weaver-work-cli 0.1.33 → 0.1.38

package/dist/index.js

@@ -7,12 +7,12 @@ import {
   firstPositionalToken,
   registerCommands,
   toCommandMetadata
-} from "./chunks/chunk-GFPXQIY2.js";
+} from "./chunks/chunk-VRYHGG6O.js";
 import "./chunks/chunk-EG6ZU444.js";
 import "./chunks/chunk-AJ62BGAW.js";
-import "./chunks/chunk-EEWPQE3O.js";
-import "./chunks/chunk-6ATGWRZM.js";
-import "./chunks/chunk-D223PTXU.js";
+import "./chunks/chunk-FUWVHMVV.js";
+import "./chunks/chunk-UZZBA6PV.js";
+import "./chunks/chunk-OJQUJZQF.js";
 import "./chunks/chunk-LUSPKZKY.js";
 import "./chunks/chunk-BUSC6UAE.js";
 
@@ -29,7 +29,7 @@ function lazyShortcut(definition) {
       placeholder.allowExcessArguments(true);
       placeholder.helpOption(false);
       placeholder.action(async () => {
-        const { dispatchLazyShortcut } = await import("./chunks/lazy-dispatch-RNS4EE4S.js");
+        const { dispatchLazyShortcut } = await import("./chunks/lazy-dispatch-NMYEIHRH.js");
         await dispatchLazyShortcut(definition, shortcutMetadata());
       });
     }
@@ -39,107 +39,112 @@ var builtinShortcuts = [
   lazyShortcut({
     name: "invoice",
     description: "E10 \u4E1A\u7968\u901A\u53D1\u7968\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/invoice-AOXWJKYT.js")).invoiceShortcut
+    load: async () => (await import("./chunks/invoice-HWVSXGX6.js")).invoiceShortcut
   }),
   lazyShortcut({
     name: "ehr",
     description: "\u6CDB\u5FAEE10\u805A\u624D\u6797\uFF08\u4EBA\u4E8B/\u51FA\u52E4/\u85AA\u916C\uFF09CLI",
-    load: async () => (await import("./chunks/ehr-WFOC3B4D.js")).ehrShortcut
+    load: async () => (await import("./chunks/ehr-2STW5ILH.js")).ehrShortcut
   }),
   lazyShortcut({
     name: "cowork",
     description: "\u6CDB\u5FAEE10\u534F\u4F5C\u533A\uFF08\u534F\u4F5C\u4E8B\u9879/\u8BA8\u8BBA/\u5BA1\u6279/\u5171\u4EAB\u6743\u9650\uFF09CLI",
-    load: async () => (await import("./chunks/cowork-CKWYHXYB.js")).coworkShortcut
+    load: async () => (await import("./chunks/cowork-BLG62BL2.js")).coworkShortcut
   }),
   lazyShortcut({
     name: "archive",
     description: "E10 \u6587\u4E66\u5B9A\u6863\u6848\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/archive-FVFY6GZN.js")).archiveShortcut
+    load: async () => (await import("./chunks/archive-PDV724YK.js")).archiveShortcut
   }),
   lazyShortcut({
     name: "archive-oa",
     description: "E10 \u6863\u6848\u5B9A\u4F4D\u4E0E OA \u5546\u52A1\u5408\u540C\u501F\u9605 CLI",
-    load: async () => (await import("./chunks/archive-oa-NW3OD4UV.js")).archiveOaShortcut
+    load: async () => (await import("./chunks/archive-oa-4XE4MNXQ.js")).archiveOaShortcut
   }),
   lazyShortcut({
     name: "calendar",
     description: "\u6CDB\u5FAEE10\u65E5\u7A0B\u7BA1\u7406 CLI\uFF08\u521B\u5EFA/\u67E5\u8BE2/\u66F4\u65B0/\u5220\u9664/\u5B57\u5178\uFF09",
-    load: async () => (await import("./chunks/calendar-7KXE4ED3.js")).calendarShortcut
+    load: async () => (await import("./chunks/calendar-FG4BAZHE.js")).calendarShortcut
   }),
   lazyShortcut({
     name: "fna",
     description: "\u6CDB\u5FAEE10\u9F50\u4E1A\u6210\u8D39\u63A7\u4E2D\u5FC3\uFF08\u9884\u7B97/\u8D39\u7528\u4E2D\u5FC3/\u501F\u6B3E\u7BA1\u7406/\u53D1\u7968\u6838\u9500\uFF09CLI",
-    load: async () => (await import("./chunks/fna-F7QRIIZC.js")).fnaShortcut
+    load: async () => (await import("./chunks/fna-6RCY4NU5.js")).fnaShortcut
   }),
   lazyShortcut({
     name: "hrm",
     description: "\u6CDB\u5FAEE10\u7EC4\u7EC7\u7BA1\u7406\uFF08\u5458\u5DE5/\u7EC4\u7EC7/\u5C97\u4F4D\u67E5\u8BE2\uFF09CLI",
-    load: async () => (await import("./chunks/hrm-NI6XAKW5.js")).hrmShortcut
+    load: async () => (await import("./chunks/hrm-PKJ6ELSH.js")).hrmShortcut
   }),
   lazyShortcut({
     name: "mail",
     description: "\u6CDB\u5FAEE10\u90AE\u4EF6\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/mail-VDHJAB4O.js")).mailShortcut
+    load: async () => (await import("./chunks/mail-B42RRU7G.js")).mailShortcut
   }),
   lazyShortcut({
     name: "meeting",
     description: "\u6CDB\u5FAEE10\u4F1A\u8BAE\u7BA1\u7406 CLI\uFF08\u6807\u51C6\u7248\uFF1A\u67E5\u8BE2/\u51B2\u7A81/\u9884\u7EA6/\u56DE\u6267/\u7B7E\u5230\uFF09",
-    load: async () => (await import("./chunks/meeting-GA7XCNNP.js")).meetingShortcut
+    load: async () => (await import("./chunks/meeting-CFYVBJSS.js")).meetingShortcut
   }),
   lazyShortcut({
     name: "okr",
     description: "\u6CDB\u5FAEE10 OKR \u76EE\u6807\u7BA1\u7406 CLI\uFF08\u76EE\u6807\u67E5\u8BE2/\u65B0\u5EFA/\u7F16\u8F91\u3001\u5173\u952E\u6210\u679C\u3001\u76EE\u6807\u5BF9\u9F50\u3001\u8BC4\u8BBA\uFF09",
-    load: async () => (await import("./chunks/okr-TQIRERPQ.js")).okrShortcut
+    load: async () => (await import("./chunks/okr-GCLF6V7W.js")).okrShortcut
   }),
   lazyShortcut({
     name: "plan",
     description: "\u6CDB\u5FAEE10\u8BA1\u5212\u62A5\u544A CLI\uFF08\u67E5\u8BE2/\u65B0\u5EFA/\u4FEE\u6539/\u53D1\u5E03/\u64A4\u56DE/\u63D0\u4EA4\u63D0\u9192/\u8BC4\u8BBA\uFF09",
-    load: async () => (await import("./chunks/plan-4RY4LN2P.js")).planShortcut
+    load: async () => (await import("./chunks/plan-ZVL7GBRI.js")).planShortcut
   }),
   lazyShortcut({
     name: "esb",
     description: "\u6CDB\u5FAEE10 ESB \u4E2D\u5FC3\u81EA\u5B9A\u4E49\u89E6\u53D1\u52A8\u4F5C\u6D41 CLI",
-    load: async () => (await import("./chunks/esb-LJZTN663.js")).esbShortcut
+    load: async () => (await import("./chunks/esb-UUDQUNKY.js")).esbShortcut
   }),
   lazyShortcut({
     name: "ebuilder-form",
     description: "\u6CDB\u5FAEE10 eBuilder \u8868\u5355\u83DC\u5355\u3001\u5217\u8868\u548C\u8868\u5355\u6570\u636E CLI",
-    load: async () => (await import("./chunks/ebuilder-form-KOLJRVZD.js")).ebuilderFormShortcut
+    load: async () => (await import("./chunks/ebuilder-form-NUKG5QW4.js")).ebuilderFormShortcut
   }),
   lazyShortcut({
     name: "jiuchuanhui",
     description: "\u6CDB\u5FAEE10\u4E5D\u6C1A\u6C47\u8425\u9500\u7BA1\u7406 CLI\uFF08\u5BA2\u6237/\u8054\u7CFB\u4EBA/\u5546\u673A/\u7EBF\u7D22/\u8054\u7CFB\u8BA1\u5212/\u516C\u6D77\uFF09",
-    load: async () => (await import("./chunks/jiuchuanhui-7NQWEZAW.js")).jiuchuanhuiShortcut
+    load: async () => (await import("./chunks/jiuchuanhui-L7VKILZB.js")).jiuchuanhuiShortcut
   }),
   lazyShortcut({
     name: "asset",
     description: "E10 \u8D44\u4EA7\u7BA1\u7406\uFF08\u8D44\u7BA1\u5BB6\uFF09CLI",
-    load: async () => (await import("./chunks/asset-7QJKMIDV.js")).assetShortcut
+    load: async () => (await import("./chunks/asset-PDL2QE2N.js")).assetShortcut
   }),
   lazyShortcut({
     name: "im",
     description: "\u6CDB\u5FAEE10\u6613\u79D2\u529E\uFF08\u5373\u65F6\u901A\u8BAF\uFF09CLI",
-    load: async () => (await import("./chunks/im-7TRTF3KT.js")).imShortcut
+    load: async () => (await import("./chunks/im-YJAXS7CO.js")).imShortcut
   }),
   lazyShortcut({
     name: "project",
     description: "\u6CDB\u5FAEE10\u4E8B\u4E95\u7136\u9879\u76EE\u7BA1\u7406 CLI\uFF08\u9879\u76EE/\u4EFB\u52A1\u67E5\u8BE2\u4E0E\u786E\u8BA4\u5199\u5165\uFF09",
-    load: async () => (await import("./chunks/project-D6XT2OC5.js")).projectShortcut
+    load: async () => (await import("./chunks/project-4YWAAE2K.js")).projectShortcut
   }),
   lazyShortcut({
     name: "workflow",
     description: "\u6CDB\u5FAEE10\u6D41\u7A0B\u667A\u80FD\u52A9\u624B CLI\uFF08\u67E5\u8BE2/\u67E5\u770B/\u64CD\u4F5C/\u6279\u91CF/\u53D1\u8D77/\u4FEE\u6539\uFF09",
-    load: async () => (await import("./chunks/workflow-HLBZRWIY.js")).workflowShortcut
+    load: async () => (await import("./chunks/workflow-BB24DFBY.js")).workflowShortcut
   }),
   lazyShortcut({
     name: "blog",
     description: "\u6CDB\u5FAEE10\u5DE5\u4F5C\u65E5\u62A5 CLI\uFF08\u67E5\u8BE2/\u53D1\u5E03/\u7F16\u8F91/\u8BC4\u8BBA/\u70B9\u8D5E/\u63D0\u9192/\u5BFC\u51FA\uFF09",
-    load: async () => (await import("./chunks/blog-I7SDPNW4.js")).blogShortcut
+    load: async () => (await import("./chunks/blog-UYR3EUXW.js")).blogShortcut
   }),
   lazyShortcut({
     name: "caizhilian",
     description: "\u6CDB\u5FAEE10\u91C7\u77E5\u8FDE\uFF08\u6587\u6863\u4E2D\u5FC3\uFF09CLI",
-    load: async () => (await import("./chunks/caizhilian-O37ZIQNY.js")).caizhilianShortcut
+    load: async () => (await import("./chunks/caizhilian-LG2X5NMF.js")).caizhilianShortcut
+  }),
+  lazyShortcut({
+    name: "contract",
+    description: "\u6CDB\u5FAEE10\u4ECA\u627F\u8FBE\u5408\u540C\u7BA1\u7406 CLI",
+    load: async () => (await import("./chunks/contract-XIRAFTEV.js")).contractShortcut
   })
 ];
 function shortcutMetadata() {

package/dist/internal/e10/auth-recovery.js

@@ -23,6 +23,116 @@ const AUTH_REQUIRED_MARKERS = [
     'not logged in',
     'not login',
 ];
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Location 命中这些特征即为登录类跳转。 */
+const LOGIN_REDIRECT_MARKERS = [
+    'login',
+    'passport',
+    'sso',
+    'oauth',
+    'signin',
+    'sign-in',
+    'authorize',
+    'authn',
+    'atrust',
+    'checkticket',
+];
+/** Location 命中这些特征即为文件服务/对象存储交接。 */
+const FILE_REDIRECT_MARKERS = [
+    'fileservice',
+    '/file/download',
+    '/file/remotedownload',
+    '/remotedownload/',
+    '/api/file/',
+    '/download/',
+    'aliyuncs.com',
+    'myqcloud.com',
+    'qiniucdn.com',
+    'qbox.me',
+    'jdcloud.com',
+    'amazonaws.com',
+    'blob.core.windows.net',
+    'ctyunapi.cn',
+    'hiclouds.com',
+    'minio',
+    's3.',
+    'obs.',
+    'ks3',
+];
+/** 这些请求路径本身就是取文件：其 3xx 只要不是登录页，就是文件服务交接。 */
+const FILE_REQUEST_PATH_MARKERS = [
+    '/api/file/',
+    '/file/download',
+    '/remotedownload/',
+    '/fileservice',
+    '/download',
+];
+/** 跳转目标是前端页面骨架（如 wui/index.html#/main），不是文件直链。 */
+const APP_SHELL_REDIRECT = /(?:\.html?(?:[?#]|$)|#\/|wui\/)/u;
+export function isE10RedirectStatus(status) {
+    return REDIRECT_STATUSES.has(status);
+}
+/**
+ * 取跳转目标里「有语义」的部分：主机名 + 路径 + hash，**丢掉 query**。
+ * 对象存储的签名 query 是长随机串，拿去匹配关键词容易误伤（例如签名里恰好
+ * 出现 `sso`），所以只在主机与路径上判定。
+ */
+function redirectTarget(location) {
+    const raw = location.trim().toLowerCase();
+    if (!raw)
+        return '';
+    try {
+        const url = new URL(raw, 'https://e10.invalid');
+        return `${url.hostname}${url.pathname}${url.hash}`.toLowerCase();
+    }
+    catch {
+        return raw.split('?')[0];
+    }
+}
+/**
+ * 识别 3xx 的真实语义。登录跳转优先判定，避免对象存储地址里的参数误伤；
+ * 若是下载类请求且目标不像登录页，则认为是文件服务交接（对象存储的签名地址
+ * 不一定带 `fileservice` 之类的特征，只能靠请求路径反推）。
+ */
+export function classifyE10Redirect(response) {
+    if (!isE10RedirectStatus(response.status))
+        return 'other';
+    const target = redirectTarget(response.headers?.get('location') || '');
+    if (!target)
+        return 'other';
+    if (LOGIN_REDIRECT_MARKERS.some((marker) => target.includes(marker)))
+        return 'login';
+    if (FILE_REDIRECT_MARKERS.some((marker) => target.includes(marker)))
+        return 'file';
+    const requestPath = (response.requestPath || '').toLowerCase();
+    if (requestPath
+        && FILE_REQUEST_PATH_MARKERS.some((marker) => requestPath.includes(marker))
+        // 跳到前端页面骨架说明不是文件直链，继续按「无法判定」保守处理。
+        && !APP_SHELL_REDIRECT.test(target)) {
+        return 'file';
+    }
+    return 'other';
+}
+/** 3xx 指向文件服务：属于下载直传，登录态有效，不得触发重新登录。 */
+export function isE10FileRedirect(response) {
+    return classifyE10Redirect(response) === 'file';
+}
+/** 3xx 指向登录页：登录态确实失效。 */
+export function isE10LoginRedirect(response) {
+    return classifyE10Redirect(response) === 'login';
+}
+/**
+ * 业务层统一的「HTTP 层登录态失效」判定：401，或 3xx 且不是文件服务交接。
+ * 各 shortcut 用它替代原来的 `status === 401 || status === 302`，避免把下载
+ * 直传的 302 误报成登录失效。
+ */
+export function isE10SessionExpiredResponse(response) {
+    if (response.status === 401)
+        return true;
+    if (isE10RedirectStatus(response.status))
+        return !isE10FileRedirect(response);
+    return false;
+}
 const recoveryInFlight = new Map();
 function asRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -77,9 +187,12 @@ function responseText(response) {
  * Detect only explicit authentication rejection signals. A bare HTTP 403 is
  * deliberately excluded because E10 also uses it for ordinary permission
  * denials, which must never trigger a credential refresh.
+ *
+ * 3xx 只在「跳到登录页」或「无法判定」时才算认证失败：下载接口把文件交接给
+ * 文件服务时同样返回 302，那不是登录失效，重新登录既无用也会白白换一次票据。
  */
 export function isE10AuthenticationRequired(response) {
-    if (response.status === 401 || response.status === 302)
+    if (isE10SessionExpiredResponse(response))
         return true;
     if (responseCodes(response.value).some((code) => AUTH_REQUIRED_CODES.has(code)))
         return true;

package/dist/internal/e10/client.js

@@ -1,4 +1,4 @@
-import { isE10AuthenticationRequired, sameE10SessionIdentity, } from './auth-recovery.js';
+import { isE10AuthenticationRequired, isE10LoginRedirect, isE10RedirectStatus, sameE10SessionIdentity, } from './auth-recovery.js';
 class E10AuthenticationContextChangedError extends Error {
 }
 export class E10ApiClient {
@@ -78,6 +78,7 @@ export class E10ApiClient {
                 if (!authenticationRecoveryAttempted && isE10AuthenticationRequired({
                     status: resp.status,
                     headers: resp.headers,
+                    requestPath: safePathname(url),
                     text,
                     value,
                 })) {
@@ -94,7 +95,12 @@ export class E10ApiClient {
                     }
                 }
                 // Preserve the legacy password-based refresh for non-XiaoE callers.
-                if (resp.status === 302) {
+                // 只有真的跳到登录页才刷新；3xx 交给文件服务（下载直传）时登录态仍有效。
+                if (isE10LoginRedirect({
+                    status: resp.status,
+                    headers: resp.headers,
+                    requestPath: safePathname(url),
+                }) || (isE10RedirectStatus(resp.status) && !resp.headers.get('location'))) {
                     const ok = await this.auth.ensureValid();
                     if (!ok)
                         throw new Error('E10 session expired; please login again');
@@ -134,3 +140,11 @@ function refreshAuthenticationHeaders(init, session) {
     headers['user-agent'] = session.uaHeader();
     init.headers = headers;
 }
+function safePathname(rawUrl) {
+    try {
+        return new URL(rawUrl).pathname;
+    }
+    catch {
+        return rawUrl.startsWith('/') ? rawUrl.split('?')[0] : '';
+    }
+}

package/dist/internal/e10/fetch-timing.js

@@ -0,0 +1,31 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+const storage = new AsyncLocalStorage();
+export function createFetchTimingSink() {
+    return { fetchMs: 0, fetchCount: 0, fetchStart: null, fetchEnd: null };
+}
+/** 在 `sink` 的上下文里执行 `fn`：期间发生的 fetch 都会记到它上面。 */
+export function runWithFetchTiming(sink, fn) {
+    return storage.run(sink, fn);
+}
+/**
+ * fetch 前调一次，拿到的结束函数在 fetch 落定（成功或失败）时调一次。
+ * 返回 `null` 表示当前没有 sink（非计时路径）⇒ 调用方跳过全部计时动作。
+ */
+export function startFetchTiming() {
+    const sink = storage.getStore();
+    if (!sink)
+        return null;
+    const startedAt = Date.now();
+    let finished = false;
+    return () => {
+        if (finished)
+            return;
+        finished = true;
+        const endedAt = Date.now();
+        sink.fetchMs += Math.max(0, endedAt - startedAt);
+        sink.fetchCount += 1;
+        // 重试会有多次 fetch：起点取最早、终点取最晚，中间的空档（如换票据）不计入 fetchCost。
+        sink.fetchStart = sink.fetchStart === null ? startedAt : Math.min(sink.fetchStart, startedAt);
+        sink.fetchEnd = sink.fetchEnd === null ? endedAt : Math.max(sink.fetchEnd, endedAt);
+    };
+}

package/dist/internal/e10/request-runtime.js

@@ -1,7 +1,10 @@
 import { CliError, ExitCode } from '../../core/errors.js';
-import { isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
+import { classifyE10Redirect, isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
+import { startFetchTiming } from './fetch-timing.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_BIG_INT_STRINGS = true;
+/** 下载直传最多跟几跳：E10 -> 对象存储通常 1 跳，留一点余量但不允许成环。 */
+const MAX_DOWNLOAD_REDIRECTS = 3;
 const RESERVED_HEADERS = [
     'authorization',
     'cookie',
@@ -62,16 +65,18 @@ export class E10RequestRuntime {
             }
             stripReservedHeaders(mutable.headers);
             const requestEteamsId = this.session.eteamsId;
-            let parsed = await this.executeRequest(mutable, request.trustedHeaders);
+            let attempt = await this.executeRequest(mutable, request.trustedHeaders);
             if (!mutable.streamBody
-                && isE10AuthenticationRequired(parsed)
+                // 已交接给文件服务的响应不是 E10 的接口回答，登录态不该由它判定。
+                && !attempt.fromFileRedirect
+                && isE10AuthenticationRequired(authenticationProbe(mutable, attempt.parsed))
                 && await this.recoverExpiredSession(requestEteamsId)) {
                 // Authentication rejection is a definitive pre-business failure. Retry
                 // exactly once with the new session; never retry transport/partial errors.
-                parsed = await this.executeRequest(mutable, request.trustedHeaders);
+                attempt = await this.executeRequest(mutable, request.trustedHeaders);
             }
-            await this.runAfterResponse(mutable, this.sessionContext(), parsed);
-            return parsed;
+            await this.runAfterResponse(mutable, this.sessionContext(), attempt.parsed);
+            return attempt.parsed;
         }
         catch (error) {
             await this.runOnError(mutable, this.sessionContext(), error);
@@ -83,7 +88,74 @@ export class E10RequestRuntime {
         const headers = this.composeHeaders(request, trustedHeaders);
         const init = this.buildFetchInit(request, headers);
         const response = await this.fetchWithTimeout(url, init, request.timeoutMs);
-        return this.readResponse(response, request.responseType, request.bigIntStrings, request.maxResponseBytes, request.timeoutMs);
+        // 二进制下载：E10 常以 302 把文件交接给文件服务/对象存储。这里直接跟过去
+        // 取字节，既不会把「文件流」当成登录失效，也不会触发无谓的重新登录。
+        const followed = request.responseType === 'binary'
+            ? await this.followDownloadRedirect(response, request, url)
+            : { response, followed: false };
+        if (followed.followed && (followed.response.status === 401 || followed.response.status === 403)) {
+            // 这是文件服务对直链的回答（签名过期/无权限），与 E10 登录态无关：
+            // 报清楚，别让调用方误以为要重新登录。
+            throw new E10ApiError('network', 'download_file_service_denied', `文件服务拒绝下载（HTTP ${followed.response.status}），直链可能已过期，请重试下载`, {
+                retryable: true,
+                exitCode: ExitCode.NetworkError,
+                details: { status: followed.response.status },
+            });
+        }
+        return {
+            parsed: await this.readResponse(followed.response, request.responseType, request.bigIntStrings, request.maxResponseBytes, request.timeoutMs),
+            fromFileRedirect: followed.followed,
+        };
+    }
+    /**
+     * 跟随下载直传的 3xx。仅当跳转目标是文件服务（非登录页）时才跟随，最多
+     * `MAX_DOWNLOAD_REDIRECTS` 跳；登录类跳转原样返回，交给上层认证恢复处理。
+     * 凭证规则：同源才继续带 Cookie/eteamsid，跨域（对象存储）不带任何鉴权头。
+     */
+    async followDownloadRedirect(response, request, requestUrl) {
+        const baseOrigin = safeOrigin(this.session.getBaseUrl());
+        let current = response;
+        let currentUrl = requestUrl;
+        let followed = false;
+        for (let hop = 0; hop < MAX_DOWNLOAD_REDIRECTS; hop += 1) {
+            const kind = classifyE10Redirect({
+                status: current.status,
+                headers: current.headers,
+                requestPath: request.path,
+            });
+            if (kind !== 'file')
+                return { response: current, followed };
+            const location = current.headers.get('location');
+            if (!location)
+                return { response: current, followed };
+            let next;
+            try {
+                next = new URL(location, currentUrl);
+            }
+            catch {
+                return { response: current, followed };
+            }
+            if (!/^https?:$/u.test(next.protocol))
+                return { response: current, followed };
+            const sameOrigin = baseOrigin !== '' && safeOrigin(next.toString()) === baseOrigin;
+            current = await this.fetchWithTimeout(next, this.buildDownloadRedirectInit(sameOrigin), request.timeoutMs);
+            currentUrl = next;
+            followed = true;
+        }
+        return { response: current, followed };
+    }
+    buildDownloadRedirectInit(sameOrigin) {
+        const headers = {
+            Accept: 'application/octet-stream, */*',
+            'User-Agent': this.session.uaHeader(),
+        };
+        if (sameOrigin) {
+            headers.Cookie = this.attachSessionTicket
+                ? this.session.cookieHeaderWithSessionTicket()
+                : this.session.cookieHeader();
+            headers.eteamsid = this.session.eteamsId;
+        }
+        return { method: 'GET', headers, redirect: 'manual' };
     }
     async recoverExpiredSession(requestEteamsId) {
         // Another concurrent request may already have refreshed the shared session
@@ -220,6 +292,9 @@ export class E10RequestRuntime {
     async fetchWithTimeout(url, init, timeoutMs) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
+        // 「纯 fetch」= 发出请求 → 收到响应头（`fetch` 落定那一刻，不含读响应体/解析）。没有计时上下文
+        // （`startFetchTiming()` 返回 `null`）时它什么都不做，非计时路径零开销。
+        const stopFetchTiming = startFetchTiming();
         try {
             return await this.fetchFn(url, { ...init, signal: controller.signal });
         }
@@ -238,6 +313,7 @@ export class E10RequestRuntime {
         }
         finally {
             clearTimeout(timer);
+            stopFetchTiming?.();
         }
     }
     async readResponse(response, responseType, bigIntStrings = DEFAULT_BIG_INT_STRINGS, maxResponseBytes, timeoutMs = DEFAULT_TIMEOUT_MS) {
@@ -271,6 +347,31 @@ export class E10RequestRuntime {
 export function parseJsonPreservingBigInts(text) {
     return JSON.parse(quoteLargeJsonIntegers(text));
 }
+/**
+ * 组装认证探测入参。二进制响应不能把文件字节交给关键词扫描（乱码里出现
+ * 「login」会误判成登录失效），只保留状态码与跳转目标；同时带上请求路径，
+ * 让「下载接口 -> 文件服务」的 3xx 能被识别为交接而不是失效。
+ */
+function authenticationProbe(request, response) {
+    if ('content' in response) {
+        return { status: response.status, headers: response.headers, requestPath: request.path };
+    }
+    return {
+        status: response.status,
+        headers: response.headers,
+        requestPath: request.path,
+        text: response.text,
+        value: response.value,
+    };
+}
+function safeOrigin(rawUrl) {
+    try {
+        return new URL(rawUrl).origin.toLowerCase();
+    }
+    catch {
+        return '';
+    }
+}
 const LONG_INTEGER_MIN_DIGITS = 16;
 // 一趟扫描把 JSON 拆成「字符串字面量」与「数字」两类 token：字符串整体跳过，
 // 数字只在它是纯整数且位数够长时补引号。逐字符拼串在 MB 级响应上要 100 ms 以上，

package/dist/shortcuts/archive/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ArchiveCliError, archiveAuthError, archiveNetworkError, archiveValidationError, } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -151,7 +152,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     }
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -182,7 +183,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     }
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {

package/dist/shortcuts/archive-oa/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ArchiveOaCliError, archiveOaAuthError, archiveOaNetworkError, archiveOaValidationError, } from './errors.js';
 /** 本模块允许调用的路径前缀：ebuilder 业务接口与 OpenESB 开放服务。 */
 const ALLOWED_PATH_PREFIXES = ['/api/', '/openserver/'];
@@ -122,7 +123,7 @@ export function createArchiveOaHost(ctx, dependencies = {}) {
             headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
             timeoutMs,
         }).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw archiveOaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/asset/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ziguanjiaAuthError, ziguanjiaBusinessError, ziguanjiaNetworkError, ziguanjiaValidationError, } from './errors.js';
 const EBUILDER_PREFIX = process.env.WEAVER_EBUILDER_PREFIX || '/api/ebuilder';
 const ESB_TRIGGER_PATH = '/api/esb/server/event/triggerActionFlow';
@@ -176,7 +177,7 @@ export function createZiguanjiaHost(ctx) {
             query,
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -242,7 +243,7 @@ export function createZiguanjiaHost(ctx) {
             formData: fd,
             bigIntStrings: false,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -315,7 +316,7 @@ export function createZiguanjiaHost(ctx) {
             },
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -363,7 +364,7 @@ export function createZiguanjiaHost(ctx) {
             body: fullBody,
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -393,7 +394,7 @@ export function createZiguanjiaHost(ctx) {
             body: payload,
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/blog/host.js

@@ -3,6 +3,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { BlogCliError, blogAuthError, blogNetworkError, blogValidationError, } from './errors.js';
 const MAX_EXPORT_BYTES = 50 * 1024 * 1024;
 /** E10 登录失效在业务响应体里的 code（实测 -2 既可能是数字也可能是字符串） */
@@ -91,7 +92,7 @@ export function createBlogHost(ctx, dependencies = {}) {
             body,
             timeoutMs,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -134,7 +135,7 @@ export function createBlogHost(ctx, dependencies = {}) {
             timeoutMs,
             headers: { Accept: 'application/octet-stream, */*' },
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         const contentType = response.contentType;