weaver-work-cli 0.1.39 → 0.1.42

package/dist/chunks/{chunk-GVPJZXJ2.js → chunk-EKWAQSLU.js}

@@ -19,7 +19,7 @@ import {
 } from "./chunk-AJ62BGAW.js";
 import {
   clearInvoiceTokenForSession
-} from "./chunk-ZXRNHZTE.js";
+} from "./chunk-TTPJJJC4.js";
 import {
   E10AuthSession,
   XIAOE_AGENT_TYPE,
@@ -48,7 +48,7 @@ import {
   setActiveProfile,
   switchActiveProfile,
   tryXiaoEUnifiedLogin
-} from "./chunk-XXJOSZTQ.js";
+} from "./chunk-FOAA27U5.js";
 import {
   CliError,
   isCliError,
@@ -3547,6 +3547,7 @@ var AGENT_RETURN_URL_ENV_KEY = "WEAVER_AGENT_RETURN_URL";
 var AGENT_RETURN_PATH = "/agent-return";
 var AGENT_RETURN_TOKEN_HEADER = "x-weaver-agent-return-token";
 var AGENT_RETURN_TIMEOUT_MS = 9e5;
+var OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS = 3e4;
 var UNSAFE_AGENT_RETURN_PROTOCOLS = /* @__PURE__ */ new Set([
   "about:",
   "blob:",
@@ -3698,7 +3699,8 @@ function formatAuthStatus(status) {
     ..."loginSource" in status && status.loginSource ? ["loginSource: " + status.loginSource] : [],
     ..."credentialSourceStep" in status && status.credentialSourceStep ? ["credentialSourceStep: " + status.credentialSourceStep] : [],
     ..."credentialSourceType" in status && status.credentialSourceType ? ["credentialSourceType: " + status.credentialSourceType] : [],
-    ..."credentialSourceLabel" in status && status.credentialSourceLabel ? ["credentialSourceLabel: " + status.credentialSourceLabel] : []
+    ..."credentialSourceLabel" in status && status.credentialSourceLabel ? ["credentialSourceLabel: " + status.credentialSourceLabel] : [],
+    ..."expiryTimes" in status && status.expiryTimes ? ["expiryTimes: " + status.expiryTimes] : []
   ];
   if ("valid" in status) {
     lines.push("valid: " + String(status.valid));
@@ -3717,7 +3719,8 @@ function formatLoginResult(result) {
     ...result.loginSource ? ["loginSource: " + result.loginSource] : [],
     ...result.credentialSourceStep ? ["credentialSourceStep: " + result.credentialSourceStep] : [],
     ...result.credentialSourceType ? ["credentialSourceType: " + result.credentialSourceType] : [],
-    ...result.credentialSourceLabel ? ["credentialSourceLabel: " + result.credentialSourceLabel] : []
+    ...result.credentialSourceLabel ? ["credentialSourceLabel: " + result.credentialSourceLabel] : [],
+    ...result.expiryTimes ? ["expiryTimes: " + result.expiryTimes] : []
   ].join("\n");
 }
 async function clearInvoiceTokenCache(profile, authData) {
@@ -3787,6 +3790,22 @@ function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
   });
   return `${baseUrl}/papi/sso/oauth2.0/authorize?${authorizeParams.toString()}`;
 }
+function isTlsClientHello(error) {
+  if (!error || typeof error !== "object") return false;
+  const rawPacket = error.rawPacket;
+  return Buffer.isBuffer(rawPacket) && rawPacket.length >= 3 && rawPacket[0] === 22 && rawPacket[1] === 3;
+}
+function createOAuthCallbackProtocolMismatchError(port) {
+  return Object.assign(new CliError(
+    `OAuth callback protocol mismatch: the browser connected to https://127.0.0.1:${port}, but the CLI callback listener uses HTTP. Retry the login and, on the callback error page, change only the URL scheme to http:// before reloading; keep the path and query unchanged. The E10 authorization service should preserve HTTP loopback redirect URIs.`,
+    3 /* AuthError */
+  ), {
+    type: "authentication",
+    subtype: "oauth_callback_protocol_mismatch",
+    retryable: false,
+    stage: "oauth_callback"
+  });
+}
 async function readJsonObject(resp) {
   const data = await resp.json().catch(() => ({}));
   return data && typeof data === "object" && !Array.isArray(data) ? data : {};
@@ -3962,7 +3981,7 @@ function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
     "CLI \u4F1A\u4F18\u5148\u4F7F\u7528 XiaoE \u5BA2\u6237\u7AEF\u5185\u7F6E Python \u6267\u884C tokens.py\uFF1B\u81EA\u52A8\u53D1\u73B0\u4E0D\u53EF\u7528\u65F6\uFF0C\u53EF\u7528 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON \u6307\u5B9A\u517C\u5BB9\u89E3\u91CA\u5668\u3002"
   ].join(" ");
 }
-async function runBrowserLogin(ctx, options, behavior = {}) {
+async function runXiaoELogin(ctx, options) {
   const commandOpts = asOptions(options);
   const globalOptions = ctx.getGlobalOptions();
   const profileFromGlobal = globalOptions.profile;
@@ -3973,52 +3992,49 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     profileBaseUrl: cfg.baseUrl,
     env: ctx.env
   });
-  const xiaoESources = behavior.tryXiaoEUnifiedLogin === true ? inspectXiaoEUnifiedLoginSources({
+  const xiaoESources = inspectXiaoEUnifiedLoginSources({
     env: ctx.env,
     baseUrl: preferredXiaoEBaseUrl,
     profileBaseUrl: cfg.baseUrl,
-    allowTokenScript: behavior.allowXiaoETokenScript === true
-  }) : {
-    platformCredential: false,
-    tokenScript: false,
-    clientCredential: false,
-    environmentCredential: false,
-    any: false
-  };
-  const useXiaoELogin = behavior.tryXiaoEUnifiedLogin === true && xiaoESources.any;
-  const baseUrl = behavior.tryXiaoEUnifiedLogin ? preferredXiaoEBaseUrl : normalizeUrl(explicitBaseUrl || cfg.baseUrl || "");
+    allowTokenScript: true
+  });
+  const useXiaoELogin = xiaoESources.any;
+  const baseUrl = preferredXiaoEBaseUrl;
+  const tenantKey = optionString(commandOpts, "tenantKey");
+  ctx.logger.info([
+    "XiaoE unified login preflight:",
+    "authMode=xiaoe",
+    `credentialSourceDetected=${String(xiaoESources.any)}`,
+    `attempted=${String(useXiaoELogin)}`,
+    `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+    `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+    `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+    `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+    `clientType=${xiaoESources.clientType || "(unset)"}`,
+    `baseUrl=${baseUrl || "(unresolved)"}`
+  ].join(" "));
+  if (useXiaoELogin) {
+    const xiaoEResult = await tryXiaoEUnifiedLogin2(ctx, baseUrl, tenantKey, profileFromGlobal, true);
+    if (xiaoEResult) return xiaoEResult;
+  }
+  ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
+  throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+}
+async function runBrowserLogin(ctx, options) {
+  const commandOpts = asOptions(options);
+  const globalOptions = ctx.getGlobalOptions();
+  const profileFromGlobal = globalOptions.profile;
+  const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+  const explicitBaseUrl = optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || "";
+  const baseUrl = normalizeUrl(explicitBaseUrl || cfg.baseUrl || "");
   const tenantKey = optionString(commandOpts, "tenantKey");
   const portText = optionString(commandOpts, "port") || "19800";
   const port = Number.parseInt(portText, 10);
   const explicitAgentType = optionString(commandOpts, "agentType", "agent_type");
-  const agentType = useXiaoELogin ? optionString(commandOpts, "agentType", "agent_type") || XIAOE_AGENT_TYPE : resolveAgentType(commandOpts, ctx.env);
+  const agentType = resolveAgentType(commandOpts, ctx.env);
   if (!Number.isInteger(port) || port <= 0 || port > 65535) {
     throw new CliError("Invalid --port value", 2 /* UsageError */);
   }
-  if (behavior.tryXiaoEUnifiedLogin) {
-    ctx.logger.info([
-      "XiaoE unified login preflight:",
-      "authMode=xiaoe",
-      `credentialSourceDetected=${String(xiaoESources.any)}`,
-      `attempted=${String(useXiaoELogin)}`,
-      `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
-      `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
-      `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
-      `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
-      `baseUrl=${baseUrl || "(unresolved)"}`
-    ].join(" "));
-  }
-  if (useXiaoELogin) {
-    const xiaoEResult = await tryXiaoEUnifiedLogin2(ctx, baseUrl, tenantKey, profileFromGlobal, behavior.allowXiaoETokenScript === true);
-    if (xiaoEResult) return xiaoEResult;
-  }
-  const willOpenBrowser = behavior.browserFallback !== "never";
-  if (behavior.tryXiaoEUnifiedLogin && behavior.explainXiaoEFallback) {
-    ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-  }
-  if (!willOpenBrowser) {
-    throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
-  }
   if (!baseUrl) throw new CliError("Missing --base-url", 2 /* UsageError */);
   const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
   const agentReturnToken = agentReturnTarget ? randomBytes(24).toString("base64url") : "";
@@ -4030,6 +4046,7 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
     let settled = false;
     let timer = null;
     let pendingLoginResult = null;
+    let tlsCallbackDetected = false;
     const finish = (error, result) => {
       if (settled) return;
       settled = true;
@@ -4100,6 +4117,10 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
         finish(new CliError("No authorization code received.", 3 /* AuthError */));
         return;
       }
+      if (tlsCallbackDetected && timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
       try {
         const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
         const responseHeaders = {
@@ -4130,6 +4151,25 @@ async function runBrowserLogin(ctx, options, behavior = {}) {
       const message = error.code === "EADDRINUSE" ? `Port ${port} is already in use. Retry with --port ${port + 1}.` : error.code === "EACCES" ? `Port ${port} is not accessible. Retry with another --port.` : error.message;
       finish(new CliError(message, 2 /* UsageError */));
     });
+    server.on("clientError", (error, socket) => {
+      if (isTlsClientHello(error)) {
+        if (!tlsCallbackDetected) {
+          tlsCallbackDetected = true;
+          ctx.logger.warn([
+            `OAuth callback protocol mismatch: the browser used HTTPS for 127.0.0.1:${port}, while the CLI listener is HTTP.`,
+            "\u5728 30 \u79D2\u5185\u628A\u6D4F\u89C8\u5668\u5F53\u524D\u5730\u5740\u5F00\u5934\u660E\u786E\u6539\u4E3A http://\uFF0C\u4FDD\u7559\u540E\u9762\u7684\u5B8C\u6574\u8DEF\u5F84\u548C\u53C2\u6570\uFF0C\u7136\u540E\u56DE\u8F66\u91CD\u8BD5\u3002",
+            "\u4E0D\u8981\u628A\u5730\u5740\u4E2D\u7684\u6388\u6743\u7801\u590D\u5236\u5230\u804A\u5929\u6216\u65E5\u5FD7\u3002"
+          ].join(" "));
+          if (timer) clearTimeout(timer);
+          timer = setTimeout(() => {
+            finish(createOAuthCallbackProtocolMismatchError(port));
+          }, OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS);
+        }
+        socket.destroy();
+        return;
+      }
+      socket.destroy();
+    });
     server.listen(port, "127.0.0.1", () => {
       ctx.logger.info("Local callback server: " + redirectUri);
       openUrlInBrowser(loginUrl, ctx);
@@ -4173,10 +4213,16 @@ function formatWhoami(title, data) {
     "User-Agent: " + (data.userAgent || "")
   ].join("\n");
 }
-function registerBrowserLoginCommand(auth, action, name, description, behavior = {}) {
+function registerBrowserLoginCommand(auth, action, name, description) {
   const command = auth.command(name).description(description).option("--base-url <url>", "E10 base URL").option("--tenant-key <key>", "Tenant key fallback after login").option("--port <n>", "Local OAuth callback port", "19800").option("--agent_type <value>", "Agent type sent to E10 authorize endpoint").option("--agent-type <value>", "Alias of --agent_type").option("--agent-return-url <url>", "Desktop application URL linked by the login success page");
   command.action(action(async (ctx, options) => {
-    const result = await runBrowserLogin(ctx, options, behavior);
+    const result = await runBrowserLogin(ctx, options);
+    ctx.output.write(result, { text: formatLoginResult(result) });
+  }));
+}
+function registerXiaoELoginCommand(auth, action) {
+  auth.command("xiaoe").description("Use XiaoE unified login without browser OAuth fallback").option("--base-url <url>", "E10 base URL").option("--tenant-key <key>", "Tenant key fallback after login").option("--port <n>", "Deprecated compatibility option; ignored by XiaoE unified login", "19800").option("--agent_type <value>", "Deprecated compatibility option; ignored by XiaoE unified login").option("--agent-type <value>", "Alias of --agent_type").option("--agent-return-url <url>", "Deprecated compatibility option; ignored by XiaoE unified login").action(action(async (ctx, options) => {
+    const result = await runXiaoELogin(ctx, options);
     ctx.output.write(result, { text: formatLoginResult(result) });
   }));
 }
@@ -4191,7 +4237,7 @@ function registerE10AuthCommands(parent, action) {
     const commandOpts = asOptions(options);
     const authFile = findAuthFile(ctx.cwd, opts);
     const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
-    const valid = session && commandOpts.check !== false ? await session.checkValid() : void 0;
+    const valid = session && commandOpts.check !== false ? session.isExpired() ? false : await session.checkValid() : void 0;
     const status = session ? {
       loggedIn: true,
       userId: session.userId,
@@ -4211,6 +4257,7 @@ function registerE10AuthCommands(parent, action) {
       ...session.credentialSourceStep ? { credentialSourceStep: session.credentialSourceStep } : {},
       ...session.credentialSourceType ? { credentialSourceType: session.credentialSourceType } : {},
       ...session.credentialSourceLabel ? { credentialSourceLabel: session.credentialSourceLabel } : {},
+      ...session.expiryTimes ? { expiryTimes: session.expiryTimes } : {},
       valid
     } : {
       loggedIn: false,
@@ -4244,12 +4291,7 @@ function registerE10AuthCommands(parent, action) {
   }));
   registerBrowserLoginCommand(auth, action, "login", "Open browser OAuth2.0 login and save E10 auth");
   registerBrowserLoginCommand(auth, action, "oidc", "Alias of auth login for OAuth2.0 browser login");
-  registerBrowserLoginCommand(auth, action, "xiaoe", "Use XiaoE unified login without browser OAuth fallback", {
-    tryXiaoEUnifiedLogin: true,
-    allowXiaoETokenScript: true,
-    explainXiaoEFallback: true,
-    browserFallback: "never"
-  });
+  registerXiaoELoginCommand(auth, action);
   auth.command("logout").alias("clear").description("Clear saved E10 auth for the current or selected profile").action(action(async (ctx) => {
     const opts = ctx.getGlobalOptions();
     const profile2 = opts.profile || getActiveProfile();