feat: add standalone login renewal

test/client-installer.test.ts

@@ -98,7 +98,9 @@ test("generic installer preserves identity across safe updates, rollback, downgr
     ["https://approval.example.test/downloads/manifest.sig", signature],
     ...Object.entries(manifest.artifacts).map(([name, artifact]) => [artifact.url, bodies[name as keyof typeof bodies]] as [string, Buffer]),
   ]);
+  let downloadCalls = 0;
   const fetchFn = async (input: string | URL | Request) => {
+    downloadCalls += 1;
     const url = String(input);
     const body = responses.get(url);
     return body ? new Response(new Uint8Array(body), { status: 200 }) : new Response("missing", { status: 404 });
@@ -122,6 +124,11 @@ test("generic installer preserves identity across safe updates, rollback, downgr
   assert.match(installOutput.nextSteps.join(" "), /立即处理 postInstall.*不得等待用户首次查询审批/s);
   assert.equal(installOutput.postInstall.status, "authorization_required");
   assert.equal(installOutput.postInstall.authChallenge.directUrl, "https://approval.example.test/oauth/device?user_code=INSTALL-1234");
+  assert.deepEqual(installOutput.loginCommand, {
+    command: join(appRoot, "bin", process.platform === "win32" ? "dingtalk-approval.cmd" : "dingtalk-approval"),
+    args: ["login", "--json"],
+  });
+  assert.deepEqual(installOutput.postInstall.loginCommand, installOutput.loginCommand);
   assert.deepEqual(installOutput.postInstall.confirmTool, { name: "approval_login", arguments: {} });
   assert.deepEqual(installOutput.postInstall.verifyTool, {
     name: "approval_list_todos", arguments: { source: "all", query: "", limit: 1 },
@@ -137,6 +144,27 @@ test("generic installer preserves identity across safe updates, rollback, downgr
   assert.doesNotMatch(readFileSync(paths.bridgeCommand, "utf8"), /--url/);
   const stableBridgePath = paths.bridgeCommand;
   const initialRuntime = state.runtimeDir;
+
+  const callsBeforeStandaloneLogin = downloadCalls;
+  output.length = 0;
+  assert.equal(await runClientInstaller(["login", "--app-root", appRoot, "--json"], commandContext), 0);
+  const loginOutput = JSON.parse(output.pop()!);
+  assert.equal(loginOutput.operation, "login");
+  assert.equal(loginOutput.status, "authorization_required");
+  assert.equal(loginOutput.authChallenge.directUrl, "https://approval.example.test/oauth/device?user_code=INSTALL-1234");
+  assert.deepEqual(loginOutput.loginCommand, installOutput.loginCommand);
+  assert.equal(downloadCalls, callsBeforeStandaloneLogin, "standalone login must not download or reinstall artifacts");
+
+  output.length = 0;
+  assert.equal(await runClientInstaller(["login", "--app-root", appRoot, "--json"], {
+    ...commandContext, env: { ...env, FAKE_BRIDGE_AUTHENTICATED: "1" },
+  }), 0);
+  const authenticatedLogin = JSON.parse(output.pop()!);
+  assert.equal(authenticatedLogin.status, "authenticated");
+  assert.equal(authenticatedLogin.authenticated, true);
+  assert.equal(authenticatedLogin.authChallenge, undefined);
+  assert.equal(downloadCalls, callsBeforeStandaloneLogin, "authenticated login check must stay local except for the Bridge flow");
+
   mkdirSync(dirname(paths.sessionFile), { recursive: true });
   const sessionBody = Buffer.from(`${JSON.stringify({
     authenticated: true,
@@ -273,6 +301,9 @@ test("generic installer preserves identity across safe updates, rollback, downgr
   });
   assert.equal(removed, 0);
   assert.equal(existsSync(appRoot), false);
+  output.length = 0;
+  assert.equal(await runClientInstaller(["login", "--app-root", appRoot, "--json"], commandContext), 1);
+  assert.match(JSON.parse(output.pop()!).error, /尚未安装/);
 });
 
 function manifestFixture(
@@ -311,7 +342,11 @@ function digest(value: Buffer): string { return createHash("sha256").update(valu
 function createFakeNpm(bin: string): void {
   const fakeBridge = `#!/usr/bin/env node
 if (process.env.FAKE_BRIDGE_FAIL === "1") process.exit(2);
-if (process.argv.includes("--post-install-login")) {
+if (process.argv.includes("--login") || process.argv.includes("--post-install-login")) {
+  if (process.env.FAKE_BRIDGE_AUTHENTICATED === "1") {
+    console.log(JSON.stringify({ authenticated: true, message: "已登录，可以读取审批。" }));
+    process.exit(0);
+  }
   console.log(JSON.stringify({
     authenticated: false,
     message: "需要完成钉钉授权登录。",