weaver-work-cli 0.1.38 → 0.1.40

package/dist/internal/e10/auth/commands.js

@@ -17,6 +17,7 @@ const AGENT_RETURN_URL_ENV_KEY = 'WEAVER_AGENT_RETURN_URL';
 const AGENT_RETURN_PATH = '/agent-return';
 const AGENT_RETURN_TOKEN_HEADER = 'x-weaver-agent-return-token';
 const AGENT_RETURN_TIMEOUT_MS = 900_000;
+const OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS = 30_000;
 const UNSAFE_AGENT_RETURN_PROTOCOLS = new Set([
     'about:',
     'blob:',
@@ -191,6 +192,7 @@ function formatAuthStatus(status) {
         ...('credentialSourceStep' in status && status.credentialSourceStep ? ['credentialSourceStep: ' + status.credentialSourceStep] : []),
         ...('credentialSourceType' in status && status.credentialSourceType ? ['credentialSourceType: ' + status.credentialSourceType] : []),
         ...('credentialSourceLabel' in status && status.credentialSourceLabel ? ['credentialSourceLabel: ' + status.credentialSourceLabel] : []),
+        ...('expiryTimes' in status && status.expiryTimes ? ['expiryTimes: ' + status.expiryTimes] : []),
     ];
     if ('valid' in status) {
         lines.push('valid: ' + String(status.valid));
@@ -210,6 +212,7 @@ function formatLoginResult(result) {
         ...(result.credentialSourceStep ? ['credentialSourceStep: ' + result.credentialSourceStep] : []),
         ...(result.credentialSourceType ? ['credentialSourceType: ' + result.credentialSourceType] : []),
         ...(result.credentialSourceLabel ? ['credentialSourceLabel: ' + result.credentialSourceLabel] : []),
+        ...(result.expiryTimes ? ['expiryTimes: ' + result.expiryTimes] : []),
     ].join('\n');
 }
 async function clearInvoiceTokenCache(profile, authData) {
@@ -300,6 +303,24 @@ export function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
     });
     return `${baseUrl}/papi/sso/oauth2.0/authorize?${authorizeParams.toString()}`;
 }
+/** Node's HTTP parser exposes the first unread bytes when TLS is sent to an HTTP listener. */
+export function isTlsClientHello(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const rawPacket = error.rawPacket;
+    return Buffer.isBuffer(rawPacket)
+        && rawPacket.length >= 3
+        && rawPacket[0] === 0x16
+        && rawPacket[1] === 0x03;
+}
+export function createOAuthCallbackProtocolMismatchError(port) {
+    return Object.assign(new CliError(`OAuth callback protocol mismatch: the browser connected to https://127.0.0.1:${port}, but the CLI callback listener uses HTTP. Retry the login and, on the callback error page, change only the URL scheme to http:// before reloading; keep the path and query unchanged. The E10 authorization service should preserve HTTP loopback redirect URIs.`, ExitCode.AuthError), {
+        type: 'authentication',
+        subtype: 'oauth_callback_protocol_mismatch',
+        retryable: false,
+        stage: 'oauth_callback',
+    });
+}
 async function readJsonObject(resp) {
     const data = await resp.json().catch(() => ({}));
     return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
@@ -488,7 +509,7 @@ function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
         'CLI 会优先使用 XiaoE 客户端内置 Python 执行 tokens.py；自动发现不可用时，可用 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON 指定兼容解释器。',
     ].join(' ');
 }
-async function runBrowserLogin(ctx, options, behavior = {}) {
+async function runXiaoELogin(ctx, options) {
     const commandOpts = asOptions(options);
     const globalOptions = ctx.getGlobalOptions();
     const profileFromGlobal = globalOptions.profile;
@@ -499,59 +520,49 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         profileBaseUrl: cfg.baseUrl,
         env: ctx.env,
     });
-    const xiaoESources = behavior.tryXiaoEUnifiedLogin === true
-        ? inspectXiaoEUnifiedLoginSources({
-            env: ctx.env,
-            baseUrl: preferredXiaoEBaseUrl,
-            profileBaseUrl: cfg.baseUrl,
-            allowTokenScript: behavior.allowXiaoETokenScript === true,
-        })
-        : {
-            platformCredential: false,
-            tokenScript: false,
-            clientCredential: false,
-            environmentCredential: false,
-            any: false,
-        };
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
-    const baseUrl = behavior.tryXiaoEUnifiedLogin
-        ? preferredXiaoEBaseUrl
-        : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
+    const xiaoESources = inspectXiaoEUnifiedLoginSources({
+        env: ctx.env,
+        baseUrl: preferredXiaoEBaseUrl,
+        profileBaseUrl: cfg.baseUrl,
+        allowTokenScript: true,
+    });
+    const useXiaoELogin = xiaoESources.any;
+    const baseUrl = preferredXiaoEBaseUrl;
+    const tenantKey = optionString(commandOpts, 'tenantKey');
+    ctx.logger.info([
+        'XiaoE unified login preflight:',
+        'authMode=xiaoe',
+        `credentialSourceDetected=${String(xiaoESources.any)}`,
+        `attempted=${String(useXiaoELogin)}`,
+        `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+        `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+        `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+        `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+        `baseUrl=${baseUrl || '(unresolved)'}`,
+    ].join(' '));
+    if (useXiaoELogin) {
+        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true);
+        if (xiaoEResult)
+            return xiaoEResult;
+    }
+    ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
+    throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+}
+async function runBrowserLogin(ctx, options) {
+    const commandOpts = asOptions(options);
+    const globalOptions = ctx.getGlobalOptions();
+    const profileFromGlobal = globalOptions.profile;
+    const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+    const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
+    const baseUrl = normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
     const explicitAgentType = optionString(commandOpts, 'agentType', 'agent_type');
-    const agentType = useXiaoELogin
-        ? optionString(commandOpts, 'agentType', 'agent_type') || XIAOE_AGENT_TYPE
-        : resolveAgentType(commandOpts, ctx.env);
+    const agentType = resolveAgentType(commandOpts, ctx.env);
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
-    if (behavior.tryXiaoEUnifiedLogin) {
-        ctx.logger.info([
-            'XiaoE unified login preflight:',
-            'authMode=xiaoe',
-            `credentialSourceDetected=${String(xiaoESources.any)}`,
-            `attempted=${String(useXiaoELogin)}`,
-            `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
-            `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
-            `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
-            `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
-            `baseUrl=${baseUrl || '(unresolved)'}`,
-        ].join(' '));
-    }
-    if (useXiaoELogin) {
-        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
-        if (xiaoEResult)
-            return xiaoEResult;
-    }
-    const willOpenBrowser = behavior.browserFallback !== 'never';
-    if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
-        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-    }
-    if (!willOpenBrowser) {
-        throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
-    }
     if (!baseUrl)
         throw new CliError('Missing --base-url', ExitCode.UsageError);
     const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
@@ -564,6 +575,7 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         let settled = false;
         let timer = null;
         let pendingLoginResult = null;
+        let tlsCallbackDetected = false;
         const finish = (error, result) => {
             if (settled)
                 return;
@@ -647,6 +659,13 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
                 finish(new CliError('No authorization code received.', ExitCode.AuthError));
                 return;
             }
+            // The user followed the recovery instruction and reached the HTTP
+            // callback. Do not let the protocol-mismatch grace timer race the token
+            // exchange that is now legitimately in progress.
+            if (tlsCallbackDetected && timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
             try {
                 const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
                 const responseHeaders = {
@@ -685,6 +704,26 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
                     : error.message;
             finish(new CliError(message, ExitCode.UsageError));
         });
+        server.on('clientError', (error, socket) => {
+            if (isTlsClientHello(error)) {
+                if (!tlsCallbackDetected) {
+                    tlsCallbackDetected = true;
+                    ctx.logger.warn([
+                        `OAuth callback protocol mismatch: the browser used HTTPS for 127.0.0.1:${port}, while the CLI listener is HTTP.`,
+                        '在 30 秒内把浏览器当前地址开头明确改为 http://，保留后面的完整路径和参数，然后回车重试。',
+                        '不要把地址中的授权码复制到聊天或日志。',
+                    ].join(' '));
+                    if (timer)
+                        clearTimeout(timer);
+                    timer = setTimeout(() => {
+                        finish(createOAuthCallbackProtocolMismatchError(port));
+                    }, OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS);
+                }
+                socket.destroy();
+                return;
+            }
+            socket.destroy();
+        });
         server.listen(port, '127.0.0.1', () => {
             ctx.logger.info('Local callback server: ' + redirectUri);
             openUrlInBrowser(loginUrl, ctx);
@@ -728,7 +767,7 @@ function formatWhoami(title, data) {
         'User-Agent: ' + (data.userAgent || ''),
     ].join('\n');
 }
-function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
+function registerBrowserLoginCommand(auth, action, name, description) {
     const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
@@ -738,7 +777,23 @@ function registerBrowserLoginCommand(auth, action, name, description, behavior =
         .option('--agent-type <value>', 'Alias of --agent_type')
         .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
     command.action(action(async (ctx, options) => {
-        const result = await runBrowserLogin(ctx, options, behavior);
+        const result = await runBrowserLogin(ctx, options);
+        ctx.output.write(result, { text: formatLoginResult(result) });
+    }));
+}
+function registerXiaoELoginCommand(auth, action) {
+    auth.command('xiaoe')
+        .description('Use XiaoE unified login without browser OAuth fallback')
+        .option('--base-url <url>', 'E10 base URL')
+        .option('--tenant-key <key>', 'Tenant key fallback after login')
+        // Keep previously accepted browser flags as no-ops so existing wrappers do
+        // not break. The dedicated handler never parses them or opens a callback.
+        .option('--port <n>', 'Deprecated compatibility option; ignored by XiaoE unified login', '19800')
+        .option('--agent_type <value>', 'Deprecated compatibility option; ignored by XiaoE unified login')
+        .option('--agent-type <value>', 'Alias of --agent_type')
+        .option('--agent-return-url <url>', 'Deprecated compatibility option; ignored by XiaoE unified login')
+        .action(action(async (ctx, options) => {
+        const result = await runXiaoELogin(ctx, options);
         ctx.output.write(result, { text: formatLoginResult(result) });
     }));
 }
@@ -758,7 +813,9 @@ export function registerE10AuthCommands(parent, action) {
         const commandOpts = asOptions(options);
         const authFile = findAuthFile(ctx.cwd, opts);
         const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
-        const valid = session && commandOpts.check !== false ? await session.checkValid() : undefined;
+        const valid = session && commandOpts.check !== false
+            ? session.isExpired() ? false : await session.checkValid()
+            : undefined;
         const status = session
             ? {
                 loggedIn: true,
@@ -779,6 +836,7 @@ export function registerE10AuthCommands(parent, action) {
                 ...(session.credentialSourceStep ? { credentialSourceStep: session.credentialSourceStep } : {}),
                 ...(session.credentialSourceType ? { credentialSourceType: session.credentialSourceType } : {}),
                 ...(session.credentialSourceLabel ? { credentialSourceLabel: session.credentialSourceLabel } : {}),
+                ...(session.expiryTimes ? { expiryTimes: session.expiryTimes } : {}),
                 valid,
             }
             : {
@@ -823,12 +881,7 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
-    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Use XiaoE unified login without browser OAuth fallback', {
-        tryXiaoEUnifiedLogin: true,
-        allowXiaoETokenScript: true,
-        explainXiaoEFallback: true,
-        browserFallback: 'never',
-    });
+    registerXiaoELoginCommand(auth, action);
     auth.command('logout')
         .alias('clear')
         .description('Clear saved E10 auth for the current or selected profile')

package/dist/internal/e10/auth/messages.js

@@ -1,3 +1,4 @@
 export const E10_REAUTH_GUIDANCE = '请结合当前宿主环境选择合适的登录方式，恢复登录后重试原请求。';
 export const E10_AUTH_REQUIRED_MESSAGE = `E10 登录态不可用。${E10_REAUTH_GUIDANCE}`;
+export const E10_XIAOE_RECOVERY_FAILED_MESSAGE = 'E10 登录态不可用。已尝试小 e 自动重新获取登录信息，但未取得可用登录态。请在小 e 中恢复登录后重试。';
 export const E10_SESSION_EXPIRED_MESSAGE = `E10 登录态已失效，本次操作已停止。${E10_REAUTH_GUIDANCE}`;

package/dist/internal/e10/auth/session.js

@@ -337,6 +337,15 @@ export class E10AuthSession {
     get credentialSourceLabel() {
         return this.data.credentialSourceLabel || '';
     }
+    get expiryTimes() {
+        const value = Number(this.data.expiryTimes);
+        return Number.isFinite(value) && value > 0 ? value : undefined;
+    }
+    /** XiaoE 换取的 ETEAMSID 是否已经超过其明确的失效时间。 */
+    isExpired(now = Date.now()) {
+        const expiryTimes = this.expiryTimes;
+        return expiryTimes !== undefined && now >= expiryTimes;
+    }
     getBaseUrl() {
         return (this.data.baseUrl || '').replace(/\/$/, '');
     }
@@ -389,6 +398,7 @@ export class E10AuthSession {
             stTicket: this.data.stTicket,
             redirectUrl: this.data.redirectUrl,
             cookieSavedAt: this.data.cookieSavedAt,
+            expiryTimes: this.expiryTimes,
             mainUrl: this.data.mainUrl,
             ...sourceInfo,
             hasEteamsId: Boolean(this.eteamsId),
@@ -419,7 +429,7 @@ export class E10AuthSession {
             return null;
         const session = E10AuthSession.fromFile(authPath, baseUrl, passportUrl);
         // 富化只是"刷新/纠偏"：登录时这些字段已落盘。调用方可显式跳过（见 E10SessionLoadOptions）。
-        if (session && !(load.skipProfileEnrichment && hasUsableUserId(session))) {
+        if (session && !session.isExpired() && !(load.skipProfileEnrichment && hasUsableUserId(session))) {
             await session.fetchEmployeeId();
         }
         return session;

package/dist/internal/e10/auth/xiaoe.js

@@ -57,6 +57,8 @@ export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/ex
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
 export const XIAOE_BUNDLED_ENV_SCRIPT_SOURCE = 'bundled scripts/xiaoe_env.py';
+/** 与 XiaoE `tokens.py` 保持一致：换票成功后默认有效 2 小时。 */
+export const XIAOE_ETEAMID_TTL_MS = 7_200_000;
 function envString(env, ...keys) {
     for (const key of keys) {
         const value = env[key];
@@ -134,6 +136,14 @@ function readString(data, ...keys) {
     }
     return '';
 }
+function readExpiryTimes(data) {
+    for (const key of ['expiryTimes', 'expiryTime', 'expiresAt', 'expires_at']) {
+        const value = Number(data[key]);
+        if (Number.isFinite(value) && value > 0)
+            return Math.trunc(value);
+    }
+    return undefined;
+}
 function cookieString(value) {
     if (!value)
         return '';
@@ -209,7 +219,19 @@ function readXiaoECredentialRecord(value, source, fallbackBaseUrl = '') {
         || cookieValue(rawCookie, 'ETEAMSID');
     if (!baseUrl || !eteamsId)
         return null;
-    return { baseUrl: normalizeUrl(baseUrl), eteamsId, source, rawCookie };
+    const expiryTimes = candidates.map(readExpiryTimes).find((value) => value !== undefined);
+    return {
+        baseUrl: normalizeUrl(baseUrl),
+        eteamsId,
+        source,
+        rawCookie,
+        ...(expiryTimes !== undefined ? { expiryTimes } : {}),
+    };
+}
+function withDefaultXiaoEExpiry(credential) {
+    if (!credential || credential.expiryTimes !== undefined)
+        return credential;
+    return { ...credential, expiryTimes: Date.now() + XIAOE_ETEAMID_TTL_MS };
 }
 function parseXiaoEUnifiedLoginMap(raw, source) {
     const value = raw.trim();
@@ -533,7 +555,7 @@ async function resolveXiaoETokenScriptCredential(baseUrl, env = process.env) {
     const tokenData = await runXiaoETokenScript(baseUrl, env);
     if (!tokenData)
         return null;
-    return readXiaoECredentialRecord(tokenData, 'xiaoeUserData/tokens.py', baseUrl);
+    return withDefaultXiaoEExpiry(readXiaoECredentialRecord(tokenData, 'xiaoeUserData/tokens.py', baseUrl));
 }
 async function resolveXiaoEBundledEnvScriptCredential(baseUrl, env = process.env) {
     const scriptPath = xiaoEBundledEnvScriptPath();
@@ -542,7 +564,7 @@ async function resolveXiaoEBundledEnvScriptCredential(baseUrl, env = process.env
     const tokenData = await runXiaoEPythonCredentialScript(scriptPath, baseUrl, env);
     if (!tokenData)
         return null;
-    return readXiaoECredentialRecord(tokenData, XIAOE_BUNDLED_ENV_SCRIPT_SOURCE, baseUrl);
+    return withDefaultXiaoEExpiry(readXiaoECredentialRecord(tokenData, XIAOE_BUNDLED_ENV_SCRIPT_SOURCE, baseUrl));
 }
 export function xiaoEClientRobotsRoot(env = process.env) {
     if (process.platform === 'win32') {
@@ -766,7 +788,7 @@ async function resolveXiaoETokenCredential(credential, baseUrl) {
     // from the same origin as the token exchange. Newer 0000/200 responses keep
     // the XiaoE service origin separate and use the requested E10 target.
     const resolvedBaseUrl = payload.code === 0 ? credential.erpaUrl : targetBaseUrl;
-    return readXiaoECredentialRecord(payload, credential.source, resolvedBaseUrl);
+    return withDefaultXiaoEExpiry(readXiaoECredentialRecord(payload, credential.source, resolvedBaseUrl));
 }
 async function resolveXiaoEPlatformCredential(baseUrl, env = process.env) {
     const credential = readXiaoEPlatformCredential(env);
@@ -850,6 +872,7 @@ async function saveXiaoEUnifiedLogin(input) {
         baseUrl,
         passportUrl: baseUrl,
         cookieSavedAt: Date.now(),
+        ...(input.expiryTimes !== undefined ? { expiryTimes: input.expiryTimes } : {}),
         loginSource: 'xiaoe-unified',
         credentialSourceStep: input.credentialSource.credentialSourceStep,
         credentialSourceType: input.credentialSource.credentialSourceType,
@@ -872,6 +895,7 @@ async function saveXiaoEUnifiedLogin(input) {
             agentType: XIAOE_AGENT_TYPE,
             version: '',
             loginSource: 'xiaoe-unified',
+            ...(input.expiryTimes !== undefined ? { expiryTimes: input.expiryTimes } : {}),
             ...input.credentialSource,
         },
     };
@@ -973,6 +997,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
             baseUrl: credential.baseUrl || baseUrl || DEFAULT_E10_BASE_URL,
             eteamsId: credential.eteamsId,
             rawCookie: credential.rawCookie,
+            expiryTimes: credential.expiryTimes,
             tenantKeyFallback: options.tenantKeyFallback,
             profileHint: options.profileHint,
             credentialSource: describeXiaoECredentialSource(credential.source),

package/dist/internal/e10/auth-recovery.js

@@ -1,6 +1,6 @@
 import { isXiaoERuntimeAgent } from '../../core/runtime-agent.js';
-import { getActiveProfile } from './auth/session.js';
-import { hasXiaoEEnv, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
+import { getActiveProfile, readProfileConfig } from './auth/session.js';
+import { hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
 const AUTH_REQUIRED_CODES = new Set(['-2', '401']);
 const AUTH_REQUIRED_MARKERS = [
     '未登录',
@@ -225,8 +225,10 @@ export function canAutomaticallyRecoverXiaoE(ctx, currentSession) {
         || isXiaoERuntimeAgent(currentSession?.agentType);
 }
 /**
- * Silently refresh a stale XiaoE session. Concurrent requests for the same
- * profile/base URL share one credential exchange, so a burst of 401 responses
+ * Silently recover a stale or missing XiaoE session. Without a local session,
+ * current runtime evidence is required before obtaining credentials.
+ * Concurrent requests for the same profile/base URL share one credential
+ * exchange, so a burst of 401 responses
  * does not start a burst of login attempts.
  */
 export async function recoverXiaoEAuthSession(ctx, currentSession) {
@@ -234,7 +236,12 @@ export async function recoverXiaoEAuthSession(ctx, currentSession) {
         return null;
     const options = globalOptions(ctx);
     const profile = options.profile || getActiveProfile();
-    const baseUrl = currentSession.getBaseUrl();
+    const config = readProfileConfig(profile);
+    const baseUrl = resolveXiaoEPreferredBaseUrl({
+        explicitBaseUrl: currentSession?.getBaseUrl() || options.baseUrl,
+        profileBaseUrl: config.baseUrl,
+        env: ctx.env,
+    });
     const key = `${profile}\n${baseUrl}`;
     const existing = recoveryInFlight.get(key);
     if (existing)
@@ -246,7 +253,7 @@ export async function recoverXiaoEAuthSession(ctx, currentSession) {
             profileBaseUrl: baseUrl,
             allowBundledEnvScript: true,
             allowTokenScript: true,
-            tenantKeyFallback: currentSession.tenantKey,
+            tenantKeyFallback: currentSession?.tenantKey || config.tenantKey,
             profileHint: profile,
             // Intentionally no logger: transparent recovery must not leak an
             // intermediate "login" step into agent stdout/stderr or JSON output.

package/dist/internal/e10/client.js

@@ -1,4 +1,5 @@
 import { isE10AuthenticationRequired, isE10LoginRedirect, isE10RedirectStatus, sameE10SessionIdentity, } from './auth-recovery.js';
+import { E10_XIAOE_RECOVERY_FAILED_MESSAGE } from './auth/messages.js';
 class E10AuthenticationContextChangedError extends Error {
 }
 export class E10ApiClient {
@@ -62,6 +63,18 @@ export class E10ApiClient {
     async requestRaw(url, init) {
         let lastError = null;
         let authenticationRecoveryAttempted = false;
+        if (this.auth.isExpired?.()) {
+            authenticationRecoveryAttempted = true;
+            const recovered = await this.recoverAuthentication?.(this.auth) || null;
+            if (!recovered || recovered.isExpired?.()) {
+                throw new Error(E10_XIAOE_RECOVERY_FAILED_MESSAGE);
+            }
+            if (!sameE10SessionIdentity(this.auth, recovered)) {
+                throw new E10AuthenticationContextChangedError('XiaoE automatic authentication recovery changed the E10 login context');
+            }
+            this.auth.replaceWith(recovered);
+            refreshAuthenticationHeaders(init, this.auth);
+        }
         for (let attempt = 1; attempt <= this.retries; attempt++) {
             try {
                 const resp = await fetch(url, { ...init, redirect: 'manual' });

package/dist/internal/e10/context.js

@@ -1,14 +1,35 @@
 import { CliError, ExitCode } from '../../core/errors.js';
-import { E10_AUTH_REQUIRED_MESSAGE } from './auth/messages.js';
+import { E10_AUTH_REQUIRED_MESSAGE, E10_XIAOE_RECOVERY_FAILED_MESSAGE } from './auth/messages.js';
 import { E10AuthSession } from './auth/session.js';
 import { E10ApiClient } from './client.js';
-import { recoverXiaoEAuthSession } from './auth-recovery.js';
+import { canAutomaticallyRecoverXiaoE, recoverXiaoEAuthSession } from './auth-recovery.js';
+function xiaoERecoveryFailedError() {
+    return Object.assign(new CliError(E10_XIAOE_RECOVERY_FAILED_MESSAGE, ExitCode.AuthError), {
+        type: 'authentication',
+        subtype: 'xiaoe_credential_unavailable',
+        retryable: false,
+        stage: 'xiaoe_unified_login',
+    });
+}
 export async function getE10Session(ctx, load = {}) {
     const options = ctx.getGlobalOptions();
     return E10AuthSession.fromOptions(options, ctx.cwd, load);
 }
 export async function requireE10Session(ctx, load = {}) {
-    const session = await getE10Session(ctx, load);
+    let session = await getE10Session(ctx, load);
+    if (session?.isExpired() && canAutomaticallyRecoverXiaoE(ctx, session)) {
+        session = await recoverXiaoEAuthSession(ctx, session).catch(() => null);
+        if (!session || session.isExpired())
+            throw xiaoERecoveryFailedError();
+    }
+    if (!session && canAutomaticallyRecoverXiaoE(ctx)) {
+        // Read-only probes use getE10Session; only a command requiring a session
+        // may establish one from the current XiaoE host's credentials.
+        session = await recoverXiaoEAuthSession(ctx).catch(() => null);
+        if (!session) {
+            throw xiaoERecoveryFailedError();
+        }
+    }
     if (!session) {
         throw new CliError(E10_AUTH_REQUIRED_MESSAGE, ExitCode.AuthError);
     }

package/dist/internal/e10/request-runtime.js

@@ -1,6 +1,7 @@
 import { CliError, ExitCode } from '../../core/errors.js';
 import { classifyE10Redirect, isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
 import { startFetchTiming } from './fetch-timing.js';
+import { E10_XIAOE_RECOVERY_FAILED_MESSAGE } from './auth/messages.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_BIG_INT_STRINGS = true;
 /** 下载直传最多跟几跳：E10 -> 对象存储通常 1 跳，留一点余量但不允许成环。 */
@@ -53,6 +54,12 @@ export class E10RequestRuntime {
         return this.request({ ...request, responseType: 'binary' });
     }
     async request(request) {
+        if (this.session.isExpired?.()) {
+            const recovered = await this.recoverExpiredSession(this.session.eteamsId);
+            if (!recovered || this.session.isExpired?.()) {
+                throw new E10ApiError('authentication', 'session_expired', E10_XIAOE_RECOVERY_FAILED_MESSAGE, { exitCode: ExitCode.AuthError, retryable: false });
+            }
+        }
         const mutable = this.prepareRequest(request);
         try {
             await this.runBeforeRequest(mutable, this.sessionContext());
@@ -171,6 +178,8 @@ export class E10RequestRuntime {
         }
         if (!recovered)
             return false;
+        if (recovered.isExpired?.())
+            return false;
         if (!sameE10SessionIdentity(this.session, recovered)) {
             throw new E10ApiError('authentication', 'session_context_changed', 'XiaoE 自动恢复后的登录身份或 E10 环境发生变化，本次请求未重试', { exitCode: ExitCode.AuthError, retryable: false });
         }
@@ -201,6 +210,7 @@ export class E10RequestRuntime {
             timeoutMs: request.timeoutMs || DEFAULT_TIMEOUT_MS,
             responseType: request.responseType || 'json',
             bigIntStrings: request.bigIntStrings ?? DEFAULT_BIG_INT_STRINGS,
+            followRedirects: request.followRedirects === true,
         };
     }
     sessionContext() {
@@ -270,7 +280,8 @@ export class E10RequestRuntime {
         const init = {
             method: request.method,
             headers,
-            redirect: 'manual',
+            // 文件下载允许跟随重定向（302 → 文件服务）；其余请求保持 manual 以便识别登录跳转
+            redirect: request.followRedirects ? 'follow' : 'manual',
         };
         if (request.streamBody) {
             init.body = request.streamBody;

package/dist/shortcuts/archive/host.js

@@ -135,6 +135,8 @@ export function createArchiveHost(ctx, dependencies = {}) {
                 formData: multipart,
                 headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
                 timeoutMs,
+                // 下载接口常 302 重定向到文件服务/CDN，需跟随，避免被误判为登录失效
+                followRedirects: true,
             })
             : await rt.requestJson({
                 module: 'archive',

package/dist/shortcuts/archive/manifest.js

@@ -25,7 +25,7 @@ export const archiveManifest = {
     rules: [
         '写操作（*.apply）必须先执行同名的 prepare 拿到 continuation，再带 confirm=true 执行 apply；CLI 用 --yes 表示确认。',
         '借阅单下载为异步任务：apply 会轮询打包进度，完成后把 zip 保存到当前用户的「下载」目录（可用 output 指定路径）。',
-        '发起借阅/续借只返回流程创建页 URL，CLI 不自动打开浏览器，需由用户或上层在浏览器中打开。',
+        '发起借阅/续借只返回流程创建页 URL，CLI 不自动打开浏览器；应以 Markdown 超链接（a 标签）返回，由客户端决定打开方式。',
         '借阅车/借阅单列表优先自定义接口，接口未发布时自动回退 ebuilder 列表链路，回退时行的字段更少（提供 fields/display）。',
     ],
     operations: archiveOperations,

package/dist/shortcuts/archive/operations/borrow-list.js

@@ -194,7 +194,19 @@ const borrowListDetail = {
         }
         const session = await host.getSession();
         const detail = await fetchBorrowDetail(host, session.userId, String(dataId));
-        return archiveSuccess('archive.borrow-list.detail', detail, { count: detail.details.length });
+        // 档案题名补可点击链接：arcDangan.id 形如 {档案ID}_{表单ID}，拼成与全文检索一致的 archiveView
+        const root = String(session?.baseUrl ?? '').replace(/\/+$/, '');
+        const details = detail.details.map((item) => ({
+            ...item,
+            arcDangan: item.arcDangan.map((arc) => {
+                const [arcId, arcFormId = ''] = String(arc.id ?? '').split('_');
+                if (!arcId || !arcFormId)
+                    return arc;
+                const viewPath = `/sp/custom/archive/archiveView?arcId=${arcId}&arcFormId=${arcFormId}`;
+                return { ...arc, viewPath, url: root ? `${root}${viewPath}` : viewPath };
+            }),
+        }));
+        return archiveSuccess('archive.borrow-list.detail', { ...detail, details }, { count: details.length });
     },
 };
 export const borrowListOperations = [borrowListList, borrowListDetail];

package/dist/shortcuts/archive/operations/flow-url.js

@@ -67,7 +67,7 @@ function flowResult(action, baseUrl, workflowId, params, extra = {}) {
         workflowId,
         url: buildFlowUrl(baseUrl, workflowId, params),
         params,
-        hint: 'CLI 不自动打开浏览器，请在浏览器中打开该 URL 完成后续填写与提交',
+        hint: 'CLI 不自动打开浏览器，也不要执行 open/start 自动打开；请把 url 以 Markdown 超链接（a 标签）返回，由客户端决定打开方式',
     }, { wrote: true });
 }
 const flowBorrowCarPrepare = {