openyida 2026.10.15-2 → 2026.10.16

package/lib/auth/token-auth.js

@@ -229,6 +229,26 @@ function createTokenAuthRequiredError(reason, sourceError) {
   );
 }
 
+function createAuthProfileSelectionError(status) {
+  const reason = status.failure_reason || status.status;
+  if (!['profile_required', 'profile_not_found'].includes(reason)) {return null;}
+  const { CliError } = require('../core/cli-error');
+  const { t } = require('../core/i18n');
+  return new CliError(t(`common.auth_${reason}`), {
+    code: reason === 'profile_required' ? 'AUTH_PROFILE_REQUIRED' : 'AUTH_PROFILE_NOT_FOUND',
+    details: {
+      authMode: 'token',
+      status: reason,
+      failure_reason: reason,
+      auth_profile: status.auth_profile,
+      candidate_count: status.candidate_count,
+      candidates: status.candidates,
+      next_step: status.next_step,
+      next_step_commands: status.next_step_commands,
+    },
+  });
+}
+
 function createTokenRefreshFailedError(reason, sourceError) {
   const { CliError } = require('../core/cli-error');
   return new CliError(
@@ -630,7 +650,12 @@ async function tokenLogout(options = {}) {
 }
 
 async function getAccessToken(options = {}) {
-  let session = loadTokenSession(options);
+  const resolution = resolveTokenSession(options);
+  let session = resolution.session;
+  if (!session) {
+    const selectionError = createAuthProfileSelectionError(resolution);
+    if (selectionError) {throw selectionError;}
+  }
   // Do not reject a token from local expiry metadata. The business endpoint is
   // the authority: requestWithAutoLogin refreshes only after it rejects the
   // access token, then retries with the newly persisted local session.
@@ -675,4 +700,5 @@ module.exports = {
   resolveTokenBaseUrl,
   isRefreshAuthRequired,
   createTokenRefreshFailedError,
+  createAuthProfileSelectionError,
 };

package/lib/auth/token-store.js

@@ -472,12 +472,31 @@ function saveAuthProfilePointer(session, options = {}) {
   return pointer;
 }
 
-function loadAuthProfilePointer(options = {}) {
-  const pointerFile = getAuthProfilePointerFilePath(options);
-  if (!fs.existsSync(pointerFile)) {
+function getWorkspaceAuthProfilePointerFilePath(options = {}) {
+  const root = path.resolve(resolveProjectRoot(options));
+  const workspace = path.dirname(root);
+  if (isEnvTokenAuthMode(options.env || process.env) || path.basename(root) !== 'project' ||
+      fs.existsSync(path.join(workspace, 'config.json'))) {
     return null;
   }
   try {
+    // Only bridge the conventional workspace -> workspace/project transition.
+    // A symlinked project belongs to its own workspace, not its lexical parent.
+    if (fs.realpathSync(root) !== path.join(fs.realpathSync(workspace), 'project')) {return null;}
+    return getAuthProfilePointerFilePath({ ...options, projectRoot: workspace, envName: resolveEnvName(options) });
+  } catch {return null;}
+}
+
+function loadAuthProfilePointer(options = {}) {
+  try {
+    let pointerFile = getAuthProfilePointerFilePath(options);
+    // An explicit child selection (including an unbound/corrupt pointer) wins.
+    // Reading inherited metadata never copies credentials or writes a pointer.
+    if (!fs.existsSync(pointerFile)) {
+      if (fs.existsSync(getTokenFilePath(options))) {return null;}
+      pointerFile = getWorkspaceAuthProfilePointerFilePath(options);
+    }
+    if (!pointerFile || !fs.existsSync(pointerFile)) {return null;}
     const pointer = JSON.parse(fs.readFileSync(pointerFile, 'utf8'));
     if (!pointer || typeof pointer !== 'object' || !pointer.auth_profile) {
       return null;
@@ -491,6 +510,13 @@ function loadAuthProfilePointer(options = {}) {
 function clearAuthProfilePointer(options = {}) {
   try {
     const pointerFile = getAuthProfilePointerFilePath(options);
+    const workspacePointerFile = getWorkspaceAuthProfilePointerFilePath(options);
+    if (workspacePointerFile && fs.existsSync(workspacePointerFile)) {
+      // Detaching this project must not revive its inherited workspace choice
+      // on the next command, or clear another project's workspace selection.
+      writeJsonFileAtomic(pointerFile, { version: AUTH_PROFILE_VERSION, detached: true });
+      return;
+    }
     if (fs.existsSync(pointerFile)) {
       fs.unlinkSync(pointerFile);
     }

package/lib/core/locales/en.js

@@ -1016,6 +1016,8 @@ Examples:
     data_check_failed: '  ⚠️  Data check failed, proceeding with modification',
   },
   common: {
+    auth_profile_required: 'Multiple organizations have saved credentials. Run openyida auth profiles, then openyida auth profile switch <auth_profile> to select this project\'s organization.',
+    auth_profile_not_found: 'The requested organization credentials were not found. Run openyida auth profiles to inspect saved organizations and select the correct profile.',
     auth_identity_changed: 'Authentication identity changed during preflight; no write was issued.',
     http_status: '  HTTP status: {0}',
     http_response: '  HTTP response: {0}',

package/lib/core/locales/zh.js

@@ -987,6 +987,8 @@ openyida - 宜搭命令行工具
     data_check_failed: '  ⚠️  数据量检查失败，继续执行修改',
   },
   common: {
+    auth_profile_required: '已有多个组织的登录凭证，请执行 openyida auth profiles，并用 openyida auth profile switch <auth_profile> 选择本项目的组织。',
+    auth_profile_not_found: '未找到指定组织的登录凭证，请执行 openyida auth profiles 核对已有组织，再选择正确的登录凭证。',
     auth_identity_changed: '校验期间登录身份发生变化，本次未发起写入。',
     http_status: '  HTTP 状态码: {0}',
     http_response: '  HTTP 响应: {0}',

package/lib/core/utils.js

@@ -960,6 +960,11 @@ function triggerLogin(options = {}) {
   if (tokenAuthData) {
     return tokenAuthData;
   }
+  const { createAuthProfileSelectionError } = require('../auth/token-auth');
+  const selectionError = createAuthProfileSelectionError(getAuthStatus({
+    ...options, projectRoot: options.projectRoot || findProjectRoot(),
+  }));
+  if (selectionError) {throw selectionError;}
   const { CliError } = require('./cli-error');
   throw new CliError(
     'not_logged_in: token auth is unavailable. Run openyida login first.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.10.15-2",
+  "version": "2026.10.16",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/yida-skills/skills/yida-design/templates/design-themes/dark-rail-fine-lines/app_theme.css

@@ -106,8 +106,8 @@
   --corner-3: 2px;
   --corner-4: 2px;
   --corner-5: 2px;
-  --corner-circle: var(--corner-2);
-  --corner-semicircle: 2px;
+  --corner-circle: 999px;
+  --corner-semicircle: var(--corner-2);
 
   /* 阴影 */
   --shadow-1: 0px 2px 4px 0px rgba(0, 0, 0, 0.12);
@@ -158,7 +158,7 @@
   /* 卡片 */
   --pod-card-padding: 20px;
   --pod-card-border-radius: var(--pod-xl-border-radius, 20px);
-  --pod-card-border: none;
+  --pod-card-border: 1px solid var(--color-line1-1);
   --pod-card-spacing: var(--pod-md-gap-pad-margin);
 
   /* 导航：顶导与侧导布局 */

package/yida-skills/skills/yida-design/templates/design-themes/dark-rail-fine-lines/design.md

@@ -11,6 +11,7 @@ tokens:
         "--pod-app-root-bg-image": "none" # 仅作用于根节点；本主题不使用背景图
         "--pod-page-bg-color": "#FFFFFF" # neutral-gray；白色内容画布
         "--pod-card-bg-color": "#FFFFFF" # neutral-gray；一级内容表面
+        "--pod-card-border": "1px solid var(--color-line1-1)"
         "--pod-table-cell-color": "var(--pod-card-bg-color)" # 表格正文跟随卡片表面
         "--pod-shell-padding": "0px"
       navigation:
@@ -112,8 +113,8 @@ tokens:
       "--corner-3": 2px # 气泡、浮层、弹窗外轮廓
       "--corner-4": 2px # 小型嵌入摘要与内部组合容器
       "--corner-5": 2px # 卡片、独立面板与抽屉外轮廓
-      "--corner-circle": "var(--corner-2)" # 等宽高头像、图例圆点
-      "--corner-semicircle": 2px # 胶囊按钮、计数标记、进度条圆头
+      "--corner-circle": 999px # 等宽高头像、图例圆点
+      "--corner-semicircle": "var(--corner-2)" # 胶囊按钮、计数标记、进度条圆头
     shadow:
       "--shadow-1": "0px 2px 4px 0px rgba(0, 0, 0, 0.12)"
       "--shadow-2": "0px 4px 20px -1px rgba(0, 0, 0, 0.16)"