openyida 2026.10.13 → 2026.10.14

package/lib/core/command-manifest.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { getMaterialSourcingGuidance } = require('../asset/ai-image');
+const { validateManagedPolicy, managedPolicySchema } = require('./managed-policy');
 const { getVisualDecisionPolicy } = require('../design-plan/visual-policy');
 const { getPageNavigationContract } = require('../design-plan/navigation-policy');
 const { ENTRY_MODES } = require('../design-plan/entry-navigation');
@@ -506,6 +507,13 @@ const COMMAND_SIDE_EFFECTS = new Map([
     read_actions: ['agent-card'],
     mutating_actions: ['serve'],
   })],
+  ['agent', sideEffect('mixed', {
+    mutates_yida: false,
+    mutates_local: true,
+    read_actions: ['doctor', 'status'],
+    mutating_actions: ['connect', 'run', 'disconnect', 'logout'],
+    note: 'Explicit local-agent control. Remote runs use only the current task grant and never read a personal OpenYida profile.',
+  })],
   ['aggregate-table', sideEffect('mixed', {
     mutates_yida: true,
     mutates_local: false,
@@ -780,6 +788,11 @@ const COMMAND_PERMISSIONS = new Map([
   ], actionDependentPermission({
     preauthorized_actions: ['serve'],
   })),
+  ...permissionEntries([
+    'agent',
+  ], actionDependentPermission({
+    ask_actions: ['connect', 'run', 'disconnect', 'logout'],
+  })),
 
   ...permissionEntries([
     'aggregate-table',
@@ -1024,6 +1037,7 @@ function command(id, path, usage, descriptionKey, options = {}) {
     throw new Error('Missing permission metadata for command: ' + id);
   }
   const normalizedPermission = normalizePermission(commandPermission, commandSideEffect);
+  validateManagedPolicy(options.managedRun, id);
 
   return {
     id,
@@ -1044,6 +1058,7 @@ function command(id, path, usage, descriptionKey, options = {}) {
     noteKeys: cloneJsonMetadata(options.noteKeys, []),
     ...(options.resultReuse ? { resultReuse: cloneJsonMetadata(options.resultReuse, null) } : {}),
     hidden: options.hidden === true,
+    managedRun: cloneJsonMetadata(options.managedRun, null),
     sideEffect: cloneSideEffect(commandSideEffect),
     permission: clonePermission(normalizedPermission),
   };
@@ -1054,14 +1069,14 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', {
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
         requiresLogin: false,
         output: 'json',
       }),
-      command('logout', ['logout'], 'logout', 'help.cmd_logout', { requiresLogin: false }),
-      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch>', 'help.cmd_auth', { requiresLogin: false }),
-      command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org'),
-      command('env', ['env'], 'env [--json|setup|list|show|switch|add|remove] [options]', 'help.cmd_env', {
+      command('logout', ['logout'], 'logout', 'help.cmd_logout', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
+      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch>', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] } } }, requiresLogin: false }),
+      command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('env', ['env'], 'env [--json|setup|list|show|switch|add|remove] [options]', 'help.cmd_env', { managedRun: { scope: 'local', allowedFlags: ['--json', '--quiet'] },
         requiresLogin: false,
         output: 'text|json',
       }),
@@ -1071,11 +1086,11 @@ const COMMAND_GROUPS = [
     id: 'app',
     titleKey: 'help.group_app',
     commands: [
-      command('app-entry.get', ['app-entry', 'get'], 'app-entry get <appType> [--json]', 'app_entry.desc_get', {
+      command('app-entry.get', ['app-entry', 'get'], 'app-entry get <appType> [--json]', 'app_entry.desc_get', { managedRun: {'scope':'app','appPosition':1},
         args: [{ name: 'appType', type: 'string', source: 'positional', position: 0, required: true },
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] }],
       }),
-      command('app-entry.set', ['app-entry', 'set'], 'app-entry set <appType> [--frontend <url>|--frontend-page <formUuid>] [--management <url>|--management-page <formUuid>] [--clear-frontend] [--clear-management] [--json]', 'app_entry.desc_set', {
+      command('app-entry.set', ['app-entry', 'set'], 'app-entry set <appType> [--frontend <url>|--frontend-page <formUuid>] [--management <url>|--management-page <formUuid>] [--clear-frontend] [--clear-management] [--json]', 'app_entry.desc_set', { managedRun: {'scope':'app','appPosition':1,'mutation':{'operation':'update_app_entry'}},
         args: [
           { name: 'appType', type: 'string', source: 'positional', position: 0, required: true },
           { name: 'frontend', type: 'string', source: 'option', builder_options: ['--frontend'] },
@@ -1088,21 +1103,21 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Complete URLs, including workbench page IDs, are preserved. --frontend-page requires a published display page. --management-page verifies ownership and builds /workbench/<formUuid>. Generated URLs need runtime verification; public entries require the verified complete URL. Omitted entries remain unchanged.'],
       }),
-      command('app-list', ['app-list'], 'app-list [--type managed|created] [--page N] [--size N]', 'help.cmd_app_list', {
+      command('app-list', ['app-list'], 'app-list [--type managed|created] [--page N] [--size N]', 'help.cmd_app_list', { managedRun: {'scope':'denied','reason':'scope_not_audited'},
         notes: ['Successful results include appUrl/workbenchUrl for the business workspace and adminUrl for developer administration. Complete application delivery retains adminUrl regardless of auth runtime; route construction does not verify recipient access. Preserve the frontend URL from its own page result.'],
       }),
-      command('corp-efficiency', ['corp-efficiency'], 'corp-efficiency [overview|details|detail|groups|notify] [options] [--open|--no-open]', 'help.cmd_corp_efficiency', {
+      command('corp-efficiency', ['corp-efficiency'], 'corp-efficiency [overview|details|detail|groups|notify] [options] [--open|--no-open]', 'help.cmd_corp_efficiency', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'json',
       }),
-      command('create-app', ['create-app'], 'create-app "<name>"|--name <name> [options] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_app', {
+      command('create-app', ['create-app'], 'create-app "<name>"|--name <name> [options] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_app', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         notes: ['Successful results include appUrl/workbenchUrl for the business workspace and adminUrl for developer administration. Complete application delivery retains adminUrl regardless of auth runtime; route construction does not verify recipient access. Preserve the frontend URL from its own page result.'],
       }),
-      command('design-plan.catalog', ['design-plan', 'catalog'], 'design-plan catalog [--json]', 'help.cmd_design_plan_catalog', {
+      command('design-plan.catalog', ['design-plan', 'catalog'], 'design-plan catalog [--json]', 'help.cmd_design_plan_catalog', { managedRun: { scope: 'local' },
         requiresLogin: false, output: 'json',
         args: [{ name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] }],
         notes: ['Read available theme IDs and page patterns before init when the theme mapping is unknown. Theme summaries describe deep/light navigation and deep/light content in natural language; they do not expose navTheme/contentTheme assignment syntax. Reuse this result for the current planning session.'],
       }),
-      command('design-plan.init', ['design-plan', 'init'], 'design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]', 'help.cmd_design_plan_init', {
+      command('design-plan.init', ['design-plan', 'init'], 'design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]', 'help.cmd_design_plan_init', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
         notes: ['Requires a selected theme from --theme-id or visualSelection.themeId. A recorded brief theme cannot be overridden by a conflicting --theme-id; reuse the recorded choice. Init disables comparison and style questions for the selected theme, even when design fields are pending. There is no navigation-tone argument: init reads navTheme from the selected theme template, overwrites stale navigationStyle.tone, and records toneSource=theme_derived. Free creative preserves an explicitly authored navigationStyle.tone and records toneSource=project_defined. Returns preserved business facts, authoring.pendingFields with file/path/message, typed examples in authoring-context.md, and materialize.command with materialize.shell (powershell on Windows, posix elsewhere). Execute the command in that shell. Complete the pending facts, review business coverage, then set ready=true. Author ordered page blocks as {name,purpose}; omitted contentPriority and contentRichness.contentLayers derive from these blocks, preserving explicit overrides. Author project-specific acceptanceCriteria; materialize merges them with resource-based checks. A string visualSelection.colorStrategy is preserved as usage text with primaryColor pending; invalid types fail before files are written. Init guidance is preliminary; materialize still validates the completed plan.'],
@@ -1113,7 +1128,7 @@ const COMMAND_GROUPS = [
           { name: 'json', type: 'boolean', required: false, source: 'option', builder_options: ['--json'] },
         ],
       }),
-      command('design-plan.preview', ['design-plan', 'preview'], 'design-plan preview <build-plan.json> --part-file <module.json> [--json]', 'help.cmd_design_plan_preview', {
+      command('design-plan.preview', ['design-plan', 'preview'], 'design-plan preview <build-plan.json> --part-file <module.json> [--json]', 'help.cmd_design_plan_preview', { managedRun: { scope: 'local' },
         requiresLogin: false, output: 'json',
         args: [
           { name: 'buildPlan', type: 'file', required: true, source: 'positional', position: 0, builder_options: ['--build-plan'] },
@@ -1122,7 +1137,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Updates completed fact modules in preview/ drafts. Modules share a source base; one writer updates changed sections and preserves custom CSS. Final materialize validates the complete plan and writes PRD, design, HTML and theme together.'],
       }),
-      command('design-plan.materialize', ['design-plan', 'materialize'], 'design-plan materialize <build-plan.json> [--from-preview | --business-file <json> --visual-file <json>] [--output-dir <dir>] [--rebase-parts] [--check] [--json]', 'help.cmd_design_plan_materialize', {
+      command('design-plan.materialize', ['design-plan', 'materialize'], 'design-plan materialize <build-plan.json> [--from-preview | --business-file <json> --visual-file <json>] [--output-dir <dir>] [--rebase-parts] [--check] [--json]', 'help.cmd_design_plan_materialize', { managedRun: {'scope':'local'},
         notes: ['Local validation failures include repair.inputHash/errorHash. Do not retry unchanged inputs and arguments; stop after two repair attempts with the same error set. CLI reports diagnostics without persisting retry counters.', 'Validates readable text/surface pairs before materializing. Known low contrast returns DESIGN_THEME_CONTRAST_LOW and never silently recolors the project. Use check-design --json to inspect uncomputed pairs and review them in the browser.', 'Derives navigationStyle.tone and appConfig.navTheme from the selected theme template. Navigation appearance tokens come directly from that template plus explicit visualStyle.tokens; mode-independent tokens such as --pod-nav-menu-item-selected-shadow flow through the base token contract; materialize does not synthesize a light/dark replacement palette. Free creative uses project-authored navigation tone and tokens. Validates image slots before writing artifacts. JSON assetTasks lists taskKey/taskState, independent searches ordered by required/hero/design order, collection-wide concurrency, host-enforced time budgets, two-round limits, resume policy, output paths and resolve argv. After matching plan confirmation, executionContract requires checking background Agent and Bash separately, dispatching only verified nonblocking tools or doing authorized business work before synchronous asset batches; record real job IDs and continue app/form/page work; replace <appType> with the real ID for upload. Materialized PRD execution pages include navigationPolicy derived from app/page navigation: platform-shell is content-only; standalone without a planned menu renders no application menu. This command performs no search or upload. Local asset inputs resolve against the command cwd; absolute paths survive page-task directory changes.'],
         resultReuse: { mode: 'local_input_dependent', inputs: ['buildPlan', 'businessFile', 'visualFile', 'preview'], onInputChange: 'rerun_after_known_success', writes: 'local_artifacts_only' },
         requiresLogin: false,
@@ -1138,7 +1153,7 @@ const COMMAND_GROUPS = [
           { name: 'json', type: 'boolean', required: false, source: 'option', builder_options: ['--json'] },
         ],
       }),
-      command('design-plan.patch', ['design-plan', 'patch'], 'design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]', 'help.cmd_design_plan_patch', {
+      command('design-plan.patch', ['design-plan', 'patch'], 'design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]', 'help.cmd_design_plan_patch', { managedRun: {'scope':'local'},
         notes: ['Local validation failures include repair.inputHash/errorHash. Do not retry unchanged inputs and arguments; stop after two repair attempts with the same error set. CLI reports diagnostics without persisting retry counters.', 'Edit the existing plan with one batch of --set assignments; do not restart init or rewrite business.json/visual.json. navigationStyle.tone, navigationStyle.toneSource and execution.appConfig.navTheme are derived and cannot be patched; change the selected theme instead. For free-creative only, navigationStyle.tone is authored and can be patched. With --materialize, update changed PRD/design/HTML sections and theme tokens, preserving unrelated local content and custom CSS. JSON updated lists artifact files actually written. The CLI maintains .build-plan-artifacts.json as the generated baseline; overlapping local edits fail before any writes. Without --materialize, validate and save source facts without rendering HTML or writing artifacts. Unpresented edits keep the draft revision; substantive edits to a presented version advance once and clear approval. Asset materialStatus/missingAssets updates preserve approval.'],
         requiresLogin: false,
         output: 'text|json',
@@ -1150,7 +1165,7 @@ const COMMAND_GROUPS = [
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
         ],
       }),
-      command('update-app', ['update-app'], 'update-app <appType> [--name "..."] [--desc "..."] [--icon <name>] [--icon-color <color>] [--colour <key>] [--theme-color <color>] [--theme-file <css>] [--confirm-legacy-app-style] [--disable-custom-theme] [--nav-theme light|dark|white|gray] [--logo-source appIcon|customImage] [--layout side|top|l_shape] [--hide-app-nav|--show-app-nav]', 'help.cmd_update_app', {
+      command('update-app', ['update-app'], 'update-app <appType> [--name "..."] [--desc "..."] [--icon <name>] [--icon-color <color>] [--colour <key>] [--theme-color <color>] [--theme-file <css>] [--confirm-legacy-app-style] [--disable-custom-theme] [--nav-theme light|dark|white|gray] [--logo-source appIcon|customImage] [--layout side|top|l_shape] [--hide-app-nav|--show-app-nav]', 'help.cmd_update_app', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'update_app_setting' } },
         args: [
           { name: 'appType', type: 'string', required: true, source: 'positional', position: 0 },
           { name: 'name', type: 'string', source: 'option', builder_options: ['--name', '-n'] },
@@ -1178,7 +1193,7 @@ const COMMAND_GROUPS = [
           'Platform preset keys are used independently of --theme-file and --theme-color. Choose --hide-app-nav or --show-app-nav to set navigation visibility.',
         ],
       }),
-      command('app-theme.snapshot', ['app-theme', 'snapshot'], 'app-theme snapshot <appType> --output-dir <new-dir> [--json]', 'help.cmd_app_theme_snapshot', {
+      command('app-theme.snapshot', ['app-theme', 'snapshot'], 'app-theme snapshot <appType> --output-dir <new-dir> [--json]', 'help.cmd_app_theme_snapshot', { managedRun: { scope: 'app', appPosition: 1 },
         output: 'json',
         args: [
           { name: 'appType', type: 'string', required: true, source: 'positional', position: 0 },
@@ -1187,7 +1202,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Read-only remote snapshot of application theme settings, runtime theme mode, and icon; archive original CSS bytes and checksums in a fresh local directory. Returns restorableKeys and cannotClearKeys. No page/source backup or icon/mode restore. Before beautification, ensure every planned changed key is restorable and no protected field changes; update-app theme upload may also change icon color. Missing or empty originals cannot be restored by the platform single-config endpoint. CSS fetch requires a direct HTTPS text/css response and sends no Yida credentials. Snapshot is not a server transaction; two matching reads detect changes during collection.'],
       }),
-      command('app-theme.restore', ['app-theme', 'restore'], 'app-theme restore <appType> --snapshot <before.json> --expected-current <after.json> [--check | --confirm --output-dir <new-dir>] [--json]', 'help.cmd_app_theme_restore', {
+      command('app-theme.restore', ['app-theme', 'restore'], 'app-theme restore <appType> --snapshot <before.json> --expected-current <after.json> [--check | --confirm --output-dir <new-dir>] [--json]', 'help.cmd_app_theme_restore', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_app', requiredFlags: ['--confirm'] } },
         output: 'json',
         args: [
           { name: 'appType', type: 'string', required: true, source: 'positional', position: 0 },
@@ -1200,7 +1215,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Default/--check performs no remote writes and returns canRestore plus blockers. --confirm attests to user-authorized rollback and requires a new journal directory. Validate both snapshots, CSS bytes and app/corp/base URL; current theme state must equal the snapshot captured immediately after this run, not a newly captured externally changed baseline. Refuse empty/absent target values, changed protected icon/theme mode, or unavailable/changed original CSS. Restore only allowlisted nonempty theme config values via updateSingleConfig; never update the whole app, reupload CSS, upgrade theme mode, or overwrite business settings. Check tracked state before each write and read it back afterwards. This is not atomic/CAS and cannot exclude all concurrent writes. Partial/unknown outcomes retain a journal and require inspection before retry; verified success covers configuration only, not page appearance.'],
       }),
-      command('upgrade-app-theme', ['upgrade-app-theme'], 'upgrade-app-theme <appType> --explicit-request [--confirm | --prepare --output-dir <dir>] [--json]', 'help.cmd_upgrade_app_theme', {
+      command('upgrade-app-theme', ['upgrade-app-theme'], 'upgrade-app-theme <appType> --explicit-request [--confirm | --prepare --output-dir <dir>] [--json]', 'help.cmd_upgrade_app_theme', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'update_app', requiredFlags: ['--confirm'] } },
         output: 'json',
         args: [
           { name: 'appType', type: 'string', required: true, source: 'positional', position: 0 },
@@ -1212,9 +1227,9 @@ const COMMAND_GROUPS = [
         ],
         notes: ['--prepare reads remote schemas/source bundles into a new local backup directory and produces a per-resource migration plan without remote writes; it requires explicit upgrade intent but no mutation confirmation. Before --confirm, use the independent upgrade Skill to prepare/review sources, migrate legacy JSX to Canvas without business/layout changes, and remove verified form-detail style injection. Only mutate after an explicit user request to upgrade an existing app to the modern theme AND an affirmative ask_human reply for that app. These flags attest to both checks; they do not replace human confirmation. If ask_human is unavailable, stop before mutation. The CLI itself checks server-derived agentAppType and app/corp identity before offering any confirmation or preparing backups. agentAppType comes from FROM_BUILDER_AI=y plus BUILDER_AI_SOURCE; source alone or FROM_AI does not qualify. Only local/cloud/qwenwork qualifies. Reject non-AI or unverified apps without offering an upgrade or exposing source fields. Skill guidance and confirmation flags cannot bypass this gate. Do not check V4, appThemeEnable, organization theme gray or upgrade gray. After ask_human approval, migrate legacy navigation layout and colors before persisting CREATED_WITH_MODERN_THEME=y and APP_THEME_MODE=modern, then read all changed settings back. Already modern navigation colors stay unchanged. Report partial/unknown writes on failure. Success verifies configuration only, not page migration or runtime rendering. appUpgradeComplete remains false until the Skill verifies all page/form migrations.'],
       }),
-      command('app-online', ['app-online'], 'app-online <appType> [--to-ding-app-center] [--show-app-center]', 'help.cmd_app_online'),
-      command('app-offline', ['app-offline'], 'app-offline <appType> [--to-ding-app-center] [--show-app-center]', 'help.cmd_app_offline'),
-      command('nav-group', ['nav-group'], 'nav-group <list|create|rename|delete|move|order|auto-order|hide|show> <appType> ...', 'help.cmd_nav_group', {
+      command('app-online', ['app-online'], 'app-online <appType> [--to-ding-app-center] [--show-app-center]', 'help.cmd_app_online', { managedRun: {'scope':'denied','reason':'scope_not_audited'} }),
+      command('app-offline', ['app-offline'], 'app-offline <appType> [--to-ding-app-center] [--show-app-center]', 'help.cmd_app_offline', { managedRun: {'scope':'denied','reason':'scope_not_audited'} }),
+      command('nav-group', ['nav-group'], 'nav-group <list|create|rename|delete|move|order|auto-order|hide|show> <appType> ...', 'help.cmd_nav_group', { managedRun: {'scope':'actions','actions':{'list':{'scope':'app','appPosition':1},'create':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'rename':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'delete':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'move':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'order':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'auto-order':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'hide':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}},'show':{'scope':'app','appPosition':1,'mutation':{'operation':'update_nav'}}}},
         output: 'json',
         aliases: ['group'],
         examples: [
@@ -1224,21 +1239,29 @@ const COMMAND_GROUPS = [
         ],
         notes: ['create accepts --icon auto|<iconName>. By default it selects a business icon from the group title using the page navigation icon catalog, preserves the created node when updating its icon, and verifies readback. list exposes icon. NAV_GROUP_CREATE_INCOMPLETE is not retry-safe: inspect nextStep before further changes. Existing group icons are not automatically changed.'],
       }),
-      command('app-permission', ['app-permission'], 'app-permission <get|set|add|remove|search-user> ...', 'help.cmd_app_permission', {
-        output: 'json',
+      command('app-permission', ['app-permission'], 'app-permission <get|set|add|remove|search-user> ...', 'help.cmd_app_permission', { managedRun: {
+        scope: 'actions',
+        actions: {
+          get: { scope: 'app', appPosition: 1 },
+          set: { scope: 'app', appPosition: 1, mutation: { operation: 'update_app_permission' } },
+          add: { scope: 'app', appPosition: 1, mutation: { operation: 'update_app_permission' } },
+          remove: { scope: 'app', appPosition: 1, mutation: { operation: 'update_app_permission' } }
+        }
+      },
+      output: 'json',
       }),
-      command('i18n', ['i18n'], 'i18n <overview|config|languages|list|upsert|delete|translate|translate-all|upgrade> <appType> ...', 'help.cmd_i18n', {
+      command('i18n', ['i18n'], 'i18n <overview|config|languages|list|upsert|delete|translate|translate-all|upgrade> <appType> ...', 'help.cmd_i18n', { managedRun: { scope: 'actions', actions: { config: { scope: 'actions', actions: { get: { scope: 'app', appPosition: 2 }, set: { scope: 'app', appPosition: 2, mutation: { operation: 'update_app' } } } }, 'overview': { scope: 'app', appPosition: 1 }, 'languages': { scope: 'app', appPosition: 1 }, 'list': { scope: 'app', appPosition: 1 }, 'translate': { scope: 'app', appPosition: 1 }, 'upsert': { scope: 'app', appPosition: 1, mutation: { operation: 'update_app' } }, 'batch-upsert': { scope: 'app', appPosition: 1, mutation: { operation: 'update_app' } }, 'delete': { scope: 'app', appPosition: 1, mutation: { operation: 'update_app' } }, 'translate-all': { scope: 'app', appPosition: 1, mutation: { operation: 'update_app' } }, 'upgrade': { scope: 'app', appPosition: 1, mutation: { operation: 'update_app' } } } },
         output: 'json',
       }),
-      command('export', ['export'], 'export <appType> [output]', 'help.cmd_export'),
-      command('import', ['import'], 'import <file> [name]', 'help.cmd_import'),
+      command('export', ['export'], 'export <appType> [output]', 'help.cmd_export', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('import', ['import'], 'import <file> [name]', 'help.cmd_import', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
     ],
   },
   {
     id: 'form',
     titleKey: 'help.group_form',
     commands: [
-      command('create-form.batch', ['create-form', 'batch'], 'create-form batch <appType> <plan.json> [--concurrency 1..4] [--check] [--json]', 'help.cmd_create_form_batch', {
+      command('create-form.batch', ['create-form', 'batch'], 'create-form batch <appType> <plan.json> [--concurrency 1..4] [--check] [--json]', 'help.cmd_create_form_batch', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'create_form', forbiddenFlags: ['--check'] } },
         output: 'json',
         args: [
           { name: 'appType', type: 'string', required: true, source: 'positional', position: 0, builder_options: ['--app-type'] },
@@ -1249,7 +1272,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Creates independent normal forms concurrently after dependency validation. Each plan item accepts layout (single/double/card/section), theme (default/compact/comfortable), labelAlign (top/left/right), icon and locale, and forwards them to create-form create. References resolve from successful schema readbacks. Existing formUuid entries are read-only reuse. Saves IDs and status beside the plan; recoveryAction and nextAction are enum values: rerun_unchanged_plan reuses successful results and resumes known form IDs; inspect_unknown_write_then_reconcile requires checking uncertain writes before rerunning. Results expose appUrl and formUrl; url remains the compatible form entry. Navigation ordering and shared app configuration follow the batch.'],
       }),
-      command('create-form.create', ['create-form', 'create'], 'create-form create <appType> "<formTitle>" <fieldsJsonFile> [--layout single|double|card|section] [--theme default|compact|comfortable] [--label-align top|left|right] [--icon auto|<iconName>] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_form', {
+      command('create-form.create', ['create-form', 'create'], 'create-form create <appType> "<formTitle>" <fieldsJsonFile> [--layout single|double|card|section] [--theme default|compact|comfortable] [--label-align top|left|right] [--icon auto|<iconName>] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_form', { managedRun: {'scope':'app','appPosition':1,'mutation':{'operation':'create_form'}},
         args: [
           {
             name: 'appType',
@@ -1375,7 +1398,7 @@ const COMMAND_GROUPS = [
           'Divider colorType defaults to theme. If default bindings are unsuitable for the current theme, use custom with backgroundColor, secondaryColor and titleColor designed together; explicit user color values are not required. These are field JSON properties, not CLI flags. Dark-content and composite-title guidance is advisory, not a new validation or upload/save gate.',
         ],
       }),
-      command('create-form.icons', ['create-form', 'icons'], 'create-form icons [--json]', 'help.cmd_list_form_icons', {
+      command('create-form.icons', ['create-form', 'icons'], 'create-form icons [--json]', 'help.cmd_list_form_icons', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'json',
         args: [
@@ -1396,34 +1419,46 @@ const COMMAND_GROUPS = [
           display: 'openyida create-form icons [--json]',
         },
         examples: ['openyida create-form icons --json'],
+        aliases: ['create-form list-icons'],
       }),
-      command('create-form.validate-fields', ['create-form', 'validate-fields'], 'create-form validate-fields <fieldsJsonOrFile> [--json]', 'help.cmd_validate_form', {
+      command('create-form.validate-fields', ['create-form', 'validate-fields'], 'create-form validate-fields <fieldsJsonOrFile> [--json]', 'help.cmd_validate_form', { managedRun: { scope: 'local' },
         requiresLogin: false,
       }),
-      command('create-form.update', ['create-form', 'update'], 'create-form update <appType> <formUuid> (<changesJsonOrFile> | --data-file <changesJsonOrFile>) [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_update_form'),
-      command('create-form.resume', ['create-form', 'resume'], 'create-form resume <appType> <formUuid> <fieldsJsonOrFile> [--json]', 'help.cmd_update_form', {
+      command('create-form.update', ['create-form', 'update'], 'create-form update <appType> <formUuid> (<changesJsonOrFile> | --data-file <changesJsonOrFile>) [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } } }),
+      command('create-form.resume', ['create-form', 'resume'], 'create-form resume <appType> <formUuid> <fieldsJsonOrFile> [--json]', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } },
         notes: ['On save-schema HTTP 5xx, read back the latest schema. Accept already-applied fields or retry missing compatible fields once with the latest revision; conflicts and other failures stop. Success includes appUrl, formUrl and the compatible url field.'],
       }),
-      command('create-form.patch', ['create-form', 'patch'], 'create-form patch <appType> <formUuid> <patchJsonOrFile> [--open|--no-open]', 'help.cmd_update_form'),
-      command('create-form.rule', ['create-form', 'rule'], 'create-form rule <appType> <formUuid> <rulesJsonOrFile> [--open|--no-open]', 'help.cmd_update_form'),
-      command('create-form.validation', ['create-form', 'validation'], 'create-form validation <appType> <formUuid> <validationsJsonOrFile> [--open|--no-open]', 'help.cmd_update_form'),
-      command('add-validation', ['add-validation'], 'add-validation <appType> <formUuid> --field <labelOrId> --type <phone|regex|idCard|email|...> [--message <text>]', 'help.cmd_update_form'),
-      command('create-form.bind-datasource', ['create-form', 'bind-datasource'], 'create-form bind-datasource <appType> <formUuid> <fieldLabelOrId> <dataSourceJsonOrFile> [--open|--no-open]', 'help.cmd_update_form'),
-      command('create-form.add-option', ['create-form', 'add-option'], 'create-form add-option <appType> <formUuid> <fieldLabel> <option1> [option2] ...', 'help.cmd_update_form'),
-      command('list-forms', ['list-forms'], 'list-forms <appType> [--keyword <text>]', 'help.cmd_list_forms', {
+      command('create-form.patch', ['create-form', 'patch'], 'create-form patch <appType> <formUuid> <patchJsonOrFile> [--open|--no-open]', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } } }),
+      command('create-form.rule', ['create-form', 'rule'], 'create-form rule <appType> <formUuid> <rulesJsonOrFile> [--open|--no-open]', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } } }),
+      command('create-form.validation', ['create-form', 'validation'], 'create-form validation <appType> <formUuid> <validationsJsonOrFile> [--open|--no-open]', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } } }),
+      command('add-validation', ['add-validation'], 'add-validation <appType> <formUuid> --field <labelOrId> --type <phone|regex|idCard|email|...> [--message <text>]', 'help.cmd_update_form', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('create-form.bind-datasource', ['create-form', 'bind-datasource'], 'create-form bind-datasource <appType> <formUuid> <fieldLabelOrId> <dataSourceJsonOrFile> [--open|--no-open]', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } } }),
+      command('create-form.add-option', ['create-form', 'add-option'], 'create-form add-option <appType> <formUuid> <fieldLabel> <option1> [option2] ...', 'help.cmd_update_form', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form', formUuidPosition: 2 } } }),
+      command('list-forms', ['list-forms'], 'list-forms <appType> [--keyword <text>]', 'help.cmd_list_forms', { managedRun: { scope: 'app', appPosition: 0 },
         examples: ['openyida list-forms APP_XXX --keyword 客户'],
       }),
-      command('aggregate-table', ['aggregate-table'], 'aggregate-table <list|create-empty|inspect|preview|save|publish|status> <appType> ...', 'help.cmd_aggregate_table', {
-        output: 'json',
+      command('aggregate-table', ['aggregate-table'], 'aggregate-table <list|create-empty|inspect|preview|save|publish|status> <appType> ...', 'help.cmd_aggregate_table', { managedRun: {
+        scope: 'actions',
+        actions: {
+          list: { scope: 'app', appPosition: 1 },
+          inspect: { scope: 'app', appPosition: 1 },
+          preview: { scope: 'app', appPosition: 1 },
+          status: { scope: 'app', appPosition: 1 },
+          'create-empty': { scope: 'app', appPosition: 1, mutation: { operation: 'create_report' } },
+          save: { scope: 'app', appPosition: 1, mutation: { operation: 'create_report' } },
+          publish: { scope: 'app', appPosition: 1, mutation: { operation: 'create_report' } }
+        }
+      },
+      output: 'json',
       }),
-      command('get-schema', ['get-schema'], 'get-schema <appType> <formUuid|--all> [--summary-json|--field-map-json|--analysis-json]', 'help.cmd_get_schema', {
+      command('get-schema', ['get-schema'], 'get-schema <appType> <formUuid|--all> [--summary-json|--field-map-json|--analysis-json]', 'help.cmd_get_schema', { managedRun: { scope: 'app', appPosition: 0 },
         examples: ['openyida get-schema APP_XXX FORM_XXX --field-map-json'],
       }),
-      command('check-prd-completeness', ['check-prd-completeness'], 'check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]', 'help.cmd_check_prd_completeness', {
+      command('check-prd-completeness', ['check-prd-completeness'], 'check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]', 'help.cmd_check_prd_completeness', { managedRun: { scope: 'app', appParser: 'prd-completeness' },
         output: 'json',
         notes: ['Checks resource counts and optional build-manifest.assetExecution recorded intervals. Include materialize.assetTasks and taskState records plus businessWork startedAt/endedAt; missing dispatch proof, missing overlap or assets before business in synchronous fallback produces needs_review. This is record consistency, not independent verification of host events.'],
       }),
-      command('check-design', ['check-design'], 'check-design <design.md> [--prd <prd.md>] [--base-dir <dir>] [--json]', 'help.cmd_check_design', {
+      command('check-design', ['check-design'], 'check-design <design.md> [--prd <prd.md>] [--base-dir <dir>] [--json]', 'help.cmd_check_design', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
         notes: ['Checks 26 text/surface pairs with alpha compositing and a 4.5:1 minimum. Known failures return DESIGN_THEME_CONTRAST_LOW with token names and ratios; paletteContrast.unresolved requires browser review and is not a pass. Disabled colors and decorative swatches are excluded. Gradients, images and local component CSS need visual verification. Theme generation with a complete design document uses the same check and never silently recolors the project.', 'Local validation failures include repair.inputHash/errorHash. Do not retry unchanged inputs and arguments; stop after two repair attempts with the same error set. CLI reports diagnostics without persisting retry counters.', 'Checks declared iconSystem.colorPairs against resolved design tokens. Each pair has a unique name, foreground, background and an opaque surface when the background is translucent. Icon contrast must reach 3:1; JSON iconContrast reports the checked pairs. Unsupported colors and missing surfaces fail rather than count as verified. This does not inspect browser styles, inherited opacity, gradients or undeclared icon colors.'],
@@ -1434,10 +1469,10 @@ const COMMAND_GROUPS = [
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
         ],
       }),
-      command('er', ['er'], 'er <appType> [--format mermaid|json] [--output file] [--include-system] [--include-pages]', 'help.cmd_er', {
+      command('er', ['er'], 'er <appType> [--format mermaid|json] [--output file] [--include-system] [--include-pages]', 'help.cmd_er', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'text|json',
       }),
-      command('create-page', ['create-page'], 'create-page <appType> "<name>" [--mode dashboard] [--hide-nav] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_page', {
+      command('create-page', ['create-page'], 'create-page <appType> "<name>" [--mode dashboard] [--hide-nav] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_page', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'create_page' } },
         output: 'text|json',
         args: [
           { name: 'appType', type: 'string', source: 'positional', position: 0, required: true },
@@ -1456,8 +1491,8 @@ const COMMAND_GROUPS = [
           'Unverified hiding exits nonzero with success=false, pageCreated=true, pageId and CREATE_PAGE_NAVIGATION_NOT_VERIFIED. Use recovery.command/args and recovery.verifyCommand/verifyArgs on that existing page. Never repeat create-page to repair navigation.',
         ],
       }),
-      command('build-page', ['build-page'], 'build-page <sourceFile> [--output file|--write]', 'help.cmd_build_page', { requiresLogin: false }),
-      command('check-page', ['check-page'], 'check-page <src> [--compat] [--json]', 'help.cmd_check_page', {
+      command('build-page', ['build-page'], 'build-page <sourceFile> [--output file|--write]', 'help.cmd_build_page', { managedRun: { scope: 'local' }, requiresLogin: false }),
+      command('check-page', ['check-page'], 'check-page <src> [--compat] [--json]', 'help.cmd_check_page', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
         args: [
@@ -1467,7 +1502,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Local source validation, including form-open-container checks for recognized form links and drawer structure. Fails with CHECK_PAGE_FAILED and per-rule diagnostics. Dynamic interactions still require runtime verification.'],
       }),
-      command('compile', ['compile'], 'compile <src> [--canvas] [--compat] [--skip-lint] [--strict-theme|--allow-fixed-brand] [--json]', 'help.cmd_compile', {
+      command('compile', ['compile'], 'compile <src> [--canvas] [--compat] [--skip-lint] [--strict-theme|--allow-fixed-brand] [--json]', 'help.cmd_compile', { managedRun: {'scope':'local'},
         requiresLogin: false,
         output: 'text|json',
         args: [
@@ -1481,7 +1516,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Local validation failures include repair.inputHash/errorHash. Do not retry unchanged inputs and arguments; stop after two repair attempts with the same error set. CLI reports diagnostics without persisting retry counters.', 'Canvas compilation checks theme provider mounting, theme reads before the provider is active, module-level theme context declarations, fixed ConfigProvider brand colors, and known navigation destinations missing appType. Extract canvas-theme and canvas-navigation before coding. Form actions also require the maintained form-open-container fragment, hook and rendered container. Fixed brand colors remain in the source and are returned in warnings even with --json; --strict-theme blocks them and --allow-fixed-brand preserves them. These flags are Canvas-only and mutually exclusive. Dynamic colors, resource identity and runtime rendering still require verification.'],
       }),
-      command('publish', ['publish'], 'publish <src> <appType> <formUuid> [--health-check] [--force] [--canvas] [--compat] [--skip-lint] [--fix-theme] [--strict-theme] [--allow-fixed-brand] [--auto-nav-order] [--open|--no-open] [--json]', 'help.cmd_publish', {
+      command('publish', ['publish'], 'publish <src> <appType> <formUuid> [--health-check] [--force] [--canvas] [--compat] [--skip-lint] [--fix-theme] [--strict-theme] [--allow-fixed-brand] [--auto-nav-order] [--open|--no-open] [--json]', 'help.cmd_publish', { managedRun: {'scope':'app','appPosition':1,'sourcePosition':0,'mutation':{'operation':'publish_page','formUuidPosition':2}},
         args: [
           { name: 'src', type: 'file', source: 'positional', position: 0, required: true },
           { name: 'appType', type: 'string', source: 'positional', position: 1, required: true },
@@ -1501,7 +1536,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['Canvas publishing runs the same theme and form-open-container structure checks as compile before login or remote writes. --force does not bypass Canvas compilation checks. --health-check verifies saved content; inspect the actual page for runtime behavior. Fixed brand overrides are preserved with structured warnings by default. --strict-theme blocks them; --allow-fixed-brand conflicts with --strict-theme and --fix-theme. --fix-theme requires the migrated controls to be inside a mounted CanvasThemeProvider and compiles before writing. Unproven dynamic render paths require manual migration. No stdin prompts.', 'Publishing reads persisted page navigation by default without a new flag. With renderNav=false, url and standaloneUrl use the clean /custom/<formUuid> route, with no navigation query parameters; workbenchUrl remains available. Unknown or visible navigation returns standaloneUrl=null; inspect navigationVerification and navigationWarning. A navigation read failure does not undo publication or prove standalone readiness. Configure scoped service frontend pages persistently before publishing; get-form-config can recover the verified URL without republishing.'],
       }),
-      command('update-form-config', ['update-form-config'], 'update-form-config <appType> <formUuid> <true|false|keep> "<title>" [--locale zh_CN|en_US|ja_JP]', 'help.cmd_update_form_config', {
+      command('update-form-config', ['update-form-config'], 'update-form-config <appType> <formUuid> <true|false|keep> "<title>" [--locale zh_CN|en_US|ja_JP]', 'help.cmd_update_form_config', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'update_form_config', formUuidPosition: 1 } },
         args: [
           { name: 'appType', type: 'string', source: 'positional', position: 0, required: true },
           { name: 'formUuid', type: 'string', source: 'positional', position: 1, required: true },
@@ -1511,7 +1546,7 @@ const COMMAND_GROUPS = [
         ],
         notes: ['A successful write acknowledgement is not navigation readback. Follow with get-form-config <appType> <formUuid> --json; inspect renderNav, falling back to isRenderNav only when renderNav is absent.'],
       }),
-      command('get-form-config', ['get-form-config'], 'get-form-config <appType> <formUuid> [--json]', 'help.cmd_get_form_config', {
+      command('get-form-config', ['get-form-config'], 'get-form-config <appType> <formUuid> [--json]', 'help.cmd_get_form_config', { managedRun: { scope: 'app', appPosition: 0 },
         output: 'json',
         args: [
           { name: 'appType', type: 'string', source: 'positional', position: 0, required: true },
@@ -1527,43 +1562,74 @@ const COMMAND_GROUPS = [
     titleKey: 'help.group_data',
     commands: [
       command('data', ['data'], 'data <query|get|create|update> <resource> ... | delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]', 'help.cmd_data', {
+        managedRun: { scope: 'actions', actions: {
+          query: { scope: 'actions', actions: {
+            form: { scope: 'app', appPosition: 2 }, subform: { scope: 'app', appPosition: 2 },
+            process: { scope: 'app', appPosition: 2 }, 'operation-records': { scope: 'app', appPosition: 2 },
+            tasks: { scope: 'app', appPosition: 2 },
+          } },
+          get: { scope: 'actions', actions: {
+            form: { scope: 'app', appPosition: 2 }, subform: { scope: 'app', appPosition: 2 },
+            process: { scope: 'app', appPosition: 2 },
+          } },
+          create: { scope: 'actions', actions: {
+            form: { scope: 'app', appPosition: 2, mutation: { operation: 'create_form_data', formUuidPosition: 3 } },
+            process: { scope: 'app', appPosition: 2, mutation: { operation: 'create_form_data', formUuidPosition: 3 } },
+          } },
+          update: { scope: 'actions', actions: {
+            form: { scope: 'app', appPosition: 2, mutation: { operation: 'update_form_data', formUuidOption: '--form-uuid' } },
+            process: { scope: 'app', appPosition: 2, mutation: { operation: 'update_form_data', formUuidOption: '--form-uuid' } },
+          } },
+          delete: { scope: 'actions', actions: {
+            form: { scope: 'app', appPosition: 2, mutation: { operation: 'delete_form_data', formUuidPosition: 3 } },
+          } },
+          execute: { scope: 'actions', actions: {
+            task: { scope: 'app', appPosition: 2, mutation: { operation: 'execute_task', formUuidOption: '--form-uuid' } },
+          } },
+        } },
         output: 'json',
         noteKeys: ['help.data_notes'],
+        notes: [
+          'Each condition uses key (field ID), componentName, type, operator and value. Query types: TextField/TextareaField/TableField TEXT; NumberField/RateField/DateField/CascadeDateField DOUBLE; RadioField/SelectField/CheckboxField/MultiSelectField/DepartmentSelectField ARRAY; EmployeeField/CascadeSelectField/CitySelectField STRING; ImageField/AttachmentField TEXT.',
+          'Ordinary form searchFormDatas accepts AND condition arrays via --search-json/--search-file. DateField: type DOUBLE, is/is_not, value ""; zero is filled. Query range endpoints as DateField with .start/.end: both empty means unfilled, both filled means complete.',
+          'Use synchronized NumberField counts (eq 0/gt 0) for any filled endpoint, multi-choice options or subform rows; maintain every write entry and backfill history. --resolve-aliases supports rangeAlias.start/.end and parentId aliases. Use server pagination and dynamicOrder. Guide: yida-skills/references/query-condition-guide.md; sample: yida-data-management empty-query.',
+        ],
         examples: [
+          'openyida data query form APP_XXX FORM_XXX --page 1 --size 20 --search-json \'[{"key":"dateField_due","componentName":"DateField","type":"DOUBLE","operator":"is","value":""}]\'',
           'openyida data create form APP_XXX FORM_XXX --expect-form-name 客户 --expect-form-type receipt --data-json \'{"textField_name":"客户 A","dateField_followUp":1787932800000}\'',
           'openyida data delete form APP_XXX FORM_XXX --inst-id FINST_XXX --expect-form-name 客户 --expect-form-type receipt --confirm --json',
         ],
       }),
-      command('task-center', ['task-center'], 'task-center <type> [options]', 'help.cmd_task_center'),
-      command('basic-info', ['basic-info'], 'basic-info <overview|commodity|grant|capacity|quota|abs-path|dataflow|i18n|domain>', 'help.cmd_basic_info', {
+      command('task-center', ['task-center'], 'task-center <type> [options]', 'help.cmd_task_center', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('basic-info', ['basic-info'], 'basic-info <overview|commodity|grant|capacity|quota|abs-path|dataflow|i18n|domain>', 'help.cmd_basic_info', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'json',
       }),
-      command('read-dingtalk-doc', ['read-dingtalk-doc'], 'read-dingtalk-doc <docUrl> [--output <file>] [--json]', 'help.cmd_read_dingtalk_doc', {
+      command('read-dingtalk-doc', ['read-dingtalk-doc'], 'read-dingtalk-doc <docUrl> [--output <file>] [--json]', 'help.cmd_read_dingtalk_doc', { managedRun: { scope: 'selected_input', inputType: 'ding_doc', inputField: 'docUrl' },
         output: 'text|json',
       }),
-      command('read-dingtalk-tingji', ['read-dingtalk-tingji'], 'read-dingtalk-tingji <taskUuid> [--json]', 'help.cmd_read_dingtalk_tingji', {
+      command('read-dingtalk-tingji', ['read-dingtalk-tingji'], 'read-dingtalk-tingji <taskUuid> [--json]', 'help.cmd_read_dingtalk_tingji', { managedRun: { scope: 'selected_input', inputType: 'tingji', inputField: 'taskUuid' },
         output: 'json',
       }),
-      command('get-permission', ['get-permission'], 'get-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--json]', 'help.cmd_get_permission'),
-      command('save-permission', ['save-permission'], 'save-permission <appType> <formUuid> --package-uuid <packageUuid> [--data-permission <json>|--action-permission <json>|--field-permission <json>]', 'help.cmd_save_permission', {
+      command('get-permission', ['get-permission'], 'get-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--json]', 'help.cmd_get_permission', { managedRun: { scope: 'app', appPosition: 0 } }),
+      command('save-permission', ['save-permission'], 'save-permission <appType> <formUuid> --package-uuid <packageUuid> [--data-permission <json>|--action-permission <json>|--field-permission <json>]', 'help.cmd_save_permission', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'update_form_permission', formUuidPosition: 1 } },
         examples: [
           'openyida get-permission APP_XXX FORM_XXX --json',
           'openyida save-permission APP_XXX FORM_XXX --package-uuid PACKAGE_XXX --data-permission \'{"dataRange":"ORIGINATOR"}\'',
         ],
       }),
-      command('corp-manager', ['corp-manager'], 'corp-manager <search-user|list|add|remove|address-book> ...', 'help.cmd_corp_manager', { output: 'json' }),
-      command('agent-center', ['agent-center'], 'agent-center <list|create|update|cancel|range|search-user> ...', 'help.cmd_agent_center', { output: 'json' }),
+      command('corp-manager', ['corp-manager'], 'corp-manager <search-user|list|add|remove|address-book> ...', 'help.cmd_corp_manager', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, output: 'json' }),
+      command('agent-center', ['agent-center'], 'agent-center <list|create|update|cancel|range|search-user> ...', 'help.cmd_agent_center', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, output: 'json' }),
     ],
   },
   {
     id: 'process',
     titleKey: 'help.group_process',
     commands: [
-      command('configure-process', ['configure-process'], 'configure-process <appType> <formUuid> <definition> [processCode] [--replace]', 'help.cmd_configure_process', {
+      command('configure-process', ['configure-process'], 'configure-process <appType> <formUuid> <definition> [processCode] [--replace]', 'help.cmd_configure_process', { managedRun: {'scope':'app','appPosition':0,'mutation':{'operation':'update_process','formUuidPosition':1}},
         resultReuse: { mode: 'non_replayable_write', inputs: ['definition'], onInputChange: 'read_back_and_confirm_new_update', reason: 'May create and publish a new process version; --replace is not an idempotency key.' },
         examples: ['openyida configure-process APP_XXX FORM_XXX .cache/openyida/process/process-with-actions.json'],
       }),
-      command('create-process', ['create-process'], 'create-process <appType> <formTitle> <fieldsJsonFile> <processDefinitionFile> [--replace] | create-process <appType> --formUuid <formUuid> <processDefinitionFile> [--replace]', 'help.cmd_create_process', {
+      command('create-process', ['create-process'], 'create-process <appType> <formTitle> <fieldsJsonFile> <processDefinitionFile> [--replace] | create-process <appType> --formUuid <formUuid> <processDefinitionFile> [--replace]', 'help.cmd_create_process', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'create_process' } },
         output: 'json',
         noteKeys: ['help.create_process_notes'],
         examples: [
@@ -1571,21 +1637,31 @@ const COMMAND_GROUPS = [
           'openyida create-process APP_XXX --formUuid FORM_XXX .cache/openyida/process/process-with-actions.json',
         ],
       }),
-      command('ai-form-setting', ['ai-form-setting'], 'ai-form-setting <get|fields|models|enable|disable|save> <appType> ...', 'help.cmd_ai_form_setting', {
-        output: 'json',
-        aliases: ['ai-approve', 'aiFormSetting'],
+      command('ai-form-setting', ['ai-form-setting'], 'ai-form-setting <get|fields|models|enable|disable|save> <appType> ...', 'help.cmd_ai_form_setting', { managedRun: {
+        scope: 'actions',
+        actions: {
+          get: { scope: 'app', appPosition: 1 },
+          fields: { scope: 'app', appPosition: 1 },
+          models: { scope: 'app', appPosition: 1 },
+          enable: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form_config' } },
+          disable: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form_config' } },
+          save: { scope: 'app', appPosition: 1, mutation: { operation: 'update_form_config' } }
+        }
+      },
+      output: 'json',
+      aliases: ['ai-approve', 'aiFormSetting'],
       }),
-      command('process.preview', ['process', 'preview'], 'process preview <appType> ...', 'help.cmd_process_preview'),
+      command('process.preview', ['process', 'preview'], 'process preview <appType> ...', 'help.cmd_process_preview', { managedRun: { scope: 'app', appPosition: 1 } }),
     ],
   },
   {
     id: 'share',
     titleKey: 'help.group_share',
     commands: [
-      command('verify-short-url', ['verify-short-url'], 'verify-short-url <appType> ...', 'help.cmd_verify_url'),
-      command('save-share-config', ['save-share-config'], 'save-share-config <appType> ...', 'help.cmd_save_share'),
-      command('get-page-config', ['get-page-config'], 'get-page-config <appType> <formUuid>', 'help.cmd_get_page_config'),
-      command('externalize-form', ['externalize-form'], 'externalize-form <appType> <formUuid> [--schema-file file]', 'help.cmd_externalize_form', {
+      command('verify-short-url', ['verify-short-url'], 'verify-short-url <appType> ...', 'help.cmd_verify_url', { managedRun: { scope: 'app', appPosition: 0 } }),
+      command('save-share-config', ['save-share-config'], 'save-share-config <appType> ...', 'help.cmd_save_share', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'update_share_config', formUuidPosition: 1 } } }),
+      command('get-page-config', ['get-page-config'], 'get-page-config <appType> <formUuid>', 'help.cmd_get_page_config', { managedRun: { scope: 'app', appPosition: 0 } }),
+      command('externalize-form', ['externalize-form'], 'externalize-form <appType> <formUuid> [--schema-file file]', 'help.cmd_externalize_form', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'json|markdown',
       }),
     ],
@@ -1594,57 +1670,57 @@ const COMMAND_GROUPS = [
     id: 'report',
     titleKey: 'help.group_report',
     commands: [
-      command('create-report', ['create-report'], 'create-report <appType> "<name>" ... [--json] [--open|--no-open]', 'help.cmd_create_report'),
-      command('append-chart', ['append-chart'], 'append-chart <appType> <reportId> ... [--json] [--open|--no-open]', 'help.cmd_append_chart'),
-      command('report.inspect', ['report', 'inspect'], 'report inspect <appType> <reportId> --json', 'help.cmd_report_inspect', { output: 'json', resultReuse: { mode: 'read_only', invalidateAfter: 'observed_remote_mutation', source: 'current_server_schema_and_query_probes' } }),
+      command('create-report', ['create-report'], 'create-report <appType> "<name>" ... [--json] [--open|--no-open]', 'help.cmd_create_report', { managedRun: {'scope':'app','appPosition':0,'mutation':{'operation':'create_report'}} }),
+      command('append-chart', ['append-chart'], 'append-chart <appType> <reportId> ... [--json] [--open|--no-open]', 'help.cmd_append_chart', { managedRun: { scope: 'app', appPosition: 0, mutation: { operation: 'update_report', formUuidPosition: 1 } } }),
+      command('report.inspect', ['report', 'inspect'], 'report inspect <appType> <reportId> --json', 'help.cmd_report_inspect', { managedRun: {'scope':'app','appPosition':1}, output: 'json', resultReuse: { mode: 'read_only', invalidateAfter: 'observed_remote_mutation', source: 'current_server_schema_and_query_probes' } }),
     ],
   },
   {
     id: 'connector',
     titleKey: 'help.group_connector',
     commands: [
-      command('connector.list', ['connector', 'list'], 'connector list', 'help.cmd_connector_list'),
-      command('connector.create', ['connector', 'create'], 'connector create "name" "domain" ...', 'help.cmd_connector_create'),
-      command('connector.detail', ['connector', 'detail'], 'connector detail <id>', 'help.cmd_connector_detail'),
-      command('connector.delete', ['connector', 'delete'], 'connector delete <id> [--force]', 'help.cmd_connector_delete'),
-      command('connector.add-action', ['connector', 'add-action'], 'connector add-action --operations <file> --connector-id <id>', 'help.cmd_connector_add_action'),
-      command('connector.update-action', ['connector', 'update-action'], 'connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm', 'help.cmd_connector_update_action'),
-      command('connector.list-actions', ['connector', 'list-actions'], 'connector list-actions <id>', 'help.cmd_connector_list_actions'),
-      command('connector.delete-action', ['connector', 'delete-action'], 'connector delete-action <id> <operation-id>', 'help.cmd_connector_delete_action'),
-      command('connector.test', ['connector', 'test'], 'connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]', 'help.cmd_connector_test'),
-      command('connector.list-connections', ['connector', 'list-connections'], 'connector list-connections <id>', 'help.cmd_connector_list_connections'),
-      command('connector.create-connection', ['connector', 'create-connection'], 'connector create-connection <id> <name> [--interactive]', 'help.cmd_connector_create_connection'),
-      command('connector.smart-create', ['connector', 'smart-create'], 'connector smart-create --curl "..."', 'help.cmd_connector_smart'),
-      command('connector.parse-api', ['connector', 'parse-api'], 'connector parse-api [options]', 'help.cmd_connector_parse_api'),
-      command('connector.gen-template', ['connector', 'gen-template'], 'connector gen-template [output]', 'help.cmd_connector_gen_template'),
+      command('connector.list', ['connector', 'list'], 'connector list', 'help.cmd_connector_list', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.create', ['connector', 'create'], 'connector create "name" "domain" ...', 'help.cmd_connector_create', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.detail', ['connector', 'detail'], 'connector detail <id>', 'help.cmd_connector_detail', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.delete', ['connector', 'delete'], 'connector delete <id> [--force]', 'help.cmd_connector_delete', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.add-action', ['connector', 'add-action'], 'connector add-action --operations <file> --connector-id <id>', 'help.cmd_connector_add_action', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.update-action', ['connector', 'update-action'], 'connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm', 'help.cmd_connector_update_action', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.list-actions', ['connector', 'list-actions'], 'connector list-actions <id>', 'help.cmd_connector_list_actions', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.delete-action', ['connector', 'delete-action'], 'connector delete-action <id> <operation-id>', 'help.cmd_connector_delete_action', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.test', ['connector', 'test'], 'connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]', 'help.cmd_connector_test', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.list-connections', ['connector', 'list-connections'], 'connector list-connections <id>', 'help.cmd_connector_list_connections', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.create-connection', ['connector', 'create-connection'], 'connector create-connection <id> <name> [--interactive]', 'help.cmd_connector_create_connection', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.smart-create', ['connector', 'smart-create'], 'connector smart-create --curl "..."', 'help.cmd_connector_smart', { managedRun: { scope: 'denied', reason: 'organization_scope_required' } }),
+      command('connector.parse-api', ['connector', 'parse-api'], 'connector parse-api [options]', 'help.cmd_connector_parse_api', { managedRun: { scope: 'local' } }),
+      command('connector.gen-template', ['connector', 'gen-template'], 'connector gen-template [output]', 'help.cmd_connector_gen_template', { managedRun: { scope: 'local' } }),
     ],
   },
   {
     id: 'integration',
     titleKey: 'help.group_integration',
     commands: [
-      command('integration.create', ['integration', 'create'], 'integration create <appType> ... [--spec file.json] [--connector-system-token-app <appType>]', 'help.cmd_integration'),
-      command('integration.update', ['integration', 'update'], 'integration update <appType> <formUuid> <processCode> --spec <desired-spec.json> [--publish]', 'help.cmd_integration_update', {
+      command('integration.create', ['integration', 'create'], 'integration create <appType> ... [--spec file.json] [--connector-system-token-app <appType>]', 'help.cmd_integration', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'create_process' } } }),
+      command('integration.update', ['integration', 'update'], 'integration update <appType> <formUuid> <processCode> --spec <desired-spec.json> [--publish]', 'help.cmd_integration_update', { managedRun: { scope: 'app', appPosition: 1 },
         requiresLogin: false,
         output: 'json',
       }),
-      command('integration.list', ['integration', 'list'], 'integration list <appType> [--flow-types 1,2,3,5,6] [--form-uuid <uuid>] [--status y|n] [--json]', 'help.cmd_integration_list', {
+      command('integration.list', ['integration', 'list'], 'integration list <appType> [--flow-types 1,2,3,5,6] [--form-uuid <uuid>] [--status y|n] [--json]', 'help.cmd_integration_list', { managedRun: { scope: 'app', appPosition: 1 },
         output: 'json',
       }),
-      command('integration.enable', ['integration', 'enable'], 'integration enable <appType> <formUuid> <processCode>', 'help.cmd_integration_enable', {
+      command('integration.enable', ['integration', 'enable'], 'integration enable <appType> <formUuid> <processCode>', 'help.cmd_integration_enable', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_process', formUuidPosition: 2 } },
         output: 'json',
       }),
-      command('integration.disable', ['integration', 'disable'], 'integration disable <appType> <formUuid> <processCode>', 'help.cmd_integration_disable', {
+      command('integration.disable', ['integration', 'disable'], 'integration disable <appType> <formUuid> <processCode>', 'help.cmd_integration_disable', { managedRun: { scope: 'app', appPosition: 1, mutation: { operation: 'update_process', formUuidPosition: 2 } },
         output: 'json',
       }),
-      command('integration.check', ['integration', 'check'], 'integration check <appType...>', 'help.cmd_integration_check'),
-      command('integration.diagnose', ['integration', 'diagnose'], 'integration diagnose (--text <text>|--file <path>|--rules) [--json]', 'help.cmd_integration_diagnose', {
+      command('integration.check', ['integration', 'check'], 'integration check <appType...>', 'help.cmd_integration_check', { managedRun: { scope: 'app', appPosition: 1 } }),
+      command('integration.diagnose', ['integration', 'diagnose'], 'integration diagnose (--text <text>|--file <path>|--rules) [--json]', 'help.cmd_integration_diagnose', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
       }),
-      command('dws', ['dws'], 'dws <command> [args]', 'help.cmd_dws'),
-      command('dws.contact-user-search', ['dws', 'contact', 'user', 'search'], 'dws contact user search --keyword <text>', 'help.cmd_dws'),
-      command('dingtalk-link', ['dingtalk-link'], 'dingtalk-link <url> [--target fullScreen] [--legacy-scheme] [--json]', 'help.cmd_dingtalk_link', {
+      command('dws', ['dws'], 'dws <command> [args]', 'help.cmd_dws', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('dws.contact-user-search', ['dws', 'contact', 'user', 'search'], 'dws contact user search --keyword <text>', 'help.cmd_dws', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('dingtalk-link', ['dingtalk-link'], 'dingtalk-link <url> [--target fullScreen] [--legacy-scheme] [--json]', 'help.cmd_dingtalk_link', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
       }),
@@ -1654,32 +1730,38 @@ const COMMAND_GROUPS = [
     id: 'utility',
     titleKey: 'help.group_utility',
     commands: [
-      command('commands', ['commands'], 'commands [--json]', 'help.cmd_commands', {
+      command('commands', ['commands'], 'commands [--json]', 'help.cmd_commands', { managedRun: { scope: 'local' },
+        requiresLogin: false,
+        output: 'json',
+      }),
+      command('agent-capabilities', ['agent-capabilities'], 'agent-capabilities [--json] [--summary-json|--compact]', 'help.cmd_agent_capabilities', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'json',
       }),
-      command('agent-capabilities', ['agent-capabilities'], 'agent-capabilities [--json] [--summary-json|--compact]', 'help.cmd_agent_capabilities', {
+      command('agent', ['agent'], 'agent <doctor|diagnose|status|connect|run|disconnect|logout|logs> [options]', 'help.cmd_agent', { managedRun: { scope: 'actions', actions: { 'ask-human': { scope: 'local' } } },
         requiresLogin: false,
         output: 'json',
+        examples: ['openyida agent diagnose --json', 'openyida agent diagnose --session "<Yida session URL>" --json', 'openyida agent run --help'],
       }),
-      command('mcp', ['mcp'], 'mcp', 'help.cmd_commands', {
+      command('mcp', ['mcp'], 'mcp', 'help.cmd_commands', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         requiresLogin: false,
         output: 'json',
         hidden: true,
       }),
-      command('a2a', ['a2a'], 'a2a <serve|agent-card> [options]', 'help.cmd_a2a', {
+      command('a2a', ['a2a'], 'a2a <serve|agent-card> [options]', 'help.cmd_a2a', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         requiresLogin: false,
         output: 'text|json',
       }),
-      command('bridge', ['bridge'], 'bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open|--no-open]', 'help.cmd_bridge', {
+      command('bridge', ['bridge'], 'bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open|--no-open]', 'help.cmd_bridge', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         requiresLogin: false,
         output: 'text|json',
       }),
-      command('copy', ['copy'], 'copy [--force]', 'help.cmd_copy', { requiresLogin: false }),
-      command('sample', ['sample'], 'sample [--list] [<skill> <name>] [--output <file-or-directory>] [--var KEY=VALUE ...] [--design-file <design.md>] [--style-id <themeId|free-creative>] [--theme-ids <id,...>] [--pop-art-context <explicit-request|showcase>]', 'help.cmd_sample', {
+      command('copy', ['copy'], 'copy [--force]', 'help.cmd_copy', { managedRun: {'scope':'denied','reason':'scope_not_audited'}, requiresLogin: false }),
+      command('sample', ['sample'], 'sample [--list] [<skill> <name>] [--output <file-or-directory>] [--var KEY=VALUE ...] [--design-file <design.md>] [--style-id <themeId|free-creative>] [--theme-ids <id,...>] [--pop-art-context <explicit-request|showcase>]', 'help.cmd_sample', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
         notes: [
+          'openyida sample yida-data-management empty-query --output <file.js> emits buildEmptyConditions, buildCountConditions and countFilledRangeEndpoints. Use current schema field IDs and explicit range modes. Returned arrays work with --search-json or page searchFormDatas. The template performs no query, schema change or count maintenance.',
           'On explicit preview requests only: openyida sample yida-design theme-preview --theme-ids <comma-separated-ids> --output <preview.html> --json generates a standalone read-only HTML gallery on any host. Displays all requested eligible themes, titles and images only, four to six columns on desktop with responsive wrapping and unlimited rows; refuses existing files. No selection buttons. Use ask_human for selection. app-pop requires --pop-art-context explicit-request|showcase with actual task evidence; absent evidence, exclude it from recommendations, choices and previews.',
           'Optional read-only QwenWork preview, only on explicit user request: run openyida sample yida-design theme-selector --json to prepare only the preview HTML in the host skills directory. No bridge submission; selection always uses ask_human. Pass result.widget_path unchanged to qoder_show_widget; it is relative to result.skillsRoot, not result.outputPath or a repository path. This sample does not accept --output, --var, --design-file or --style-id.',
           'yida-design app-theme reads concrete tokens from --design-file and writes CSS plus a sibling <output>.tokens.md update snapshot. The same output path preserves project CSS and applies changed tokens. Without --design-file it resets the output to the public base template. Menu radius, normal/hover/selected borders and selected shadow apply to side, L-shaped and top navigation; only legacy/shared-skeleton CSS gains missing menu-shape rules. Named templates preserve paired CSS declarations and selectors, instantiate brand placeholders and apply project deltas without auto-adding navigation rules or color-group.',
@@ -1707,30 +1789,30 @@ const COMMAND_GROUPS = [
           { name: 'styleId', type: 'string', source: 'option', builder_options: ['--style-id'], description: 'Required only for yida-design application-style. Accepts any themeId from design-plan catalog, including shared themes and free-creative. Exports design.md, app_theme.css and form-layout.json with brand placeholders; accepts neither --design-file nor --var.' },
         ],
       }),
-      command('doctor', ['doctor'], 'doctor [--fix]', 'help.cmd_doctor', { requiresLogin: false }),
-      command('db-seq-fix', ['db-seq-fix'], 'db-seq-fix [--fix]', 'help.cmd_db_seq_fix'),
-      command('formula.evaluate', ['formula', 'evaluate'], 'formula evaluate <formula|file> [--schema file]', 'help.cmd_formula_evaluate', {
+      command('doctor', ['doctor'], 'doctor [--fix]', 'help.cmd_doctor', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
+      command('db-seq-fix', ['db-seq-fix'], 'db-seq-fix [--fix]', 'help.cmd_db_seq_fix', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('formula.evaluate', ['formula', 'evaluate'], 'formula evaluate <formula|file> [--schema file]', 'help.cmd_formula_evaluate', { managedRun: { scope: 'local' },
         requiresLogin: false,
         output: 'text|json',
       }),
-      command('update', ['update'], 'update', 'help.cmd_update', { requiresLogin: false }),
-      command('export-conversation', ['export-conversation'], 'export-conversation [options]', 'help.cmd_export_conversation', {
+      command('update', ['update'], 'update', 'help.cmd_update', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
+      command('export-conversation', ['export-conversation'], 'export-conversation [options]', 'help.cmd_export_conversation', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         requiresLogin: false,
       }),
-      command('feedback', ['feedback'], 'feedback <setup|url|dismiss|status> [options]', 'help.cmd_feedback', {
+      command('feedback', ['feedback'], 'feedback <setup|url|dismiss|status> [options]', 'help.cmd_feedback', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         requiresLogin: false,
         output: 'text|json',
       }),
-      command('batch', ['batch'], 'batch <file>|--commands "cmd1 ; cmd2" [--stop-on-error] [--json]', 'help.cmd_batch', {
+      command('batch', ['batch'], 'batch <file>|--commands "cmd1 ; cmd2" [--stop-on-error] [--json]', 'help.cmd_batch', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'text|json',
       }),
-      command('flash-to-prd', ['flash-to-prd'], 'flash-to-prd --file <path> --name "<project>"', 'help.cmd_flash_to_prd', {
+      command('flash-to-prd', ['flash-to-prd'], 'flash-to-prd --file <path> --name "<project>"', 'help.cmd_flash_to_prd', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         requiresLogin: false,
       }),
-      command('ai', ['ai'], 'ai <text|image> [options]', 'help.cmd_ai', {
+      command('ai', ['ai'], 'ai <text|image> [options]', 'help.cmd_ai', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'text|json',
       }),
-      command('asset', ['asset'], 'asset <status|resolve|sources> [options]', 'help.cmd_asset', {
+      command('asset', ['asset'], 'asset <status|resolve|sources> [options]', 'help.cmd_asset', { managedRun: { scope: 'actions', actions: { status: { scope: 'local' }, sources: { scope: 'local' }, resolve: { scope: 'app', appOption: '--app-type' } } },
         noteKeys: ['asset.sourceRecords'],
         notes: ['resolve --page-id <pageId> selects a page from --design or input assetStrategy; output contains only that page. Use distinct --manifest paths for concurrent page jobs. Host search follows collection_policy; resolve performs one attempt per supplied candidate. Verified hotlink-allowed URLs are delivered directly without login or appType. Draft assets accept hotlinkAllowed/rehostAllowed booleans and deliveryMode=auto|upload. Stock CDN URLs allow hotlinking by default; Unsplash requires hotlinking unless separate rehosting permission is recorded. --upload-assets requests permitted hosting; upload failure keeps only a verified hotlink-allowed original URL.'],
         args: [
@@ -1741,9 +1823,9 @@ const COMMAND_GROUPS = [
         requiresLogin: false,
         output: 'text|json',
       }),
-      command('cdn-config', ['cdn-config'], 'cdn-config [options]', 'help.cmd_cdn_config'),
-      command('cdn-upload', ['cdn-upload'], 'cdn-upload <image-path>', 'help.cmd_cdn_upload'),
-      command('cdn-refresh', ['cdn-refresh'], 'cdn-refresh [options]', 'help.cmd_cdn_refresh'),
+      command('cdn-config', ['cdn-config'], 'cdn-config [options]', 'help.cmd_cdn_config', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('cdn-upload', ['cdn-upload'], 'cdn-upload <image-path>', 'help.cmd_cdn_upload', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
+      command('cdn-refresh', ['cdn-refresh'], 'cdn-refresh [options]', 'help.cmd_cdn_refresh', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
     ],
   },
 ];
@@ -1774,6 +1856,7 @@ function localizeCommand(entry, translate) {
     notes: [...cloneJsonMetadata(entry.notes, []), ...(entry.noteKeys || []).map(key => translate(key))],
     ...(entry.resultReuse ? { result_reuse: cloneJsonMetadata(entry.resultReuse, null) } : {}),
     hidden: entry.hidden,
+    managed_run: cloneJsonMetadata(entry.managedRun, null),
     side_effect: cloneSideEffect(entry.sideEffect),
     permission: clonePermission(entry.permission),
   };
@@ -2060,6 +2143,7 @@ function buildCommandManifest(options = {}) {
       title_key: group.titleKey,
       commands: group.commands.map(entry => entry.id),
     })),
+    managed_run_schema: managedPolicySchema(),
     side_effect_schema: cloneSideEffectSchema(),
     permission_schema: clonePermissionSchema(),
     forbidden_alias_schema: cloneForbiddenAliasSchema(),