   * Can return an [Ambiguous](Error::Ambiguous) error
+   * if there is more than one platform credential
+   * that matches this entry.  This can only happen
+   * on some platforms, and then only if a third-party
+   * application wrote the ambiguous credential.
+   *
+   * Note: This does _not_ affect the lifetime of the [Entry]
+   * structure, which is controlled by Rust.  It only
+   * affects the underlying credential store.
+   */
+  deleteCredential(): boolean
+  /** Alias for `deleteCredential` */
+  deletePassword(): boolean
+}
+
+export interface Credential {
+  account: string
+  password: string
+}
+
+/** find credentials by service name */
+export declare function findCredentials(service: string, target?: string | undefined | null): Array<Credential>
+
+/** find credentials by service name */
+export declare function findCredentialsAsync(service: string, target?: string | undefined | null, signal?: AbortSignal | undefined | null): Promise<Array<Credential>>