weaver-work-cli 0.1.33 → 0.1.38

package/dist/shortcuts/caizhilian/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { CaizhilianCliError, caizhilianAuthError, caizhilianNetworkError, caizhilianValidationError, } from './errors.js';
 /** 业务请求默认超时（源 assets/config.json：http.timeout = 12 秒）。 */
 export const CAIZHILAN_TIMEOUT_MS = 12_000;
@@ -152,7 +153,7 @@ export function createCaizhilianHost(ctx, dependencies = {}) {
     }
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw caizhilianAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -183,7 +184,7 @@ export function createCaizhilianHost(ctx, dependencies = {}) {
     }
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw caizhilianAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {

package/dist/shortcuts/calendar/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { calendarAuthError, calendarNetworkError, CalendarCliError, calendarValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -110,7 +111,7 @@ export function createCalendarHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw calendarAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/contract/host.js

@@ -1,6 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { basename } from 'node:path';
 import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
+import { isE10SessionExpiredResponse, } from '../../internal/e10/auth-recovery.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime, } from '../../internal/e10/request-runtime.js';
@@ -179,7 +180,7 @@ export function createContractHost(ctx, dependencies = {}) {
             }
             throw error;
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw contractAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status, path });
         }
         const { text, value } = response;

package/dist/shortcuts/cowork/host.js

@@ -2,7 +2,9 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { CoworkCliError, coworkAuthError, coworkNetworkError, coworkValidationError } from './errors.js';
+import { coworkPerf } from './operations/types.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
     return options.profile || getActiveProfile();
@@ -97,7 +99,9 @@ export function createCoworkHost(ctx, dependencies = {}) {
         || ((innerCtx) => requireE10Session(innerCtx, { skipProfileEnrichment: true }));
     async function ensureSession() {
         if (!e10Session) {
+            const sessionStart = Date.now();
             e10Session = await requireSession(ctx);
+            coworkPerf.sessionMs = Date.now() - sessionStart;
             sessionContext = {
                 baseUrl: e10Session.getBaseUrl(),
                 profile: inferProfile(ctx),
@@ -123,6 +127,7 @@ export function createCoworkHost(ctx, dependencies = {}) {
         assertPath(path);
         const resolvedMethod = method || (body === undefined && form === undefined ? 'GET' : 'POST');
         let response;
+        const reqStart = Date.now();
         try {
             response = await (await runtime()).requestJson({
                 module: 'cowork',
@@ -139,7 +144,11 @@ export function createCoworkHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        finally {
+            coworkPerf.requestCount += 1;
+            coworkPerf.requestMs += Date.now() - reqStart;
+        }
+        if (isE10SessionExpiredResponse(response)) {
             throw coworkAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/cowork/operations/types.js

@@ -1,10 +1,25 @@
 export const READ = 'read';
 export const READ_BEFORE_WRITE = 'read-before-write';
 export const WRITE = 'write';
+/** 进程内耗时收集器（周军锋 2026-10-20 要求：全链路耗时可量化）。host 写入、coworkSuccess 注出；内部诊断字段不进回答。 */
+export const coworkPerf = {
+    t0: Date.now(),
+    sessionMs: 0,
+    requestCount: 0,
+    requestMs: 0,
+};
 export function coworkSuccess(action, data, meta) {
     const payload = { ok: true, action, data };
-    if (meta && Object.keys(meta).length > 0)
-        payload.meta = meta;
+    const perf = {
+        elapsed_ms: Date.now() - coworkPerf.t0,
+        session_ms: coworkPerf.sessionMs || undefined,
+        requests: coworkPerf.requestCount || undefined,
+        network_ms: coworkPerf.requestMs || undefined,
+    };
+    for (const k of Object.keys(perf))
+        if (perf[k] === undefined)
+            delete perf[k];
+    payload.meta = { ...(meta || {}), ...perf };
     return payload;
 }
 /** 构造「对象类型 + 严格禁止额外字段」的 JSON Schema。 */

package/dist/shortcuts/ebuilder-form/host.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { requireE10Session } from '../../internal/e10/context.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
 import { ebuilderAuthError, ebuilderBusinessError, ebuilderNetworkError, ebuilderValidationError, } from './errors.js';
@@ -231,7 +232,8 @@ export function createEbuilderFormHost(ctx) {
             headers: options.headers,
             bigIntStrings: options.bigIntStrings ?? true,
         });
-        if ([302, 401, 403].includes(response.status)) {
+        // 403 在 eBuilder 这里偏「无权」，3xx 只有跳到登录页才算登录失效（文件服务交接不算）。
+        if (isE10SessionExpiredResponse(response) || response.status === 403) {
             throw ebuilderAuthError('session_expired', 'E10 登录态已失效或当前账号无权访问该 eBuilder 数据', { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/ehr/host.js

@@ -3,6 +3,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ehrAuthError, ehrNetworkError, EhrCliError, ehrValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -165,7 +166,7 @@ export function createEhrHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ehrAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/ehr/operations/recruit-write.js

@@ -28,6 +28,31 @@ async function requireRecruitCache(env) {
     }
     return env.recruitContext.load(env.host);
 }
+// ── 产物链接（2026-10-29 周军锋要求：写操作完成后自动生成链接返回对话框）──
+// URL 模板与 recruit-stage 脚本同源：人才卡片 /sp/ebdpage/view/{ebdDetailPageId}?talentId=（实证）；
+// 列表滑出 /sp/ebdfpage/list/{listId}/card/0/{objId}/{dataId}/{listId}?id={dataId}&openSource=field&openSourceId={dataId}&openSourceAppId={appId}（面试管理实证，offer/entry 同构未单独实测）；
+// 列表直开 /sp/ebdfpage/list/{listId}[?talentId=]（candidate.import 同构）。全部取自环境缓存，id 缺失返回 null 不编造。
+function recruitTalentCardUrl(cache, baseUrl, talentId) {
+    if (!cache.ebdDetailPageId || !talentId)
+        return null;
+    const extra = String(cache.selfUse) === "1" ? "&recruitType=useSelf" : "";
+    return `${baseUrl.replace(/\/+$/, "")}/sp/ebdpage/view/${cache.ebdDetailPageId}?talentId=${talentId}${extra}`;
+}
+function recruitSlideLocateUrl(cache, baseUrl, listKey, formKey, dataId) {
+    const listId = cache.lists?.[listKey]?.listId;
+    const objId = cache.forms?.[formKey]?.objId;
+    if (!listId || !objId || !dataId || !cache.appId)
+        return null;
+    const base = baseUrl.replace(/\/+$/, "");
+    return `${base}/sp/ebdfpage/list/${listId}/card/0/${objId}/${dataId}/${listId}?id=${dataId}&openSource=field&openSourceId=${dataId}&openSourceAppId=${cache.appId}`;
+}
+function recruitOpenListUrl(cache, baseUrl, listKey, talentId) {
+    const menu = cache.lists?.[listKey];
+    if (!menu?.listId)
+        return null;
+    const extra = talentId ? `?talentId=${talentId}${String(cache.selfUse) === "1" ? "&recruitType=useSelf" : ""}` : "";
+    return `${baseUrl.replace(/\/+$/, "")}/sp/ebdfpage/list/${menu.listId}${extra}`;
+}
 /** 建前查重：按手机号搜人才库（total 恒 0 平台缺陷，以 data.data[] 非空为准）。 */
 export async function checkDuplicateByMobile(env, cache, mobile) {
     const talent = cache.lists.talent;
@@ -501,6 +526,8 @@ const candidateCreateApply = {
             talentId: newId,
             initTalentBatch: initMsg,
             searchHint: `可用 ehr.recruit.candidate.search 按 name=${name} 或 mobile=${mobile} 回查`,
+            talentCardUrl: recruitTalentCardUrl(cache, lease.baseUrl, newId),
+            talentListLocateUrl: recruitOpenListUrl(cache, lease.baseUrl, 'talent', newId),
         });
     },
 };
@@ -713,6 +740,8 @@ const interviewArrangeApply = {
             candidate: `${plan.candidateName}（talentId=${args.talentId}）`,
             time: plan.interviewTime,
             interviewer: plan.interviewer,
+            talentCardUrl: recruitTalentCardUrl(cache, lease.baseUrl, args.talentId),
+            interviewLocateUrl: recruitSlideLocateUrl(cache, lease.baseUrl, 'interview', 'interview_plan', planFormId),
         });
     },
 };
@@ -962,6 +991,8 @@ const offerSendApply = {
             sendOffer: 'SUCCESS',
             runEsb: { successNum: esbResult.successNum, failNum: esbResult.failNum, msg: esbResult.successMsg },
             nextStep: '回查 offer_status_select 应已变更为「已发送待反馈」',
+            talentCardUrl: recruitTalentCardUrl(cache, lease.baseUrl, payload.talentId),
+            offerListUrl: recruitOpenListUrl(cache, lease.baseUrl, 'offer'),
         });
     },
 };
@@ -1241,6 +1272,7 @@ const entryProcessApply = {
             saveEstPreEntry: '已落账号',
             runEsb: { successNum: esbResult.successNum, failNum: esbResult.failNum, msg: esbResult.successMsg },
             nextStep: '回查入职列表 transact_status 应由 1 变为 2',
+            entryListUrl: recruitOpenListUrl(cache, lease.baseUrl, 'entry'),
         });
     },
 };
@@ -1463,6 +1495,7 @@ const feedbackEditApply = {
                 ? { result: backFeedback.result, comment: backFeedback.judgement, changed }
                 : '回查未取到该反馈',
             ...(changed ? {} : { warning: '回查未确认变更生效，请人工在 E10 中核对面试反馈，禁止自动重试' }),
+            talentCardUrl: recruitTalentCardUrl(cache, lease.baseUrl, payload.talentId),
         });
     },
 };
@@ -1581,6 +1614,7 @@ const feedbackUrgeApply = {
         requireConfirm(args, 'ehr.recruit.candidate.interview.feedback.urge.apply');
         const lease = await verifyLease(args, 'ehr.recruit.candidate.interview.feedback.urge.apply', env);
         const payload = (lease.payload || {});
+        const cache = await requireRecruitCache(env);
         if (!payload.feedbackRecordId || !payload.esbActionId || !payload.interviewDetailObjId) {
             throw ehrValidationError('continuation_payload_invalid', 'continuation 缺少催评参数，请重新执行 prepare');
         }
@@ -1602,6 +1636,7 @@ const feedbackUrgeApply = {
             status: 'COMPLETE',
             feedbackRecordId: payload.feedbackRecordId,
             runEsb: { successNum: esbResult.successNum, failNum: esbResult.failNum, msg: esbResult.successMsg },
+            talentCardUrl: recruitTalentCardUrl(cache, lease.baseUrl, payload.talentId),
         });
     },
 };

package/dist/shortcuts/ehr/operations/recruit.js

@@ -698,6 +698,152 @@ const candidateList = {
         });
     },
 };
+/** 当前登录人姓名（teamsCheck → currentUser.username），用于「我作为面试官」匹配 */
+/** 人员字段可能是 JSON 数组串（[{name,id,...}]）→ 取姓名连接；纯文本原样返回 */
+function personNames(value) {
+    const text = String(value ?? '').trim();
+    if (!text)
+        return '';
+    if (text.startsWith('[')) {
+        try {
+            const arr = JSON.parse(text);
+            if (Array.isArray(arr)) {
+                const names = arr
+                    .map((item) => (typeof item === 'string' ? item : item?.name ?? item?.username ?? ''))
+                    .filter(Boolean);
+                if (names.length)
+                    return names.join('、');
+            }
+        }
+        catch { /* 非 JSON，按纯文本处理 */ }
+    }
+    return text;
+}
+/** 展示名兜底：跨基线 displayData 会把关联字段直接给名字（talent_id=人名、position_manage_id=职位名）；纯 16 位以上数字视为 id，不当名字用 */
+function nameLike(value) {
+    const text = String(value ?? '').trim();
+    if (!text || /^\d{16,}$/.test(text))
+        return null;
+    return text;
+}
+async function resolveCurrentUserName(host) {
+    // teamsCheck 的响应不被 isBusinessSuccess 认可（无 status 字段），故直接 fetch，绕开业务判定
+    try {
+        const session = await host.getSession();
+        const baseUrl = String(session?.baseUrl || '');
+        if (!baseUrl)
+            return '';
+        const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/json',
+                eteamsid: String(session?.eteamsId || ''),
+                cookie: typeof session?.cookieHeader === 'function' ? session.cookieHeader() : '',
+                'user-agent': typeof session?.uaHeader === 'function' ? session.uaHeader() : 'weaver-work-cli',
+                origin: baseUrl,
+            },
+            redirect: 'manual',
+        });
+        const data = await resp.json().catch(() => ({}));
+        const cu = data.currentUser ?? data.data?.currentUser ?? null;
+        return cu ? String(cu.username ?? cu.id ?? '') : '';
+    }
+    catch {
+        return '';
+    }
+}
+const interviewFeedbackTodo = {
+    name: 'ehr.recruit.interview.feedbackTodo',
+    resource: 'recruit',
+    method: 'interview.feedbackTodo',
+    action: 'ehr.recruit.interview.feedbackTodo',
+    summary: '面试待办：**只返回我作为面试官的 AI 面试待反馈清单**（候选人已答完、已有录像、我还没填意见）；按需翻页 + 客户端筛选，不返回全量面试',
+    capability: 'recruit',
+    risk: READ,
+    inputSchema: schemaOf({
+        maxPages: { type: 'integer', minimum: 1, maximum: 50, description: '最多翻页数（默认 5）' },
+        pageSize: { type: 'integer', minimum: 1, maximum: 200, description: '单页条数（默认 200，实测服务端上限 200）' },
+    }),
+    handler: async (args, env) => {
+        if (!env.recruitContext)
+            throw ehrValidationError('recruit_context_unavailable', '招聘上下文加载器未初始化');
+        const cache = await env.recruitContext.load(env.host);
+        const listParam = cache.lists.interview;
+        const form = cache.forms.interview_plan;
+        if (!listParam?.listId || !form?.objId) {
+            throw new RecruitContextError('recruit_list_unavailable', '当前环境未启用「面试管理」功能（未找到面试列表/表单参数，按能力探测拦截）。');
+        }
+        const pageSize = toNumber(args.pageSize, 'pageSize') ?? 200;
+        const maxPages = toNumber(args.maxPages, 'maxPages') ?? 5;
+        const me = await resolveCurrentUserName(env.host);
+        // 枚举可能回退成 optionId：用环境缓存的 field_options 运行时映射回中文（不写死 id）
+        const fields = cache.fields[form.objId] || {};
+        const fieldOpts = cache.field_options[form.objId] || {};
+        const statusOpts = fieldOpts[fields.union_status] || {};
+        const typeOpts = fieldOpts[fields.interview_type] || {};
+        const toCn = (map, raw) => {
+            const text = String(raw ?? '');
+            return map[text] ?? text;
+        };
+        const statusOf = (row) => toCn(statusOpts, row?.union_status_key ?? row?.union_status);
+        const typeOf = (row) => toCn(typeOpts, row?.interview_type_key ?? row?.interview_type);
+        const interviewerOf = (row) => personNames(row?.interviewer);
+        const scanned = [];
+        let lastPageCount = 0;
+        for (let i = 0; i < maxPages; i++) {
+            const body = buildListBody({
+                listId: listParam.listId,
+                cusMenuId: listParam.cusMenuId,
+                menuName: listParam.menuName || '面试管理',
+                title: '面试管理',
+                current: i + 1,
+                pageSize,
+            });
+            const page = await fetchListRows(env.host, form.objId, listParam.listId, body);
+            const use = page.displayRows && page.displayRows.length ? page.displayRows : page.rows;
+            scanned.push(...use);
+            lastPageCount = use.length;
+            if (use.length < pageSize)
+                break;
+        }
+        // 「待反馈」= 后端 InterviewStatusEnum.TO_FEEDBACK：
+        // AI 面试结束时间已过 且（有录像附件 或 已开始录制）且 反馈结果为空
+        // ⇒ 这个状态本身就等于「已完成 + 有视频 + 未填意见」，无需再读视频字段
+        const pending = scanned.filter((row) => /待反馈/.test(statusOf(row)));
+        const mineAll = me ? pending.filter((row) => interviewerOf(row).includes(me)) : [];
+        const mineAi = mineAll.filter((row) => /AI\s*面试/i.test(typeOf(row)));
+        const slim = (row) => ({
+            form_data_id: row?.form_data_id ?? row?.id ?? null,
+            candidate_name: nameLike(row?.candidate_name) ?? nameLike(row?.talent_id) ?? nameLike(row?.name),
+            position_name: nameLike(row?.position_name) ?? nameLike(row?.position_manage_id),
+            start_time: row?.start_time ?? null,
+            interview_type_key: typeOf(row) || null,
+            interview_session: row?.interview_session ?? null,
+            interviewer: interviewerOf(row) || null,
+            union_status_key: statusOf(row) || null,
+            subject: row?.subject ?? null,
+            talent_id: row?.talent_id ?? null,
+            position_manage_id: row?.position_manage_id ?? null,
+        });
+        const notes = [];
+        if (!me)
+            notes.push('未能解析当前登录人姓名（teamsCheck 失败），无法按面试官过滤');
+        if (lastPageCount >= pageSize && scanned.length >= pageSize * maxPages) {
+            notes.push(`已扫描 ${scanned.length} 条（达 maxPages=${maxPages} 上限），如怀疑遗漏可加大 maxPages`);
+        }
+        return ehrSuccess('ehr.recruit.interview.feedbackTodo', {
+            currentUser: me || null,
+            scanned: scanned.length,
+            myAiPendingFeedback: { count: mineAi.length, rows: mineAi.map(slim) },
+            myOtherPendingFeedback: {
+                count: mineAll.length - mineAi.length,
+                rows: mineAll.filter((row) => !/AI\s*面试/i.test(typeOf(row))).map(slim),
+            },
+            ...(notes.length ? { note: notes.join('；') } : {}),
+        });
+    },
+};
 const candidateCard = {
     name: 'ehr.recruit.candidate.card',
     resource: 'recruit',
@@ -815,6 +961,7 @@ export const recruitOperations = [
     candidateSearch,
     candidateList,
     candidateCard,
+    interviewFeedbackTodo,
 ];
 export const RECRUIT_SECOND_PHASE_WITHHELD = [
     'recruit.candidate.create',

package/dist/shortcuts/esb/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { EsbCliError, esbApiError, esbAuthError, esbNetworkError, esbPermissionError, esbValidationError, esbWriteUncertain, } from './errors.js';
 /** 源接口文档给出的去域名路径；域名与认证由 E10 会话层托管。 */
 export const ESB_PATHS = {
@@ -117,7 +118,7 @@ export function createEsbHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw esbAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/fna/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { FnaCliError, fnaAuthError, fnaNetworkError, fnaValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -116,7 +117,7 @@ export function createFnaHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw fnaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/fna/operations/expense-chart.js

@@ -8,6 +8,8 @@ const MAX_ROWS_LIMIT = 5000;
 const USER_INPUT_LIMIT = 500;
 const BLOCKED_MESSAGE = /拦截|高危|安全校验/;
 const CLARIFY_MESSAGE = /不明确|请补充|补充查询/;
+/** 权限类文案：命中即视为数据权限不足，Agent 必须停在原地，不得改调其它接口拼数据。 */
+const PERMISSION_DENIED_MESSAGE = /权限|越权/;
 function requireUserInput(value) {
     if (typeof value !== 'string' || value.trim().length === 0) {
         throw fnaValidationError('user_input_required', 'userInput 必填（自然语言问题，不能为空白）');
@@ -65,16 +67,23 @@ function collectColumns(rows) {
     }
     return columns;
 }
+/**
+ * 按文案推断字符串 data 的语义。
+ * 权限类文案优先归类为 clarify：服务端可能只返回「无数据权限」而不带「不明确」，
+ * 若落进 unexpected，Agent 会误判为无非预期形态，进而换问法或改调其它接口拼数据。
+ */
 function classifyMessage(message) {
+    if (PERMISSION_DENIED_MESSAGE.test(message))
+        return { kind: 'clarify', permissionDenied: true };
     if (BLOCKED_MESSAGE.test(message))
-        return 'blocked';
+        return { kind: 'blocked', permissionDenied: false };
     if (CLARIFY_MESSAGE.test(message))
-        return 'clarify';
+        return { kind: 'clarify', permissionDenied: false };
     return undefined;
 }
 /**
  * 归一化 getExpenseChart 的 data。code 恒为 200，成败只看 data 形态：
- * 对象数组 → rows/empty；追问/安全拦截文案 → clarify/blocked（按文案推断）；其余 → unexpected。
+ * 对象数组 → rows/empty；追问/安全拦截/无权限文案 → clarify/blocked（按文案推断，无权限额外标 permissionDenied）；其余 → unexpected。
  * maxRows 只截断本地返回，列名仍按服务端全量结果收集。
  */
 function normalizeChart(data, maxRows) {
@@ -107,9 +116,12 @@ function normalizeChart(data, maxRows) {
         });
     }
     if (typeof data === 'string') {
-        const kind = classifyMessage(data);
-        if (kind) {
-            return fnaSuccess('fna.expense.chart', { kind, message: data }, { messageKindInferred: true });
+        const classified = classifyMessage(data);
+        if (classified) {
+            return fnaSuccess('fna.expense.chart', { kind: classified.kind, message: data }, {
+                messageKindInferred: true,
+                permissionDenied: classified.permissionDenied,
+            });
         }
     }
     return fnaSuccess('fna.expense.chart', { kind: 'unexpected' }, { dataType: dataTypeOf(data) });
@@ -124,7 +136,7 @@ const fnaExpenseChart = {
     resource: 'expense',
     method: 'expense.chart',
     action: 'fna.expense.chart',
-    summary: '报销报表 AI 问答：用自然语言查询分组/排名/趋势，返回 kind=rows/empty/clarify/blocked/unexpected；maxRows 只截断本地展示',
+    summary: '报销报表 AI 问答：用自然语言查询分组/排名/趋势，返回 kind=rows/empty/clarify/blocked/unexpected；无权限文案额外返回 meta.permissionDenied=true，此时必须停住、不得改调其它接口拼数据；maxRows 只截断本地展示',
     capability: 'expense-chart',
     risk: READ,
     inputSchema: schemaOf({

package/dist/shortcuts/hrm/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { HrmCliError, hrmAuthError, hrmNetworkError, hrmValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -114,7 +115,7 @@ export function createHrmHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw hrmAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/im/host.js

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { dirname, extname, resolve } from 'node:path';
 import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
+import { isE10SessionExpiredResponse, } from '../../internal/e10/auth-recovery.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -121,7 +122,7 @@ export function createImHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw imAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -182,7 +183,7 @@ export function createImHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw imAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE);
         }
         if (response.status !== 200) {

package/dist/shortcuts/index.js

@@ -130,6 +130,11 @@ export const builtinShortcuts = [
         description: '泛微E10采知连（文档中心）CLI',
         load: async () => (await import('./caizhilian/index.js')).caizhilianShortcut,
     }),
+    lazyShortcut({
+        name: 'contract',
+        description: '泛微E10今承达合同管理 CLI',
+        load: async () => (await import('./contract/index.js')).contractShortcut,
+    }),
 ];
 /** 全部 shortcut 的 CLI 元数据（不触发任何实现模块加载）。 */
 export function shortcutMetadata() {

package/dist/shortcuts/invoice/host.js

@@ -4,6 +4,7 @@ import { E10_REAUTH_GUIDANCE, E10_SESSION_EXPIRED_MESSAGE } from '../../internal
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { InvoiceCliError, invoiceAuthError, invoiceNetworkError, invoiceValidationError, } from './errors.js';
 const MAX_DOWNLOAD_BYTES = 50 * 1024 * 1024;
 const TOKEN_SERVICE = 'cn.weaver.weaver-work-cli.invoice-token';
@@ -199,7 +200,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -258,7 +259,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -293,7 +294,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -320,7 +321,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         const contentType = response.contentType;

package/dist/shortcuts/jiuchuanhui/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { JiuchuanhuiCliError, jiuchuanhuiAuthError, jiuchuanhuiNetworkError, jiuchuanhuiValidationError, } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -127,7 +128,7 @@ export function createJiuchuanhuiHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw jiuchuanhuiAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {