weaver-work-cli 0.1.26 → 0.1.28

package/README.md

@@ -229,8 +229,13 @@ E10 配置/映射 → 当前 profile → `https://www.e-cology.com.cn`”解析
 `authentication/xiaoe_credential_unavailable`，不会自动打开浏览器或降级到
 `auth login`。确需浏览器授权时，调用方必须另行显式执行 `auth login`。
 
-业务命令不会自动建立 XiaoE 登录态。桌面客户端需要 XiaoE 专属业务行为时，把全局参数
-放在业务子命令之前，例如：
+业务命令不会在没有本地会话时主动建立 XiaoE 登录态，因此首次使用仍需显式执行
+`auth xiaoe`。已有会话在接口层被明确判定为失效（HTTP 401/302、业务码 `-2` 或登录页）时，
+公共 E10 请求运行时会静默换取一次新会话并把被拒绝的请求重放一次；这个过程不向
+stdout/stderr 输出中间“登录”步骤，并会合并同一 profile 的并发换票。流式请求、网络错误、
+`partial` / `write_uncertain` 不会重放；恢复后的地址或用户身份变化时也会停止。
+
+桌面客户端需要 XiaoE 专属业务行为时，把全局参数放在业务子命令之前，例如：
 
 ```text
 weaver-work-cli --runtime-agent xiaoe workflow ...

package/dist/cmd/setup/index.js

@@ -69,7 +69,7 @@ export const setupCommand = {
                 : null;
             const nextActions = [];
             if (!checks.find((check) => check.name === 'e10Auth')?.ok) {
-                nextActions.push('Run: weaver-work-cli auth login --base-url <E10_BASE_URL> --agent_type <agent_type>');
+                nextActions.push('Authenticate using the method required by the current runtime, then rerun setup.');
             }
             if (!skillInstall) {
                 nextActions.push('Optional Agent setup: weaver-work-cli skills install yepiaotong');

package/dist/internal/e10/auth/commands.js

@@ -172,12 +172,7 @@ function cookieValue(rawCookie, name) {
 }
 function formatAuthStatus(status) {
     if (!status.loggedIn) {
-        return [
-            'Not logged in.',
-            'In the XiaoE host, run: weaver-work-cli auth xiaoe',
-            'Otherwise: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>',
-            'Or:        weaver-work-cli auth set --eteamsid <id> --base-url <url> --agent_type <agent_type>',
-        ].join('\n');
+        return 'Not logged in. Select the appropriate authentication method for the current runtime before retrying.';
     }
     const lines = [
         'Logged in.',

package/dist/internal/e10/auth/messages.js

@@ -0,0 +1,3 @@
+export const E10_REAUTH_GUIDANCE = '请结合当前宿主环境选择合适的登录方式，恢复登录后重试原请求。';
+export const E10_AUTH_REQUIRED_MESSAGE = `E10 登录态不可用。${E10_REAUTH_GUIDANCE}`;
+export const E10_SESSION_EXPIRED_MESSAGE = `E10 登录态已失效，本次操作已停止。${E10_REAUTH_GUIDANCE}`;

package/dist/internal/e10/auth/session.js

@@ -360,6 +360,14 @@ export class E10AuthSession {
     uaHeader() {
         return this.agentType ? `AgentType=${this.agentType},IsAgent=true` : 'weaver-work-cli';
     }
+    /**
+     * Adopt a freshly authenticated session in place. Hosts cache this object for
+     * the lifetime of one command, so mutating it keeps every subsequent request
+     * on the refreshed credential without exposing or re-reading auth data.
+     */
+    replaceWith(session) {
+        this.data = { ...session.data, cookies: { ...session.data.cookies } };
+    }
     toJSON() {
         const sourceInfo = {
             ...(this.loginSource ? { loginSource: this.loginSource } : {}),

package/dist/internal/e10/auth-recovery.js

@@ -0,0 +1,148 @@
+import { getActiveProfile } from './auth/session.js';
+import { hasXiaoEEnv, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
+const AUTH_REQUIRED_CODES = new Set(['-2', '401']);
+const AUTH_REQUIRED_MARKERS = [
+    '未登录',
+    '请登录',
+    '重新登录',
+    '登录失效',
+    '登录已失效',
+    '登录过期',
+    '登录已过期',
+    '登录超时',
+    '会话失效',
+    '会话过期',
+    '认证失败',
+    '身份认证失败',
+    'token expired',
+    'token timeout',
+    'token invalid',
+    'session expired',
+    'login required',
+    'not logged in',
+    'not login',
+];
+const recoveryInFlight = new Map();
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function responseCodes(value) {
+    const root = asRecord(value);
+    if (!root)
+        return [];
+    const data = asRecord(root.data);
+    const resBase = asRecord(root.res_base);
+    const nestedResBase = asRecord(data?.res_base);
+    return [root.code, data?.code, resBase?.ret, nestedResBase?.ret]
+        .filter((item) => item !== undefined && item !== null)
+        .map(String);
+}
+function authenticationTextFields(value) {
+    if (typeof value === 'string')
+        return [value];
+    const root = asRecord(value);
+    if (!root)
+        return [];
+    const data = asRecord(root.data);
+    const values = [];
+    for (const record of [root, data]) {
+        if (!record)
+            continue;
+        for (const key of ['message', 'msg', 'error', 'errorMsg', 'rawText'])
+            values.push(record[key]);
+    }
+    return values
+        .filter((item) => typeof item === 'string' || typeof item === 'number')
+        .map(String);
+}
+function responseText(response) {
+    const fields = authenticationTextFields(response.value);
+    if (fields.length)
+        return fields.join('\n');
+    // A parsed object may contain ordinary user/business text such as "请登录".
+    // Never scan the complete serialized success payload for auth keywords.
+    if (asRecord(response.value))
+        return '';
+    if (typeof response.text === 'string' && response.text)
+        return response.text;
+    if (response.content && response.content.length) {
+        return response.content.subarray(0, 8 * 1024).toString('utf8');
+    }
+    return '';
+}
+/**
+ * Detect only explicit authentication rejection signals. A bare HTTP 403 is
+ * deliberately excluded because E10 also uses it for ordinary permission
+ * denials, which must never trigger a credential refresh.
+ */
+export function isE10AuthenticationRequired(response) {
+    if (response.status === 401 || response.status === 302)
+        return true;
+    if (responseCodes(response.value).some((code) => AUTH_REQUIRED_CODES.has(code)))
+        return true;
+    const text = responseText(response).toLowerCase();
+    if (!text)
+        return false;
+    if (text.includes('login.jsp'))
+        return true;
+    if (text.includes('<input') && text.includes('password'))
+        return true;
+    return AUTH_REQUIRED_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+function globalOptions(ctx) {
+    return typeof ctx.getGlobalOptions === 'function' ? ctx.getGlobalOptions() : {};
+}
+/** XiaoE automatic recovery is opt-in through explicit runtime evidence. */
+export function canAutomaticallyRecoverXiaoE(ctx) {
+    const options = globalOptions(ctx);
+    // An explicitly supplied auth file is caller-owned and must not be replaced
+    // by a profile-backed XiaoE session behind the caller's back.
+    return !options.auth && hasXiaoEEnv(ctx.env || process.env, options);
+}
+/**
+ * Silently refresh a stale XiaoE session. Concurrent requests for the same
+ * profile/base URL share one credential exchange, so a burst of 401 responses
+ * does not start a burst of login attempts.
+ */
+export async function recoverXiaoEAuthSession(ctx, currentSession) {
+    if (!canAutomaticallyRecoverXiaoE(ctx))
+        return null;
+    const options = globalOptions(ctx);
+    const profile = options.profile || getActiveProfile();
+    const baseUrl = currentSession.getBaseUrl();
+    const key = `${profile}\n${baseUrl}`;
+    const existing = recoveryInFlight.get(key);
+    if (existing)
+        return existing;
+    const recovery = (async () => {
+        const login = await tryXiaoEUnifiedLogin({
+            env: ctx.env,
+            baseUrl,
+            profileBaseUrl: baseUrl,
+            allowBundledEnvScript: true,
+            allowTokenScript: true,
+            tenantKeyFallback: currentSession.tenantKey,
+            profileHint: profile,
+            // Intentionally no logger: transparent recovery must not leak an
+            // intermediate "login" step into agent stdout/stderr or JSON output.
+        });
+        return login?.session || null;
+    })();
+    recoveryInFlight.set(key, recovery);
+    try {
+        return await recovery;
+    }
+    finally {
+        if (recoveryInFlight.get(key) === recovery)
+            recoveryInFlight.delete(key);
+    }
+}
+export function sameE10SessionIdentity(current, recovered) {
+    const currentBaseUrl = current.getBaseUrl().replace(/\/+$/u, '').toLowerCase();
+    const recoveredBaseUrl = recovered.getBaseUrl().replace(/\/+$/u, '').toLowerCase();
+    if (currentBaseUrl !== recoveredBaseUrl)
+        return false;
+    return !current.userId || !recovered.userId || current.userId === recovered.userId;
+}

package/dist/internal/e10/client.js

@@ -1,9 +1,14 @@
+import { isE10AuthenticationRequired, sameE10SessionIdentity, } from './auth-recovery.js';
+class E10AuthenticationContextChangedError extends Error {
+}
 export class E10ApiClient {
     auth;
     retries;
-    constructor(auth, retries = 3) {
+    recoverAuthentication;
+    constructor(auth, retries = 3, recoverAuthentication) {
         this.auth = auth;
         this.retries = retries;
+        this.recoverAuthentication = recoverAuthentication;
     }
     getBaseUrl() {
         return this.auth.getBaseUrl();
@@ -56,31 +61,51 @@ export class E10ApiClient {
     }
     async requestRaw(url, init) {
         let lastError = null;
+        let authenticationRecoveryAttempted = false;
         for (let attempt = 1; attempt <= this.retries; attempt++) {
             try {
                 const resp = await fetch(url, { ...init, redirect: 'manual' });
+                const text = await resp.text();
+                let value = null;
+                if (text) {
+                    try {
+                        value = JSON.parse(text);
+                    }
+                    catch {
+                        value = text;
+                    }
+                }
+                if (!authenticationRecoveryAttempted && isE10AuthenticationRequired({
+                    status: resp.status,
+                    headers: resp.headers,
+                    text,
+                    value,
+                })) {
+                    authenticationRecoveryAttempted = true;
+                    const recovered = await this.recoverAuthentication?.(this.auth) || null;
+                    if (recovered) {
+                        if (!sameE10SessionIdentity(this.auth, recovered)) {
+                            throw new E10AuthenticationContextChangedError('XiaoE automatic authentication recovery changed the E10 login context');
+                        }
+                        this.auth.replaceWith(recovered);
+                        refreshAuthenticationHeaders(init, this.auth);
+                        attempt -= 1; // the one authentication retry does not consume the transport retry budget
+                        continue;
+                    }
+                }
+                // Preserve the legacy password-based refresh for non-XiaoE callers.
                 if (resp.status === 302) {
                     const ok = await this.auth.ensureValid();
                     if (!ok)
                         throw new Error('E10 session expired; please login again');
-                    const headers = (init.headers || {});
-                    headers.eteamsid = this.auth.eteamsId;
-                    headers.cookie = this.auth.cookieHeader();
-                    headers['user-agent'] = this.auth.uaHeader();
-                    init.headers = headers;
+                    refreshAuthenticationHeaders(init, this.auth);
                     continue;
                 }
-                const text = await resp.text();
-                if (!text)
-                    return null;
-                try {
-                    return JSON.parse(text);
-                }
-                catch {
-                    return text;
-                }
+                return value;
             }
             catch (error) {
+                if (error instanceof E10AuthenticationContextChangedError)
+                    throw error;
                 lastError = error instanceof Error ? error : new Error(String(error));
                 if (attempt < this.retries) {
                     const delay = Math.min(1000 * Math.pow(2, attempt - 1), 8000);
@@ -102,3 +127,10 @@ export class E10ApiClient {
         return { body, boundary };
     }
 }
+function refreshAuthenticationHeaders(init, session) {
+    const headers = (init.headers || {});
+    headers.eteamsid = session.eteamsId;
+    headers.cookie = session.cookieHeader();
+    headers['user-agent'] = session.uaHeader();
+    init.headers = headers;
+}

package/dist/internal/e10/context.js

@@ -1,7 +1,8 @@
 import { CliError, ExitCode } from '../../core/errors.js';
+import { E10_AUTH_REQUIRED_MESSAGE } from './auth/messages.js';
 import { E10AuthSession } from './auth/session.js';
-import { hasXiaoEEnv } from './auth/xiaoe.js';
 import { E10ApiClient } from './client.js';
+import { recoverXiaoEAuthSession } from './auth-recovery.js';
 export async function getE10Session(ctx, load = {}) {
     const options = ctx.getGlobalOptions();
     return E10AuthSession.fromOptions(options, ctx.cwd, load);
@@ -9,18 +10,17 @@ export async function getE10Session(ctx, load = {}) {
 export async function requireE10Session(ctx, load = {}) {
     const session = await getE10Session(ctx, load);
     if (!session) {
-        const options = ctx.getGlobalOptions();
-        if (hasXiaoEEnv(ctx.env, options)) {
-            throw new CliError('E10 auth not found. The current runtime is XiaoE; run weaver-work-cli auth xiaoe first.', ExitCode.AuthError);
-        }
-        throw new CliError('E10 auth not found. Ask the user for the E10 login domain (base URL), then run: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>.', ExitCode.AuthError);
+        throw new CliError(E10_AUTH_REQUIRED_MESSAGE, ExitCode.AuthError);
     }
     return session;
 }
 export async function getE10Client(ctx) {
     const session = await getE10Session(ctx);
-    return session ? new E10ApiClient(session) : null;
+    return session
+        ? new E10ApiClient(session, 3, (current) => recoverXiaoEAuthSession(ctx, current))
+        : null;
 }
 export async function requireE10Client(ctx) {
-    return new E10ApiClient(await requireE10Session(ctx));
+    const session = await requireE10Session(ctx);
+    return new E10ApiClient(session, 3, (current) => recoverXiaoEAuthSession(ctx, current));
 }

package/dist/internal/e10/index.js

@@ -1,3 +1,4 @@
 export { E10ApiClient } from './client.js';
 export { getE10Client, getE10Session, requireE10Client, requireE10Session } from './context.js';
 export { E10ApiError, E10RequestRuntime, createE10RequestRuntime } from './request-runtime.js';
+export { canAutomaticallyRecoverXiaoE, isE10AuthenticationRequired, recoverXiaoEAuthSession, } from './auth-recovery.js';

package/dist/internal/e10/request-runtime.js

@@ -1,4 +1,5 @@
 import { CliError, ExitCode } from '../../core/errors.js';
+import { isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_BIG_INT_STRINGS = true;
 const RESERVED_HEADERS = [
@@ -29,11 +30,14 @@ export class E10RequestRuntime {
     interceptors;
     fetchFn;
     attachSessionTicket;
+    recoverAuthentication;
     constructor(ctx, session, dependencies = {}) {
         this.ctx = ctx;
         this.session = session;
         this.fetchFn = dependencies.fetch || globalThis.fetch;
         this.attachSessionTicket = dependencies.attachSessionTicket === true;
+        this.recoverAuthentication = dependencies.recoverAuthentication
+            || ((current) => recoverXiaoEAuthSession(this.ctx, current));
         this.interceptors = [
             ...(this.ctx.hooks?.getE10RequestInterceptors?.() || []),
             ...(dependencies.interceptors || []),
@@ -47,9 +51,8 @@ export class E10RequestRuntime {
     }
     async request(request) {
         const mutable = this.prepareRequest(request);
-        const sessionContext = this.sessionContext();
         try {
-            await this.runBeforeRequest(mutable, sessionContext);
+            await this.runBeforeRequest(mutable, this.sessionContext());
             this.assertPath(mutable.path);
             if (mutable.path !== request.path) {
                 throw new E10ApiError('policy', 'path_rewrite_denied', 'E10 API 拦截器不能修改请求路径', {
@@ -58,19 +61,58 @@ export class E10RequestRuntime {
                 });
             }
             stripReservedHeaders(mutable.headers);
-            const url = withQuery(this.session.getBaseUrl(), mutable.path, mutable.query);
-            const headers = this.composeHeaders(mutable, request.trustedHeaders);
-            const init = this.buildFetchInit(mutable, headers);
-            const response = await this.fetchWithTimeout(url, init, mutable.timeoutMs);
-            const parsed = await this.readResponse(response, mutable.responseType, mutable.bigIntStrings, mutable.maxResponseBytes, mutable.timeoutMs);
-            await this.runAfterResponse(mutable, sessionContext, parsed);
+            const requestEteamsId = this.session.eteamsId;
+            let parsed = await this.executeRequest(mutable, request.trustedHeaders);
+            if (!mutable.streamBody
+                && isE10AuthenticationRequired(parsed)
+                && await this.recoverExpiredSession(requestEteamsId)) {
+                // Authentication rejection is a definitive pre-business failure. Retry
+                // exactly once with the new session; never retry transport/partial errors.
+                parsed = await this.executeRequest(mutable, request.trustedHeaders);
+            }
+            await this.runAfterResponse(mutable, this.sessionContext(), parsed);
             return parsed;
         }
         catch (error) {
-            await this.runOnError(mutable, sessionContext, error);
+            await this.runOnError(mutable, this.sessionContext(), error);
             throw error;
         }
     }
+    async executeRequest(request, trustedHeaders = {}) {
+        const url = withQuery(this.session.getBaseUrl(), request.path, request.query);
+        const headers = this.composeHeaders(request, trustedHeaders);
+        const init = this.buildFetchInit(request, headers);
+        const response = await this.fetchWithTimeout(url, init, request.timeoutMs);
+        return this.readResponse(response, request.responseType, request.bigIntStrings, request.maxResponseBytes, request.timeoutMs);
+    }
+    async recoverExpiredSession(requestEteamsId) {
+        // Another concurrent request may already have refreshed the shared session
+        // object while this response was in flight.
+        if (this.session.eteamsId && this.session.eteamsId !== requestEteamsId)
+            return true;
+        let recovered;
+        try {
+            recovered = await this.recoverAuthentication(this.session);
+        }
+        catch {
+            return false;
+        }
+        if (!recovered)
+            return false;
+        if (!sameE10SessionIdentity(this.session, recovered)) {
+            throw new E10ApiError('authentication', 'session_context_changed', 'XiaoE 自动恢复后的登录身份或 E10 环境发生变化，本次请求未重试', { exitCode: ExitCode.AuthError, retryable: false });
+        }
+        const original = this.session;
+        if (typeof original.replaceWith === 'function') {
+            original.replaceWith(recovered);
+            this.session = original;
+        }
+        else {
+            // Structural test doubles and older embedders may not expose replaceWith.
+            this.session = recovered;
+        }
+        return true;
+    }
     prepareRequest(request) {
         return {
             module: request.module,

package/dist/shortcuts/archive/host.js

@@ -1,3 +1,4 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -151,7 +152,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw archiveAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+            throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             if (response.status < 200 || response.status >= 300) {
@@ -182,7 +183,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw archiveAuthError('session_expired', 'E10 登录态已失效，请先登录', { httpStatus: response.status });
+            throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {
             throw new ArchiveCliError('api', 'http_error', `档案下载 HTTP ${response.status}`, {

package/dist/shortcuts/archive/manifest.js

@@ -20,7 +20,7 @@ export const archiveManifest = {
     capabilities: ['fonds', 'prelib', 'search', 'borrowCar', 'borrowList', 'flow', 'download', 'upload'],
     auth: {
         required: 'e10-session',
-        note: '所有操作都要求已登录 E10（weaver-work-cli auth login --base-url <域名>），未登录时返回 auth_error。',
+        note: '所有操作都要求已登录 E10；未登录时返回 auth_error，调用方应根据当前宿主环境选择登录方式。',
     },
     rules: [
         '写操作（*.apply）必须先执行同名的 prepare 拿到 continuation，再带 confirm=true 执行 apply；CLI 用 --yes 表示确认。',

package/dist/shortcuts/archive-oa/host.js

@@ -1,3 +1,4 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -122,7 +123,7 @@ export function createArchiveOaHost(ctx, dependencies = {}) {
             timeoutMs,
         }).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw archiveOaAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+            throw archiveOaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             if (response.status < 200 || response.status >= 300) {

package/dist/shortcuts/archive-oa/manifest.js

@@ -20,7 +20,7 @@ export const archiveOaManifest = {
     capabilities: ['archiveLocate', 'contractSearch', 'borrowCar'],
     auth: {
         required: 'e10-session',
-        note: '所有操作都要求已登录 E10（weaver-work-cli auth login --base-url <域名>）。发起借阅不在 CLI 能力范围内，由用户在浏览器登录后于界面自己完成。',
+        note: '所有操作都要求已登录 E10，具体登录方式由调用方根据当前宿主环境选择。发起借阅不在 CLI 能力范围内，由用户在浏览器登录后于界面自己完成。',
     },
     rules: [
         '写操作（*.apply）必须先执行同名的 prepare 拿到 continuation，再带 confirm=true 执行 apply；CLI 用 --yes 表示确认。',

package/dist/shortcuts/asset/host.js

@@ -1,3 +1,4 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -176,7 +177,7 @@ export function createZiguanjiaHost(ctx) {
             bigIntStrings: true,
         });
         if (response.status === 401 || response.status === 302) {
-            throw ziguanjiaAuthError('session_expired', 'E10 登录态已失效，请先运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录后再试', { httpStatus: response.status });
+            throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             throw ziguanjiaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
@@ -242,7 +243,7 @@ export function createZiguanjiaHost(ctx) {
             bigIntStrings: false,
         });
         if (response.status === 401 || response.status === 302) {
-            throw ziguanjiaAuthError('session_expired', 'E10 登录态已失效，请先运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录后再试', { httpStatus: response.status });
+            throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             throw ziguanjiaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
@@ -315,7 +316,7 @@ export function createZiguanjiaHost(ctx) {
             bigIntStrings: true,
         });
         if (response.status === 401 || response.status === 302) {
-            throw ziguanjiaAuthError('session_expired', 'E10 登录态已失效，请先运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录后再试', { httpStatus: response.status });
+            throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             throw ziguanjiaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
@@ -340,7 +341,7 @@ export function createZiguanjiaHost(ctx) {
     }
     function handleEbusiness(value) {
         if (isEbSessionExpired(value)) {
-            throw ziguanjiaAuthError('session_expired', 'E10 登录态已失效，请先运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录后再试', { ret: ebCode(value) });
+            throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { ret: ebCode(value) });
         }
         const code = ebCode(value);
         if (!isEbSuccessCode(code)) {
@@ -363,7 +364,7 @@ export function createZiguanjiaHost(ctx) {
             bigIntStrings: true,
         });
         if (response.status === 401 || response.status === 302) {
-            throw ziguanjiaAuthError('session_expired', 'E10 登录态已失效，请先运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录后再试', { httpStatus: response.status });
+            throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             throw ziguanjiaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
@@ -393,7 +394,7 @@ export function createZiguanjiaHost(ctx) {
             bigIntStrings: true,
         });
         if (response.status === 401 || response.status === 302) {
-            throw ziguanjiaAuthError('session_expired', 'E10 登录态已失效，请先运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录后再试', { httpStatus: response.status });
+            throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             throw ziguanjiaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });

package/dist/shortcuts/blog/host.js

@@ -1,4 +1,5 @@
 import { ExitCode } from '../../core/errors.js';
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -75,7 +76,7 @@ export function createBlogHost(ctx, dependencies = {}) {
     }
     function assertSession(value) {
         if (isSessionExpired(value)) {
-            throw blogAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录');
+            throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE);
         }
     }
     async function blogRequest(request) {
@@ -91,7 +92,7 @@ export function createBlogHost(ctx, dependencies = {}) {
             timeoutMs,
         });
         if (response.status === 401 || response.status === 302) {
-            throw blogAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录', { httpStatus: response.status });
+            throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             if (response.status < 200 || response.status >= 300) {
@@ -134,7 +135,7 @@ export function createBlogHost(ctx, dependencies = {}) {
             headers: { Accept: 'application/octet-stream, */*' },
         });
         if (response.status === 401 || response.status === 302) {
-            throw blogAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> --agent_type <当前智能体名称> 完成登录', { httpStatus: response.status });
+            throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         const contentType = response.contentType;
         const declaredLength = Number(response.headers.get('content-length'));

package/dist/shortcuts/caizhilian/host.js

@@ -1,3 +1,4 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -152,7 +153,7 @@ export function createCaizhilianHost(ctx, dependencies = {}) {
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw caizhilianAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+            throw caizhilianAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             if (response.status < 200 || response.status >= 300) {
@@ -183,7 +184,7 @@ export function createCaizhilianHost(ctx, dependencies = {}) {
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw caizhilianAuthError('session_expired', 'E10 登录态已失效，请先登录', { httpStatus: response.status });
+            throw caizhilianAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {
             throw new CaizhilianCliError('api', 'http_error', `采知连下载 HTTP ${response.status}`, {

package/dist/shortcuts/caizhilian/manifest.js

@@ -19,7 +19,7 @@ const WITHHELD = [
     },
     {
         name: 'caizhilian.system.switch-config',
-        reason: '源 switch_config 在 Skill 本地多套环境配置间切换；CLI 的环境切换由 `weaver-work-cli config set` / `weaver-work-cli auth login --base-url <域名>` 承担，业务模块不做环境切换。',
+        reason: '源 switch_config 在 Skill 本地多套环境配置间切换；CLI 的环境与认证配置体系负责这一职责，业务模块不做环境切换。',
     },
 ];
 function buildOperations() {

package/dist/shortcuts/calendar/host.js

@@ -1,3 +1,4 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -110,7 +111,7 @@ export function createCalendarHost(ctx, dependencies = {}) {
             mapRuntimeNetworkError(error);
         }
         if (response.status === 401 || response.status === 302) {
-            throw calendarAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+            throw calendarAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             if (response.status < 200 || response.status >= 300) {