weaver-work-cli 0.1.42 → 0.1.44

package/dist/internal/e10/auth/commands.js

@@ -5,6 +5,7 @@ import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, extractSessionTicket, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
+import { appendXiaoEAuthErrorLog, clearXiaoEAuthErrorLog, getXiaoEAuthErrorLogPath, normalizeXiaoEAuthErrorLogLimit, readXiaoEAuthErrorLog, xiaoEAuthLogSecrets, } from './error-log.js';
 import { XIAOE_AGENT_TYPE, createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, inspectXiaoEUnifiedLoginSources, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
 export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, hasXiaoEUnifiedLoginSource, inspectXiaoEUnifiedLoginSources, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, } from './xiaoe.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
@@ -385,7 +386,7 @@ async function saveEteamsIdLogin(input) {
         version: input.version || '',
     };
 }
-async function tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKeyFallback, profileHint, allowTokenScript = false) {
+async function tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKeyFallback, profileHint, allowTokenScript = false, diagnostics) {
     const login = await tryXiaoEUnifiedSessionLogin({
         env: ctx.env,
         baseUrl,
@@ -394,6 +395,7 @@ async function tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKeyFallback, profileHint
         profileHint,
         allowTokenScript,
         logger: ctx.logger,
+        diagnostics,
     });
     return login?.result || null;
 }
@@ -529,6 +531,15 @@ async function runXiaoELogin(ctx, options) {
     const useXiaoELogin = xiaoESources.any;
     const baseUrl = preferredXiaoEBaseUrl;
     const tenantKey = optionString(commandOpts, 'tenantKey');
+    const diagnostics = {
+        attemptedSteps: [],
+        baseUrl,
+        clientType: xiaoESources.clientType,
+        platformCredentialDetected: xiaoESources.platformCredential,
+    };
+    if (!useXiaoELogin) {
+        diagnostics.attemptedSteps.push('platform_token:missing', 'bundled_env_script:missing', xiaoESources.clientType === 'cloud' ? 'token_script:disabled' : 'token_script:missing', xiaoESources.clientType === 'cloud' ? 'client_session:disabled' : 'client_session:missing', 'environment_map:empty');
+    }
     ctx.logger.info([
         'XiaoE unified login preflight:',
         'authMode=xiaoe',
@@ -542,12 +553,34 @@ async function runXiaoELogin(ctx, options) {
         `baseUrl=${baseUrl || '(unresolved)'}`,
     ].join(' '));
     if (useXiaoELogin) {
-        const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true);
-        if (xiaoEResult)
-            return xiaoEResult;
+        try {
+            const xiaoEResult = await tryXiaoEUnifiedLogin(ctx, baseUrl, tenantKey, profileFromGlobal, true, diagnostics);
+            if (xiaoEResult)
+                return xiaoEResult;
+        }
+        catch (error) {
+            await appendXiaoEAuthErrorLog({
+                source: 'login',
+                profile: profileFromGlobal || getActiveProfile(),
+                baseUrl,
+                diagnostics,
+                error,
+                secrets: xiaoEAuthLogSecrets(ctx.env),
+            }).catch((logError) => ctx.logger.debug(`Could not persist XiaoE auth error log: ${logError instanceof Error ? logError.message : String(logError)}`));
+            throw error;
+        }
     }
     ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-    throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
+    const error = createXiaoEUnifiedLoginUnavailableError(baseUrl);
+    await appendXiaoEAuthErrorLog({
+        source: 'login',
+        profile: profileFromGlobal || getActiveProfile(),
+        baseUrl,
+        diagnostics,
+        error,
+        secrets: xiaoEAuthLogSecrets(ctx.env),
+    }).catch((logError) => ctx.logger.debug(`Could not persist XiaoE auth error log: ${logError instanceof Error ? logError.message : String(logError)}`));
+    throw error;
 }
 async function runBrowserLogin(ctx, options) {
     const commandOpts = asOptions(options);
@@ -768,7 +801,78 @@ function formatWhoami(title, data) {
         'User-Agent: ' + (data.userAgent || ''),
     ].join('\n');
 }
-function registerBrowserLoginCommand(auth, action, name, description) {
+function formatXiaoEAuthErrorLogEntry(entry) {
+    const lines = [
+        `[${entry.timestamp}] ${entry.source} id=${entry.id}`,
+        ...(entry.profile ? [`profile: ${entry.profile}`] : []),
+        ...(entry.baseUrl ? [`baseUrl: ${entry.baseUrl}`] : []),
+        ...(entry.clientType ? [`clientType: ${entry.clientType}`] : []),
+        ...(entry.attemptedSteps.length ? [`attemptedSteps: ${entry.attemptedSteps.join(', ')}`] : []),
+        ...(entry.lastError ? [`lastError: ${entry.lastError}`] : []),
+        ...(entry.resultSessionExpired ? ['resultSessionExpired: true'] : []),
+        ...(entry.error ? [`error: ${entry.error.type}/${entry.error.subtype}: ${entry.error.message}`] : []),
+    ];
+    for (const failure of entry.failures || []) {
+        lines.push([
+            `failure: ${failure.stage}/${failure.kind}`,
+            failure.causeCode ? `causeCode=${failure.causeCode}` : '',
+            failure.httpStatus === undefined ? '' : `httpStatus=${failure.httpStatus}`,
+            failure.message,
+        ].filter(Boolean).join(' '));
+    }
+    return lines.join('\n');
+}
+async function showXiaoEAuthErrorLogs(ctx, options) {
+    const commandOpts = asOptions(options);
+    let limit;
+    try {
+        limit = normalizeXiaoEAuthErrorLogLimit(commandOpts.limit);
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error ? error.message : String(error), ExitCode.UsageError);
+    }
+    const result = await readXiaoEAuthErrorLog(limit);
+    const text = result.entries.length
+        ? [
+            `XiaoE auth error logs (${result.returned}/${result.total}, newest first)`,
+            `logFile: ${result.path}`,
+            ...(result.invalidLines ? [`invalidLines: ${result.invalidLines}`] : []),
+            '',
+            result.entries.map(formatXiaoEAuthErrorLogEntry).join('\n\n'),
+        ].join('\n')
+        : [
+            'No XiaoE auth error logs.',
+            `logFile: ${result.path}`,
+            ...(result.invalidLines ? [`invalidLines: ${result.invalidLines}`] : []),
+        ].join('\n');
+    ctx.output.write(result, { text });
+}
+function registerXiaoEAuthLogCommands(auth, action) {
+    const logs = auth.command('logs')
+        .description('View or clear persisted XiaoE authentication error logs')
+        .option('--limit <n>', 'number of recent entries to show (1-500)', '50')
+        .action(action(showXiaoEAuthErrorLogs));
+    logs.command('show')
+        .description('Show persisted XiaoE authentication error logs')
+        .option('--limit <n>', 'number of recent entries to show (1-500)', '50')
+        .action(action(showXiaoEAuthErrorLogs));
+    logs.command('path')
+        .description('Print the XiaoE authentication error log path')
+        .action(action((ctx) => {
+        const path = getXiaoEAuthErrorLogPath();
+        ctx.output.write({ path }, { text: path });
+    }));
+    logs.command('clear')
+        .description('Clear persisted XiaoE authentication error logs')
+        .action(action(async (ctx) => {
+        const result = await clearXiaoEAuthErrorLog();
+        const text = result.cleared
+            ? `Cleared XiaoE auth error logs.\nlogFile: ${result.path}`
+            : `No XiaoE auth error logs to clear.\nlogFile: ${result.path}`;
+        ctx.output.write(result, { text });
+    }));
+}
+function registerBrowserLoginCommand(auth, action, name, description, machine = false) {
     const command = auth.command(name)
         .description(description)
         .option('--base-url <url>', 'E10 base URL')
@@ -778,8 +882,28 @@ function registerBrowserLoginCommand(auth, action, name, description) {
         .option('--agent-type <value>', 'Alias of --agent_type')
         .option('--agent-return-url <url>', 'Desktop application URL linked by the login success page');
     command.action(action(async (ctx, options) => {
-        const result = await runBrowserLogin(ctx, options);
-        ctx.output.write(result, { text: formatLoginResult(result) });
+        if (!machine) {
+            const result = await runBrowserLogin(ctx, options);
+            ctx.output.write(result, { text: formatLoginResult(result) });
+            return;
+        }
+        // 平台型连接器契约：stdout 只出严格 JSON，进度与授权链接走 stderr。
+        ctx.logger.machineMode = true;
+        try {
+            const result = await runBrowserLogin(ctx, options);
+            ctx.output.raw(JSON.stringify({
+                status: 'authorized',
+                employeeId: result.userId || '',
+                tenantKey: result.tenantKey || '',
+            }));
+        }
+        catch (error) {
+            ctx.output.raw(JSON.stringify({ status: 'unauthorized' }));
+            throw error;
+        }
+        finally {
+            ctx.logger.machineMode = false;
+        }
     }));
 }
 function registerXiaoELoginCommand(auth, action) {
@@ -847,6 +971,35 @@ export function registerE10AuthCommands(parent, action) {
             };
         ctx.output.write(status, { text: formatAuthStatus(status) });
     }));
+    auth.command('show')
+        .description('Platform contract: print login status as {"status":"authorized"|"unauthorized"}')
+        .option('--status', 'print only the strict JSON status object')
+        .option('--no-check', 'skip remote session validity check')
+        .action(action(async (ctx, options) => {
+        const opts = ctx.getGlobalOptions();
+        const commandOpts = asOptions(options);
+        const authFile = findAuthFile(ctx.cwd, opts);
+        const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
+        const profile = opts.profile || getActiveProfile();
+        const expired = session ? session.isExpired() : false;
+        // 三态探活：只有明确失效（401/403）才算未授权，网络异常保持乐观，避免逼用户重复登录。
+        const probe = session && !expired && commandOpts.check !== false
+            ? await session.probeValid()
+            : undefined;
+        const authorized = Boolean(session) && !expired && probe !== false;
+        if (commandOpts.status === true) {
+            ctx.output.raw(JSON.stringify({ status: authorized ? 'authorized' : 'unauthorized' }));
+            return;
+        }
+        ctx.output.write({
+            status: authorized ? 'authorized' : 'unauthorized',
+            loggedIn: Boolean(session),
+            expired,
+            reachable: probe,
+            profile,
+            baseUrl: session ? session.getBaseUrl() : '',
+        }, { json: true });
+    }));
     auth.command('set')
         .description('Save E10 auth from an ETEAMSID cookie')
         .requiredOption('--eteamsid <id>', 'ETEAMSID cookie value')
@@ -882,7 +1035,9 @@ export function registerE10AuthCommands(parent, action) {
     }));
     registerBrowserLoginCommand(auth, action, 'login', 'Open browser OAuth2.0 login and save E10 auth');
     registerBrowserLoginCommand(auth, action, 'oidc', 'Alias of auth login for OAuth2.0 browser login');
+    registerBrowserLoginCommand(auth, action, 'init', 'Platform contract alias of auth login: stdout is strict JSON {"status":"authorized"}', true);
     registerXiaoELoginCommand(auth, action);
+    registerXiaoEAuthLogCommands(auth, action);
     auth.command('logout')
         .alias('clear')
         .description('Clear saved E10 auth for the current or selected profile')

package/dist/internal/e10/auth/error-log.js

@@ -0,0 +1,182 @@
+import { randomUUID } from 'node:crypto';
+import { appendFile, chmod, mkdir, readFile, unlink } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { toErrorEnvelope } from '../../../core/errors.js';
+import { getE10AuthRoot } from './paths.js';
+const XIAOE_AUTH_ERROR_LOG_NAME = 'xiaoe-auth-errors.ndjson';
+const DEFAULT_LOG_LIMIT = 50;
+export const MAX_XIAOE_AUTH_ERROR_LOG_LIMIT = 500;
+/**
+ * The log lives beside the CLI-owned E10 profiles, never beside a caller-owned
+ * `--auth` file. Keeping the target fixed also makes the clear command safe.
+ */
+export function getXiaoEAuthErrorLogPath() {
+    return resolve(getE10AuthRoot(), 'logs', XIAOE_AUTH_ERROR_LOG_NAME);
+}
+export function xiaoEAuthLogSecrets(env) {
+    return Object.entries(env)
+        .filter(([key, value]) => Boolean(value
+        && (key.startsWith('XIAOE_') || key.startsWith('WEAVER_XIAOE_'))
+        && /(?:TOKEN|AUTH|ETEAMSID|COOKIE|SESSION|SECRET|PASSWORD)/iu.test(key)))
+        .map(([, value]) => value);
+}
+function redactSensitiveText(value, secrets = []) {
+    let text = value;
+    for (const secret of secrets) {
+        if (secret && secret.length >= 6)
+            text = text.split(secret).join('<redacted>');
+    }
+    return text
+        // Query strings regularly carry temporary tickets. The path is enough for diagnostics.
+        .replace(/(https?:\/\/[^\s?#]+)\?[^\s#]*/giu, '$1?<redacted>')
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/giu, '$1<redacted>')
+        .replace(/((?:eteamsid|access[_-]?token|refresh[_-]?token|auth(?:orization)?|cookie|session[_-]?id|secret|password)\s*[:=]\s*)(["']?)[^\s,;}"']+/giu, '$1$2<redacted>')
+        .replace(/(["'](?:eteamsid|access[_-]?token|refresh[_-]?token|authorization|cookie|session[_-]?id|secret|password)["']\s*:\s*["'])[^"']*(["'])/giu, '$1<redacted>$2')
+        // Opaque credentials that were not labelled by the producer.
+        .replace(/\b[A-Za-z0-9_-]{48,}\b/gu, '<redacted>');
+}
+function sanitizeBaseUrl(value, secrets) {
+    if (!value)
+        return undefined;
+    try {
+        const url = new URL(value);
+        url.username = '';
+        url.password = '';
+        url.search = '';
+        url.hash = '';
+        return redactSensitiveText(url.toString().replace(/\/$/u, ''), secrets);
+    }
+    catch {
+        return redactSensitiveText(value, secrets);
+    }
+}
+function sanitizeFailure(failure, secrets) {
+    return {
+        stage: failure.stage,
+        kind: failure.kind,
+        message: redactSensitiveText(failure.message, secrets),
+        ...(failure.causeCode ? { causeCode: redactSensitiveText(failure.causeCode, secrets) } : {}),
+        ...(failure.httpStatus === undefined ? {} : { httpStatus: failure.httpStatus }),
+    };
+}
+function sanitizeError(error, secrets) {
+    if (error === undefined)
+        return undefined;
+    const envelope = toErrorEnvelope(error);
+    return {
+        ...envelope,
+        message: redactSensitiveText(envelope.message, secrets),
+        // Error details can contain arbitrary server payloads. The normalized
+        // diagnostics fields above are the only details persisted to disk.
+        ...(envelope.details === undefined ? {} : { details: '<omitted from persistent auth log>' }),
+    };
+}
+function createEntry(input) {
+    const secrets = input.secrets || [];
+    const diagnostics = input.diagnostics;
+    const baseUrl = sanitizeBaseUrl(input.baseUrl || diagnostics?.baseUrl, secrets);
+    const lastError = diagnostics?.lastError
+        ? redactSensitiveText(diagnostics.lastError, secrets)
+        : undefined;
+    const failures = diagnostics?.failures?.map((failure) => sanitizeFailure(failure, secrets));
+    const error = sanitizeError(input.error, secrets);
+    return {
+        schemaVersion: 1,
+        id: randomUUID(),
+        timestamp: new Date().toISOString(),
+        source: input.source,
+        ...(input.profile ? { profile: redactSensitiveText(input.profile, secrets) } : {}),
+        ...(baseUrl ? { baseUrl } : {}),
+        ...(diagnostics?.clientType ? { clientType: diagnostics.clientType } : {}),
+        ...(diagnostics?.platformCredentialDetected === undefined
+            ? {}
+            : { platformCredentialDetected: diagnostics.platformCredentialDetected }),
+        attemptedSteps: (diagnostics?.attemptedSteps || []).map((step) => redactSensitiveText(step, secrets)),
+        ...(lastError ? { lastError } : {}),
+        ...(failures?.length ? { failures } : {}),
+        ...(input.resultSessionExpired ? { resultSessionExpired: true } : {}),
+        ...(error ? { error } : {}),
+    };
+}
+/**
+ * Append-only persistence keeps concurrent CLI processes from overwriting one
+ * another. A logging failure is returned to the caller and must never replace
+ * the original authentication error.
+ */
+export async function appendXiaoEAuthErrorLog(input) {
+    const path = getXiaoEAuthErrorLogPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await chmod(dirname(path), 0o700).catch(() => undefined);
+    const entry = createEntry(input);
+    await appendFile(path, `${JSON.stringify(entry)}\n`, { encoding: 'utf8', mode: 0o600 });
+    // Existing files may have been created under a permissive umask.
+    await chmod(path, 0o600).catch(() => undefined);
+    return entry;
+}
+function isLogEntry(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return candidate.schemaVersion === 1
+        && typeof candidate.id === 'string'
+        && typeof candidate.timestamp === 'string'
+        && (candidate.source === 'login' || candidate.source === 'recovery')
+        && Array.isArray(candidate.attemptedSteps);
+}
+export function normalizeXiaoEAuthErrorLogLimit(value) {
+    if (value === undefined || value === null || value === '')
+        return DEFAULT_LOG_LIMIT;
+    const limit = Number(value);
+    if (!Number.isInteger(limit) || limit < 1 || limit > MAX_XIAOE_AUTH_ERROR_LOG_LIMIT) {
+        throw new RangeError(`limit must be an integer between 1 and ${MAX_XIAOE_AUTH_ERROR_LOG_LIMIT}`);
+    }
+    return limit;
+}
+export async function readXiaoEAuthErrorLog(limit = DEFAULT_LOG_LIMIT) {
+    const normalizedLimit = normalizeXiaoEAuthErrorLogLimit(limit);
+    const path = getXiaoEAuthErrorLogPath();
+    let content = '';
+    try {
+        content = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (error?.code !== 'ENOENT')
+            throw error;
+    }
+    let invalidLines = 0;
+    const entries = [];
+    for (const line of content.split(/\r?\n/u)) {
+        if (!line.trim())
+            continue;
+        try {
+            const value = JSON.parse(line);
+            if (isLogEntry(value))
+                entries.push(value);
+            else
+                invalidLines += 1;
+        }
+        catch {
+            invalidLines += 1;
+        }
+    }
+    const recent = entries.slice(-normalizedLimit).reverse();
+    return {
+        path,
+        total: entries.length,
+        returned: recent.length,
+        invalidLines,
+        entries: recent,
+    };
+}
+export async function clearXiaoEAuthErrorLog() {
+    const path = getXiaoEAuthErrorLogPath();
+    try {
+        await unlink(path);
+        return { path, cleared: true };
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return { path, cleared: false };
+        throw error;
+    }
+}

package/dist/internal/e10/auth/session.js

@@ -478,7 +478,14 @@ export class E10AuthSession {
             clear();
         }
     }
-    async checkValid() {
+    /**
+     * 三态探活：`true` 明确有效、`false` 明确失效（401/403）、`undefined` 无法判定（网络/5xx）。
+     *
+     * 为什么要和 `checkValid()` 分开：平台连接器判断"是否已登录"时，
+     * 把网络抖动当成"未登录"会逼用户重复登录；而把 401 当成"已登录"会让后续业务全失败。
+     * 未认定失效时保持乐观，明确失效才降级。
+     */
+    async probeValid() {
         const { signal, clear } = createTimeoutSignal(E10_TEAMS_CHECK_TIMEOUT_MS);
         try {
             const resp = await fetch(`${this.getBaseUrl()}/api/ecode/tree/list?parentId=0`, {
@@ -491,15 +498,22 @@ export class E10AuthSession {
                 redirect: 'manual',
                 signal,
             });
-            return resp.status === 200;
+            if (resp.status === 200)
+                return true;
+            if (resp.status === 401 || resp.status === 403)
+                return false;
+            return undefined;
         }
         catch {
-            return false;
+            return undefined;
         }
         finally {
             clear();
         }
     }
+    async checkValid() {
+        return (await this.probeValid()) === true;
+    }
     async ensureValid() {
         if (await this.checkValid())
             return true;

package/dist/internal/e10/auth-recovery.js

@@ -1,5 +1,6 @@
 import { isXiaoERuntimeAgent } from '../../core/runtime-agent.js';
 import { getActiveProfile, readProfileConfig } from './auth/session.js';
+import { appendXiaoEAuthErrorLog, xiaoEAuthLogSecrets } from './auth/error-log.js';
 import { hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin, } from './auth/xiaoe.js';
 const AUTH_REQUIRED_CODES = new Set(['-2', '401']);
 const AUTH_REQUIRED_MARKERS = [
@@ -242,6 +243,10 @@ function recoveryLogger(ctx) {
         warn: (message) => adapter.debug(message),
     };
 }
+function reportAuthLogWriteFailure(ctx, error) {
+    const logger = ctx.logger;
+    logger?.debug?.(`Could not persist XiaoE auth error log: ${error instanceof Error ? error.message : String(error)}`);
+}
 /**
  * Silently recover a stale or missing XiaoE session. Without a local session,
  * current runtime evidence is required before obtaining credentials.
@@ -278,18 +283,40 @@ export async function recoverXiaoEAuthSessionWithDiagnostics(ctx, currentSession
         return existing;
     const diagnostics = { attemptedSteps: [] };
     const recovery = (async () => {
-        const login = await tryXiaoEUnifiedLogin({
-            env: ctx.env,
-            baseUrl,
-            profileBaseUrl: baseUrl,
-            allowBundledEnvScript: true,
-            allowTokenScript: true,
-            tenantKeyFallback: currentSession?.tenantKey || config.tenantKey,
-            profileHint: profile,
-            diagnostics,
-            logger: recoveryLogger(ctx),
-        });
-        return { session: login?.session || null, diagnostics };
+        try {
+            const login = await tryXiaoEUnifiedLogin({
+                env: ctx.env,
+                baseUrl,
+                profileBaseUrl: baseUrl,
+                allowBundledEnvScript: true,
+                allowTokenScript: true,
+                tenantKeyFallback: currentSession?.tenantKey || config.tenantKey,
+                profileHint: profile,
+                diagnostics,
+                logger: recoveryLogger(ctx),
+            });
+            if (!login) {
+                await appendXiaoEAuthErrorLog({
+                    source: 'recovery',
+                    profile,
+                    baseUrl,
+                    diagnostics,
+                    secrets: xiaoEAuthLogSecrets(ctx.env),
+                }).catch((error) => reportAuthLogWriteFailure(ctx, error));
+            }
+            return { session: login?.session || null, diagnostics };
+        }
+        catch (error) {
+            await appendXiaoEAuthErrorLog({
+                source: 'recovery',
+                profile,
+                baseUrl,
+                diagnostics,
+                error,
+                secrets: xiaoEAuthLogSecrets(ctx.env),
+            }).catch((logError) => reportAuthLogWriteFailure(ctx, logError));
+            throw error;
+        }
     })();
     recoveryInFlight.set(key, recovery);
     try {

package/dist/internal/e10/context.js

@@ -1,7 +1,8 @@
 import { CliError, ExitCode } from '../../core/errors.js';
 import { E10_AUTH_REQUIRED_MESSAGE, E10_XIAOE_HOST_CREDENTIAL_MISSING_MESSAGE, E10_XIAOE_NETWORK_UNAVAILABLE_MESSAGE, E10_XIAOE_RECOVERY_FAILED_MESSAGE, } from './auth/messages.js';
 import { lastXiaoEFailure, summarizeXiaoEFailureKind, } from './auth/xiaoe.js';
-import { E10AuthSession } from './auth/session.js';
+import { appendXiaoEAuthErrorLog, xiaoEAuthLogSecrets } from './auth/error-log.js';
+import { E10AuthSession, getActiveProfile } from './auth/session.js';
 import { E10ApiClient } from './client.js';
 import { canAutomaticallyRecoverXiaoE, recoverXiaoEAuthSession, recoverXiaoEAuthSessionWithDiagnostics, } from './auth-recovery.js';
 /**
@@ -57,12 +58,26 @@ export async function getE10Session(ctx, load = {}) {
     return E10AuthSession.fromOptions(options, ctx.cwd, load);
 }
 export async function requireE10Session(ctx, load = {}) {
+    const options = ctx.getGlobalOptions();
     let session = await getE10Session(ctx, load);
     if (session?.isExpired() && canAutomaticallyRecoverXiaoE(ctx, session)) {
         const outcome = await recoverXiaoEAuthSessionWithDiagnostics(ctx, session).catch(() => null);
         session = outcome?.session || null;
         if (!session || session.isExpired()) {
-            throw xiaoERecoveryFailedError(outcome?.diagnostics, session?.isExpired() === true);
+            const resultSessionExpired = session?.isExpired() === true;
+            const error = xiaoERecoveryFailedError(outcome?.diagnostics, resultSessionExpired);
+            if (resultSessionExpired) {
+                await appendXiaoEAuthErrorLog({
+                    source: 'recovery',
+                    profile: options.profile || getActiveProfile(),
+                    baseUrl: session?.getBaseUrl(),
+                    diagnostics: outcome?.diagnostics,
+                    resultSessionExpired: true,
+                    error,
+                    secrets: xiaoEAuthLogSecrets(ctx.env),
+                }).catch(() => undefined);
+            }
+            throw error;
         }
     }
     if (!session && canAutomaticallyRecoverXiaoE(ctx)) {

package/dist/internal/skills/install.js

@@ -272,6 +272,14 @@ function writeProductMetadata(target, productContent) {
         return;
     writeFileSync(resolve(target, 'product.json'), productContent, 'utf8');
 }
+/**
+ * 拷贝白名单：整目录复制，只剔除本地依赖与系统垃圾。
+ *
+ * 历史实现把 `scripts/` 与 `assets/` 一并排除，导致带资产的技能装出来是残缺的——
+ * reception 缺 `scripts/render.py` 与 `assets/行程单模板-泛微.docx` 会直接跑不出 docx，
+ * builder 缺 `assets/dom-structure/` 也少一半能力。
+ * 技能包是受控的内部产物，资产就应当随包分发，因此只保留 node_modules 这一条硬排除。
+ */
 function shouldCopy(entry, sourceRoot, skipSkillProduct) {
     const relativePath = relative(sourceRoot, entry);
     const name = basename(entry);
@@ -282,7 +290,7 @@ function shouldCopy(entry, sourceRoot, skipSkillProduct) {
     if (name === '.DS_Store' || name.startsWith('.'))
         return false;
     const parts = relativePath.split(sep);
-    return !parts.includes('node_modules') && !parts.includes('scripts') && !parts.includes('assets');
+    return !parts.includes('node_modules');
 }
 function countFiles(root) {
     let count = 0;

package/dist/shortcuts/archive/continuation.js

@@ -1,3 +1,4 @@
+import { CONTINUATION_TTL_MS } from '../../core/continuation-ttl.js';
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
@@ -35,7 +36,7 @@ function signature(payload, key) {
 }
 export function createArchiveContinuationSigner(ctx) {
     return {
-        async issue(payload, ttlMs = 10 * 60_000) {
+        async issue(payload, ttlMs = CONTINUATION_TTL_MS) {
             const issuedAt = Date.now();
             const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
             const sig = signature(body, await loadKey(ctx));

package/dist/shortcuts/archive/index.js

@@ -1,6 +1,7 @@
 import { readFile, writeFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { ExitCode, isCliError, toErrorEnvelope } from '../../core/errors.js';
+import { reportPlatformError } from '../../core/error-codes.js';
 import { formatSearchCard, formatSearchHtml, formatSearchText } from './render/search-format.js';
 import { createArchiveContinuationSigner } from './continuation.js';
 import { createArchiveHost } from './host.js';
@@ -99,6 +100,7 @@ async function executeAndPrint(ctx, operation, input) {
         ctx.output.write(successEnvelope(result), { json: true });
     }
     catch (error) {
+        reportPlatformError(error);
         console.error(JSON.stringify(failureEnvelope(error), null, 2));
         process.exitCode = isCliError(error) ? error.exitCode : ExitCode.GeneralError;
     }
@@ -140,6 +142,7 @@ async function executeSearchPrint(ctx, input, format, outputPath) {
         ctx.output.raw(formatSearchText(rows, meta));
     }
     catch (error) {
+        reportPlatformError(error);
         console.error(JSON.stringify(failureEnvelope(error), null, 2));
         process.exitCode = isCliError(error) ? error.exitCode : ExitCode.GeneralError;
     }

package/dist/shortcuts/archive/operations/confirm.js

@@ -1,3 +1,4 @@
+import { CONTINUATION_TTL_MS } from '../../../core/continuation-ttl.js';
 import { archiveConfirmationError, archiveValidationError } from '../errors.js';
 /** apply 类写操作必须显式确认。 */
 export function requireConfirm(args, action) {
@@ -11,7 +12,7 @@ export function requireConfirm(args, action) {
  * prepare 阶段签发 continuation。
  * 环境指纹（baseUrl + 登录账号）写进票据，apply 时校验，避免跨环境/跨账号复用。
  */
-export async function issueLease(env, action, payload, ttlMs = 10 * 60_000) {
+export async function issueLease(env, action, payload, ttlMs = CONTINUATION_TTL_MS) {
     const session = await env.host.getSession();
     const continuation = await env.continuation.issue({
         operation: action,

package/dist/shortcuts/archive-oa/continuation.js

@@ -1,3 +1,4 @@
+import { CONTINUATION_TTL_MS } from '../../core/continuation-ttl.js';
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
@@ -35,7 +36,7 @@ function signature(payload, key) {
 }
 export function createArchiveOaContinuationSigner(ctx) {
     return {
-        async issue(payload, ttlMs = 10 * 60_000) {
+        async issue(payload, ttlMs = CONTINUATION_TTL_MS) {
             const issuedAt = Date.now();
             const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
             const sig = signature(body, await loadKey(ctx));