weaver-work-cli 0.1.39 → 0.1.42

package/dist/chunks/{registry-VT5Y2HLA.js → registry-7FFOXIAW.js}

@@ -4,11 +4,11 @@ import {
   esbOperationDefinitions,
   getEsbOperation,
   hasEsbOperation
-} from "./chunk-HJYVHXUQ.js";
-import "./chunk-BJGXMFGD.js";
+} from "./chunk-4RAE6JXP.js";
+import "./chunk-BBKDXQEC.js";
 import "./chunk-GPMFD4RD.js";
-import "./chunk-EZGFHJFW.js";
-import "./chunk-XXJOSZTQ.js";
+import "./chunk-SA6VBIHY.js";
+import "./chunk-FOAA27U5.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{registry-QCLZEDAP.js → registry-BKBZPBAJ.js}

@@ -4,14 +4,16 @@ import {
   getMeetingOperation,
   hasMeetingOperation,
   meetingOperationDefinitions
-} from "./chunk-NLK2RZKG.js";
-import "./chunk-T7JDJJ7H.js";
-import "./chunk-L4N7B7ZD.js";
-import "./chunk-P2DAISYW.js";
-import "./chunk-EINRJHQ3.js";
-import "./chunk-KTCB5R5H.js";
-import "./chunk-YS5DPN4T.js";
-import "./chunk-CQHGNCK2.js";
+} from "./chunk-JPRO6ER2.js";
+import "./chunk-BIPYLLVS.js";
+import "./chunk-NKZRQXST.js";
+import "./chunk-R4CHUSKC.js";
+import "./chunk-IZ7S7QUS.js";
+import "./chunk-GHXCDPTM.js";
+import "./chunk-QKNKR4RH.js";
+import "./chunk-W7BEHOSR.js";
+import "./chunk-GEWYMQME.js";
+import "./chunk-72CKAUAG.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{registry-YX4CSEMD.js → registry-RHMW6ANW.js}

@@ -4,12 +4,12 @@ import {
   getWorkflowOperation,
   hasWorkflowOperation,
   workflowOperationDefinitions
-} from "./chunk-F2EQXUEE.js";
+} from "./chunk-3KTFS4IA.js";
 import "./chunk-EZALDOQH.js";
 import "./chunk-FMPJJYYI.js";
 import "./chunk-ZUX3P6BQ.js";
 import "./chunk-AJ62BGAW.js";
-import "./chunk-XXJOSZTQ.js";
+import "./chunk-FOAA27U5.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{registry-NYPYMZXG.js → registry-Z43434VG.js}

@@ -4,7 +4,7 @@ import {
   getHrmOperation,
   hasHrmOperation,
   hrmOperationDefinitions
-} from "./chunk-G2JSIUWF.js";
+} from "./chunk-4PD5NWAX.js";
 import "./chunk-NOODWMCL.js";
 import "./chunk-OOUTBLZ4.js";
 import "./chunk-LUSPKZKY.js";

package/dist/chunks/{room-recommend-L3MWH4JW.js → room-recommend-62H7ZQQ6.js}

@@ -6,10 +6,10 @@ import {
   loadRooms,
   recommendRooms,
   rememberFrequentRoom
-} from "./chunk-T7JDJJ7H.js";
-import "./chunk-P2DAISYW.js";
-import "./chunk-YS5DPN4T.js";
-import "./chunk-CQHGNCK2.js";
+} from "./chunk-R4CHUSKC.js";
+import "./chunk-GHXCDPTM.js";
+import "./chunk-GEWYMQME.js";
+import "./chunk-72CKAUAG.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{schedule-UASAVDVD.js → schedule-FNXKH3DQ.js}

@@ -8,10 +8,10 @@ import {
   resolveMeetingScheduleTypeIds,
   resolveMemberIdsByName,
   runScheduleConflictFlow
-} from "./chunk-L4N7B7ZD.js";
-import "./chunk-P2DAISYW.js";
-import "./chunk-YS5DPN4T.js";
-import "./chunk-CQHGNCK2.js";
+} from "./chunk-IZ7S7QUS.js";
+import "./chunk-GHXCDPTM.js";
+import "./chunk-GEWYMQME.js";
+import "./chunk-72CKAUAG.js";
 import "./chunk-LUSPKZKY.js";
 import "./chunk-BUSC6UAE.js";
 export {

package/dist/chunks/{workflow-KDGIUCNW.js → workflow-ADHKCAJK.js}

@@ -2,7 +2,7 @@ import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
   createWorkflowHost
-} from "./chunk-K3RUEEOL.js";
+} from "./chunk-APVFJUQH.js";
 import {
   USER_INTENT_RULE_FILE,
   aigroupUserDir,
@@ -17,7 +17,7 @@ import {
   validateRuleFile,
   workflowOperationDefinitions,
   workflowSuccess
-} from "./chunk-F2EQXUEE.js";
+} from "./chunk-3KTFS4IA.js";
 import {
   createWorkflowContinuationSigner
 } from "./chunk-EZALDOQH.js";
@@ -28,8 +28,8 @@ import {
 } from "./chunk-FMPJJYYI.js";
 import "./chunk-ZUX3P6BQ.js";
 import "./chunk-AJ62BGAW.js";
-import "./chunk-EZGFHJFW.js";
-import "./chunk-XXJOSZTQ.js";
+import "./chunk-SA6VBIHY.js";
+import "./chunk-FOAA27U5.js";
 import {
   isCliError,
   toErrorEnvelope

package/dist/index.js

@@ -7,12 +7,12 @@ import {
   firstPositionalToken,
   registerCommands,
   toCommandMetadata
-} from "./chunks/chunk-GVPJZXJ2.js";
+} from "./chunks/chunk-EKWAQSLU.js";
 import "./chunks/chunk-ZUX3P6BQ.js";
 import "./chunks/chunk-AJ62BGAW.js";
-import "./chunks/chunk-ZXRNHZTE.js";
-import "./chunks/chunk-EZGFHJFW.js";
-import "./chunks/chunk-XXJOSZTQ.js";
+import "./chunks/chunk-TTPJJJC4.js";
+import "./chunks/chunk-SA6VBIHY.js";
+import "./chunks/chunk-FOAA27U5.js";
 import "./chunks/chunk-LUSPKZKY.js";
 import "./chunks/chunk-BUSC6UAE.js";
 
@@ -29,7 +29,7 @@ function lazyShortcut(definition) {
       placeholder.allowExcessArguments(true);
       placeholder.helpOption(false);
       placeholder.action(async () => {
-        const { dispatchLazyShortcut } = await import("./chunks/lazy-dispatch-NLZ5UQQI.js");
+        const { dispatchLazyShortcut } = await import("./chunks/lazy-dispatch-KSWTN5L6.js");
         await dispatchLazyShortcut(definition, shortcutMetadata());
       });
     }
@@ -39,117 +39,122 @@ var builtinShortcuts = [
   lazyShortcut({
     name: "invoice",
     description: "E10 \u4E1A\u7968\u901A\u53D1\u7968\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/invoice-WNBS2B4C.js")).invoiceShortcut
+    load: async () => (await import("./chunks/invoice-LVIKSIIF.js")).invoiceShortcut
   }),
   lazyShortcut({
     name: "ehr",
     description: "\u6CDB\u5FAEE10\u805A\u624D\u6797\uFF08\u4EBA\u4E8B/\u51FA\u52E4/\u85AA\u916C\uFF09CLI",
-    load: async () => (await import("./chunks/ehr-RAQNEQO7.js")).ehrShortcut
+    load: async () => (await import("./chunks/ehr-KMOJULKG.js")).ehrShortcut
+  }),
+  lazyShortcut({
+    name: "recruit-stage",
+    description: "\u6CDB\u5FAEE10\u62DB\u8058\u52A9\u624B\uFF08JD\u751F\u6210/\u7B80\u5386\u5EFA\u6863/AI\u9762\u8BD5\u9080\u7EA6\uFF09CLI",
+    load: async () => (await import("./chunks/recruit-stage-DGMFNNDE.js")).recruitStageShortcut
   }),
   lazyShortcut({
     name: "cowork",
     description: "\u6CDB\u5FAEE10\u534F\u4F5C\u533A\uFF08\u534F\u4F5C\u4E8B\u9879/\u8BA8\u8BBA/\u5BA1\u6279/\u5171\u4EAB\u6743\u9650\uFF09CLI",
-    load: async () => (await import("./chunks/cowork-HNGBPD7A.js")).coworkShortcut
+    load: async () => (await import("./chunks/cowork-3MN6EQQO.js")).coworkShortcut
   }),
   lazyShortcut({
     name: "archive",
     description: "E10 \u6587\u4E66\u5B9A\u6863\u6848\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/archive-ENZYBBME.js")).archiveShortcut
+    load: async () => (await import("./chunks/archive-J4I6MCKF.js")).archiveShortcut
   }),
   lazyShortcut({
     name: "archive-oa",
     description: "E10 \u6863\u6848\u5B9A\u4F4D\u4E0E OA \u5546\u52A1\u5408\u540C\u501F\u9605 CLI",
-    load: async () => (await import("./chunks/archive-oa-YWLEC5V4.js")).archiveOaShortcut
+    load: async () => (await import("./chunks/archive-oa-BRZKKTO4.js")).archiveOaShortcut
   }),
   lazyShortcut({
     name: "calendar",
     description: "\u6CDB\u5FAEE10\u65E5\u7A0B\u7BA1\u7406 CLI\uFF08\u521B\u5EFA/\u67E5\u8BE2/\u66F4\u65B0/\u5220\u9664/\u5B57\u5178\uFF09",
-    load: async () => (await import("./chunks/calendar-CIARBAOX.js")).calendarShortcut
+    load: async () => (await import("./chunks/calendar-Q7NQY5Z2.js")).calendarShortcut
   }),
   lazyShortcut({
     name: "fna",
     description: "\u6CDB\u5FAEE10\u9F50\u4E1A\u6210\u8D39\u63A7\u4E2D\u5FC3\uFF08\u9884\u7B97/\u8D39\u7528\u4E2D\u5FC3/\u501F\u6B3E\u7BA1\u7406/\u53D1\u7968\u6838\u9500\uFF09CLI",
-    load: async () => (await import("./chunks/fna-XTSRB7G7.js")).fnaShortcut
+    load: async () => (await import("./chunks/fna-ZQPCUV4R.js")).fnaShortcut
   }),
   lazyShortcut({
     name: "hrm",
     description: "\u6CDB\u5FAEE10\u7EC4\u7EC7\u7BA1\u7406\uFF08\u5458\u5DE5/\u7EC4\u7EC7/\u5C97\u4F4D\u67E5\u8BE2\uFF09CLI",
-    load: async () => (await import("./chunks/hrm-TLHKC545.js")).hrmShortcut
+    load: async () => (await import("./chunks/hrm-FFM4UJFS.js")).hrmShortcut
   }),
   lazyShortcut({
     name: "mail",
     description: "\u6CDB\u5FAEE10\u90AE\u4EF6\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/mail-LRYMBFNL.js")).mailShortcut
+    load: async () => (await import("./chunks/mail-VDKRGUD3.js")).mailShortcut
   }),
   lazyShortcut({
     name: "meeting",
     description: "\u6CDB\u5FAEE10\u4F1A\u8BAE\u7BA1\u7406 CLI\uFF08\u6807\u51C6\u7248\uFF1A\u67E5\u8BE2/\u51B2\u7A81/\u9884\u7EA6/\u56DE\u6267/\u7B7E\u5230\uFF09",
-    load: async () => (await import("./chunks/meeting-ESXL6MFI.js")).meetingShortcut
+    load: async () => (await import("./chunks/meeting-CLC6HP3Z.js")).meetingShortcut
   }),
   lazyShortcut({
     name: "okr",
     description: "\u6CDB\u5FAEE10 OKR \u76EE\u6807\u7BA1\u7406 CLI\uFF08\u76EE\u6807\u67E5\u8BE2/\u65B0\u5EFA/\u7F16\u8F91\u3001\u5173\u952E\u6210\u679C\u3001\u76EE\u6807\u5BF9\u9F50\u3001\u8BC4\u8BBA\uFF09",
-    load: async () => (await import("./chunks/okr-EOV65SSF.js")).okrShortcut
+    load: async () => (await import("./chunks/okr-CHG4OO3U.js")).okrShortcut
   }),
   lazyShortcut({
     name: "plan",
     description: "\u6CDB\u5FAEE10\u8BA1\u5212\u62A5\u544A CLI\uFF08\u67E5\u8BE2/\u65B0\u5EFA/\u4FEE\u6539/\u53D1\u5E03/\u64A4\u56DE/\u63D0\u4EA4\u63D0\u9192/\u8BC4\u8BBA\uFF09",
-    load: async () => (await import("./chunks/plan-YFPVKW6Y.js")).planShortcut
+    load: async () => (await import("./chunks/plan-XWR75667.js")).planShortcut
   }),
   lazyShortcut({
     name: "esb",
     description: "\u6CDB\u5FAEE10 ESB \u4E2D\u5FC3\u81EA\u5B9A\u4E49\u89E6\u53D1\u52A8\u4F5C\u6D41 CLI",
-    load: async () => (await import("./chunks/esb-6XV7C7YV.js")).esbShortcut
+    load: async () => (await import("./chunks/esb-W2PJCFCX.js")).esbShortcut
   }),
   lazyShortcut({
     name: "ebuilder-form",
     description: "\u6CDB\u5FAEE10 eBuilder \u8868\u5355\u83DC\u5355\u3001\u5217\u8868\u548C\u8868\u5355\u6570\u636E CLI",
-    load: async () => (await import("./chunks/ebuilder-form-OY6DVNRK.js")).ebuilderFormShortcut
+    load: async () => (await import("./chunks/ebuilder-form-SBHOYBUD.js")).ebuilderFormShortcut
   }),
   lazyShortcut({
     name: "jiuchuanhui",
     description: "\u6CDB\u5FAEE10\u4E5D\u6C1A\u6C47\u8425\u9500\u7BA1\u7406 CLI\uFF08\u5BA2\u6237/\u8054\u7CFB\u4EBA/\u5546\u673A/\u7EBF\u7D22/\u8054\u7CFB\u8BA1\u5212/\u516C\u6D77\uFF09",
-    load: async () => (await import("./chunks/jiuchuanhui-XABWS5RN.js")).jiuchuanhuiShortcut
+    load: async () => (await import("./chunks/jiuchuanhui-X6DINO5P.js")).jiuchuanhuiShortcut
   }),
   lazyShortcut({
     name: "asset",
     description: "E10 \u8D44\u4EA7\u7BA1\u7406\uFF08\u8D44\u7BA1\u5BB6\uFF09CLI",
-    load: async () => (await import("./chunks/asset-OOV6DWPA.js")).assetShortcut
+    load: async () => (await import("./chunks/asset-L7D4FAOZ.js")).assetShortcut
   }),
   lazyShortcut({
     name: "asset-idle",
     description: "E10 \u95F2\u7F6E\u8D44\u4EA7\u5224\u5B9A\u7ED3\u679C\u67E5\u8BE2 CLI\uFF08\u5206\u9875\u83B7\u53D6/\u805A\u5408\u7EDF\u8BA1\uFF09",
-    load: async () => (await import("./chunks/asset-idle-RE632MY5.js")).assetIdleShortcut
+    load: async () => (await import("./chunks/asset-idle-DADLLV75.js")).assetIdleShortcut
   }),
   lazyShortcut({
     name: "im",
     description: "\u6CDB\u5FAEE10\u6613\u79D2\u529E\uFF08\u5373\u65F6\u901A\u8BAF\uFF09CLI",
-    load: async () => (await import("./chunks/im-YOUCFMUK.js")).imShortcut
+    load: async () => (await import("./chunks/im-VEHKDQPB.js")).imShortcut
   }),
   lazyShortcut({
     name: "project",
     description: "\u6CDB\u5FAEE10\u4E8B\u4E95\u7136\u9879\u76EE\u7BA1\u7406 CLI\uFF08\u9879\u76EE/\u4EFB\u52A1\u67E5\u8BE2\u4E0E\u786E\u8BA4\u5199\u5165\uFF09",
-    load: async () => (await import("./chunks/project-MDVZUYQW.js")).projectShortcut
+    load: async () => (await import("./chunks/project-5BXOOKMG.js")).projectShortcut
   }),
   lazyShortcut({
     name: "workflow",
     description: "\u6CDB\u5FAEE10\u6D41\u7A0B\u667A\u80FD\u52A9\u624B CLI\uFF08\u67E5\u8BE2/\u67E5\u770B/\u64CD\u4F5C/\u6279\u91CF/\u53D1\u8D77/\u4FEE\u6539\uFF09",
-    load: async () => (await import("./chunks/workflow-KDGIUCNW.js")).workflowShortcut
+    load: async () => (await import("./chunks/workflow-ADHKCAJK.js")).workflowShortcut
   }),
   lazyShortcut({
     name: "blog",
     description: "\u6CDB\u5FAEE10\u5DE5\u4F5C\u65E5\u62A5 CLI\uFF08\u67E5\u8BE2/\u53D1\u5E03/\u7F16\u8F91/\u8BC4\u8BBA/\u70B9\u8D5E/\u63D0\u9192/\u5BFC\u51FA\uFF09",
-    load: async () => (await import("./chunks/blog-PEPOJAL7.js")).blogShortcut
+    load: async () => (await import("./chunks/blog-BVGQ7NZL.js")).blogShortcut
   }),
   lazyShortcut({
     name: "caizhilian",
     description: "\u6CDB\u5FAEE10\u91C7\u77E5\u8FDE\uFF08\u6587\u6863\u4E2D\u5FC3\uFF09CLI",
-    load: async () => (await import("./chunks/caizhilian-WYIQDVPJ.js")).caizhilianShortcut
+    load: async () => (await import("./chunks/caizhilian-SAADNFD6.js")).caizhilianShortcut
   }),
   lazyShortcut({
     name: "contract",
     description: "\u6CDB\u5FAEE10\u4ECA\u627F\u8FBE\u5408\u540C\u7BA1\u7406 CLI",
-    load: async () => (await import("./chunks/contract-73MERZWN.js")).contractShortcut
+    load: async () => (await import("./chunks/contract-5BETHRSG.js")).contractShortcut
   })
 ];
 function shortcutMetadata() {

package/dist/internal/e10/auth/commands.js

@@ -17,6 +17,7 @@ const AGENT_RETURN_URL_ENV_KEY = 'WEAVER_AGENT_RETURN_URL';
 const AGENT_RETURN_PATH = '/agent-return';
 const AGENT_RETURN_TOKEN_HEADER = 'x-weaver-agent-return-token';
 const AGENT_RETURN_TIMEOUT_MS = 900_000;
+const OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS = 30_000;
 const UNSAFE_AGENT_RETURN_PROTOCOLS = new Set([
     'about:',
     'blob:',
@@ -191,6 +192,7 @@ function formatAuthStatus(status) {
         ...('credentialSourceStep' in status && status.credentialSourceStep ? ['credentialSourceStep: ' + status.credentialSourceStep] : []),
         ...('credentialSourceType' in status && status.credentialSourceType ? ['credentialSourceType: ' + status.credentialSourceType] : []),
         ...('credentialSourceLabel' in status && status.credentialSourceLabel ? ['credentialSourceLabel: ' + status.credentialSourceLabel] : []),
+        ...('expiryTimes' in status && status.expiryTimes ? ['expiryTimes: ' + status.expiryTimes] : []),
     ];
     if ('valid' in status) {
         lines.push('valid: ' + String(status.valid));
@@ -210,6 +212,7 @@ function formatLoginResult(result) {
         ...(result.credentialSourceStep ? ['credentialSourceStep: ' + result.credentialSourceStep] : []),
         ...(result.credentialSourceType ? ['credentialSourceType: ' + result.credentialSourceType] : []),
         ...(result.credentialSourceLabel ? ['credentialSourceLabel: ' + result.credentialSourceLabel] : []),
+        ...(result.expiryTimes ? ['expiryTimes: ' + result.expiryTimes] : []),
     ].join('\n');
 }
 async function clearInvoiceTokenCache(profile, authData) {
@@ -300,6 +303,24 @@ export function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
     });
     return `${baseUrl}/papi/sso/oauth2.0/authorize?${authorizeParams.toString()}`;
 }
+/** Node's HTTP parser exposes the first unread bytes when TLS is sent to an HTTP listener. */
+export function isTlsClientHello(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const rawPacket = error.rawPacket;
+    return Buffer.isBuffer(rawPacket)
+        && rawPacket.length >= 3
+        && rawPacket[0] === 0x16
+        && rawPacket[1] === 0x03;
+}
+export function createOAuthCallbackProtocolMismatchError(port) {
+    return Object.assign(new CliError(`OAuth callback protocol mismatch: the browser connected to https://127.0.0.1:${port}, but the CLI callback listener uses HTTP. Retry the login and, on the callback error page, change only the URL scheme to http:// before reloading; keep the path and query unchanged. The E10 authorization service should preserve HTTP loopback redirect URIs.`, ExitCode.AuthError), {
+        type: 'authentication',
+        subtype: 'oauth_callback_protocol_mismatch',
+        retryable: false,
+        stage: 'oauth_callback',
+    });
+}
 async function readJsonObject(resp) {
     const data = await resp.json().catch(() => ({}));
     return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
@@ -488,7 +509,7 @@ function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
         'CLI 会优先使用 XiaoE 客户端内置 Python 执行 tokens.py；自动发现不可用时，可用 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON 指定兼容解释器。',
     ].join(' ');
 }
-async function runBrowserLogin(ctx, options, behavior = {}) {
+async function runXiaoELogin(ctx, options) {
     const commandOpts = asOptions(options);
     const globalOptions = ctx.getGlobalOptions();
     const profileFromGlobal = globalOptions.profile;
@@ -499,59 +520,50 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         profileBaseUrl: cfg.baseUrl,
         env: ctx.env,
     });
-    const xiaoESources = behavior.tryXiaoEUnifiedLogin === true
-        ? inspectXiaoEUnifiedLoginSources({
-            env: ctx.env,
-            baseUrl: preferredXiaoEBaseUrl,
-            profileBaseUrl: cfg.baseUrl,
-            allowTokenScript: behavior.allowXiaoETokenScript === true,
-        })
-        : {
-            platformCredential: false,
-            tokenScript: false,
-            clientCredential: false,
-            environmentCredential: false,
-            any: false,
-        };
-    const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
-    const baseUrl = behavior.tryXiaoEUnifiedLogin
-        ? preferredXiaoEBaseUrl
-        : normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
+    const xiaoESources = inspectXiaoEUnifiedLoginSources({
+        env: ctx.env,
+        baseUrl: preferredXiaoEBaseUrl,
+        profileBaseUrl: cfg.baseUrl,
+        allowTokenScript: true,
+    });
+    const useXiaoELogin = xiaoESources.any;
+    const baseUrl = preferredXiaoEBaseUrl;
+    const tenantKey = optionString(commandOpts, 'tenantKey');
+    ctx.logger.info([
+        'XiaoE unified login preflight:',
+        'authMode=xiaoe',
+        `credentialSourceDetected=${String(xiaoESources.any)}`,
+        `attempted=${String(useXiaoELogin)}`,
+        `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+        `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+        `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+        `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+        `clientType=${xiaoESources.clientType || '(unset)'}`,
+        `baseUrl=${baseUrl || '(unresolved)'}`,
+    ].join(' '));
+    if (useXiaoELogin) {
+        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true);
+        if (xiaoEResult)
+            return xiaoEResult;
+    }
+    ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
+    throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+}
+async function runBrowserLogin(ctx, options) {
+    const commandOpts = asOptions(options);
+    const globalOptions = ctx.getGlobalOptions();
+    const profileFromGlobal = globalOptions.profile;
+    const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+    const explicitBaseUrl = optionString(commandOpts, 'baseUrl') || globalOptions.baseUrl || '';
+    const baseUrl = normalizeUrl(explicitBaseUrl || cfg.baseUrl || '');
     const tenantKey = optionString(commandOpts, 'tenantKey');
     const portText = optionString(commandOpts, 'port') || '19800';
     const port = Number.parseInt(portText, 10);
     const explicitAgentType = optionString(commandOpts, 'agentType', 'agent_type');
-    const agentType = useXiaoELogin
-        ? optionString(commandOpts, 'agentType', 'agent_type') || XIAOE_AGENT_TYPE
-        : resolveAgentType(commandOpts, ctx.env);
+    const agentType = resolveAgentType(commandOpts, ctx.env);
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new CliError('Invalid --port value', ExitCode.UsageError);
     }
-    if (behavior.tryXiaoEUnifiedLogin) {
-        ctx.logger.info([
-            'XiaoE unified login preflight:',
-            'authMode=xiaoe',
-            `credentialSourceDetected=${String(xiaoESources.any)}`,
-            `attempted=${String(useXiaoELogin)}`,
-            `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
-            `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
-            `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
-            `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
-            `baseUrl=${baseUrl || '(unresolved)'}`,
-        ].join(' '));
-    }
-    if (useXiaoELogin) {
-        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
-        if (xiaoEResult)
-            return xiaoEResult;
-    }
-    const willOpenBrowser = behavior.browserFallback !== 'never';
-    if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
-        ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-    }
-    if (!willOpenBrowser) {
-        throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
-    }
     if (!baseUrl)
         throw new CliError('Missing --base-url', ExitCode.UsageError);
     const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
@@ -564,6 +576,7 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         let settled = false;
         let timer = null;
         let pendingLoginResult = null;
+        let tlsCallbackDetected = false;
         const finish = (error, result) => {
             if (settled)
                 return;
@@ -647,6 +660,13 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
                 finish(new CliError('No authorization code received.', ExitCode.AuthError));
                 return;
             }
+            // The user followed the recovery instruction and reached the HTTP
+            // callback. Do not let the protocol-mismatch grace timer race the token
+            // exchange that is now legitimately in progress.
+            if (tlsCallbackDetected && timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
             try {
                 const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
                 const responseHeaders = {
@@ -685,6 +705,26 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
                     : error.message;
             finish(new CliError(message, ExitCode.UsageError));
         });
+        server.on('clientError', (error, socket) => {
+            if (isTlsClientHello(error)) {
+                if (!tlsCallbackDetected) {
+                    tlsCallbackDetected = true;
+                    ctx.logger.warn([
+                        `OAuth callback protocol mismatch: the browser used HTTPS for 127.0.0.1:${port}, while the CLI listener is HTTP.`,
+                        '在 30 秒内把浏览器当前地址开头明确改为 http://，保留后面的完整路径和参数，然后回车重试。',
+                        '不要把地址中的授权码复制到聊天或日志。',
+                    ].join(' '));
+                    if (timer)
+                        clearTimeout(timer);
+                    timer = setTimeout(() => {
+                        finish(createOAuthCallbackProtocolMismatchError(port));
+                    }, OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS);
+                }
+                socket.destroy();
+                return;
+            }
+            socket.destroy();
+        });
         server.listen(port, '127.0.0.1', () => {
             ctx.logger.info('Local callback server: ' + redirectUri);
             openUrlInBrowser(loginUrl, ctx);
@@ -728,7 +768,7 @@ function formatWhoami(title, data) {
         'User-Agent: ' + (data.userAgent || ''),
     ].join('\n');
 }
-function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
+function registerBrowserLoginCommand(auth, action, name, description) {
     const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
@@ -738,7 +778,23 @@ function registerBrowserLoginCommand(auth, action, name, description, behavior =
         .option('--agent-type <value>', 'Alias of --agent_type')
         .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
     command.action(action(async (ctx, options) => {
-        const result = await runBrowserLogin(ctx, options, behavior);
+        const result = await runBrowserLogin(ctx, options);
+        ctx.output.write(result, { text: formatLoginResult(result) });
+    }));
+}
+function registerXiaoELoginCommand(auth, action) {
+    auth.command('xiaoe')
+        .description('Use XiaoE unified login without browser OAuth fallback')
+        .option('--base-url <url>', 'E10 base URL')
+        .option('--tenant-key <key>', 'Tenant key fallback after login')
+        // Keep previously accepted browser flags as no-ops so existing wrappers do
+        // not break. The dedicated handler never parses them or opens a callback.
+        .option('--port <n>', 'Deprecated compatibility option; ignored by XiaoE unified login', '19800')
+        .option('--agent_type <value>', 'Deprecated compatibility option; ignored by XiaoE unified login')
+        .option('--agent-type <value>', 'Alias of --agent_type')
+        .option('--agent-return-url <url>', 'Deprecated compatibility option; ignored by XiaoE unified login')
+        .action(action(async (ctx, options) => {
+        const result = await runXiaoELogin(ctx, options);
         ctx.output.write(result, { text: formatLoginResult(result) });
     }));
 }
@@ -758,7 +814,9 @@ export function registerE10AuthCommands(parent, action) {
         const commandOpts = asOptions(options);
         const authFile = findAuthFile(ctx.cwd, opts);
         const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
-        const valid = session && commandOpts.check !== false ? await session.checkValid() : undefined;
+        const valid = session && commandOpts.check !== false
+            ? session.isExpired() ? false : await session.checkValid()
+            : undefined;
         const status = session
             ? {
                 loggedIn: true,
@@ -779,6 +837,7 @@ export function registerE10AuthCommands(parent, action) {
                 ...(session.credentialSourceStep ? { credentialSourceStep: session.credentialSourceStep } : {}),
                 ...(session.credentialSourceType ? { credentialSourceType: session.credentialSourceType } : {}),
                 ...(session.credentialSourceLabel ? { credentialSourceLabel: session.credentialSourceLabel } : {}),
+                ...(session.expiryTimes ? { expiryTimes: session.expiryTimes } : {}),
                 valid,
             }
             : {
@@ -823,12 +882,7 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
-    registerBrowserLoginCommand(auth, action, 'xiaoe', 'Use XiaoE unified login without browser OAuth fallback', {
-        tryXiaoEUnifiedLogin: true,
-        allowXiaoETokenScript: true,
-        explainXiaoEFallback: true,
-        browserFallback: 'never',
-    });
+    registerXiaoELoginCommand(auth, action);
     auth.command('logout')
         .alias('clear')
         .description('Clear saved E10 auth for the current or selected profile')

package/dist/internal/e10/auth/messages.js

@@ -1,4 +1,10 @@
 export const E10_REAUTH_GUIDANCE = '请结合当前宿主环境选择合适的登录方式，恢复登录后重试原请求。';
 export const E10_AUTH_REQUIRED_MESSAGE = `E10 登录态不可用。${E10_REAUTH_GUIDANCE}`;
 export const E10_XIAOE_RECOVERY_FAILED_MESSAGE = 'E10 登录态不可用。已尝试小 e 自动重新获取登录信息，但未取得可用登录态。请在小 e 中恢复登录后重试。';
+export const E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE = 'E10 登录态不可用。小 e 网页端未向当前运行环境注入统一登录凭据，自动获取已停止。请检查网页技能沙箱的宿主凭据透传后重试。';
+/**
+ * 恢复流程全程只有网络错误时的文案。此时登录态根本没有被验证过，让用户去
+ * 重新登录是误导——该做的是稍后重试。
+ */
+export const E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE = '暂时无法连接 E10，请稍后重试';
 export const E10_SESSION_EXPIRED_MESSAGE = `E10 登录态已失效，本次操作已停止。${E10_REAUTH_GUIDANCE}`;