diff --git a/scripts/cli/app.py b/scripts/cli/app.py
index bdb0ff9..b999786 100644
--- a/scripts/cli/app.py
+++ b/scripts/cli/app.py
@@ -4,7 +4,7 @@ CLI entry point: argv dispatch for account-manager v2.
 
 Subcommand tree:
   platform  list/get
-  account   add-web|add-secret|get|list|pick-web|mark-session|mark-error|mark-used
+  account   add-web|add-secret|get|get-credential|list|pick-web|mark-session|mark-error|mark-used
   credential pick|resolve
   lease     release|list|cleanup
   (legacy)  add|list|get|list-json|pick-web|open|delete
@@ -12,6 +12,7 @@ Subcommand tree:
 Machine commands output single-line JSON where appropriate.
 """
 import sys
+from typing import Optional
 
 from service.account_crypto_commands import (
     cmd_account_export_credentials,
@@ -22,6 +23,7 @@ from service.account_service import (
     cmd_account_add_secret,
     cmd_account_add_web,
     cmd_account_get,
+    cmd_account_get_credential,
     cmd_account_list,
     cmd_account_mark_error,
     cmd_account_mark_session,
@@ -63,12 +65,14 @@ _USAGE = """account-manager v2 — Credential & Browser Profile Manager
                   [--label <label>] [--tenant-id <t>] [--environment <env>]
                   [--role <role>] [--provider-code <code>] [--url <url>]
                   [--extra-json <json>] [--profile-dir <path>]
+                  [--auth-strategy <s>] [--session-persistent 0|1] [--device-fingerprint <fp>]
   account add-secret --platform <p> --credential-type <type>
-                     --secret-storage env|windows_credential|none
+                     --secret-storage env|windows_credential|none|local_encrypted
                      [--secret-ref <env_var>] [--secret-stdin]
                      [--label <label>] [--account-id <id>]
                      [--environment <env>] [--role <role>]
   account get <id> [--with-credentials]
+  account get-credential <account_id> [--reveal --lease-token <token>]
   account list [--platform <p>] [--environment <env>]
                [--tenant-id <t>] [--role <role>] [--limit N]
   account pick-web --platform <p> [--environment <env>] [--tenant-id <t>]
@@ -179,6 +183,11 @@ def main() -> None:
             _cmd_add_web(av)
         elif sub == "add-secret":
             _cmd_add_secret(av)
+        elif sub == "get-credential":
+            if len(av) < 4:
+                print("ERROR:CLI_BAD_ARGS account get-credential 需要 <account_id>。")
+                sys.exit(1)
+            _cmd_get_credential(av)
         elif sub == "get":
             if len(av) < 4:
                 print("ERROR:CLI_BAD_ARGS account get 需要 <id>。")
@@ -363,6 +372,17 @@ def _cmd_add_web(argv: list[str]) -> None:
     url = _get_opt(argv, "--url")
     extra_json_str = _get_opt(argv, "--extra-json")
     profile_dir_override = _get_opt(argv, "--profile-dir")
+    auth_strategy = _get_opt(argv, "--auth-strategy")
+    session_persistent_raw = _get_opt(argv, "--session-persistent")
+    device_fingerprint = _get_opt(argv, "--device-fingerprint")
+
+    session_persistent: Optional[int] = None
+    if session_persistent_raw is not None:
+        try:
+            session_persistent = int(session_persistent_raw)
+        except ValueError:
+            print("ERROR:CLI_BAD_ARGS --session-persistent 必须是整数（0 或 1）。")
+            return
 
     if not plat:
         print("ERROR:CLI_BAD_ARGS account add-web 需要 --platform <platform>。")
@@ -379,9 +399,24 @@ def _cmd_add_web(argv: list[str]) -> None:
         url=url,
         extra_json_str=extra_json_str,
         profile_dir_override=profile_dir_override,
+        auth_strategy=auth_strategy,
+        session_persistent=session_persistent,
+        device_fingerprint=device_fingerprint,
     )
 
 
+def _cmd_get_credential(argv: list[str]) -> None:
+    aid_raw = argv[3]
+    try:
+        aid = int(aid_raw)
+    except ValueError:
+        print(f"ERROR:CLI_BAD_ARGS account_id 必须是整数：{aid_raw}")
+        return
+    reveal = _has_flag(argv, "--reveal")
+    lease_token = _get_opt(argv, "--lease-token")
+    cmd_account_get_credential(aid, reveal=reveal, lease_token=lease_token)
+
+
 def _cmd_add_secret(argv: list[str]) -> None:
     plat = _get_opt(argv, "--platform", "")
     ctype = _get_opt(argv, "--credential-type", "api_key")