weaver-work-cli 0.1.36 → 0.1.38

package/dist/internal/e10/request-runtime.js

@@ -1,8 +1,10 @@
 import { CliError, ExitCode } from '../../core/errors.js';
-import { isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
+import { classifyE10Redirect, isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
 import { startFetchTiming } from './fetch-timing.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_BIG_INT_STRINGS = true;
+/** 下载直传最多跟几跳：E10 -> 对象存储通常 1 跳，留一点余量但不允许成环。 */
+const MAX_DOWNLOAD_REDIRECTS = 3;
 const RESERVED_HEADERS = [
     'authorization',
     'cookie',
@@ -63,16 +65,18 @@ export class E10RequestRuntime {
             }
             stripReservedHeaders(mutable.headers);
             const requestEteamsId = this.session.eteamsId;
-            let parsed = await this.executeRequest(mutable, request.trustedHeaders);
+            let attempt = await this.executeRequest(mutable, request.trustedHeaders);
             if (!mutable.streamBody
-                && isE10AuthenticationRequired(parsed)
+                // 已交接给文件服务的响应不是 E10 的接口回答，登录态不该由它判定。
+                && !attempt.fromFileRedirect
+                && isE10AuthenticationRequired(authenticationProbe(mutable, attempt.parsed))
                 && await this.recoverExpiredSession(requestEteamsId)) {
                 // Authentication rejection is a definitive pre-business failure. Retry
                 // exactly once with the new session; never retry transport/partial errors.
-                parsed = await this.executeRequest(mutable, request.trustedHeaders);
+                attempt = await this.executeRequest(mutable, request.trustedHeaders);
             }
-            await this.runAfterResponse(mutable, this.sessionContext(), parsed);
-            return parsed;
+            await this.runAfterResponse(mutable, this.sessionContext(), attempt.parsed);
+            return attempt.parsed;
         }
         catch (error) {
             await this.runOnError(mutable, this.sessionContext(), error);
@@ -84,7 +88,74 @@ export class E10RequestRuntime {
         const headers = this.composeHeaders(request, trustedHeaders);
         const init = this.buildFetchInit(request, headers);
         const response = await this.fetchWithTimeout(url, init, request.timeoutMs);
-        return this.readResponse(response, request.responseType, request.bigIntStrings, request.maxResponseBytes, request.timeoutMs);
+        // 二进制下载：E10 常以 302 把文件交接给文件服务/对象存储。这里直接跟过去
+        // 取字节，既不会把「文件流」当成登录失效，也不会触发无谓的重新登录。
+        const followed = request.responseType === 'binary'
+            ? await this.followDownloadRedirect(response, request, url)
+            : { response, followed: false };
+        if (followed.followed && (followed.response.status === 401 || followed.response.status === 403)) {
+            // 这是文件服务对直链的回答（签名过期/无权限），与 E10 登录态无关：
+            // 报清楚，别让调用方误以为要重新登录。
+            throw new E10ApiError('network', 'download_file_service_denied', `文件服务拒绝下载（HTTP ${followed.response.status}），直链可能已过期，请重试下载`, {
+                retryable: true,
+                exitCode: ExitCode.NetworkError,
+                details: { status: followed.response.status },
+            });
+        }
+        return {
+            parsed: await this.readResponse(followed.response, request.responseType, request.bigIntStrings, request.maxResponseBytes, request.timeoutMs),
+            fromFileRedirect: followed.followed,
+        };
+    }
+    /**
+     * 跟随下载直传的 3xx。仅当跳转目标是文件服务（非登录页）时才跟随，最多
+     * `MAX_DOWNLOAD_REDIRECTS` 跳；登录类跳转原样返回，交给上层认证恢复处理。
+     * 凭证规则：同源才继续带 Cookie/eteamsid，跨域（对象存储）不带任何鉴权头。
+     */
+    async followDownloadRedirect(response, request, requestUrl) {
+        const baseOrigin = safeOrigin(this.session.getBaseUrl());
+        let current = response;
+        let currentUrl = requestUrl;
+        let followed = false;
+        for (let hop = 0; hop < MAX_DOWNLOAD_REDIRECTS; hop += 1) {
+            const kind = classifyE10Redirect({
+                status: current.status,
+                headers: current.headers,
+                requestPath: request.path,
+            });
+            if (kind !== 'file')
+                return { response: current, followed };
+            const location = current.headers.get('location');
+            if (!location)
+                return { response: current, followed };
+            let next;
+            try {
+                next = new URL(location, currentUrl);
+            }
+            catch {
+                return { response: current, followed };
+            }
+            if (!/^https?:$/u.test(next.protocol))
+                return { response: current, followed };
+            const sameOrigin = baseOrigin !== '' && safeOrigin(next.toString()) === baseOrigin;
+            current = await this.fetchWithTimeout(next, this.buildDownloadRedirectInit(sameOrigin), request.timeoutMs);
+            currentUrl = next;
+            followed = true;
+        }
+        return { response: current, followed };
+    }
+    buildDownloadRedirectInit(sameOrigin) {
+        const headers = {
+            Accept: 'application/octet-stream, */*',
+            'User-Agent': this.session.uaHeader(),
+        };
+        if (sameOrigin) {
+            headers.Cookie = this.attachSessionTicket
+                ? this.session.cookieHeaderWithSessionTicket()
+                : this.session.cookieHeader();
+            headers.eteamsid = this.session.eteamsId;
+        }
+        return { method: 'GET', headers, redirect: 'manual' };
     }
     async recoverExpiredSession(requestEteamsId) {
         // Another concurrent request may already have refreshed the shared session
@@ -276,6 +347,31 @@ export class E10RequestRuntime {
 export function parseJsonPreservingBigInts(text) {
     return JSON.parse(quoteLargeJsonIntegers(text));
 }
+/**
+ * 组装认证探测入参。二进制响应不能把文件字节交给关键词扫描（乱码里出现
+ * 「login」会误判成登录失效），只保留状态码与跳转目标；同时带上请求路径，
+ * 让「下载接口 -> 文件服务」的 3xx 能被识别为交接而不是失效。
+ */
+function authenticationProbe(request, response) {
+    if ('content' in response) {
+        return { status: response.status, headers: response.headers, requestPath: request.path };
+    }
+    return {
+        status: response.status,
+        headers: response.headers,
+        requestPath: request.path,
+        text: response.text,
+        value: response.value,
+    };
+}
+function safeOrigin(rawUrl) {
+    try {
+        return new URL(rawUrl).origin.toLowerCase();
+    }
+    catch {
+        return '';
+    }
+}
 const LONG_INTEGER_MIN_DIGITS = 16;
 // 一趟扫描把 JSON 拆成「字符串字面量」与「数字」两类 token：字符串整体跳过，
 // 数字只在它是纯整数且位数够长时补引号。逐字符拼串在 MB 级响应上要 100 ms 以上，

package/dist/shortcuts/archive/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ArchiveCliError, archiveAuthError, archiveNetworkError, archiveValidationError, } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -151,7 +152,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     }
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -182,7 +183,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     }
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {

package/dist/shortcuts/archive-oa/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ArchiveOaCliError, archiveOaAuthError, archiveOaNetworkError, archiveOaValidationError, } from './errors.js';
 /** 本模块允许调用的路径前缀：ebuilder 业务接口与 OpenESB 开放服务。 */
 const ALLOWED_PATH_PREFIXES = ['/api/', '/openserver/'];
@@ -122,7 +123,7 @@ export function createArchiveOaHost(ctx, dependencies = {}) {
             headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
             timeoutMs,
         }).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw archiveOaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/asset/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ziguanjiaAuthError, ziguanjiaBusinessError, ziguanjiaNetworkError, ziguanjiaValidationError, } from './errors.js';
 const EBUILDER_PREFIX = process.env.WEAVER_EBUILDER_PREFIX || '/api/ebuilder';
 const ESB_TRIGGER_PATH = '/api/esb/server/event/triggerActionFlow';
@@ -176,7 +177,7 @@ export function createZiguanjiaHost(ctx) {
             query,
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -242,7 +243,7 @@ export function createZiguanjiaHost(ctx) {
             formData: fd,
             bigIntStrings: false,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -315,7 +316,7 @@ export function createZiguanjiaHost(ctx) {
             },
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -363,7 +364,7 @@ export function createZiguanjiaHost(ctx) {
             body: fullBody,
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -393,7 +394,7 @@ export function createZiguanjiaHost(ctx) {
             body: payload,
             bigIntStrings: true,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ziguanjiaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/blog/host.js

@@ -3,6 +3,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { BlogCliError, blogAuthError, blogNetworkError, blogValidationError, } from './errors.js';
 const MAX_EXPORT_BYTES = 50 * 1024 * 1024;
 /** E10 登录失效在业务响应体里的 code（实测 -2 既可能是数字也可能是字符串） */
@@ -91,7 +92,7 @@ export function createBlogHost(ctx, dependencies = {}) {
             body,
             timeoutMs,
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -134,7 +135,7 @@ export function createBlogHost(ctx, dependencies = {}) {
             timeoutMs,
             headers: { Accept: 'application/octet-stream, */*' },
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw blogAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         const contentType = response.contentType;

package/dist/shortcuts/caizhilian/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { CaizhilianCliError, caizhilianAuthError, caizhilianNetworkError, caizhilianValidationError, } from './errors.js';
 /** 业务请求默认超时（源 assets/config.json：http.timeout = 12 秒）。 */
 export const CAIZHILAN_TIMEOUT_MS = 12_000;
@@ -152,7 +153,7 @@ export function createCaizhilianHost(ctx, dependencies = {}) {
     }
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw caizhilianAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -183,7 +184,7 @@ export function createCaizhilianHost(ctx, dependencies = {}) {
     }
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw caizhilianAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {

package/dist/shortcuts/calendar/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { calendarAuthError, calendarNetworkError, CalendarCliError, calendarValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -110,7 +111,7 @@ export function createCalendarHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw calendarAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/contract/host.js

@@ -1,6 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { basename } from 'node:path';
 import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
+import { isE10SessionExpiredResponse, } from '../../internal/e10/auth-recovery.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime, } from '../../internal/e10/request-runtime.js';
@@ -179,7 +180,7 @@ export function createContractHost(ctx, dependencies = {}) {
             }
             throw error;
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw contractAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status, path });
         }
         const { text, value } = response;

package/dist/shortcuts/cowork/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { CoworkCliError, coworkAuthError, coworkNetworkError, coworkValidationError } from './errors.js';
 import { coworkPerf } from './operations/types.js';
 function inferProfile(ctx) {
@@ -147,7 +148,7 @@ export function createCoworkHost(ctx, dependencies = {}) {
             coworkPerf.requestCount += 1;
             coworkPerf.requestMs += Date.now() - reqStart;
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw coworkAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/ebuilder-form/host.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { requireE10Session } from '../../internal/e10/context.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
 import { ebuilderAuthError, ebuilderBusinessError, ebuilderNetworkError, ebuilderValidationError, } from './errors.js';
@@ -231,7 +232,8 @@ export function createEbuilderFormHost(ctx) {
             headers: options.headers,
             bigIntStrings: options.bigIntStrings ?? true,
         });
-        if ([302, 401, 403].includes(response.status)) {
+        // 403 在 eBuilder 这里偏「无权」，3xx 只有跳到登录页才算登录失效（文件服务交接不算）。
+        if (isE10SessionExpiredResponse(response) || response.status === 403) {
             throw ebuilderAuthError('session_expired', 'E10 登录态已失效或当前账号无权访问该 eBuilder 数据', { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/ehr/host.js

@@ -3,6 +3,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { ehrAuthError, ehrNetworkError, EhrCliError, ehrValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -165,7 +166,7 @@ export function createEhrHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw ehrAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/esb/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { EsbCliError, esbApiError, esbAuthError, esbNetworkError, esbPermissionError, esbValidationError, esbWriteUncertain, } from './errors.js';
 /** 源接口文档给出的去域名路径；域名与认证由 E10 会话层托管。 */
 export const ESB_PATHS = {
@@ -117,7 +118,7 @@ export function createEsbHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw esbAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/fna/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { FnaCliError, fnaAuthError, fnaNetworkError, fnaValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -116,7 +117,7 @@ export function createFnaHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw fnaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/hrm/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { HrmCliError, hrmAuthError, hrmNetworkError, hrmValidationError } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -114,7 +115,7 @@ export function createHrmHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw hrmAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/im/host.js

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { dirname, extname, resolve } from 'node:path';
 import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
+import { isE10SessionExpiredResponse, } from '../../internal/e10/auth-recovery.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -121,7 +122,7 @@ export function createImHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw imAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -182,7 +183,7 @@ export function createImHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw imAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE);
         }
         if (response.status !== 200) {

package/dist/shortcuts/invoice/host.js

@@ -4,6 +4,7 @@ import { E10_REAUTH_GUIDANCE, E10_SESSION_EXPIRED_MESSAGE } from '../../internal
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { InvoiceCliError, invoiceAuthError, invoiceNetworkError, invoiceValidationError, } from './errors.js';
 const MAX_DOWNLOAD_BYTES = 50 * 1024 * 1024;
 const TOKEN_SERVICE = 'cn.weaver.weaver-work-cli.invoice-token';
@@ -199,7 +200,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -258,7 +259,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -293,7 +294,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
@@ -320,7 +321,7 @@ export function createInvoiceHost(ctx, dependencies = {}) {
             timeoutMs,
             trustedHeaders: trustedInvoiceHeaders(token),
         });
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw invoiceAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         const contentType = response.contentType;

package/dist/shortcuts/jiuchuanhui/host.js

@@ -2,6 +2,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { JiuchuanhuiCliError, jiuchuanhuiAuthError, jiuchuanhuiNetworkError, jiuchuanhuiValidationError, } from './errors.js';
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
@@ -127,7 +128,7 @@ export function createJiuchuanhuiHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw jiuchuanhuiAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/mail/host.js

@@ -3,6 +3,7 @@ import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { isE10SessionExpiredResponse } from '../../internal/e10/auth-recovery.js';
 import { mailAuthError, mailNetworkError, MailCliError, mailValidationError } from './errors.js';
 import { mailPerf } from './operations/types.js';
 function inferProfile(ctx) {
@@ -160,7 +161,7 @@ export function createMailHost(ctx, dependencies = {}) {
             mailPerf.requestCount += 1;
             mailPerf.requestMs += Date.now() - reqStart;
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw mailAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/meeting/host.js

@@ -1,4 +1,5 @@
 import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
+import { isE10SessionExpiredResponse, } from '../../internal/e10/auth-recovery.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -127,7 +128,7 @@ export function createMeetingHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw meetingAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status !== 200) {
@@ -177,7 +178,7 @@ export function createMeetingHost(ctx, dependencies = {}) {
         catch (error) {
             mapRuntimeNetworkError(error);
         }
-        if (response.status === 401 || response.status === 302) {
+        if (isE10SessionExpiredResponse(response)) {
             throw meetingAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {

package/dist/shortcuts/meeting/invitation/text.js

@@ -0,0 +1,71 @@
+/**
+ * 邀请函的**对话内文本版**（Markdown），与 docx 版同源同字段。
+ *
+ * 为什么要有这一份（2026-10-31 用户明确要求）：
+ * 「邀请函不是在对话里给个文件让我自己下载，而是**直接展示在对话里**」。
+ * docx 是给人打印/发出去的成品，但小E 会话里用户看不到 docx 内容 ——
+ * 只回一个 filePath，用户还得去本地打开才知道写了什么。
+ * 所以渲染 docx 的同时产出一份纯文本，模型可以把正文直接贴进回复。
+ *
+ * 版式与 `templates/meeting/invitation.docx` 一致：标题 / 称呼 / 邀请语 /
+ * 会议要素 / 议程表 / 落款 / 备注。取不到的字段统一写【待补充】，与 docx 的黄色高亮同义。
+ */
+import { PENDING_MARK } from './docx.js';
+/** 单元格里的 `|` 会破坏 Markdown 表格，换行会破坏行结构 —— 统一折成空格。 */
+function cell(value) {
+    return String(value ?? '').replace(/\|/g, '/').replace(/\s*\r?\n\s*/g, ' ').trim();
+}
+/**
+ * 生成邀请函的对话文本版。
+ *
+ * @param resolver    与 docx 共用的占位符解析器（保证两版内容一字不差）
+ * @param agendaRows  议程行（来自会议议题 / extra.agenda / 模板示例行）
+ * @param options.pendingHint 是否在末尾附「【待补充】需人工补」的提示（默认附）
+ */
+export function renderInvitationMarkdown(resolver, agendaRows, options = {}) {
+    const pending = new Set();
+    const val = (key) => {
+        const rendered = resolver(key);
+        if (rendered.pending) {
+            pending.add(key);
+            return PENDING_MARK;
+        }
+        return String(rendered.text ?? '').trim();
+    };
+    const lines = [];
+    lines.push('# 邀请函');
+    lines.push('');
+    lines.push(`**尊敬的 ${val('guest_org')}：**`);
+    lines.push('');
+    lines.push(`${val('caller')} 诚邀您参加「${val('mt_name')}」，现将会议安排通知如下：`);
+    lines.push('');
+    lines.push(`- **会议名称**：${val('mt_name')}`);
+    lines.push(`- **会议时间**：${val('begin_datetime')}~${val('end_datetime')}`);
+    lines.push(`- **会议地点**：${val('address')}`);
+    lines.push(`- **参会人员**：${val('hrm_members')}`);
+    lines.push(`- **会议内容**：${val('mt_desc')}`);
+    lines.push('');
+    lines.push(`**${val('begin_date')}会议议程安排：**`);
+    lines.push('');
+    lines.push('| 议程安排 | 议程内容 | 议程时间 |');
+    lines.push('| --- | --- | --- |');
+    if (agendaRows.length === 0) {
+        lines.push('| — | 暂无议程 | — |');
+    }
+    else {
+        for (const [name, content, timeRange] of agendaRows) {
+            lines.push(`| ${cell(name) || '—'} | ${cell(content) || '—'} | ${cell(timeRange) || '—'} |`);
+        }
+    }
+    lines.push('');
+    lines.push(val('company_name'));
+    lines.push('');
+    lines.push(val('issue_date'));
+    lines.push('');
+    lines.push('> 注：以上为拟定会议安排，具体会议时间与议程需根据实际情况确认。');
+    if (options.pendingHint !== false && pending.size > 0) {
+        lines.push('');
+        lines.push(`> ⚠️ 标 ${PENDING_MARK} 的字段会议里没有值，需要人工补；补完可用 mtId 重新生成。`);
+    }
+    return { markdown: lines.join('\n'), pendingFields: [...pending] };
+}