openxiangda 1.0.0

package/lib/cli.js

@@ -0,0 +1,2423 @@
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const {
+  CONFIG_FILE,
+  PROJECT_STATE_FILE,
+  getProfile,
+  loadConfig,
+  loadProjectState,
+  normalizeBaseUrl,
+  saveConfig,
+  saveProjectState,
+} = require('./config');
+const { requestJson } = require('./http');
+const { getSkillStatusReport, installSkills } = require('./skills');
+const { initWorkspace } = require('./workspace-init');
+const {
+  fail,
+  openBrowser,
+  parseArgs,
+  print,
+  sleep,
+  warn,
+  writeJson,
+} = require('./utils');
+
+async function main(argv) {
+  const [command, ...rest] = argv;
+  if (!command || command === 'help' || command === '--help' || command === '-h') {
+    printHelp();
+    return;
+  }
+
+  if (command === 'login') return login(rest);
+  if (command === 'env') return env(rest);
+  if (command === 'auth') return auth(rest);
+  if (command === 'platform') return platform(rest);
+  if (command === 'workspace') return workspace(rest);
+  if (command === 'app') return app(rest);
+  if (command === 'form') return form(rest);
+  if (command === 'page') return page(rest);
+  if (command === 'menu') return menu(rest);
+  if (command === 'workflow') return workflow(rest);
+  if (command === 'automation') return automation(rest);
+  if (command === 'permission') return permission(rest);
+  if (command === 'settings') return settings(rest);
+  if (command === 'inspect') return inspect(rest);
+  if (command === 'skill') return skill(rest);
+  if (command === 'commands') return commands(rest);
+
+  fail(`未知命令: ${command}`);
+}
+
+function printHelp() {
+  print(`OpenXiangda CLI
+
+Usage:
+  openxiangda login <platform-url> [--profile name]
+  openxiangda platform add <name> <platform-url>
+  openxiangda platform list
+  openxiangda platform use <name>
+  openxiangda auth status|refresh|logout [--profile name]
+  openxiangda env [--profile name]
+  openxiangda workspace init [dir] [--name package-name] [--install] [--profile name --app-type APP_XXX]
+  openxiangda workspace bind --profile <name> --app-type <APP_XXX>
+  openxiangda workspace publish --profile <name>
+  openxiangda app list [--profile name] [--json]
+  openxiangda app create <name> [--profile name] [--description text]
+  openxiangda app snapshot <APP_XXX> [--profile name] [--json]
+  openxiangda form list [--profile name] [--json]
+  openxiangda form create <formCode> [--name text] [--type receipt]  # low-level shell only
+  openxiangda form bind <formCode> --form-uuid <FORM_XXX>
+  openxiangda form pull <formCode|formUuid> [--json]
+  openxiangda form publish <formCode|formUuid> --bundle-url <url>     # repair only
+  openxiangda page list [--profile name] [--json]
+  openxiangda page publish <pageCode> --entry-url <url> --version <v> --build-id <id>  # repair only
+  openxiangda page bind <pageCode> --page-id <id>
+  openxiangda menu list [--profile name] [--json]
+  openxiangda menu create <menuCode> --name <text> --type <nav|receipt|display>
+  openxiangda menu bind <menuCode> --menu-id <id>
+  openxiangda workflow list [--profile name] [--form-code code] [--json]
+  openxiangda workflow create <workflowCode> --form-code <formCode> --definition-json <file>
+  openxiangda workflow bind <workflowCode> --workflow-id <id>
+  openxiangda workflow publish <workflowCode|workflowId>
+  openxiangda automation list [--profile name] [--json]
+  openxiangda automation create <automationCode> --name <text> --trigger-json <file> --definition-json <file>
+  openxiangda automation bind <automationCode> --automation-id <id>
+  openxiangda automation publish|enable|disable <automationCode|automationId>
+  openxiangda permission role-list|role-create|role-bind
+  openxiangda permission page-group-list|page-group-create|page-group-bind
+  openxiangda permission form-group-list|form-group-create|form-group-bind
+  openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access
+  openxiangda inspect app|form|workflow|automation|permissions
+  openxiangda skill install [--agent codex] [--dest <skills-dir>] [--force] [--dry-run] [--json]
+  openxiangda skill status [--agent codex] [--dest <skills-dir>] [--json]
+
+OpenXiangda 使用普通用户登录 token，不需要 AK/SK。
+表单页、流程表单页和代码页的主链路是 sy-lowcode-app-workspace + openxiangda workspace publish。
+JS_CODE V2 使用 trusted_node；AI 源码必须写在 src/js-code-nodes/<scriptCode>/index.ts，definition-json 中的 sourceFile.localPath 会在 validate/create 时先 TS 校验、再构建并上传为快照。`);
+}
+
+async function platform(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+
+  if (subcommand === 'add') {
+    const [name, rawUrl] = positional;
+    if (!name || !rawUrl) {
+      fail('用法: openxiangda platform add <name> <platform-url>');
+    }
+    const baseUrl = normalizeBaseUrl(rawUrl);
+    const existing = config.profiles[name] || {};
+    const urlChanged = existing.baseUrl && existing.baseUrl !== baseUrl;
+    config.profiles[name] = {
+      name,
+      baseUrl,
+      user: urlChanged ? null : existing.user || null,
+      tenant: urlChanged ? null : existing.tenant || null,
+      token: urlChanged ? null : existing.token || null,
+      updatedAt: new Date().toISOString(),
+    };
+    config.currentProfile = config.currentProfile || name;
+    saveConfig(config);
+    print(`已添加平台 profile: ${name} -> ${baseUrl}`);
+    return;
+  }
+
+  if (subcommand === 'list') {
+    const rows = Object.values(config.profiles).map(profile => ({
+      current: profile.name === config.currentProfile,
+      name: profile.name,
+      baseUrl: profile.baseUrl,
+      user: profile.user?.name || profile.user?.username || null,
+      tenant: profile.tenant?.name || profile.tenant?.code || null,
+      loggedIn: Boolean(profile.token?.accessToken),
+    }));
+    if (flags.json) return writeJson(rows);
+    if (rows.length === 0) {
+      print('暂无平台 profile。先执行 openxiangda platform add <name> <url>');
+      return;
+    }
+    for (const row of rows) {
+      print(
+        `${row.current ? '*' : ' '} ${row.name}  ${row.baseUrl}  ${
+          row.loggedIn ? 'logged-in' : 'not-login'
+        }`
+      );
+    }
+    return;
+  }
+
+  if (subcommand === 'use') {
+    const [name] = positional;
+    if (!name) fail('用法: openxiangda platform use <name>');
+    if (!config.profiles[name]) fail(`平台 profile 不存在: ${name}`);
+    config.currentProfile = name;
+    saveConfig(config);
+    print(`当前平台 profile: ${name}`);
+    return;
+  }
+
+  if (subcommand === 'remove') {
+    const [name] = positional;
+    if (!name) fail('用法: openxiangda platform remove <name>');
+    delete config.profiles[name];
+    if (config.currentProfile === name) {
+      config.currentProfile = Object.keys(config.profiles)[0] || null;
+    }
+    saveConfig(config);
+    print(`已移除平台 profile: ${name}`);
+    return;
+  }
+
+  fail('用法: openxiangda platform add|list|use|remove');
+}
+
+async function login(args) {
+  const { flags, positional } = parseArgs(args);
+  const config = loadConfig();
+  const rawUrl = positional[0];
+  const profileName = flags.profile || config.currentProfile || 'default';
+  let profile = config.profiles[profileName] || { name: profileName };
+
+  if (rawUrl) {
+    profile = {
+      ...profile,
+      name: profileName,
+      baseUrl: normalizeBaseUrl(rawUrl),
+    };
+    config.profiles[profileName] = profile;
+  }
+
+  if (!profile.baseUrl) {
+    fail('缺少平台地址。用法: openxiangda login <platform-url> [--profile name]');
+  }
+
+  const sessionPayload = await requestJson(
+    profile.baseUrl,
+    '/openxiangda-api/v1/auth/cli-sessions',
+    {
+      method: 'POST',
+      body: { baseUrl: profile.baseUrl },
+    }
+  );
+  const session = normalizeLoginSession(unwrapApi(sessionPayload), profile.baseUrl);
+
+  print(`打开登录页并扫码确认授权: ${session.loginUrl}`);
+  renderTerminalQr(session.qrText || session.loginUrl);
+  if (!flags['no-open']) {
+    try {
+      openBrowser(session.loginUrl);
+    } catch (error) {
+      warn(`自动打开浏览器失败，请手动访问登录地址: ${error.message}`);
+    }
+  }
+
+  const deadline = Date.now() + Number(session.expireIn || 300) * 1000;
+  while (Date.now() < deadline) {
+    await sleep(2000);
+    const payload = await requestJson(
+      profile.baseUrl,
+      `/openxiangda-api/v1/auth/cli-sessions/${session.sessionId}`
+    );
+    const data = unwrapApi(payload);
+    if (data.status === 'authorized') {
+      profile = {
+        ...profile,
+        token: {
+          accessToken: data.accessToken,
+          refreshToken: data.refreshToken,
+          accessTokenExpiresAt: data.accessTokenExpiresAt,
+          refreshTokenExpiresAt: data.refreshTokenExpiresAt,
+        },
+        user: data.user || null,
+        tenant: data.tenant || null,
+        updatedAt: new Date().toISOString(),
+      };
+      config.profiles[profileName] = profile;
+      config.currentProfile = profileName;
+      saveConfig(config);
+
+      const result = {
+        profile: profileName,
+        baseUrl: profile.baseUrl,
+        user: profile.user,
+        tenant: profile.tenant,
+        accessTokenExpiresAt: profile.token.accessTokenExpiresAt,
+      };
+      if (flags.json) writeJson(result);
+      else print(`登录成功: ${profileName} (${profile.baseUrl})`);
+      return;
+    }
+    if (data.status === 'expired' || data.status === 'revoked') {
+      fail('CLI 登录会话已失效，请重新执行 openxiangda login');
+    }
+  }
+
+  fail('CLI 登录等待超时，请重新执行 openxiangda login');
+}
+
+function normalizeLoginSession(session, baseUrl) {
+  const loginUrl = normalizePlatformSessionUrl(session.loginUrl, baseUrl);
+  return {
+    ...session,
+    loginUrl,
+    qrText: normalizePlatformSessionUrl(session.qrText, baseUrl) || loginUrl,
+  };
+}
+
+function normalizePlatformSessionUrl(value, baseUrl) {
+  if (!value) return value;
+  try {
+    const input = new URL(value);
+    const base = new URL(baseUrl);
+    const basePath = base.pathname.replace(/\/+$/, '');
+    if (
+      input.host === base.host &&
+      basePath &&
+      input.pathname.startsWith('/openxiangda-api/')
+    ) {
+      return `${base.origin}${basePath}${input.pathname}${input.search}${input.hash}`;
+    }
+    return input.toString();
+  } catch {
+    return value;
+  }
+}
+
+async function auth(args) {
+  const [subcommand, ...rest] = args;
+  const { flags } = parseArgs(rest);
+
+  if (subcommand === 'status') {
+    const config = loadConfig();
+    const { profileName, profile } = getProfile(config, flags.profile);
+    if (!profile.token?.accessToken) {
+      print(`未登录: ${profileName} (${profile.baseUrl})`);
+      return;
+    }
+    const data = await requestWithAuth(config, profileName, '/openxiangda-api/v1/auth/whoami');
+    config.profiles[profileName].user = data.user;
+    config.profiles[profileName].tenant = data.tenant;
+    saveConfig(config);
+    if (flags.json) return writeJson(data);
+    print(
+      `已登录: ${profileName} ${profile.baseUrl} user=${data.user?.name || data.user?.id} tenant=${data.tenant?.name || data.tenant?.code}`
+    );
+    return;
+  }
+
+  if (subcommand === 'refresh') {
+    const config = loadConfig();
+    const profileName = flags.profile || config.currentProfile;
+    if (!profileName) fail('未选择平台 profile');
+    const data = await refreshProfile(config, profileName);
+    saveConfig(config);
+    if (flags.json) return writeJson({ profile: profileName, ...data });
+    print(`token 已刷新: ${profileName}`);
+    return;
+  }
+
+  if (subcommand === 'logout') {
+    const config = loadConfig();
+    const { profileName, profile } = getProfile(config, flags.profile);
+    if (profile.token?.accessToken) {
+      try {
+        await requestJson(profile.baseUrl, '/openxiangda-api/v1/auth/logout', {
+          method: 'POST',
+          accessToken: profile.token.accessToken,
+        });
+      } catch (error) {
+        warn(`服务端注销失败，本地 token 仍会清除: ${error.message}`);
+      }
+    }
+    profile.token = null;
+    saveConfig(config);
+    print(`已退出登录: ${profileName}`);
+    return;
+  }
+
+  fail('用法: openxiangda auth status|refresh|logout [--profile name]');
+}
+
+async function env(args) {
+  const { flags } = parseArgs(args);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+  const profile = profileName ? config.profiles[profileName] : null;
+  const state = loadProjectState();
+  const currentState = profileName ? state.profiles?.[profileName] : null;
+  const data = {
+    configFile: CONFIG_FILE,
+    projectStateFile: path.join(process.cwd(), PROJECT_STATE_FILE),
+    currentProfile: profileName || null,
+    baseUrl: profile?.baseUrl || null,
+    loggedIn: Boolean(profile?.token?.accessToken),
+    user: profile?.user || null,
+    tenant: profile?.tenant || null,
+    appType: currentState?.appType || null,
+  };
+
+  if (flags.json) return writeJson(data);
+  print(`配置文件: ${data.configFile}`);
+  print(`项目状态: ${data.projectStateFile}`);
+  print(`当前 profile: ${data.currentProfile || '-'}`);
+  print(`平台地址: ${data.baseUrl || '-'}`);
+  print(`登录状态: ${data.loggedIn ? '已登录' : '未登录'}`);
+  print(`项目绑定 appType: ${data.appType || '-'}`);
+}
+
+async function workspace(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+
+  if (subcommand === 'init') {
+    const result = initWorkspace({
+      dir: positional[0],
+      name: flags.name,
+      install: flags.install,
+      force: flags.force,
+      profile: flags.profile,
+      appType: flags['app-type'],
+    });
+    if (flags.json) return writeJson(result);
+    printWorkspaceInitReport(result);
+    return;
+  }
+
+  const { profileName, profile } = getProfile(config, flags.profile);
+
+  if (subcommand === 'bind') {
+    const appType = flags['app-type'] || positional[0];
+    if (!appType) {
+      fail('用法: openxiangda workspace bind --profile <name> --app-type <APP_XXX>');
+    }
+    const state = loadProjectState();
+    state.profiles = state.profiles || {};
+    state.profiles[profileName] = {
+      ...(state.profiles[profileName] || {}),
+      baseUrl: profile.baseUrl,
+      appType,
+      resources: state.profiles[profileName]?.resources || {
+        forms: {},
+        pages: {},
+        workflows: {},
+        automations: {},
+        menus: {},
+      },
+      updatedAt: new Date().toISOString(),
+    };
+    saveProjectState(state);
+    print(`当前工作区已绑定 ${profileName}: ${appType}`);
+    return;
+  }
+
+  if (subcommand === 'publish') {
+    const state = loadProjectState();
+    const bound = state.profiles?.[profileName];
+    if (!bound?.appType) {
+      fail(
+        `profile ${profileName} 未绑定应用。先执行 openxiangda workspace bind --profile ${profileName} --app-type APP_XXX`
+      );
+    }
+    await requestWithAuth(
+      config,
+      profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(bound.appType)}/snapshot`
+    );
+    runWorkspacePublish(profileName, profile, bound.appType);
+    return;
+  }
+
+  fail('用法: openxiangda workspace init|bind|publish');
+}
+
+async function app(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'list') {
+    const data = await requestWithAuth(config, profileName, '/openxiangda-api/v1/apps/');
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'create') {
+    const name = flags.name || positional.join(' ');
+    if (!name) fail('用法: openxiangda app create <name> [--profile name]');
+    const data = await requestWithAuth(config, profileName, '/openxiangda-api/v1/apps/', {
+      method: 'POST',
+      body: {
+        name,
+        description: flags.description || '',
+        iconfontCss: flags['iconfont-css'] || '',
+      },
+    });
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand !== 'snapshot') {
+    fail('用法: openxiangda app list|create|snapshot');
+  }
+  const [appType] = positional;
+  if (!appType) fail('缺少 appType');
+  const data = await requestWithAuth(
+    config,
+    profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(appType)}/snapshot`
+  );
+  if (flags.json) return writeJson(data);
+  print(JSON.stringify(data, null, 2));
+}
+
+async function form(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'bind') {
+    const [formCode, maybeFormUuid] = positional;
+    const formUuid = flags['form-uuid'] || maybeFormUuid;
+    if (!formCode || !formUuid) {
+      fail('用法: openxiangda form bind <formCode> --form-uuid <FORM_XXX>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    saveFormResource(target, formCode, formUuid);
+    print(`已绑定表单 ${formCode}: ${formUuid}`);
+    return;
+  }
+
+  if (subcommand === 'create') {
+    const [formCode] = positional;
+    const name = flags.name || positional.slice(1).join(' ') || formCode;
+    if (!formCode || !name) {
+      fail('用法: openxiangda form create <formCode> [--name text]');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms`,
+      {
+        method: 'POST',
+        body: {
+          name,
+          formType: flags.type || 'receipt',
+          formUuid: flags['form-uuid'],
+          builderVersion: flags['builder-version'],
+          createMenu: Boolean(flags.menu),
+          menuParentId: flags['menu-parent-id'],
+          menuIcon: flags['menu-icon'],
+        },
+      }
+    );
+    const formUuid = data?.form?.formUuid || data?.formUuid;
+    if (formUuid) {
+      saveFormResource(target, formCode, formUuid, { name });
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'pull') {
+    const [formKey] = positional;
+    if (!formKey) fail('用法: openxiangda form pull <formCode|formUuid>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveFormUuid(target.bound, formKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'publish') {
+    const [formKey] = positional;
+    if (!formKey || !flags['bundle-url']) {
+      fail(
+        '用法: openxiangda form publish <formCode|formUuid> --bundle-url <url>'
+      );
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveFormUuid(target.bound, formKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/publish`,
+      {
+        method: 'POST',
+        body: {
+          bundleUrl: flags['bundle-url'],
+          cssUrl: flags['css-url'] || null,
+          version: flags.version || '',
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail('用法: openxiangda form list|create|bind|pull|publish');
+}
+
+async function page(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/pages`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'bind') {
+    const [pageCode, maybePageId] = positional;
+    const pageId = flags['page-id'] || maybePageId;
+    if (!pageCode || !pageId) {
+      fail('用法: openxiangda page bind <pageCode> --page-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    savePageResource(target, pageCode, pageId);
+    print(`已绑定代码页 ${pageCode}: ${pageId}`);
+    return;
+  }
+
+  if (subcommand === 'releases') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/pages/releases`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'activate') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    if (!flags.version || !flags['build-id']) {
+      fail('用法: openxiangda page activate --version <v> --build-id <id>');
+    }
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/pages/releases/activate`,
+      {
+        method: 'POST',
+        body: {
+          version: flags.version,
+          buildId: flags['build-id'],
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'publish') {
+    const [pageCode] = positional;
+    if (!pageCode || !flags['entry-url'] || !flags.version || !flags['build-id']) {
+      fail(
+        '用法: openxiangda page publish <pageCode> --entry-url <url> --version <v> --build-id <id>'
+      );
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/pages/${encodeURIComponent(pageCode)}/publish`,
+      {
+        method: 'POST',
+        body: {
+          name: flags.name || pageCode,
+          description: flags.description || '',
+          version: flags.version,
+          buildId: flags['build-id'],
+          route: flags.route ? JSON.parse(flags.route) : {},
+          props: flags.props ? JSON.parse(flags.props) : {},
+          runtime: {
+            entryUrl: flags['entry-url'],
+            cssUrls: splitList(flags['css-urls']),
+            jsUrls: splitList(flags['js-urls']),
+            framework: flags.framework || 'react',
+            frameworkVersion: flags['framework-version'] || '',
+            cssIsolation: flags['css-isolation'] || 'namespace',
+            format: flags.format || 'esm',
+          },
+          menu: flags.menu
+            ? {
+                enabled: true,
+                name: flags['menu-name'] || flags.name || pageCode,
+                parentId: flags['menu-parent-id'] || null,
+                icon: flags['menu-icon'] || null,
+              }
+            : { enabled: false },
+        },
+      }
+    );
+    const item = Array.isArray(data?.items) ? data.items[0] : null;
+    if (item?.pageId) {
+      savePageResource(target, pageCode, item.pageId, {
+        routeKey: item.routeKey,
+        legacyFormUuid: item.legacyFormUuid,
+      });
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail('用法: openxiangda page list|publish|bind|releases|activate');
+}
+
+async function menu(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'bind') {
+    const [menuCode, maybeMenuId] = positional;
+    const menuId = flags['menu-id'] || maybeMenuId;
+    if (!menuCode || !menuId) {
+      fail('用法: openxiangda menu bind <menuCode> --menu-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    saveMenuResource(target, menuCode, menuId);
+    print(`已绑定菜单 ${menuCode}: ${menuId}`);
+    return;
+  }
+
+  if (subcommand === 'create') {
+    const [menuCode] = positional;
+    const name = flags.name || positional.slice(1).join(' ') || menuCode;
+    if (!menuCode || !name) {
+      fail('用法: openxiangda menu create <menuCode> --name <text>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`,
+      {
+        method: 'POST',
+        body: {
+          name,
+          type: flags.type || 'nav',
+          formUuid: flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']),
+          pageId: flags['page-id'] || resolveOptionalPageId(target.bound, flags['page-code']),
+          parentId: flags['parent-id'] || null,
+          icon: flags.icon || null,
+        },
+      }
+    );
+    if (data?.id) saveMenuResource(target, menuCode, data.id, { name });
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'delete') {
+    const [menuKey] = positional;
+    if (!menuKey) fail('用法: openxiangda menu delete <menuCode|menuId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const menuId = resolveMenuId(target.bound, menuKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menuId)}`,
+      { method: 'DELETE' }
+    );
+    if (target.bound.resources?.menus?.[menuKey]) {
+      delete target.bound.resources.menus[menuKey];
+      saveProjectState(target.state);
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail('用法: openxiangda menu list|create|bind|delete');
+}
+
+async function workflow(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`,
+        {
+          formUuid,
+          isPublished: flags.published,
+          page: flags.page,
+          pageSize: flags['page-size'],
+        }
+      )
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'bind') {
+    const [workflowCode, maybeWorkflowId] = positional;
+    const workflowId = flags['workflow-id'] || maybeWorkflowId;
+    if (!workflowCode || !workflowId) {
+      fail('用法: openxiangda workflow bind <workflowCode> --workflow-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    saveWorkflowResource(target, workflowCode, workflowId, {
+      formUuid: flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']),
+    });
+    print(`已绑定流程 ${workflowCode}: ${workflowId}`);
+    return;
+  }
+
+  if (subcommand === 'create') {
+    const [workflowCode] = positional;
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    if (!workflowCode || !formUuid || !flags['definition-json']) {
+      fail(
+        '用法: openxiangda workflow create <workflowCode> --form-code <formCode>|--form-uuid <FORM_XXX> --definition-json <file>'
+      );
+    }
+    const definitionJson = await readDefinitionJsonArg(
+      config,
+      target.profileName,
+      flags['definition-json'],
+      'definition-json'
+    );
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`,
+      {
+        method: 'POST',
+        body: {
+          formUuid,
+          definitionJson,
+          ...(flags['view-json']
+            ? { viewJson: readJsonArg(flags['view-json'], 'view-json') }
+            : {}),
+        },
+      }
+    );
+    if (data?.id) saveWorkflowResource(target, workflowCode, data.id, { formUuid });
+    if (flags.publish && data?.id) {
+      const published = await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(data.id)}/publish`,
+        { method: 'POST', body: { isPublished: true } }
+      );
+      if (flags.json) return writeJson(published);
+      print(JSON.stringify(published, null, 2));
+      return;
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'pull') {
+    const [workflowKey] = positional;
+    if (!workflowKey) fail('用法: openxiangda workflow pull <workflowCode|workflowId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const workflowId = resolveWorkflowId(target.bound, workflowKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflowId)}`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'publish') {
+    const [workflowKey] = positional;
+    if (!workflowKey) fail('用法: openxiangda workflow publish <workflowCode|workflowId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const workflowId = resolveWorkflowId(target.bound, workflowKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflowId)}/publish`,
+      {
+        method: 'POST',
+        body: { isPublished: !flags.unpublish },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'delete') {
+    const [workflowKey] = positional;
+    if (!workflowKey) fail('用法: openxiangda workflow delete <workflowCode|workflowId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const workflowId = resolveWorkflowId(target.bound, workflowKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflowId)}`,
+      { method: 'DELETE' }
+    );
+    if (target.bound.resources?.workflows?.[workflowKey]) {
+      delete target.bound.resources.workflows[workflowKey];
+      saveProjectState(target.state);
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'validate') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    if (!flags['definition-json']) {
+      fail('用法: openxiangda workflow validate --definition-json <file>');
+    }
+    const definitionJson = await readDefinitionJsonArg(
+      config,
+      target.profileName,
+      flags['definition-json'],
+      'definition-json'
+    );
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/definition/validate`,
+      {
+        method: 'POST',
+        body: {
+          definitionJson,
+          requirePublishNodes: Boolean(flags.publish),
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail('用法: openxiangda workflow list|create|bind|pull|publish|delete|validate');
+}
+
+async function automation(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`,
+        {
+          formUuid,
+          isPublished: flags.published,
+          isEnabled: flags.enabled,
+          triggerType: flags['trigger-type'],
+          keyword: flags.keyword,
+          page: flags.page,
+          pageSize: flags['page-size'],
+        }
+      )
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'bind') {
+    const [automationCode, maybeAutomationId] = positional;
+    const automationId = flags['automation-id'] || maybeAutomationId;
+    if (!automationCode || !automationId) {
+      fail('用法: openxiangda automation bind <automationCode> --automation-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    saveAutomationResource(target, automationCode, automationId, {
+      formUuid: flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']),
+    });
+    print(`已绑定自动化 ${automationCode}: ${automationId}`);
+    return;
+  }
+
+  if (subcommand === 'create') {
+    const [automationCode] = positional;
+    const target = getWorkspaceTarget(config, profileName, flags);
+    if (!automationCode || !flags.name || !flags['trigger-json'] || !flags['definition-json']) {
+      fail(
+        '用法: openxiangda automation create <automationCode> --name <text> --trigger-json <file> --definition-json <file>'
+      );
+    }
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    const triggerConfig = readJsonArg(flags['trigger-json'], 'trigger-json');
+    if (formUuid && !triggerConfig.formUuid) triggerConfig.formUuid = formUuid;
+    if (!triggerConfig.appType) triggerConfig.appType = target.appType;
+
+    const definitionJson = await readDefinitionJsonArg(
+      config,
+      target.profileName,
+      flags['definition-json'],
+      'definition-json'
+    );
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`,
+      {
+        method: 'POST',
+        body: {
+          name: flags.name,
+          description: flags.description || '',
+          formUuid,
+          triggerConfig,
+          definitionJson,
+          ...(flags['view-json']
+            ? { viewJson: readJsonArg(flags['view-json'], 'view-json') }
+            : {}),
+          tags: flags.tags || '',
+        },
+      }
+    );
+    if (data?.id) saveAutomationResource(target, automationCode, data.id, { formUuid });
+    if (flags.publish && data?.id) {
+      const published = await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(data.id)}/publish`,
+        { method: 'POST' }
+      );
+      if (flags.json) return writeJson(published);
+      print(JSON.stringify(published, null, 2));
+      return;
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'pull') {
+    const [automationKey] = positional;
+    if (!automationKey) fail('用法: openxiangda automation pull <automationCode|automationId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const automationId = resolveAutomationId(target.bound, automationKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automationId)}`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (['publish', 'unpublish', 'enable', 'disable'].includes(subcommand)) {
+    const [automationKey] = positional;
+    if (!automationKey) {
+      fail(`用法: openxiangda automation ${subcommand} <automationCode|automationId>`);
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const automationId = resolveAutomationId(target.bound, automationKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automationId)}/${subcommand}`,
+      { method: 'POST' }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'delete') {
+    const [automationKey] = positional;
+    if (!automationKey) fail('用法: openxiangda automation delete <automationCode|automationId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const automationId = resolveAutomationId(target.bound, automationKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automationId)}`,
+      { method: 'DELETE' }
+    );
+    if (target.bound.resources?.automations?.[automationKey]) {
+      delete target.bound.resources.automations[automationKey];
+      saveProjectState(target.state);
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'validate') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    if (!flags['definition-json']) {
+      fail('用法: openxiangda automation validate --definition-json <file> [--trigger-json <file>]');
+    }
+    const definitionJson = await readDefinitionJsonArg(
+      config,
+      target.profileName,
+      flags['definition-json'],
+      'definition-json'
+    );
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/definition/validate`,
+      {
+        method: 'POST',
+        body: {
+          definitionJson,
+          triggerConfig: flags['trigger-json']
+            ? readJsonArg(flags['trigger-json'], 'trigger-json')
+            : undefined,
+          strictLiveBinding: Boolean(flags.strict),
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'cron-validate') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const cronExpression = flags.cron || positional[0];
+    if (!cronExpression) fail('用法: openxiangda automation cron-validate <cron>');
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/cron/validate`,
+      {
+        method: 'POST',
+        body: { cronExpression },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail('用法: openxiangda automation list|create|bind|pull|publish|unpublish|enable|disable|delete|validate|cron-validate');
+}
+
+async function permission(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'role-list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`,
+        {
+          name: flags.name,
+          code: flags.code,
+          page: flags.page,
+          limit: flags.limit,
+        }
+      )
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'role-bind') {
+    const [roleCode, maybeRoleId] = positional;
+    const roleId = flags['role-id'] || maybeRoleId;
+    if (!roleCode || !roleId) {
+      fail('用法: openxiangda permission role-bind <roleCode> --role-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    saveRoleResource(target, roleCode, roleId);
+    print(`已绑定角色 ${roleCode}: ${roleId}`);
+    return;
+  }
+
+  if (subcommand === 'role-create') {
+    const [roleCode] = positional;
+    const name = flags.name || positional.slice(1).join(' ') || roleCode;
+    if (!roleCode || !name) {
+      fail('用法: openxiangda permission role-create <roleCode> --name <text>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`,
+      {
+        method: 'POST',
+        body: {
+          code: flags.code || roleCode,
+          name,
+          description: flags.description || '',
+        },
+      }
+    );
+    if (data?.id) saveRoleResource(target, roleCode, data.id, { code: data.code, name: data.name });
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'role-users') {
+    const [roleKey] = positional;
+    if (!roleKey) fail('用法: openxiangda permission role-users <roleCode|roleId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const roleId = resolveRoleId(target.bound, roleKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(roleId)}/users`,
+        {
+          keyword: flags.keyword,
+          page: flags.page,
+          limit: flags.limit,
+        }
+      )
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'role-add-users') {
+    const [roleKey] = positional;
+    const userIds = splitList(flags['user-ids']);
+    if (!roleKey || userIds.length === 0) {
+      fail('用法: openxiangda permission role-add-users <roleCode|roleId> --user-ids <id1,id2>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const roleId = resolveRoleId(target.bound, roleKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(roleId)}/users`,
+      {
+        method: 'POST',
+        body: { userIds },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'page-group-list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`,
+        {
+          name: flags.name,
+          page: flags.page,
+          limit: flags.limit,
+        }
+      )
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'page-group-bind') {
+    const [groupCode, maybeGroupId] = positional;
+    const groupId = flags['group-id'] || maybeGroupId;
+    if (!groupCode || !groupId) {
+      fail('用法: openxiangda permission page-group-bind <groupCode> --group-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    savePagePermissionGroupResource(target, groupCode, groupId);
+    print(`已绑定页面权限组 ${groupCode}: ${groupId}`);
+    return;
+  }
+
+  if (subcommand === 'page-group-create') {
+    const [groupCode] = positional;
+    const name = flags.name || positional.slice(1).join(' ') || groupCode;
+    if (!groupCode || !name) {
+      fail('用法: openxiangda permission page-group-create <groupCode> --name <text>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`,
+      {
+        method: 'POST',
+        body: {
+          name,
+          roles: splitList(flags.roles),
+          menuFormUuids: resolveFormUuidList(target.bound, flags['menu-form-uuids'], flags['form-codes']),
+        },
+      }
+    );
+    if (data?.id) savePagePermissionGroupResource(target, groupCode, data.id, { name });
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'form-group-list') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    if (!formUuid) {
+      fail('用法: openxiangda permission form-group-list --form-code <formCode>|--form-uuid <FORM_XXX>');
+    }
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`,
+        {
+          type: flags.type,
+          name: flags.name,
+          page: flags.page,
+          limit: flags.limit,
+        }
+      )
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'form-group-bind') {
+    const [groupCode, maybeGroupId] = positional;
+    const groupId = flags['group-id'] || maybeGroupId;
+    if (!groupCode || !groupId) {
+      fail('用法: openxiangda permission form-group-bind <groupCode> --group-id <id>');
+    }
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    saveFormPermissionGroupResource(target, groupCode, groupId, { formUuid });
+    print(`已绑定表单权限组 ${groupCode}: ${groupId}`);
+    return;
+  }
+
+  if (subcommand === 'form-group-create') {
+    const [groupCode] = positional;
+    const name = flags.name || positional.slice(1).join(' ') || groupCode;
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
+    if (!groupCode || !name || !formUuid) {
+      fail('用法: openxiangda permission form-group-create <groupCode> --form-code <formCode>|--form-uuid <FORM_XXX> --name <text> --type <submit|view>');
+    }
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`,
+      {
+        method: 'POST',
+        body: {
+          name,
+          type: flags.type || 'view',
+          roles: splitList(flags.roles),
+          operations: splitList(flags.operations),
+          ...(flags['data-scope-json']
+            ? { dataScope: readJsonArg(flags['data-scope-json'], 'data-scope-json') }
+            : {}),
+          ...(flags['field-permissions-json']
+            ? {
+                fieldPermissions: readJsonArg(
+                  flags['field-permissions-json'],
+                  'field-permissions-json'
+                ),
+              }
+            : {}),
+          ...(flags['data-permission-json']
+            ? {
+                dataPermission: readJsonArg(
+                  flags['data-permission-json'],
+                  'data-permission-json'
+                ),
+              }
+            : {}),
+        },
+      }
+    );
+    if (data?.id) {
+      saveFormPermissionGroupResource(target, groupCode, data.id, {
+        name,
+        formUuid,
+      });
+    }
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'form-summary') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code'] || positional[0]);
+    if (!formUuid) fail('用法: openxiangda permission form-summary --form-code <formCode>|--form-uuid <FORM_XXX>');
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-summary`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'menu-permissions') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/user-menu-permissions`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail(
+    '用法: openxiangda permission role-list|role-create|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-bind|form-group-list|form-group-create|form-group-bind|form-summary|menu-permissions'
+  );
+}
+
+async function settings(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (subcommand === 'get') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/settings`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'save') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    if (!flags['settings-json']) {
+      fail('用法: openxiangda settings save <formCode|formUuid> --settings-json <file>');
+    }
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/settings`,
+      {
+        method: 'PUT',
+        body: {
+          settings: readJsonArg(flags['settings-json'], 'settings-json'),
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'indexes') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/field-indexes`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'indexes-save') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    if (!flags['indexes-json']) {
+      fail('用法: openxiangda settings indexes-save <formCode|formUuid> --indexes-json <file>');
+    }
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/field-indexes`,
+      {
+        method: 'PUT',
+        body: {
+          indexes: readJsonArg(flags['indexes-json'], 'indexes-json'),
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'data-management') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/data-management`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'data-management-save') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    if (!flags['config-json']) {
+      fail('用法: openxiangda settings data-management-save <formCode|formUuid> --config-json <file>');
+    }
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/data-management`,
+      {
+        method: 'PUT',
+        body: {
+          config: readJsonArg(flags['config-json'], 'config-json'),
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'public-access') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'public-access-save') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`,
+      {
+        method: 'PUT',
+        body: {
+          isPublic: flags.public === undefined ? true : String(flags.public) !== 'false',
+          description: flags.description || '',
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'public-access-delete') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`,
+      { method: 'DELETE' }
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail(
+    '用法: openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access|public-access-save|public-access-delete'
+  );
+}
+
+async function inspect(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (!subcommand || subcommand === 'app' || subcommand === 'snapshot') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const appType = positional[0] || target.appType;
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(appType)}/snapshot`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'form') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'workflow') {
+    const [workflowKey] = positional;
+    if (!workflowKey) fail('用法: openxiangda inspect workflow <workflowCode|workflowId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const workflowId = resolveWorkflowId(target.bound, workflowKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflowId)}`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'automation') {
+    const [automationKey] = positional;
+    if (!automationKey) fail('用法: openxiangda inspect automation <automationCode|automationId>');
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const automationId = resolveAutomationId(target.bound, automationKey, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automationId)}`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  if (subcommand === 'permissions') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuid = resolveSettingsFormUuid(target.bound, positional[0], flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-summary`
+    );
+    if (flags.json) return writeJson(data);
+    print(JSON.stringify(data, null, 2));
+    return;
+  }
+
+  fail('用法: openxiangda inspect app|form|workflow|automation|permissions');
+}
+
+async function commands(args) {
+  const { flags } = parseArgs(args);
+  const manifest = {
+    name: 'openxiangda',
+    commands: [
+      'login <platform-url> [--profile name]',
+      'platform add|list|use|remove',
+      'auth status|refresh|logout',
+      'env',
+      'workspace init|bind|publish',
+      'app list|create|snapshot',
+      'form list|create|bind|pull|publish',
+      'page list|publish|bind|releases|activate',
+      'menu list|create|bind|delete',
+      'workflow list|create|bind|pull|publish|delete|validate',
+      'automation list|create|bind|pull|publish|unpublish|enable|disable|delete|validate|cron-validate',
+      'permission role-list|role-create|role-bind|role-users|role-add-users',
+      'permission page-group-list|page-group-create|page-group-bind',
+      'permission form-group-list|form-group-create|form-group-bind|form-summary|menu-permissions',
+      'settings get|save|indexes|indexes-save|data-management|data-management-save|public-access|public-access-save|public-access-delete',
+      'inspect app|form|workflow|automation|permissions',
+      'skill install|status',
+    ],
+  };
+  if (flags.json) return writeJson(manifest);
+  print(JSON.stringify(manifest, null, 2));
+}
+
+function printWorkspaceInitReport(result) {
+  const lines = [
+    `已创建 OpenXiangda workspace: ${result.targetDir}`,
+    `package: ${result.packageName}`,
+  ];
+  if (result.bound) {
+    lines.push(`已绑定 ${result.bound.profile}: ${result.bound.appType}`);
+  }
+  if (result.installedDependencies) {
+    lines.push('依赖已安装');
+  }
+  lines.push('下一步:');
+  for (const step of result.nextSteps) {
+    lines.push(`  ${step}`);
+  }
+  print(lines.join('\n'));
+}
+
+async function skill(args) {
+  const [subcommand, ...rest] = args;
+  const { flags } = parseArgs(rest);
+  const options = {
+    agent: flags.agent || 'codex',
+    dest: flags.dest,
+    force: Boolean(flags.force),
+    dryRun: Boolean(flags['dry-run']),
+  };
+
+  if (subcommand === 'install') {
+    const result = installSkills(options);
+    if (flags.json) return writeJson(result);
+    printSkillInstallReport(result);
+    return;
+  }
+
+  if (subcommand === 'status') {
+    const result = getSkillStatusReport(options);
+    if (flags.json) return writeJson(result);
+    printSkillStatusReport(result);
+    return;
+  }
+
+  fail('用法: openxiangda skill install|status [--agent codex] [--dest <skills-dir>]');
+}
+
+function printSkillInstallReport(result) {
+  if (result.results) {
+    // 多平台安装结果
+    print(`OpenXiangda skill install (${result.agent})`);
+    for (const res of result.results) {
+      print(`Destination: ${res.skillsDir}`);
+      for (const item of res.operations) {
+        print(`- ${item.name}: ${item.operation}`);
+      }
+    }
+  } else {
+    // 单平台安装结果
+    const lines = [
+      `OpenXiangda skill install (${result.agent})`,
+      `Destination: ${result.skillsDir}`,
+    ];
+    for (const item of result.operations) {
+      lines.push(`- ${item.name}: ${item.operation}`);
+    }
+    for (const warning of result.warnings) {
+      lines.push(`Warning: ${warning}`);
+    }
+    print(lines.join('\n'));
+  }
+
+  print(result.message);
+}
+
+function printSkillStatusReport(result) {
+  if (result.results) {
+    // 多平台状态结果
+    print(`OpenXiangda skill status (${result.agent})`);
+    for (const res of result.results) {
+      print(`Destination: ${res.skillsDir}`);
+      for (const item of res.skills) {
+        const version = item.installedVersion ? ` (${item.installedVersion})` : '';
+        print(`- ${item.name}: ${item.status}${version}`);
+      }
+    }
+  } else {
+    // 单平台状态结果
+    const lines = [
+      `OpenXiangda skill status (${result.agent})`,
+      `Destination: ${result.skillsDir}`,
+    ];
+    for (const item of result.skills) {
+      const version = item.installedVersion ? ` (${item.installedVersion})` : '';
+      lines.push(`- ${item.name}: ${item.status}${version}`);
+    }
+    for (const warning of result.warnings) {
+      lines.push(`Warning: ${warning}`);
+    }
+    print(lines.join('\n'));
+  }
+}
+
+function getWorkspaceTarget(config, profileName, flags = {}) {
+  const resolved = getProfile(config, profileName);
+  const state = loadProjectState();
+  const bound = state.profiles?.[resolved.profileName] || {};
+  const appType = flags['app-type'] || bound.appType;
+  if (!appType) {
+    fail(
+      `profile ${resolved.profileName} 未绑定应用。先执行 openxiangda workspace bind --profile ${resolved.profileName} --app-type APP_XXX`
+    );
+  }
+  return {
+    profileName: resolved.profileName,
+    profile: resolved.profile,
+    state,
+    bound,
+    appType,
+  };
+}
+
+function ensureResourceBuckets(bound) {
+  bound.resources = bound.resources || {};
+  bound.resources.forms = bound.resources.forms || {};
+  bound.resources.pages = bound.resources.pages || {};
+  bound.resources.workflows = bound.resources.workflows || {};
+  bound.resources.automations = bound.resources.automations || {};
+  bound.resources.menus = bound.resources.menus || {};
+  bound.resources.roles = bound.resources.roles || {};
+  bound.resources.pagePermissionGroups = bound.resources.pagePermissionGroups || {};
+  bound.resources.formPermissionGroups = bound.resources.formPermissionGroups || {};
+}
+
+function resolveFormUuid(bound, formKey, flags = {}) {
+  if (flags['form-uuid']) return flags['form-uuid'];
+  const mapped = bound.resources?.forms?.[formKey]?.formUuid;
+  return mapped || formKey;
+}
+
+function resolveOptionalFormUuid(bound, formCode) {
+  if (!formCode) return undefined;
+  return bound.resources?.forms?.[formCode]?.formUuid || formCode;
+}
+
+function resolveOptionalPageId(bound, pageCode) {
+  if (!pageCode) return undefined;
+  return bound.resources?.pages?.[pageCode]?.pageId || pageCode;
+}
+
+function resolveMenuId(bound, menuKey, flags = {}) {
+  if (flags['menu-id']) return flags['menu-id'];
+  const mapped = bound.resources?.menus?.[menuKey]?.menuId;
+  return mapped || menuKey;
+}
+
+function resolveWorkflowId(bound, workflowKey, flags = {}) {
+  if (flags['workflow-id']) return flags['workflow-id'];
+  const mapped = bound.resources?.workflows?.[workflowKey]?.workflowId;
+  return mapped || workflowKey;
+}
+
+function resolveAutomationId(bound, automationKey, flags = {}) {
+  if (flags['automation-id']) return flags['automation-id'];
+  const mapped = bound.resources?.automations?.[automationKey]?.automationId;
+  return mapped || automationKey;
+}
+
+function resolveRoleId(bound, roleKey, flags = {}) {
+  if (flags['role-id']) return flags['role-id'];
+  const mapped = bound.resources?.roles?.[roleKey]?.roleId;
+  return mapped || roleKey;
+}
+
+function resolveFormUuidList(bound, rawFormUuids, rawFormCodes) {
+  const direct = splitList(rawFormUuids);
+  const fromCodes = splitList(rawFormCodes).map(code => resolveOptionalFormUuid(bound, code));
+  return [...direct, ...fromCodes].filter(Boolean);
+}
+
+function resolveSettingsFormUuid(bound, formKey, flags = {}) {
+  const key = formKey || flags['form-code'] || flags['form-uuid'];
+  if (!key && !flags['form-uuid']) {
+    fail('缺少表单标识。传入 <formCode|formUuid> 或 --form-code/--form-uuid');
+  }
+  return resolveFormUuid(bound, key, flags);
+}
+
+function saveFormResource(target, formCode, formUuid, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.forms[formCode] = {
+    ...(nextBound.resources.forms[formCode] || {}),
+    ...extra,
+    formUuid,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function savePageResource(target, pageCode, pageId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.pages[pageCode] = {
+    ...(nextBound.resources.pages[pageCode] || {}),
+    ...extra,
+    pageId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function saveMenuResource(target, menuCode, menuId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.menus[menuCode] = {
+    ...(nextBound.resources.menus[menuCode] || {}),
+    ...extra,
+    menuId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function saveWorkflowResource(target, workflowCode, workflowId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.workflows[workflowCode] = {
+    ...(nextBound.resources.workflows[workflowCode] || {}),
+    ...extra,
+    workflowId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function saveAutomationResource(target, automationCode, automationId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.automations[automationCode] = {
+    ...(nextBound.resources.automations[automationCode] || {}),
+    ...extra,
+    automationId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function saveRoleResource(target, roleCode, roleId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.roles[roleCode] = {
+    ...(nextBound.resources.roles[roleCode] || {}),
+    ...extra,
+    roleId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function savePagePermissionGroupResource(target, groupCode, groupId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.pagePermissionGroups[groupCode] = {
+    ...(nextBound.resources.pagePermissionGroups[groupCode] || {}),
+    ...extra,
+    groupId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function saveFormPermissionGroupResource(target, groupCode, groupId, extra = {}) {
+  target.state.profiles = target.state.profiles || {};
+  target.state.profiles[target.profileName] = {
+    ...target.bound,
+    baseUrl: target.profile.baseUrl,
+    appType: target.appType,
+    updatedAt: new Date().toISOString(),
+  };
+  const nextBound = target.state.profiles[target.profileName];
+  ensureResourceBuckets(nextBound);
+  nextBound.resources.formPermissionGroups[groupCode] = {
+    ...(nextBound.resources.formPermissionGroups[groupCode] || {}),
+    ...extra,
+    groupId,
+    updatedAt: new Date().toISOString(),
+  };
+  saveProjectState(target.state);
+  target.bound = nextBound;
+}
+
+function readJsonArg(value, label) {
+  return readJsonArgWithBase(value, label).data;
+}
+
+function readJsonArgWithBase(value, label) {
+  if (!value) fail(`缺少 ${label}`);
+  const raw = String(value).trim();
+  try {
+    if (raw.startsWith('{') || raw.startsWith('[')) {
+      return { data: JSON.parse(raw), baseDir: process.cwd() };
+    }
+    const filePath = path.resolve(process.cwd(), raw);
+    return {
+      data: JSON.parse(fs.readFileSync(filePath, 'utf8')),
+      baseDir: path.dirname(filePath),
+    };
+  } catch (error) {
+    fail(`无法读取 ${label}: ${error.message}`);
+  }
+}
+
+async function readDefinitionJsonArg(config, profileName, value, label) {
+  const { data, baseDir } = readJsonArgWithBase(value, label);
+  const uploadCache = new Map();
+  await resolveJsCodeSnapshotFiles(config, profileName, data, baseDir, uploadCache);
+  return data;
+}
+
+async function resolveJsCodeSnapshotFiles(config, profileName, value, baseDir, uploadCache) {
+  if (!value || typeof value !== 'object') return;
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      await resolveJsCodeSnapshotFiles(config, profileName, item, baseDir, uploadCache);
+    }
+    return;
+  }
+
+  if (
+    value.sourceFile &&
+    typeof value.sourceFile === 'object' &&
+    value.sourceFile.localPath
+  ) {
+    const sourceFile = await uploadJsCodeSnapshotFile(
+      config,
+      profileName,
+      value.sourceFile.localPath,
+      baseDir,
+      value.scriptCode,
+      uploadCache
+    );
+    value.runtimeMode = value.runtimeMode || 'trusted_node';
+    value.sourceType = 'file_snapshot';
+    value.sourceFile = sourceFile;
+    value.code = value.code || '';
+  }
+
+  for (const child of Object.values(value)) {
+    await resolveJsCodeSnapshotFiles(config, profileName, child, baseDir, uploadCache);
+  }
+}
+
+async function uploadJsCodeSnapshotFile(
+  config,
+  profileName,
+  localPath,
+  baseDir,
+  scriptCode,
+  uploadCache
+) {
+  const rawLocalPath = String(localPath);
+  const baseResolvedPath = path.resolve(baseDir || process.cwd(), rawLocalPath);
+  const cwdResolvedPath = path.resolve(process.cwd(), rawLocalPath);
+  const resolvedLocalPath = fs.existsSync(baseResolvedPath)
+    ? baseResolvedPath
+    : cwdResolvedPath;
+  const bundlePath = resolveJsCodeBundlePath(resolvedLocalPath, scriptCode);
+  if (!fs.existsSync(bundlePath)) {
+    fail(`JS_CODE bundle不存在: ${bundlePath}`);
+  }
+  const extension = path.extname(bundlePath).toLowerCase();
+  if (!['.js', '.cjs', '.mjs'].includes(extension)) {
+    fail(`JS_CODE bundle必须是 .js/.cjs/.mjs: ${bundlePath}`);
+  }
+  const cacheKey = bundlePath;
+  if (uploadCache.has(cacheKey)) return uploadCache.get(cacheKey);
+
+  const buffer = fs.readFileSync(bundlePath);
+  const uploaded = await requestFormWithAuth(
+    config,
+    profileName,
+    '/file/js-code-snapshot/upload',
+    () => {
+      const formData = new FormData();
+      const blob = new Blob([buffer], { type: 'application/javascript' });
+      formData.append('file', blob, path.basename(bundlePath));
+      return formData;
+    }
+  );
+  const sourceFile = {
+    bucketName: uploaded.bucketName,
+    objectName: uploaded.objectName,
+    sha256: uploaded.sha256,
+    size: uploaded.size,
+    originalName: uploaded.originalName,
+    contentType: uploaded.contentType,
+  };
+  uploadCache.set(cacheKey, sourceFile);
+  print(`已上传JS_CODE快照: ${path.relative(process.cwd(), bundlePath)} (${sourceFile.sha256})`);
+  return sourceFile;
+}
+
+function resolveJsCodeBundlePath(localPath, scriptCode) {
+  const extension = path.extname(localPath).toLowerCase();
+  if (['.js', '.cjs', '.mjs'].includes(extension)) {
+    fail(
+      `JS_CODE V2 要求 AI 源码使用 TypeScript，请把 sourceFile.localPath 指向 src/js-code-nodes/<scriptCode>/index.ts，而不是已构建的 ${extension} 文件: ${localPath}`
+    );
+  }
+  if (extension !== '.ts') {
+    fail(
+      `JS_CODE V2 sourceFile.localPath 必须指向 TypeScript 源文件 src/js-code-nodes/<scriptCode>/index.ts: ${localPath}`
+    );
+  }
+
+  const normalized = localPath.replace(/\\/g, '/');
+  const matched = normalized.match(/src\/js-code-nodes\/([^/]+)\/index\.tsx?$/);
+  const resolvedScriptCode = scriptCode || matched?.[1];
+  if (!resolvedScriptCode) {
+    fail(
+      `无法从 sourceFile.localPath 推断 scriptCode，请使用 src/js-code-nodes/<scriptCode>/index.ts: ${localPath}`
+    );
+  }
+
+  const workspaceRoot = findWorkspaceRoot(localPath);
+  const result = spawnSync('pnpm', ['build-js-code', '--script', resolvedScriptCode], {
+    cwd: workspaceRoot,
+    stdio: 'inherit',
+  });
+  if (result.status !== 0) {
+    fail(`JS_CODE bundle构建失败: ${resolvedScriptCode}`);
+  }
+  return path.join(workspaceRoot, 'dist', 'js-code-nodes', resolvedScriptCode, 'index.cjs');
+}
+
+function findWorkspaceRoot(startPath) {
+  if (!fs.existsSync(startPath)) {
+    return process.cwd();
+  }
+  let dir = fs.statSync(startPath).isDirectory() ? startPath : path.dirname(startPath);
+  while (dir && dir !== path.dirname(dir)) {
+    const packageFile = path.join(dir, 'package.json');
+    if (fs.existsSync(packageFile)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+        if (pkg.scripts?.['build-js-code'] || pkg.name === 'sy-lowcode-app-workspace') {
+          return dir;
+        }
+      } catch {
+        return dir;
+      }
+    }
+    dir = path.dirname(dir);
+  }
+  return process.cwd();
+}
+
+function apiPathWithQuery(apiPath, query) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query || {})) {
+    if (value === undefined || value === null || value === false || value === '') continue;
+    params.set(key, String(value));
+  }
+  const queryString = params.toString();
+  return queryString ? `${apiPath}?${queryString}` : apiPath;
+}
+
+function splitList(value) {
+  if (!value) return [];
+  return String(value)
+    .split(',')
+    .map(item => item.trim())
+    .filter(Boolean);
+}
+
+function renderTerminalQr(text) {
+  try {
+    require('qrcode-terminal').generate(text, { small: true });
+  } catch {
+    print('未安装 qrcode-terminal，已改为展示登录链接。');
+  }
+}
+
+function unwrapApi(payload) {
+  if (!payload || typeof payload !== 'object') return payload;
+  if ('code' in payload && Number(payload.code) >= 400) {
+    const error = new Error(payload.message || 'OpenXiangda API request failed');
+    error.apiCode = Number(payload.code);
+    throw error;
+  }
+  return 'data' in payload ? payload.data : payload;
+}
+
+function isUnauthorized(error) {
+  return (
+    Number(error?.apiCode) === 401 ||
+    String(error?.message || '').includes('HTTP 401')
+  );
+}
+
+async function requestWithAuth(config, profileName, apiPath, options = {}) {
+  const resolved = getProfile(config, profileName);
+  const profile = resolved.profile;
+  if (!profile.token?.accessToken) {
+    fail(`profile ${resolved.profileName} 未登录，请先执行 openxiangda login --profile ${resolved.profileName}`);
+  }
+
+  try {
+    const payload = await requestJson(profile.baseUrl, apiPath, {
+      ...options,
+      accessToken: profile.token.accessToken,
+    });
+    return unwrapApi(payload);
+  } catch (error) {
+    if (!isUnauthorized(error) || !profile.token?.refreshToken) {
+      throw error;
+    }
+    await refreshProfile(config, resolved.profileName);
+    const payload = await requestJson(profile.baseUrl, apiPath, {
+      ...options,
+      accessToken: profile.token.accessToken,
+    });
+    return unwrapApi(payload);
+  }
+}
+
+async function requestFormWithAuth(config, profileName, apiPath, formDataFactory) {
+  const resolved = getProfile(config, profileName);
+  const profile = resolved.profile;
+  if (!profile.token?.accessToken) {
+    fail(`profile ${resolved.profileName} 未登录，请先执行 openxiangda login --profile ${resolved.profileName}`);
+  }
+
+  try {
+    const payload = await requestForm(
+      profile.baseUrl,
+      apiPath,
+      formDataFactory(),
+      profile.token.accessToken
+    );
+    return unwrapApi(payload);
+  } catch (error) {
+    if (!isUnauthorized(error) || !profile.token?.refreshToken) {
+      throw error;
+    }
+    await refreshProfile(config, resolved.profileName);
+    const payload = await requestForm(
+      profile.baseUrl,
+      apiPath,
+      formDataFactory(),
+      profile.token.accessToken
+    );
+    return unwrapApi(payload);
+  }
+}
+
+async function requestForm(baseUrl, apiPath, formData, accessToken) {
+  if (typeof fetch !== 'function') {
+    throw new Error('当前 Node.js 版本不支持 fetch，请使用 Node.js 18 或更高版本');
+  }
+  const url = `${baseUrl.replace(/\/+$/, '')}${apiPath}`;
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      accept: 'application/json',
+      authorization: `Bearer ${accessToken}`,
+    },
+    body: formData,
+  });
+  const text = await response.text();
+  let payload = null;
+  if (text) {
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = { message: text };
+    }
+  }
+  if (!response.ok) {
+    const message = payload?.message || response.statusText || 'request failed';
+    throw new Error(`HTTP ${response.status}: ${message}`);
+  }
+  return payload;
+}
+
+async function refreshProfile(config, profileName) {
+  const { profile } = getProfile(config, profileName);
+  if (!profile.token?.refreshToken) {
+    fail(`profile ${profileName} 没有 refresh token，请重新登录`);
+  }
+  const payload = await requestJson(profile.baseUrl, '/openxiangda-api/v1/auth/refresh', {
+    method: 'POST',
+    body: { refreshToken: profile.token.refreshToken },
+  });
+  const data = unwrapApi(payload);
+  profile.token = {
+    ...profile.token,
+    accessToken: data.accessToken,
+    refreshToken: data.refreshToken,
+    accessTokenExpiresAt: data.accessTokenExpiresAt,
+    refreshTokenExpiresAt: data.refreshTokenExpiresAt,
+  };
+  profile.updatedAt = new Date().toISOString();
+  return {
+    accessTokenExpiresAt: profile.token.accessTokenExpiresAt,
+    refreshTokenExpiresAt: profile.token.refreshTokenExpiresAt,
+  };
+}
+
+function runWorkspacePublish(profileName, profile, appType) {
+  const packageFile = path.join(process.cwd(), 'package.json');
+  if (!fs.existsSync(packageFile)) {
+    fail('当前目录没有 package.json，无法识别工作区发布脚本');
+  }
+  const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+  const scripts = pkg.scripts || {};
+  const scriptName = scripts['openxiangda:publish']
+    ? 'openxiangda:publish'
+    : scripts['publish:all']
+      ? 'publish:all'
+      : null;
+  if (!scriptName) {
+    fail('当前工作区缺少 openxiangda:publish 或 publish:all 脚本');
+  }
+
+  const usePnpm = fs.existsSync(path.join(process.cwd(), 'pnpm-lock.yaml'));
+  const command = usePnpm ? 'pnpm' : 'npm';
+  const args = usePnpm ? ['run', scriptName] : ['run', scriptName];
+  const result = spawnSync(command, args, {
+    cwd: process.cwd(),
+    stdio: 'inherit',
+    env: {
+      ...process.env,
+      OPENXIANGDA_PROFILE: profileName,
+      OPENXIANGDA_BASE_URL: profile.baseUrl,
+      OPENXIANGDA_ACCESS_TOKEN: profile.token.accessToken,
+      OPENXIANGDA_APP_TYPE: appType,
+    },
+  });
+  if (result.status !== 0) {
+    process.exit(result.status || 1);
+  }
+}
+
+module.exports = {
+  main,
+};