weaver-work-cli 0.1.39 → 0.1.40

package/dist/chunks/{registry-YX4CSEMD.js → registry-UGRBCBHO.js}

@@ -4,12 +4,12 @@ import {
   getWorkflowOperation,
   hasWorkflowOperation,
   workflowOperationDefinitions
-} from "./chunk-F2EQXUEE.js";
+} from "./chunk-LFMSDBZN.js";
 import "./chunk-EZALDOQH.js";
 import "./chunk-FMPJJYYI.js";
 import "./chunk-ZUX3P6BQ.js";
 import "./chunk-AJ62BGAW.js";
-import "./chunk-XXJOSZTQ.js";
+import "./chunk-4TEDNCON.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{room-recommend-L3MWH4JW.js → room-recommend-A3UDC3CA.js}

@@ -6,10 +6,10 @@ import {
   loadRooms,
   recommendRooms,
   rememberFrequentRoom
-} from "./chunk-T7JDJJ7H.js";
-import "./chunk-P2DAISYW.js";
-import "./chunk-YS5DPN4T.js";
-import "./chunk-CQHGNCK2.js";
+} from "./chunk-FLS4DPGP.js";
+import "./chunk-I566ZYNF.js";
+import "./chunk-NJKREDA3.js";
+import "./chunk-7BRU4EFH.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{schedule-UASAVDVD.js → schedule-5GCACCK7.js}

@@ -8,10 +8,10 @@ import {
   resolveMeetingScheduleTypeIds,
   resolveMemberIdsByName,
   runScheduleConflictFlow
-} from "./chunk-L4N7B7ZD.js";
-import "./chunk-P2DAISYW.js";
-import "./chunk-YS5DPN4T.js";
-import "./chunk-CQHGNCK2.js";
+} from "./chunk-4CTESSKI.js";
+import "./chunk-I566ZYNF.js";
+import "./chunk-NJKREDA3.js";
+import "./chunk-7BRU4EFH.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{workflow-KDGIUCNW.js → workflow-M5ZJ7DWF.js}

@@ -1,8 +1,5 @@
 import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
-import {
-  createWorkflowHost
-} from "./chunk-K3RUEEOL.js";
 import {
   USER_INTENT_RULE_FILE,
   aigroupUserDir,
@@ -17,10 +14,13 @@ import {
   validateRuleFile,
   workflowOperationDefinitions,
   workflowSuccess
-} from "./chunk-F2EQXUEE.js";
+} from "./chunk-LFMSDBZN.js";
 import {
   createWorkflowContinuationSigner
 } from "./chunk-EZALDOQH.js";
+import {
+  createWorkflowHost
+} from "./chunk-NETCCARD.js";
 import {
   CLARIFICATION_SUBTYPE,
   WorkflowCliError,
@@ -28,8 +28,8 @@ import {
 } from "./chunk-FMPJJYYI.js";
 import "./chunk-ZUX3P6BQ.js";
 import "./chunk-AJ62BGAW.js";
-import "./chunk-EZGFHJFW.js";
-import "./chunk-XXJOSZTQ.js";
+import "./chunk-WFFNM65B.js";
+import "./chunk-4TEDNCON.js";
 import {
   isCliError,
   toErrorEnvelope

package/dist/index.js

@@ -7,12 +7,12 @@ import {
   firstPositionalToken,
   registerCommands,
   toCommandMetadata
-} from "./chunks/chunk-GVPJZXJ2.js";
+} from "./chunks/chunk-LN447PY2.js";
 import "./chunks/chunk-ZUX3P6BQ.js";
 import "./chunks/chunk-AJ62BGAW.js";
-import "./chunks/chunk-ZXRNHZTE.js";
-import "./chunks/chunk-EZGFHJFW.js";
-import "./chunks/chunk-XXJOSZTQ.js";
+import "./chunks/chunk-SPRHHSVC.js";
+import "./chunks/chunk-WFFNM65B.js";
+import "./chunks/chunk-4TEDNCON.js";
 import "./chunks/chunk-LUSPKZKY.js";
 import "./chunks/chunk-BUSC6UAE.js";
 
@@ -29,7 +29,7 @@ function lazyShortcut(definition) {
       placeholder.allowExcessArguments(true);
       placeholder.helpOption(false);
       placeholder.action(async () => {
-        const { dispatchLazyShortcut } = await import("./chunks/lazy-dispatch-NLZ5UQQI.js");
+        const { dispatchLazyShortcut } = await import("./chunks/lazy-dispatch-XRRI46M6.js");
         await dispatchLazyShortcut(definition, shortcutMetadata());
       });
     }
@@ -39,117 +39,117 @@ var builtinShortcuts = [
   lazyShortcut({
     name: "invoice",
     description: "E10 \u4E1A\u7968\u901A\u53D1\u7968\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/invoice-WNBS2B4C.js")).invoiceShortcut
+    load: async () => (await import("./chunks/invoice-T5JTA32H.js")).invoiceShortcut
   }),
   lazyShortcut({
     name: "ehr",
     description: "\u6CDB\u5FAEE10\u805A\u624D\u6797\uFF08\u4EBA\u4E8B/\u51FA\u52E4/\u85AA\u916C\uFF09CLI",
-    load: async () => (await import("./chunks/ehr-RAQNEQO7.js")).ehrShortcut
+    load: async () => (await import("./chunks/ehr-GYXIYH3A.js")).ehrShortcut
   }),
   lazyShortcut({
     name: "cowork",
     description: "\u6CDB\u5FAEE10\u534F\u4F5C\u533A\uFF08\u534F\u4F5C\u4E8B\u9879/\u8BA8\u8BBA/\u5BA1\u6279/\u5171\u4EAB\u6743\u9650\uFF09CLI",
-    load: async () => (await import("./chunks/cowork-HNGBPD7A.js")).coworkShortcut
+    load: async () => (await import("./chunks/cowork-HJLI353D.js")).coworkShortcut
   }),
   lazyShortcut({
     name: "archive",
     description: "E10 \u6587\u4E66\u5B9A\u6863\u6848\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/archive-ENZYBBME.js")).archiveShortcut
+    load: async () => (await import("./chunks/archive-JHTONRST.js")).archiveShortcut
   }),
   lazyShortcut({
     name: "archive-oa",
     description: "E10 \u6863\u6848\u5B9A\u4F4D\u4E0E OA \u5546\u52A1\u5408\u540C\u501F\u9605 CLI",
-    load: async () => (await import("./chunks/archive-oa-YWLEC5V4.js")).archiveOaShortcut
+    load: async () => (await import("./chunks/archive-oa-FCHLCPHC.js")).archiveOaShortcut
   }),
   lazyShortcut({
     name: "calendar",
     description: "\u6CDB\u5FAEE10\u65E5\u7A0B\u7BA1\u7406 CLI\uFF08\u521B\u5EFA/\u67E5\u8BE2/\u66F4\u65B0/\u5220\u9664/\u5B57\u5178\uFF09",
-    load: async () => (await import("./chunks/calendar-CIARBAOX.js")).calendarShortcut
+    load: async () => (await import("./chunks/calendar-RTWAMKHD.js")).calendarShortcut
   }),
   lazyShortcut({
     name: "fna",
     description: "\u6CDB\u5FAEE10\u9F50\u4E1A\u6210\u8D39\u63A7\u4E2D\u5FC3\uFF08\u9884\u7B97/\u8D39\u7528\u4E2D\u5FC3/\u501F\u6B3E\u7BA1\u7406/\u53D1\u7968\u6838\u9500\uFF09CLI",
-    load: async () => (await import("./chunks/fna-XTSRB7G7.js")).fnaShortcut
+    load: async () => (await import("./chunks/fna-K2MHTQ24.js")).fnaShortcut
   }),
   lazyShortcut({
     name: "hrm",
     description: "\u6CDB\u5FAEE10\u7EC4\u7EC7\u7BA1\u7406\uFF08\u5458\u5DE5/\u7EC4\u7EC7/\u5C97\u4F4D\u67E5\u8BE2\uFF09CLI",
-    load: async () => (await import("./chunks/hrm-TLHKC545.js")).hrmShortcut
+    load: async () => (await import("./chunks/hrm-VLRBKTZB.js")).hrmShortcut
   }),
   lazyShortcut({
     name: "mail",
     description: "\u6CDB\u5FAEE10\u90AE\u4EF6\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/mail-LRYMBFNL.js")).mailShortcut
+    load: async () => (await import("./chunks/mail-3Y7MJ6PS.js")).mailShortcut
   }),
   lazyShortcut({
     name: "meeting",
     description: "\u6CDB\u5FAEE10\u4F1A\u8BAE\u7BA1\u7406 CLI\uFF08\u6807\u51C6\u7248\uFF1A\u67E5\u8BE2/\u51B2\u7A81/\u9884\u7EA6/\u56DE\u6267/\u7B7E\u5230\uFF09",
-    load: async () => (await import("./chunks/meeting-ESXL6MFI.js")).meetingShortcut
+    load: async () => (await import("./chunks/meeting-M7LTXGJE.js")).meetingShortcut
   }),
   lazyShortcut({
     name: "okr",
     description: "\u6CDB\u5FAEE10 OKR \u76EE\u6807\u7BA1\u7406 CLI\uFF08\u76EE\u6807\u67E5\u8BE2/\u65B0\u5EFA/\u7F16\u8F91\u3001\u5173\u952E\u6210\u679C\u3001\u76EE\u6807\u5BF9\u9F50\u3001\u8BC4\u8BBA\uFF09",
-    load: async () => (await import("./chunks/okr-EOV65SSF.js")).okrShortcut
+    load: async () => (await import("./chunks/okr-OBC6S67L.js")).okrShortcut
   }),
   lazyShortcut({
     name: "plan",
     description: "\u6CDB\u5FAEE10\u8BA1\u5212\u62A5\u544A CLI\uFF08\u67E5\u8BE2/\u65B0\u5EFA/\u4FEE\u6539/\u53D1\u5E03/\u64A4\u56DE/\u63D0\u4EA4\u63D0\u9192/\u8BC4\u8BBA\uFF09",
-    load: async () => (await import("./chunks/plan-YFPVKW6Y.js")).planShortcut
+    load: async () => (await import("./chunks/plan-5H6I53SK.js")).planShortcut
   }),
   lazyShortcut({
     name: "esb",
     description: "\u6CDB\u5FAEE10 ESB \u4E2D\u5FC3\u81EA\u5B9A\u4E49\u89E6\u53D1\u52A8\u4F5C\u6D41 CLI",
-    load: async () => (await import("./chunks/esb-6XV7C7YV.js")).esbShortcut
+    load: async () => (await import("./chunks/esb-I5INCEFE.js")).esbShortcut
   }),
   lazyShortcut({
     name: "ebuilder-form",
     description: "\u6CDB\u5FAEE10 eBuilder \u8868\u5355\u83DC\u5355\u3001\u5217\u8868\u548C\u8868\u5355\u6570\u636E CLI",
-    load: async () => (await import("./chunks/ebuilder-form-OY6DVNRK.js")).ebuilderFormShortcut
+    load: async () => (await import("./chunks/ebuilder-form-HTGI63UU.js")).ebuilderFormShortcut
   }),
   lazyShortcut({
     name: "jiuchuanhui",
     description: "\u6CDB\u5FAEE10\u4E5D\u6C1A\u6C47\u8425\u9500\u7BA1\u7406 CLI\uFF08\u5BA2\u6237/\u8054\u7CFB\u4EBA/\u5546\u673A/\u7EBF\u7D22/\u8054\u7CFB\u8BA1\u5212/\u516C\u6D77\uFF09",
-    load: async () => (await import("./chunks/jiuchuanhui-XABWS5RN.js")).jiuchuanhuiShortcut
+    load: async () => (await import("./chunks/jiuchuanhui-P2FNEQVZ.js")).jiuchuanhuiShortcut
   }),
   lazyShortcut({
     name: "asset",
     description: "E10 \u8D44\u4EA7\u7BA1\u7406\uFF08\u8D44\u7BA1\u5BB6\uFF09CLI",
-    load: async () => (await import("./chunks/asset-OOV6DWPA.js")).assetShortcut
+    load: async () => (await import("./chunks/asset-RLIHC7DB.js")).assetShortcut
   }),
   lazyShortcut({
     name: "asset-idle",
     description: "E10 \u95F2\u7F6E\u8D44\u4EA7\u5224\u5B9A\u7ED3\u679C\u67E5\u8BE2 CLI\uFF08\u5206\u9875\u83B7\u53D6/\u805A\u5408\u7EDF\u8BA1\uFF09",
-    load: async () => (await import("./chunks/asset-idle-RE632MY5.js")).assetIdleShortcut
+    load: async () => (await import("./chunks/asset-idle-KVOFTLCP.js")).assetIdleShortcut
   }),
   lazyShortcut({
     name: "im",
     description: "\u6CDB\u5FAEE10\u6613\u79D2\u529E\uFF08\u5373\u65F6\u901A\u8BAF\uFF09CLI",
-    load: async () => (await import("./chunks/im-YOUCFMUK.js")).imShortcut
+    load: async () => (await import("./chunks/im-QK3VTLXK.js")).imShortcut
   }),
   lazyShortcut({
     name: "project",
     description: "\u6CDB\u5FAEE10\u4E8B\u4E95\u7136\u9879\u76EE\u7BA1\u7406 CLI\uFF08\u9879\u76EE/\u4EFB\u52A1\u67E5\u8BE2\u4E0E\u786E\u8BA4\u5199\u5165\uFF09",
-    load: async () => (await import("./chunks/project-MDVZUYQW.js")).projectShortcut
+    load: async () => (await import("./chunks/project-L75QZV4S.js")).projectShortcut
   }),
   lazyShortcut({
     name: "workflow",
     description: "\u6CDB\u5FAEE10\u6D41\u7A0B\u667A\u80FD\u52A9\u624B CLI\uFF08\u67E5\u8BE2/\u67E5\u770B/\u64CD\u4F5C/\u6279\u91CF/\u53D1\u8D77/\u4FEE\u6539\uFF09",
-    load: async () => (await import("./chunks/workflow-KDGIUCNW.js")).workflowShortcut
+    load: async () => (await import("./chunks/workflow-M5ZJ7DWF.js")).workflowShortcut
   }),
   lazyShortcut({
     name: "blog",
     description: "\u6CDB\u5FAEE10\u5DE5\u4F5C\u65E5\u62A5 CLI\uFF08\u67E5\u8BE2/\u53D1\u5E03/\u7F16\u8F91/\u8BC4\u8BBA/\u70B9\u8D5E/\u63D0\u9192/\u5BFC\u51FA\uFF09",
-    load: async () => (await import("./chunks/blog-PEPOJAL7.js")).blogShortcut
+    load: async () => (await import("./chunks/blog-42OZTJNP.js")).blogShortcut
   }),
   lazyShortcut({
     name: "caizhilian",
     description: "\u6CDB\u5FAEE10\u91C7\u77E5\u8FDE\uFF08\u6587\u6863\u4E2D\u5FC3\uFF09CLI",
-    load: async () => (await import("./chunks/caizhilian-WYIQDVPJ.js")).caizhilianShortcut
+    load: async () => (await import("./chunks/caizhilian-KRK547K5.js")).caizhilianShortcut
   }),
   lazyShortcut({
     name: "contract",
     description: "\u6CDB\u5FAEE10\u4ECA\u627F\u8FBE\u5408\u540C\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/contract-73MERZWN.js")).contractShortcut
+    load: async () => (await import("./chunks/contract-HI4FNPYE.js")).contractShortcut
   })
 ];
 function shortcutMetadata() {

package/dist/internal/e10/auth/commands.js

@@ -17,6 +17,7 @@ const AGENT_RETURN_URL_ENV_KEY = 'WEAVER_AGENT_RETURN_URL';
 const AGENT_RETURN_PATH = '/agent-return';
 const AGENT_RETURN_TOKEN_HEADER = 'x-weaver-agent-return-token';
 const AGENT_RETURN_TIMEOUT_MS = 900_000;
+const OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS = 30_000;
 const UNSAFE_AGENT_RETURN_PROTOCOLS = new Set([
     'about:',
     'blob:',
@@ -191,6 +192,7 @@ function formatAuthStatus(status) {
         ...('credentialSourceStep' in status && status.credentialSourceStep ? ['credentialSourceStep: ' + status.credentialSourceStep] : []),
         ...('credentialSourceType' in status && status.credentialSourceType ? ['credentialSourceType: ' + status.credentialSourceType] : []),
         ...('credentialSourceLabel' in status && status.credentialSourceLabel ? ['credentialSourceLabel: ' + status.credentialSourceLabel] : []),
+        ...('expiryTimes' in status && status.expiryTimes ? ['expiryTimes: ' + status.expiryTimes] : []),
     ];
     if ('valid' in status) {
         lines.push('valid: ' + String(status.valid));
@@ -210,6 +212,7 @@ function formatLoginResult(result) {
         ...(result.credentialSourceStep ? ['credentialSourceStep: ' + result.credentialSourceStep] : []),
         ...(result.credentialSourceType ? ['credentialSourceType: ' + result.credentialSourceType] : []),
         ...(result.credentialSourceLabel ? ['credentialSourceLabel: ' + result.credentialSourceLabel] : []),
+        ...(result.expiryTimes ? ['expiryTimes: ' + result.expiryTimes] : []),
     ].join('\n');
 }
 async function clearInvoiceTokenCache(profile, authData) {
@@ -300,6 +303,24 @@ export function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
     });
     return `${baseUrl}/papi/sso/oauth2.0/authorize?${authorizeParams.toString()}`;
 }
+/** Node's HTTP parser exposes the first unread bytes when TLS is sent to an HTTP listener. */
+export function isTlsClientHello(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const rawPacket = error.rawPacket;
+    return Buffer.isBuffer(rawPacket)
+        && rawPacket.length >= 3
+        && rawPacket[0] === 0x16
+        && rawPacket[1] === 0x03;
+}
+export function createOAuthCallbackProtocolMismatchError(port) {
+    return Object.assign(new CliError(`OAuth callback protocol mismatch: the browser connected to https://127.0.0.1:${port}, but the CLI callback listener uses HTTP. Retry the login and, on the callback error page, change only the URL scheme to http:// before reloading; keep the path and query unchanged. The E10 authorization service should preserve HTTP loopback redirect URIs.`, ExitCode.AuthError), {
+        type: 'authentication',
+        subtype: 'oauth_callback_protocol_mismatch',
+        retryable: false,
+        stage: 'oauth_callback',
+    });
+}
 async function readJsonObject(resp) {
     const data = await resp.json().catch(() => ({}));
     return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
@@ -488,7 +509,7 @@ function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
         'CLI 会优先使用 XiaoE 客户端内置 Python 执行 tokens.py；自动发现不可用时，可用 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON 指定兼容解释器。',
     ].join(' ');
 }
-async function runBrowserLogin(ctx, options, behavior = {}) {
+async function runXiaoELogin(ctx, options) {
     const commandOpts = asOptions(options);
     const globalOptions = ctx.getGlobalOptions();
     const profileFromGlobal = globalOptions.profile;
@@ -499,59 +520,49 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         profileBaseUrl: cfg.baseUrl,
         env: ctx.env,
     });
-    const xiaoESources = behavior.tryXiaoEUnifiedLogin === true
-        ? inspectXiaoEUnifiedLoginSources({
-            env: ctx.env,
-            baseUrl: preferredXiaoEBaseUrl,
-            profileBaseUrl: cfg.baseUrl,
-            allowTokenScript: behavior.allowXiaoETokenScript === true,
-        })
-        : {
-            platformCredential: false,
-            tokenScript: false,
-            clientCredential: false,
-            environmentCredential: false,
-            any: false,
-        };
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
-    const baseUrl = behavior.tryXiaoEUnifiedLogin
-        ? preferredXiaoEBaseUrl
-        : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
+    const xiaoESources = inspectXiaoEUnifiedLoginSources({
+        env: ctx.env,
+        baseUrl: preferredXiaoEBaseUrl,
+        profileBaseUrl: cfg.baseUrl,
+        allowTokenScript: true,
+    });
+    const useXiaoELogin = xiaoESources.any;
+    const baseUrl = preferredXiaoEBaseUrl;
+    const tenantKey = optionString(commandOpts, 'tenantKey');
+    ctx.logger.info([
+        'XiaoE unified login preflight:',
+        'authMode=xiaoe',
+        `credentialSourceDetected=${String(xiaoESources.any)}`,
+        `attempted=${String(useXiaoELogin)}`,
+        `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+        `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+        `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+        `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+        `baseUrl=${baseUrl || '(unresolved)'}`,
+    ].join(' '));
+    if (useXiaoELogin) {
+        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true);
+        if (xiaoEResult)
+            return xiaoEResult;
+    }
+    ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
+    throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+}
+async function runBrowserLogin(ctx, options) {
+    const commandOpts = asOptions(options);
+    const globalOptions = ctx.getGlobalOptions();
+    const profileFromGlobal = globalOptions.profile;
+    const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+    const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
+    const baseUrl = normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
     const explicitAgentType = optionString(commandOpts, 'agentType', 'agent_type');
-    const agentType = useXiaoELogin
-        ? optionString(commandOpts, 'agentType', 'agent_type') || XIAOE_AGENT_TYPE
-        : resolveAgentType(commandOpts, ctx.env);
+    const agentType = resolveAgentType(commandOpts, ctx.env);
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
-    if (behavior.tryXiaoEUnifiedLogin) {
-        ctx.logger.info([
-            'XiaoE unified login preflight:',
-            'authMode=xiaoe',
-            `credentialSourceDetected=${String(xiaoESources.any)}`,
-            `attempted=${String(useXiaoELogin)}`,
-            `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
-            `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
-            `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
-            `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
-            `baseUrl=${baseUrl || '(unresolved)'}`,
-        ].join(' '));
-    }
-    if (useXiaoELogin) {
-        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
-        if (xiaoEResult)
-            return xiaoEResult;
-    }
-    const willOpenBrowser = behavior.browserFallback !== 'never';
-    if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
-        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-    }
-    if (!willOpenBrowser) {
-        throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
-    }
     if (!baseUrl)
         throw new CliError('Missing --base-url', ExitCode.UsageError);
     const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
@@ -564,6 +575,7 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         let settled = false;
         let timer = null;
         let pendingLoginResult = null;
+        let tlsCallbackDetected = false;
         const finish = (error, result) => {
             if (settled)
                 return;
@@ -647,6 +659,13 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
                 finish(new CliError('No authorization code received.', ExitCode.AuthError));
                 return;
             }
+            // The user followed the recovery instruction and reached the HTTP
+            // callback. Do not let the protocol-mismatch grace timer race the token
+            // exchange that is now legitimately in progress.
+            if (tlsCallbackDetected && timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
             try {
                 const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
                 const responseHeaders = {
@@ -685,6 +704,26 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
                     : error.message;
             finish(new CliError(message, ExitCode.UsageError));
         });
+        server.on('clientError', (error, socket) => {
+            if (isTlsClientHello(error)) {
+                if (!tlsCallbackDetected) {
+                    tlsCallbackDetected = true;
+                    ctx.logger.warn([
+                        `OAuth callback protocol mismatch: the browser used HTTPS for 127.0.0.1:${port}, while the CLI listener is HTTP.`,
+                        '在 30 秒内把浏览器当前地址开头明确改为 http://，保留后面的完整路径和参数，然后回车重试。',
+                        '不要把地址中的授权码复制到聊天或日志。',
+                    ].join(' '));
+                    if (timer)
+                        clearTimeout(timer);
+                    timer = setTimeout(() => {
+                        finish(createOAuthCallbackProtocolMismatchError(port));
+                    }, OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS);
+                }
+                socket.destroy();
+                return;
+            }
+            socket.destroy();
+        });
         server.listen(port, '127.0.0.1', () => {
             ctx.logger.info('Local callback server: ' + redirectUri);
             openUrlInBrowser(loginUrl, ctx);
@@ -728,7 +767,7 @@ function formatWhoami(title, data) {
         'User-Agent: ' + (data.userAgent || ''),
     ].join('\n');
 }
-function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
+function registerBrowserLoginCommand(auth, action, name, description) {
     const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
@@ -738,7 +777,23 @@ function registerBrowserLoginCommand(auth, action, name, description, behavior =
         .option('--agent-type <value>', 'Alias of --agent_type')
         .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
     command.action(action(async (ctx, options) => {
-        const result = await runBrowserLogin(ctx, options, behavior);
+        const result = await runBrowserLogin(ctx, options);
+        ctx.output.write(result, { text: formatLoginResult(result) });
+    }));
+}
+function registerXiaoELoginCommand(auth, action) {
+    auth.command('xiaoe')
+        .description('Use XiaoE unified login without browser OAuth fallback')
+        .option('--base-url <url>', 'E10 base URL')
+        .option('--tenant-key <key>', 'Tenant key fallback after login')
+        // Keep previously accepted browser flags as no-ops so existing wrappers do
+        // not break. The dedicated handler never parses them or opens a callback.
+        .option('--port <n>', 'Deprecated compatibility option; ignored by XiaoE unified login', '19800')
+        .option('--agent_type <value>', 'Deprecated compatibility option; ignored by XiaoE unified login')
+        .option('--agent-type <value>', 'Alias of --agent_type')
+        .option('--agent-return-url <url>', 'Deprecated compatibility option; ignored by XiaoE unified login')
+        .action(action(async (ctx, options) => {
+        const result = await runXiaoELogin(ctx, options);
         ctx.output.write(result, { text: formatLoginResult(result) });
     }));
 }
@@ -758,7 +813,9 @@ export function registerE10AuthCommands(parent, action) {
         const commandOpts = asOptions(options);
         const authFile = findAuthFile(ctx.cwd, opts);
         const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
-        const valid = session && commandOpts.check !== false ? await session.checkValid() : undefined;
+        const valid = session && commandOpts.check !== false
+            ? session.isExpired() ? false : await session.checkValid()
+            : undefined;
         const status = session
             ? {
                 loggedIn: true,
@@ -779,6 +836,7 @@ export function registerE10AuthCommands(parent, action) {
                 ...(session.credentialSourceStep ? { credentialSourceStep: session.credentialSourceStep } : {}),
                 ...(session.credentialSourceType ? { credentialSourceType: session.credentialSourceType } : {}),
                 ...(session.credentialSourceLabel ? { credentialSourceLabel: session.credentialSourceLabel } : {}),
+                ...(session.expiryTimes ? { expiryTimes: session.expiryTimes } : {}),
                 valid,
             }
             : {
@@ -823,12 +881,7 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
-    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Use XiaoE unified login without browser OAuth fallback', {
-        tryXiaoEUnifiedLogin: true,
-        allowXiaoETokenScript: true,
-        explainXiaoEFallback: true,
-        browserFallback: 'never',
-    });
+    registerXiaoELoginCommand(auth, action);
     auth.command('logout')
         .alias('clear')
         .description('Clear saved E10 auth for the current or selected profile')

package/dist/internal/e10/auth/session.js

@@ -337,6 +337,15 @@ export class E10AuthSession {
     get credentialSourceLabel() {
         return this.data.credentialSourceLabel || '';
     }
+    get expiryTimes() {
+        const value = Number(this.data.expiryTimes);
+        return Number.isFinite(value) && value > 0 ? value : undefined;
+    }
+    /** XiaoE 换取的 ETEAMSID 是否已经超过其明确的失效时间。 */
+    isExpired(now = Date.now()) {
+        const expiryTimes = this.expiryTimes;
+        return expiryTimes !== undefined && now >= expiryTimes;
+    }
     getBaseUrl() {
         return (this.data.baseUrl || '').replace(/\/$/, '');
     }
@@ -389,6 +398,7 @@ export class E10AuthSession {
             stTicket: this.data.stTicket,
             redirectUrl: this.data.redirectUrl,
             cookieSavedAt: this.data.cookieSavedAt,
+            expiryTimes: this.expiryTimes,
             mainUrl: this.data.mainUrl,
             ...sourceInfo,
             hasEteamsId: Boolean(this.eteamsId),
@@ -419,7 +429,7 @@ export class E10AuthSession {
             return null;
         const session = E10AuthSession.fromFile(authPath, baseUrl, passportUrl);
         // 富化只是"刷新/纠偏"：登录时这些字段已落盘。调用方可显式跳过（见 E10SessionLoadOptions）。
-        if (session && !(load.skipProfileEnrichment && hasUsableUserId(session))) {
+        if (session && !session.isExpired() && !(load.skipProfileEnrichment && hasUsableUserId(session))) {
             await session.fetchEmployeeId();
         }
         return session;

package/dist/internal/e10/auth/xiaoe.js

@@ -57,6 +57,8 @@ export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/ex
 export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
 export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
 export const XIAOE_BUNDLED_ENV_SCRIPT_SOURCE = 'bundled scripts/xiaoe_env.py';
+/** 与 XiaoE `tokens.py` 保持一致：换票成功后默认有效 2 小时。 */
+export const XIAOE_ETEAMID_TTL_MS = 7_200_000;
 function envString(env, ...keys) {
     for (const key of keys) {
         const value = env[key];
@@ -134,6 +136,14 @@ function readString(data, ...keys) {
     }
     return '';
 }
+function readExpiryTimes(data) {
+    for (const key of ['expiryTimes', 'expiryTime', 'expiresAt', 'expires_at']) {
+        const value = Number(data[key]);
+        if (Number.isFinite(value) && value > 0)
+            return Math.trunc(value);
+    }
+    return undefined;
+}
 function cookieString(value) {
     if (!value)
         return '';
@@ -209,7 +219,19 @@ function readXiaoECredentialRecord(value, source, fallbackBaseUrl = '') {
         || cookieValue(rawCookie, 'ETEAMSID');
     if (!baseUrl || !eteamsId)
         return null;
-    return { baseUrl: normalizeUrl(baseUrl), eteamsId, source, rawCookie };
+    const expiryTimes = candidates.map(readExpiryTimes).find((value) => value !== undefined);
+    return {
+        baseUrl: normalizeUrl(baseUrl),
+        eteamsId,
+        source,
+        rawCookie,
+        ...(expiryTimes !== undefined ? { expiryTimes } : {}),
+    };
+}
+function withDefaultXiaoEExpiry(credential) {
+    if (!credential || credential.expiryTimes !== undefined)
+        return credential;
+    return { ...credential, expiryTimes: Date.now() + XIAOE_ETEAMID_TTL_MS };
 }
 function parseXiaoEUnifiedLoginMap(raw, source) {
     const value = raw.trim();
@@ -533,7 +555,7 @@ async function resolveXiaoETokenScriptCredential(baseUrl, env = process.env) {
     const tokenData = await runXiaoETokenScript(baseUrl, env);
     if (!tokenData)
         return null;
-    return readXiaoECredentialRecord(tokenData, 'xiaoeUserData/tokens.py', baseUrl);
+    return withDefaultXiaoEExpiry(readXiaoECredentialRecord(tokenData, 'xiaoeUserData/tokens.py', baseUrl));
 }
 async function resolveXiaoEBundledEnvScriptCredential(baseUrl, env = process.env) {
     const scriptPath = xiaoEBundledEnvScriptPath();
@@ -542,7 +564,7 @@ async function resolveXiaoEBundledEnvScriptCredential(baseUrl, env = process.env
     const tokenData = await runXiaoEPythonCredentialScript(scriptPath, baseUrl, env);
     if (!tokenData)
         return null;
-    return readXiaoECredentialRecord(tokenData, XIAOE_BUNDLED_ENV_SCRIPT_SOURCE, baseUrl);
+    return withDefaultXiaoEExpiry(readXiaoECredentialRecord(tokenData, XIAOE_BUNDLED_ENV_SCRIPT_SOURCE, baseUrl));
 }
 export function xiaoEClientRobotsRoot(env = process.env) {
     if (process.platform === 'win32') {
@@ -766,7 +788,7 @@ async function resolveXiaoETokenCredential(credential, baseUrl) {
     // from the same origin as the token exchange. Newer 0000/200 responses keep
     // the XiaoE service origin separate and use the requested E10 target.
     const resolvedBaseUrl = payload.code === 0 ? credential.erpaUrl : targetBaseUrl;
-    return readXiaoECredentialRecord(payload, credential.source, resolvedBaseUrl);
+    return withDefaultXiaoEExpiry(readXiaoECredentialRecord(payload, credential.source, resolvedBaseUrl));
 }
 async function resolveXiaoEPlatformCredential(baseUrl, env = process.env) {
     const credential = readXiaoEPlatformCredential(env);
@@ -850,6 +872,7 @@ async function saveXiaoEUnifiedLogin(input) {
         baseUrl,
         passportUrl: baseUrl,
         cookieSavedAt: Date.now(),
+        ...(input.expiryTimes !== undefined ? { expiryTimes: input.expiryTimes } : {}),
         loginSource: 'xiaoe-unified',
         credentialSourceStep: input.credentialSource.credentialSourceStep,
         credentialSourceType: input.credentialSource.credentialSourceType,
@@ -872,6 +895,7 @@ async function saveXiaoEUnifiedLogin(input) {
             agentType: XIAOE_AGENT_TYPE,
             version: '',
             loginSource: 'xiaoe-unified',
+            ...(input.expiryTimes !== undefined ? { expiryTimes: input.expiryTimes } : {}),
             ...input.credentialSource,
         },
     };
@@ -973,6 +997,7 @@ export async function tryXiaoEUnifiedLogin(options = {}) {
             baseUrl: credential.baseUrl || baseUrl || DEFAULT_E10_BASE_URL,
             eteamsId: credential.eteamsId,
             rawCookie: credential.rawCookie,
+            expiryTimes: credential.expiryTimes,
             tenantKeyFallback: options.tenantKeyFallback,
             profileHint: options.profileHint,
             credentialSource: describeXiaoECredentialSource(credential.source),