fix(plugins): repair Windows DingTalk authorization

executor/src/runtime_work/local_connector_auth.rs

@@ -238,12 +238,10 @@ fn resolve_plugin_root_candidates(
         ));
     }
 
-    let home = env::var_os("HOME")
-        .map(PathBuf::from)
-        .ok_or_else(|| AppIpcError::new("internal_error", "HOME is not set"))?;
-    let executor_home = env::var_os("WEGENT_EXECUTOR_HOME")
-        .map(PathBuf::from)
-        .unwrap_or_else(|| home.join(".wegent-executor"));
+    let executor_home = resolve_executor_home(
+        env::var_os("WEGENT_EXECUTOR_HOME").map(PathBuf::from),
+        dirs::home_dir(),
+    )?;
 
     let mut candidates: Vec<PathBuf> = Vec::new();
     let store_plugins = executor_home.join("capabilities/store/plugins");
@@ -286,6 +284,15 @@ fn resolve_plugin_root_candidates(
     Ok(candidates)
 }
 
+fn resolve_executor_home(
+    configured_executor_home: Option<PathBuf>,
+    platform_home: Option<PathBuf>,
+) -> Result<PathBuf, AppIpcError> {
+    configured_executor_home
+        .or_else(|| platform_home.map(|home| home.join(".wegent-executor")))
+        .ok_or_else(|| AppIpcError::new("internal_error", "Home directory is not available"))
+}
+
 fn has_plugin_manifest(path: &Path) -> bool {
     path.join(".codex-plugin/plugin.json").is_file()
         || path.join(".claude-plugin/plugin.json").is_file()
@@ -454,6 +461,22 @@ fn browser_auth_sessions() -> &'static Mutex<HashMap<String, BrowserAuthSession>
     BROWSER_AUTH_SESSIONS.get_or_init(|| Mutex::new(HashMap::new()))
 }
 
+async fn active_browser_auth_state(plugin_key: &str, connector_slug: &str) -> Option<Value> {
+    let state = {
+        let sessions = browser_auth_sessions().lock().await;
+        sessions
+            .values()
+            .find(|session| {
+                session.plugin_key == plugin_key
+                    && session.connector_slug == connector_slug
+                    && !session.task.is_finished()
+            })
+            .map(|session| Arc::clone(&session.state))
+    }?;
+    let response = state.lock().await.clone();
+    Some(response)
+}
+
 async fn start_browser_auth(
     payload: Value,
     plugin_root: PathBuf,
@@ -466,6 +489,9 @@ async fn start_browser_auth(
         .or_else(|| string_field(&payload, "connector_slug"))
         .or_else(|| string_field(&payload, "slug"))
         .ok_or_else(|| AppIpcError::new("bad_request", "connectorSlug is required"))?;
+    if let Some(state) = active_browser_auth_state(&plugin_key, &connector_slug).await {
+        return Ok(state);
+    }
     let session_id = Uuid::new_v4().to_string();
     let state = Arc::new(Mutex::new(browser_session_state(
         "preparing",
@@ -860,6 +886,43 @@ mod tests {
             .any(|pair| pair == ["--wait-seconds", "0"]));
     }
 
+    #[tokio::test]
+    async fn reuses_active_browser_auth_session_state() {
+        let plugin_key = format!("plugin-{}", Uuid::new_v4());
+        let connector_slug = "browser-auth".to_owned();
+        let session_id = Uuid::new_v4().to_string();
+        let state = Arc::new(tokio::sync::Mutex::new(browser_session_state(
+            "waiting_browser",
+            "Complete authorization in the browser",
+            &session_id,
+        )));
+        let task = tokio::spawn(async { std::future::pending::<()>().await });
+        browser_auth_sessions().lock().await.insert(
+            session_id.clone(),
+            BrowserAuthSession {
+                plugin_key: plugin_key.clone(),
+                connector_slug: connector_slug.clone(),
+                state,
+                task,
+            },
+        );
+
+        let reused = active_browser_auth_state(&plugin_key, &connector_slug)
+            .await
+            .expect("active session");
+
+        assert_eq!(
+            reused.get("sessionId").and_then(Value::as_str),
+            Some(session_id.as_str())
+        );
+        let session = browser_auth_sessions()
+            .lock()
+            .await
+            .remove(&session_id)
+            .expect("inserted session");
+        session.task.abort();
+    }
+
     #[test]
     fn reject_absolute_and_parent_paths() {
         assert!(validate_relative_arg("scripts/run.sh").is_ok());
@@ -921,6 +984,15 @@ mod tests {
         }
     }
 
+    #[test]
+    fn resolve_executor_home_uses_runtime_path_without_platform_home() {
+        let executor_home = PathBuf::from("runtime/executor-home");
+
+        let resolved = resolve_executor_home(Some(executor_home.clone()), None).unwrap();
+
+        assert_eq!(resolved, executor_home);
+    }
+
     #[test]
     fn resolve_plugin_root_prefers_newest_version_directory() {
         let _guard = env_lock();

executor/src/runtime_work/local_connector_auth/tools.rs

@@ -275,13 +275,10 @@ async fn resolve_managed_tool(
 }
 
 fn executor_home() -> Result<PathBuf, AppIpcError> {
-    if let Some(path) = env::var_os("WEGENT_EXECUTOR_HOME") {
-        return Ok(PathBuf::from(path));
-    }
-    env::var_os("HOME")
-        .map(PathBuf::from)
-        .map(|home| home.join(".wegent-executor"))
-        .ok_or_else(|| AppIpcError::new("internal_error", "HOME is not set"))
+    super::resolve_executor_home(
+        env::var_os("WEGENT_EXECUTOR_HOME").map(PathBuf::from),
+        dirs::home_dir(),
+    )
 }
 
 fn current_tool_target() -> Result<String, AppIpcError> {

wework/e2e/desktop/modules/plugin-flows.mjs

@@ -691,6 +691,15 @@ async function verifyMarketplacePluginLifecycle({
   await control.command('waitFor', actionsSelector, {
     timeoutMs: WORKBENCH_READY_TIMEOUT_MS,
   })
+  await waitForSnapshot(
+    control,
+    snapshot =>
+      snapshot.testIds.includes(`plugin-marketplace-actions-${pluginId}`) &&
+      snapshot.testIds.some(
+        testId => testId.startsWith('plugins-installed-strip-item-') && testId.includes(PLUGIN_NAME)
+      ),
+    'The installed marketplace card and installed strip became inconsistent'
+  )
   await control.command('click', actionsSelector)
   const trySelector = `[data-testid="plugin-marketplace-try-${pluginId}"]`
   await control.command('waitFor', trySelector, {

wework/package.json

@@ -133,7 +133,7 @@
     "@vitejs/plugin-react": "^6.0.1",
     "@vitest/coverage-istanbul": "^4.1.8",
     "autoprefixer": "^10.5.0",
-    "dingtalk-workspace-cli": "1.0.54",
+    "dingtalk-workspace-cli": "1.0.58",
     "eslint": "^10.3.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.2",

wework/src/api/local/localConnectorAuth.test.ts

@@ -48,6 +48,14 @@ describe('localConnectorAuthHealth cache', () => {
     await expect(localConnectorAuthHealth(target)).resolves.toEqual({ status: 'ok' })
     expect(mocks.requestLocalExecutor).toHaveBeenCalledTimes(1)
   })
+
+  test('bypasses a cached result while waiting for a fresh local installation', async () => {
+    const target = { pluginKey: 'dingtalk', connectorSlug: 'dingtalk' }
+    await localConnectorAuthHealth(target)
+    await localConnectorAuthHealth(target, { bypassCache: true })
+
+    expect(mocks.requestLocalExecutor).toHaveBeenCalledTimes(2)
+  })
 })
 
 describe('local connector kinds', () => {

wework/src/api/local/localConnectorAuth.ts

@@ -37,6 +37,10 @@ export interface LocalConnectorAuthTarget {
   pluginRoot?: string | null
 }
 
+interface LocalConnectorAuthHealthOptions {
+  bypassCache?: boolean
+}
+
 /** Short TTL so send preflight does not re-probe an already-healthy connector. */
 const OK_HEALTH_TTL_MS = 120_000
 const okHealthCache = new Map<string, number>()
@@ -63,10 +67,13 @@ async function callLocalConnectorAuth(
   })
 }
 
-export function localConnectorAuthHealth(target: LocalConnectorAuthTarget) {
+export function localConnectorAuthHealth(
+  target: LocalConnectorAuthTarget,
+  options: LocalConnectorAuthHealthOptions = {}
+) {
   const key = healthCacheKey(target)
   const cachedAt = okHealthCache.get(key)
-  if (cachedAt != null && Date.now() - cachedAt < OK_HEALTH_TTL_MS) {
+  if (!options.bypassCache && cachedAt != null && Date.now() - cachedAt < OK_HEALTH_TTL_MS) {
     return Promise.resolve({ status: 'ok' as const satisfies LocalConnectorAuthStatus })
   }
   return callLocalConnectorAuth('health', target).then(result => {

wework/src/components/plugins/LocalConnectorAuthDialog.test.tsx

@@ -109,4 +109,34 @@ describe('LocalConnectorAuthDialog browser oauth', () => {
     expect(onCancel).toHaveBeenCalledTimes(1)
     await waitFor(() => expect(authMocks.cancel).toHaveBeenCalledWith(executorTarget, 'session-2'))
   })
+
+  test('keeps the executor session alive when the dialog is remounted by its host', async () => {
+    authMocks.start.mockResolvedValue({
+      status: 'waiting_browser',
+      sessionId: 'session-remount',
+    })
+    authMocks.poll.mockImplementation(() => new Promise(() => undefined))
+
+    const view = render(
+      <LocalConnectorAuthDialog open target={target} onSuccess={vi.fn()} onCancel={vi.fn()} />
+    )
+
+    await waitFor(() => expect(authMocks.start).toHaveBeenCalled())
+    view.unmount()
+    render(<LocalConnectorAuthDialog open target={target} onSuccess={vi.fn()} onCancel={vi.fn()} />)
+
+    await waitFor(() => expect(authMocks.start).toHaveBeenCalledTimes(2))
+    expect(authMocks.cancel).not.toHaveBeenCalled()
+  })
+
+  test('shows a string executor error once', async () => {
+    authMocks.start.mockRejectedValue('internal_error: HOME is not set')
+
+    render(<LocalConnectorAuthDialog open target={target} onSuccess={vi.fn()} onCancel={vi.fn()} />)
+
+    await screen.findByTestId('local-connector-auth-retry')
+    expect(screen.getAllByText('internal_error: HOME is not set')).toHaveLength(1)
+    expect(screen.getByTestId('local-connector-auth-browser-error')).toBeInTheDocument()
+    expect(screen.queryByTestId('local-connector-auth-browser-loading')).not.toBeInTheDocument()
+  })
 })

wework/src/components/plugins/LocalConnectorAuthDialog.tsx

@@ -1,4 +1,4 @@
-import { ExternalLink, Loader2, QrCode, RefreshCw, X } from 'lucide-react'
+import { AlertCircle, ExternalLink, Loader2, QrCode, RefreshCw, X } from 'lucide-react'
 import { useTranslation } from '@/hooks/useTranslation'
 import { cn } from '@/lib/utils'
 import type {
@@ -98,10 +98,24 @@ export function LocalConnectorAuthDialog({
               className="flex h-56 w-56 flex-col items-center justify-center gap-3 rounded-lg border border-dashed bg-background"
               data-testid="local-connector-auth-browser"
             >
-              {status?.status === 'waiting_browser' ? (
-                <ExternalLink className="h-8 w-8 text-muted-foreground" />
+              {error ? (
+                <AlertCircle
+                  className="h-8 w-8 text-destructive"
+                  aria-hidden="true"
+                  data-testid="local-connector-auth-browser-error"
+                />
+              ) : status?.status === 'waiting_browser' ? (
+                <ExternalLink
+                  className="h-8 w-8 text-muted-foreground"
+                  aria-hidden="true"
+                  data-testid="local-connector-auth-browser-waiting"
+                />
               ) : (
-                <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
+                <Loader2
+                  className="h-8 w-8 animate-spin text-muted-foreground"
+                  aria-hidden="true"
+                  data-testid="local-connector-auth-browser-loading"
+                />
               )}
               <span className="text-sm text-muted-foreground">
                 {t('workbench.plugins_local_browser_device_only', '凭据仅保存在此设备')}
@@ -123,8 +137,9 @@ export function LocalConnectorAuthDialog({
               )}
             </div>
           )}
-          <p className="text-center text-sm text-foreground">{statusText}</p>
-          {error ? <p className="text-center text-sm text-destructive">{error}</p> : null}
+          <p className={cn('text-center text-sm', error ? 'text-destructive' : 'text-foreground')}>
+            {statusText}
+          </p>
         </div>
 
         <div className="mt-4 flex justify-end gap-2">