weaver-work-cli 0.1.42 → 0.1.44

package/dist/chunks/chunk-XHK4MDR5.js

@@ -0,0 +1,2497 @@
+import { createRequire as __esbuildCreateRequire } from 'node:module';
+const require = __esbuildCreateRequire(import.meta.url);
+import {
+  DEFAULT_RESULT_THRESHOLD_BYTES,
+  Output,
+  RefError,
+  bytesOf,
+  listRefs,
+  pickValue,
+  pruneRefs,
+  readRef,
+  refMaxBytes,
+  refMaxCount,
+  resolveRefInput,
+  resultThresholdBytes
+} from "./chunk-727FH2NI.js";
+import {
+  refsDir
+} from "./chunk-AJ62BGAW.js";
+import {
+  Command,
+  clearInvoiceTokenForSession
+} from "./chunk-BCVYBYYT.js";
+import {
+  shouldReportPlatformError,
+  toPlatformError
+} from "./chunk-6N4JPNFL.js";
+import {
+  appendXiaoEAuthErrorLog,
+  clearXiaoEAuthErrorLog,
+  getXiaoEAuthErrorLogPath,
+  normalizeXiaoEAuthErrorLogLimit,
+  readXiaoEAuthErrorLog,
+  xiaoEAuthLogSecrets
+} from "./chunk-ETNJSKMM.js";
+import {
+  E10AuthSession,
+  XIAOE_AGENT_TYPE,
+  buildE10CookieHeader,
+  clearProfileAuthFile,
+  createXiaoEUnifiedLoginUnavailableError,
+  extractRawSetCookie,
+  extractSessionTicket,
+  findAuthFile,
+  getActiveProfile,
+  getE10AuthRoot,
+  getProfileAuthPath,
+  getProfileDir,
+  hasXiaoEEnv,
+  inspectXiaoEUnifiedLoginSources,
+  listProfiles,
+  normalizeGlobalOptions,
+  packageFileUrl,
+  packagePath,
+  profileNameFromUrl,
+  readProfileConfig,
+  readTeamsCheckUserInfo,
+  resolveXiaoEPreferredBaseUrl,
+  saveAuthFile,
+  saveProfileConfig,
+  setActiveProfile,
+  switchActiveProfile,
+  tryXiaoEUnifiedLogin
+} from "./chunk-UFIT2UU3.js";
+import {
+  CliError,
+  isCliError,
+  toErrorEnvelope
+} from "./chunk-UG5G54VL.js";
+
+// src/cmd/argv.ts
+var VALUE_TAKING_GLOBAL_OPTIONS = /* @__PURE__ */ new Set([
+  "--config",
+  "--auth",
+  "--profile",
+  "--runtime-agent",
+  "--base-url",
+  "--passport-url"
+]);
+function firstPositionalToken(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === void 0) return void 0;
+    if (token === "--") return argv[index + 1];
+    if (token.startsWith("-")) {
+      if (VALUE_TAKING_GLOBAL_OPTIONS.has(token)) index += 1;
+      continue;
+    }
+    return token;
+  }
+  return void 0;
+}
+function toCommandMetadata(commands) {
+  return commands.map((command) => ({
+    name: command.name,
+    description: command.description,
+    category: command.category
+  }));
+}
+
+// src/cmd/commands/index.ts
+var commandsCommand = {
+  name: "commands",
+  description: "Registered command discovery",
+  category: "system",
+  register({ program, action }) {
+    const commands = program.command("commands").alias("module").description("Inspect registered commands");
+    commands.command("list").description("List registered commands").action(action((ctx) => {
+      ctx.output.write({ commands: ctx.commands, modules: ctx.modules });
+    }));
+  }
+};
+
+// src/cmd/config/index.ts
+function parseValue(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (value === "null") return null;
+  if (/^-?\d+(\.\d+)?$/.test(value)) return Number(value);
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+var configCommand = {
+  name: "config",
+  description: "Generic local configuration commands",
+  category: "system",
+  register({ program, action }) {
+    const config = program.command("config").description("Manage weaver-work-cli config");
+    config.command("path").description("Print the active config file path").action(action((ctx) => {
+      ctx.output.write({ path: ctx.config.path() }, { text: ctx.config.path() });
+    }));
+    config.command("list").description("Print all config values").action(action((ctx) => {
+      ctx.output.write(ctx.config.all());
+    }));
+    config.command("get").description("Print one config value").argument("<key>", "config key").action(action((ctx, key) => {
+      if (typeof key !== "string") throw new CliError("key must be a string", 2 /* UsageError */);
+      ctx.output.write({ key, value: ctx.config.get(key) });
+    }));
+    config.command("set").description("Set one config value").argument("<key>", "config key").argument("<value>", "config value").action(action((ctx, key, value) => {
+      if (typeof key !== "string" || typeof value !== "string") {
+        throw new CliError("key and value must be strings", 2 /* UsageError */);
+      }
+      const parsed = parseValue(value);
+      ctx.config.set(key, parsed);
+      ctx.output.write({ key, value: parsed, path: ctx.config.path() }, { text: "Saved " + key });
+    }));
+    config.command("delete").description("Delete one config value").argument("<key>", "config key").action(action((ctx, key) => {
+      if (typeof key !== "string") throw new CliError("key must be a string", 2 /* UsageError */);
+      const deleted = ctx.config.delete(key);
+      ctx.output.write({ key, deleted, path: ctx.config.path() }, { text: deleted ? "Deleted " + key : "No value for " + key });
+    }));
+  }
+};
+
+// src/cmd/docs/index.ts
+import { cpSync, existsSync, readdirSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+var DOCS_DIR = packagePath("docs");
+var PKG_JSON_URL = packageFileUrl("package.json");
+function packageVersion() {
+  try {
+    return JSON.parse(readFileSync(PKG_JSON_URL, "utf-8")).version;
+  } catch {
+    return "unknown";
+  }
+}
+function countFiles(dir) {
+  let count = 0;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const entryPath = resolve(dir, entry.name);
+    count += entry.isDirectory() ? countFiles(entryPath) : 1;
+  }
+  return count;
+}
+function ensureDocs() {
+  if (!existsSync(DOCS_DIR)) {
+    throw new CliError("docs directory does not exist: " + DOCS_DIR);
+  }
+}
+var docsCommand = {
+  name: "docs",
+  description: "Packaged docs and template copy commands",
+  category: "system",
+  register({ program, action }) {
+    const docs = program.command("docs").description("Read or copy packaged docs");
+    docs.command("root").description("Print packaged docs root path").action(action((ctx) => {
+      ensureDocs();
+      const root = DOCS_DIR.replace(/[\\/]+$/, "");
+      ctx.output.write({ root, version: packageVersion() }, { text: root + "\nversion: " + packageVersion() });
+    }));
+    docs.command("copy").description("Copy packaged docs to <target>/weaver-work-cli-docs").argument("[target]", "target directory", process.cwd()).action(action((ctx, target) => {
+      ensureDocs();
+      const dest = resolve(String(target || process.cwd()), "weaver-work-cli-docs");
+      const sourceRoot = DOCS_DIR.replace(/[\\/]+$/, "");
+      if (dest === sourceRoot || dest.startsWith(sourceRoot + "/") || dest.startsWith(sourceRoot + "\\")) {
+        throw new CliError("target directory is inside docs source: " + dest);
+      }
+      cpSync(DOCS_DIR, dest, { recursive: true });
+      const files = countFiles(dest);
+      ctx.output.write({ files, dest, version: packageVersion() }, { text: "Copied " + files + " files to " + dest });
+    }));
+  }
+};
+
+// src/cmd/doctor/index.ts
+import { existsSync as existsSync2 } from "node:fs";
+function versionMajor(version) {
+  return Number(version.replace(/^v/, "").split(".")[0] || 0);
+}
+var doctorCommand = {
+  name: "doctor",
+  description: "Environment diagnostics",
+  category: "system",
+  register({ program, action }) {
+    program.command("doctor").description("Check local CLI environment").option("--e10", "also check E10 auth file discovery").action(action((ctx, options) => {
+      const opts = options && typeof options === "object" ? options : {};
+      const checks = [
+        {
+          name: "node",
+          ok: versionMajor(process.version) >= 18,
+          detail: process.version
+        },
+        {
+          name: "package",
+          ok: Boolean(ctx.packageInfo.version),
+          detail: ctx.packageInfo.name + "@" + ctx.packageInfo.version
+        },
+        {
+          name: "configPath",
+          ok: true,
+          detail: ctx.config.path()
+        }
+      ];
+      if (opts.e10) {
+        const authFile = findAuthFile(ctx.cwd);
+        checks.push({
+          name: "e10AuthFile",
+          ok: Boolean(authFile && existsSync2(authFile)),
+          detail: authFile || "not found"
+        });
+      }
+      const ok = checks.every((check) => check.ok);
+      ctx.output.write({ ok, checks });
+    }));
+  }
+};
+
+// src/internal/e10/auth/commands.ts
+import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+var DEFAULT_AGENT_TYPE = "weaver-work-cli";
+var EXPLICIT_AGENT_TYPE_ENV_KEYS = [
+  "WORKBUDDY_AGENT_TYPE",
+  "CODEX_AGENT_TYPE",
+  "WEAVER_AGENT_TYPE"
+];
+var AGENT_RETURN_URL_ENV_KEY = "WEAVER_AGENT_RETURN_URL";
+var AGENT_RETURN_PATH = "/agent-return";
+var AGENT_RETURN_TOKEN_HEADER = "x-weaver-agent-return-token";
+var AGENT_RETURN_TIMEOUT_MS = 9e5;
+var OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS = 3e4;
+var UNSAFE_AGENT_RETURN_PROTOCOLS = /* @__PURE__ */ new Set([
+  "about:",
+  "blob:",
+  "data:",
+  "file:",
+  "ftp:",
+  "http:",
+  "https:",
+  "javascript:",
+  "mailto:",
+  "sms:",
+  "tel:",
+  "vbscript:",
+  "ws:",
+  "wss:"
+]);
+var BUILT_IN_AGENT_RETURN_TARGETS = [
+  {
+    aliases: ["workbuddy"],
+    label: "WorkBuddy",
+    url: "workbuddy://"
+  },
+  {
+    aliases: ["xiaoe", "xiaoeclient", "\u5C0Fe", "\u667A\u80FD\u5C0Fe"],
+    label: "\u667A\u80FD\u5C0F E",
+    url: "xiaoe-client://"
+  },
+  {
+    aliases: ["codex", "openaicodex"],
+    label: "Codex",
+    url: "codex://"
+  }
+];
+function asOptions(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function optionString(options, ...keys) {
+  for (const key of keys) {
+    const value = options[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function envString(env, ...keys) {
+  for (const key of keys) {
+    const value = env[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function hasEnvPrefix(env, prefix) {
+  return Object.keys(env).some((key) => key === prefix || key.startsWith(`${prefix}_`));
+}
+function inferAgentTypeFromEnv(env) {
+  if (hasXiaoEEnv(env)) return XIAOE_AGENT_TYPE;
+  if (hasEnvPrefix(env, "WORKBUDDY")) return "workbuddy";
+  if (hasEnvPrefix(env, "CODEX")) return "codex";
+  return "";
+}
+function resolveAgentType(options = {}, env = process.env) {
+  return optionString(options, "agentType", "agent_type") || envString(env, ...EXPLICIT_AGENT_TYPE_ENV_KEYS) || inferAgentTypeFromEnv(env) || DEFAULT_AGENT_TYPE;
+}
+function normalizeAgentKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/gu, "");
+}
+function normalizeAgentAlias(value) {
+  return value.trim().toLowerCase().replace(/[^\p{Letter}\p{Number}]+/gu, "");
+}
+function builtInAgentReturnTarget(agentType) {
+  const alias = normalizeAgentAlias(agentType);
+  const target = BUILT_IN_AGENT_RETURN_TARGETS.find((candidate) => candidate.aliases.includes(alias));
+  return target ? { label: target.label, url: target.url } : null;
+}
+function conventionalAgentReturnUrl(agentType) {
+  const scheme = agentType.trim().toLowerCase();
+  if (normalizeAgentAlias(agentType) === normalizeAgentAlias(DEFAULT_AGENT_TYPE) || scheme.length > 64 || !/^[a-z][a-z0-9+.-]*$/u.test(scheme) || UNSAFE_AGENT_RETURN_PROTOCOLS.has(`${scheme}:`)) {
+    return "";
+  }
+  return `${scheme}://`;
+}
+function validateAgentReturnUrl(value) {
+  if (value.length > 2048 || /[\u0000-\u001f\u007f\s]/u.test(value) || !/^[a-z][a-z0-9+.-]*:\/\//iu.test(value)) {
+    throw new CliError("Invalid --agent-return-url value", 2 /* UsageError */);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new CliError("Invalid --agent-return-url value", 2 /* UsageError */);
+  }
+  if (UNSAFE_AGENT_RETURN_PROTOCOLS.has(url.protocol)) {
+    throw new CliError("--agent-return-url must use a registered desktop application URL scheme.", 2 /* UsageError */);
+  }
+  return value;
+}
+function resolveAgentReturnTarget(options = {}, env = process.env, agentType = resolveAgentType(options, env)) {
+  const builtInTarget = builtInAgentReturnTarget(agentType);
+  const explicitUrl = optionString(options, "agentReturnUrl") || envString(env, AGENT_RETURN_URL_ENV_KEY);
+  if (explicitUrl) {
+    return {
+      label: builtInTarget?.label || agentType,
+      url: validateAgentReturnUrl(explicitUrl)
+    };
+  }
+  if (builtInTarget) return builtInTarget;
+  const conventionalUrl = conventionalAgentReturnUrl(agentType);
+  return conventionalUrl ? { label: agentType, url: conventionalUrl } : null;
+}
+function normalizeUrl(value) {
+  return value.replace(/\/+$/, "");
+}
+function readString(data, ...keys) {
+  for (const key of keys) {
+    const value = data[key];
+    if (typeof value === "string" && value) return value;
+    if (typeof value === "number") return String(value);
+  }
+  return "";
+}
+function cookieString(value) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && !Array.isArray(value)) {
+    return Object.entries(value).filter(([, cookieValue2]) => cookieValue2 !== void 0 && cookieValue2 !== null && cookieValue2 !== "").map(([name, cookieValue2]) => `${name}=${String(cookieValue2)}`).join("; ");
+  }
+  return "";
+}
+function cookieValue(rawCookie, name) {
+  const match = rawCookie.match(new RegExp(`${name}=([^;]+)`));
+  return match?.[1] || "";
+}
+function formatAuthStatus(status) {
+  if (!status.loggedIn) {
+    return "Not logged in. Select the appropriate authentication method for the current runtime before retrying.";
+  }
+  const lines = [
+    "Logged in.",
+    "userId: " + status.userId,
+    "tenantKey: " + (status.tenantKey || ""),
+    "tenantName: " + (status.tenantName || ""),
+    "department: " + (status.department || ""),
+    "subcompany: " + (status.subcompany || ""),
+    "position: " + (status.position || ""),
+    "version: " + (status.version || ""),
+    "agentType: " + (status.agentType || ""),
+    "baseUrl: " + status.baseUrl,
+    "profile: " + status.profile,
+    "authFile: " + status.authFile,
+    ..."loginSource" in status && status.loginSource ? ["loginSource: " + status.loginSource] : [],
+    ..."credentialSourceStep" in status && status.credentialSourceStep ? ["credentialSourceStep: " + status.credentialSourceStep] : [],
+    ..."credentialSourceType" in status && status.credentialSourceType ? ["credentialSourceType: " + status.credentialSourceType] : [],
+    ..."credentialSourceLabel" in status && status.credentialSourceLabel ? ["credentialSourceLabel: " + status.credentialSourceLabel] : [],
+    ..."expiryTimes" in status && status.expiryTimes ? ["expiryTimes: " + status.expiryTimes] : []
+  ];
+  if ("valid" in status) {
+    lines.push("valid: " + String(status.valid));
+  }
+  return lines.join("\n");
+}
+function formatLoginResult(result) {
+  return [
+    "Saved E10 auth.",
+    "userId: " + result.userId,
+    "tenantKey: " + result.tenantKey,
+    "tenantName: " + result.tenantName,
+    "baseUrl: " + result.baseUrl,
+    "profile: " + result.profile,
+    "authFile: " + result.authFile,
+    ...result.loginSource ? ["loginSource: " + result.loginSource] : [],
+    ...result.credentialSourceStep ? ["credentialSourceStep: " + result.credentialSourceStep] : [],
+    ...result.credentialSourceType ? ["credentialSourceType: " + result.credentialSourceType] : [],
+    ...result.credentialSourceLabel ? ["credentialSourceLabel: " + result.credentialSourceLabel] : [],
+    ...result.expiryTimes ? ["expiryTimes: " + result.expiryTimes] : []
+  ].join("\n");
+}
+async function clearInvoiceTokenCache(profile, authData) {
+  if (!authData.baseUrl || !authData.userId) return;
+  await clearInvoiceTokenForSession({
+    baseUrl: normalizeUrl(authData.baseUrl),
+    profile,
+    userId: authData.userId
+  }).catch(() => false);
+}
+function posixShellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function powershellQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function resolveWeaverEnvShell(shell, platform = process.platform) {
+  if (shell === "auto") return platform === "win32" ? "powershell" : "posix";
+  if (shell === "posix" || shell === "powershell") return shell;
+  throw new CliError("Invalid --shell value. Use auto, posix, or powershell.", 2 /* UsageError */);
+}
+function formatWeaverEnvExports(value, shell = "auto", platform = process.platform) {
+  const resolved = resolveWeaverEnvShell(shell, platform);
+  return Object.entries(value).map(([name, envValue2]) => resolved === "powershell" ? `$env:${name} = ${powershellQuote(envValue2)}` : `export ${name}=${posixShellQuote(envValue2)}`).join("\n");
+}
+function esc(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function renderE10LoginSuccessPage(userId, returnTarget = null, launchToken = "") {
+  const safeReturnTarget = returnTarget ? { ...returnTarget, url: validateAgentReturnUrl(returnTarget.url) } : null;
+  const agentKey = safeReturnTarget ? normalizeAgentKey(safeReturnTarget.label) || "agent" : "";
+  const returnAction = safeReturnTarget && launchToken ? `<div class="overlay" data-agent-return data-token="${esc(launchToken)}" data-agent-key="${esc(agentKey)}" data-agent-label="${esc(safeReturnTarget.label)}" data-fallback-url="${esc(safeReturnTarget.url)}"><section class="prompt" role="dialog" aria-modal="true" aria-labelledby="agent-return-title"><div class="app-icon" aria-hidden="true"><svg viewBox="0 0 64 64"><defs><linearGradient id="app-gradient" x1="8" y1="4" x2="56" y2="60" gradientUnits="userSpaceOnUse"><stop stop-color="#24d3b5"/><stop offset="1" stop-color="#08aa82"/></linearGradient></defs><rect width="64" height="64" rx="16" fill="url(#app-gradient)"/><path d="M18 21.5 32 13l14 8.5v17L32 47 18 38.5v-17Z" fill="#fff" fill-opacity=".96"/><rect x="23" y="25" width="18" height="15" rx="6" fill="#12b991"/><circle cx="28.5" cy="32.5" r="1.8" fill="#fff"/><circle cx="35.5" cy="32.5" r="1.8" fill="#fff"/></svg></div><h1 id="agent-return-title">\u662F\u5426\u6253\u5F00\u201C${esc(safeReturnTarget.label)}\u201D\uFF1F</h1><p>\u767B\u5F55\u6388\u6743\u5DF2\u5B8C\u6210\uFF0C\u8FD4\u56DE ${esc(safeReturnTarget.label)} \u7EE7\u7EED\u4F7F\u7528\u3002</p><button class="primary" type="button" data-action="open">\u6253\u5F00\u201C${esc(safeReturnTarget.label)}\u201D</button><button class="secondary" type="button" data-action="always">\u59CB\u7EC8\u6253\u5F00\u201C${esc(safeReturnTarget.label)}\u201D</button><button class="secondary" type="button" data-action="cancel">\u53D6\u6D88</button><div class="status" role="status" aria-live="polite"></div></section></div>` : "";
+  const returnScript = safeReturnTarget && launchToken ? `<script nonce="${esc(launchToken)}">(()=>{const root=document.querySelector('[data-agent-return]');if(!root)return;const status=root.querySelector('.status');const buttons=[...root.querySelectorAll('button')];const agentLabel=root.dataset.agentLabel||'\u5E94\u7528';const fallbackUrl=root.dataset.fallbackUrl||'';const storageKey='weaver-work-cli.agent-return.'+root.dataset.agentKey;let busy=false;const setBusy=value=>{busy=value;buttons.forEach(button=>{button.disabled=value;});};const closePrompt=()=>{root.hidden=true;};const savePreference=()=>{try{localStorage.setItem(storageKey,'1');}catch{}};const clearPreference=()=>{try{localStorage.removeItem(storageKey);}catch{}};const hasPreference=()=>{try{return localStorage.getItem(storageKey)==='1';}catch{return false;}};const post=async action=>{let response;try{response=await fetch('${AGENT_RETURN_PATH}?action='+encodeURIComponent(action),{method:'POST',headers:{'${AGENT_RETURN_TOKEN_HEADER}':root.dataset.token}});}catch{return false;}if(!response.ok)throw new Error(await response.text()||'\u8BF7\u6C42\u5931\u8D25');return true;};const openAgent=async persist=>{if(busy)return;setBusy(true);status.textContent='\u6B63\u5728\u6253\u5F00 '+agentLabel+'\u2026';try{const openedLocally=await post('open');if(persist)savePreference();if(!openedLocally){closePrompt();window.location.href=fallbackUrl;return;}closePrompt();}catch(error){if(persist)clearPreference();status.textContent=error instanceof Error?error.message:'\u65E0\u6CD5\u6253\u5F00\u5E94\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002';setBusy(false);}};root.querySelector('[data-action="open"]').addEventListener('click',()=>openAgent(false));root.querySelector('[data-action="always"]').addEventListener('click',()=>openAgent(true));root.querySelector('[data-action="cancel"]').addEventListener('click',()=>{if(busy)return;clearPreference();closePrompt();post('cancel').catch(()=>{});});if(hasPreference())openAgent(false);})();</script>` : "";
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>weaver-work-cli \u767B\u5F55\u6210\u529F</title><style>:root{color-scheme:light}*{box-sizing:border-box}body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Arial,sans-serif;background:radial-gradient(circle at 50% 18%,#eefbf8 0,#f6f7f9 42%,#eef1f5 100%);color:#20242a;display:grid;place-items:center;min-height:100vh;margin:0}.card{background:rgba(255,255,255,.88);border:1px solid #e6e8ec;border-radius:18px;padding:34px 38px;box-shadow:0 18px 55px rgba(18,24,40,.09);width:min(560px,calc(100vw - 40px));text-align:center}.title{font-size:24px;font-weight:700;margin-bottom:10px}.desc{color:#667085;font-size:15px;line-height:24px}.user{color:#98a2b3;font-size:12px;margin-top:18px}.overlay{position:fixed;inset:0;z-index:10;display:grid;place-items:center;padding:20px;background:rgba(28,34,41,.36);backdrop-filter:blur(5px)}.overlay[hidden]{display:none}.prompt{width:min(410px,calc(100vw - 32px));padding:32px 28px 26px;border:1px solid rgba(255,255,255,.75);border-radius:24px;background:rgba(250,250,251,.97);box-shadow:0 24px 70px rgba(15,23,42,.28);text-align:center}.app-icon{width:74px;height:74px;margin:0 auto 24px;filter:drop-shadow(0 8px 14px rgba(8,170,130,.22))}.app-icon svg{display:block;width:100%;height:100%}.prompt h1{margin:0;font-size:20px;line-height:30px;font-weight:700;letter-spacing:-.2px}.prompt p{margin:10px 0 24px;color:#667085;font-size:14px;line-height:22px}.prompt button{display:block;width:100%;min-height:40px;border:0;border-radius:12px;font:600 16px/22px inherit;cursor:pointer;transition:transform .12s ease,filter .12s ease}.prompt button+button{margin-top:10px}.prompt button:hover{filter:brightness(.98)}.prompt button:active{transform:scale(.99)}.prompt button:disabled{cursor:wait;opacity:.62}.primary{background:linear-gradient(180deg,#2f91ff,#0b74e5);color:#fff;box-shadow:0 8px 18px rgba(11,116,229,.2)}.secondary{background:#e9eaec;color:#22252a}.status{min-height:18px;margin-top:14px;color:#667085;font-size:12px;line-height:18px}</style></head><body><main class="card"><div class="title">\u767B\u5F55\u6388\u6743\u6210\u529F</div><div class="desc">\u4F60\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\uFF0C\u8FD4\u56DE\u667A\u80FD\u4F53\u6216\u7EC8\u7AEF\u7EE7\u7EED\u4F7F\u7528\u3002</div><div class="user">${esc(userId)}</div></main>${returnAction}${returnScript}</body></html>`;
+}
+function resolveBrowserOpenCommand(url, platform = process.platform) {
+  if (platform === "win32") {
+    return { file: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+  }
+  if (platform === "darwin") return { file: "open", args: [url] };
+  return { file: "xdg-open", args: [url] };
+}
+function openUrlInBrowser(url, ctx) {
+  const command = resolveBrowserOpenCommand(url);
+  execFile(command.file, command.args, (error) => {
+    if (error) {
+      ctx.logger.warn("Could not open browser automatically. Copy the login URL manually.");
+    }
+  });
+}
+function openUrlWithSystemHandler(url) {
+  const command = resolveBrowserOpenCommand(url);
+  return new Promise((resolve8, reject) => {
+    execFile(command.file, command.args, (error) => {
+      if (error) reject(error);
+      else resolve8();
+    });
+  });
+}
+function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
+  const authorizeParams = new URLSearchParams({
+    redirect_uri: redirectUri,
+    response_type: "code",
+    access_type: "agent",
+    agent_type: agentType,
+    from: agentType
+  });
+  return `${baseUrl}/papi/sso/oauth2.0/authorize?${authorizeParams.toString()}`;
+}
+function isTlsClientHello(error) {
+  if (!error || typeof error !== "object") return false;
+  const rawPacket = error.rawPacket;
+  return Buffer.isBuffer(rawPacket) && rawPacket.length >= 3 && rawPacket[0] === 22 && rawPacket[1] === 3;
+}
+function createOAuthCallbackProtocolMismatchError(port) {
+  return Object.assign(new CliError(
+    `OAuth callback protocol mismatch: the browser connected to https://127.0.0.1:${port}, but the CLI callback listener uses HTTP. Retry the login and, on the callback error page, change only the URL scheme to http:// before reloading; keep the path and query unchanged. The E10 authorization service should preserve HTTP loopback redirect URIs.`,
+    3 /* AuthError */
+  ), {
+    type: "authentication",
+    subtype: "oauth_callback_protocol_mismatch",
+    retryable: false,
+    stage: "oauth_callback"
+  });
+}
+async function readJsonObject(resp) {
+  const data = await resp.json().catch(() => ({}));
+  return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+}
+async function resolveUserInfo(baseUrl, eteamsId, rawCookie = "", agentType = "") {
+  const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/json",
+      eteamsid: eteamsId,
+      cookie: buildE10CookieHeader(rawCookie, eteamsId, agentType),
+      "user-agent": agentType ? `AgentType=${agentType},IsAgent=true` : DEFAULT_AGENT_TYPE,
+      origin: baseUrl
+    },
+    redirect: "manual"
+  });
+  const data = await resp.json().catch(() => ({}));
+  return { userInfo: readTeamsCheckUserInfo(resp, data), setCookie: extractRawSetCookie(resp) };
+}
+async function saveEteamsIdLogin(input) {
+  const baseUrl = normalizeUrl(input.baseUrl);
+  const passportUrl = normalizeUrl(input.passportUrl || baseUrl);
+  const { userInfo, setCookie } = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || "", input.agentType);
+  if (!userInfo.userId) {
+    throw new CliError("Could not resolve userId. Check whether ETEAMSID is valid for this E10 domain.", 3 /* AuthError */);
+  }
+  const tenantKey = userInfo.tenantKey || input.tenantKeyFallback;
+  const profile = input.profileHint || profileNameFromUrl(baseUrl);
+  setActiveProfile(profile);
+  const cookies = { ETEAMSID: input.eteamsId };
+  if (input.rawCookie) cookies.raw = input.rawCookie;
+  const ztSession = extractSessionTicket(setCookie, input.rawCookie || "");
+  const authData = {
+    cookies,
+    userId: userInfo.userId,
+    tenantKey,
+    tenantName: userInfo.tenantName,
+    department: userInfo.department,
+    subcompany: userInfo.subcompany,
+    position: userInfo.position,
+    agentType: input.agentType,
+    version: input.version || "",
+    baseUrl,
+    passportUrl,
+    cookieSavedAt: Date.now(),
+    ...ztSession ? { ztSession } : {}
+  };
+  await clearInvoiceTokenCache(profile, authData);
+  const authFile = saveAuthFile(authData, profile);
+  saveProfileConfig(baseUrl, passportUrl, profile, tenantKey);
+  return {
+    ...userInfo,
+    tenantKey,
+    eteamsId: input.eteamsId,
+    baseUrl,
+    passportUrl,
+    profile,
+    authFile,
+    agentType: input.agentType,
+    version: input.version || ""
+  };
+}
+async function tryXiaoEUnifiedLogin2(ctx, baseUrl, tenantKeyFallback, profileHint, allowTokenScript = false, diagnostics) {
+  const login = await tryXiaoEUnifiedLogin({
+    env: ctx.env,
+    baseUrl,
+    allowBundledEnvScript: true,
+    tenantKeyFallback,
+    profileHint,
+    allowTokenScript,
+    logger: ctx.logger,
+    diagnostics
+  });
+  return login?.result || null;
+}
+async function oidcExchange(code, redirectUri, baseUrl, tenantKeyFallback, agentTypeFallback, profileHint) {
+  const base = normalizeUrl(baseUrl);
+  const tokenParams = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri
+  });
+  const tokenResp = await fetch(`${base}/papi/sso/oauth2.0/accessToken`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: tokenParams.toString(),
+    redirect: "manual"
+  });
+  const tokenData = await readJsonObject(tokenResp);
+  if (tokenResp.status >= 400) {
+    const message = readString(tokenData, "message", "msg", "error_description", "error") || `OAuth token exchange failed: ${tokenResp.status}`;
+    throw new CliError(message, 3 /* AuthError */);
+  }
+  let eteamsId = readString(tokenData, "eteamsId", "eteamsid");
+  let userId = readString(tokenData, "id", "userId", "employeeId");
+  let rawCookies = cookieString(tokenData.cookies || tokenData.cookie) || extractRawSetCookie(tokenResp);
+  let agentType = agentTypeFallback || readString(tokenData, "agentType", "agent_type");
+  let version = readString(tokenData, "version", "baselineVersion");
+  const accessToken = readString(tokenData, "access_token", "accessToken");
+  if (!eteamsId) eteamsId = cookieValue(rawCookies, "ETEAMSID");
+  if (accessToken && (!eteamsId || !userId || !rawCookies || !version || !agentType)) {
+    const profileResp = await fetch(`${base}/papi/sso/oauth2.0/profile?access_token=${encodeURIComponent(accessToken)}`, {
+      method: "POST",
+      headers: { accept: "application/json" },
+      redirect: "manual"
+    });
+    const profileData = await readJsonObject(profileResp);
+    const profileRawCookies = cookieString(profileData.cookies || profileData.cookie) || extractRawSetCookie(profileResp);
+    if (!eteamsId) eteamsId = readString(profileData, "eteamsId", "eteamsid") || cookieValue(profileRawCookies, "ETEAMSID");
+    if (!userId) userId = readString(profileData, "id", "userId", "employeeId");
+    if (!rawCookies) rawCookies = profileRawCookies;
+    if (!agentType) agentType = readString(profileData, "agentType", "agent_type");
+    if (!version) version = readString(profileData, "version", "baselineVersion");
+  }
+  if (!eteamsId) {
+    throw new CliError("Could not resolve ETEAMSID from OAuth response.", 3 /* AuthError */);
+  }
+  const { userInfo, setCookie } = await resolveUserInfo(base, eteamsId, rawCookies, agentType).catch(() => ({
+    userInfo: {
+      userId: "",
+      tenantKey: "",
+      tenantName: "",
+      department: "",
+      subcompany: "",
+      position: ""
+    },
+    setCookie: ""
+  }));
+  const tenantKey = readString(tokenData, "tenant_key", "tenantKey") || userInfo.tenantKey || tenantKeyFallback;
+  const ztSession = extractSessionTicket(setCookie, rawCookies);
+  const authData = {
+    cookies: { ETEAMSID: eteamsId, raw: rawCookies },
+    userId: userInfo.userId || userId || "unknown",
+    tenantKey,
+    tenantName: userInfo.tenantName,
+    department: userInfo.department,
+    subcompany: userInfo.subcompany,
+    position: userInfo.position,
+    agentType,
+    version,
+    baseUrl: base,
+    passportUrl: base,
+    cookieSavedAt: Date.now(),
+    ...ztSession ? { ztSession } : {}
+  };
+  const profile = profileHint || profileNameFromUrl(base);
+  setActiveProfile(profile);
+  await clearInvoiceTokenCache(profile, authData);
+  const authFile = saveAuthFile(authData, profile);
+  saveProfileConfig(base, base, profile, tenantKey);
+  return {
+    userId: authData.userId,
+    tenantKey,
+    tenantName: authData.tenantName || "",
+    department: authData.department || "",
+    subcompany: authData.subcompany || "",
+    position: authData.position || "",
+    eteamsId,
+    baseUrl: base,
+    passportUrl: base,
+    profile,
+    authFile,
+    agentType,
+    version
+  };
+}
+function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
+  return [
+    attempted ? "XiaoE \u7EDF\u4E00\u767B\u5F55\u5DF2\u5C1D\u8BD5\uFF0C\u4F46\u672A\u83B7\u53D6\u5230\u53EF\u7528\u4F1A\u8BDD\u3002" : "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 XiaoE \u7EDF\u4E00\u767B\u5F55\u51ED\u636E\u6E90\uFF0C\u672C\u6B21\u672A\u5C1D\u8BD5\u7EDF\u4E00\u767B\u5F55\u3002",
+    "`auth xiaoe` \u4E0D\u4F1A\u964D\u7EA7\u5230\u6D4F\u89C8\u5668 OAuth\u3002",
+    baseUrl ? `\u5F53\u524D E10 baseUrl: ${baseUrl}\u3002` : "\u672A\u4ECE XiaoE \u51ED\u8BC1\u4E2D\u89E3\u6790\u5230 E10 baseUrl\u3002",
+    attempted ? "CLI \u5DF2\u4F9D\u6B21\u5C1D\u8BD5\u5E73\u53F0\u6CE8\u5165\u51ED\u8BC1\u7684 Node \u6362\u7968\u3001CLI \u5185\u7F6E xiaoe_env.py \u517C\u5BB9\u6362\u7968\u3001\u5BBF\u4E3B xiaoeUserData/tokens.py\u3001\u684C\u9762 XiaoE \u5BA2\u6237\u7AEF\u51ED\u8BC1\uFF08XiaoE/Robots/*/user_settings.json\uFF09\u548C WEAVER_XIAOE_* \u73AF\u5883\u6620\u5C04\u3002" : "CLI \u5DF2\u68C0\u67E5\u5E73\u53F0\u6CE8\u5165\u51ED\u8BC1\u3001\u5BBF\u4E3B xiaoeUserData/tokens.py\u3001\u684C\u9762 XiaoE \u5BA2\u6237\u7AEF\u51ED\u8BC1\uFF08XiaoE/Robots/*/user_settings.json\uFF09\u548C WEAVER_XIAOE_* \u73AF\u5883\u6620\u5C04\u3002",
+    "CLI \u4F1A\u4F18\u5148\u4F7F\u7528 XiaoE \u5BA2\u6237\u7AEF\u5185\u7F6E Python \u6267\u884C tokens.py\uFF1B\u81EA\u52A8\u53D1\u73B0\u4E0D\u53EF\u7528\u65F6\uFF0C\u53EF\u7528 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON \u6307\u5B9A\u517C\u5BB9\u89E3\u91CA\u5668\u3002"
+  ].join(" ");
+}
+async function runXiaoELogin(ctx, options) {
+  const commandOpts = asOptions(options);
+  const globalOptions = ctx.getGlobalOptions();
+  const profileFromGlobal = globalOptions.profile;
+  const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+  const explicitBaseUrl = optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || "";
+  const preferredXiaoEBaseUrl = resolveXiaoEPreferredBaseUrl({
+    explicitBaseUrl,
+    profileBaseUrl: cfg.baseUrl,
+    env: ctx.env
+  });
+  const xiaoESources = inspectXiaoEUnifiedLoginSources({
+    env: ctx.env,
+    baseUrl: preferredXiaoEBaseUrl,
+    profileBaseUrl: cfg.baseUrl,
+    allowTokenScript: true
+  });
+  const useXiaoELogin = xiaoESources.any;
+  const baseUrl = preferredXiaoEBaseUrl;
+  const tenantKey = optionString(commandOpts, "tenantKey");
+  const diagnostics = {
+    attemptedSteps: [],
+    baseUrl,
+    clientType: xiaoESources.clientType,
+    platformCredentialDetected: xiaoESources.platformCredential
+  };
+  if (!useXiaoELogin) {
+    diagnostics.attemptedSteps.push(
+      "platform_token:missing",
+      "bundled_env_script:missing",
+      xiaoESources.clientType === "cloud" ? "token_script:disabled" : "token_script:missing",
+      xiaoESources.clientType === "cloud" ? "client_session:disabled" : "client_session:missing",
+      "environment_map:empty"
+    );
+  }
+  ctx.logger.info([
+    "XiaoE unified login preflight:",
+    "authMode=xiaoe",
+    `credentialSourceDetected=${String(xiaoESources.any)}`,
+    `attempted=${String(useXiaoELogin)}`,
+    `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
+    `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
+    `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
+    `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
+    `clientType=${xiaoESources.clientType || "(unset)"}`,
+    `baseUrl=${baseUrl || "(unresolved)"}`
+  ].join(" "));
+  if (useXiaoELogin) {
+    try {
+      const xiaoEResult = await tryXiaoEUnifiedLogin2(
+        ctx,
+        baseUrl,
+        tenantKey,
+        profileFromGlobal,
+        true,
+        diagnostics
+      );
+      if (xiaoEResult) return xiaoEResult;
+    } catch (error2) {
+      await appendXiaoEAuthErrorLog({
+        source: "login",
+        profile: profileFromGlobal || getActiveProfile(),
+        baseUrl,
+        diagnostics,
+        error: error2,
+        secrets: xiaoEAuthLogSecrets(ctx.env)
+      }).catch((logError) => ctx.logger.debug(
+        `Could not persist XiaoE auth error log: ${logError instanceof Error ? logError.message : String(logError)}`
+      ));
+      throw error2;
+    }
+  }
+  ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
+  const error = createXiaoEUnifiedLoginUnavailableError(baseUrl);
+  await appendXiaoEAuthErrorLog({
+    source: "login",
+    profile: profileFromGlobal || getActiveProfile(),
+    baseUrl,
+    diagnostics,
+    error,
+    secrets: xiaoEAuthLogSecrets(ctx.env)
+  }).catch((logError) => ctx.logger.debug(
+    `Could not persist XiaoE auth error log: ${logError instanceof Error ? logError.message : String(logError)}`
+  ));
+  throw error;
+}
+async function runBrowserLogin(ctx, options) {
+  const commandOpts = asOptions(options);
+  const globalOptions = ctx.getGlobalOptions();
+  const profileFromGlobal = globalOptions.profile;
+  const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+  const explicitBaseUrl = optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || "";
+  const baseUrl = normalizeUrl(explicitBaseUrl || cfg.baseUrl || "");
+  const tenantKey = optionString(commandOpts, "tenantKey");
+  const portText = optionString(commandOpts, "port") || "19800";
+  const port = Number.parseInt(portText, 10);
+  const explicitAgentType = optionString(commandOpts, "agentType", "agent_type");
+  const agentType = resolveAgentType(commandOpts, ctx.env);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new CliError("Invalid --port value", 2 /* UsageError */);
+  }
+  if (!baseUrl) throw new CliError("Missing --base-url", 2 /* UsageError */);
+  const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
+  const agentReturnToken = agentReturnTarget ? randomBytes(24).toString("base64url") : "";
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const loginUrl = buildE10AuthorizeUrl(baseUrl, redirectUri, agentType);
+  ctx.logger.info("Open browser login: " + loginUrl);
+  ctx.logger.info("Waiting for E10 authorization callback...");
+  return await new Promise((resolve8, reject) => {
+    let settled = false;
+    let timer = null;
+    let pendingLoginResult = null;
+    let tlsCallbackDetected = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      const complete = () => {
+        if (error) reject(error);
+        else resolve8(result);
+      };
+      try {
+        server.close(complete);
+      } catch {
+        complete();
+      }
+    };
+    const server = createServer(async (req, res) => {
+      const callbackUrl = new URL(req.url || "/", `http://127.0.0.1:${port}`);
+      if (callbackUrl.pathname === AGENT_RETURN_PATH) {
+        const requestToken = req.headers[AGENT_RETURN_TOKEN_HEADER];
+        if (req.method !== "POST" || !agentReturnTarget || !pendingLoginResult || requestToken !== agentReturnToken) {
+          res.writeHead(403, { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8" });
+          res.end("Forbidden");
+          return;
+        }
+        const action = callbackUrl.searchParams.get("action");
+        if (action === "cancel") {
+          const result = pendingLoginResult;
+          res.writeHead(204, { "cache-control": "no-store" });
+          res.end();
+          finish(null, result);
+          return;
+        }
+        if (action !== "open") {
+          res.writeHead(400, { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8" });
+          res.end("Invalid action");
+          return;
+        }
+        try {
+          await openUrlWithSystemHandler(agentReturnTarget.url);
+          const result = pendingLoginResult;
+          res.writeHead(200, { "cache-control": "no-store", "content-type": "application/json; charset=utf-8" });
+          res.end('{"ok":true}');
+          finish(null, result);
+        } catch {
+          ctx.logger.warn(`Could not open ${agentReturnTarget.label} automatically.`);
+          res.writeHead(500, { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8" });
+          res.end(`\u65E0\u6CD5\u6253\u5F00 ${agentReturnTarget.label}\uFF0C\u8BF7\u786E\u8BA4\u5E94\u7528\u5DF2\u5B89\u88C5\u3002`);
+        }
+        return;
+      }
+      if (callbackUrl.pathname !== "/callback") {
+        res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+        res.end("Not found");
+        return;
+      }
+      const error = callbackUrl.searchParams.get("error");
+      const code = callbackUrl.searchParams.get("code");
+      const redirectAgentType = explicitAgentType || callbackUrl.searchParams.get("agent_type") || callbackUrl.searchParams.get("agentType") || callbackUrl.searchParams.get("from") || agentType;
+      if (error) {
+        const message = callbackUrl.searchParams.get("error_description") || error;
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end(`<h1>Authorization failed</h1><p>${esc(message)}</p>`);
+        finish(new CliError("OAuth authorization failed: " + message, 3 /* AuthError */));
+        return;
+      }
+      if (!code) {
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end("<h1>Login failed</h1><p>Missing authorization code.</p>");
+        finish(new CliError("No authorization code received.", 3 /* AuthError */));
+        return;
+      }
+      if (tlsCallbackDetected && timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+      try {
+        const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
+        const responseHeaders = {
+          "cache-control": "no-store",
+          "content-security-policy": agentReturnTarget ? `default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${agentReturnToken}'; connect-src 'self'` : `default-src 'none'; style-src 'unsafe-inline'`,
+          "content-type": "text/html; charset=utf-8",
+          "referrer-policy": "no-referrer",
+          "x-content-type-options": "nosniff",
+          "x-frame-options": "DENY"
+        };
+        res.writeHead(200, responseHeaders);
+        res.end(renderE10LoginSuccessPage(result.userId, agentReturnTarget, agentReturnToken));
+        if (!agentReturnTarget) {
+          finish(null, result);
+          return;
+        }
+        pendingLoginResult = result;
+        if (timer) clearTimeout(timer);
+        timer = setTimeout(() => finish(null, result), AGENT_RETURN_TIMEOUT_MS);
+      } catch (exchangeError) {
+        const message = exchangeError instanceof Error ? exchangeError.message : String(exchangeError);
+        res.writeHead(500, { "content-type": "text/html; charset=utf-8" });
+        res.end(`<h1>Login failed</h1><p>${esc(message)}</p>`);
+        finish(exchangeError);
+      }
+    });
+    server.on("error", (error) => {
+      const message = error.code === "EADDRINUSE" ? `Port ${port} is already in use. Retry with --port ${port + 1}.` : error.code === "EACCES" ? `Port ${port} is not accessible. Retry with another --port.` : error.message;
+      finish(new CliError(message, 2 /* UsageError */));
+    });
+    server.on("clientError", (error, socket) => {
+      if (isTlsClientHello(error)) {
+        if (!tlsCallbackDetected) {
+          tlsCallbackDetected = true;
+          ctx.logger.warn([
+            `OAuth callback protocol mismatch: the browser used HTTPS for 127.0.0.1:${port}, while the CLI listener is HTTP.`,
+            "\u5728 30 \u79D2\u5185\u628A\u6D4F\u89C8\u5668\u5F53\u524D\u5730\u5740\u5F00\u5934\u660E\u786E\u6539\u4E3A http://\uFF0C\u4FDD\u7559\u540E\u9762\u7684\u5B8C\u6574\u8DEF\u5F84\u548C\u53C2\u6570\uFF0C\u7136\u540E\u56DE\u8F66\u91CD\u8BD5\u3002",
+            "\u4E0D\u8981\u628A\u5730\u5740\u4E2D\u7684\u6388\u6743\u7801\u590D\u5236\u5230\u804A\u5929\u6216\u65E5\u5FD7\u3002"
+          ].join(" "));
+          if (timer) clearTimeout(timer);
+          timer = setTimeout(() => {
+            finish(createOAuthCallbackProtocolMismatchError(port));
+          }, OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS);
+        }
+        socket.destroy();
+        return;
+      }
+      socket.destroy();
+    });
+    server.listen(port, "127.0.0.1", () => {
+      ctx.logger.info("Local callback server: " + redirectUri);
+      openUrlInBrowser(loginUrl, ctx);
+    });
+    timer = setTimeout(() => {
+      finish(new CliError("Login timed out after 5 minutes.", 3 /* AuthError */));
+    }, 3e5);
+  });
+}
+function sessionToCachedUser(session, profile) {
+  return {
+    employeeId: session.userId,
+    tenantKey: session.tenantKey,
+    tenantName: session.tenantName,
+    department: session.department,
+    subcompany: session.subcompany,
+    position: session.position,
+    version: session.version,
+    baseUrl: session.getBaseUrl(),
+    profile,
+    eteamsId: session.eteamsId,
+    agentType: session.agentType,
+    cookie: session.cookieHeader(),
+    userAgent: session.uaHeader()
+  };
+}
+function formatWhoami(title, data) {
+  return [
+    title,
+    "employeeId: " + (data.employeeId || ""),
+    "tenantKey: " + (data.tenantKey || ""),
+    "tenantName: " + (data.tenantName || ""),
+    "department: " + (data.department || ""),
+    "subcompany: " + (data.subcompany || ""),
+    "position: " + (data.position || ""),
+    "version: " + (data.version || ""),
+    "baseUrl: " + (data.baseUrl || ""),
+    "profile: " + (data.profile || ""),
+    "ETEAMSID: " + (data.eteamsId || ""),
+    "cookie: " + (data.cookie || ""),
+    "User-Agent: " + (data.userAgent || "")
+  ].join("\n");
+}
+function formatXiaoEAuthErrorLogEntry(entry) {
+  const lines = [
+    `[${entry.timestamp}] ${entry.source} id=${entry.id}`,
+    ...entry.profile ? [`profile: ${entry.profile}`] : [],
+    ...entry.baseUrl ? [`baseUrl: ${entry.baseUrl}`] : [],
+    ...entry.clientType ? [`clientType: ${entry.clientType}`] : [],
+    ...entry.attemptedSteps.length ? [`attemptedSteps: ${entry.attemptedSteps.join(", ")}`] : [],
+    ...entry.lastError ? [`lastError: ${entry.lastError}`] : [],
+    ...entry.resultSessionExpired ? ["resultSessionExpired: true"] : [],
+    ...entry.error ? [`error: ${entry.error.type}/${entry.error.subtype}: ${entry.error.message}`] : []
+  ];
+  for (const failure of entry.failures || []) {
+    lines.push([
+      `failure: ${failure.stage}/${failure.kind}`,
+      failure.causeCode ? `causeCode=${failure.causeCode}` : "",
+      failure.httpStatus === void 0 ? "" : `httpStatus=${failure.httpStatus}`,
+      failure.message
+    ].filter(Boolean).join(" "));
+  }
+  return lines.join("\n");
+}
+async function showXiaoEAuthErrorLogs(ctx, options) {
+  const commandOpts = asOptions(options);
+  let limit;
+  try {
+    limit = normalizeXiaoEAuthErrorLogLimit(commandOpts.limit);
+  } catch (error) {
+    throw new CliError(error instanceof Error ? error.message : String(error), 2 /* UsageError */);
+  }
+  const result = await readXiaoEAuthErrorLog(limit);
+  const text = result.entries.length ? [
+    `XiaoE auth error logs (${result.returned}/${result.total}, newest first)`,
+    `logFile: ${result.path}`,
+    ...result.invalidLines ? [`invalidLines: ${result.invalidLines}`] : [],
+    "",
+    result.entries.map(formatXiaoEAuthErrorLogEntry).join("\n\n")
+  ].join("\n") : [
+    "No XiaoE auth error logs.",
+    `logFile: ${result.path}`,
+    ...result.invalidLines ? [`invalidLines: ${result.invalidLines}`] : []
+  ].join("\n");
+  ctx.output.write(result, { text });
+}
+function registerXiaoEAuthLogCommands(auth, action) {
+  const logs = auth.command("logs").description("View or clear persisted XiaoE authentication error logs").option("--limit <n>", "number of recent entries to show (1-500)", "50").action(action(showXiaoEAuthErrorLogs));
+  logs.command("show").description("Show persisted XiaoE authentication error logs").option("--limit <n>", "number of recent entries to show (1-500)", "50").action(action(showXiaoEAuthErrorLogs));
+  logs.command("path").description("Print the XiaoE authentication error log path").action(action((ctx) => {
+    const path = getXiaoEAuthErrorLogPath();
+    ctx.output.write({ path }, { text: path });
+  }));
+  logs.command("clear").description("Clear persisted XiaoE authentication error logs").action(action(async (ctx) => {
+    const result = await clearXiaoEAuthErrorLog();
+    const text = result.cleared ? `Cleared XiaoE auth error logs.
+logFile: ${result.path}` : `No XiaoE auth error logs to clear.
+logFile: ${result.path}`;
+    ctx.output.write(result, { text });
+  }));
+}
+function registerBrowserLoginCommand(auth, action, name, description, machine = false) {
+  const command = auth.command(name).description(description).option("--base-url <url>", "E10 base URL").option("--tenant-key <key>", "Tenant key fallback after login").option("--port <n>", "Local OAuth callback port", "19800").option("--agent_type <value>", "Agent type sent to E10 authorize endpoint").option("--agent-type <value>", "Alias of --agent_type").option("--agent-return-url <url>", "Desktop application URL linked by the login success page");
+  command.action(action(async (ctx, options) => {
+    if (!machine) {
+      const result = await runBrowserLogin(ctx, options);
+      ctx.output.write(result, { text: formatLoginResult(result) });
+      return;
+    }
+    ctx.logger.machineMode = true;
+    try {
+      const result = await runBrowserLogin(ctx, options);
+      ctx.output.raw(JSON.stringify({
+        status: "authorized",
+        employeeId: result.userId || "",
+        tenantKey: result.tenantKey || ""
+      }));
+    } catch (error) {
+      ctx.output.raw(JSON.stringify({ status: "unauthorized" }));
+      throw error;
+    } finally {
+      ctx.logger.machineMode = false;
+    }
+  }));
+}
+function registerXiaoELoginCommand(auth, action) {
+  auth.command("xiaoe").description("Use XiaoE unified login without browser OAuth fallback").option("--base-url <url>", "E10 base URL").option("--tenant-key <key>", "Tenant key fallback after login").option("--port <n>", "Deprecated compatibility option; ignored by XiaoE unified login", "19800").option("--agent_type <value>", "Deprecated compatibility option; ignored by XiaoE unified login").option("--agent-type <value>", "Alias of --agent_type").option("--agent-return-url <url>", "Deprecated compatibility option; ignored by XiaoE unified login").action(action(async (ctx, options) => {
+    const result = await runXiaoELogin(ctx, options);
+    ctx.output.write(result, { text: formatLoginResult(result) });
+  }));
+}
+function registerE10AuthCommands(parent, action) {
+  const auth = parent.command("auth").description("E10 auth and profile management");
+  auth.command("root").description("Print the E10 auth root directory").action(action((ctx) => {
+    const root = getE10AuthRoot();
+    ctx.output.write({ root }, { text: root });
+  }));
+  auth.command("status").description("Show E10 login status").option("--no-check", "skip remote session validity check").action(action(async (ctx, options) => {
+    const opts = ctx.getGlobalOptions();
+    const commandOpts = asOptions(options);
+    const authFile = findAuthFile(ctx.cwd, opts);
+    const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
+    const valid = session && commandOpts.check !== false ? session.isExpired() ? false : await session.checkValid() : void 0;
+    const status = session ? {
+      loggedIn: true,
+      userId: session.userId,
+      tenantKey: session.tenantKey,
+      tenantName: session.tenantName,
+      department: session.department,
+      subcompany: session.subcompany,
+      position: session.position,
+      version: session.version,
+      agentType: session.agentType,
+      baseUrl: session.getBaseUrl(),
+      passportUrl: session.getPassportUrl(),
+      profile: opts.profile || getActiveProfile(),
+      authFile,
+      hasEteamsId: Boolean(session.eteamsId),
+      ...session.loginSource ? { loginSource: session.loginSource } : {},
+      ...session.credentialSourceStep ? { credentialSourceStep: session.credentialSourceStep } : {},
+      ...session.credentialSourceType ? { credentialSourceType: session.credentialSourceType } : {},
+      ...session.credentialSourceLabel ? { credentialSourceLabel: session.credentialSourceLabel } : {},
+      ...session.expiryTimes ? { expiryTimes: session.expiryTimes } : {},
+      valid
+    } : {
+      loggedIn: false,
+      profile: opts.profile || getActiveProfile(),
+      authFile
+    };
+    ctx.output.write(status, { text: formatAuthStatus(status) });
+  }));
+  auth.command("show").description('Platform contract: print login status as {"status":"authorized"|"unauthorized"}').option("--status", "print only the strict JSON status object").option("--no-check", "skip remote session validity check").action(action(async (ctx, options) => {
+    const opts = ctx.getGlobalOptions();
+    const commandOpts = asOptions(options);
+    const authFile = findAuthFile(ctx.cwd, opts);
+    const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
+    const profile2 = opts.profile || getActiveProfile();
+    const expired = session ? session.isExpired() : false;
+    const probe = session && !expired && commandOpts.check !== false ? await session.probeValid() : void 0;
+    const authorized = Boolean(session) && !expired && probe !== false;
+    if (commandOpts.status === true) {
+      ctx.output.raw(JSON.stringify({ status: authorized ? "authorized" : "unauthorized" }));
+      return;
+    }
+    ctx.output.write({
+      status: authorized ? "authorized" : "unauthorized",
+      loggedIn: Boolean(session),
+      expired,
+      reachable: probe,
+      profile: profile2,
+      baseUrl: session ? session.getBaseUrl() : ""
+    }, { json: true });
+  }));
+  auth.command("set").description("Save E10 auth from an ETEAMSID cookie").requiredOption("--eteamsid <id>", "ETEAMSID cookie value").option("--base-url <url>", "E10 base URL").option("--passport-url <url>", "E10 passport URL; defaults to base URL").option("--tenant-key <key>", "Tenant key fallback").option("--agent_type <value>", "Agent type used in cookie and User-Agent").option("--agent-type <value>", "Alias of --agent_type").action(action(async (ctx, options) => {
+    const globalOptions = ctx.getGlobalOptions();
+    const commandOpts = asOptions(options);
+    const profileFromGlobal = globalOptions.profile;
+    const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
+    const baseUrl = normalizeUrl(optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || cfg.baseUrl || "");
+    const passportUrl = normalizeUrl(optionString(commandOpts, "passportUrl") || globalOptions.passportUrl || cfg.passportUrl || baseUrl);
+    const tenantKeyFallback = optionString(commandOpts, "tenantKey");
+    const agentType = resolveAgentType(commandOpts, ctx.env);
+    const eteamsId = optionString(commandOpts, "eteamsid");
+    if (!baseUrl) throw new CliError("Missing --base-url", 2 /* UsageError */);
+    if (!eteamsId) throw new CliError("Missing --eteamsid", 2 /* UsageError */);
+    ctx.logger.info("Resolving E10 user information...");
+    const result = await saveEteamsIdLogin({
+      baseUrl,
+      passportUrl,
+      eteamsId,
+      tenantKeyFallback,
+      agentType,
+      profileHint: profileFromGlobal
+    });
+    ctx.output.write(result, { text: formatLoginResult(result) });
+  }));
+  registerBrowserLoginCommand(auth, action, "login", "Open browser OAuth2.0 login and save E10 auth");
+  registerBrowserLoginCommand(auth, action, "oidc", "Alias of auth login for OAuth2.0 browser login");
+  registerBrowserLoginCommand(
+    auth,
+    action,
+    "init",
+    'Platform contract alias of auth login: stdout is strict JSON {"status":"authorized"}',
+    true
+  );
+  registerXiaoELoginCommand(auth, action);
+  registerXiaoEAuthLogCommands(auth, action);
+  auth.command("logout").alias("clear").description("Clear saved E10 auth for the current or selected profile").action(action(async (ctx) => {
+    const opts = ctx.getGlobalOptions();
+    const profile2 = opts.profile || getActiveProfile();
+    const authFile = getProfileAuthPath(profile2);
+    const session = E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl);
+    if (session) {
+      await clearInvoiceTokenCache(profile2, {
+        baseUrl: session.getBaseUrl(),
+        userId: session.userId
+      });
+    }
+    const result = clearProfileAuthFile(profile2);
+    const text = result.cleared ? "Cleared E10 auth.\nprofile: " + result.profile + "\nauthFile: " + result.authFile : "No E10 auth to clear.\nprofile: " + result.profile + "\nauthFile: " + result.authFile;
+    ctx.output.write(result, { text });
+  }));
+  auth.command("whoami").description("Show cached or live E10 user information").option("--json", "print output as JSON").option("--live", "call teamsCheck for live user information").action(action(async (ctx, options) => {
+    const opts = ctx.getGlobalOptions();
+    const commandOpts = asOptions(options);
+    const json = commandOpts.json === true;
+    const live = commandOpts.live === true;
+    const authFile = findAuthFile(ctx.cwd, opts);
+    const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
+    if (!session || !session.eteamsId) throw new CliError("E10 auth not found.", 3 /* AuthError */);
+    const profile2 = opts.profile || getActiveProfile();
+    const cached = sessionToCachedUser(session, profile2);
+    if (!live) {
+      ctx.output.write(cached, {
+        json,
+        text: formatWhoami("Current E10 user (cached)", cached)
+      });
+      return;
+    }
+    const base = session.getBaseUrl();
+    const resp = await fetch(`${base}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(base)}`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json",
+        eteamsid: session.eteamsId,
+        cookie: session.cookieHeader(),
+        "user-agent": session.uaHeader(),
+        origin: base
+      },
+      redirect: "manual"
+    });
+    const raw = await resp.json().catch(() => ({}));
+    if (json || ctx.getGlobalOptions().json) {
+      ctx.output.write(raw, { json: true });
+      return;
+    }
+    const userInfo = readTeamsCheckUserInfo(resp, raw);
+    const liveData = {
+      ...cached,
+      employeeId: userInfo.userId || cached.employeeId,
+      tenantKey: userInfo.tenantKey || cached.tenantKey,
+      tenantName: userInfo.tenantName || cached.tenantName,
+      department: userInfo.department || cached.department,
+      subcompany: userInfo.subcompany || cached.subcompany,
+      position: userInfo.position || cached.position
+    };
+    ctx.output.write(liveData, { text: formatWhoami("Current E10 user (live)", liveData) });
+  }));
+  auth.command("export-weaver-env").description("Print WEAVER_* shell exports for the active E10 auth").option("--shell <shell>", "Shell syntax: auto, posix, or powershell", "auto").action(action(async (ctx, options) => {
+    const commandOpts = asOptions(options);
+    const session = await E10AuthSession.fromOptions(ctx.getGlobalOptions(), ctx.cwd);
+    if (!session) throw new CliError("E10 auth not found.", 3 /* AuthError */);
+    const value = {
+      WEAVER_BASE_URL: session.getBaseUrl(),
+      WEAVER_ETEAMSID: session.eteamsId,
+      WEAVER_COOKIE: session.cookieHeader(),
+      WEAVER_USER_AGENT: session.uaHeader(),
+      WEAVER_AGENT_TYPE: session.agentType
+    };
+    if (ctx.getGlobalOptions().json) {
+      ctx.output.write(value);
+      return;
+    }
+    const shell = optionString(commandOpts, "shell") || "auto";
+    ctx.output.raw(formatWeaverEnvExports(value, shell));
+  }));
+  const profile = auth.command("profile").description("Manage E10 profiles");
+  profile.command("list").description("List E10 profiles").action(action((ctx) => {
+    const active = getActiveProfile();
+    const profiles = listProfiles().map((name) => ({
+      name,
+      active: name === active,
+      dir: getProfileDir(name)
+    }));
+    ctx.output.write({ active, profiles });
+  }));
+  profile.command("use").description("Switch active E10 profile; creates it if missing").argument("<name>", "profile name").action(action((ctx, name) => {
+    if (typeof name !== "string") throw new CliError("profile name must be a string", 2 /* UsageError */);
+    switchActiveProfile(name);
+    const result = {
+      active: name,
+      dir: getProfileDir(name),
+      authFile: getProfileAuthPath(name)
+    };
+    ctx.output.write(result, { text: "Active E10 profile: " + name + "\ndir: " + result.dir });
+  }));
+  profile.command("current").description("Print active E10 profile").action(action((ctx) => {
+    const active = getActiveProfile();
+    ctx.output.write({ active, dir: getProfileDir(active) }, { text: active });
+  }));
+  return auth;
+}
+
+// src/cmd/e10/index.ts
+var e10Command = {
+  name: "e10",
+  description: "E10 platform adapter: auth, profiles, and shared API client",
+  category: "platform",
+  register({ program, ctx, action }) {
+    registerE10AuthCommands(program, action);
+    const e10 = program.command("e10").description("E10 platform commands");
+    registerE10AuthCommands(e10, action);
+    ctx.hooks.register({
+      beforeRun(runCtx) {
+        const authFile = findAuthFile(runCtx.cwd);
+        const session = authFile ? E10AuthSession.fromFile(authFile) : null;
+        if (!session) return;
+        runCtx.env.WEAVER_BASE_URL ||= session.getBaseUrl();
+        runCtx.env.WEAVER_ETEAMSID ||= session.eteamsId;
+        runCtx.env.WEAVER_COOKIE ||= session.cookieHeader();
+        runCtx.env.WEAVER_USER_AGENT ||= session.uaHeader();
+        runCtx.env.WEAVER_AGENT_TYPE ||= session.agentType;
+      }
+    });
+  }
+};
+
+// src/cmd/identity/index.ts
+function safeIdentity(session, profile) {
+  const pick = (value) => typeof value === "string" ? value : "";
+  return {
+    employeeId: pick(session.userId),
+    tenantKey: pick(session.tenantKey),
+    tenantName: pick(session.tenantName),
+    department: pick(session.department),
+    subcompany: pick(session.subcompany),
+    position: pick(session.position),
+    version: pick(session.version),
+    baseUrl: session.getBaseUrl(),
+    profile,
+    agentType: pick(session.agentType)
+  };
+}
+var identityCommand = {
+  name: "identity",
+  description: "Print the signed-in identity in a connector-safe JSON form",
+  category: "platform",
+  register({ program, action }) {
+    const identity = program.command("identity").description("Connector contract: report who the current credential belongs to");
+    identity.command("whoami").description("Print the signed-in E10 identity as JSON without any credential material").action(action((ctx) => {
+      const opts = ctx.getGlobalOptions();
+      const authFile = findAuthFile(ctx.cwd, opts);
+      const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
+      if (!session) throw new CliError("E10 auth not found.", 3 /* AuthError */);
+      const profile = opts.profile || getActiveProfile();
+      ctx.output.raw(JSON.stringify(safeIdentity(session, profile)));
+    }));
+  }
+};
+
+// src/cmd/refs/index.ts
+function parseDuration(value) {
+  const raw = value.trim().toLowerCase();
+  const matched = /^(\d+)\s*([dhms])?$/.exec(raw);
+  if (!matched) {
+    throw new CliError(`\u65E0\u6CD5\u89E3\u6790\u65F6\u957F\uFF1A${value}\uFF08\u793A\u4F8B\uFF1A7d\u300124h\u300130m\uFF09`, 2 /* UsageError */);
+  }
+  const amount = Number(matched[1]);
+  const unit = matched[2] ?? "ms";
+  const factor = unit === "d" ? 864e5 : unit === "h" ? 36e5 : unit === "m" ? 6e4 : 1;
+  return amount * factor;
+}
+function asOptions2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+var refsCommand = {
+  name: "refs",
+  description: "Inspect and prune persisted large results",
+  category: "system",
+  register({ program, action }) {
+    const refs = program.command("refs").description("Manage persisted large results");
+    refs.command("path").description("Print the directory holding persisted results").action(action((ctx) => {
+      const path = refsDir(ctx);
+      ctx.output.write({ path }, { text: path });
+    }));
+    refs.command("list").description("List persisted results, newest first").action(action((ctx) => {
+      const now = Date.now();
+      const items = listRefs(ctx).filter((row) => Date.parse(row.expiresAt) > now).map((row) => ({
+        refId: row.refId,
+        operation: row.operation ?? null,
+        bytes: row.bytes,
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt
+      }));
+      ctx.output.write({ count: items.length, items });
+    }));
+    refs.command("show").description("Print one persisted result in full").argument("<refId>", "reference id").action(action((ctx, refId) => {
+      const id = String(refId ?? "").trim();
+      if (!id) throw new CliError("refId \u4E0D\u80FD\u4E3A\u7A7A", 2 /* UsageError */);
+      const record = readRef(ctx, id);
+      const configuredLimit = resultThresholdBytes(ctx);
+      const displayLimit = configuredLimit > 0 ? configuredLimit : DEFAULT_RESULT_THRESHOLD_BYTES;
+      if (bytesOf(record.envelope) > displayLimit) {
+        throw new CliError(
+          `\u7ED3\u679C\u592A\u5927\uFF0C\u4E0D\u80FD\u5B89\u5168\u5730\u4E00\u6B21\u663E\u793A\u3002\u8BF7\u7528 refs get ${id} <json-path> \u8BFB\u53D6\u9700\u8981\u7684\u5B57\u6BB5\u3002`,
+          2 /* UsageError */
+        );
+      }
+      ctx.output.write(record.envelope, { json: true, persist: false });
+    }));
+    refs.command("get").description("Print one value from a persisted result by JSON path").argument("<refId>", "reference id").argument("<path>", "JSON path, e.g. data.items[0].fid").action(action((ctx, refId, path) => {
+      const id = String(refId ?? "").trim();
+      const jsonPath = String(path ?? "").trim();
+      if (!id || !jsonPath) throw new CliError("refId \u548C JSON \u8DEF\u5F84\u4E0D\u80FD\u4E3A\u7A7A", 2 /* UsageError */);
+      const record = readRef(ctx, id);
+      ctx.output.write(pickValue(record.envelope, jsonPath));
+    }));
+    refs.command("prune").description("Prune persisted results").option("--older-than <duration>", "remove results created before this age, e.g. 7d").option("--all", "remove every persisted result").action(action((ctx, options) => {
+      const opts = asOptions2(options);
+      if (opts.all === true) {
+        const result2 = pruneRefs(ctx, { maxCount: 0, maxBytes: 0 });
+        ctx.output.write({
+          removed: result2.removed,
+          kept: result2.kept,
+          bytes: result2.bytes,
+          cleanupIncomplete: result2.cleanupIncomplete
+        });
+        return;
+      }
+      const olderThanMs = opts.olderThan ? parseDuration(String(opts.olderThan)) : void 0;
+      const result = pruneRefs(ctx, {
+        maxCount: refMaxCount(ctx),
+        maxBytes: refMaxBytes(ctx),
+        ...olderThanMs === void 0 ? {} : { olderThanMs }
+      });
+      ctx.output.write({
+        removed: result.removed,
+        kept: result.kept,
+        bytes: result.bytes,
+        cleanupIncomplete: result.cleanupIncomplete
+      });
+    }));
+  }
+};
+
+// src/cmd/run/index.ts
+import { resolve as resolve2 } from "node:path";
+
+// src/services/command-runner.ts
+import { spawn } from "node:child_process";
+var CommandRunner = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  async run(command, args = [], options = {}) {
+    const runContext = {
+      cwd: options.cwd || this.ctx.cwd,
+      command,
+      args,
+      env: options.env || this.ctx.env,
+      shell: options.shell
+    };
+    await this.ctx.hooks.beforeRun(runContext);
+    const result = await new Promise((resolve8) => {
+      const child = spawn(command, args, {
+        cwd: runContext.cwd,
+        env: runContext.env,
+        shell: runContext.shell,
+        stdio: options.stdio === "inherit" ? "inherit" : "pipe"
+      });
+      const stdout = [];
+      const stderr = [];
+      if (child.stdout) child.stdout.on("data", (chunk) => stdout.push(chunk));
+      if (child.stderr) child.stderr.on("data", (chunk) => stderr.push(chunk));
+      child.on("close", (code, signal) => {
+        resolve8({
+          command,
+          args,
+          cwd: runContext.cwd,
+          code,
+          signal,
+          stdout: Buffer.concat(stdout).toString("utf-8"),
+          stderr: Buffer.concat(stderr).toString("utf-8")
+        });
+      });
+    });
+    await this.ctx.hooks.afterRun(runContext, result);
+    return result;
+  }
+};
+
+// src/cmd/run/index.ts
+var runCommand = {
+  name: "run",
+  description: "Generic external command runner with hooks",
+  category: "system",
+  register({ program, action }) {
+    program.command("run").description("Run an external command through the shared command runner").argument("<command>", "command to run").argument("[args...]", "command arguments").option("--cwd <dir>", "working directory").option("--shell", "run through the platform shell").option("--inherit", "inherit stdio instead of capturing output").allowUnknownOption(true).action(action(async (ctx, command, args, options) => {
+      if (typeof command !== "string") {
+        throw new CliError("command must be a string", 2 /* UsageError */);
+      }
+      const opts = options && typeof options === "object" ? options : {};
+      const result = await new CommandRunner(ctx).run(command, Array.isArray(args) ? args.map(String) : [], {
+        cwd: opts.cwd ? resolve2(opts.cwd) : void 0,
+        shell: opts.shell,
+        stdio: opts.inherit ? "inherit" : "pipe"
+      });
+      if (!opts.inherit && result.stdout) process.stdout.write(result.stdout);
+      if (!opts.inherit && result.stderr) process.stderr.write(result.stderr);
+      if (result.code && result.code !== 0) {
+        throw new CliError("command exited with code " + result.code, result.code);
+      }
+    }));
+  }
+};
+
+// src/cmd/setup/index.ts
+import { existsSync as existsSync4 } from "node:fs";
+
+// src/internal/skills/install.ts
+import { cpSync as cpSync2, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, posix, relative, resolve as resolve3, sep, win32 } from "node:path";
+var SKILL_PREFIX = "weaver-e10-";
+var LEGACY_SKILL_PREFIX = "weaver-work-cli-";
+var SHARED_SKILL_NAME = "weaver-e10-shared";
+function envValue(env, name) {
+  const direct = env[name];
+  if (typeof direct === "string" && direct.trim()) return direct.trim();
+  const expected = name.toUpperCase();
+  for (const [key, value] of Object.entries(env)) {
+    if (key.toUpperCase() === expected && typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function hasEnvFamily(env, prefix, ignoredNames = []) {
+  const expected = `${prefix.toUpperCase()}_`;
+  const ignored = new Set(ignoredNames.map((name) => name.toUpperCase()));
+  return Object.entries(env).some(([key, value]) => key.toUpperCase().startsWith(expected) && !ignored.has(key.toUpperCase()) && typeof value === "string" && Boolean(value.trim()));
+}
+function normalizedAgentType(value) {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "codex-cli") return "codex";
+  if (normalized === "work-buddy") return "workbuddy";
+  return normalized || "unknown";
+}
+function isKnownSkillsHost(host) {
+  return host === "codex" || host === "workbuddy";
+}
+function resolveSkillsTargetPath(value, options = {}) {
+  const trimmed = value.trim();
+  if (!trimmed) throw new Error("skills target path must not be empty");
+  const platform = options.platform ?? process.platform;
+  const pathApi = platform === "win32" ? win32 : posix;
+  const userHome = options.homeDir ?? homedir();
+  if (trimmed === "~") return pathApi.resolve(userHome);
+  if (/^~[\\/]/u.test(trimmed)) {
+    const segments = trimmed.slice(2).split(/[\\/]+/u).filter(Boolean);
+    return pathApi.resolve(userHome, ...segments);
+  }
+  return pathApi.resolve(trimmed);
+}
+function hostSkillsRoot(host, env, options) {
+  const platform = options.platform ?? process.platform;
+  const pathApi = platform === "win32" ? win32 : posix;
+  const userHome = options.homeDir ?? homedir();
+  const envName = host === "codex" ? "CODEX_HOME" : "WORKBUDDY_HOME";
+  const configuredHome = envValue(env, envName);
+  const hostHome = configuredHome ? resolveSkillsTargetPath(configuredHome, options) : pathApi.resolve(userHome, host === "codex" ? ".codex" : ".workbuddy");
+  return pathApi.resolve(hostHome, "skills");
+}
+function detectSkillsHost(env = process.env) {
+  const explicitAgent = envValue(env, "WEAVER_AGENT_TYPE");
+  if (explicitAgent) return normalizedAgentType(explicitAgent);
+  const hasCodexRuntime = hasEnvFamily(env, "CODEX", ["CODEX_HOME"]);
+  const hasWorkBuddyRuntime = hasEnvFamily(env, "WORKBUDDY", ["WORKBUDDY_HOME"]);
+  if (hasCodexRuntime !== hasWorkBuddyRuntime) return hasCodexRuntime ? "codex" : "workbuddy";
+  const hasCodexHome = Boolean(envValue(env, "CODEX_HOME"));
+  const hasWorkBuddyHome = Boolean(envValue(env, "WORKBUDDY_HOME"));
+  if (hasCodexHome !== hasWorkBuddyHome) return hasCodexHome ? "codex" : "workbuddy";
+  return "unknown";
+}
+function resolveSkillsRoot(env = process.env, options = {}) {
+  const configuredRoot = envValue(env, "WEAVER_SKILLS_ROOT");
+  if (configuredRoot) {
+    const explicitAgent = envValue(env, "WEAVER_AGENT_TYPE");
+    const detectedHost = explicitAgent ? normalizedAgentType(explicitAgent) : detectSkillsHost(env);
+    return {
+      root: resolveSkillsTargetPath(configuredRoot, options),
+      host: detectedHost === "unknown" ? "explicit" : detectedHost,
+      source: "explicit-env",
+      environmentVariable: "WEAVER_SKILLS_ROOT"
+    };
+  }
+  const host = detectSkillsHost(env);
+  if (isKnownSkillsHost(host)) {
+    const environmentVariable = envValue(env, host === "codex" ? "CODEX_HOME" : "WORKBUDDY_HOME") ? host === "codex" ? "CODEX_HOME" : "WORKBUDDY_HOME" : void 0;
+    return {
+      root: hostSkillsRoot(host, env, options),
+      host,
+      source: environmentVariable ? "explicit-env" : "host-detected",
+      ...environmentVariable ? { environmentVariable } : {}
+    };
+  }
+  const codexRoot = hostSkillsRoot("codex", env, options);
+  const workBuddyRoot = hostSkillsRoot("workbuddy", env, options);
+  const pathExists = options.pathExists ?? existsSync3;
+  if (host === "unknown") {
+    const existing = [
+      { root: codexRoot, host: "codex" },
+      { root: workBuddyRoot, host: "workbuddy" }
+    ].filter((candidate) => pathExists(candidate.root));
+    if (existing.length === 1) {
+      return { ...existing[0], source: "filesystem-detected" };
+    }
+    return {
+      root: codexRoot,
+      host,
+      source: "fallback",
+      requiresExplicitTarget: true,
+      reason: existing.length > 1 ? "ambiguous-host" : "unknown-host",
+      candidates: [codexRoot, workBuddyRoot]
+    };
+  }
+  return {
+    root: codexRoot,
+    host,
+    source: "fallback",
+    requiresExplicitTarget: true,
+    reason: "unsupported-host",
+    candidates: [codexRoot, workBuddyRoot]
+  };
+}
+function unresolvedSkillsRootMessage(resolution, targetOption = "--target-dir") {
+  const reason = resolution.reason === "ambiguous-host" ? "\u68C0\u6D4B\u5230\u591A\u4E2A\u53EF\u80FD\u7684\u5BBF\u4E3B\u76EE\u5F55" : resolution.reason === "unsupported-host" ? `\u68C0\u6D4B\u5230\u5F53\u524D\u667A\u80FD\u4F53 ${resolution.host}\uFF0C\u4F46\u4E0D\u77E5\u9053\u5B83\u7684 skills \u76EE\u5F55` : "\u672A\u68C0\u6D4B\u5230\u5F53\u524D\u667A\u80FD\u4F53\u53CA\u5176 skills \u76EE\u5F55";
+  return [
+    `${reason}\uFF0C\u4E3A\u907F\u514D\u88C5\u9519\u4F4D\u7F6E\uFF0C\u672C\u6B21\u672A\u6267\u884C\u5B89\u88C5\u3002`,
+    `\u8BF7\u4F7F\u7528 ${targetOption} <\u5F53\u524D\u667A\u80FD\u4F53\u7684 skills \u6839\u76EE\u5F55>\uFF0C\u6216\u8BBE\u7F6E WEAVER_SKILLS_ROOT \u540E\u91CD\u8BD5\u3002`,
+    ...resolution.candidates?.length ? [`\u5DF2\u77E5\u5019\u9009\u76EE\u5F55\uFF1A${resolution.candidates.join("\uFF0C")}`] : []
+  ].join("\n");
+}
+function normalizePackagedSkillName(value) {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed === "all") return trimmed;
+  if (trimmed.includes("/") || trimmed.includes("\\") || trimmed === "." || trimmed === "..") {
+    throw new Error(`invalid skill name: ${value}`);
+  }
+  if (!/^[A-Za-z0-9._-]+$/u.test(trimmed)) {
+    throw new Error(`invalid skill name: ${value}`);
+  }
+  if (trimmed.startsWith(LEGACY_SKILL_PREFIX)) {
+    return `${SKILL_PREFIX}${trimmed.slice(LEGACY_SKILL_PREFIX.length)}`;
+  }
+  return trimmed.startsWith(SKILL_PREFIX) ? trimmed : `${SKILL_PREFIX}${trimmed}`;
+}
+function resolvePackagedSkillNames(sourceRoot, requested = "all") {
+  const available = readdirSync2(sourceRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync3(resolve3(sourceRoot, entry.name, "SKILL.md"))).map((entry) => entry.name).sort();
+  const normalized = normalizePackagedSkillName(requested);
+  if (!normalized || normalized === "all") return available;
+  if (!available.includes(normalized)) {
+    const shortName = normalized.slice(SKILL_PREFIX.length);
+    const suggestions = available.filter((name) => editDistance(shortName, name.replace(/^weaver-e10-/u, "")) <= 2);
+    throw new Error([
+      `unknown packaged skill: ${requested}`,
+      ...suggestions.length ? [`Did you mean: ${suggestions.join(", ")}?`] : [],
+      'Run "weaver-work-cli skills list" to see available skills.'
+    ].join("\n"));
+  }
+  const names = [];
+  if (normalized !== SHARED_SKILL_NAME && available.includes(SHARED_SKILL_NAME)) {
+    names.push(SHARED_SKILL_NAME);
+  }
+  names.push(normalized);
+  return names;
+}
+function editDistance(left, right) {
+  let row = Array.from({ length: right.length + 1 }, (_, index) => index);
+  for (let i = 0; i < left.length; i += 1) {
+    const next = [i + 1];
+    for (let j = 0; j < right.length; j += 1) {
+      next.push(Math.min(next[j] + 1, row[j + 1] + 1, row[j] + (left[i] === right[j] ? 0 : 1)));
+    }
+    row = next;
+  }
+  return row[right.length];
+}
+function installPackagedSkills(sourceRoot, targetRoot, requested = "all") {
+  const resolvedSourceRoot = resolve3(sourceRoot);
+  const resolvedTargetRoot = resolve3(targetRoot);
+  const skillNames = resolvePackagedSkillNames(resolvedSourceRoot, requested);
+  const productContent = productMetadataContent(resolvedSourceRoot);
+  mkdirSync(resolvedTargetRoot, { recursive: true, mode: 448 });
+  const installed = skillNames.map((name) => {
+    const source = resolveInside(resolvedSourceRoot, name);
+    const target = resolve3(resolvedTargetRoot, basename(name));
+    statSync(resolve3(source, "SKILL.md"));
+    cpSync2(source, target, {
+      recursive: true,
+      force: true,
+      filter: (entry) => shouldCopy(entry, source, Boolean(productContent))
+    });
+    writeProductMetadata(target, productContent);
+    const current = {
+      name,
+      source,
+      target,
+      files: countFiles2(target)
+    };
+    return current;
+  });
+  return {
+    sourceRoot: resolvedSourceRoot,
+    targetRoot: resolvedTargetRoot,
+    skillNames,
+    installed
+  };
+}
+function productMetadataContent(sourceRoot) {
+  const productPath = productMetadataPath(sourceRoot);
+  if (!existsSync3(productPath)) return null;
+  const product = JSON.parse(readFileSync2(productPath, "utf8"));
+  const packageInfo = readPackageInfo(resolve3(sourceRoot, "..", "package.json"));
+  const metadata = {
+    schemaVersion: typeof product.schemaVersion === "number" ? product.schemaVersion : 1,
+    product: stringOrEmpty(product.product),
+    productVersion: stringOrEmpty(packageInfo?.version) || stringOrEmpty(product.productVersion),
+    packageName: stringOrEmpty(packageInfo?.name) || stringOrEmpty(product.packageName),
+    command: stringOrEmpty(product.command),
+    nodeEngine: stringOrEmpty(packageInfo?.engines?.node) || stringOrEmpty(product.nodeEngine)
+  };
+  if (metadata.product !== "weaver-work-cli" || metadata.packageName !== "weaver-work-cli" || metadata.command !== "weaver-work-cli" || !metadata.productVersion || !metadata.nodeEngine) {
+    throw new Error("skill-template/product.json or package.json is invalid for weaver-work-cli skills");
+  }
+  return `${JSON.stringify(metadata, null, 2)}
+`;
+}
+function productMetadataPath(sourceRoot) {
+  const templatePath = resolve3(sourceRoot, "..", "skill-template", "product.json");
+  if (existsSync3(templatePath)) return templatePath;
+  return resolve3(sourceRoot, "product.json");
+}
+function readPackageInfo(packagePath2) {
+  if (!existsSync3(packagePath2)) return null;
+  return JSON.parse(readFileSync2(packagePath2, "utf8"));
+}
+function stringOrEmpty(value) {
+  return typeof value === "string" ? value : "";
+}
+function writeProductMetadata(target, productContent) {
+  if (!productContent) return;
+  writeFileSync(resolve3(target, "product.json"), productContent, "utf8");
+}
+function shouldCopy(entry, sourceRoot, skipSkillProduct) {
+  const relativePath = relative(sourceRoot, entry);
+  const name = basename(entry);
+  if (!relativePath) return true;
+  if (skipSkillProduct && relativePath === "product.json") return false;
+  if (name === ".DS_Store" || name.startsWith(".")) return false;
+  const parts = relativePath.split(sep);
+  return !parts.includes("node_modules");
+}
+function countFiles2(root) {
+  let count = 0;
+  for (const entry of readdirSync2(root, { withFileTypes: true })) {
+    const child = resolve3(root, entry.name);
+    if (entry.isDirectory()) count += countFiles2(child);
+    if (entry.isFile()) count += 1;
+  }
+  return count;
+}
+function resolveInside(base, subpath = "") {
+  if (subpath.startsWith("/") || subpath.split(/[\\/]/u).includes("..")) {
+    throw new Error(`invalid skill path: ${subpath}`);
+  }
+  const target = resolve3(base, subpath || ".");
+  const rel = relative(base, target);
+  if (rel === ".." || rel.startsWith(`..${sep}`)) {
+    throw new Error(`invalid skill path: ${subpath}`);
+  }
+  return target;
+}
+
+// src/cmd/setup/index.ts
+var SKILLS_DIR = packagePath("skills");
+function versionMajor2(version) {
+  return Number(version.replace(/^v/, "").split(".")[0] || 0);
+}
+var setupCommand = {
+  name: "setup",
+  description: "One-step setup checks for business shortcuts",
+  category: "system",
+  register({ program, action }) {
+    const setup = program.command("setup").description("One-step setup checks for business shortcuts");
+    setup.command("invoice").description("Check invoice CLI readiness and optionally install Agent skills").option("--install-skill", "install packaged invoice skill into the current Agent skills directory").option("--skill-target-dir <path>", "override target Agent skills directory").action(action((ctx, options) => {
+      const opts = options && typeof options === "object" ? options : {};
+      const authFile = findAuthFile(ctx.cwd, ctx.getGlobalOptions());
+      const packagedSkills = resolvePackagedSkillNames(SKILLS_DIR, "yepiaotong");
+      const checks = [
+        {
+          name: "node",
+          ok: versionMajor2(process.version) >= 18,
+          detail: process.version
+        },
+        {
+          name: "package",
+          ok: true,
+          detail: ctx.packageInfo.name + "@" + ctx.packageInfo.version
+        },
+        {
+          name: "invoiceSkillPackaged",
+          ok: packagedSkills.includes("weaver-e10-yepiaotong"),
+          detail: packagedSkills.join(", ")
+        },
+        {
+          name: "e10Auth",
+          ok: Boolean(authFile && existsSync4(authFile)),
+          detail: authFile || "not found"
+        }
+      ];
+      const specifiedSkillRoot = typeof opts.skillTargetDir === "string" && opts.skillTargetDir.trim() ? resolveSkillsTargetPath(opts.skillTargetDir) : "";
+      const skillResolution = opts.installSkill ? specifiedSkillRoot ? { root: specifiedSkillRoot, host: "explicit", source: "target-dir" } : resolveSkillsRoot(ctx.env) : null;
+      if (skillResolution?.requiresExplicitTarget) {
+        throw new CliError(
+          unresolvedSkillsRootMessage(skillResolution, "--skill-target-dir"),
+          2 /* UsageError */
+        );
+      }
+      const skillInstall = skillResolution ? {
+        ...installPackagedSkills(SKILLS_DIR, skillResolution.root, "yepiaotong"),
+        skillsHost: skillResolution.host,
+        skillsRootSource: skillResolution.source,
+        warnings: skillResolution.source === "filesystem-detected" ? ["\u76EE\u6807\u76EE\u5F55\u4EC5\u6839\u636E\u672C\u673A\u5DF2\u6709\u76EE\u5F55\u63A8\u65AD\uFF1B\u5982\u4E0E\u5F53\u524D\u667A\u80FD\u4F53\u4E0D\u7B26\uFF0C\u8BF7\u663E\u5F0F\u6307\u5B9A\u3002"] : []
+      } : null;
+      const nextActions = [];
+      if (!checks.find((check) => check.name === "e10Auth")?.ok) {
+        nextActions.push("Authenticate using the method required by the current runtime, then rerun setup.");
+      }
+      if (!skillInstall) {
+        nextActions.push("Optional Agent setup: weaver-work-cli skills install yepiaotong");
+      }
+      nextActions.push("Verify invoice operations: weaver-work-cli invoice schema");
+      const ok = checks.every((check) => check.ok);
+      ctx.output.write({
+        ok,
+        module: "invoice",
+        checks,
+        skillInstall,
+        nextActions
+      }, {
+        text: [
+          ok ? "Invoice setup checks passed." : "Invoice setup needs attention.",
+          ...checks.map((check) => `- ${check.name}: ${check.ok ? "ok" : "missing"} (${check.detail})`),
+          ...skillInstall ? skillInstall.installed.map((entry) => `- installed skill: ${entry.name} -> ${entry.target}`) : [],
+          ...skillInstall ? skillInstall.warnings.map((warning) => `- warning: ${warning}`) : [],
+          "Next:",
+          ...nextActions.map((actionText) => `- ${actionText}`)
+        ].join("\n")
+      });
+    }));
+  }
+};
+
+// src/cmd/skills/index.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+// src/internal/skills/detector.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
+import { join, resolve as resolve4 } from "node:path";
+var PACKAGED_DETECTOR_VERSION = "1.0.13";
+var PACKAGED_DETECTOR_NAME = `weaver-skill-detector-${PACKAGED_DETECTOR_VERSION}`;
+function packagedDetectorDir() {
+  return packagePath("tools", PACKAGED_DETECTOR_NAME);
+}
+function detectorScriptPath(detectorDir) {
+  return join(detectorDir, "scripts", "validate_skill.py");
+}
+function legacySiblingDetectorDir() {
+  return resolve4(packagedDetectorDir(), "..", "..", "..", PACKAGED_DETECTOR_NAME);
+}
+function detectorVersion(detectorDir) {
+  let version = PACKAGED_DETECTOR_VERSION;
+  const metaPath = join(detectorDir, "_meta.json");
+  if (existsSync5(metaPath)) {
+    try {
+      const meta = JSON.parse(readFileSync3(metaPath, "utf8"));
+      if (typeof meta.version === "string" && meta.version) version = meta.version;
+    } catch {
+      version = PACKAGED_DETECTOR_VERSION;
+    }
+  }
+  return version;
+}
+function resolveDetectorInfo(detectorDir) {
+  const candidates = detectorDir ? [resolve4(detectorDir)] : [packagedDetectorDir(), legacySiblingDetectorDir()].map((candidate) => resolve4(candidate));
+  for (const candidate of candidates) {
+    const scriptPath = detectorScriptPath(candidate);
+    if (existsSync5(scriptPath)) {
+      return { detectorDir: candidate, scriptPath, version: detectorVersion(candidate) };
+    }
+  }
+  throw new CliError(`weaver skill detector is not available; checked: ${candidates.map(detectorScriptPath).join(", ")}`, 2 /* UsageError */);
+}
+
+// src/internal/skills/reader.ts
+import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { relative as relative2, resolve as resolve5, sep as sep2 } from "node:path";
+var SKILL_PREFIX2 = "weaver-e10-";
+var LEGACY_SKILL_PREFIX2 = "weaver-work-cli-";
+var SkillReader = class {
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  list() {
+    return readdirSync3(this.root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => this.skillInfo(entry.name)).filter((entry) => Boolean(entry)).sort((a, b) => a.name.localeCompare(b.name));
+  }
+  listPath(target) {
+    const { name, subpath } = splitTarget(target);
+    const skill = this.resolveSkill(name);
+    const skillRoot = skill.root;
+    const dir = this.resolveInside(skillRoot, subpath);
+    const info = statSync2(dir);
+    if (!info.isDirectory()) {
+      throw new Error(`path is a file, not a directory: ${target}`);
+    }
+    const listed = cleanOutputPath(skill.name, subpath);
+    const entries = readdirSync3(dir, { withFileTypes: true }).map((entry) => ({
+      path: cleanOutputPath(listed, entry.name),
+      isDir: entry.isDirectory()
+    })).sort((a, b) => a.path.localeCompare(b.path));
+    return { path: listed, entries };
+  }
+  read(target, pathArg = "") {
+    const split = splitTarget(target);
+    const skill = this.resolveSkill(split.name);
+    const subpath = pathArg || split.subpath || "SKILL.md";
+    const file = this.resolveInside(skill.root, subpath);
+    const info = statSync2(file);
+    if (info.isDirectory()) {
+      throw new Error(`path is a directory, not a file: ${cleanOutputPath(skill.name, subpath)}`);
+    }
+    return {
+      skill: skill.name,
+      path: cleanOutputPath(subpath),
+      content: readFileSync4(file, "utf-8")
+    };
+  }
+  skillInfo(name) {
+    try {
+      const skillRoot = this.ensureSkill(name);
+      const content = readFileSync4(resolve5(skillRoot, "SKILL.md"), "utf-8");
+      const frontmatter = parseFrontmatter(content);
+      return {
+        name,
+        title: frontmatter.name,
+        description: frontmatter.description,
+        version: frontmatter.version
+      };
+    } catch {
+      return null;
+    }
+  }
+  ensureSkill(name) {
+    return this.resolveSkill(name).root;
+  }
+  resolveSkill(name) {
+    if (!name || name.includes("/") || name.includes("\\") || name === "." || name === "..") {
+      throw new Error(`unknown skill: ${name}`);
+    }
+    const skillRoot = this.resolveInside(this.root, name);
+    if (!existsDirectoryWithSkill(skillRoot)) {
+      const normalized = normalizeLegacySkillName(name);
+      if (normalized !== name) {
+        const normalizedRoot = this.resolveInside(this.root, normalized);
+        if (existsDirectoryWithSkill(normalizedRoot)) return { name: normalized, root: normalizedRoot };
+      }
+    }
+    const info = statSync2(skillRoot);
+    if (!info.isDirectory()) throw new Error(`unknown skill: ${name}`);
+    statSync2(resolve5(skillRoot, "SKILL.md"));
+    return { name, root: skillRoot };
+  }
+  resolveInside(base, subpath = "") {
+    const cleaned = subpath.replace(/\\/g, "/");
+    if (cleaned.startsWith("/") || cleaned.split("/").includes("..")) {
+      throw new Error(`invalid skill path: ${subpath}`);
+    }
+    const target = resolve5(base, cleaned || ".");
+    const rel = relative2(base, target);
+    if (rel === ".." || rel.startsWith(`..${sep2}`) || resolve5(base) === target && cleaned === "..") {
+      throw new Error(`invalid skill path: ${subpath}`);
+    }
+    return target;
+  }
+};
+function normalizeLegacySkillName(name) {
+  return name.startsWith(LEGACY_SKILL_PREFIX2) ? `${SKILL_PREFIX2}${name.slice(LEGACY_SKILL_PREFIX2.length)}` : name;
+}
+function existsDirectoryWithSkill(skillRoot) {
+  try {
+    const info = statSync2(skillRoot);
+    if (!info.isDirectory()) return false;
+    statSync2(resolve5(skillRoot, "SKILL.md"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function splitTarget(target) {
+  const index = target.indexOf("/");
+  if (index === -1) return { name: target, subpath: "" };
+  return {
+    name: target.slice(0, index),
+    subpath: target.slice(index + 1)
+  };
+}
+function cleanOutputPath(...parts) {
+  return parts.filter(Boolean).join("/").replace(/\/+/g, "/").replace(/^\.\//, "");
+}
+function parseFrontmatter(content) {
+  const lines = content.split(/\r?\n/u);
+  if (lines[0] !== "---") return {};
+  const result = {};
+  for (let index = 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (line === "---") return result;
+    const match = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/u);
+    if (!match) continue;
+    result[match[1]] = match[2].replace(/^['"]|['"]$/g, "");
+  }
+  return {};
+}
+
+// src/cmd/skills/index.ts
+var SKILLS_DIR2 = packagePath("skills");
+function reader() {
+  if (!existsSync6(SKILLS_DIR2)) {
+    throw new CliError("skills directory does not exist: " + SKILLS_DIR2);
+  }
+  return new SkillReader(SKILLS_DIR2);
+}
+function commandOptions(value) {
+  if (!value || typeof value !== "object" || !("opts" in value)) return {};
+  const opts = value.opts();
+  return opts && typeof opts === "object" ? opts : {};
+}
+function describeRoot(resolution) {
+  if (resolution.source === "target-dir") return "\u7531 --target-dir \u6307\u5B9A";
+  if (resolution.source === "explicit-env") {
+    return `\u7531 ${resolution.environmentVariable || "\u5BBF\u4E3B\u73AF\u5883\u53D8\u91CF"} \u6307\u5B9A\uFF08${resolution.host}\uFF09`;
+  }
+  if (resolution.source === "host-detected") return `\u81EA\u52A8\u63A2\u6D4B\u5BBF\u4E3B ${resolution.host}`;
+  if (resolution.source === "filesystem-detected") return `\u7531\u672C\u673A\u552F\u4E00\u5DF2\u5B58\u5728\u7684\u5BBF\u4E3B\u76EE\u5F55\u63A8\u65AD\uFF08${resolution.host}\uFF09`;
+  return "\u65E0\u6CD5\u53EF\u9760\u5224\u65AD\u5BBF\u4E3B";
+}
+function pythonInvocation(opts) {
+  if (opts.python) return { command: opts.python, args: [] };
+  if (process.platform === "win32") return { command: "py", args: ["-3"] };
+  return { command: "python3", args: [] };
+}
+function detectorArgs(target, opts, globalJson) {
+  const args = [target];
+  if (opts.json || globalJson) args.push("--json");
+  if (opts.noHtml || opts.html === false) args.push("--no-html");
+  if (opts.out) args.push("--out", opts.out);
+  if (typeof opts.html === "string") args.push("--html", opts.html);
+  if (opts.platform) args.push("--platform", opts.platform);
+  if (opts.marketCatalog) args.push("--market-catalog", opts.marketCatalog);
+  if (opts.marketLive) args.push("--market-live");
+  return args;
+}
+var skillsCommand = {
+  name: "skills",
+  description: "Read packaged agent skill content",
+  category: "skills",
+  register({ program, action }) {
+    const skills = program.command("skills").description("Read packaged agent skill content");
+    skills.command("list").description("List skills, or list one layer under a skill path").argument("[target]", "skill name or name/path").option("--json", "accepted for symmetry; output is always JSON").action(action((ctx, target) => {
+      const skillReader = reader();
+      if (typeof target !== "string" || !target) {
+        const listed2 = skillReader.list();
+        ctx.output.write({ ok: true, skills: listed2, count: listed2.length }, { json: true });
+        return;
+      }
+      const listed = skillReader.listPath(target);
+      ctx.output.write({ ok: true, ...listed, count: listed.entries.length }, { json: true });
+    }));
+    skills.command("read").description("Print a skill SKILL.md or a file under the skill").argument("<target>", "skill name or name/path").argument("[path]", "path under the skill").option("--json", "output as a JSON envelope instead of raw markdown").action(action((ctx, target, pathArg, command) => {
+      if (typeof target !== "string") throw new CliError("target must be a string");
+      const opts = commandOptions(command || pathArg);
+      const result = reader().read(target, typeof pathArg === "string" ? pathArg : "");
+      if (opts.json || ctx.getGlobalOptions().json) {
+        ctx.output.write(result, { json: true });
+        return;
+      }
+      ctx.output.raw(result.content);
+    }));
+    skills.command("install").description("Install packaged skills into the current Agent skills directory").argument("[target]", "skill name (weaver-e10-* or legacy weaver-work-cli-*), short name such as skill-maker, or all", "all").option("--target-dir <path>", "override target skills directory").action(action((ctx, target, options) => {
+      const opts = options && typeof options === "object" ? options : {};
+      const specified = typeof opts.targetDir === "string" && opts.targetDir.trim() ? resolveSkillsTargetPath(opts.targetDir) : "";
+      const resolution = specified ? { root: specified, host: "explicit", source: "target-dir" } : resolveSkillsRoot(ctx.env);
+      if (resolution.requiresExplicitTarget) {
+        throw new CliError(unresolvedSkillsRootMessage(resolution), 2 /* UsageError */);
+      }
+      const targetRoot = resolution.root;
+      const result = installPackagedSkills(SKILLS_DIR2, targetRoot, typeof target === "string" ? target : "all");
+      const warnings = resolution.source === "filesystem-detected" ? ["\u63D0\u793A\uFF1A\u8BE5\u76EE\u5F55\u4EC5\u6839\u636E\u672C\u673A\u5DF2\u6709\u76EE\u5F55\u63A8\u65AD\uFF1B\u5982\u4E0E\u5F53\u524D\u667A\u80FD\u4F53\u4E0D\u7B26\uFF0C\u8BF7\u7528 --target-dir \u6216 WEAVER_SKILLS_ROOT \u6307\u5B9A\u3002"] : [];
+      ctx.output.write({
+        ...result,
+        targetRoot,
+        skillsHost: resolution.host,
+        skillsRootSource: resolution.source,
+        warnings
+      }, {
+        text: [
+          `Skills root: ${targetRoot}\uFF08${describeRoot(resolution)}\uFF09`,
+          "Installed packaged skills:",
+          ...result.installed.map((entry) => `- ${entry.name} -> ${entry.target}`),
+          ...warnings
+        ].join("\n")
+      });
+    }));
+    skills.command("validate").description("Validate a generated skill using the packaged Weaver skill detector").argument("<target>", "skill directory, SKILL.md, or skill zip").option("--detector-dir <path>", "override detector directory; defaults to the packaged detector").option("--python <path>", "Python executable; defaults to python3, or py -3 on Windows").option("--json", "ask the detector to print JSON").option("--no-html", "disable detector HTML report output").option("--out <path>", "write detector markdown report").option("--html <path>", "write detector HTML report").option("--platform <platform>", "detector platform: weaver or qwenwork").option("--market-catalog <path>", "detector market catalog JSON").option("--market-live", "enable detector live market checks").action(action((ctx, target, options) => {
+      if (typeof target !== "string") throw new CliError("target must be a string");
+      const opts = options && typeof options === "object" ? options : {};
+      const detector = resolveDetectorInfo(opts.detectorDir);
+      const python = pythonInvocation(opts);
+      const child = spawnSync(python.command, [
+        ...python.args,
+        detector.scriptPath,
+        ...detectorArgs(target, opts, Boolean(ctx.getGlobalOptions().json))
+      ], { stdio: "inherit" });
+      if (child.error) throw new CliError(`failed to run Python detector: ${child.error.message}`);
+      if (typeof child.status === "number") {
+        process.exitCode = child.status;
+        return;
+      }
+      if (child.signal) throw new CliError(`detector terminated by signal: ${child.signal}`);
+      throw new CliError("detector exited without a status code");
+    }));
+  }
+};
+
+// src/cmd/index.ts
+var builtinCommands = [
+  configCommand,
+  docsCommand,
+  doctorCommand,
+  commandsCommand,
+  runCommand,
+  refsCommand,
+  e10Command,
+  identityCommand,
+  setupCommand,
+  skillsCommand
+];
+
+// src/core/input.ts
+var FileInputPolicyError = class extends CliError {
+  type = "policy";
+  subtype = "file_input_denied";
+  retryable = false;
+  constructor() {
+    super(
+      "\u4E0D\u5141\u8BB8\u901A\u8FC7 --input <path> \u8BFB\u53D6 JSON \u6587\u4EF6\u3002\u8BF7\u6539\u7528 --input-json\u3001--input -\uFF0C\u6216\u7528 --input-ref \u4F20\u9012\u4E0A\u4E00\u6B65\u7684\u7ED3\u679C\u3002",
+      6 /* PolicyError */
+    );
+    this.name = "FileInputPolicyError";
+  }
+};
+function configuredPolicy(ctx) {
+  const io = ctx.config.get("io");
+  if (io && typeof io === "object" && !Array.isArray(io) && "fileInput" in io) {
+    return io.fileInput;
+  }
+  return ctx.config.get("io.fileInput");
+}
+function resolveFileInputPolicy(ctx, options) {
+  const allow = options.allowFileInput === true;
+  const deny = options.fileInput === false;
+  if (allow && deny) {
+    throw new CliError("\u4E0D\u80FD\u540C\u65F6\u4F20 --allow-file-input \u548C --no-file-input", 2 /* UsageError */);
+  }
+  if (allow) return "allow";
+  if (deny) return "deny";
+  const fromEnv = (ctx.env.WEAVER_WORK_CLI_FILE_INPUT ?? "").trim().toLowerCase();
+  if (fromEnv === "allow" || fromEnv === "warn" || fromEnv === "deny") return fromEnv;
+  const fromConfig = configuredPolicy(ctx);
+  if (fromConfig === "allow" || fromConfig === "warn" || fromConfig === "deny") return fromConfig;
+  return "warn";
+}
+function guardFileInput(ctx, options) {
+  const input = options.input;
+  if (input === void 0 || input === null || String(input).trim() === "" || input === "-") return;
+  const policy = resolveFileInputPolicy(ctx, options);
+  if (policy === "allow") return;
+  if (policy === "deny") throw new FileInputPolicyError();
+  process.stderr.write(
+    "[weaver-work-cli] \u4F7F\u7528 --input <path> \u8BFB\u53D6 JSON \u6587\u4EF6\uFF1B\u591A\u6B65\u4F20\u9012\u8BF7\u4F18\u5148\u7528 --input-ref\uFF0C\u7B80\u5355\u6570\u636E\u8BF7\u7528 --input-json\u3002\n"
+  );
+}
+
+// src/cmd/action.ts
+function commandFromArgs(args) {
+  const last = args[args.length - 1];
+  return last && typeof last === "object" && "name" in last && "opts" in last ? last : void 0;
+}
+function optionsHolderFrom(args) {
+  return args.find((arg) => Boolean(
+    arg && typeof arg === "object" && !Array.isArray(arg) && !("opts" in arg) && ("inputRef" in arg || "pick" in arg || "pickAs" in arg || "allowFileInput" in arg || "fileInput" in arg)
+  ));
+}
+function applyRefInput(ctx, args) {
+  const holder = optionsHolderFrom(args);
+  if (!holder) return;
+  const refId = String(holder.inputRef ?? "").trim();
+  if (!refId) {
+    if (holder.pick || holder.pickAs) {
+      throw new RefError("input_ref_required", "--pick \u548C --pick-as \u5FC5\u987B\u4E0E --input-ref \u4E00\u8D77\u4F7F\u7528");
+    }
+    return;
+  }
+  if (holder.inputJson !== void 0 || holder.input !== void 0) {
+    throw new RefError("input_conflict", "\u4E0D\u80FD\u540C\u65F6\u4F20 --input-ref \u4E0E --input/--input-json");
+  }
+  const pick = holder.pick === void 0 || holder.pick === null || holder.pick === "" ? void 0 : String(holder.pick);
+  const pickAs = holder.pickAs === void 0 || holder.pickAs === null || holder.pickAs === "" ? void 0 : String(holder.pickAs);
+  holder.inputJson = JSON.stringify(resolveRefInput(ctx, {
+    refId,
+    ...pick ? { pick } : {},
+    ...pickAs ? { pickAs } : {}
+  }));
+  delete holder.inputRef;
+  delete holder.pick;
+  delete holder.pickAs;
+}
+function cleanupRefs(ctx) {
+  try {
+    pruneRefs(ctx, { maxCount: refMaxCount(ctx), maxBytes: refMaxBytes(ctx) });
+  } catch {
+    process.stderr.write("[weaver-work-cli] \u6682\u5B58\u7ED3\u679C\u6E05\u7406\u5931\u8D25\uFF1B\u672C\u6B21\u547D\u4EE4\u7EE7\u7EED\u6267\u884C\u3002\n");
+  }
+}
+function isRefsShow(command) {
+  const names = [];
+  let current = command;
+  while (current) {
+    const name = current.name();
+    if (name) names.unshift(name);
+    current = current.parent;
+  }
+  return names.slice(-2).join(" ") === "refs show";
+}
+function createAction(ctx) {
+  return (handler) => async (...args) => {
+    const commandCtx = ctx.forCommand(commandFromArgs(args));
+    try {
+      await commandCtx.hooks.beforeCommand(commandCtx);
+      applyRefInput(commandCtx, args);
+      const options = commandCtx.activeCommand?.opts();
+      if (options) guardFileInput(commandCtx, options);
+      if (!isRefsShow(commandCtx.activeCommand)) cleanupRefs(commandCtx);
+      const result = await handler(commandCtx, ...args);
+      await commandCtx.hooks.afterCommand(commandCtx, result);
+    } catch (error) {
+      await commandCtx.hooks.onError(commandCtx, error);
+      if (shouldReportPlatformError(error)) {
+        process.stderr.write(JSON.stringify(toPlatformError(error)) + "\n");
+      }
+      if (commandCtx.getGlobalOptions().json) {
+        console.error(JSON.stringify({
+          schemaVersion: 1,
+          ok: false,
+          error: toErrorEnvelope(error)
+        }, null, 2));
+        process.exitCode = isCliError(error) ? error.exitCode : 1 /* GeneralError */;
+        return;
+      }
+      if (isCliError(error)) {
+        commandCtx.logger.error(error.message);
+        process.exitCode = error.exitCode;
+        return;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      commandCtx.logger.error(message);
+      process.exitCode = 1 /* GeneralError */;
+    }
+  };
+}
+
+// src/cmd/register.ts
+var IO_CHANNEL_OPTIONS = [
+  { flags: "--input-ref <ref>", description: "consume a persisted large result reference" },
+  { flags: "--pick <path>", description: "pick a sub path from --input-ref, e.g. items[0].fid" },
+  { flags: "--pick-as <field>", description: "map a scalar picked value to this input field, e.g. fid" },
+  { flags: "--allow-file-input", description: "allow reading JSON input from --input <path>" },
+  { flags: "--no-file-input", description: "reject JSON input from --input <path>" }
+];
+function ensureRefInputOptions(command) {
+  if (command.commands.length === 0) {
+    for (const option of IO_CHANNEL_OPTIONS) {
+      const long = option.flags.split(" ")[0];
+      if (!command.options.some((existing) => existing.long === long)) {
+        command.option(option.flags, option.description);
+      }
+    }
+    return;
+  }
+  for (const child of command.commands) {
+    ensureRefInputOptions(child);
+  }
+}
+async function registerCommands(program, ctx, commands) {
+  ctx.commands = commands.map((command) => ({
+    name: command.name,
+    description: command.description,
+    category: command.category
+  }));
+  ctx.modules = ctx.commands;
+  for (const command of commands) {
+    if (command.hooks) {
+      ctx.hooks.register(command.hooks);
+    }
+  }
+  const action = createAction(ctx);
+  for (const command of commands) {
+    await command.register({ program, ctx, action });
+  }
+  ensureRefInputOptions(program);
+}
+
+// src/cmd/root.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+
+// src/core/context.ts
+import { homedir as homedir2 } from "node:os";
+import { resolve as resolve7 } from "node:path";
+
+// src/core/config-store.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname } from "node:path";
+var ConfigStore = class {
+  constructor(getPath) {
+    this.getPath = getPath;
+  }
+  getPath;
+  path() {
+    return this.getPath();
+  }
+  all() {
+    const filePath = this.path();
+    if (!existsSync7(filePath)) return {};
+    try {
+      const value = JSON.parse(readFileSync5(filePath, "utf-8"));
+      return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    } catch {
+      return {};
+    }
+  }
+  get(key) {
+    return this.all()[key];
+  }
+  set(key, value) {
+    const data = this.all();
+    data[key] = value;
+    this.save(data);
+  }
+  delete(key) {
+    const data = this.all();
+    const existed = Object.prototype.hasOwnProperty.call(data, key);
+    delete data[key];
+    this.save(data);
+    return existed;
+  }
+  save(data) {
+    const filePath = this.path();
+    mkdirSync2(dirname(filePath), { recursive: true });
+    writeFileSync2(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  }
+};
+
+// src/core/logger.ts
+var Logger = class {
+  constructor(getOptions) {
+    this.getOptions = getOptions;
+  }
+  getOptions;
+  /**
+   * 机器模式：进度与提示改走 stderr，stdout 只留给结构化结果。
+   *
+   * 只有显式开启的平台型命令（如 `auth init`）会打开它，默认关闭，
+   * 因此既有命令的 stdout 输出口径完全不变。
+   */
+  machineMode = false;
+  info(message) {
+    if (this.machineMode) {
+      console.error(message);
+      return;
+    }
+    const opts = this.getOptions();
+    if (!opts.quiet && !opts.json) {
+      console.log(message);
+    }
+  }
+  warn(message) {
+    const opts = this.getOptions();
+    if (!opts.quiet && !opts.json) {
+      console.warn(message);
+    }
+  }
+  error(message) {
+    console.error(message);
+  }
+  debug(message) {
+    const opts = this.getOptions();
+    if (opts.verbose && !opts.json) {
+      console.error("[debug] " + message);
+    }
+  }
+};
+
+// src/core/context.ts
+function createCliContext(program, hooks, packageInfo) {
+  const getGlobalOptions = () => normalizeGlobalOptions(program.opts());
+  const configStore = new ConfigStore(() => {
+    const opts = getGlobalOptions();
+    const home = process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve7(homedir2(), ".weaver-work-cli");
+    return opts.config ? resolve7(opts.config) : resolve7(home, "config.json");
+  });
+  const partialCtx = {
+    cwd: process.cwd(),
+    env: process.env,
+    program,
+    hooks,
+    packageInfo,
+    commands: [],
+    modules: [],
+    getGlobalOptions,
+    forCommand(command) {
+      return { ...ctx, activeCommand: command };
+    }
+  };
+  const ctx = partialCtx;
+  ctx.logger = new Logger(getGlobalOptions);
+  ctx.output = new Output(ctx);
+  ctx.config = configStore;
+  return ctx;
+}
+
+// src/core/hooks.ts
+var HookManager = class {
+  hooks = {
+    beforeCommand: [],
+    afterCommand: [],
+    onError: [],
+    beforeRun: [],
+    afterRun: []
+  };
+  e10RequestInterceptors = [];
+  register(hooks) {
+    for (const [name, handler] of Object.entries(hooks)) {
+      if (handler) {
+        this.hooks[name].push(handler);
+      }
+    }
+  }
+  async beforeCommand(ctx) {
+    for (const hook of this.hooks.beforeCommand) {
+      await hook(ctx);
+    }
+  }
+  async afterCommand(ctx, result) {
+    for (const hook of this.hooks.afterCommand) {
+      await hook(ctx, result);
+    }
+  }
+  async onError(ctx, error) {
+    for (const hook of this.hooks.onError) {
+      await hook(ctx, error);
+    }
+  }
+  async beforeRun(ctx) {
+    for (const hook of this.hooks.beforeRun) {
+      await hook(ctx);
+    }
+  }
+  async afterRun(ctx, result) {
+    for (const hook of this.hooks.afterRun) {
+      await hook(ctx, result);
+    }
+  }
+  registerE10RequestInterceptor(interceptor) {
+    this.e10RequestInterceptors.push(interceptor);
+  }
+  getE10RequestInterceptors() {
+    return this.e10RequestInterceptors;
+  }
+};
+
+// src/cmd/root.ts
+var CLI_COMMAND_NAME = "weaver-work-cli";
+function readPackageInfo2() {
+  const pkg = JSON.parse(readFileSync6(packagePath("package.json"), "utf-8"));
+  return {
+    name: pkg.name || CLI_COMMAND_NAME,
+    version: pkg.version || "0.0.0",
+    description: pkg.description
+  };
+}
+function createProgram() {
+  const packageInfo = readPackageInfo2();
+  const program = new Command();
+  const hooks = new HookManager();
+  const ctx = createCliContext(program, hooks, packageInfo);
+  program.name(CLI_COMMAND_NAME).description(packageInfo.description || "Extensible TypeScript CLI").version(packageInfo.version).option("--json", "print command output as JSON").option("--quiet", "suppress non-error logs").option("--verbose", "print debug logs").option("--config <path>", "use a custom weaver-work-cli config file").option("--auth <path>", "use a specific E10 auth file").option("--profile <name>", "use a specific E10 profile").option("--runtime-agent <name>", "identify the current agent runtime (for example: xiaoe)").option(
+    "--is-connector [value]",
+    "run as the WorkBuddy connector: use the fixed E10 profile managed by the connector"
+  ).option("--base-url <url>", "override E10 base URL").option("--passport-url <url>", "override E10 passport URL");
+  program.showHelpAfterError();
+  return { program, ctx };
+}
+
+export {
+  firstPositionalToken,
+  toCommandMetadata,
+  builtinCommands,
+  registerCommands,
+  createProgram
+};