openyida 2026.10.21 → 2026.10.22-snapshot.0

package/README.md

@@ -143,6 +143,25 @@ openyida login --check-only --json
 openyida auth status
 ```
 
+For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
+
+```bash
+openyida auth qwenwork user-info --json
+```
+
+This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
+
+Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.
+
+```js
+const { exchangeQwenWorkAgentToken, getQwenWorkUserInfo } = require('openyida/lib/auth/qwenwork-client');
+async function readCloudUser() {
+  const credential = await exchangeQwenWorkAgentToken();
+  // The result contains QwenWork identifiers, not YiDA IDs.
+  return getQwenWorkUserInfo(credential);
+}
+```
+
 To reuse an existing shared login profile for the current project, switch first instead of starting a new OAuth login:
 
 ```bash
@@ -446,7 +465,9 @@ openyida feedback report --input summary.json --output-dir feedback-draft-001
 
 Your AI prepares the summary from observed evidence and selected reproduction screenshots. PRs include before/after test comparisons. Before anything is published, review the final text and images, confirm sensitive information, and remove anything you do not want to share. See the [report input format](yida-skills/skills/yida-feedback/references/report-input.md). Review business information before sharing. With a GitHub account, authorize your AI to submit an Issue or contribute a verified public OpenYida fix through your personal Fork. Without an account, create a GitHub account first. If that is not possible, share the report in the AI开发者群 (AI developer group).
 
-When you choose to submit an OpenYida Issue, the feedback Skill can check your signed-in GitHub account with `openyida feedback github status --json`. Star and a personal Fork are optional: `feedback github star --confirm` and `feedback github fork --confirm` run only after you choose them. Existing actions are reused. This check is separate from installation and automatic updates; neither action is required to submit an Issue.
+To configure a submission tool, your AI can first run `openyida feedback github setup --json` to check gh and the current account. After you approve the installation plan, it can run `openyida feedback github setup --install --confirm --json`, using existing Homebrew on macOS/Linux or WinGet on Windows. Without a supported manager, official instructions or the web remain available. Browser authorization is a separate step performed by you; installation does not log you in, request passwords or tokens, or replace public-content approval. Resume the original draft after setup. See the [account and tool guide](yida-skills/skills/yida-feedback/references/github-setup.md).
+
+When preparing a PR that needs a personal Fork, or when you ask how to support the project, the feedback Skill can inspect account support state with `openyida feedback github status --json`. Star and a personal Fork are optional: `feedback github star --confirm` and `feedback github fork --confirm` run only after you choose them. Existing actions are reused. This check is separate from installation and automatic updates; neither action is required to submit an Issue.
 
 <!-- OPENYIDA_COMMANDS_START -->
 <!-- This section is generated by `npm run docs:commands`. Do not edit command rows by hand. -->
@@ -457,7 +478,7 @@ When you choose to submit an OpenYida Issue, the feedback Skill can check your s
 |---------|-------------|
 | `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
-| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
+| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch\|qwenwork user-info> [--json]` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |
 | `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
@@ -530,7 +551,7 @@ When you choose to submit an OpenYida Issue, the feedback Skill can check your s
 
 | Command | Description |
 |---------|-------------|
-| `openyida data <query\|get\|create\|update> <resource> ... \| delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]` | Unified data management (form/process/task/subform) |
+| `openyida data <query\|get\|create\|update\|transfer> <resource> ... \| delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]` | Unified data management (form/process/task/subform) |
 | `openyida task-center <todo\|created\|done\|cc\|proxy\|capabilities\|scaffold\|options\|inspect\|count> [--spec <file.json> --output <file.canvas.jsx>] [options]` | Global task center (todo/processed/cc etc.) |
 | `openyida basic-info <overview\|commodity\|grant\|capacity\|quota\|abs-path\|dataflow\|i18n\|domain>` | Query organization basic info, capacity, quotas, and domain settings |
 | `openyida read-dingtalk-doc <docUrl> [--output <file>] [--json]` | Fetch Markdown content from a DingTalk document |

package/bin/yida.js

@@ -714,6 +714,10 @@ async function main() {
 
     case 'auth': {
       const subCommand = args[0];
+      if (subCommand === 'qwenwork') {
+        await require('../lib/auth/qwenwork').run(args.slice(1));
+        break;
+      }
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
       const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');

package/lib/app/canvas-compile.js

@@ -55,6 +55,7 @@ const { assertCanvasThemeStructure } = require('./canvas-theme-guard');
 const { assertCanvasIconExports } = require('./canvas-icon-guard');
 const { assertCanvasNavigationStructure } = require('./canvas-navigation-guard');
 const { assertCanvasNavigationPaths } = require('./canvas-path-guard');
+const { findResponsiveLayoutIssues } = require('./responsive-layout-guard');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -977,6 +978,13 @@ function compileCanvasLocal(source, options = {}) {
   assertCanvasNavigationPaths(source, options);
   assertInlineCssStructure(source, options);
   const warnings = [];
+  findResponsiveLayoutIssues(source).forEach((issue) => {
+    warnings.push({
+      line: issue.line,
+      rule: issue.rule,
+      message: t(issue.messageKey, ...(issue.params || [])),
+    });
+  });
   assertCanvasThemeStructure(source, { ...options, onThemeWarning(message, details) {
     warnings.push({ ...details, message });
     if (options.onThemeWarning) { options.onThemeWarning(message, details); }

package/lib/app/page-linter.js

@@ -9,6 +9,7 @@ const {
 const { findBareCjkJsxTextIdentifiers } = require('./jsx-text-guard');
 const { findDirectFormOpenIssues } = require('./form-open-guard');
 const { findFormDetailLinkIssues } = require('./form-detail-link-guard');
+const { findResponsiveLayoutIssues } = require('./responsive-layout-guard');
 const Babel = require('@babel/standalone');
 
 const THEN_CALLBACK_LINE_LIMIT = 50;
@@ -1051,6 +1052,15 @@ function lintYidaSource(sourceCode, filePath) {
   findFormDetailLinkIssues(sourceCode, { parserOptions: PARSER_OPTIONS }).forEach((issue) => {
     pushIssue(errors, issue.line, 'form-detail-link', t('publish.lint_form_detail_link'), disableMap);
   });
+  findResponsiveLayoutIssues(sourceCode).forEach((issue) => {
+    pushIssue(
+      warnings,
+      issue.line,
+      issue.rule,
+      t(issue.messageKey, ...(issue.params || [])),
+      disableMap
+    );
+  });
   return { errors, warnings };
 }
 

package/lib/app/responsive-layout-guard.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const FIXED_WIDTH_THRESHOLD = 480;
+
+function getLine(source, index) {
+  return source.slice(0, index).split('\n').length;
+}
+
+function lineHasOptOut(source, index, marker) {
+  const lineStart = source.lastIndexOf('\n', index) + 1;
+  const lineEnd = source.indexOf('\n', index);
+  const line = source.slice(lineStart, lineEnd < 0 ? source.length : lineEnd);
+  return line.includes(marker);
+}
+
+/**
+ * Find high-confidence responsive layout risks shared by Canvas and legacy JSX pages.
+ * The checks stay advisory because viewport-owned overlays and fixed-size visualizations
+ * can be intentional; authors can add the documented line marker after reviewing one.
+ * @param {string} source
+ * @returns {Array<{line: number, rule: string, messageKey: string, params?: Array<unknown>}>>}
+ */
+function findResponsiveLayoutIssues(source) {
+  const text = String(source || '');
+  const issues = [];
+
+  const observerMatch = /new\s+(?:window\.)?ResizeObserver\s*\(/.exec(text);
+  if (observerMatch && !/\.\s*(?:disconnect|unobserve)\s*\(/.test(text)) {
+    issues.push({
+      line: getLine(text, observerMatch.index),
+      rule: 'resize-observer-cleanup',
+      messageKey: 'publish.lint_resize_observer_cleanup',
+    });
+  }
+
+  const viewportMatch = /(?:window\s*\.\s*innerWidth|matchMedia\s*\(\s*['"`]\s*\([^'"`]*(?:min|max)-width)/.exec(text);
+  const hasLayoutBranch = /(?:@media|grid-template-columns|gridTemplateColumns|flex-direction|flexDirection|\bmobile\b|\bisMobile\b)/.test(text);
+  const hasContainerSignal = /(?:@container|container-type|containerType|ResizeObserver|getBoundingClientRect\s*\(\s*\)\s*\.\s*width|\.\s*clientWidth\b)/.test(text);
+  if (
+    viewportMatch && hasLayoutBranch && !hasContainerSignal &&
+    !text.includes('openyida-responsive-viewport-ok')
+  ) {
+    issues.push({
+      line: getLine(text, viewportMatch.index),
+      rule: 'responsive-viewport-only',
+      messageKey: 'publish.lint_responsive_viewport_only',
+    });
+  }
+
+  const fixedWidthPattern = /(?:^|[\s{;,])width\s*:\s*['"]?(\d{3,})px?['"]?(?=\s*[,;}])/gm;
+  let fixedWidthMatch;
+  while ((fixedWidthMatch = fixedWidthPattern.exec(text)) !== null) {
+    const width = Number(fixedWidthMatch[1]);
+    if (
+      width >= FIXED_WIDTH_THRESHOLD &&
+      !lineHasOptOut(text, fixedWidthMatch.index, 'openyida-responsive-fixed-width-ok')
+    ) {
+      issues.push({
+        line: getLine(text, fixedWidthMatch.index),
+        rule: 'responsive-fixed-width',
+        messageKey: 'publish.lint_responsive_fixed_width',
+        params: [width],
+      });
+    }
+  }
+
+  const scaleMatch = /(?:transform\s*:\s*[^;\n}]*\bscale\s*\(|\bzoom\s*:)/.exec(text);
+  if (scaleMatch && !text.includes('openyida-responsive-scale-ok')) {
+    issues.push({
+      line: getLine(text, scaleMatch.index),
+      rule: 'responsive-page-scale',
+      messageKey: 'publish.lint_responsive_page_scale',
+    });
+  }
+
+  return issues;
+}
+
+module.exports = {
+  FIXED_WIDTH_THRESHOLD,
+  findResponsiveLayoutIssues,
+};

package/lib/auth/qwenwork-client.js

@@ -0,0 +1,190 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+
+const DEFAULT_TIMEOUT_MS = 20000;
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+
+function failure(code, message, stage, details = {}) {
+  return new CliError(t(`qwenwork.${message}`), {
+    code: `QWENWORK_${code}`,
+    details: { stage, ...details },
+  });
+}
+
+function pick(env, names) {
+  for (const name of names) {
+    const value = String(env[name] || '').trim();
+    if (value) {
+      return { name, value };
+    }
+  }
+  return null;
+}
+
+function normalizeBaseUrl(value) {
+  try {
+    const url = new URL(value);
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) ||
+      url.username || url.password || url.search || url.hash) {
+      throw new Error('invalid_url');
+    }
+    return url.href.replace(/\/+$/, '');
+  } catch {
+    throw failure('INVALID_GATEWAY', 'invalid_url', 'resolve_credentials');
+  }
+}
+
+function isObject(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+// Do not include upstream bodies, headers or exception messages in diagnostics:
+// an authentication endpoint may echo credentials even in an error response.
+async function requestJson(method, url, accessToken, options, stage) {
+  const timeoutMs = options.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : options.timeoutMs;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw failure('INVALID_TIMEOUT', 'request_failed', stage);
+  }
+  const controller = new globalThis.AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await globalThis.fetch(url, {
+      method,
+      headers: { accept: 'application/json', authorization: `Bearer ${accessToken}` },
+      redirect: 'manual',
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      if (response.body) {
+        await response.body.cancel();
+      }
+      throw failure('HTTP_ERROR', 'request_failed', stage, { status_code: response.status });
+    }
+    const chunks = [];
+    let size = 0;
+    if (response.body) {
+      const reader = response.body.getReader();
+      let next = await reader.read();
+      while (!next.done) {
+        const { value } = next;
+        size += value.byteLength;
+        if (size > MAX_RESPONSE_BYTES) {
+          await reader.cancel();
+          throw failure('RESPONSE_TOO_LARGE', 'invalid_response', stage);
+        }
+        chunks.push(Buffer.from(value));
+        next = await reader.read();
+      }
+    }
+    let payload;
+    try {
+      payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    } catch {
+      throw failure('INVALID_RESPONSE', 'invalid_response', stage);
+    }
+    if (!isObject(payload) || (payload.code !== undefined && payload.code !== 'ok')) {
+      throw failure('INVALID_RESPONSE', 'invalid_response', stage);
+    }
+    return payload;
+  } catch (error) {
+    if (error && error.isCliError) {
+      throw error;
+    }
+    throw controller.signal.aborted
+      ? failure('TIMEOUT', 'request_timeout', stage)
+      : failure('NETWORK_ERROR', 'request_failed', stage);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function decodeClaims(token) {
+  try {
+    const value = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8'));
+    return isObject(value) ? value : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Exchange a cloud Agent credential for an in-memory scoped user credential.
+ * This does not issue or persist an OpenYida session.
+ */
+async function exchangeQwenWorkAgentToken(options = {}) {
+  const env = options.env || process.env;
+  const agent = pick(env, ['QWENWORK_AGENT_TOKEN', 'MULE_AGENT_TOKEN', 'AGENT_TOKEN']);
+  if (!agent || /[\r\n]/.test(agent.value)) {
+    throw failure('CREDENTIAL_MISSING', 'credential_missing', 'resolve_credentials');
+  }
+  const gateway = pick(env, ['QWENWORK_GATEWAY_URL', 'MULE_GATEWAY_URL']);
+  if (!gateway) {
+    throw failure('GATEWAY_MISSING', 'gateway_missing', 'resolve_credentials');
+  }
+  const baseUrl = normalizeBaseUrl(gateway.value);
+  const response = await requestJson('POST', `${baseUrl}/api/agent-gw/token/exchange`, agent.value, options, 'exchange');
+  // The current cloud endpoint returns {token, scope, ttl} without an envelope.
+  const payload = isObject(response.data) ? response.data : response;
+  if (typeof payload.token !== 'string' || !payload.token.trim() || /\s/.test(payload.token) ||
+    typeof payload.scope !== 'string' || !Number.isFinite(payload.ttl) || payload.ttl <= 0) {
+    throw failure('INVALID_RESPONSE', 'invalid_response', 'exchange');
+  }
+  const decoded = decodeClaims(payload.token);
+  if (typeof decoded.exp === 'number' && decoded.exp * 1000 <= Date.now()) {
+    throw failure('TOKEN_EXPIRED', 'expired_token', 'exchange');
+  }
+  return {
+    access_token: payload.token,
+    base_url: baseUrl,
+    credential_source: agent.name,
+    scope: payload.scope,
+    expires_in: payload.ttl,
+    expires_at: typeof decoded.exp === 'number' ? decoded.exp * 1000 : Date.now() + payload.ttl * 1000,
+  };
+}
+
+/** Query the credential's own origin; never infer a YiDA endpoint or organization. */
+async function getQwenWorkUserInfo(credential, options = {}) {
+  const accessToken = credential && credential.access_token;
+  if (typeof accessToken !== 'string' || !accessToken || /[\r\n]/.test(accessToken)) {
+    throw failure('CREDENTIAL_MISSING', 'credential_missing', 'user_info');
+  }
+  const baseUrl = normalizeBaseUrl(credential.base_url);
+  const response = await requestJson('GET', `${baseUrl}/user/info`, accessToken, options, 'user_info');
+  if (response.code !== 'ok' || !isObject(response.data) ||
+    typeof response.data.user_id !== 'string' || !response.data.user_id.trim()) {
+    throw failure('INVALID_RESPONSE', 'invalid_response', 'user_info');
+  }
+  const env = options.env || process.env;
+  const decoded = decodeClaims(accessToken);
+  // Decoding is not local signature verification. The authenticated /user/info
+  // response establishes identity; these comparisons catch context drift.
+  for (const expected of [env.QWENWORK_USER_ID, env.MULE_USER_ID, decoded.user_id, decoded.sub]) {
+    if (expected && String(expected) !== response.data.user_id) {
+      throw failure('IDENTITY_MISMATCH', 'identity_mismatch', 'user_info');
+    }
+  }
+  const orgId = response.data.biz && response.data.biz.org_id;
+  if (orgId && decoded.biz_org_id && orgId !== decoded.biz_org_id) {
+    throw failure('IDENTITY_MISMATCH', 'identity_mismatch', 'user_info');
+  }
+  return response.data;
+}
+
+/** Safe composition for identity consumers: the returned object has no credential. */
+async function getQwenWorkIdentity(options = {}) {
+  const credential = await exchangeQwenWorkAgentToken(options);
+  const profile = await getQwenWorkUserInfo(credential, options);
+  return {
+    base_url: credential.base_url,
+    credential_source: credential.credential_source,
+    scope: credential.scope,
+    expires_in: credential.expires_in,
+    expires_at: credential.expires_at,
+    profile,
+  };
+}
+
+module.exports = { exchangeQwenWorkAgentToken, getQwenWorkUserInfo, getQwenWorkIdentity };

package/lib/auth/qwenwork.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+const { redactSensitive } = require('../core/redact');
+const { getQwenWorkIdentity } = require('./qwenwork-client');
+
+async function run(args, options = {}) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(t('qwenwork.usage'));
+    return;
+  }
+  if (args[0] !== 'user-info' || args.slice(1).some(arg => arg !== '--json')) {
+    throw new CliError(t('qwenwork.usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 });
+  }
+  const identity = await getQwenWorkIdentity(options);
+  const { profile, ...metadata } = identity;
+  const result = redactSensitive({
+    ok: true,
+    provider: 'qwenwork',
+    ...metadata,
+    user: {
+      user_id: profile.user_id,
+      nickname: profile.nickname,
+      username: profile.username,
+      email: profile.email,
+      is_biz: profile.is_biz,
+      biz_org_id: profile.biz && profile.biz.org_id,
+      biz_org_name: profile.biz && profile.biz.org_name,
+    },
+    yida_session_created: false,
+  });
+  console.log(JSON.stringify(result, null, 2));
+  return result;
+}
+
+module.exports = { run };

package/lib/core/command-manifest.js

@@ -574,7 +574,7 @@ const COMMAND_SIDE_EFFECTS = new Map([
     mutates_yida: false,
     mutates_local: true,
     read_actions: ['status', 'profiles', 'profile list'],
-    mutating_actions: ['login', 'refresh', 'logout', 'profile switch'],
+    mutating_actions: ['login', 'refresh', 'logout', 'profile switch', 'qwenwork user-info'],
   })],
   ['batch', sideEffect('mixed', {
     mutates_yida: true,
@@ -612,7 +612,7 @@ const COMMAND_SIDE_EFFECTS = new Map([
     mutates_yida: true,
     mutates_local: false,
     read_actions: ['query', 'get'],
-    mutating_actions: ['create', 'update', 'delete'],
+    mutating_actions: ['create', 'update', 'delete', 'transfer'],
   })],
   ['db-seq-fix', sideEffect('mixed', {
     mutates_yida: true,
@@ -648,7 +648,7 @@ const COMMAND_SIDE_EFFECTS = new Map([
     mutates_yida: true,
     mutates_local: true,
     read_actions: ['url', 'status', 'github status'],
-    mutating_actions: ['setup', 'dismiss', 'report', 'github star', 'github fork'],
+    mutating_actions: ['setup', 'dismiss', 'report', 'github setup --install --confirm', 'github star', 'github fork'],
   })],
   ['i18n', sideEffect('mixed', {
     mutates_yida: true,
@@ -903,7 +903,7 @@ const COMMAND_PERMISSIONS = new Map([
   ...permissionEntries([
     'auth',
   ], actionDependentPermission({
-    preauthorized_actions: ['login', 'refresh', 'logout', 'profile switch'],
+    preauthorized_actions: ['login', 'refresh', 'logout', 'profile switch', 'qwenwork user-info'],
   })),
 
   ...permissionEntries([
@@ -950,7 +950,7 @@ const COMMAND_PERMISSIONS = new Map([
   ...permissionEntries([
     'data',
   ], actionDependentPermission({
-    preauthorized_actions: ['create', 'update'],
+    preauthorized_actions: ['create', 'update', 'transfer'],
     ask_actions: ['delete'],
   })),
 
@@ -1143,7 +1143,7 @@ const COMMAND_GROUPS = [
         output: 'json',
       }),
       command('logout', ['logout'], 'logout', 'help.cmd_logout', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
-      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch>', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] } } }, requiresLogin: false }),
+      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] }, qwenwork: { scope: 'denied', reason: 'identity_exchange' } } }, requiresLogin: false }),
       command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
       command('env', ['env'], 'env [--json|setup|list|show|switch|add|remove] [options]', 'help.cmd_env', { managedRun: { scope: 'local', allowedFlags: ['--json', '--quiet'] },
         requiresLogin: false,
@@ -1748,12 +1748,13 @@ const COMMAND_GROUPS = [
     id: 'data',
     titleKey: 'help.group_data',
     commands: [
-      command('data', ['data'], 'data <query|get|create|update> <resource> ... | delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]', 'help.cmd_data', {
+      command('data', ['data'], 'data <query|get|create|update|transfer> <resource> ... | delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]', 'help.cmd_data', {
         managedRun: { scope: 'actions', actions: {
           query: { scope: 'actions', actions: {
             form: { scope: 'app', appPosition: 2 }, subform: { scope: 'app', appPosition: 2 },
             process: { scope: 'app', appPosition: 2 }, 'operation-records': { scope: 'app', appPosition: 2 },
             tasks: { scope: 'app', appPosition: 2 },
+            'process-tasks': { scope: 'app', appPosition: 2 },
           } },
           get: { scope: 'actions', actions: {
             form: { scope: 'app', appPosition: 2 }, subform: { scope: 'app', appPosition: 2 },
@@ -1773,6 +1774,9 @@ const COMMAND_GROUPS = [
           execute: { scope: 'actions', actions: {
             task: { scope: 'app', appPosition: 2, mutation: { operation: 'execute_task', formUuidOption: '--form-uuid' } },
           } },
+          transfer: { scope: 'actions', actions: {
+            task: { scope: 'app', appPosition: 2, mutation: { operation: 'execute_task', formUuidOption: '--form-uuid' } },
+          } },
         } },
         output: 'json',
         noteKeys: ['help.data_notes', 'query_data.approver_query_help'],
@@ -1787,6 +1791,8 @@ const COMMAND_GROUPS = [
           'openyida data query form APP_XXX FORM_XXX --page 1 --size 20 --search-json \'[{"key":"dateField_due","componentName":"DateField","type":"DOUBLE","operator":"is","value":""}]\'',
           'openyida data create form APP_XXX FORM_XXX --expect-form-name 客户 --expect-form-type receipt --data-json \'{"textField_name":"客户 A","dateField_followUp":1787932800000}\'',
           'openyida data delete form APP_XXX FORM_XXX --inst-id FINST_XXX --expect-form-name 客户 --expect-form-type receipt --confirm --json',
+          'openyida data query process-tasks APP_XXX --process-inst-id PINST_XXX --json',
+          'openyida data transfer task APP_XXX --process-inst-id PINST_XXX --form-uuid FORM_XXX --to-user-id USER_ID --expect-form-name "Approval form" --expect-form-type process --json',
         ],
       }),
       command('task-center', ['task-center'], 'task-center <todo|created|done|cc|proxy|capabilities|scaffold|options|inspect|count> [--spec <file.json> --output <file.canvas.jsx>] [options]', 'help.cmd_task_center', {
@@ -2052,11 +2058,13 @@ const COMMAND_GROUPS = [
         requiresLogin: false,
       }),
       command('feedback', ['feedback'], 'feedback <report|github|setup|url|dismiss|status> [options]', 'help.cmd_feedback', { managedRun: { scope: 'actions', actions: { report: { scope: 'local' } } },
-        permission: actionDependentPermission({ preauthorized_actions: ['report', 'url', 'status', 'dismiss', 'github status'], ask_actions: ['setup', 'github star', 'github fork'] }),
+        permission: actionDependentPermission({ preauthorized_actions: ['report', 'url', 'status', 'dismiss', 'github status'], ask_actions: ['setup', 'github setup', 'github setup --install --confirm', 'github star', 'github fork'] }),
         requiresLogin: false,
         output: 'text|json',
-        examples: ['openyida feedback report --input summary.json --output-dir feedback-draft-001'],
-        notes: ['report prepares local review drafts only; no login, source checkout, update check or network submission. github status [--json] checks the authenticated github.com user, Star and personal Fork through an existing gh installation; it performs no writes. github star|fork --confirm [--json] requires the user to explicitly choose that account action. Missing gh/login, unknown status and declined actions never block Issue submission. Already applied actions are reused; writes are single-attempt with readback. No auto-update/install hook, Issue submission, clone or git remote modification. Managed runs permit only offline report preparation.'],
+        examples: ['openyida feedback report --input summary.json --output-dir feedback-draft-001', 'openyida feedback github setup --json', 'openyida feedback github setup --install --confirm --json'],
+        // Keep setup conservative in permission metadata: --install changes the local machine.
+        // The parser distinguishes read-only setup from a separately confirmed installation.
+        notes: ['github setup [--json] detects gh and verifies the current account without installing or logging in. github setup --install --confirm performs one user-approved installation via existing Homebrew (macOS/Linux) or WinGet (Windows), then checks gh again. No manager bootstrap, source changes, automatic retry, upgrade, or automatic login; unsupported environments use official instructions or the web. Browser authorization requires separate consent and public submission still requires content review. report prepares local review drafts only; no login, source checkout, update check or network submission. github status [--json] checks the authenticated github.com user, Star and personal Fork through an existing gh installation; it performs no writes. github star|fork --confirm [--json] requires the user to explicitly choose that account action. Missing gh/login, unknown status and declined actions never block Issue submission. Already applied actions are reused; writes are single-attempt with readback. No auto-update/install hook, Issue submission, clone or git remote modification. Managed runs permit only offline report preparation.'],
       }),
       command('batch', ['batch'], 'batch <file>|--commands "cmd1 ; cmd2" [--stop-on-error] [--json]', 'help.cmd_batch', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'text|json',