weaver-work-cli 0.1.40 → 0.1.44

package/dist/chunks/{chunk-7E6MUOEK.js → chunk-CWYGFU5B.js}

@@ -2,13 +2,13 @@ import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
   meetingStateDir
-} from "./chunk-NJKREDA3.js";
+} from "./chunk-GAMZLAG2.js";
 import {
   SCHEMA_ID,
   meetingSuccess,
   meetingValidationError,
   schemaOf
-} from "./chunk-7BRU4EFH.js";
+} from "./chunk-QVSWRLLU.js";
 
 // src/shortcuts/meeting/operations/attachment-content.ts
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/chunks/{chunk-NOODWMCL.js → chunk-D4ADSZ7H.js}

@@ -2,7 +2,7 @@ import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
   hrmValidationError
-} from "./chunk-OOUTBLZ4.js";
+} from "./chunk-56EZERK4.js";
 
 // src/shortcuts/hrm/operations/types.ts
 var READ = "read";

package/dist/chunks/{chunk-WFFNM65B.js → chunk-ETNJSKMM.js}

@@ -3,18 +3,173 @@ const require = __esbuildCreateRequire(import.meta.url);
 import {
   E10AuthSession,
   E10_AUTH_REQUIRED_MESSAGE,
+  E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE,
+  E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE,
   E10_XIAOE_RECOVERY_FAILED_MESSAGE,
   getActiveProfile,
+  getE10AuthRoot,
   hasXiaoEEnv,
   isXiaoERuntimeAgent,
+  lastXiaoEFailure,
+  readErrorCauseCode,
   readProfileConfig,
   resolveXiaoEPreferredBaseUrl,
   startFetchTiming,
+  summarizeXiaoEFailureKind,
   tryXiaoEUnifiedLogin
-} from "./chunk-4TEDNCON.js";
+} from "./chunk-UFIT2UU3.js";
 import {
-  CliError
-} from "./chunk-LUSPKZKY.js";
+  CliError,
+  toErrorEnvelope
+} from "./chunk-UG5G54VL.js";
+
+// src/internal/e10/auth/error-log.ts
+import { randomUUID } from "node:crypto";
+import { appendFile, chmod, mkdir, readFile, unlink } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+var XIAOE_AUTH_ERROR_LOG_NAME = "xiaoe-auth-errors.ndjson";
+var DEFAULT_LOG_LIMIT = 50;
+var MAX_XIAOE_AUTH_ERROR_LOG_LIMIT = 500;
+function getXiaoEAuthErrorLogPath() {
+  return resolve(getE10AuthRoot(), "logs", XIAOE_AUTH_ERROR_LOG_NAME);
+}
+function xiaoEAuthLogSecrets(env) {
+  return Object.entries(env).filter(([key, value]) => Boolean(
+    value && (key.startsWith("XIAOE_") || key.startsWith("WEAVER_XIAOE_")) && /(?:TOKEN|AUTH|ETEAMSID|COOKIE|SESSION|SECRET|PASSWORD)/iu.test(key)
+  )).map(([, value]) => value);
+}
+function redactSensitiveText(value, secrets = []) {
+  let text = value;
+  for (const secret of secrets) {
+    if (secret && secret.length >= 6) text = text.split(secret).join("<redacted>");
+  }
+  return text.replace(/(https?:\/\/[^\s?#]+)\?[^\s#]*/giu, "$1?<redacted>").replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/giu, "$1<redacted>").replace(
+    /((?:eteamsid|access[_-]?token|refresh[_-]?token|auth(?:orization)?|cookie|session[_-]?id|secret|password)\s*[:=]\s*)(["']?)[^\s,;}"']+/giu,
+    "$1$2<redacted>"
+  ).replace(
+    /(["'](?:eteamsid|access[_-]?token|refresh[_-]?token|authorization|cookie|session[_-]?id|secret|password)["']\s*:\s*["'])[^"']*(["'])/giu,
+    "$1<redacted>$2"
+  ).replace(/\b[A-Za-z0-9_-]{48,}\b/gu, "<redacted>");
+}
+function sanitizeBaseUrl(value, secrets) {
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return redactSensitiveText(url.toString().replace(/\/$/u, ""), secrets);
+  } catch {
+    return redactSensitiveText(value, secrets);
+  }
+}
+function sanitizeFailure(failure, secrets) {
+  return {
+    stage: failure.stage,
+    kind: failure.kind,
+    message: redactSensitiveText(failure.message, secrets),
+    ...failure.causeCode ? { causeCode: redactSensitiveText(failure.causeCode, secrets) } : {},
+    ...failure.httpStatus === void 0 ? {} : { httpStatus: failure.httpStatus }
+  };
+}
+function sanitizeError(error, secrets) {
+  if (error === void 0) return void 0;
+  const envelope = toErrorEnvelope(error);
+  return {
+    ...envelope,
+    message: redactSensitiveText(envelope.message, secrets),
+    // Error details can contain arbitrary server payloads. The normalized
+    // diagnostics fields above are the only details persisted to disk.
+    ...envelope.details === void 0 ? {} : { details: "<omitted from persistent auth log>" }
+  };
+}
+function createEntry(input) {
+  const secrets = input.secrets || [];
+  const diagnostics = input.diagnostics;
+  const baseUrl = sanitizeBaseUrl(input.baseUrl || diagnostics?.baseUrl, secrets);
+  const lastError = diagnostics?.lastError ? redactSensitiveText(diagnostics.lastError, secrets) : void 0;
+  const failures = diagnostics?.failures?.map((failure) => sanitizeFailure(failure, secrets));
+  const error = sanitizeError(input.error, secrets);
+  return {
+    schemaVersion: 1,
+    id: randomUUID(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    source: input.source,
+    ...input.profile ? { profile: redactSensitiveText(input.profile, secrets) } : {},
+    ...baseUrl ? { baseUrl } : {},
+    ...diagnostics?.clientType ? { clientType: diagnostics.clientType } : {},
+    ...diagnostics?.platformCredentialDetected === void 0 ? {} : { platformCredentialDetected: diagnostics.platformCredentialDetected },
+    attemptedSteps: (diagnostics?.attemptedSteps || []).map((step) => redactSensitiveText(step, secrets)),
+    ...lastError ? { lastError } : {},
+    ...failures?.length ? { failures } : {},
+    ...input.resultSessionExpired ? { resultSessionExpired: true } : {},
+    ...error ? { error } : {}
+  };
+}
+async function appendXiaoEAuthErrorLog(input) {
+  const path = getXiaoEAuthErrorLogPath();
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await chmod(dirname(path), 448).catch(() => void 0);
+  const entry = createEntry(input);
+  await appendFile(path, `${JSON.stringify(entry)}
+`, { encoding: "utf8", mode: 384 });
+  await chmod(path, 384).catch(() => void 0);
+  return entry;
+}
+function isLogEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value;
+  return candidate.schemaVersion === 1 && typeof candidate.id === "string" && typeof candidate.timestamp === "string" && (candidate.source === "login" || candidate.source === "recovery") && Array.isArray(candidate.attemptedSteps);
+}
+function normalizeXiaoEAuthErrorLogLimit(value) {
+  if (value === void 0 || value === null || value === "") return DEFAULT_LOG_LIMIT;
+  const limit = Number(value);
+  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_XIAOE_AUTH_ERROR_LOG_LIMIT) {
+    throw new RangeError(`limit must be an integer between 1 and ${MAX_XIAOE_AUTH_ERROR_LOG_LIMIT}`);
+  }
+  return limit;
+}
+async function readXiaoEAuthErrorLog(limit = DEFAULT_LOG_LIMIT) {
+  const normalizedLimit = normalizeXiaoEAuthErrorLogLimit(limit);
+  const path = getXiaoEAuthErrorLogPath();
+  let content = "";
+  try {
+    content = await readFile(path, "utf8");
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  let invalidLines = 0;
+  const entries = [];
+  for (const line of content.split(/\r?\n/u)) {
+    if (!line.trim()) continue;
+    try {
+      const value = JSON.parse(line);
+      if (isLogEntry(value)) entries.push(value);
+      else invalidLines += 1;
+    } catch {
+      invalidLines += 1;
+    }
+  }
+  const recent = entries.slice(-normalizedLimit).reverse();
+  return {
+    path,
+    total: entries.length,
+    returned: recent.length,
+    invalidLines,
+    entries: recent
+  };
+}
+async function clearXiaoEAuthErrorLog() {
+  const path = getXiaoEAuthErrorLogPath();
+  try {
+    await unlink(path);
+    return { path, cleared: true };
+  } catch (error) {
+    if (error?.code === "ENOENT") return { path, cleared: false };
+    throw error;
+  }
+}
 
 // src/internal/e10/auth-recovery.ts
 var AUTH_REQUIRED_CODES = /* @__PURE__ */ new Set(["-2", "401"]);
@@ -165,8 +320,31 @@ function canAutomaticallyRecoverXiaoE(ctx, currentSession) {
   if (options.auth) return false;
   return hasXiaoEEnv(ctx.env || process.env, options) || currentSession?.loginSource === "xiaoe-unified" || isXiaoERuntimeAgent(currentSession?.agentType);
 }
+function recoveryLogger(ctx) {
+  const options = globalOptions(ctx);
+  if (options.json || options.quiet || options.verbose !== true) return void 0;
+  const adapter = ctx.logger;
+  if (!adapter || typeof adapter.debug !== "function") return void 0;
+  return {
+    info: (message) => adapter.debug(message),
+    warn: (message) => adapter.debug(message)
+  };
+}
+function reportAuthLogWriteFailure(ctx, error) {
+  const logger = ctx.logger;
+  logger?.debug?.(
+    `Could not persist XiaoE auth error log: ${error instanceof Error ? error.message : String(error)}`
+  );
+}
 async function recoverXiaoEAuthSession(ctx, currentSession) {
-  if (!canAutomaticallyRecoverXiaoE(ctx, currentSession)) return null;
+  return (await recoverXiaoEAuthSessionWithDiagnostics(ctx, currentSession)).session;
+}
+async function recoverXiaoEAuthSessionWithDiagnostics(ctx, currentSession) {
+  const emptyOutcome = () => ({
+    session: null,
+    diagnostics: { attemptedSteps: [] }
+  });
+  if (!canAutomaticallyRecoverXiaoE(ctx, currentSession)) return emptyOutcome();
   const options = globalOptions(ctx);
   const profile = options.profile || getActiveProfile();
   const config = readProfileConfig(profile);
@@ -179,19 +357,41 @@ async function recoverXiaoEAuthSession(ctx, currentSession) {
 ${baseUrl}`;
   const existing = recoveryInFlight.get(key);
   if (existing) return existing;
+  const diagnostics = { attemptedSteps: [] };
   const recovery = (async () => {
-    const login = await tryXiaoEUnifiedLogin({
-      env: ctx.env,
-      baseUrl,
-      profileBaseUrl: baseUrl,
-      allowBundledEnvScript: true,
-      allowTokenScript: true,
-      tenantKeyFallback: currentSession?.tenantKey || config.tenantKey,
-      profileHint: profile
-      // Intentionally no logger: transparent recovery must not leak an
-      // intermediate "login" step into agent stdout/stderr or JSON output.
-    });
-    return login?.session || null;
+    try {
+      const login = await tryXiaoEUnifiedLogin({
+        env: ctx.env,
+        baseUrl,
+        profileBaseUrl: baseUrl,
+        allowBundledEnvScript: true,
+        allowTokenScript: true,
+        tenantKeyFallback: currentSession?.tenantKey || config.tenantKey,
+        profileHint: profile,
+        diagnostics,
+        logger: recoveryLogger(ctx)
+      });
+      if (!login) {
+        await appendXiaoEAuthErrorLog({
+          source: "recovery",
+          profile,
+          baseUrl,
+          diagnostics,
+          secrets: xiaoEAuthLogSecrets(ctx.env)
+        }).catch((error) => reportAuthLogWriteFailure(ctx, error));
+      }
+      return { session: login?.session || null, diagnostics };
+    } catch (error) {
+      await appendXiaoEAuthErrorLog({
+        source: "recovery",
+        profile,
+        baseUrl,
+        diagnostics,
+        error,
+        secrets: xiaoEAuthLogSecrets(ctx.env)
+      }).catch((logError) => reportAuthLogWriteFailure(ctx, logError));
+      throw error;
+    }
   })();
   recoveryInFlight.set(key, recovery);
   try {
@@ -208,28 +408,70 @@ function sameE10SessionIdentity(current, recovered) {
 }
 
 // src/internal/e10/context.ts
-function xiaoERecoveryFailedError() {
-  return Object.assign(new CliError(E10_XIAOE_RECOVERY_FAILED_MESSAGE, 3 /* AuthError */), {
-    type: "authentication",
-    subtype: "xiaoe_credential_unavailable",
-    retryable: false,
-    stage: "xiaoe_unified_login"
-  });
+function xiaoERecoveryFailedError(diagnostics, resultSessionExpired = false) {
+  const failureKind = summarizeXiaoEFailureKind(diagnostics);
+  const lastFailure = lastXiaoEFailure(diagnostics);
+  const networkUnavailable = failureKind === "network";
+  const hostCredentialMissing = diagnostics?.clientType === "cloud" && diagnostics.platformCredentialDetected === false && diagnostics.attemptedSteps.includes("platform_token:missing") && diagnostics.attemptedSteps.includes("environment_map:empty");
+  const details = diagnostics ? {
+    ...diagnostics.baseUrl ? { baseUrl: diagnostics.baseUrl } : {},
+    ...diagnostics.clientType ? { clientType: diagnostics.clientType } : {},
+    ...diagnostics.platformCredentialDetected === void 0 ? {} : { platformCredentialDetected: diagnostics.platformCredentialDetected },
+    attemptedSteps: diagnostics.attemptedSteps,
+    ...diagnostics.lastError ? { lastError: diagnostics.lastError } : {},
+    ...failureKind ? { errorKind: failureKind } : {},
+    ...lastFailure ? { failureStage: lastFailure.stage } : {},
+    ...diagnostics.failures?.length ? { failures: diagnostics.failures } : {},
+    ...hostCredentialMissing ? { reason: "host_credential_not_injected" } : {},
+    ...resultSessionExpired ? { resultSessionExpired: true } : {}
+  } : void 0;
+  return Object.assign(
+    new CliError(
+      networkUnavailable ? E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE : hostCredentialMissing ? E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE : E10_XIAOE_RECOVERY_FAILED_MESSAGE,
+      3 /* AuthError */
+    ),
+    {
+      type: "authentication",
+      subtype: networkUnavailable ? "xiaoe_network_unavailable" : "xiaoe_credential_unavailable",
+      // 网络错误是可重试的；凭证缺失/被拒重试也一样失败，不能让调用方空转。
+      retryable: networkUnavailable,
+      stage: lastFailure?.stage || "xiaoe_unified_login",
+      ...details ? { details } : {}
+    }
+  );
 }
 async function getE10Session(ctx, load = {}) {
   const options = ctx.getGlobalOptions();
   return E10AuthSession.fromOptions(options, ctx.cwd, load);
 }
 async function requireE10Session(ctx, load = {}) {
+  const options = ctx.getGlobalOptions();
   let session = await getE10Session(ctx, load);
   if (session?.isExpired() && canAutomaticallyRecoverXiaoE(ctx, session)) {
-    session = await recoverXiaoEAuthSession(ctx, session).catch(() => null);
-    if (!session || session.isExpired()) throw xiaoERecoveryFailedError();
+    const outcome = await recoverXiaoEAuthSessionWithDiagnostics(ctx, session).catch(() => null);
+    session = outcome?.session || null;
+    if (!session || session.isExpired()) {
+      const resultSessionExpired = session?.isExpired() === true;
+      const error = xiaoERecoveryFailedError(outcome?.diagnostics, resultSessionExpired);
+      if (resultSessionExpired) {
+        await appendXiaoEAuthErrorLog({
+          source: "recovery",
+          profile: options.profile || getActiveProfile(),
+          baseUrl: session?.getBaseUrl(),
+          diagnostics: outcome?.diagnostics,
+          resultSessionExpired: true,
+          error,
+          secrets: xiaoEAuthLogSecrets(ctx.env)
+        }).catch(() => void 0);
+      }
+      throw error;
+    }
   }
   if (!session && canAutomaticallyRecoverXiaoE(ctx)) {
-    session = await recoverXiaoEAuthSession(ctx).catch(() => null);
+    const outcome = await recoverXiaoEAuthSessionWithDiagnostics(ctx).catch(() => null);
+    session = outcome?.session || null;
     if (!session) {
-      throw xiaoERecoveryFailedError();
+      throw xiaoERecoveryFailedError(outcome?.diagnostics);
     }
   }
   if (!session) {
@@ -540,13 +782,16 @@ var E10RequestRuntime = class {
       if (error instanceof Error && error.name === "AbortError") {
         throw new E10ApiError("network", "timeout", `\u8BF7\u6C42\u8D85\u65F6\uFF08${timeoutMs}ms\uFF09`, {
           retryable: false,
-          exitCode: 4 /* NetworkError */
+          exitCode: 4 /* NetworkError */,
+          details: { timeoutMs }
         });
       }
       const message = error instanceof Error ? error.message : String(error);
+      const causeCode = readErrorCauseCode(error);
       throw new E10ApiError("network", "transport", `\u8BF7\u6C42\u5931\u8D25\uFF1A${message}`, {
         retryable: true,
-        exitCode: 4 /* NetworkError */
+        exitCode: 4 /* NetworkError */,
+        ...causeCode ? { details: { causeCode } } : {}
       });
     } finally {
       clearTimeout(timer);
@@ -706,8 +951,15 @@ function cloneForHook(value) {
 }
 
 export {
+  getXiaoEAuthErrorLogPath,
+  xiaoEAuthLogSecrets,
+  appendXiaoEAuthErrorLog,
+  normalizeXiaoEAuthErrorLogLimit,
+  readXiaoEAuthErrorLog,
+  clearXiaoEAuthErrorLog,
   isE10SessionExpiredResponse,
   isE10AuthenticationRequired,
+  getE10Session,
   requireE10Session,
   E10ApiError,
   createE10RequestRuntime

package/dist/chunks/{chunk-CAQNBBQA.js → chunk-F4E4EM35.js}

@@ -8,17 +8,17 @@ import {
   esbPermissionError,
   esbValidationError,
   esbWriteUncertain
-} from "./chunk-GPMFD4RD.js";
+} from "./chunk-TXUG266F.js";
 import {
   E10ApiError,
   createE10RequestRuntime,
   isE10SessionExpiredResponse,
   requireE10Session
-} from "./chunk-WFFNM65B.js";
+} from "./chunk-ETNJSKMM.js";
 import {
   E10_SESSION_EXPIRED_MESSAGE,
   getActiveProfile
-} from "./chunk-4TEDNCON.js";
+} from "./chunk-UFIT2UU3.js";
 
 // src/shortcuts/esb/host.ts
 var ESB_PATHS = {

package/dist/chunks/{chunk-4CTESSKI.js → chunk-FAZTGX7S.js}

@@ -3,13 +3,13 @@ const require = __esbuildCreateRequire(import.meta.url);
 import {
   readCache,
   writeCache
-} from "./chunk-I566ZYNF.js";
+} from "./chunk-Z7VYWPZV.js";
 import {
   SCHEMA_DATETIME_MINUTE,
   meetingSuccess,
   meetingValidationError,
   schemaOf
-} from "./chunk-7BRU4EFH.js";
+} from "./chunk-QVSWRLLU.js";
 
 // src/shortcuts/meeting/operations/eb/schedule.ts
 var SCHEDULE_TYPE_PATH = "/api/ebuilder/form/formdata/v2/getFormDataList/queryAgendaType";
@@ -110,9 +110,9 @@ async function runScheduleConflictFlow(env, input) {
   if (!employeeId) {
     throw meetingValidationError("schedule_employee_required", "\u53D6\u4E0D\u5230\u5F53\u524D\u767B\u5F55\u7528\u6237 id\uFF0C\u65E0\u6CD5\u89E6\u53D1 ESB \u65E5\u7A0B\u67E5\u8BE2");
   }
-  const { createEsbHost } = await import("./host-256GVCAH.js");
-  const { createEsbContinuationSigner } = await import("./continuation-NLECEJPX.js");
-  const { getEsbOperation } = await import("./registry-RXPN6BBT.js");
+  const { createEsbHost } = await import("./host-WIKN2EJ5.js");
+  const { createEsbContinuationSigner } = await import("./continuation-KI7DRRZN.js");
+  const { getEsbOperation } = await import("./registry-KNKSCJNT.js");
   const esbEnv = {
     ctx: env.ctx,
     host: createEsbHost(env.ctx),
@@ -331,7 +331,7 @@ async function resolveMemberIdsByName(env, names) {
   const unique = [...new Set(names)].filter((name) => name !== "");
   if (unique.length === 0) return map;
   try {
-    const { hrmEmployeeOperations } = await import("./employee-SAK2QYXX.js");
+    const { hrmEmployeeOperations } = await import("./employee-22BGJ3QS.js");
     const query = hrmEmployeeOperations.find((operation) => operation.name === "hrm.employee.query");
     if (!query) return map;
     for (const name of unique) {