weaver-work-cli 0.1.40 → 0.1.44

package/dist/chunks/{chunk-4TEDNCON.js → chunk-UFIT2UU3.js}

@@ -2,7 +2,7 @@ import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
   CliError
-} from "./chunk-LUSPKZKY.js";
+} from "./chunk-UG5G54VL.js";
 
 // src/internal/e10/auth/session.ts
 import { constants, createDecipheriv as createDecipheriv2, createHash, publicEncrypt } from "node:crypto";
@@ -52,6 +52,75 @@ function writeWithRetry(path, data, options) {
   }
 }
 
+// src/internal/e10/network-error.ts
+var NETWORK_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ECONNABORTED",
+  "EHOSTUNREACH",
+  "EHOSTDOWN",
+  "ENETUNREACH",
+  "ENETDOWN",
+  "ENETRESET",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "EPIPE",
+  "ETIMEDOUT",
+  "ESOCKETTIMEDOUT",
+  "ERR_SOCKET_CONNECTION_TIMEOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_SOCKET",
+  "UND_ERR_CLOSED",
+  "UND_ERR_ABORTED",
+  "CERT_HAS_EXPIRED",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "ERR_TLS_CERT_ALTNAME_INVALID",
+  "ERR_SSL_WRONG_VERSION_NUMBER"
+]);
+var ABORT_ERROR_CODE = "ABORT_ERR";
+function asRecord(value) {
+  return value && typeof value === "object" ? value : null;
+}
+function readErrorCauseCode(error, maxDepth = 5) {
+  let current = error;
+  const seen = /* @__PURE__ */ new Set();
+  for (let depth = 0; depth < maxDepth; depth += 1) {
+    if (current === void 0 || current === null || seen.has(current)) return void 0;
+    seen.add(current);
+    if (current instanceof Error && current.name === "AbortError") return ABORT_ERROR_CODE;
+    const record = asRecord(current);
+    if (!record) return void 0;
+    if (record.name === "AbortError") return ABORT_ERROR_CODE;
+    const code = record.code;
+    if (typeof code === "string" && code) return code;
+    const errno = record.errno;
+    if (typeof errno === "string" && errno) return errno;
+    if (typeof errno === "number") return String(errno);
+    current = record.cause;
+  }
+  return void 0;
+}
+function isAbortError(error) {
+  if (error instanceof Error && error.name === "AbortError") return true;
+  return asRecord(error)?.name === "AbortError";
+}
+function isNetworkErrorCode(code) {
+  return typeof code === "string" && NETWORK_ERROR_CODES.has(code.toUpperCase());
+}
+var TRANSPORT_MESSAGE_PATTERN = /fetch failed|socket hang up|other side closed|network|connection (?:refused|reset|closed)|timed? ?out|timeout|certificate|getaddrinfo|dns lookup/i;
+function looksLikeTransportMessage(message) {
+  return TRANSPORT_MESSAGE_PATTERN.test(message);
+}
+function createTimeoutSignal(timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+
 // src/internal/e10/auth/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
@@ -189,6 +258,7 @@ function parseAuthFile(raw) {
 }
 
 // src/internal/e10/auth/session.ts
+var E10_TEAMS_CHECK_TIMEOUT_MS = 15e3;
 var RSA_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEOk/WyyJKdAHIfMODFnKg7MBoraFBnL3F18hhLx5n01J5g4hCkmpc5+KQFKIQIA/QWk9m7QBzI/OV9ZDFk54LaWm3xP8C+P1TPp7UVGz3iNDLdvgSxuGEYPmML3NaqkbVlvW7/NlNA3ED4Kao7rR5GUYSdFfbaBoxBFae638hzQIDAQAB
 -----END PUBLIC KEY-----`;
@@ -359,16 +429,16 @@ function findAuthFile(startDir = process.cwd(), options = {}) {
   if (existsSync2(activeProfileAuth)) return activeProfileAuth;
   return null;
 }
-function asRecord(value) {
+function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function readTeamsCheckUserInfo(resp, data) {
-  const root = asRecord(data);
-  const nested = asRecord(root.data);
-  const currentUser = asRecord(root.currentUser || nested.currentUser);
-  const currentTenant = asRecord(root.currentTenant || nested.currentTenant);
-  const department = asRecord(currentUser.department);
-  const position = asRecord(currentUser.position);
+  const root = asRecord2(data);
+  const nested = asRecord2(root.data);
+  const currentUser = asRecord2(root.currentUser || nested.currentUser);
+  const currentTenant = asRecord2(root.currentTenant || nested.currentTenant);
+  const department = asRecord2(currentUser.department);
+  const position = asRecord2(currentUser.position);
   const userId = resp.headers.get("employeeId") || currentUser.employeeId || currentUser.id || nested.employeeId || root.employeeId || "";
   const tenantKey = currentUser.tenantKey || currentTenant.tenantKey || nested.tenantKey || nested.tenantkey || root.tenantKey || root.tenantkey || "";
   return {
@@ -582,6 +652,7 @@ var E10AuthSession = class _E10AuthSession {
     return session;
   }
   async fetchEmployeeId() {
+    const { signal, clear } = createTimeoutSignal(E10_TEAMS_CHECK_TIMEOUT_MS);
     try {
       const resp = await fetch(
         `${this.getBaseUrl()}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(this.getBaseUrl())}`,
@@ -594,7 +665,8 @@ var E10AuthSession = class _E10AuthSession {
             cookie: this.cookieHeader(),
             "user-agent": this.uaHeader(),
             origin: this.getBaseUrl()
-          }
+          },
+          signal
         }
       );
       const data = await resp.json().catch(() => ({}));
@@ -606,9 +678,19 @@ var E10AuthSession = class _E10AuthSession {
       if (userInfo.subcompany) this.data.subcompany = userInfo.subcompany;
       if (userInfo.position) this.data.position = userInfo.position;
     } catch {
+    } finally {
+      clear();
     }
   }
-  async checkValid() {
+  /**
+   * 三态探活：`true` 明确有效、`false` 明确失效（401/403）、`undefined` 无法判定（网络/5xx）。
+   *
+   * 为什么要和 `checkValid()` 分开：平台连接器判断"是否已登录"时，
+   * 把网络抖动当成"未登录"会逼用户重复登录；而把 401 当成"已登录"会让后续业务全失败。
+   * 未认定失效时保持乐观，明确失效才降级。
+   */
+  async probeValid() {
+    const { signal, clear } = createTimeoutSignal(E10_TEAMS_CHECK_TIMEOUT_MS);
     try {
       const resp = await fetch(`${this.getBaseUrl()}/api/ecode/tree/list?parentId=0`, {
         headers: {
@@ -617,13 +699,21 @@ var E10AuthSession = class _E10AuthSession {
           cookie: this.cookieHeader(),
           "user-agent": this.uaHeader()
         },
-        redirect: "manual"
+        redirect: "manual",
+        signal
       });
-      return resp.status === 200;
+      if (resp.status === 200) return true;
+      if (resp.status === 401 || resp.status === 403) return false;
+      return void 0;
     } catch {
-      return false;
+      return void 0;
+    } finally {
+      clear();
     }
   }
+  async checkValid() {
+    return await this.probeValid() === true;
+  }
   async ensureValid() {
     if (await this.checkValid()) return true;
     const account = process.env.E10_ACCOUNT;
@@ -722,6 +812,8 @@ var E10AuthSession = class _E10AuthSession {
 var E10_REAUTH_GUIDANCE = "\u8BF7\u7ED3\u5408\u5F53\u524D\u5BBF\u4E3B\u73AF\u5883\u9009\u62E9\u5408\u9002\u7684\u767B\u5F55\u65B9\u5F0F\uFF0C\u6062\u590D\u767B\u5F55\u540E\u91CD\u8BD5\u539F\u8BF7\u6C42\u3002";
 var E10_AUTH_REQUIRED_MESSAGE = `E10 \u767B\u5F55\u6001\u4E0D\u53EF\u7528\u3002${E10_REAUTH_GUIDANCE}`;
 var E10_XIAOE_RECOVERY_FAILED_MESSAGE = "E10 \u767B\u5F55\u6001\u4E0D\u53EF\u7528\u3002\u5DF2\u5C1D\u8BD5\u5C0F e \u81EA\u52A8\u91CD\u65B0\u83B7\u53D6\u767B\u5F55\u4FE1\u606F\uFF0C\u4F46\u672A\u53D6\u5F97\u53EF\u7528\u767B\u5F55\u6001\u3002\u8BF7\u5728\u5C0F e \u4E2D\u6062\u590D\u767B\u5F55\u540E\u91CD\u8BD5\u3002";
+var E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE = "E10 \u767B\u5F55\u6001\u4E0D\u53EF\u7528\u3002\u5C0F e \u7F51\u9875\u7AEF\u672A\u5411\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u6CE8\u5165\u7EDF\u4E00\u767B\u5F55\u51ED\u636E\uFF0C\u81EA\u52A8\u83B7\u53D6\u5DF2\u505C\u6B62\u3002\u8BF7\u68C0\u67E5\u7F51\u9875\u6280\u80FD\u6C99\u7BB1\u7684\u5BBF\u4E3B\u51ED\u636E\u900F\u4F20\u540E\u91CD\u8BD5\u3002";
+var E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE = "\u6682\u65F6\u65E0\u6CD5\u8FDE\u63A5 E10\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5";
 var E10_SESSION_EXPIRED_MESSAGE = `E10 \u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u672C\u6B21\u64CD\u4F5C\u5DF2\u505C\u6B62\u3002${E10_REAUTH_GUIDANCE}`;
 
 // src/core/package-paths.ts
@@ -836,6 +928,82 @@ var XIAOE_CLIENT_SETTINGS_SOURCE = "XiaoE/Robots/user_settings.json";
 var XIAOE_USER_TOKEN_SOURCE = "XIAOE_USER_TOKEN";
 var XIAOE_BUNDLED_ENV_SCRIPT_SOURCE = "bundled scripts/xiaoe_env.py";
 var XIAOE_ETEAMID_TTL_MS = 72e5;
+var XIAOE_DIAGNOSTIC_MAX_LENGTH = 300;
+function redactXiaoEDiagnostic(message, secrets) {
+  let text = message;
+  for (const secret of secrets) {
+    if (secret && secret.length >= 8 && text.includes(secret)) {
+      text = text.split(secret).join("<redacted>");
+    }
+  }
+  const normalized = text.replace(/\s+/gu, " ").trim();
+  return normalized.length > XIAOE_DIAGNOSTIC_MAX_LENGTH ? `${normalized.slice(0, XIAOE_DIAGNOSTIC_MAX_LENGTH)}\u2026` : normalized;
+}
+function noteXiaoEStep(diagnostics, step) {
+  diagnostics?.attemptedSteps.push(step);
+}
+function tagXiaoEError(message, tags) {
+  return Object.assign(new CliError(message, 3 /* AuthError */), tags);
+}
+function readTag(error, key, type) {
+  if (!error || typeof error !== "object") return void 0;
+  const value = error[key];
+  return typeof value === type ? value : void 0;
+}
+function classifyXiaoEHttpStatus(status) {
+  if (status === 401 || status === 403) return "credential";
+  if (status >= 300 && status < 400) return "credential";
+  return status >= 400 ? "http" : "credential";
+}
+function classifyXiaoEError(error) {
+  const taggedKind = readTag(error, "errorKind", "string");
+  const taggedStatus = readTag(error, "status", "number");
+  const taggedCause = readTag(error, "causeCode", "string");
+  const causeCode = taggedCause || readErrorCauseCode(error);
+  const withCause = causeCode ? { causeCode } : {};
+  const withStatus = taggedStatus === void 0 ? {} : { status: taggedStatus };
+  if (taggedKind) return { kind: taggedKind, ...withCause, ...withStatus };
+  const message = error instanceof Error ? error.message : String(error);
+  if (isAbortError(error)) return { kind: "network", causeCode: causeCode || "ETIMEDOUT" };
+  if (taggedStatus !== void 0) {
+    return { kind: classifyXiaoEHttpStatus(taggedStatus), ...withCause, status: taggedStatus };
+  }
+  if (causeCode && isNetworkErrorCode(causeCode)) return { kind: "network", causeCode };
+  const httpMatch = /\bHTTP (\d{3})\b/u.exec(message);
+  if (httpMatch) {
+    const status = Number(httpMatch[1]);
+    return { kind: classifyXiaoEHttpStatus(status), ...withCause, status };
+  }
+  if (looksLikeTransportMessage(message)) return { kind: "network", ...withCause };
+  return { kind: "credential", ...withCause };
+}
+function noteXiaoEError(diagnostics, error, secrets = [], stage = "e10_session") {
+  if (!diagnostics) return;
+  const message = error instanceof Error ? error.message : String(error);
+  const redacted = redactXiaoEDiagnostic(message, secrets);
+  if (redacted) diagnostics.lastError = redacted;
+  const { kind, causeCode, status } = classifyXiaoEError(error);
+  const failure = {
+    stage: readTag(error, "stage", "string") ?? stage,
+    kind,
+    message: redacted,
+    ...causeCode ? { causeCode } : {},
+    ...status === void 0 ? {} : { httpStatus: status }
+  };
+  if (!diagnostics.failures) diagnostics.failures = [];
+  diagnostics.failures.push(failure);
+}
+function summarizeXiaoEFailureKind(diagnostics) {
+  const failures = diagnostics?.failures || [];
+  if (!failures.length) return void 0;
+  if (failures.some((failure) => failure.kind === "credential")) return "credential";
+  if (failures.some((failure) => failure.kind === "http")) return "http";
+  return failures.every((failure) => failure.kind === "network") ? "network" : void 0;
+}
+function lastXiaoEFailure(diagnostics) {
+  const failures = diagnostics?.failures || [];
+  return failures.length ? failures[failures.length - 1] : void 0;
+}
 function envString(env, ...keys) {
   for (const key of keys) {
     const value = env[key];
@@ -854,6 +1022,15 @@ function hasXiaoEEnv(env = process.env, options = {}) {
   const explicitAgentType = envString(env, "WEAVER_AGENT_TYPE");
   return explicitAgentType ? isXiaoERuntimeAgent(explicitAgentType) : false;
 }
+function resolveXiaoEClientType(env = process.env) {
+  const raw = envString(env, "XIAOE_CLIENT_TYPE").toLowerCase();
+  if (raw === "client" || raw === "desktop" || raw === "pc") return "client";
+  if (raw === "cloud" || raw === "web" || raw === "browser") return "cloud";
+  return void 0;
+}
+function isXiaoECloudRuntime(env = process.env) {
+  return resolveXiaoEClientType(env) === "cloud";
+}
 function describeXiaoECredentialSource(source) {
   if (source === XIAOE_USER_TOKEN_SOURCE || source === XIAOE_BUNDLED_ENV_SCRIPT_SOURCE) {
     return {
@@ -1352,14 +1529,17 @@ function inspectXiaoEUnifiedLoginSources(options = {}) {
   });
   const platformCredential = hasXiaoEPlatformCredential(env);
   const allowLocalDiscovery = options.allowLocalDiscovery !== false;
-  const tokenScript = options.allowTokenScript !== false && hasXiaoETokenScript(env, allowLocalDiscovery);
-  const clientCredential = hasXiaoEClientCredential(env, allowLocalDiscovery);
+  const clientType = resolveXiaoEClientType(env);
+  const allowDesktopChannels = clientType !== "cloud";
+  const tokenScript = allowDesktopChannels && options.allowTokenScript !== false && hasXiaoETokenScript(env, allowLocalDiscovery);
+  const clientCredential = allowDesktopChannels && hasXiaoEClientCredential(env, allowLocalDiscovery);
   const environmentCredential = Boolean(baseUrl && resolveXiaoEUnifiedLoginCredential(baseUrl, env));
   return {
     platformCredential,
     tokenScript,
     clientCredential,
     environmentCredential,
+    clientType,
     any: platformCredential || tokenScript || clientCredential || environmentCredential
   };
 }
@@ -1382,37 +1562,71 @@ async function fetchXiaoEClientEteamId(credential, domain) {
       });
       if (resp.status < 300 || resp.status >= 400) break;
       if (redirects === 5) {
-        throw new CliError("XiaoE client token endpoint redirected too many times.", 3 /* AuthError */);
+        throw tagXiaoEError("XiaoE client token endpoint redirected too many times.", {
+          errorKind: "http"
+        });
       }
       const location = resp.headers.get("location");
       if (!location) {
-        throw new CliError("XiaoE client token endpoint returned a redirect without Location.", 3 /* AuthError */);
+        throw tagXiaoEError("XiaoE client token endpoint returned a redirect without Location.", {
+          errorKind: "http",
+          status: resp.status
+        });
       }
       const next = new URL(location, endpoint);
       const sameOrigin = next.origin === endpoint.origin;
       const sameHostHttpsUpgrade = endpoint.protocol === "http:" && next.protocol === "https:" && next.hostname === endpoint.hostname;
       const safeProtocol = next.protocol === "http:" || next.protocol === "https:";
       if (!safeProtocol || next.username || next.password || !sameOrigin && !sameHostHttpsUpgrade) {
-        throw new CliError("XiaoE client token endpoint attempted an unsafe cross-origin redirect.", 3 /* AuthError */);
+        throw tagXiaoEError("XiaoE client token endpoint attempted an unsafe cross-origin redirect.", {
+          errorKind: "http",
+          status: resp.status
+        });
       }
       await resp.body?.cancel().catch(() => void 0);
       endpoint = next;
     }
     if (!resp?.ok) {
-      throw new CliError(`XiaoE client token endpoint returned HTTP ${resp?.status || 0}.`, 3 /* AuthError */);
+      const status = resp?.status || 0;
+      throw tagXiaoEError(`XiaoE client token endpoint returned HTTP ${status}.`, {
+        errorKind: classifyXiaoEHttpStatus(status),
+        status
+      });
     }
-    const data = await resp.json().catch(() => null);
+    const data = await resp.json().catch((error) => {
+      if (isAbortError(error)) throw error;
+      return null;
+    });
     if (!data || typeof data !== "object" || Array.isArray(data)) {
-      throw new CliError("XiaoE client token endpoint returned invalid JSON.", 3 /* AuthError */);
+      throw tagXiaoEError("XiaoE client token endpoint returned invalid JSON.", {
+        errorKind: "http",
+        status: resp.status
+      });
     }
     const payload = data;
     const businessCode = payload.code;
     const businessData = payload.data && typeof payload.data === "object" && !Array.isArray(payload.data) ? payload.data : {};
     if (businessCode !== "0000" && businessCode !== 0 && businessCode !== 200 || !readString(businessData, "eteamId")) {
       const codeText = businessCode === void 0 ? "missing" : String(businessCode);
-      throw new CliError(`XiaoE client token exchange failed with business code ${codeText}.`, 3 /* AuthError */);
+      throw tagXiaoEError(`XiaoE client token exchange failed with business code ${codeText}.`, {
+        errorKind: "credential"
+      });
     }
     return payload;
+  } catch (error) {
+    if (isAbortError(error)) {
+      throw tagXiaoEError(
+        `XiaoE client token endpoint timed out after ${XIAOE_CLIENT_TOKEN_TIMEOUT_MS} ms.`,
+        { errorKind: "network", causeCode: "ETIMEDOUT" }
+      );
+    }
+    if (error instanceof CliError) throw error;
+    const causeCode = readErrorCauseCode(error);
+    const message = error instanceof Error ? error.message : String(error);
+    throw tagXiaoEError(
+      `XiaoE client token endpoint request failed${causeCode ? ` (${causeCode})` : ""}: ${message}`,
+      { errorKind: "network", ...causeCode ? { causeCode } : {} }
+    );
   } finally {
     clearTimeout(timer);
   }
@@ -1461,26 +1675,58 @@ function createXiaoEUnifiedLoginUnavailableError(baseUrl = "") {
   });
 }
 async function resolveUserInfo(baseUrl, eteamsId, rawCookie = "", agentType = "") {
-  const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
-    method: "POST",
-    headers: {
-      accept: "application/json",
-      "content-type": "application/json",
-      eteamsid: eteamsId,
-      cookie: buildE10CookieHeader(rawCookie, eteamsId, agentType),
-      "user-agent": agentType ? `AgentType=${agentType},IsAgent=true` : "weaver-work-cli",
-      origin: baseUrl
-    },
-    redirect: "manual"
-  });
-  const data = await resp.json().catch(() => ({}));
-  return { userInfo: readTeamsCheckUserInfo(resp, data), setCookie: extractRawSetCookie(resp) };
+  const { signal, clear } = createTimeoutSignal(E10_TEAMS_CHECK_TIMEOUT_MS);
+  try {
+    const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json",
+        eteamsid: eteamsId,
+        cookie: buildE10CookieHeader(rawCookie, eteamsId, agentType),
+        "user-agent": agentType ? `AgentType=${agentType},IsAgent=true` : "weaver-work-cli",
+        origin: baseUrl
+      },
+      redirect: "manual",
+      signal
+    });
+    const data = await resp.json().catch((error) => {
+      if (isAbortError(error)) throw error;
+      return {};
+    });
+    return { userInfo: readTeamsCheckUserInfo(resp, data), setCookie: extractRawSetCookie(resp), status: resp.status };
+  } catch (error) {
+    if (isAbortError(error)) {
+      throw tagXiaoEError(
+        `E10 teamsCheck timed out after ${E10_TEAMS_CHECK_TIMEOUT_MS} ms.`,
+        { errorKind: "network", stage: "teams_check", causeCode: "ETIMEDOUT" }
+      );
+    }
+    if (error instanceof CliError) throw error;
+    const causeCode = readErrorCauseCode(error);
+    const message = error instanceof Error ? error.message : String(error);
+    throw tagXiaoEError(
+      `E10 teamsCheck request failed${causeCode ? ` (${causeCode})` : ""}: ${message}`,
+      { errorKind: "network", stage: "teams_check", ...causeCode ? { causeCode } : {} }
+    );
+  } finally {
+    clear();
+  }
 }
 async function saveXiaoEUnifiedLogin(input) {
   const baseUrl = normalizeUrl(input.baseUrl);
-  const { userInfo, setCookie } = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || "", XIAOE_AGENT_TYPE);
+  const { userInfo, setCookie, status } = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || "", XIAOE_AGENT_TYPE);
   if (!userInfo.userId) {
-    throw new CliError("Could not resolve userId. Check whether XiaoE unified login is valid for this E10 domain.", 3 /* AuthError */);
+    const statusText = status || 0;
+    throw classifyXiaoEHttpStatus(statusText) === "http" ? tagXiaoEError(`E10 teamsCheck returned HTTP ${statusText}.`, {
+      errorKind: "http",
+      stage: "teams_check",
+      status: statusText
+    }) : tagXiaoEError("Could not resolve userId. Check whether XiaoE unified login is valid for this E10 domain.", {
+      errorKind: "credential",
+      stage: "teams_check",
+      status: statusText
+    });
   }
   const tenantKey = userInfo.tenantKey || input.tenantKeyFallback || "";
   const profile = input.profileHint || profileNameFromUrl(baseUrl);
@@ -1537,41 +1783,67 @@ async function tryXiaoEUnifiedLogin(options = {}) {
     profileBaseUrl: options.profileBaseUrl,
     env
   });
-  const mayUseTokenScript = options.allowTokenScript === true;
-  if (!baseUrl && !mayUseTokenScript) return null;
+  const mayUseTokenScript = options.allowTokenScript === true && !isXiaoECloudRuntime(env);
+  const diagnostics = options.diagnostics;
+  const platformCredentialDetected = hasXiaoEPlatformCredential(env);
+  const secrets = [envString(env, "XIAOE_USER_TOKEN")];
+  if (diagnostics) {
+    diagnostics.baseUrl = baseUrl;
+    diagnostics.platformCredentialDetected = platformCredentialDetected;
+    diagnostics.clientType = resolveXiaoEClientType(env);
+  }
+  if (!baseUrl && !mayUseTokenScript) {
+    noteXiaoEStep(diagnostics, "base_url:missing");
+    return null;
+  }
   let credential = null;
-  if (hasXiaoEPlatformCredential(env)) {
+  if (platformCredentialDetected) {
     options.logger?.info("Trying XiaoE platform credential from XIAOE_USER_TOKEN...");
     try {
       credential = await resolveXiaoEPlatformCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
+      noteXiaoEError(diagnostics, error, secrets, "platform_token");
       options.logger?.warn("XiaoE platform credential failed. " + message);
     }
     if (!credential) {
       options.logger?.warn(options.allowBundledEnvScript ? "XiaoE platform credential did not return usable ETEAMSID; will try the CLI-bundled xiaoe_env.py compatibility path next." : "XiaoE platform credential did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.");
     }
   }
-  if (!credential && options.allowBundledEnvScript && hasXiaoEPlatformCredential(env)) {
-    const scriptPath = xiaoEBundledEnvScriptPath();
-    if (!scriptPath) {
-      options.logger?.warn("CLI-bundled xiaoe_env.py was not found; will try desktop XiaoE credential sources next.");
+  noteXiaoEStep(
+    diagnostics,
+    credential ? "platform_token:ok" : `platform_token:${platformCredentialDetected ? "failed" : "missing"}`
+  );
+  if (!credential) {
+    if (!options.allowBundledEnvScript) {
+      noteXiaoEStep(diagnostics, "bundled_env_script:disabled");
+    } else if (!platformCredentialDetected) {
+      noteXiaoEStep(diagnostics, "bundled_env_script:missing");
     } else {
-      options.logger?.info("Trying CLI-bundled xiaoe_env.py compatibility credential...");
-      try {
-        credential = await resolveXiaoEBundledEnvScriptCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        options.logger?.warn("CLI-bundled xiaoe_env.py failed. " + message);
-      }
-      if (!credential) {
-        options.logger?.warn("CLI-bundled xiaoe_env.py did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.");
+      const scriptPath = xiaoEBundledEnvScriptPath();
+      if (!scriptPath) {
+        noteXiaoEStep(diagnostics, "bundled_env_script:missing");
+        options.logger?.warn("CLI-bundled xiaoe_env.py was not found; will try desktop XiaoE credential sources next.");
+      } else {
+        options.logger?.info("Trying CLI-bundled xiaoe_env.py compatibility credential...");
+        try {
+          credential = await resolveXiaoEBundledEnvScriptCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          noteXiaoEError(diagnostics, error, secrets, "bundled_env_script");
+          options.logger?.warn("CLI-bundled xiaoe_env.py failed. " + message);
+        }
+        if (!credential) {
+          options.logger?.warn("CLI-bundled xiaoe_env.py did not return usable ETEAMSID; will try xiaoeUserData/tokens.py next.");
+        }
+        noteXiaoEStep(diagnostics, `bundled_env_script:${credential ? "ok" : "failed"}`);
       }
     }
   }
   if (!credential && mayUseTokenScript) {
     const tokenScriptPath = xiaoETokenScriptPath(env);
     if (!tokenScriptPath) {
+      noteXiaoEStep(diagnostics, "token_script:missing");
       options.logger?.warn("XiaoE token script not found. Expected xiaoeUserData/tokens.py; will try the local XiaoE client session next.");
     } else {
       options.logger?.info("Trying XiaoE token script credential...");
@@ -1579,11 +1851,13 @@ async function tryXiaoEUnifiedLogin(options = {}) {
         credential = await resolveXiaoETokenScriptCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
+        noteXiaoEError(diagnostics, error, secrets, "token_script");
         options.logger?.warn("XiaoE token script failed. " + message);
       }
       if (!credential) {
         options.logger?.warn("XiaoE token script did not return usable ETEAMSID; will try the local XiaoE client session next.");
       }
+      noteXiaoEStep(diagnostics, `token_script:${credential ? "ok" : "failed"}`);
     }
     if (!credential && hasXiaoEClientCredential(env)) {
       options.logger?.info("Trying built-in XiaoE client session credential...");
@@ -1591,18 +1865,29 @@ async function tryXiaoEUnifiedLogin(options = {}) {
         credential = await resolveXiaoEClientCredential(baseUrl || DEFAULT_E10_BASE_URL, env);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
+        noteXiaoEError(diagnostics, error, secrets, "client_session");
         options.logger?.warn("Built-in XiaoE client credential failed. " + message);
       }
       if (!credential) {
         options.logger?.warn("Built-in XiaoE client credential did not return usable ETEAMSID; will try WEAVER_XIAOE_* credentials next.");
       }
+      noteXiaoEStep(diagnostics, `client_session:${credential ? "ok" : "failed"}`);
+    } else if (!credential) {
+      noteXiaoEStep(diagnostics, "client_session:missing");
     }
+  } else if (!credential) {
+    noteXiaoEStep(diagnostics, "token_script:disabled");
+    noteXiaoEStep(diagnostics, "client_session:disabled");
   }
   if (!credential && baseUrl) credential = resolveXiaoEUnifiedLoginCredential(baseUrl, env);
-  if (!credential) return null;
+  if (!credential) {
+    noteXiaoEStep(diagnostics, "environment_map:empty");
+    return null;
+  }
+  noteXiaoEStep(diagnostics, `credential_source:${credential.source}`);
   options.logger?.info("Detected XiaoE unified login for this E10 domain. Trying XiaoE auth...");
   try {
-    return await saveXiaoEUnifiedLogin({
+    const login = await saveXiaoEUnifiedLogin({
       baseUrl: credential.baseUrl || baseUrl || DEFAULT_E10_BASE_URL,
       eteamsId: credential.eteamsId,
       rawCookie: credential.rawCookie,
@@ -1611,8 +1896,16 @@ async function tryXiaoEUnifiedLogin(options = {}) {
       profileHint: options.profileHint,
       credentialSource: describeXiaoECredentialSource(credential.source)
     });
+    noteXiaoEStep(diagnostics, "e10_session:ok");
+    if (diagnostics) {
+      delete diagnostics.lastError;
+      delete diagnostics.failures;
+    }
+    return login;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
+    noteXiaoEError(diagnostics, error, secrets, "e10_session");
+    noteXiaoEStep(diagnostics, "e10_session:failed");
     options.logger?.warn("XiaoE unified login failed. " + message);
     return null;
   }
@@ -1647,6 +1940,7 @@ export {
   packagePath,
   packageFileUrl,
   normalizeGlobalOptions,
+  readErrorCauseCode,
   getE10AuthRoot,
   getActiveProfile,
   setActiveProfile,
@@ -1668,9 +1962,13 @@ export {
   E10_REAUTH_GUIDANCE,
   E10_AUTH_REQUIRED_MESSAGE,
   E10_XIAOE_RECOVERY_FAILED_MESSAGE,
+  E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE,
+  E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE,
   E10_SESSION_EXPIRED_MESSAGE,
   isXiaoERuntimeAgent,
   XIAOE_AGENT_TYPE,
+  summarizeXiaoEFailureKind,
+  lastXiaoEFailure,
   hasXiaoEEnv,
   inspectXiaoEUnifiedLoginSources,
   resolveXiaoEPreferredBaseUrl,

package/dist/chunks/{chunk-LUSPKZKY.js → chunk-UG5G54VL.js}

@@ -49,5 +49,6 @@ function toErrorEnvelope(error) {
 export {
   CliError,
   isCliError,
+  isStructuredError,
   toErrorEnvelope
 };

package/dist/chunks/{chunk-NIAJ5ZCG.js → chunk-UL5XUQ25.js}

@@ -2,7 +2,10 @@ import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
   esbValidationError
-} from "./chunk-GPMFD4RD.js";
+} from "./chunk-TXUG266F.js";
+import {
+  CONTINUATION_TTL_MS
+} from "./chunk-7BDPM5ST.js";
 
 // src/shortcuts/esb/continuation.ts
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
@@ -37,7 +40,7 @@ function signature(payload, key) {
 }
 function createEsbContinuationSigner(ctx) {
   return {
-    async issue(payload, ttlMs = 10 * 6e4) {
+    async issue(payload, ttlMs = CONTINUATION_TTL_MS) {
       const issuedAt = Date.now();
       const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
       const sig = signature(body, await loadKey(ctx));

package/dist/chunks/{chunk-FMPJJYYI.js → chunk-WRXSAVKO.js}

@@ -2,7 +2,7 @@ import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
   CliError
-} from "./chunk-LUSPKZKY.js";
+} from "./chunk-UG5G54VL.js";
 
 // src/shortcuts/workflow/errors.ts
 var WorkflowCliError = class extends CliError {