weaver-work-cli 0.1.29 → 0.1.32

package/dist/chunks/chunk-2GA5ZIQL.js

@@ -0,0 +1,1615 @@
+import { createRequire as __esbuildCreateRequire } from 'node:module';
+const require = __esbuildCreateRequire(import.meta.url);
+import {
+  CliError
+} from "./chunk-LUSPKZKY.js";
+
+// src/internal/e10/auth/session.ts
+import { constants, createDecipheriv as createDecipheriv2, createHash, publicEncrypt } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, unlinkSync } from "node:fs";
+import { dirname, resolve as resolve3 } from "node:path";
+
+// src/core/connector.ts
+var CONNECTOR_PROFILE = "eteams";
+function isConnectorEnabled(value) {
+  if (value === void 0 || value === null || value === false) return false;
+  if (value === true) return true;
+  const normalized = String(value).trim().toLowerCase();
+  return normalized === "" || normalized === "true" || normalized === "1" || normalized === "yes";
+}
+var connectorMode = false;
+function isConnectorMode() {
+  return connectorMode;
+}
+function normalizeGlobalOptions(options) {
+  if (!isConnectorEnabled(options.isConnector)) {
+    connectorMode = false;
+    return options;
+  }
+  connectorMode = true;
+  return { ...options, profile: CONNECTOR_PROFILE };
+}
+
+// src/core/write-with-retry.ts
+import { writeFileSync } from "node:fs";
+var RETRIABLE_WRITE_ERRORS = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY", "ENOTEMPTY"]);
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function writeWithRetry(path, data, options) {
+  const maxAttempts = 4;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    try {
+      writeFileSync(path, data, options);
+      return;
+    } catch (error) {
+      const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+      if (!RETRIABLE_WRITE_ERRORS.has(code) || attempt === maxAttempts - 1) {
+        throw error;
+      }
+      sleepSync(80 * (attempt + 1));
+    }
+  }
+}
+
+// src/internal/e10/auth/crypto.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { resolve as resolve2 } from "node:path";
+
+// src/internal/e10/auth/paths.ts
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+function getE10AuthRoot() {
+  const override = process.env.WEAVER_WORK_CLI_AUTH_ROOT?.trim();
+  return override ? resolve(override) : resolve(homedir(), ".weaver-work-cli", "e10");
+}
+function getE10ProfilesRoot() {
+  return resolve(getE10AuthRoot(), "profiles");
+}
+function getE10ActiveProfilePath() {
+  return resolve(getE10AuthRoot(), "profile");
+}
+
+// src/internal/e10/auth/crypto.ts
+var ALGORITHM = "aes-256-gcm";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+var KEYCHAIN_SERVICE = "weaver-work-cli";
+var KEYCHAIN_ACCOUNT = "auth-key";
+var require2 = createRequire(import.meta.url);
+var encKey = null;
+var keyringEntryConstructor;
+function getKeyFilePath() {
+  return resolve2(getE10AuthRoot(), ".key");
+}
+function loadKeyringEntryConstructor() {
+  if (keyringEntryConstructor !== void 0) return keyringEntryConstructor;
+  try {
+    const module = require2("@napi-rs/keyring");
+    keyringEntryConstructor = typeof module.Entry === "function" ? module.Entry : null;
+  } catch {
+    keyringEntryConstructor = null;
+  }
+  return keyringEntryConstructor;
+}
+function readKeychainKey(service) {
+  const KeyringEntry = loadKeyringEntryConstructor();
+  if (!KeyringEntry) return null;
+  try {
+    const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
+    const stored = entry.getPassword();
+    if (stored && /^[A-Za-z0-9+/=]{40,}$/.test(stored)) {
+      const key = Buffer.from(stored, "base64");
+      if (key.length === 32) return key;
+    }
+  } catch {
+  }
+  return null;
+}
+function writeKeychainKey(service, key) {
+  const KeyringEntry = loadKeyringEntryConstructor();
+  if (!KeyringEntry) return false;
+  try {
+    const entry = new KeyringEntry(service, KEYCHAIN_ACCOUNT);
+    entry.setPassword(key.toString("base64"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readKeyFile(filePath) {
+  if (!existsSync(filePath)) return null;
+  try {
+    const key = Buffer.from(readFileSync(filePath, "utf-8").trim(), "base64");
+    return key.length === 32 ? key : null;
+  } catch {
+    return null;
+  }
+}
+function getEncKey() {
+  if (encKey) return encKey;
+  const storedKey = readKeychainKey(KEYCHAIN_SERVICE);
+  if (storedKey) {
+    encKey = storedKey;
+    return encKey;
+  }
+  const keyFile = getKeyFilePath();
+  const fileKey = readKeyFile(keyFile);
+  if (fileKey) {
+    encKey = fileKey;
+    return encKey;
+  }
+  const fresh = randomBytes(32);
+  if (writeKeychainKey(KEYCHAIN_SERVICE, fresh)) {
+    encKey = fresh;
+    return encKey;
+  }
+  encKey = fresh;
+  mkdirSync(getE10AuthRoot(), { recursive: true });
+  writeWithRetry(keyFile, encKey.toString("base64"), { mode: 384 });
+  return encKey;
+}
+function encryptAuthData(plaintext) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, getEncKey(), iv, { authTagLength: TAG_LENGTH });
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const combined = Buffer.concat([iv, encrypted, tag]);
+  return { enc: true, v: 1, data: combined.toString("base64") };
+}
+function decryptAuthData(wrapper) {
+  const combined = Buffer.from(wrapper.data, "base64");
+  if (combined.length < IV_LENGTH + TAG_LENGTH + 1) return null;
+  const iv = combined.subarray(0, IV_LENGTH);
+  const tag = combined.subarray(combined.length - TAG_LENGTH);
+  const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
+  try {
+    const decipher = createDecipheriv(ALGORITHM, getEncKey(), iv, { authTagLength: TAG_LENGTH });
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+function parseAuthFile(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.enc === true && typeof parsed.data === "string") {
+      const decrypted = decryptAuthData(parsed);
+      if (!decrypted) return null;
+      return JSON.parse(decrypted);
+    }
+    if (parsed.cookies && parsed.userId) return parsed;
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// src/internal/e10/auth/session.ts
+var RSA_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEOk/WyyJKdAHIfMODFnKg7MBoraFBnL3F18hhLx5n01J5g4hCkmpc5+KQFKIQIA/QWk9m7QBzI/OV9ZDFk54LaWm3xP8C+P1TPp7UVGz3iNDLdvgSxuGEYPmML3NaqkbVlvW7/NlNA3ED4Kao7rR5GUYSdFfbaBoxBFae638hzQIDAQAB
+-----END PUBLIC KEY-----`;
+var AES_SEED = "yoJXYSzZhAOpbEFJklGtqd74X2ChTKOL";
+function sha1(data) {
+  return createHash("sha1").update(data).digest();
+}
+function getAesKey() {
+  const h = sha1(sha1(Buffer.from(AES_SEED))).toString("hex").slice(0, 32);
+  return Buffer.from(h, "hex");
+}
+function decryptAES(key, encryptedHex) {
+  const encrypted = Buffer.from(encryptedHex, "hex");
+  const decipher = createDecipheriv2("aes-128-ecb", key, null);
+  decipher.setAutoPadding(true);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf-8");
+}
+async function fetchPublicKey(baseUrl, passportUrl) {
+  try {
+    const url = `${passportUrl}/papi/passport/info/getUrlInfo?type=login&service=${encodeURIComponent(baseUrl)}`;
+    const resp = await fetch(url, {
+      headers: {
+        accept: "application/json",
+        langtype: "zh_CN",
+        "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
+      }
+    });
+    if (resp.status !== 200) return null;
+    const data = await resp.json();
+    if (data.code !== 200 || !data.data?.publicKey) return null;
+    const decrypted = decryptAES(getAesKey(), data.data.publicKey);
+    return "-----BEGIN PUBLIC KEY-----\n" + decrypted + "\n-----END PUBLIC KEY-----";
+  } catch {
+    return null;
+  }
+}
+function getActiveProfile() {
+  const activeProfileFile = getE10ActiveProfilePath();
+  try {
+    if (existsSync2(activeProfileFile)) {
+      const name = readFileSync2(activeProfileFile, "utf-8").trim();
+      if (name) return name;
+    }
+  } catch {
+  }
+  return "default";
+}
+function setActiveProfile(name) {
+  if (isConnectorMode()) return;
+  switchActiveProfile(name);
+}
+function switchActiveProfile(name) {
+  mkdirSync2(getE10ProfilesRoot(), { recursive: true });
+  mkdirSync2(resolve3(getE10ProfilesRoot(), name), { recursive: true });
+  writeWithRetry(getE10ActiveProfilePath(), name, "utf-8");
+}
+function listProfiles() {
+  try {
+    if (!existsSync2(getE10ProfilesRoot())) return [];
+    return readdirSync(getE10ProfilesRoot(), { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+function getProfileDir(name) {
+  return resolve3(getE10ProfilesRoot(), name);
+}
+function getProfileAuthPath(name) {
+  return resolve3(getProfileDir(name), "auth");
+}
+function getProfileConfigPath(name) {
+  return resolve3(getProfileDir(name), "config.json");
+}
+var MULTI_LABEL_PUBLIC_SUFFIXES = /* @__PURE__ */ new Set([
+  "com.cn",
+  "net.cn",
+  "org.cn",
+  "gov.cn",
+  "edu.cn",
+  "ac.cn",
+  "com.hk",
+  "net.hk",
+  "org.hk",
+  "edu.hk",
+  "gov.hk",
+  "com.tw",
+  "net.tw",
+  "org.tw",
+  "edu.tw",
+  "gov.tw",
+  "com.mo",
+  "net.mo",
+  "org.mo",
+  "edu.mo",
+  "gov.mo",
+  "co.uk",
+  "org.uk",
+  "me.uk",
+  "ac.uk",
+  "gov.uk",
+  "co.jp",
+  "ne.jp",
+  "or.jp",
+  "ac.jp",
+  "go.jp",
+  "com.au",
+  "net.au",
+  "org.au",
+  "co.nz",
+  "net.nz",
+  "com.sg",
+  "com.my",
+  "com.br",
+  "com.mx",
+  "com.tr"
+]);
+function profileNameFromUrl(baseUrl) {
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    if (!host) return "default";
+    if (/^(\d{1,3}\.){3}\d{1,3}$/u.test(host)) return host.replace(/[^0-9a-z]+/gu, "-");
+    const parts = host.split(".").filter(Boolean);
+    if (parts.length <= 1) return parts[0] || "default";
+    const hasMultiLabelSuffix = parts.length >= 3 && MULTI_LABEL_PUBLIC_SUFFIXES.has(parts.slice(-2).join("."));
+    const index = hasMultiLabelSuffix ? parts.length - 3 : parts.length - 2;
+    return parts[index] || parts[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function readProfileConfig(profile = getActiveProfile()) {
+  const configPath = getProfileConfigPath(profile);
+  if (existsSync2(configPath)) {
+    try {
+      return JSON.parse(readFileSync2(configPath, "utf-8"));
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+function saveProfileConfig(baseUrl, passportUrl, profile = getActiveProfile(), tenantKey) {
+  const configPath = getProfileConfigPath(profile);
+  mkdirSync2(dirname(configPath), { recursive: true });
+  writeWithRetry(configPath, JSON.stringify({ baseUrl, passportUrl, tenantKey }, null, 2) + "\n", { mode: 384 });
+}
+function saveAuthFile(data, profile = getActiveProfile()) {
+  const authPath = getProfileAuthPath(profile);
+  mkdirSync2(dirname(authPath), { recursive: true });
+  writeWithRetry(authPath, JSON.stringify(encryptAuthData(JSON.stringify(data))), { mode: 384 });
+  return authPath;
+}
+function clearProfileAuthFile(profile = getActiveProfile()) {
+  const authFile = getProfileAuthPath(profile);
+  if (!existsSync2(authFile)) return { profile, authFile, cleared: false };
+  unlinkSync(authFile);
+  return { profile, authFile, cleared: true };
+}
+function findAuthFile(startDir = process.cwd(), options = {}) {
+  if (options.auth) return options.auth;
+  if (options.profile) {
+    const profileAuth = getProfileAuthPath(options.profile);
+    if (existsSync2(profileAuth)) return profileAuth;
+  }
+  const envAuth = process.env.E10_AUTH_PATH;
+  if (envAuth && existsSync2(envAuth)) return envAuth;
+  const activeProfileAuth = getProfileAuthPath(getActiveProfile());
+  if (existsSync2(activeProfileAuth)) return activeProfileAuth;
+  return null;
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function readTeamsCheckUserInfo(resp, data) {
+  const root = asRecord(data);
+  const nested = asRecord(root.data);
+  const currentUser = asRecord(root.currentUser || nested.currentUser);
+  const currentTenant = asRecord(root.currentTenant || nested.currentTenant);
+  const department = asRecord(currentUser.department);
+  const position = asRecord(currentUser.position);
+  const userId = resp.headers.get("employeeId") || currentUser.employeeId || currentUser.id || nested.employeeId || root.employeeId || "";
+  const tenantKey = currentUser.tenantKey || currentTenant.tenantKey || nested.tenantKey || nested.tenantkey || root.tenantKey || root.tenantkey || "";
+  return {
+    userId: String(userId || ""),
+    tenantKey: String(tenantKey || ""),
+    tenantName: String(currentTenant.tenantName || currentTenant.name || ""),
+    department: String(department.name || ""),
+    subcompany: String(root.subCompanyName || nested.subCompanyName || ""),
+    position: String(position.name || "")
+  };
+}
+function buildE10CookieHeader(rawCookie, eteamsId, agentType = "") {
+  let cookie = rawCookie || "";
+  if (cookie) {
+    if (/ETEAMSID=/.test(cookie)) {
+      cookie = cookie.replace(/ETEAMSID=[^;]+/, `ETEAMSID=${eteamsId}`);
+    } else if (eteamsId) {
+      cookie += `; ETEAMSID=${eteamsId}`;
+    }
+  } else if (eteamsId) {
+    cookie = `ETEAMSID=${eteamsId}`;
+  }
+  if (agentType && !/agentType=/.test(cookie)) {
+    cookie = cookie ? `${cookie}; agentType=${agentType}` : `agentType=${agentType}`;
+  }
+  if (!/isAgent=/.test(cookie)) {
+    cookie = cookie ? `${cookie}; isAgent=true` : "isAgent=true";
+  }
+  return cookie;
+}
+function splitSetCookie(value) {
+  return value.split(/,\s*(?=[^;,]+=)/).filter(Boolean);
+}
+function extractRawSetCookie(resp) {
+  const headers = resp.headers;
+  const setCookies = headers.getSetCookie?.() || splitSetCookie(headers.get("set-cookie") || "");
+  return setCookies.map((cookie) => cookie.split(";")[0]).filter(Boolean).join("; ");
+}
+function extractSessionTicket(...sources) {
+  for (const source of sources) {
+    if (!source) continue;
+    const match = source.match(/(?:^|;\s*)ZT_SESSION=([^;]+)/u);
+    if (match?.[1]) return match[1];
+  }
+  return "";
+}
+function readSessionTicketExpiry(ticket) {
+  const payload = ticket.split(".")[1];
+  if (!payload) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    const exp = Number(data?.exp);
+    return Number.isFinite(exp) && exp > 0 ? exp : null;
+  } catch {
+    return null;
+  }
+}
+function usableSessionTicket(ticket) {
+  const trimmed = (ticket || "").trim();
+  if (!trimmed) return "";
+  const exp = readSessionTicketExpiry(trimmed);
+  if (exp !== null && exp * 1e3 <= Date.now()) return "";
+  return trimmed;
+}
+function hasUsableUserId(session) {
+  const id = session.userId;
+  return Boolean(id) && id !== "unknown";
+}
+var E10AuthSession = class _E10AuthSession {
+  constructor(data, filePath = null, baseUrlFallback, passportUrlFallback) {
+    this.filePath = filePath;
+    this.data = data;
+    this.data.baseUrl = this.data.baseUrl || baseUrlFallback || "";
+    this.data.passportUrl = this.data.passportUrl || passportUrlFallback || this.data.baseUrl;
+  }
+  filePath;
+  data;
+  get cookies() {
+    return this.data.cookies || {};
+  }
+  get eteamsId() {
+    return this.cookies.ETEAMSID || "";
+  }
+  get userId() {
+    return this.data.userId || "";
+  }
+  get tenantKey() {
+    return this.data.tenantKey || "";
+  }
+  get tenantName() {
+    return this.data.tenantName || "";
+  }
+  get department() {
+    return this.data.department || "";
+  }
+  get subcompany() {
+    return this.data.subcompany || "";
+  }
+  get position() {
+    return this.data.position || "";
+  }
+  get agentType() {
+    return this.data.agentType || this.data.agent_type || "";
+  }
+  get version() {
+    return this.data.version || this.data.baselineVersion || "";
+  }
+  get loginSource() {
+    return this.data.loginSource || "";
+  }
+  get credentialSourceStep() {
+    return this.data.credentialSourceStep;
+  }
+  get credentialSourceType() {
+    return this.data.credentialSourceType || "";
+  }
+  get credentialSourceLabel() {
+    return this.data.credentialSourceLabel || "";
+  }
+  getBaseUrl() {
+    return (this.data.baseUrl || "").replace(/\/$/, "");
+  }
+  getPassportUrl() {
+    return (this.data.passportUrl || this.getBaseUrl()).replace(/\/$/, "");
+  }
+  cookieHeader() {
+    const raw = this.cookies.raw || "";
+    return buildE10CookieHeader(raw, this.eteamsId, this.agentType);
+  }
+  /** 在 `cookieHeader()` 基础上附加网关会话票据（`ZT_SESSION`）。
+   *
+   *  **只在票存在、非空且未过期时才追加**：没有票（老 auth 文件／网关未下发 set-cookie／set-cookie 为空）
+   *  或票已过期时，返回值与 `cookieHeader()` **逐字节相同** ⇒ 未受惠也算不上回退。
+   *  是否使用本方法由调用方决定（目前只有流程侧，见 `E10RequestRuntimeDependencies.attachSessionTicket`）。 */
+  cookieHeaderWithSessionTicket() {
+    const base = this.cookieHeader();
+    const ticket = usableSessionTicket(this.data.ztSession);
+    return ticket ? `${base}; ZT_SESSION=${ticket}` : base;
+  }
+  uaHeader() {
+    return this.agentType ? `AgentType=${this.agentType},IsAgent=true` : "weaver-work-cli";
+  }
+  /**
+   * Adopt a freshly authenticated session in place. Hosts cache this object for
+   * the lifetime of one command, so mutating it keeps every subsequent request
+   * on the refreshed credential without exposing or re-reading auth data.
+   */
+  replaceWith(session) {
+    this.data = { ...session.data, cookies: { ...session.data.cookies } };
+  }
+  toJSON() {
+    const sourceInfo = {
+      ...this.loginSource ? { loginSource: this.loginSource } : {},
+      ...this.credentialSourceStep ? { credentialSourceStep: this.credentialSourceStep } : {},
+      ...this.credentialSourceType ? { credentialSourceType: this.credentialSourceType } : {},
+      ...this.credentialSourceLabel ? { credentialSourceLabel: this.credentialSourceLabel } : {}
+    };
+    return {
+      userId: this.userId,
+      tenantKey: this.tenantKey,
+      tenantName: this.tenantName,
+      department: this.department,
+      subcompany: this.subcompany,
+      position: this.position,
+      agentType: this.agentType,
+      version: this.version,
+      baseUrl: this.getBaseUrl(),
+      passportUrl: this.getPassportUrl(),
+      stTicket: this.data.stTicket,
+      redirectUrl: this.data.redirectUrl,
+      cookieSavedAt: this.data.cookieSavedAt,
+      mainUrl: this.data.mainUrl,
+      ...sourceInfo,
+      hasEteamsId: Boolean(this.eteamsId)
+    };
+  }
+  static fromFile(filePath, baseUrlFallback, passportUrlFallback) {
+    try {
+      const raw = readFileSync2(filePath, "utf-8");
+      const data = parseAuthFile(raw);
+      if (!data || !data.cookies?.ETEAMSID || !data.baseUrl) return null;
+      return new _E10AuthSession(data, filePath, baseUrlFallback, passportUrlFallback);
+    } catch {
+      return null;
+    }
+  }
+  static async fromOptions(options, startDir = process.cwd(), load = {}) {
+    let baseUrl = options.baseUrl;
+    let passportUrl = options.passportUrl;
+    if (options.profile) {
+      const cfg = readProfileConfig(options.profile);
+      baseUrl ||= cfg.baseUrl;
+      passportUrl ||= cfg.passportUrl;
+    }
+    const authPath = findAuthFile(startDir, options);
+    if (!authPath) return null;
+    const session = _E10AuthSession.fromFile(authPath, baseUrl, passportUrl);
+    if (session && !(load.skipProfileEnrichment && hasUsableUserId(session))) {
+      await session.fetchEmployeeId();
+    }
+    return session;
+  }
+  async fetchEmployeeId() {
+    try {
+      const resp = await fetch(
+        `${this.getBaseUrl()}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(this.getBaseUrl())}`,
+        {
+          method: "POST",
+          headers: {
+            accept: "application/json",
+            "content-type": "application/json",
+            eteamsid: this.eteamsId,
+            cookie: this.cookieHeader(),
+            "user-agent": this.uaHeader(),
+            origin: this.getBaseUrl()
+          }
+        }
+      );
+      const data = await resp.json().catch(() => ({}));
+      const userInfo = readTeamsCheckUserInfo(resp, data);
+      if (userInfo.userId && userInfo.userId !== this.data.userId) this.data.userId = userInfo.userId;
+      if (userInfo.tenantKey) this.data.tenantKey = userInfo.tenantKey;
+      if (userInfo.tenantName) this.data.tenantName = userInfo.tenantName;
+      if (userInfo.department) this.data.department = userInfo.department;
+      if (userInfo.subcompany) this.data.subcompany = userInfo.subcompany;
+      if (userInfo.position) this.data.position = userInfo.position;
+    } catch {
+    }
+  }
+  async checkValid() {
+    try {
+      const resp = await fetch(`${this.getBaseUrl()}/api/ecode/tree/list?parentId=0`, {
+        headers: {
+          accept: "application/json",
+          eteamsid: this.eteamsId,
+          cookie: this.cookieHeader(),
+          "user-agent": this.uaHeader()
+        },
+        redirect: "manual"
+      });
+      return resp.status === 200;
+    } catch {
+      return false;
+    }
+  }
+  async ensureValid() {
+    if (await this.checkValid()) return true;
+    const account = process.env.E10_ACCOUNT;
+    const password = process.env.E10_PASSWORD;
+    if (!account || !password) return false;
+    await this.rsaLogin(account, password);
+    this.save();
+    return true;
+  }
+  async rsaLogin(account, password) {
+    const passport = this.getPassportUrl();
+    const base = this.getBaseUrl();
+    const pem = await fetchPublicKey(base, passport) || RSA_PUBLIC_KEY_PEM;
+    const enc = (value) => publicEncrypt(
+      { key: pem, padding: constants.RSA_PKCS1_PADDING },
+      Buffer.from(value, "utf-8")
+    ).toString("base64");
+    const resp = await fetch(`${passport}/papi/passport/login/pclogin`, {
+      method: "POST",
+      headers: {
+        accept: "application/json, text/plain, */*",
+        "content-type": "application/json;charset=UTF-8",
+        langtype: "zh_CN",
+        origin: passport
+      },
+      body: JSON.stringify({
+        account: enc(account),
+        password: enc(password),
+        service: base,
+        tenantKey: "all_teams",
+        teamsInfo: JSON.stringify({ urlSearchParams: `?service=${encodeURIComponent(base)}` }),
+        passportCusLoginDomain: passport,
+        serviceToken: "",
+        auxiliaryToken: "",
+        language: "zh_CN",
+        onlySelfTenant: 0,
+        loginRedirectUrl: "",
+        devType: "72",
+        registerDataSource: "",
+        registerSource: "",
+        registerSourceUrl: "",
+        moduleSource: "",
+        integratedLoginId: "",
+        agreementChecked: "0",
+        needPassword: true
+      }),
+      redirect: "manual"
+    });
+    const result = await resp.json();
+    if (result.code !== 200 || !result.status || !result.data?.stTicket) {
+      throw new CliError(result.msg || "E10 RSA login failed", 3 /* AuthError */);
+    }
+    const ticketResp = await fetch(`${base}/papi/baseserver/layout/checkTicket`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json",
+        origin: base
+      },
+      body: JSON.stringify({ ticket: result.data.stTicket, service: base }),
+      redirect: "manual"
+    });
+    const headers = ticketResp.headers;
+    const setCookies = headers.getSetCookie?.() || [];
+    const cookies = {};
+    for (const cookie of setCookies) {
+      const match = cookie.match(/^([^=]+)=([^;]+)/);
+      if (match) cookies[match[1].trim()] = match[2];
+    }
+    const rawCookie = extractRawSetCookie(ticketResp);
+    if (rawCookie) cookies.raw = rawCookie;
+    const ticketData = await ticketResp.json().catch(() => ({}));
+    const userInfo = readTeamsCheckUserInfo(ticketResp, ticketData);
+    this.data = {
+      cookies,
+      userId: userInfo.userId || account,
+      tenantKey: userInfo.tenantKey || this.tenantKey,
+      tenantName: userInfo.tenantName,
+      department: userInfo.department,
+      subcompany: userInfo.subcompany,
+      position: userInfo.position,
+      baseUrl: base,
+      passportUrl: passport,
+      stTicket: "",
+      redirectUrl: "",
+      cookieSavedAt: Date.now()
+    };
+  }
+  save() {
+    if (!this.filePath) return;
+    writeWithRetry(this.filePath, JSON.stringify(encryptAuthData(JSON.stringify(this.data))), { mode: 384 });
+  }
+};
+
+// src/internal/e10/auth/messages.ts
+var E10_REAUTH_GUIDANCE = "\u8BF7\u7ED3\u5408\u5F53\u524D\u5BBF\u4E3B\u73AF\u5883\u9009\u62E9\u5408\u9002\u7684\u767B\u5F55\u65B9\u5F0F\uFF0C\u6062\u590D\u767B\u5F55\u540E\u91CD\u8BD5\u539F\u8BF7\u6C42\u3002";
+var E10_AUTH_REQUIRED_MESSAGE = `E10 \u767B\u5F55\u6001\u4E0D\u53EF\u7528\u3002${E10_REAUTH_GUIDANCE}`;
+var E10_SESSION_EXPIRED_MESSAGE = `E10 \u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u672C\u6B21\u64CD\u4F5C\u5DF2\u505C\u6B62\u3002${E10_REAUTH_GUIDANCE}`;
+
+// src/core/package-paths.ts
+import { existsSync as existsSync3, realpathSync } from "node:fs";
+import { dirname as dirname2, join, resolve as resolve4 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+var cachedRoot;
+function entryDirectory(entry) {
+  const absoluteEntry = resolve4(entry);
+  try {
+    return dirname2(realpathSync(absoluteEntry));
+  } catch {
+    return dirname2(absoluteEntry);
+  }
+}
+function packageRootDir() {
+  if (cachedRoot) return cachedRoot;
+  const seeds = [];
+  const entry = process.argv[1];
+  if (entry) seeds.push(entryDirectory(entry));
+  seeds.push(dirname2(fileURLToPath(import.meta.url)));
+  for (const seed of seeds) {
+    let dir = seed;
+    for (let depth = 0; depth < 10; depth += 1) {
+      if (existsSync3(join(dir, "package.json"))) {
+        cachedRoot = dir;
+        return dir;
+      }
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  cachedRoot = process.cwd();
+  return cachedRoot;
+}
+function packagePath(...segments) {
+  return join(packageRootDir(), ...segments);
+}
+function packageFileUrl(...segments) {
+  return pathToFileURL(packagePath(...segments));
+}
+
+// src/internal/e10/auth/xiaoe.ts
+import { execFile } from "node:child_process";
+import { accessSync, constants as fsConstants, existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+
+// src/core/runtime-agent.ts
+var XIAOE_RUNTIME_AGENT_ALIASES = /* @__PURE__ */ new Set([
+  "xiaoe",
+  "xiaoeclient",
+  "\u5C0Fe",
+  "\u5C0Fe\u5BA2\u6237\u7AEF",
+  "\u667A\u80FD\u5C0Fe",
+  "\u667A\u80FD\u5C0Fe\u5BA2\u6237\u7AEF"
+]);
+function normalizeRuntimeAgent(value) {
+  if (typeof value !== "string") return "";
+  return value.toLowerCase().replace(/[^a-z0-9\p{Script=Han}]+/gu, "");
+}
+function isXiaoERuntimeAgent(value) {
+  return XIAOE_RUNTIME_AGENT_ALIASES.has(normalizeRuntimeAgent(value));
+}
+function isXiaoERuntime(options) {
+  return isXiaoERuntimeAgent(options?.runtimeAgent);
+}
+
+// src/internal/e10/auth/xiaoe.ts
+var DEFAULT_E10_BASE_URL = "https://www.e-cology.com.cn";
+var XIAOE_AGENT_TYPE = "XiaoE";
+var XIAOE_UNIFIED_LOGIN_MAP_ENV_KEYS = [
+  "WEAVER_XIAOE_AUTH_MAP",
+  "WEAVER_XIAOE_E10_AUTH_MAP",
+  "WEAVER_XIAOE_DOMAIN_ETEAMSID_MAP",
+  "WEAVER_XIAOE_UNIFIED_LOGIN_MAP",
+  "XIAOE_E10_AUTH_MAP",
+  "XIAOE_E10_DOMAIN_ETEAMSID_MAP",
+  "XIAOE_DOMAIN_ETEAMSID_MAP",
+  "XIAOE_UNIFIED_LOGIN_MAP"
+];
+var XIAOE_SINGLE_DOMAIN_ENV_KEYS = [
+  "WEAVER_XIAOE_E10_DOMAIN",
+  "WEAVER_XIAOE_BASE_URL",
+  "WEAVER_XIAOE_E10_BASE_URL",
+  "XIAOE_E10_DOMAIN",
+  "XIAOE_BASE_URL",
+  "XIAOE_E10_BASE_URL"
+];
+var XIAOE_DEFAULT_DOMAIN_ENV_KEYS = [
+  "WEAVER_XIAOE_DEFAULT_DOMAIN",
+  "WEAVER_XIAOE_DEFAULT_BASE_URL",
+  "WEAVER_XIAOE_E10_DEFAULT_DOMAIN",
+  "WEAVER_XIAOE_E10_DEFAULT_BASE_URL",
+  "XIAOE_DEFAULT_DOMAIN",
+  "XIAOE_DEFAULT_BASE_URL",
+  "XIAOE_E10_DEFAULT_DOMAIN",
+  "XIAOE_E10_DEFAULT_BASE_URL"
+];
+var XIAOE_TOKEN_SCRIPT_ENV_KEY = "WEAVER_XIAOE_TOKEN_SCRIPT_PATH";
+var XIAOE_TOKEN_SCRIPT_PYTHON_ENV_KEY = "WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON";
+var XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY = "XIAOE_TOKEN_SCRIPT_PATH";
+var XIAOE_TOKEN_SCRIPT_PYTHON_LEGACY_ENV_KEY = "XIAOE_TOKEN_SCRIPT_PYTHON";
+var XIAOE_TOKEN_SCRIPT_TIMEOUT_MS = 15e3;
+var XIAOE_CLIENT_TOKEN_TIMEOUT_MS = 15e3;
+var XIAOE_USER_SETTINGS_PATH_ENV_KEY = "XIAOE_USER_SETTINGS_PATH";
+var XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS = [
+  "XIAOE_ROBOT_DATA_ROOT",
+  "XIAOE_ROBOT_ROOT"
+];
+var XIAOE_SKILL_ETEAMID_API_PATH = "/spec-apps/api/app/rpachat/skill/extend/eteamId";
+var XIAOE_CLIENT_SETTINGS_SOURCE = "XiaoE/Robots/user_settings.json";
+var XIAOE_USER_TOKEN_SOURCE = "XIAOE_USER_TOKEN";
+var XIAOE_BUNDLED_ENV_SCRIPT_SOURCE = "bundled scripts/xiaoe_env.py";
+function envString(env, ...keys) {
+  for (const key of keys) {
+    const value = env[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function hasXiaoEEnv(env = process.env, options = {}) {
+  if (isXiaoERuntime(options)) return true;
+  if (Object.keys(env).some((key) => key.startsWith("XIAOE_"))) return true;
+  const explicitHostAgentType = envString(env, "WORKBUDDY_AGENT_TYPE", "CODEX_AGENT_TYPE");
+  if (explicitHostAgentType) return isXiaoERuntimeAgent(explicitHostAgentType);
+  if (Object.keys(env).some((key) => key.startsWith("WORKBUDDY_") || key.startsWith("CODEX_"))) {
+    return false;
+  }
+  const explicitAgentType = envString(env, "WEAVER_AGENT_TYPE");
+  return explicitAgentType ? isXiaoERuntimeAgent(explicitAgentType) : false;
+}
+function describeXiaoECredentialSource(source) {
+  if (source === XIAOE_USER_TOKEN_SOURCE || source === XIAOE_BUNDLED_ENV_SCRIPT_SOURCE) {
+    return {
+      credentialSourceStep: 1,
+      credentialSourceType: "xiaoe_platform",
+      credentialSourceLabel: source === XIAOE_BUNDLED_ENV_SCRIPT_SOURCE ? "XiaoE platform user token (bundled Python fallback)" : "XiaoE platform user token"
+    };
+  }
+  if (source === "xiaoeUserData/tokens.py") {
+    return {
+      credentialSourceStep: 2,
+      credentialSourceType: "token_script",
+      credentialSourceLabel: "xiaoeUserData/tokens.py"
+    };
+  }
+  if (source === XIAOE_CLIENT_SETTINGS_SOURCE) {
+    return {
+      credentialSourceStep: 3,
+      credentialSourceType: "xiaoe_client",
+      credentialSourceLabel: "XiaoE client settings"
+    };
+  }
+  return {
+    credentialSourceStep: 4,
+    credentialSourceType: "xiaoe_env",
+    credentialSourceLabel: "WEAVER_XIAOE_* environment variables"
+  };
+}
+function normalizeUrl(value) {
+  return value.replace(/\/+$/, "");
+}
+function readString(data, ...keys) {
+  for (const key of keys) {
+    const value = data[key];
+    if (typeof value === "string" && value) return value;
+    if (typeof value === "number") return String(value);
+  }
+  return "";
+}
+function cookieString(value) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && !Array.isArray(value)) {
+    return Object.entries(value).filter(([, cookieValue2]) => cookieValue2 !== void 0 && cookieValue2 !== null && cookieValue2 !== "").map(([name, cookieValue2]) => `${name}=${String(cookieValue2)}`).join("; ");
+  }
+  return "";
+}
+function cookieValue(rawCookie, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = rawCookie.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+  return match?.[1] || "";
+}
+function recordCandidates(value) {
+  return [
+    value,
+    value.data,
+    value.result,
+    value.auth,
+    value.session,
+    value.e10,
+    value.e10Auth,
+    value.e10_auth
+  ].filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry));
+}
+function normalizeDomainKey(value) {
+  const raw = normalizeUrl(value.trim());
+  if (!raw) return null;
+  try {
+    const url = new URL(raw.includes("://") ? raw : `https://${raw}`);
+    return {
+      raw: raw.toLowerCase(),
+      origin: normalizeUrl(url.origin).toLowerCase(),
+      host: url.hostname.toLowerCase()
+    };
+  } catch {
+    return {
+      raw: raw.toLowerCase(),
+      origin: raw.toLowerCase(),
+      host: ""
+    };
+  }
+}
+function domainMatches(baseUrl, candidate) {
+  const base = normalizeDomainKey(baseUrl);
+  const target = normalizeDomainKey(candidate);
+  if (!base || !target) return false;
+  return base.origin === target.origin || base.raw === target.raw || Boolean(base.host && target.host && base.host === target.host);
+}
+function readXiaoECredentialRecord(value, source, fallbackBaseUrl = "") {
+  const candidates = recordCandidates(value);
+  const baseUrl = candidates.map((entry) => readString(entry, "domain", "baseUrl", "base_url", "url", "host", "e10BaseUrl", "e10_base_url")).find(Boolean) || fallbackBaseUrl;
+  const rawCookie = candidates.map((entry) => cookieString(entry.cookies || entry.cookie || entry.rawCookie || entry.raw_cookie)).find(Boolean) || "";
+  const eteamsId = candidates.map((entry) => readString(entry, "eteamsId", "eteamsid", "ETEAMSID", "eteamId", "eteam_id", "eTeamId", "eteamID", "eteam_id")).find(Boolean) || cookieValue(rawCookie, "ETEAMSID");
+  if (!baseUrl || !eteamsId) return null;
+  return { baseUrl: normalizeUrl(baseUrl), eteamsId, source, rawCookie };
+}
+function parseXiaoEUnifiedLoginMap(raw, source) {
+  const value = raw.trim();
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    if (Array.isArray(parsed)) {
+      return parsed.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? readXiaoECredentialRecord(entry, source) : null).filter((entry) => Boolean(entry));
+    }
+    if (parsed && typeof parsed === "object") {
+      const record = parsed;
+      const direct = readXiaoECredentialRecord(record, source);
+      if (direct) return [direct];
+      return Object.entries(record).map(([baseUrl, entry]) => {
+        if (typeof entry === "string" || typeof entry === "number") {
+          return { baseUrl: normalizeUrl(baseUrl), eteamsId: String(entry), source };
+        }
+        if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+          return readXiaoECredentialRecord(entry, source, baseUrl);
+        }
+        return null;
+      }).filter((entry) => Boolean(entry));
+    }
+  } catch {
+  }
+  return value.split(/[;,\n]+/u).map((entry) => entry.trim()).filter(Boolean).map((entry) => {
+    const delimiter = entry.includes("|") ? "|" : entry.includes("=") ? "=" : "";
+    if (delimiter) {
+      const index = entry.indexOf(delimiter);
+      const baseUrl = entry.slice(0, index).trim();
+      const eteamsId = entry.slice(index + delimiter.length).trim();
+      return baseUrl && eteamsId ? { baseUrl: normalizeUrl(baseUrl), eteamsId, source } : null;
+    }
+    const parts = entry.split(/\s+/u).filter(Boolean);
+    return parts.length === 2 ? { baseUrl: normalizeUrl(parts[0]), eteamsId: parts[1], source } : null;
+  }).filter((entry) => Boolean(entry));
+}
+function listXiaoEUnifiedLoginCredentials(env = process.env) {
+  const candidates = [];
+  for (const key of XIAOE_UNIFIED_LOGIN_MAP_ENV_KEYS) {
+    const raw = envString(env, key);
+    if (raw) candidates.push(...parseXiaoEUnifiedLoginMap(raw, key));
+  }
+  return candidates;
+}
+function resolveXiaoEUnifiedLoginCredential(baseUrl, env = process.env) {
+  const candidates = listXiaoEUnifiedLoginCredentials(env);
+  return candidates.find((candidate) => domainMatches(baseUrl, candidate.baseUrl)) || null;
+}
+function normalizeBaseUrlValue(value) {
+  const raw = normalizeUrl(value.trim());
+  if (!raw) return "";
+  return /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+}
+function resolveXiaoEConfiguredBaseUrl(env) {
+  const explicitDefault = envString(env, ...XIAOE_DEFAULT_DOMAIN_ENV_KEYS);
+  if (explicitDefault) return normalizeBaseUrlValue(explicitDefault);
+  const singleDomain = envString(env, ...XIAOE_SINGLE_DOMAIN_ENV_KEYS);
+  if (singleDomain) return normalizeBaseUrlValue(singleDomain);
+  const firstCredential = listXiaoEUnifiedLoginCredentials(env)[0];
+  if (firstCredential?.baseUrl) return normalizeUrl(firstCredential.baseUrl);
+  return "";
+}
+function uniqueStrings(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const value of values) {
+    if (!value || seen.has(value)) continue;
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function xiaoETokenScriptCandidatePaths(env = process.env) {
+  const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY, XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY);
+  if (explicit) return [explicit];
+  if (process.platform === "win32") {
+    const localAppData = envString(env, "LOCALAPPDATA");
+    const userProfile = envString(env, "USERPROFILE");
+    return uniqueStrings([
+      localAppData ? join2(localAppData, "xiaoeUserData", "tokens.py") : "",
+      userProfile ? join2(userProfile, "AppData", "Local", "xiaoeUserData", "tokens.py") : ""
+    ]);
+  }
+  const envHome = envString(env, "HOME");
+  const nodeHome = envHome ? "" : homedir2();
+  return uniqueStrings([
+    envHome ? join2(envHome, "Library", "Application Support", "xiaoeUserData", "tokens.py") : "",
+    nodeHome ? join2(nodeHome, "Library", "Application Support", "xiaoeUserData", "tokens.py") : ""
+  ]);
+}
+function xiaoETokenScriptPath(env = process.env) {
+  return xiaoETokenScriptCandidatePaths(env).find((path) => existsSync4(path)) || "";
+}
+function xiaoEBundledEnvScriptPath() {
+  const scriptPath = packagePath("scripts", "xiaoe_env.py");
+  return existsSync4(scriptPath) ? scriptPath : "";
+}
+function hasXiaoETokenScript(env = process.env, allowLocalDiscovery = true) {
+  const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY, XIAOE_TOKEN_SCRIPT_LEGACY_ENV_KEY);
+  if (explicit) return existsSync4(explicit);
+  if (!allowLocalDiscovery) return false;
+  const scriptPath = xiaoETokenScriptPath(env);
+  return Boolean(scriptPath && existsSync4(scriptPath));
+}
+function isExecutableFile(path) {
+  try {
+    if (!statSync(path).isFile()) return false;
+    accessSync(path, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function listXiaoEPythonRuntimeDirectories(resourcesRoot) {
+  if (!resourcesRoot || !existsSync4(resourcesRoot)) return [];
+  try {
+    return readdirSync2(resourcesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^Python3(?:[-_.]\d[\d.]*)?$/iu.test(entry.name)).map((entry) => join2(resourcesRoot, entry.name)).sort((left, right) => right.localeCompare(left, void 0, { numeric: true }));
+  } catch {
+    return [];
+  }
+}
+function listExecutablePythonFiles(directory, platform) {
+  if (!directory || !existsSync4(directory)) return [];
+  try {
+    const pattern = platform === "win32" ? /^python(?:3(?:\.\d+)*)?\.exe$/iu : /^python3(?:\.\d+)*$/u;
+    return readdirSync2(directory, { withFileTypes: true }).filter((entry) => entry.isFile() && pattern.test(entry.name)).map((entry) => join2(directory, entry.name)).filter(isExecutableFile).sort((left, right) => right.localeCompare(left, void 0, { numeric: true }));
+  } catch {
+    return [];
+  }
+}
+function xiaoEClientPythonCandidates(env = process.env, platform = process.platform) {
+  const appRoots = [];
+  if (platform === "darwin") {
+    const envHome = envString(env, "HOME");
+    const nodeHome = homedir2();
+    for (const home of uniqueStrings([envHome, nodeHome])) {
+      appRoots.push(join2(home, "Applications", "\u667A\u80FD\u5C0Fe.app"));
+    }
+    appRoots.push("/Applications/\u667A\u80FD\u5C0Fe.app");
+  } else if (platform === "win32") {
+    const localAppData = envString(env, "LOCALAPPDATA");
+    const programFiles = uniqueStrings([
+      envString(env, "ProgramW6432"),
+      envString(env, "ProgramFiles"),
+      envString(env, "ProgramFiles(x86)")
+    ]);
+    const appNames = ["\u667A\u80FD\u5C0Fe", "XiaoE", "XiaoEClient", "XiaoEAI"];
+    if (localAppData) {
+      for (const appName of appNames) {
+        appRoots.push(join2(localAppData, "Programs", appName), join2(localAppData, appName));
+      }
+    }
+    for (const programFilesRoot of programFiles) {
+      for (const appName of appNames) appRoots.push(join2(programFilesRoot, appName));
+    }
+  }
+  const candidates = [];
+  for (const appRoot of uniqueStrings(appRoots)) {
+    const resourcesRoots = platform === "darwin" ? [join2(appRoot, "Contents", "Resources")] : [join2(appRoot, "Resources"), appRoot];
+    for (const resourcesRoot of resourcesRoots) {
+      for (const runtimeRoot of listXiaoEPythonRuntimeDirectories(resourcesRoot)) {
+        const executableDirectories = platform === "win32" ? [runtimeRoot, join2(runtimeRoot, "bin")] : [join2(runtimeRoot, "bin")];
+        for (const executableDirectory of executableDirectories) {
+          candidates.push(...listExecutablePythonFiles(executableDirectory, platform));
+        }
+      }
+    }
+  }
+  return uniqueStrings(candidates);
+}
+function xiaoETokenScriptPythonCandidates(env = process.env, platform = process.platform) {
+  const explicit = envString(env, XIAOE_TOKEN_SCRIPT_PYTHON_ENV_KEY, XIAOE_TOKEN_SCRIPT_PYTHON_LEGACY_ENV_KEY);
+  if (explicit) return [explicit];
+  return uniqueStrings(
+    platform === "win32" ? [...xiaoEClientPythonCandidates(env, platform), "python", "python3", "py"] : [...xiaoEClientPythonCandidates(env, platform), "python3", "/usr/bin/python3", "python"]
+  );
+}
+function isXiaoETokenScriptEnvFailure(message) {
+  return /No module named|ModuleNotFoundError|ENOENT|EACCES|permission denied|command not found|not recognized as an internal|cannot find the file/i.test(message);
+}
+async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, baseUrl, env) {
+  const wrapper = [
+    "import ast,contextlib,io,json,runpy,sys",
+    `path = ${JSON.stringify(scriptPath)}`,
+    `base_url = ${JSON.stringify(baseUrl)}`,
+    "sys.argv = [path, base_url]",
+    "buf = io.StringIO()",
+    "data = None",
+    "with contextlib.redirect_stdout(buf):",
+    '    runpy.run_path(path, run_name="__main__")',
+    "text = buf.getvalue().strip()",
+    "if text:",
+    "    lines = [line.strip() for line in text.splitlines() if line.strip()]",
+    "    candidates = [text] + (lines[-1:] if lines else [])",
+    "    last_error = None",
+    "    for candidate in candidates:",
+    "        try:",
+    "            data = json.loads(candidate)",
+    "            break",
+    "        except Exception as exc:",
+    "            last_error = exc",
+    "        try:",
+    "            data = ast.literal_eval(candidate)",
+    "            break",
+    "        except Exception as exc:",
+    "            last_error = exc",
+    "    if data is None:",
+    '        raise SystemExit("XiaoE credential script stdout is not valid JSON object")',
+    "else:",
+    '    raise SystemExit("XiaoE credential script produced empty stdout")',
+    "print(json.dumps(data, ensure_ascii=False))"
+  ].join("\n");
+  return await new Promise((resolve6, reject) => {
+    execFile(
+      pythonCommand,
+      ["-c", wrapper],
+      {
+        env,
+        timeout: XIAOE_TOKEN_SCRIPT_TIMEOUT_MS,
+        maxBuffer: 1024 * 1024
+      },
+      (error, stdout, stderr) => {
+        if (error) {
+          const detail = (stderr || error.message || "unknown error").trim().split("\n").slice(-1)[0];
+          reject(new CliError("XiaoE credential script failed: " + detail, 3 /* AuthError */));
+          return;
+        }
+        const text = stdout.trim();
+        if (!text) {
+          reject(new CliError("XiaoE credential script returned empty stdout.", 3 /* AuthError */));
+          return;
+        }
+        try {
+          const parsed = JSON.parse(text);
+          resolve6(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null);
+        } catch {
+          reject(new CliError("XiaoE credential script stdout is not valid JSON.", 3 /* AuthError */));
+        }
+      }
+    );
+  });
+}
+async function runXiaoEPythonCredentialScript(scriptPath, baseUrl, env) {
+  if (!scriptPath || !existsSync4(scriptPath)) return null;
+  let lastError = null;
+  for (const pythonCommand of xiaoETokenScriptPythonCandidates(env)) {
+    try {
+      return await runXiaoETokenScriptOnce(pythonCommand, scriptPath, baseUrl, env);
+    } catch (error) {
+      lastError = error;
+      const message = error instanceof Error ? error.message : String(error);
+      if (!isXiaoETokenScriptEnvFailure(message)) break;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new CliError("XiaoE credential script failed.", 3 /* AuthError */);
+}
+async function runXiaoETokenScript(baseUrl, env = process.env) {
+  return runXiaoEPythonCredentialScript(xiaoETokenScriptPath(env), baseUrl, env);
+}
+async function resolveXiaoETokenScriptCredential(baseUrl, env = process.env) {
+  const tokenData = await runXiaoETokenScript(baseUrl, env);
+  if (!tokenData) return null;
+  return readXiaoECredentialRecord(tokenData, "xiaoeUserData/tokens.py", baseUrl);
+}
+async function resolveXiaoEBundledEnvScriptCredential(baseUrl, env = process.env) {
+  const scriptPath = xiaoEBundledEnvScriptPath();
+  if (!scriptPath) return null;
+  const tokenData = await runXiaoEPythonCredentialScript(scriptPath, baseUrl, env);
+  if (!tokenData) return null;
+  return readXiaoECredentialRecord(tokenData, XIAOE_BUNDLED_ENV_SCRIPT_SOURCE, baseUrl);
+}
+function xiaoEClientRobotsRoot(env = process.env) {
+  if (process.platform === "win32") {
+    const localAppData = envString(env, "LOCALAPPDATA");
+    return localAppData ? join2(localAppData, "XiaoE", "Robots") : "";
+  }
+  const home = envString(env, "HOME") || homedir2();
+  return home ? join2(home, "Library", "Application Support", "XiaoE", "Robots") : "";
+}
+function isFile(path) {
+  if (!path || !existsSync4(path)) return false;
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDirectory(path) {
+  if (!path || !existsSync4(path)) return false;
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function listXiaoEClientSettingsFiles(root) {
+  if (!root) return [];
+  if (isFile(root)) return [root];
+  if (!isDirectory(root)) return [];
+  const candidates = [];
+  const addCandidate = (path) => {
+    if (isFile(path)) candidates.push(path);
+  };
+  const addChildSettings = (directory) => {
+    if (!isDirectory(directory)) return;
+    try {
+      for (const entry of readdirSync2(directory, { withFileTypes: true })) {
+        if (entry.isDirectory()) addCandidate(join2(directory, entry.name, "user_settings.json"));
+      }
+    } catch {
+    }
+  };
+  addCandidate(join2(root, "user_settings.json"));
+  addChildSettings(root);
+  const robotsRoot = join2(root, "Robots");
+  addCandidate(join2(robotsRoot, "user_settings.json"));
+  addChildSettings(robotsRoot);
+  return uniqueStrings(candidates);
+}
+function sortedXiaoEClientSettingsFiles(root) {
+  const files = listXiaoEClientSettingsFiles(root);
+  return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
+}
+function xiaoEClientSettingsCandidateFiles(env, allowLocalDiscovery = true) {
+  const candidates = [];
+  const explicitSettingsPath = envString(env, XIAOE_USER_SETTINGS_PATH_ENV_KEY);
+  if (isFile(explicitSettingsPath)) candidates.push(explicitSettingsPath);
+  for (const key of XIAOE_CLIENT_SETTINGS_ROOT_ENV_KEYS) {
+    const injectedRoot = envString(env, key);
+    candidates.push(...sortedXiaoEClientSettingsFiles(injectedRoot));
+  }
+  if (allowLocalDiscovery) {
+    candidates.push(...sortedXiaoEClientSettingsFiles(xiaoEClientRobotsRoot(env)));
+  }
+  return uniqueStrings(candidates);
+}
+function readXiaoEPlatformCredential(env = process.env) {
+  const envToken = envString(env, "XIAOE_USER_TOKEN");
+  if (!envToken) return null;
+  const rawErpa = envString(
+    env,
+    "WEAVER_XIAOE_ERP",
+    "WEAVER_XIAOE_ERPA",
+    "WEAVER_XIAOE_ERP_URL",
+    "XIAOE_ERP",
+    "XIAOE_ERPA",
+    "XIAOE_ERP_URL",
+    "XIAOE_DOMAIN"
+  );
+  const erpaUrl = normalizeBaseUrlValue(rawErpa);
+  if (!erpaUrl) return null;
+  return { authToken: envToken, erpaUrl, source: XIAOE_USER_TOKEN_SOURCE };
+}
+function hasXiaoEPlatformCredential(env = process.env) {
+  return Boolean(readXiaoEPlatformCredential(env));
+}
+function readXiaoEClientCredential(env = process.env) {
+  for (const settingsFile of xiaoEClientSettingsCandidateFiles(env)) {
+    try {
+      const parsed = JSON.parse(readFileSync3(settingsFile, "utf8"));
+      const authToken = readString(parsed, "session_id", "sessionId");
+      const erpaUrl = normalizeUrl(readString(parsed, "erpa", "erpa_url", "erpaUrl"));
+      if (authToken && erpaUrl) return { authToken, erpaUrl, source: XIAOE_CLIENT_SETTINGS_SOURCE };
+    } catch {
+    }
+  }
+  return null;
+}
+function hasXiaoEClientCredential(env = process.env, allowLocalDiscovery = true) {
+  return Boolean(xiaoEClientSettingsCandidateFiles(env, allowLocalDiscovery)[0]);
+}
+function inspectXiaoEUnifiedLoginSources(options = {}) {
+  const env = options.env || process.env;
+  const baseUrl = resolveXiaoEPreferredBaseUrl({
+    explicitBaseUrl: options.baseUrl,
+    profileBaseUrl: options.profileBaseUrl,
+    env
+  });
+  const platformCredential = hasXiaoEPlatformCredential(env);
+  const allowLocalDiscovery = options.allowLocalDiscovery !== false;
+  const tokenScript = options.allowTokenScript !== false && hasXiaoETokenScript(env, allowLocalDiscovery);
+  const clientCredential = hasXiaoEClientCredential(env, allowLocalDiscovery);
+  const environmentCredential = Boolean(baseUrl && resolveXiaoEUnifiedLoginCredential(baseUrl, env));
+  return {
+    platformCredential,
+    tokenScript,
+    clientCredential,
+    environmentCredential,
+    any: platformCredential || tokenScript || clientCredential || environmentCredential
+  };
+}
+async function fetchXiaoEClientEteamId(credential, domain) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), XIAOE_CLIENT_TOKEN_TIMEOUT_MS);
+  try {
+    let endpoint = new URL(`${credential.erpaUrl}${XIAOE_SKILL_ETEAMID_API_PATH}`);
+    let resp = null;
+    for (let redirects = 0; redirects <= 5; redirects += 1) {
+      resp = await fetch(endpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: credential.authToken
+        },
+        body: JSON.stringify({ domain: domain || DEFAULT_E10_BASE_URL }),
+        redirect: "manual",
+        signal: controller.signal
+      });
+      if (resp.status < 300 || resp.status >= 400) break;
+      if (redirects === 5) {
+        throw new CliError("XiaoE client token endpoint redirected too many times.", 3 /* AuthError */);
+      }
+      const location = resp.headers.get("location");
+      if (!location) {
+        throw new CliError("XiaoE client token endpoint returned a redirect without Location.", 3 /* AuthError */);
+      }
+      const next = new URL(location, endpoint);
+      const sameOrigin = next.origin === endpoint.origin;
+      const sameHostHttpsUpgrade = endpoint.protocol === "http:" && next.protocol === "https:" && next.hostname === endpoint.hostname;
+      const safeProtocol = next.protocol === "http:" || next.protocol === "https:";
+      if (!safeProtocol || next.username || next.password || !sameOrigin && !sameHostHttpsUpgrade) {
+        throw new CliError("XiaoE client token endpoint attempted an unsafe cross-origin redirect.", 3 /* AuthError */);
+      }
+      await resp.body?.cancel().catch(() => void 0);
+      endpoint = next;
+    }
+    if (!resp?.ok) {
+      throw new CliError(`XiaoE client token endpoint returned HTTP ${resp?.status || 0}.`, 3 /* AuthError */);
+    }
+    const data = await resp.json().catch(() => null);
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+      throw new CliError("XiaoE client token endpoint returned invalid JSON.", 3 /* AuthError */);
+    }
+    const payload = data;
+    const businessCode = payload.code;
+    const businessData = payload.data && typeof payload.data === "object" && !Array.isArray(payload.data) ? payload.data : {};
+    if (businessCode !== "0000" && businessCode !== 0 && businessCode !== 200 || !readString(businessData, "eteamId")) {
+      const codeText = businessCode === void 0 ? "missing" : String(businessCode);
+      throw new CliError(`XiaoE client token exchange failed with business code ${codeText}.`, 3 /* AuthError */);
+    }
+    return payload;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveXiaoETokenCredential(credential, baseUrl) {
+  const targetBaseUrl = baseUrl || DEFAULT_E10_BASE_URL;
+  const payload = await fetchXiaoEClientEteamId(credential, targetBaseUrl);
+  const resolvedBaseUrl = payload.code === 0 ? credential.erpaUrl : targetBaseUrl;
+  return readXiaoECredentialRecord(payload, credential.source, resolvedBaseUrl);
+}
+async function resolveXiaoEPlatformCredential(baseUrl, env = process.env) {
+  const credential = readXiaoEPlatformCredential(env);
+  if (!credential) return null;
+  return resolveXiaoETokenCredential(credential, baseUrl);
+}
+async function resolveXiaoEClientCredential(baseUrl, env = process.env) {
+  const clientCredential = readXiaoEClientCredential(env);
+  if (!clientCredential) return null;
+  return resolveXiaoETokenCredential(clientCredential, baseUrl);
+}
+function resolveXiaoEPreferredBaseUrl(options) {
+  const env = options.env || process.env;
+  const explicit = normalizeUrl(options.explicitBaseUrl || "");
+  if (explicit) return explicit;
+  const configured = resolveXiaoEConfiguredBaseUrl(env);
+  if (configured) return configured;
+  const profileBaseUrl = normalizeUrl(options.profileBaseUrl || "");
+  if (profileBaseUrl) return profileBaseUrl;
+  return DEFAULT_E10_BASE_URL;
+}
+function createXiaoEUnifiedLoginUnavailableError(baseUrl = "") {
+  const target = normalizeUrl(baseUrl);
+  const message = [
+    "XiaoE unified login did not return a usable E10 session.",
+    target ? `Resolved E10 baseUrl: ${target}.` : "No E10 baseUrl could be resolved.",
+    "The auth xiaoe command never falls back to browser OAuth.",
+    "Refresh the XiaoE web session or restore host credential injection before retrying."
+  ].join(" ");
+  return Object.assign(new CliError(message, 3 /* AuthError */), {
+    type: "authentication",
+    subtype: "xiaoe_credential_unavailable",
+    retryable: false,
+    stage: "xiaoe_unified_login"
+  });
+}
+async function resolveUserInfo(baseUrl, eteamsId, rawCookie = "", agentType = "") {
+  const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/json",
+      eteamsid: eteamsId,
+      cookie: buildE10CookieHeader(rawCookie, eteamsId, agentType),
+      "user-agent": agentType ? `AgentType=${agentType},IsAgent=true` : "weaver-work-cli",
+      origin: baseUrl
+    },
+    redirect: "manual"
+  });
+  const data = await resp.json().catch(() => ({}));
+  return { userInfo: readTeamsCheckUserInfo(resp, data), setCookie: extractRawSetCookie(resp) };
+}
+async function saveXiaoEUnifiedLogin(input) {
+  const baseUrl = normalizeUrl(input.baseUrl);
+  const { userInfo, setCookie } = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || "", XIAOE_AGENT_TYPE);
+  if (!userInfo.userId) {
+    throw new CliError("Could not resolve userId. Check whether XiaoE unified login is valid for this E10 domain.", 3 /* AuthError */);
+  }
+  const tenantKey = userInfo.tenantKey || input.tenantKeyFallback || "";
+  const profile = input.profileHint || profileNameFromUrl(baseUrl);
+  setActiveProfile(profile);
+  const cookies = { ETEAMSID: input.eteamsId };
+  if (input.rawCookie) cookies.raw = input.rawCookie;
+  const ztSession = extractSessionTicket(setCookie, input.rawCookie || "");
+  const authData = {
+    cookies,
+    userId: userInfo.userId,
+    tenantKey,
+    tenantName: userInfo.tenantName,
+    department: userInfo.department,
+    subcompany: userInfo.subcompany,
+    position: userInfo.position,
+    agentType: XIAOE_AGENT_TYPE,
+    version: "",
+    baseUrl,
+    passportUrl: baseUrl,
+    cookieSavedAt: Date.now(),
+    loginSource: "xiaoe-unified",
+    credentialSourceStep: input.credentialSource.credentialSourceStep,
+    credentialSourceType: input.credentialSource.credentialSourceType,
+    credentialSourceLabel: input.credentialSource.credentialSourceLabel,
+    ...ztSession ? { ztSession } : {}
+  };
+  const authFile = saveAuthFile(authData, profile);
+  saveProfileConfig(baseUrl, baseUrl, profile, tenantKey);
+  const session = new E10AuthSession(authData, authFile);
+  return {
+    session,
+    result: {
+      ...userInfo,
+      tenantKey,
+      eteamsId: input.eteamsId,
+      baseUrl,
+      passportUrl: baseUrl,
+      profile,
+      authFile,
+      agentType: XIAOE_AGENT_TYPE,
+      version: "",
+      loginSource: "xiaoe-unified",
+      ...input.credentialSource
+    }
+  };
+}
+async function tryXiaoEUnifiedLogin(options = {}) {
+  const env = options.env || process.env;
+  const explicitBaseUrl = normalizeUrl(options.baseUrl || "");
+  const baseUrl = resolveXiaoEPreferredBaseUrl({
+    explicitBaseUrl,
+    profileBaseUrl: options.profileBaseUrl,
+    env
+  });
+  const mayUseTokenScript = options.allowTokenScript === true;
+  if (!baseUrl && !mayUseTokenScript) return null;
+  let credential = null;
+  if (hasXiaoEPlatformCredential(env)) {
+    options.logger?.info("Trying XiaoE platform credential from XIAOE_USER_TOKEN...");
+    try {
+      credential = await resolveXiaoEPlatformCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      options.logger?.warn("XiaoE platform credential failed. " + message);
+    }
+    if (!credential) {
+      options.logger?.warn(options.allowBundledEnvScript ? "XiaoE platform credential did not return usable ETEAMSID; will try the CLI-bundled xiaoe_env.py compatibility path next." : "XiaoE platform credential did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.");
+    }
+  }
+  if (!credential && options.allowBundledEnvScript && hasXiaoEPlatformCredential(env)) {
+    const scriptPath = xiaoEBundledEnvScriptPath();
+    if (!scriptPath) {
+      options.logger?.warn("CLI-bundled xiaoe_env.py was not found; will try desktop XiaoE credential sources next.");
+    } else {
+      options.logger?.info("Trying CLI-bundled xiaoe_env.py compatibility credential...");
+      try {
+        credential = await resolveXiaoEBundledEnvScriptCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        options.logger?.warn("CLI-bundled xiaoe_env.py failed. " + message);
+      }
+      if (!credential) {
+        options.logger?.warn("CLI-bundled xiaoe_env.py did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.");
+      }
+    }
+  }
+  if (!credential && mayUseTokenScript) {
+    const tokenScriptPath = xiaoETokenScriptPath(env);
+    if (!tokenScriptPath) {
+      options.logger?.warn("XiaoE token script not found. Expected xiaoeUserData/tokens.py; will try the local XiaoE client session next.");
+    } else {
+      options.logger?.info("Trying XiaoE token script credential...");
+      try {
+        credential = await resolveXiaoETokenScriptCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        options.logger?.warn("XiaoE token script failed. " + message);
+      }
+      if (!credential) {
+        options.logger?.warn("XiaoE token script did not return usable ETEAMSID; will try the local XiaoE client session next.");
+      }
+    }
+    if (!credential && hasXiaoEClientCredential(env)) {
+      options.logger?.info("Trying built-in XiaoE client session credential...");
+      try {
+        credential = await resolveXiaoEClientCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        options.logger?.warn("Built-in XiaoE client credential failed. " + message);
+      }
+      if (!credential) {
+        options.logger?.warn("Built-in XiaoE client credential did not return usable ETEAMSID; will try WEAVER_XIAOE_* credentials next.");
+      }
+    }
+  }
+  if (!credential && baseUrl) credential = resolveXiaoEUnifiedLoginCredential(baseUrl, env);
+  if (!credential) return null;
+  options.logger?.info("Detected XiaoE unified login for this E10 domain. Trying XiaoE auth...");
+  try {
+    return await saveXiaoEUnifiedLogin({
+      baseUrl: credential.baseUrl || baseUrl || DEFAULT_E10_BASE_URL,
+      eteamsId: credential.eteamsId,
+      rawCookie: credential.rawCookie,
+      tenantKeyFallback: options.tenantKeyFallback,
+      profileHint: options.profileHint,
+      credentialSource: describeXiaoECredentialSource(credential.source)
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    options.logger?.warn("XiaoE unified login failed. " + message);
+    return null;
+  }
+}
+
+export {
+  packagePath,
+  packageFileUrl,
+  normalizeGlobalOptions,
+  getE10AuthRoot,
+  getActiveProfile,
+  setActiveProfile,
+  switchActiveProfile,
+  listProfiles,
+  getProfileDir,
+  getProfileAuthPath,
+  profileNameFromUrl,
+  readProfileConfig,
+  saveProfileConfig,
+  saveAuthFile,
+  clearProfileAuthFile,
+  findAuthFile,
+  readTeamsCheckUserInfo,
+  buildE10CookieHeader,
+  extractRawSetCookie,
+  extractSessionTicket,
+  E10AuthSession,
+  E10_REAUTH_GUIDANCE,
+  E10_AUTH_REQUIRED_MESSAGE,
+  E10_SESSION_EXPIRED_MESSAGE,
+  XIAOE_AGENT_TYPE,
+  hasXiaoEEnv,
+  inspectXiaoEUnifiedLoginSources,
+  resolveXiaoEPreferredBaseUrl,
+  createXiaoEUnifiedLoginUnavailableError,
+  tryXiaoEUnifiedLogin
+};