diff --git a/internal/auth/login.go b/internal/auth/login.go
index cf59054..18ea099 100644
--- a/internal/auth/login.go
+++ b/internal/auth/login.go
@@ -123,10 +123,11 @@ func Login(username, password string) (*LoginResult, error) {
 		}
 	}
 
-	return nil, fmt.Errorf("login succeeded but token verification failed: %w", lastErr)
+	return nil, fmt.Errorf("login succeeded but token verification failed (%v).\n\nPlease use private token instead:\n  1. Visit https://www.gitlink.org.cn/tokens → Create a new token\n  2. Run: gitlink-cli auth login --token\n  3. Paste your private token", lastErr)
 }
 
 // GetCurrentUser fetches the authenticated user info.
+// Returns error if not authenticated or token is invalid.
 func GetCurrentUser() (map[string]interface{}, error) {
 	cfg, err := config.Load()
 	if err != nil {
@@ -145,10 +146,25 @@ func GetCurrentUser() (map[string]interface{}, error) {
 		return nil, err
 	}
 
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(data))
+	}
+
 	var result map[string]interface{}
 	if err := json.Unmarshal(data, &result); err != nil {
 		return nil, err
 	}
 
+	// GitLink returns {"status": -1, "message": "..."} for auth errors with HTTP 200
+	if status, ok := result["status"].(float64); ok && status < 0 {
+		msg, _ := result["message"].(string)
+		return nil, fmt.Errorf("%s", msg)
+	}
+
+	// Verify we got actual user data
+	if _, ok := result["login"]; !ok {
+		return nil, fmt.Errorf("invalid response: missing login field")
+	}
+
 	return result, nil
 }
diff --git a/npm/package.json b/npm/package.json
index f33ccd8..797f109 100644
--- a/npm/package.json
+++ b/npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gitlink-ai/cli",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "GitLink 平台官方命令行工具 — 代码托管、协作开发和自动化",
   "bin": {
     "gitlink-cli": "bin/cli.js",