weaver-work-cli 0.1.25 → 0.1.28

package/README.md

@@ -211,41 +211,46 @@ weaver-work-cli auth login --base-url "https://weapp.xxx.cn"
 weaver-work-cli auth oidc --base-url "https://weapp.xxx.cn"
 ```
 
-只有当前智能体身份明确为 XiaoE 时，`auth xiaoe` 和未显式指定认证来源的业务命令才会优先使用平台注入的
-`XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 换取 ETEAMSID：其中 `XIAOE_DOMAIN` 是
-XiaoE/erpa 换票服务地址，不是 E10 登录地址。CLI 的 Node 实现会直接调用与
-`xiaoe_env.py` / `tokens.py` 相同的换票接口，并校验业务码和 `data.eteamId`；它保留
-系统 CA 校验，且只允许同源重定向或同主机 HTTP→HTTPS 升级。平台凭证不可用时，
-CLI 会先在内部调用 npm 包自带的 `scripts/xiaoe_env.py` 兼容路径，再按顺序尝试
-宿主 `xiaoeUserData/tokens.py`、桌面 XiaoE 客户端当前会话
-（优先读取宿主注入的 `XIAOE_USER_SETTINGS_PATH`，其次查找
-`XIAOE_ROBOT_DATA_ROOT` / `XIAOE_ROBOT_ROOT`，最后回退
-`XiaoE/Robots/<id>/user_settings.json`）和 `WEAVER_XIAOE_*` 环境映射。只要会话文件中的
-`session_id` 与 `erpa` 有效，Node 路径即可直接换票，不要求宿主存在 `tokens.py`。
-`xiaoe_env.py` 由 CLI 独占执行并解析，不放进 shared Skill，也不把 stdout 凭证暴露给
-Agent；Skill 只负责调用 `weaver-work-cli auth xiaoe`。CLI 自带脚本仅依赖 Python
-标准库，仍保持 TLS 证书校验，不会采用关闭证书校验的回退。
-
-XiaoE 桌面客户端不一定注入上述 Token 对；它会注入 `XIAOE_DATA_ROOT`、
-`XIAOE_ROBOT_DATA_ROOT`、`XIAOE_USER_SETTINGS_PATH`、`XIAOE_ROBOT_ROOT` 等精确的
-运行时路径标记，CLI 也把这些标记识别为当前 XiaoE 桌面宿主。普通 `XIAOE_SKILL_*`、
-`WEAVER_XIAOE_*` 配置或仅在磁盘上发现客户端文件仍不构成宿主身份。
-
-E10 目标地址按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*` E10 配置/映射 →
-当前 profile → `https://www.e-cology.com.cn`”解析，绝不会把 `XIAOE_DOMAIN`
-当作 E10 地址。匹配成功时直接保存登录态，并固定使用 `agentType=XiaoE`。业务命令
-在已确认的 XiaoE 智能体环境中且未显式指定 `--auth` / `--profile` 时，也会自动优先尝试 XiaoE 统一登录。
-`auth xiaoe` 失败后仅在 macOS/Windows 桌面宿主自动降级浏览器 OAuth；Web/Linux
-环境会返回结构化的 `authentication/xiaoe_web_credential_unavailable` 错误，不再
-启动无法回调的 localhost 浏览器登录。确需浏览器授权时，应在可接收本地回调的宿主
-显式运行 `auth login`。也可以显式使用：
+XiaoE 环境保留两种识别入口：桌面客户端由 Agent 根据宿主/任务的明确上下文判断，并在
+业务命令上传 `--runtime-agent xiaoe`；网页端沿用原有环境变量规则，成对的
+`XIAOE_USER_TOKEN` + `XIAOE_DOMAIN` 会被识别为 XiaoE。判定为 XiaoE 后，Agent 显式执行：
 
 ```text
 weaver-work-cli auth xiaoe
 ```
 
-`auth login` / `auth oidc` 始终是纯浏览器 OAuth 入口。本机存在 `xiaoeUserData/tokens.py`、XiaoE 客户端目录、`XIAOE_SKILL_*` 或 `WEAVER_XIAOE_*` 配置，都不能单独证明当前智能体是 XiaoE，也不会让 WorkBuddy、Codex 或其他智能体切换到 XiaoE 登录。
-`auth xiaoe` 会先输出不含凭证的 preflight 摘要（`hostDetected`、`attempted`、`tokenScriptDetected`、`clientSettingsDetected`、`baseUrl`）；命中 `tokens.py` 或内置 Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续 `auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings` 表示未依赖 `tokens.py`，由 Node 直接换票。
+`auth xiaoe` 本身就是认证方式的显式选择。`hasXiaoEEnv` 通过桌面端显式参数或网页端原有
+环境变量规则判断；工作目录、客户端文件或历史登录仍不作为依据。CLI 按顺序消费平台凭据、CLI 自带兼容脚本、宿主 `tokens.py`、
+桌面 XiaoE 客户端会话和 `WEAVER_XIAOE_*` 映射。`XIAOE_DOMAIN` 是 XiaoE/erpa 换票
+服务地址，不是 E10 地址。E10 目标按“显式 `--base-url` → 专用 `WEAVER_XIAOE_*`
+E10 配置/映射 → 当前 profile → `https://www.e-cology.com.cn`”解析。
+
+统一登录失败时，所有操作系统都返回结构化的
+`authentication/xiaoe_credential_unavailable`，不会自动打开浏览器或降级到
+`auth login`。确需浏览器授权时，调用方必须另行显式执行 `auth login`。
+
+业务命令不会在没有本地会话时主动建立 XiaoE 登录态，因此首次使用仍需显式执行
+`auth xiaoe`。已有会话在接口层被明确判定为失效（HTTP 401/302、业务码 `-2` 或登录页）时，
+公共 E10 请求运行时会静默换取一次新会话并把被拒绝的请求重放一次；这个过程不向
+stdout/stderr 输出中间“登录”步骤，并会合并同一 profile 的并发换票。流式请求、网络错误、
+`partial` / `write_uncertain` 不会重放；恢复后的地址或用户身份变化时也会停止。
+
+桌面客户端需要 XiaoE 专属业务行为时，把全局参数放在业务子命令之前，例如：
+
+```text
+weaver-work-cli --runtime-agent xiaoe workflow ...
+```
+
+网页端不要求补这个参数，仍由环境变量规则识别。`--runtime-agent` 只表示当前运行时类型，
+不携带也不选择凭据。`auth login` / `auth oidc`
+始终是纯浏览器 OAuth 入口，不会读取 XiaoE 凭据。
+
+`auth xiaoe` 会先输出不含凭证的 preflight 摘要，显示 `authMode=xiaoe`、
+`credentialSourceDetected`、`attempted` 及各凭据源检测结果；命中 `tokens.py` 或内置
+Node 客户端会话路径时还会输出明确的尝试日志。统一登录成功后，登录结果以及后续
+`auth status` 会显示 `credentialSourceStep`、`credentialSourceType`、
+`credentialSourceLabel`，可据此确认实际凭证来源；`3 / xiaoe_client / XiaoE client settings`
+表示未依赖 `tokens.py`，由 Node 直接换票。
 
 默认本地回调地址为 `http://127.0.0.1:19800/callback`。如果端口被占用：
 

package/dist/cmd/root.js

@@ -29,6 +29,7 @@ export function createProgram() {
         .option('--config <path>', 'use a custom weaver-work-cli config file')
         .option('--auth <path>', 'use a specific E10 auth file')
         .option('--profile <name>', 'use a specific E10 profile')
+        .option('--runtime-agent <name>', 'identify the current agent runtime (for example: xiaoe)')
         .option('--is-connector [value]', 'run as the WorkBuddy connector: use the fixed E10 profile managed by the connector')
         .option('--base-url <url>', 'override E10 base URL')
         .option('--passport-url <url>', 'override E10 passport URL');

package/dist/cmd/setup/index.js

@@ -69,7 +69,7 @@ export const setupCommand = {
                 : null;
             const nextActions = [];
             if (!checks.find((check) => check.name === 'e10Auth')?.ok) {
-                nextActions.push('Run: weaver-work-cli auth login --base-url <E10_BASE_URL> --agent_type <agent_type>');
+                nextActions.push('Authenticate using the method required by the current runtime, then rerun setup.');
             }
             if (!skillInstall) {
                 nextActions.push('Optional Agent setup: weaver-work-cli skills install yepiaotong');

package/dist/core/runtime-agent.js

@@ -0,0 +1,19 @@
+const XIAOE_RUNTIME_AGENT_ALIASES = new Set([
+    'xiaoe',
+    'xiaoeclient',
+    '小e',
+    '小e客户端',
+    '智能小e',
+    '智能小e客户端',
+]);
+export function normalizeRuntimeAgent(value) {
+    if (typeof value !== 'string')
+        return '';
+    return value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
+}
+export function isXiaoERuntimeAgent(value) {
+    return XIAOE_RUNTIME_AGENT_ALIASES.has(normalizeRuntimeAgent(value));
+}
+export function isXiaoERuntime(options) {
+    return isXiaoERuntimeAgent(options?.runtimeAgent);
+}

package/dist/internal/e10/auth/commands.js

@@ -5,8 +5,8 @@ import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
-import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEClientCredential, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
-export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, shouldUseXiaoEBrowserFallback, } from './xiaoe.js';
+import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, inspectXiaoEUnifiedLoginSources, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
+export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, hasXiaoEUnifiedLoginSource, inspectXiaoEUnifiedLoginSources, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
 const EXPLICIT_AGENT_TYPE_ENV_KEYS = [
     'WORKBUDDY_AGENT_TYPE',
@@ -172,12 +172,7 @@ function cookieValue(rawCookie, name) {
 }
 function formatAuthStatus(status) {
     if (!status.loggedIn) {
-        return [
-            'Not logged in.',
-            'In the XiaoE host, run: weaver-work-cli auth xiaoe',
-            'Otherwise: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>',
-            'Or:        weaver-work-cli auth set --eteamsid <id> --base-url <url> --agent_type <agent_type>',
-        ].join('\n');
+        return 'Not logged in. Select the appropriate authentication method for the current runtime before retrying.';
     }
     const lines = [
         'Logged in.',
@@ -480,13 +475,16 @@ async function oidcExchange(code, redirectUri, baseUrl, tenantKeyFallback, agent
         version,
     };
 }
-function xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser) {
+function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
     return [
-        willOpenBrowser
-            ? '未获取到可用的 XiaoE 统一登录信息，准备降级打开网页登录。'
-            : '未获取到可用的 XiaoE 统一登录信息；当前 Web/Linux 环境不支持本机浏览器回调，已停止自动降级。',
+        attempted
+            ? 'XiaoE 统一登录已尝试，但未获取到可用会话。'
+            : '未检测到可用的 XiaoE 统一登录凭据源，本次未尝试统一登录。',
+        '`auth xiaoe` 不会降级到浏览器 OAuth。',
         baseUrl ? `当前 E10 baseUrl: ${baseUrl}。` : '未从 XiaoE 凭证中解析到 E10 baseUrl。',
-        'CLI 已依次尝试平台注入凭证的 Node 换票、CLI 内置 xiaoe_env.py 兼容换票、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。',
+        attempted
+            ? 'CLI 已依次尝试平台注入凭证的 Node 换票、CLI 内置 xiaoe_env.py 兼容换票、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。'
+            : 'CLI 已检查平台注入凭证、宿主 xiaoeUserData/tokens.py、桌面 XiaoE 客户端凭证（XiaoE/Robots/*/user_settings.json）和 WEAVER_XIAOE_* 环境映射。',
         'CLI 会优先使用 XiaoE 客户端内置 Python 执行 tokens.py；自动发现不可用时，可用 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON 指定兼容解释器。',
     ].join(' ');
 }
@@ -496,30 +494,49 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     const profileFromGlobal = globalOptions.profile;
     const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
     const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
-    const xiaoEHostDetected = hasXiaoEEnv(ctx.env);
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoEHostDetected;
-    const baseUrl = useXiaoELogin
-        ? resolveXiaoEPreferredBaseUrl({
-            explicitBaseUrl,
-            profileBaseUrl: cfg.baseUrl,
+    const preferredXiaoEBaseUrl = resolveXiaoEPreferredBaseUrl({
+        explicitBaseUrl,
+        profileBaseUrl: cfg.baseUrl,
+        env: ctx.env,
+    });
+    const xiaoESources = behavior.tryXiaoEUnifiedLogin === true
+        ? inspectXiaoEUnifiedLoginSources({
             env: ctx.env,
+            baseUrl: preferredXiaoEBaseUrl,
+            profileBaseUrl: cfg.baseUrl,
+            allowTokenScript: behavior.allowXiaoETokenScript === true,
         })
+        : {
+            platformCredential: false,
+            tokenScript: false,
+            clientCredential: false,
+            environmentCredential: false,
+            any: false,
+        };
+    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
+    const baseUrl = behavior.tryXiaoEUnifiedLogin
+        ? preferredXiaoEBaseUrl
         : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
     const explicitAgentType = optionString(commandOpts, 'agentType', 'agent_type');
-    const agentType = resolveAgentType(commandOpts, ctx.env);
+    const agentType = useXiaoELogin
+        ? optionString(commandOpts, 'agentType', 'agent_type') || XIAOE_AGENT_TYPE
+        : resolveAgentType(commandOpts, ctx.env);
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
     if (behavior.tryXiaoEUnifiedLogin) {
         ctx.logger.info([
             'XiaoE unified login preflight:',
-            `hostDetected=${String(xiaoEHostDetected)}`,
+            'authMode=xiaoe',
+            `credentialSourceDetected=${String(xiaoESources.any)}`,
             `attempted=${String(useXiaoELogin)}`,
-            `tokenScriptDetected=${String(hasXiaoETokenScript(ctx.env))}`,
-            `clientSettingsDetected=${String(hasXiaoEClientCredential(ctx.env))}`,
+            `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+            `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+            `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+            `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
             `baseUrl=${baseUrl || '(unresolved)'}`,
         ].join(' '));
     }
@@ -528,11 +545,9 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         if (xiaoEResult)
             return xiaoEResult;
     }
-    const willOpenBrowser = !useXiaoELogin
-        || behavior.browserFallback !== 'desktop-only'
-        || shouldUseXiaoEBrowserFallback();
-    if (useXiaoELogin && behavior.explainXiaoEFallback) {
-        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, willOpenBrowser));
+    const willOpenBrowser = behavior.browserFallback !== 'never';
+    if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
+        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
     }
     if (!willOpenBrowser) {
         throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
@@ -714,15 +729,15 @@ function formatWhoami(title, data) {
     ].join('\n');
 }
 function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
-    auth.command(name)
+    const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
         .option('--tenant-key <key>', 'Tenant key fallback after login')
         .option('--port <n>', 'Local OAuth callback port', '19800')
         .option('--agent_type <value>', 'Agent type sent to E10 authorize endpoint')
         .option('--agent-type <value>', 'Alias of --agent_type')
-        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page')
-        .action(action(async (ctx, options) => {
+        .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
+    command.action(action(async (ctx, options) => {
         const result = await runBrowserLogin(ctx, options, behavior);
         ctx.output.write(result, { text: formatLoginResult(result) });
     }));
@@ -808,11 +823,11 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
-    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Try XiaoE unified login and explain before browser OAuth fallback', {
+    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Use XiaoE unified login without browser OAuth fallback', {
         tryXiaoEUnifiedLogin: true,
         allowXiaoETokenScript: true,
         explainXiaoEFallback: true,
-        browserFallback: 'desktop-only',
+        browserFallback: 'never',
     });
     auth.command('logout')
         .alias('clear')

package/dist/internal/e10/auth/messages.js

@@ -0,0 +1,3 @@
+export const E10_REAUTH_GUIDANCE = '请结合当前宿主环境选择合适的登录方式，恢复登录后重试原请求。';
+export const E10_AUTH_REQUIRED_MESSAGE = `E10 登录态不可用。${E10_REAUTH_GUIDANCE}`;
+export const E10_SESSION_EXPIRED_MESSAGE = `E10 登录态已失效，本次操作已停止。${E10_REAUTH_GUIDANCE}`;

package/dist/internal/e10/auth/session.js

@@ -360,6 +360,14 @@ export class E10AuthSession {
     uaHeader() {
         return this.agentType ? `AgentType=${this.agentType},IsAgent=true` : 'weaver-work-cli';
     }
+    /**
+     * Adopt a freshly authenticated session in place. Hosts cache this object for
+     * the lifetime of one command, so mutating it keeps every subsequent request
+     * on the refreshed credential without exposing or re-reading auth data.
+     */
+    replaceWith(session) {
+        this.data = { ...session.data, cookies: { ...session.data.cookies } };
+    }
     toJSON() {
         const sourceInfo = {
             ...(this.loginSource ? { loginSource: this.loginSource } : {}),

package/dist/internal/e10/auth/xiaoe.js

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { CliError, ExitCode } from '../../../core/errors.js';
+import { isXiaoERuntime, isXiaoERuntimeAgent } from '../../../core/runtime-agent.js';
 import { buildE10CookieHeader, E10AuthSession, extractRawSetCookie, extractSessionTicket, profileNameFromUrl, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
 export const DEFAULT_E10_BASE_URL = 'https://www.e-cology.com.cn';
 export const XIAOE_AGENT_TYPE = 'XiaoE';
@@ -52,12 +53,6 @@ const XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS = [
     'XIAOE_ROBOT_DATA_ROOT',
     'XIAOE_ROBOT_ROOT',
 ];
-const XIAOE_DESKTOP_HOST_ENV_KEYS = [
-    'XIAOE_DATA_ROOT',
-    'XIAOE_ROBOT_DATA_ROOT',
-    'XIAOE_USER_SETTINGS_PATH',
-    'XIAOE_ROBOT_ROOT',
-];
 export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/extend/eteamId';
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
@@ -70,36 +65,29 @@ function envString(env, ...keys) {
     }
     return '';
 }
-export function hasXiaoEEnv(env = process.env) {
-    const isXiaoEAgentType = (value) => {
-        const normalized = value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, '');
-        return ['xiaoe', 'xiaoeclient', '小e', '智能小e'].includes(normalized);
-    };
-    // A host-specific identity is authoritative. Generic WORKBUDDY_*/CODEX_*
-    // variables are only framework markers and can also be present when XiaoE
-    // launches the CLI through a shared agent runtime.
-    const explicitHostAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE');
-    if (explicitHostAgentType)
-        return isXiaoEAgentType(explicitHostAgentType);
-    // XiaoE injects this pair into the command process for the current run. A
-    // tokens.py path, client installation, XIAOE_SKILL_* variable, or
-    // WEAVER_XIAOE_* configuration alone is credential availability, not proof
-    // that the current agent is XiaoE.
-    if (hasXiaoEPlatformCredential(env))
+/**
+ * Identifies the XiaoE runtime without inspecting credential artifacts:
+ * desktop callers may pass --runtime-agent, and any injected XIAOE_* variable
+ * is treated as XiaoE host evidence.
+ */
+export function hasXiaoEEnv(env = process.env, options = {}) {
+    if (isXiaoERuntime(options))
         return true;
-    // The desktop XiaoE client injects these exact runtime paths even when it
-    // does not inject the web/sandbox XIAOE_USER_TOKEN + XIAOE_DOMAIN pair.
-    // They identify the current command host; unrelated XIAOE_SKILL_* variables
-    // and merely discovering local XiaoE files still do not.
-    if (XIAOE_DESKTOP_HOST_ENV_KEYS.some((key) => Boolean(envString(env, key))))
+    // XiaoE reserves this prefix for host-injected runtime variables. Presence
+    // of any matching key is sufficient; the value may legitimately be empty.
+    if (Object.keys(env).some((key) => key.startsWith('XIAOE_')))
         return true;
-    // Current-host framework markers win over WEAVER_AGENT_TYPE, which can be
-    // inherited from a previously saved E10 profile by `weaver-work-cli run`.
+    // An explicitly named host remains authoritative over credential signals.
+    const explicitHostAgentType = envString(env, 'WORKBUDDY_AGENT_TYPE', 'CODEX_AGENT_TYPE');
+    if (explicitHostAgentType)
+        return isXiaoERuntimeAgent(explicitHostAgentType);
+    // Generic framework markers can coexist with stale profile metadata, so they
+    // take precedence over WEAVER_AGENT_TYPE when no XIAOE_* variable is present.
     if (Object.keys(env).some((key) => key.startsWith('WORKBUDDY_') || key.startsWith('CODEX_'))) {
         return false;
     }
     const explicitAgentType = envString(env, 'WEAVER_AGENT_TYPE');
-    return explicitAgentType ? isXiaoEAgentType(explicitAgentType) : false;
+    return explicitAgentType ? isXiaoERuntimeAgent(explicitAgentType) : false;
 }
 export function describeXiaoECredentialSource(source) {
     // Step 1 is the platform-injected credential (XIAOE_USER_TOKEN + XIAOE_DOMAIN):
@@ -311,7 +299,7 @@ export function resolveXiaoEDefaultBaseUrl(env = process.env) {
     const configured = resolveXiaoEConfiguredBaseUrl(env);
     if (configured)
         return configured;
-    return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
+    return DEFAULT_E10_BASE_URL;
 }
 function uniqueStrings(values) {
     const seen = new Set();
@@ -350,10 +338,12 @@ export function xiaoEBundledEnvScriptPath() {
     const scriptPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../../../scripts/xiaoe_env.py');
     return existsSync(scriptPath) ? scriptPath : '';
 }
-export function hasXiaoETokenScript(env = process.env) {
+export function hasXiaoETokenScript(env = process.env, allowLocalDiscovery = true) {
     const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY, XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY);
     if (explicit)
         return existsSync(explicit);
+    if (!allowLocalDiscovery)
+        return false;
     const scriptPath = xiaoETokenScriptPath(env);
     return Boolean(scriptPath && existsSync(scriptPath));
 }
@@ -620,7 +610,7 @@ function sortedXiaoEClientSettingsFiles(root) {
     const files = listXiaoEClientSettingsFiles(root);
     return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
 }
-function xiaoEClientSettingsCandidateFiles(env) {
+function xiaoEClientSettingsCandidateFiles(env, allowLocalDiscovery = true) {
     const candidates = [];
     const explicitSettingsPath = envString(env, XIAOE_USER_SETTINGS_PATH_ENV_KEY);
     if (isFile(explicitSettingsPath))
@@ -629,7 +619,9 @@ function xiaoEClientSettingsCandidateFiles(env) {
         const injectedRoot = envString(env, key);
         candidates.push(...sortedXiaoEClientSettingsFiles(injectedRoot));
     }
-    candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+    if (allowLocalDiscovery) {
+        candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+    }
     return uniqueStrings(candidates);
 }
 export function findXiaoEClientSettingsFile(env = process.env) {
@@ -674,8 +666,38 @@ export function readXiaoEClientCredential(env = process.env) {
     }
     return null;
 }
-export function hasXiaoEClientCredential(env = process.env) {
-    return Boolean(findXiaoEClientSettingsFile(env));
+export function hasXiaoEClientCredential(env = process.env, allowLocalDiscovery = true) {
+    return Boolean(xiaoEClientSettingsCandidateFiles(env, allowLocalDiscovery)[0]);
+}
+/**
+ * Reports usable unified-login credential sources independently from host
+ * identity. Installing the XiaoE client is not proof that the current process
+ * was launched by XiaoE, but an explicit `auth xiaoe` command may still consume
+ * any credential source that is available.
+ */
+export function inspectXiaoEUnifiedLoginSources(options = {}) {
+    const env = options.env || process.env;
+    const baseUrl = resolveXiaoEPreferredBaseUrl({
+        explicitBaseUrl: options.baseUrl,
+        profileBaseUrl: options.profileBaseUrl,
+        env,
+    });
+    const platformCredential = hasXiaoEPlatformCredential(env);
+    const allowLocalDiscovery = options.allowLocalDiscovery !== false;
+    const tokenScript = options.allowTokenScript !== false
+        && hasXiaoETokenScript(env, allowLocalDiscovery);
+    const clientCredential = hasXiaoEClientCredential(env, allowLocalDiscovery);
+    const environmentCredential = Boolean(baseUrl && resolveXiaoEUnifiedLoginCredential(baseUrl, env));
+    return {
+        platformCredential,
+        tokenScript,
+        clientCredential,
+        environmentCredential,
+        any: platformCredential || tokenScript || clientCredential || environmentCredential,
+    };
+}
+export function hasXiaoEUnifiedLoginSource(options = {}) {
+    return inspectXiaoEUnifiedLoginSources(options).any;
 }
 async function fetchXiaoEClientEteamId(credential, domain) {
     const controller = new AbortController();
@@ -769,22 +791,19 @@ export function resolveXiaoEPreferredBaseUrl(options) {
     const profileBaseUrl = normalizeUrl(options.profileBaseUrl || '');
     if (profileBaseUrl)
         return profileBaseUrl;
-    return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
-}
-export function shouldUseXiaoEBrowserFallback(platform = process.platform) {
-    return platform === 'darwin' || platform === 'win32';
+    return DEFAULT_E10_BASE_URL;
 }
 export function createXiaoEUnifiedLoginUnavailableError(baseUrl = '') {
     const target = normalizeUrl(baseUrl);
     const message = [
         'XiaoE unified login did not return a usable E10 session.',
         target ? `Resolved E10 baseUrl: ${target}.` : 'No E10 baseUrl could be resolved.',
-        'This web/Linux host cannot complete a localhost browser OAuth callback.',
+        'The auth xiaoe command never falls back to browser OAuth.',
         'Refresh the XiaoE web session or restore host credential injection before retrying.',
     ].join(' ');
     return Object.assign(new CliError(message, ExitCode.AuthError), {
         type: 'authentication',
-        subtype: 'xiaoe_web_credential_unavailable',
+        subtype: 'xiaoe_credential_unavailable',
         retryable: false,
         stage: 'xiaoe_unified_login',
     });
@@ -865,7 +884,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
         profileBaseUrl: options.profileBaseUrl,
         env,
     });
-    const mayUseTokenScript = options.allowTokenScript || hasXiaoEEnv(env);
+    const mayUseTokenScript = options.allowTokenScript === true;
     if (!baseUrl && !mayUseTokenScript)
         return null;
     let credential = null;

package/dist/internal/e10/auth-recovery.js

@@ -0,0 +1,148 @@
+import { getActiveProfile } from './auth/session.js';
+import { hasXiaoEEnv, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
+const AUTH_REQUIRED_CODES = new Set(['-2', '401']);
+const AUTH_REQUIRED_MARKERS = [
+    '未登录',
+    '请登录',
+    '重新登录',
+    '登录失效',
+    '登录已失效',
+    '登录过期',
+    '登录已过期',
+    '登录超时',
+    '会话失效',
+    '会话过期',
+    '认证失败',
+    '身份认证失败',
+    'token expired',
+    'token timeout',
+    'token invalid',
+    'session expired',
+    'login required',
+    'not logged in',
+    'not login',
+];
+const recoveryInFlight = new Map();
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function responseCodes(value) {
+    const root = asRecord(value);
+    if (!root)
+        return [];
+    const data = asRecord(root.data);
+    const resBase = asRecord(root.res_base);
+    const nestedResBase = asRecord(data?.res_base);
+    return [root.code, data?.code, resBase?.ret, nestedResBase?.ret]
+        .filter((item) => item !== undefined && item !== null)
+        .map(String);
+}
+function authenticationTextFields(value) {
+    if (typeof value === 'string')
+        return [value];
+    const root = asRecord(value);
+    if (!root)
+        return [];
+    const data = asRecord(root.data);
+    const values = [];
+    for (const record of [root, data]) {
+        if (!record)
+            continue;
+        for (const key of ['message', 'msg', 'error', 'errorMsg', 'rawText'])
+            values.push(record[key]);
+    }
+    return values
+        .filter((item) => typeof item === 'string' || typeof item === 'number')
+        .map(String);
+}
+function responseText(response) {
+    const fields = authenticationTextFields(response.value);
+    if (fields.length)
+        return fields.join('\n');
+    // A parsed object may contain ordinary user/business text such as "请登录".
+    // Never scan the complete serialized success payload for auth keywords.
+    if (asRecord(response.value))
+        return '';
+    if (typeof response.text === 'string' && response.text)
+        return response.text;
+    if (response.content && response.content.length) {
+        return response.content.subarray(0, 8 * 1024).toString('utf8');
+    }
+    return '';
+}
+/**
+ * Detect only explicit authentication rejection signals. A bare HTTP 403 is
+ * deliberately excluded because E10 also uses it for ordinary permission
+ * denials, which must never trigger a credential refresh.
+ */
+export function isE10AuthenticationRequired(response) {
+    if (response.status === 401 || response.status === 302)
+        return true;
+    if (responseCodes(response.value).some((code) => AUTH_REQUIRED_CODES.has(code)))
+        return true;
+    const text = responseText(response).toLowerCase();
+    if (!text)
+        return false;
+    if (text.includes('login.jsp'))
+        return true;
+    if (text.includes('<input') && text.includes('password'))
+        return true;
+    return AUTH_REQUIRED_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+function globalOptions(ctx) {
+    return typeof ctx.getGlobalOptions === 'function' ? ctx.getGlobalOptions() : {};
+}
+/** XiaoE automatic recovery is opt-in through explicit runtime evidence. */
+export function canAutomaticallyRecoverXiaoE(ctx) {
+    const options = globalOptions(ctx);
+    // An explicitly supplied auth file is caller-owned and must not be replaced
+    // by a profile-backed XiaoE session behind the caller's back.
+    return !options.auth && hasXiaoEEnv(ctx.env || process.env, options);
+}
+/**
+ * Silently refresh a stale XiaoE session. Concurrent requests for the same
+ * profile/base URL share one credential exchange, so a burst of 401 responses
+ * does not start a burst of login attempts.
+ */
+export async function recoverXiaoEAuthSession(ctx, currentSession) {
+    if (!canAutomaticallyRecoverXiaoE(ctx))
+        return null;
+    const options = globalOptions(ctx);
+    const profile = options.profile || getActiveProfile();
+    const baseUrl = currentSession.getBaseUrl();
+    const key = `${profile}\n${baseUrl}`;
+    const existing = recoveryInFlight.get(key);
+    if (existing)
+        return existing;
+    const recovery = (async () => {
+        const login = await tryXiaoEUnifiedLogin({
+            env: ctx.env,
+            baseUrl,
+            profileBaseUrl: baseUrl,
+            allowBundledEnvScript: true,
+            allowTokenScript: true,
+            tenantKeyFallback: currentSession.tenantKey,
+            profileHint: profile,
+            // Intentionally no logger: transparent recovery must not leak an
+            // intermediate "login" step into agent stdout/stderr or JSON output.
+        });
+        return login?.session || null;
+    })();
+    recoveryInFlight.set(key, recovery);
+    try {
+        return await recovery;
+    }
+    finally {
+        if (recoveryInFlight.get(key) === recovery)
+            recoveryInFlight.delete(key);
+    }
+}
+export function sameE10SessionIdentity(current, recovered) {
+    const currentBaseUrl = current.getBaseUrl().replace(/\/+$/u, '').toLowerCase();
+    const recoveredBaseUrl = recovered.getBaseUrl().replace(/\/+$/u, '').toLowerCase();
+    if (currentBaseUrl !== recoveredBaseUrl)
+        return false;
+    return !current.userId || !recovered.userId || current.userId === recovered.userId;
+}