weaver-work-cli 0.1.25 → 0.1.26

package/README.md

@@ -211,41 +211,41 @@ weaver-work-cli auth login --base-url "https://weapp.xxx.cn"
 weaver-work-cli auth oidc --base-url "https://weapp.xxx.cn"
 ```
 
-只有当前智能体身份明确为 XiaoE 时，`auth xiaoe` 和未显式指定认证来源的业务命令才会优先使用平台注入的
-`XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 换取 ETEAMSID：其中 `XIAOE_DOMAIN` 是
-XiaoE/erpa 换票服务地址，不是 E10 登录地址。CLI 的 Node 实现会直接调用与
-`xiaoe_env.py` / `tokens.py` 相同的换票接口，并校验业务码和 `data.eteamId`；它保留
-系统 CA 校验，且只允许同源重定向或同主机 HTTP→HTTPS 升级。平台凭证不可用时，
-CLI 会先在内部调用 npm 包自带的 `scripts/xiaoe_env.py` 兼容路径，再按顺序尝试
-宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端当前会话
-（优先读取宿主注入的 `XIAOE_USER_SETTINGS_PATH`，其次查找
-`XIAOE_ROBOT_DATA_ROOT` / `XIAOE_ROBOT_ROOT`，最后回退
-`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。只要会话文件中的
-`session_id` 与 `erpa` 有效，Node 路径即可直接换票，不要求宿主存在 `tokens.py`。
-`xiaoe_env.py` 由 CLI 独占执行并解析，不放进 shared Skill，也不把 stdout 凭证暴露给
-Agent；Skill 只负责调用 `weaver-work-cli auth xiaoe`。CLI 自带脚本仅依赖 Python
-标准库，仍保持 TLS 证书校验，不会采用关闭证书校验的回退。
-
-XiaoE 桌面客户端不一定注入上述 Token 对；它会注入 `XIAOE_DATA_ROOT`、
-`XIAOE_ROBOT_DATA_ROOT`、`XIAOE_USER_SETTINGS_PATH`、`XIAOE_ROBOT_ROOT` 等精确的
-运行时路径标记，CLI 也把这些标记识别为当前 XiaoE 桌面宿主。普通 `XIAOE_SKILL_*`、
-`WEAVER_XIAOE_*` 配置或仅在磁盘上发现客户端文件仍不构成宿主身份。
-
-E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 →
-当前 profile → `https://www.e-cology.com.cn`”解析，绝不会把 `XIAOE_DOMAIN`
-当作 E10 地址。匹配成功时直接保存登录态，并固定使用 `agentType=XiaoE`。业务命令
-在已确认的 XiaoE 智能体环境中且未显式指定 `--auth` / `--profile` 时，也会自动优先尝试 XiaoE 统一登录。
-`auth xiaoe` 失败后仅在 macOS/Windows 桌面宿主自动降级浏览器 OAuth；Web/Linux
-环境会返回结构化的 `authentication/xiaoe_web_credential_unavailable` 错误，不再
-启动无法回调的 localhost 浏览器登录。确需浏览器授权时，应在可接收本地回调的宿主
-显式运行 `auth login`。也可以显式使用：
+XiaoE 环境保留两种识别入口：桌面客户端由 Agent 根据宿主/任务的明确上下文判断，并在
+业务命令上传 `--runtime-agent xiaoe`；网页端沿用原有环境变量规则，成对的
+`XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 会被识别为 XiaoE。判定为 XiaoE 后，Agent 显式执行：
 
 ```text
 weaver-work-cli auth xiaoe
 ```
 
-`auth login` / `auth oidc` 始终是纯浏览器 OAuth 入口。本机存在 `xiaoeUserData/tokens.py`、XiaoE 客户端目录、`XIAOE_SKILL_*` 或 `WEAVER_XIAOE_*` 配置，都不能单独证明当前智能体是 XiaoE，也不会让 WorkBuddy、Codex 或其他智能体切换到 XiaoE 登录。
-`auth xiaoe` 会先输出不含凭证的 preflight 摘要（`hostDetected`、`attempted`、`tokenScriptDetected`、`clientSettingsDetected`、`baseUrl`）；命中 `tokens.py` 或内置 Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续 `auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings` 表示未依赖 `tokens.py`，由 Node 直接换票。
+`auth xiaoe` 本身就是认证方式的显式选择。`hasXiaoEEnv` 通过桌面端显式参数或网页端原有
+环境变量规则判断；工作目录、客户端文件或历史登录仍不作为依据。CLI 按顺序消费平台凭据、CLI 自带兼容脚本、宿主 `tokens.py`、
+桌面 XiaoE 客户端会话和 `WEAVER_XIAOE_*` 映射。`XIAOE_DOMAIN` 是 XiaoE/erpa 换票
+服务地址，不是 E10 地址。E10 目标按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*`
+E10 配置/映射 → 当前 profile → `https://www.e-cology.com.cn`”解析。
+
+统一登录失败时，所有操作系统都返回结构化的
+`authentication/xiaoe_credential_unavailable`，不会自动打开浏览器或降级到
+`auth login`。确需浏览器授权时，调用方必须另行显式执行 `auth login`。
+
+业务命令不会自动建立 XiaoE 登录态。桌面客户端需要 XiaoE 专属业务行为时，把全局参数
+放在业务子命令之前，例如：
+
+```text
+weaver-work-cli --runtime-agent xiaoe workflow ...
+```
+
+网页端不要求补这个参数，仍由环境变量规则识别。`--runtime-agent` 只表示当前运行时类型，
+不携带也不选择凭据。`auth login` / `auth oidc`
+始终是纯浏览器 OAuth 入口，不会读取 XiaoE 凭据。
+
+`auth xiaoe` 会先输出不含凭证的 preflight 摘要，显示 `authMode=xiaoe`、
+`credentialSourceDetected`、`attempted` 及各凭据源检测结果；命中 `tokens.py` 或内置
+Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续
+`auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、
+`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings`
+表示未依赖 `tokens.py`，由 Node 直接换票。
 
 默认本地回调地址为 `http://127.0.0.1:19800/callback`。如果端口被占用：
 

package/dist/cmd/root.js

@@ -29,6 +29,7 @@ export function createProgram() {
         .option('--config <path>', 'use a custom weaver-work-cli config file')
         .option('--auth <path>', 'use a specific E10 auth file')
         .option('--profile <name>', 'use a specific E10 profile')
+        .option('--runtime-agent <name>', 'identify the current agent runtime (for example: xiaoe)')
         .option('--is-connector [value]', 'run as the WorkBuddy connector: use the fixed E10 profile managed by the connector')
         .option('--base-url <url>', 'override E10 base URL')
         .option('--passport-url <url>', 'override E10 passport URL');

package/dist/core/runtime-agent.js

@@ -0,0 +1,19 @@
+const XIAOE_RUNTIME_AGENT_ALIASES = new Set([
+    'xiaoe',
+    'xiaoeclient',
+    '小e',
+    '小e客户端',
+    '智能小e',
+    '智能小e客户端',
+]);
+export function normalizeRuntimeAgent(value) {
+    if (typeof value !== 'string')
+        return '';
+    return value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
+}
+export function isXiaoERuntimeAgent(value) {
+    return XIAOE_RUNTIME_AGENT_ALIASES.has(normalizeRuntimeAgent(value));
+}
+export function isXiaoERuntime(options) {
+    return isXiaoERuntimeAgent(options?.runtimeAgent);
+}

package/dist/internal/e10/auth/commands.js

@@ -5,8 +5,8 @@ import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
-import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEClientCredential, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
-export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, shouldUseXiaoEBrowserFallback, } from './xiaoe.js';
+import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, inspectXiaoEUnifiedLoginSources, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
+export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, hasXiaoEUnifiedLoginSource, inspectXiaoEUnifiedLoginSources, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
 const EXPLICIT_AGENT_TYPE_ENV_KEYS = [
     'WORKBUDDY_AGENT_TYPE',
@@ -480,13 +480,16 @@ async function oidcExchange(code, redirectUri, baseUrl, tenantKeyFallback, agent
         version,
     };
 }
-function xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser) {
+function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
     return [
-        willOpenBrowser
-            ? '未获取到可用的 XiaoE 统一登录信息，准备降级打开网页登录。'
-            : '未获取到可用的 XiaoE 统一登录信息；当前 Web/Linux 环境不支持本机浏览器回调，已停止自动降级。',
+        attempted
+            ? 'XiaoE 统一登录已尝试，但未获取到可用会话。'
+            : '未检测到可用的 XiaoE 统一登录凭据源，本次未尝试统一登录。',
+        '`auth xiaoe` 不会降级到浏览器 OAuth。',
         baseUrl ? `当前 E10 baseUrl: ${baseUrl}。` : '未从 XiaoE 凭证中解析到 E10 baseUrl。',
-        'CLI 已依次尝试平台注入凭证的 Node 换票、CLI 内置 xiaoe_env.py 兼容换票、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。',
+        attempted
+            ? 'CLI 已依次尝试平台注入凭证的 Node 换票、CLI 内置 xiaoe_env.py 兼容换票、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。'
+            : 'CLI 已检查平台注入凭证、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。',
         'CLI 会优先使用 XiaoE 客户端内置 Python 执行 tokens.py；自动发现不可用时，可用 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON 指定兼容解释器。',
     ].join(' ');
 }
@@ -496,30 +499,49 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     const profileFromGlobal = globalOptions.profile;
     const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
     const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
-    const xiaoEHostDetected = hasXiaoEEnv(ctx.env);
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoEHostDetected;
-    const baseUrl = useXiaoELogin
-        ? resolveXiaoEPreferredBaseUrl({
-            explicitBaseUrl,
-            profileBaseUrl: cfg.baseUrl,
+    const preferredXiaoEBaseUrl = resolveXiaoEPreferredBaseUrl({
+        explicitBaseUrl,
+        profileBaseUrl: cfg.baseUrl,
+        env: ctx.env,
+    });
+    const xiaoESources = behavior.tryXiaoEUnifiedLogin === true
+        ? inspectXiaoEUnifiedLoginSources({
             env: ctx.env,
+            baseUrl: preferredXiaoEBaseUrl,
+            profileBaseUrl: cfg.baseUrl,
+            allowTokenScript: behavior.allowXiaoETokenScript === true,
         })
+        : {
+            platformCredential: false,
+            tokenScript: false,
+            clientCredential: false,
+            environmentCredential: false,
+            any: false,
+        };
+    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
+    const baseUrl = behavior.tryXiaoEUnifiedLogin
+        ? preferredXiaoEBaseUrl
         : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
     const explicitAgentType = optionString(commandOpts, 'agentType', 'agent_type');
-    const agentType = resolveAgentType(commandOpts, ctx.env);
+    const agentType = useXiaoELogin
+        ? optionString(commandOpts, 'agentType', 'agent_type') || XIAOE_AGENT_TYPE
+        : resolveAgentType(commandOpts, ctx.env);
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
     if (behavior.tryXiaoEUnifiedLogin) {
         ctx.logger.info([
             'XiaoE unified login preflight:',
-            `hostDetected=${String(xiaoEHostDetected)}`,
+            'authMode=xiaoe',
+            `credentialSourceDetected=${String(xiaoESources.any)}`,
             `attempted=${String(useXiaoELogin)}`,
-            `tokenScriptDetected=${String(hasXiaoETokenScript(ctx.env))}`,
-            `clientSettingsDetected=${String(hasXiaoEClientCredential(ctx.env))}`,
+            `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+            `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+            `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+            `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
             `baseUrl=${baseUrl || '(unresolved)'}`,
         ].join(' '));
     }
@@ -528,11 +550,9 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         if (xiaoEResult)
             return xiaoEResult;
     }
-    const willOpenBrowser = !useXiaoELogin
-        || behavior.browserFallback !== 'desktop-only'
-        || shouldUseXiaoEBrowserFallback();
-    if (useXiaoELogin && behavior.explainXiaoEFallback) {
-        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser));
+    const willOpenBrowser = behavior.browserFallback !== 'never';
+    if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
+        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
     }
     if (!willOpenBrowser) {
         throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
@@ -714,15 +734,15 @@ function formatWhoami(title, data) {
     ].join('\n');
 }
 function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
-    auth.command(name)
+    const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
         .option('--tenant-key <key>', 'Tenant key fallback after login')
         .option('--port <n>', 'Local OAuth callback port', '19800')
         .option('--agent_type <value>', 'Agent type sent to E10 authorize endpoint')
         .option('--agent-type <value>', 'Alias of --agent_type')
-        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page')
-        .action(action(async (ctx, options) => {
+        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
+    command.action(action(async (ctx, options) => {
         const result = await runBrowserLogin(ctx, options, behavior);
         ctx.output.write(result, { text: formatLoginResult(result) });
     }));
@@ -808,11 +828,11 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
-    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Try XiaoE unified login and explain before browser OAuth fallback', {
+    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Use XiaoE unified login without browser OAuth fallback', {
         tryXiaoEUnifiedLogin: true,
         allowXiaoETokenScript: true,
         explainXiaoEFallback: true,
-        browserFallback: 'desktop-only',
+        browserFallback: 'never',
     });
     auth.command('logout')
         .alias('clear')

package/dist/internal/e10/auth/xiaoe.js

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { CliError, ExitCode } from '../../../core/errors.js';
+import { isXiaoERuntime, isXiaoERuntimeAgent } from '../../../core/runtime-agent.js';
 import { buildE10CookieHeader, E10AuthSession, extractRawSetCookie, extractSessionTicket, profileNameFromUrl, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
 export const DEFAULT_E10_BASE_URL = 'https://www.e-cology.com.cn';
 export const XIAOE_AGENT_TYPE = 'XiaoE';
@@ -52,12 +53,6 @@ const XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS = [
     'XIAOE_ROBOT_DATA_ROOT',
     'XIAOE_ROBOT_ROOT',
 ];
-const XIAOE_DESKTOP_HOST_ENV_KEYS = [
-    'XIAOE_DATA_ROOT',
-    'XIAOE_ROBOT_DATA_ROOT',
-    'XIAOE_USER_SETTINGS_PATH',
-    'XIAOE_ROBOT_ROOT',
-];
 export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/extend/eteamId';
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
@@ -70,36 +65,29 @@ function envString(env, ...keys) {
     }
     return '';
 }
-export function hasXiaoEEnv(env = process.env) {
-    const isXiaoEAgentType = (value) => {
-        const normalized = value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
-        return ['xiaoe', 'xiaoeclient', '小e', '智能小e'].includes(normalized);
-    };
-    // A host-specific identity is authoritative. Generic WORKBUDDY_*/CODEX_*
-    // variables are only framework markers and can also be present when XiaoE
-    // launches the CLI through a shared agent runtime.
-    const explicitHostAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE');
-    if (explicitHostAgentType)
-        return isXiaoEAgentType(explicitHostAgentType);
-    // XiaoE injects this pair into the command process for the current run. A
-    // tokens.py path, client installation, XIAOE_SKILL_* variable, or
-    // WEAVER_XIAOE_* configuration alone is credential availability, not proof
-    // that the current agent is XiaoE.
-    if (hasXiaoEPlatformCredential(env))
+/**
+ * Identifies the XiaoE runtime without inspecting credential artifacts:
+ * desktop callers may pass --runtime-agent, and any injected XIAOE_* variable
+ * is treated as XiaoE host evidence.
+ */
+export function hasXiaoEEnv(env = process.env, options = {}) {
+    if (isXiaoERuntime(options))
         return true;
-    // The desktop XiaoE client injects these exact runtime paths even when it
-    // does not inject the web/sandbox XIAOE_USER_TOKEN + XIAOE_DOMAIN pair.
-    // They identify the current command host; unrelated XIAOE_SKILL_* variables
-    // and merely discovering local XiaoE files still do not.
-    if (XIAOE_DESKTOP_HOST_ENV_KEYS.some((key) => Boolean(envString(env, key))))
+    // XiaoE reserves this prefix for host-injected runtime variables. Presence
+    // of any matching key is sufficient; the value may legitimately be empty.
+    if (Object.keys(env).some((key) => key.startsWith('XIAOE_')))
         return true;
-    // Current-host framework markers win over WEAVER_AGENT_TYPE, which can be
-    // inherited from a previously saved E10 profile by `weaver-work-cli run`.
+    // An explicitly named host remains authoritative over credential signals.
+    const explicitHostAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE');
+    if (explicitHostAgentType)
+        return isXiaoERuntimeAgent(explicitHostAgentType);
+    // Generic framework markers can coexist with stale profile metadata, so they
+    // take precedence over WEAVER_AGENT_TYPE when no XIAOE_* variable is present.
     if (Object.keys(env).some((key) => key.startsWith('WORKBUDDY_') || key.startsWith('CODEX_'))) {
         return false;
     }
     const explicitAgentType = envString(env, 'WEAVER_AGENT_TYPE');
-    return explicitAgentType ? isXiaoEAgentType(explicitAgentType) : false;
+    return explicitAgentType ? isXiaoERuntimeAgent(explicitAgentType) : false;
 }
 export function describeXiaoECredentialSource(source) {
     // Step 1 is the platform-injected credential (XIAOE_USER_TOKEN + XIAOE_DOMAIN):
@@ -311,7 +299,7 @@ export function resolveXiaoEDefaultBaseUrl(env = process.env) {
     const configured = resolveXiaoEConfiguredBaseUrl(env);
     if (configured)
         return configured;
-    return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
+    return DEFAULT_E10_BASE_URL;
 }
 function uniqueStrings(values) {
     const seen = new Set();
@@ -350,10 +338,12 @@ export function xiaoEBundledEnvScriptPath() {
     const scriptPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../../../scripts/xiaoe_env.py');
     return existsSync(scriptPath) ? scriptPath : '';
 }
-export function hasXiaoETokenScript(env = process.env) {
+export function hasXiaoETokenScript(env = process.env, allowLocalDiscovery = true) {
     const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY, XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY);
     if (explicit)
         return existsSync(explicit);
+    if (!allowLocalDiscovery)
+        return false;
     const scriptPath = xiaoETokenScriptPath(env);
     return Boolean(scriptPath && existsSync(scriptPath));
 }
@@ -620,7 +610,7 @@ function sortedXiaoEClientSettingsFiles(root) {
     const files = listXiaoEClientSettingsFiles(root);
     return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
 }
-function xiaoEClientSettingsCandidateFiles(env) {
+function xiaoEClientSettingsCandidateFiles(env, allowLocalDiscovery = true) {
     const candidates = [];
     const explicitSettingsPath = envString(env, XIAOE_USER_SETTINGS_PATH_ENV_KEY);
     if (isFile(explicitSettingsPath))
@@ -629,7 +619,9 @@ function xiaoEClientSettingsCandidateFiles(env) {
         const injectedRoot = envString(env, key);
         candidates.push(...sortedXiaoEClientSettingsFiles(injectedRoot));
     }
-    candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+    if (allowLocalDiscovery) {
+        candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+    }
     return uniqueStrings(candidates);
 }
 export function findXiaoEClientSettingsFile(env = process.env) {
@@ -674,8 +666,38 @@ export function readXiaoEClientCredential(env = process.env) {
     }
     return null;
 }
-export function hasXiaoEClientCredential(env = process.env) {
-    return Boolean(findXiaoEClientSettingsFile(env));
+export function hasXiaoEClientCredential(env = process.env, allowLocalDiscovery = true) {
+    return Boolean(xiaoEClientSettingsCandidateFiles(env, allowLocalDiscovery)[0]);
+}
+/**
+ * Reports usable unified-login credential sources independently from host
+ * identity. Installing the XiaoE client is not proof that the current process
+ * was launched by XiaoE, but an explicit `auth xiaoe` command may still consume
+ * any credential source that is available.
+ */
+export function inspectXiaoEUnifiedLoginSources(options = {}) {
+    const env = options.env || process.env;
+    const baseUrl = resolveXiaoEPreferredBaseUrl({
+        explicitBaseUrl: options.baseUrl,
+        profileBaseUrl: options.profileBaseUrl,
+        env,
+    });
+    const platformCredential = hasXiaoEPlatformCredential(env);
+    const allowLocalDiscovery = options.allowLocalDiscovery !== false;
+    const tokenScript = options.allowTokenScript !== false
+        && hasXiaoETokenScript(env, allowLocalDiscovery);
+    const clientCredential = hasXiaoEClientCredential(env, allowLocalDiscovery);
+    const environmentCredential = Boolean(baseUrl && resolveXiaoEUnifiedLoginCredential(baseUrl, env));
+    return {
+        platformCredential,
+        tokenScript,
+        clientCredential,
+        environmentCredential,
+        any: platformCredential || tokenScript || clientCredential || environmentCredential,
+    };
+}
+export function hasXiaoEUnifiedLoginSource(options = {}) {
+    return inspectXiaoEUnifiedLoginSources(options).any;
 }
 async function fetchXiaoEClientEteamId(credential, domain) {
     const controller = new AbortController();
@@ -769,22 +791,19 @@ export function resolveXiaoEPreferredBaseUrl(options) {
     const profileBaseUrl = normalizeUrl(options.profileBaseUrl || '');
     if (profileBaseUrl)
         return profileBaseUrl;
-    return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
-}
-export function shouldUseXiaoEBrowserFallback(platform = process.platform) {
-    return platform === 'darwin' || platform === 'win32';
+    return DEFAULT_E10_BASE_URL;
 }
 export function createXiaoEUnifiedLoginUnavailableError(baseUrl = '') {
     const target = normalizeUrl(baseUrl);
     const message = [
         'XiaoE unified login did not return a usable E10 session.',
         target ? `Resolved E10 baseUrl: ${target}.` : 'No E10 baseUrl could be resolved.',
-        'This web/Linux host cannot complete a localhost browser OAuth callback.',
+        'The auth xiaoe command never falls back to browser OAuth.',
         'Refresh the XiaoE web session or restore host credential injection before retrying.',
     ].join(' ');
     return Object.assign(new CliError(message, ExitCode.AuthError), {
         type: 'authentication',
-        subtype: 'xiaoe_web_credential_unavailable',
+        subtype: 'xiaoe_credential_unavailable',
         retryable: false,
         stage: 'xiaoe_unified_login',
     });
@@ -865,7 +884,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
         profileBaseUrl: options.profileBaseUrl,
         env,
     });
-    const mayUseTokenScript = options.allowTokenScript || hasXiaoEEnv(env);
+    const mayUseTokenScript = options.allowTokenScript === true;
     if (!baseUrl && !mayUseTokenScript)
         return null;
     let credential = null;

package/dist/internal/e10/context.js

@@ -1,41 +1,19 @@
 import { CliError, ExitCode } from '../../core/errors.js';
-import { E10AuthSession, getActiveProfile, readProfileConfig } from './auth/session.js';
-import { createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin, } from './auth/xiaoe.js';
+import { E10AuthSession } from './auth/session.js';
+import { hasXiaoEEnv } from './auth/xiaoe.js';
 import { E10ApiClient } from './client.js';
-function shouldPreferXiaoEUnifiedLogin(options, env) {
-    return !options.auth && !options.profile && hasXiaoEEnv(env);
-}
 export async function getE10Session(ctx, load = {}) {
     const options = ctx.getGlobalOptions();
-    if (shouldPreferXiaoEUnifiedLogin(options, ctx.env)) {
-        const profileBaseUrl = readProfileConfig(getActiveProfile()).baseUrl;
-        const xiaoELogin = await tryXiaoEUnifiedLogin({
-            env: ctx.env,
-            baseUrl: options.baseUrl,
-            profileBaseUrl,
-            allowBundledEnvScript: true,
-            allowTokenScript: true,
-            logger: ctx.logger,
-        });
-        if (xiaoELogin)
-            return xiaoELogin.session;
-        return null;
-    }
     return E10AuthSession.fromOptions(options, ctx.cwd, load);
 }
 export async function requireE10Session(ctx, load = {}) {
     const session = await getE10Session(ctx, load);
     if (!session) {
         const options = ctx.getGlobalOptions();
-        if (hasXiaoEEnv(ctx.env) && !shouldUseXiaoEBrowserFallback()) {
-            const baseUrl = resolveXiaoEPreferredBaseUrl({
-                explicitBaseUrl: options.baseUrl,
-                profileBaseUrl: readProfileConfig(getActiveProfile()).baseUrl,
-                env: ctx.env,
-            });
-            throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+        if (hasXiaoEEnv(ctx.env, options)) {
+            throw new CliError('E10 auth not found. The current runtime is XiaoE; run weaver-work-cli auth xiaoe first.', ExitCode.AuthError);
         }
-        throw new CliError('E10 auth not found. In XiaoE, run weaver-work-cli auth xiaoe first; if unified login is unavailable, ask the user for the E10 login domain (base URL), then run: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>.', ExitCode.AuthError);
+        throw new CliError('E10 auth not found. Ask the user for the E10 login domain (base URL), then run: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>.', ExitCode.AuthError);
     }
     return session;
 }

package/dist/shortcuts/archive-oa/constants.js

@@ -0,0 +1,66 @@
+/**
+ * archive-oa 固定业务参数。
+ *
+ * 泛微商务合同与契约锁协作采纳是两套独立的应用/列表，参数值不同，禁止交叉混用。
+ * 来源：`source/weaver-e10-archive-oa.zip` 内 10 篇接口文档（catalog.md 登记）。
+ */
+/** 加入借阅车 / 发起借阅的单次条数上限（接口侧限制）。 */
+export const MAX_BORROW_ITEMS = 6;
+/** 发起借阅流程创建页的流程 ID（前端 `flowpage/fullCreate/<flowId>`）。 */
+export const BORROW_FLOW_ID = '100003460000002090';
+/** 借阅车记录 `fb` 即界面「分部」列：0 = 泛微、1 = 契约锁。 */
+export const FLOW_FB_LABELS = {
+    '0': '泛微',
+    '1': '契约锁',
+};
+/** 档案系统：按合同号定位档案的自定义接口标识。 */
+export const ARCHIVE_LOCATE_INTERFACE_PK = 'getArcIdByContractNo';
+export const ARCHIVE_LOCATE_PATH = `/api/ebuilder/form/formdata/v2/getFormDataList/${ARCHIVE_LOCATE_INTERFACE_PK}`;
+/** 泛微商务合同（案例台账）。 */
+export const WEAVER_CONTRACT = {
+    source: 'weaver',
+    passId: '850741972510941185',
+    listId: '850741985437786120',
+    filterListId: '850741985437786120',
+    cusMenuId: '5408862605522555751',
+    urlPageTitle: '5rOb5b6u5qGI5L6L',
+};
+export const WEAVER_BORROW_CAR = {
+    source: 'weaver',
+    passId: '882393476189437952',
+    listId: '882393480417296390',
+    cusMenuId: '5408862605522555751',
+    urlPageTitle: '5rOb5b6u5qGI5L6L',
+};
+export const WEAVER_ESB_ADD = {
+    source: 'weaver',
+    esbActionIds: '882395911377174530',
+    objId: '850741972510941185',
+    listId: '850741985437786120',
+    successText: '【加入借阅车】执行成功！',
+};
+/** 契约锁协作采纳（用户常称「案例」）。 */
+export const QYS_CONTRACT = {
+    source: 'qys',
+    passId: '850742853046345728',
+    listId: '1190611964371984450',
+    cusMenuId: '5408862605522555752',
+    urlPageTitle: '5aWR57qm6ZSB5qGI5L6L',
+};
+export const QYS_BORROW_CAR = {
+    source: 'qys',
+    passId: '882393476189437952',
+    listId: '883819516961857839',
+    cusMenuId: '5408862605522555752',
+    urlPageTitle: '5aWR57qm6ZSB5qGI5L6L',
+};
+export const QYS_ESB_ADD = {
+    source: 'qys',
+    esbActionIds: '892706856573648911',
+    objId: '850742853046345728',
+    listId: '1190611964371984450',
+    successText: '【契约锁加入借阅车】执行成功！',
+};
+/** 契约锁默认过滤「处理进度 = 已归档」。 */
+export const QYS_DEFAULT_ARCHIVED_FIELD = 'cljd';
+export const QYS_DEFAULT_ARCHIVED_VALUE = '已归档';

package/dist/shortcuts/archive-oa/continuation.js

@@ -0,0 +1,70 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { archiveOaValidationError } from './errors.js';
+function stateRoot(ctx) {
+    const configured = ctx?.config?.path();
+    if (configured)
+        return resolve(configured, '..');
+    return process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve(homedir(), '.weaver-work-cli');
+}
+async function loadKey(ctx) {
+    const keysDir = resolve(stateRoot(ctx), 'keys');
+    const filename = resolve(keysDir, 'archive-oa-continuation.key');
+    await mkdir(keysDir, { recursive: true, mode: 0o700 });
+    if (existsSync(filename))
+        return readFile(filename);
+    const key = randomBytes(32);
+    try {
+        await writeFile(filename, key, { flag: 'wx', mode: 0o600 });
+        if (process.platform !== 'win32')
+            await chmod(filename, 0o600).catch(() => undefined);
+        return key;
+    }
+    catch {
+        return readFile(filename);
+    }
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function signature(payload, key) {
+    return createHmac('sha256', key).update(payload).digest('base64url');
+}
+export function createArchiveOaContinuationSigner(ctx) {
+    return {
+        async issue(payload, ttlMs = 10 * 60_000) {
+            const issuedAt = Date.now();
+            const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
+            const sig = signature(body, await loadKey(ctx));
+            return `${body}.${sig}`;
+        },
+        async verify(token, expectedOperation) {
+            if (typeof token !== 'string' || !token.includes('.')) {
+                throw archiveOaValidationError('continuation_invalid', 'continuation 无效');
+            }
+            const [body, provided] = token.split('.');
+            const expected = signature(body, await loadKey(ctx));
+            const valid = provided.length === expected.length
+                && timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+            if (!valid)
+                throw archiveOaValidationError('continuation_invalid', 'continuation 签名校验失败');
+            let value;
+            try {
+                value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+            }
+            catch {
+                throw archiveOaValidationError('continuation_invalid', 'continuation 内容无法解析');
+            }
+            if (value.operation !== expectedOperation) {
+                throw archiveOaValidationError('continuation_mismatch', 'continuation 不属于当前操作');
+            }
+            if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt < Date.now()) {
+                throw archiveOaValidationError('continuation_expired', 'continuation 已过期');
+            }
+            return value;
+        },
+    };
+}