weaver-work-cli 0.1.40 → 0.1.44

package/dist/internal/e10/auth/commands.js

@@ -5,6 +5,7 @@ import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
+import { appendXiaoEAuthErrorLog, clearXiaoEAuthErrorLog, getXiaoEAuthErrorLogPath, normalizeXiaoEAuthErrorLogLimit, readXiaoEAuthErrorLog, xiaoEAuthLogSecrets, } from './error-log.js';
 import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, inspectXiaoEUnifiedLoginSources, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
 export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, hasXiaoEUnifiedLoginSource, inspectXiaoEUnifiedLoginSources, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
@@ -385,7 +386,7 @@ async function saveEteamsIdLogin(input) {
         version: input.version || '',
     };
 }
-async function tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKeyFallback, profileHint, allowTokenScript = false) {
+async function tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKeyFallback, profileHint, allowTokenScript = false, diagnostics) {
     const login = await tryXiaoEUnifiedSessionLogin({
         env: ctx.env,
         baseUrl,
@@ -394,6 +395,7 @@ async function tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKeyFallback, profileHint
         profileHint,
         allowTokenScript,
         logger: ctx.logger,
+        diagnostics,
     });
     return login?.result || null;
 }
@@ -529,6 +531,15 @@ async function runXiaoELogin(ctx, options) {
     const useXiaoELogin = xiaoESources.any;
     const baseUrl = preferredXiaoEBaseUrl;
     const tenantKey = optionString(commandOpts, 'tenantKey');
+    const diagnostics = {
+        attemptedSteps: [],
+        baseUrl,
+        clientType: xiaoESources.clientType,
+        platformCredentialDetected: xiaoESources.platformCredential,
+    };
+    if (!useXiaoELogin) {
+        diagnostics.attemptedSteps.push('platform_token:missing', 'bundled_env_script:missing', xiaoESources.clientType === 'cloud' ? 'token_script:disabled' : 'token_script:missing', xiaoESources.clientType === 'cloud' ? 'client_session:disabled' : 'client_session:missing', 'environment_map:empty');
+    }
     ctx.logger.info([
         'XiaoE unified login preflight:',
         'authMode=xiaoe',
@@ -538,15 +549,38 @@ async function runXiaoELogin(ctx, options) {
         `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
         `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
         `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+        `clientType=${xiaoESources.clientType || '(unset)'}`,
         `baseUrl=${baseUrl || '(unresolved)'}`,
     ].join(' '));
     if (useXiaoELogin) {
-        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true);
-        if (xiaoEResult)
-            return xiaoEResult;
+        try {
+            const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true, diagnostics);
+            if (xiaoEResult)
+                return xiaoEResult;
+        }
+        catch (error) {
+            await appendXiaoEAuthErrorLog({
+                source: 'login',
+                profile: profileFromGlobal || getActiveProfile(),
+                baseUrl,
+                diagnostics,
+                error,
+                secrets: xiaoEAuthLogSecrets(ctx.env),
+            }).catch((logError) => ctx.logger.debug(`Could not persist XiaoE auth error log: ${logError instanceof Error ? logError.message : String(logError)}`));
+            throw error;
+        }
     }
     ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-    throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+    const error = createXiaoEUnifiedLoginUnavailableError(baseUrl);
+    await appendXiaoEAuthErrorLog({
+        source: 'login',
+        profile: profileFromGlobal || getActiveProfile(),
+        baseUrl,
+        diagnostics,
+        error,
+        secrets: xiaoEAuthLogSecrets(ctx.env),
+    }).catch((logError) => ctx.logger.debug(`Could not persist XiaoE auth error log: ${logError instanceof Error ? logError.message : String(logError)}`));
+    throw error;
 }
 async function runBrowserLogin(ctx, options) {
     const commandOpts = asOptions(options);
@@ -767,7 +801,78 @@ function formatWhoami(title, data) {
         'User-Agent: ' + (data.userAgent || ''),
     ].join('\n');
 }
-function registerBrowserLoginCommand(auth, action, name, description) {
+function formatXiaoEAuthErrorLogEntry(entry) {
+    const lines = [
+        `[${entry.timestamp}] ${entry.source} id=${entry.id}`,
+        ...(entry.profile ? [`profile: ${entry.profile}`] : []),
+        ...(entry.baseUrl ? [`baseUrl: ${entry.baseUrl}`] : []),
+        ...(entry.clientType ? [`clientType: ${entry.clientType}`] : []),
+        ...(entry.attemptedSteps.length ? [`attemptedSteps: ${entry.attemptedSteps.join(', ')}`] : []),
+        ...(entry.lastError ? [`lastError: ${entry.lastError}`] : []),
+        ...(entry.resultSessionExpired ? ['resultSessionExpired: true'] : []),
+        ...(entry.error ? [`error: ${entry.error.type}/${entry.error.subtype}: ${entry.error.message}`] : []),
+    ];
+    for (const failure of entry.failures || []) {
+        lines.push([
+            `failure: ${failure.stage}/${failure.kind}`,
+            failure.causeCode ? `causeCode=${failure.causeCode}` : '',
+            failure.httpStatus === undefined ? '' : `httpStatus=${failure.httpStatus}`,
+            failure.message,
+        ].filter(Boolean).join(' '));
+    }
+    return lines.join('\n');
+}
+async function showXiaoEAuthErrorLogs(ctx, options) {
+    const commandOpts = asOptions(options);
+    let limit;
+    try {
+        limit = normalizeXiaoEAuthErrorLogLimit(commandOpts.limit);
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error ? error.message : String(error), ExitCode.UsageError);
+    }
+    const result = await readXiaoEAuthErrorLog(limit);
+    const text = result.entries.length
+        ? [
+            `XiaoE auth error logs (${result.returned}/${result.total}, newest first)`,
+            `logFile: ${result.path}`,
+            ...(result.invalidLines ? [`invalidLines: ${result.invalidLines}`] : []),
+            '',
+            result.entries.map(formatXiaoEAuthErrorLogEntry).join('\n\n'),
+        ].join('\n')
+        : [
+            'No XiaoE auth error logs.',
+            `logFile: ${result.path}`,
+            ...(result.invalidLines ? [`invalidLines: ${result.invalidLines}`] : []),
+        ].join('\n');
+    ctx.output.write(result, { text });
+}
+function registerXiaoEAuthLogCommands(auth, action) {
+    const logs = auth.command('logs')
+        .description('View or clear persisted XiaoE authentication error logs')
+        .option('--limit <n>', 'number of recent entries to show (1-500)', '50')
+        .action(action(showXiaoEAuthErrorLogs));
+    logs.command('show')
+        .description('Show persisted XiaoE authentication error logs')
+        .option('--limit <n>', 'number of recent entries to show (1-500)', '50')
+        .action(action(showXiaoEAuthErrorLogs));
+    logs.command('path')
+        .description('Print the XiaoE authentication error log path')
+        .action(action((ctx) => {
+        const path = getXiaoEAuthErrorLogPath();
+        ctx.output.write({ path }, { text: path });
+    }));
+    logs.command('clear')
+        .description('Clear persisted XiaoE authentication error logs')
+        .action(action(async (ctx) => {
+        const result = await clearXiaoEAuthErrorLog();
+        const text = result.cleared
+            ? `Cleared XiaoE auth error logs.\nlogFile: ${result.path}`
+            : `No XiaoE auth error logs to clear.\nlogFile: ${result.path}`;
+        ctx.output.write(result, { text });
+    }));
+}
+function registerBrowserLoginCommand(auth, action, name, description, machine = false) {
     const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
@@ -777,8 +882,28 @@ function registerBrowserLoginCommand(auth, action, name, description) {
         .option('--agent-type <value>', 'Alias of --agent_type')
         .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
     command.action(action(async (ctx, options) => {
-        const result = await runBrowserLogin(ctx, options);
-        ctx.output.write(result, { text: formatLoginResult(result) });
+        if (!machine) {
+            const result = await runBrowserLogin(ctx, options);
+            ctx.output.write(result, { text: formatLoginResult(result) });
+            return;
+        }
+        // 平台型连接器契约：stdout 只出严格 JSON，进度与授权链接走 stderr。
+        ctx.logger.machineMode = true;
+        try {
+            const result = await runBrowserLogin(ctx, options);
+            ctx.output.raw(JSON.stringify({
+                status: 'authorized',
+                employeeId: result.userId || '',
+                tenantKey: result.tenantKey || '',
+            }));
+        }
+        catch (error) {
+            ctx.output.raw(JSON.stringify({ status: 'unauthorized' }));
+            throw error;
+        }
+        finally {
+            ctx.logger.machineMode = false;
+        }
     }));
 }
 function registerXiaoELoginCommand(auth, action) {
@@ -846,6 +971,35 @@ export function registerE10AuthCommands(parent, action) {
             };
         ctx.output.write(status, { text: formatAuthStatus(status) });
     }));
+    auth.command('show')
+        .description('Platform contract: print login status as {"status":"authorized"|"unauthorized"}')
+        .option('--status', 'print only the strict JSON status object')
+        .option('--no-check', 'skip remote session validity check')
+        .action(action(async (ctx, options) => {
+        const opts = ctx.getGlobalOptions();
+        const commandOpts = asOptions(options);
+        const authFile = findAuthFile(ctx.cwd, opts);
+        const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
+        const profile = opts.profile || getActiveProfile();
+        const expired = session ? session.isExpired() : false;
+        // 三态探活：只有明确失效（401/403）才算未授权，网络异常保持乐观，避免逼用户重复登录。
+        const probe = session && !expired && commandOpts.check !== false
+            ? await session.probeValid()
+            : undefined;
+        const authorized = Boolean(session) && !expired && probe !== false;
+        if (commandOpts.status === true) {
+            ctx.output.raw(JSON.stringify({ status: authorized ? 'authorized' : 'unauthorized' }));
+            return;
+        }
+        ctx.output.write({
+            status: authorized ? 'authorized' : 'unauthorized',
+            loggedIn: Boolean(session),
+            expired,
+            reachable: probe,
+            profile,
+            baseUrl: session ? session.getBaseUrl() : '',
+        }, { json: true });
+    }));
     auth.command('set')
         .description('Save E10 auth from an ETEAMSID cookie')
         .requiredOption('--eteamsid <id>', 'ETEAMSID cookie value')
@@ -881,7 +1035,9 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
+    registerBrowserLoginCommand(auth, action, 'init', 'Platform contract alias of auth login: stdout is strict JSON {"status":"authorized"}', true);
     registerXiaoELoginCommand(auth, action);
+    registerXiaoEAuthLogCommands(auth, action);
     auth.command('logout')
         .alias('clear')
         .description('Clear saved E10 auth for the current or selected profile')

package/dist/internal/e10/auth/error-log.js

@@ -0,0 +1,182 @@
+import { randomUUID } from 'node:crypto';
+import { appendFile, chmod, mkdir, readFile, unlink } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { toErrorEnvelope } from '../../../core/errors.js';
+import { getE10AuthRoot } from './paths.js';
+const XIAOE_AUTH_ERROR_LOG_NAME = 'xiaoe-auth-errors.ndjson';
+const DEFAULT_LOG_LIMIT = 50;
+export const MAX_XIAOE_AUTH_ERROR_LOG_LIMIT = 500;
+/**
+ * The log lives beside the CLI-owned E10 profiles, never beside a caller-owned
+ * `--auth` file. Keeping the target fixed also makes the clear command safe.
+ */
+export function getXiaoEAuthErrorLogPath() {
+    return resolve(getE10AuthRoot(), 'logs', XIAOE_AUTH_ERROR_LOG_NAME);
+}
+export function xiaoEAuthLogSecrets(env) {
+    return Object.entries(env)
+        .filter(([key, value]) => Boolean(value
+        && (key.startsWith('XIAOE_') || key.startsWith('WEAVER_XIAOE_'))
+        && /(?:TOKEN|AUTH|ETEAMSID|COOKIE|SESSION|SECRET|PASSWORD)/iu.test(key)))
+        .map(([, value]) => value);
+}
+function redactSensitiveText(value, secrets = []) {
+    let text = value;
+    for (const secret of secrets) {
+        if (secret && secret.length >= 6)
+            text = text.split(secret).join('<redacted>');
+    }
+    return text
+        // Query strings regularly carry temporary tickets. The path is enough for diagnostics.
+        .replace(/(https?:\/\/[^\s?#]+)\?[^\s#]*/giu, '$1?<redacted>')
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/giu, '$1<redacted>')
+        .replace(/((?:eteamsid|access[_-]?token|refresh[_-]?token|auth(?:orization)?|cookie|session[_-]?id|secret|password)\s*[:=]\s*)(["']?)[^\s,;}"']+/giu, '$1$2<redacted>')
+        .replace(/(["'](?:eteamsid|access[_-]?token|refresh[_-]?token|authorization|cookie|session[_-]?id|secret|password)["']\s*:\s*["'])[^"']*(["'])/giu, '$1<redacted>$2')
+        // Opaque credentials that were not labelled by the producer.
+        .replace(/\b[A-Za-z0-9_-]{48,}\b/gu, '<redacted>');
+}
+function sanitizeBaseUrl(value, secrets) {
+    if (!value)
+        return undefined;
+    try {
+        const url = new URL(value);
+        url.username = '';
+        url.password = '';
+        url.search = '';
+        url.hash = '';
+        return redactSensitiveText(url.toString().replace(/\/$/u, ''), secrets);
+    }
+    catch {
+        return redactSensitiveText(value, secrets);
+    }
+}
+function sanitizeFailure(failure, secrets) {
+    return {
+        stage: failure.stage,
+        kind: failure.kind,
+        message: redactSensitiveText(failure.message, secrets),
+        ...(failure.causeCode ? { causeCode: redactSensitiveText(failure.causeCode, secrets) } : {}),
+        ...(failure.httpStatus === undefined ? {} : { httpStatus: failure.httpStatus }),
+    };
+}
+function sanitizeError(error, secrets) {
+    if (error === undefined)
+        return undefined;
+    const envelope = toErrorEnvelope(error);
+    return {
+        ...envelope,
+        message: redactSensitiveText(envelope.message, secrets),
+        // Error details can contain arbitrary server payloads. The normalized
+        // diagnostics fields above are the only details persisted to disk.
+        ...(envelope.details === undefined ? {} : { details: '<omitted from persistent auth log>' }),
+    };
+}
+function createEntry(input) {
+    const secrets = input.secrets || [];
+    const diagnostics = input.diagnostics;
+    const baseUrl = sanitizeBaseUrl(input.baseUrl || diagnostics?.baseUrl, secrets);
+    const lastError = diagnostics?.lastError
+        ? redactSensitiveText(diagnostics.lastError, secrets)
+        : undefined;
+    const failures = diagnostics?.failures?.map((failure) => sanitizeFailure(failure, secrets));
+    const error = sanitizeError(input.error, secrets);
+    return {
+        schemaVersion: 1,
+        id: randomUUID(),
+        timestamp: new Date().toISOString(),
+        source: input.source,
+        ...(input.profile ? { profile: redactSensitiveText(input.profile, secrets) } : {}),
+        ...(baseUrl ? { baseUrl } : {}),
+        ...(diagnostics?.clientType ? { clientType: diagnostics.clientType } : {}),
+        ...(diagnostics?.platformCredentialDetected === undefined
+            ? {}
+            : { platformCredentialDetected: diagnostics.platformCredentialDetected }),
+        attemptedSteps: (diagnostics?.attemptedSteps || []).map((step) => redactSensitiveText(step, secrets)),
+        ...(lastError ? { lastError } : {}),
+        ...(failures?.length ? { failures } : {}),
+        ...(input.resultSessionExpired ? { resultSessionExpired: true } : {}),
+        ...(error ? { error } : {}),
+    };
+}
+/**
+ * Append-only persistence keeps concurrent CLI processes from overwriting one
+ * another. A logging failure is returned to the caller and must never replace
+ * the original authentication error.
+ */
+export async function appendXiaoEAuthErrorLog(input) {
+    const path = getXiaoEAuthErrorLogPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await chmod(dirname(path), 0o700).catch(() => undefined);
+    const entry = createEntry(input);
+    await appendFile(path, `${JSON.stringify(entry)}\n`, { encoding: 'utf8', mode: 0o600 });
+    // Existing files may have been created under a permissive umask.
+    await chmod(path, 0o600).catch(() => undefined);
+    return entry;
+}
+function isLogEntry(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return candidate.schemaVersion === 1
+        && typeof candidate.id === 'string'
+        && typeof candidate.timestamp === 'string'
+        && (candidate.source === 'login' || candidate.source === 'recovery')
+        && Array.isArray(candidate.attemptedSteps);
+}
+export function normalizeXiaoEAuthErrorLogLimit(value) {
+    if (value === undefined || value === null || value === '')
+        return DEFAULT_LOG_LIMIT;
+    const limit = Number(value);
+    if (!Number.isInteger(limit) || limit < 1 || limit > MAX_XIAOE_AUTH_ERROR_LOG_LIMIT) {
+        throw new RangeError(`limit must be an integer between 1 and ${MAX_XIAOE_AUTH_ERROR_LOG_LIMIT}`);
+    }
+    return limit;
+}
+export async function readXiaoEAuthErrorLog(limit = DEFAULT_LOG_LIMIT) {
+    const normalizedLimit = normalizeXiaoEAuthErrorLogLimit(limit);
+    const path = getXiaoEAuthErrorLogPath();
+    let content = '';
+    try {
+        content = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (error?.code !== 'ENOENT')
+            throw error;
+    }
+    let invalidLines = 0;
+    const entries = [];
+    for (const line of content.split(/\r?\n/u)) {
+        if (!line.trim())
+            continue;
+        try {
+            const value = JSON.parse(line);
+            if (isLogEntry(value))
+                entries.push(value);
+            else
+                invalidLines += 1;
+        }
+        catch {
+            invalidLines += 1;
+        }
+    }
+    const recent = entries.slice(-normalizedLimit).reverse();
+    return {
+        path,
+        total: entries.length,
+        returned: recent.length,
+        invalidLines,
+        entries: recent,
+    };
+}
+export async function clearXiaoEAuthErrorLog() {
+    const path = getXiaoEAuthErrorLogPath();
+    try {
+        await unlink(path);
+        return { path, cleared: true };
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return { path, cleared: false };
+        throw error;
+    }
+}

package/dist/internal/e10/auth/messages.js

@@ -1,4 +1,10 @@
 export const E10_REAUTH_GUIDANCE = '请结合当前宿主环境选择合适的登录方式，恢复登录后重试原请求。';
 export const E10_AUTH_REQUIRED_MESSAGE = `E10 登录态不可用。${E10_REAUTH_GUIDANCE}`;
 export const E10_XIAOE_RECOVERY_FAILED_MESSAGE = 'E10 登录态不可用。已尝试小 e 自动重新获取登录信息，但未取得可用登录态。请在小 e 中恢复登录后重试。';
+export const E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE = 'E10 登录态不可用。小 e 网页端未向当前运行环境注入统一登录凭据，自动获取已停止。请检查网页技能沙箱的宿主凭据透传后重试。';
+/**
+ * 恢复流程全程只有网络错误时的文案。此时登录态根本没有被验证过，让用户去
+ * 重新登录是误导——该做的是稍后重试。
+ */
+export const E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE = '暂时无法连接 E10，请稍后重试';
 export const E10_SESSION_EXPIRED_MESSAGE = `E10 登录态已失效，本次操作已停止。${E10_REAUTH_GUIDANCE}`;

package/dist/internal/e10/auth/session.js

@@ -4,8 +4,14 @@ import { dirname, resolve } from 'node:path';
 import { CliError, ExitCode } from '../../../core/errors.js';
 import { isConnectorMode } from '../../../core/connector.js';
 import { writeWithRetry } from '../../../core/write-with-retry.js';
+import { createTimeoutSignal } from '../network-error.js';
 import { encryptAuthData, parseAuthFile } from './crypto.js';
 import { getE10ActiveProfilePath, getE10ProfilesRoot } from './paths.js';
+/**
+ * teamsCheck 与会话探测都是「发业务请求之前的必经往返」，没有上限时一个半开
+ * 连接就能把整条命令挂死。所有这类小请求统一用这个超时。
+ */
+export const E10_TEAMS_CHECK_TIMEOUT_MS = 15_000;
 const RSA_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEOk/WyyJKdAHIfMODFnKg7MBoraFBnL3F18hhLx5n01J5g4hCkmpc5+KQFKIQIA/QWk9m7QBzI/OV9ZDFk54LaWm3xP8C+P1TPp7UVGz3iNDLdvgSxuGEYPmML3NaqkbVlvW7/NlNA3ED4Kao7rR5GUYSdFfbaBoxBFae638hzQIDAQAB
 -----END PUBLIC KEY-----`;
@@ -435,6 +441,8 @@ export class E10AuthSession {
         return session;
     }
     async fetchEmployeeId() {
+        // 富化不是关键路径：超时就放弃，不能让 teamsCheck 无限等待。
+        const { signal, clear } = createTimeoutSignal(E10_TEAMS_CHECK_TIMEOUT_MS);
         try {
             const resp = await fetch(`${this.getBaseUrl()}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(this.getBaseUrl())}`, {
                 method: 'POST',
@@ -446,6 +454,7 @@ export class E10AuthSession {
                     'user-agent': this.uaHeader(),
                     origin: this.getBaseUrl(),
                 },
+                signal,
             });
             const data = await resp.json().catch(() => ({}));
             const userInfo = readTeamsCheckUserInfo(resp, data);
@@ -465,8 +474,19 @@ export class E10AuthSession {
         catch {
             // Non-critical profile enrichment.
         }
+        finally {
+            clear();
+        }
     }
-    async checkValid() {
+    /**
+     * 三态探活：`true` 明确有效、`false` 明确失效（401/403）、`undefined` 无法判定（网络/5xx）。
+     *
+     * 为什么要和 `checkValid()` 分开：平台连接器判断"是否已登录"时，
+     * 把网络抖动当成"未登录"会逼用户重复登录；而把 401 当成"已登录"会让后续业务全失败。
+     * 未认定失效时保持乐观，明确失效才降级。
+     */
+    async probeValid() {
+        const { signal, clear } = createTimeoutSignal(E10_TEAMS_CHECK_TIMEOUT_MS);
         try {
             const resp = await fetch(`${this.getBaseUrl()}/api/ecode/tree/list?parentId=0`, {
                 headers: {
@@ -476,13 +496,24 @@ export class E10AuthSession {
                     'user-agent': this.uaHeader(),
                 },
                 redirect: 'manual',
+                signal,
             });
-            return resp.status === 200;
+            if (resp.status === 200)
+                return true;
+            if (resp.status === 401 || resp.status === 403)
+                return false;
+            return undefined;
         }
         catch {
-            return false;
+            return undefined;
+        }
+        finally {
+            clear();
         }
     }
+    async checkValid() {
+        return (await this.probeValid()) === true;
+    }
     async ensureValid() {
         if (await this.checkValid())
             return true;