openyida 2026.10.23-2 → 2026.10.23-beta.2

package/README.md

@@ -143,6 +143,25 @@ openyida login --check-only --json
 openyida auth status
 ```
 
+For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
+
+```bash
+openyida auth qwenwork user-info --json
+```
+
+This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
+
+Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.
+
+```js
+const { exchangeQwenWorkAgentToken, getQwenWorkUserInfo } = require('openyida/lib/auth/qwenwork-client');
+async function readCloudUser() {
+  const credential = await exchangeQwenWorkAgentToken();
+  // The result contains QwenWork identifiers, not YiDA IDs.
+  return getQwenWorkUserInfo(credential);
+}
+```
+
 To reuse an existing shared login profile for the current project, switch first instead of starting a new OAuth login:
 
 ```bash
@@ -458,8 +477,9 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | Command | Description |
 |---------|-------------|
 | `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
+| `openyida login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]` | Log in to YiDA with a one-time QwenWork exchange ticket |
 | `openyida logout` | Logout / unbind current project auth |
-| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
+| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch\|qwenwork user-info> [--json]` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |
 | `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
@@ -516,7 +536,6 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | `openyida print-template <list\|inspect\|fields\|build\|create\|copy\|save\|restore\|settings\|status\|order\|render\|files> <appType> <formUuid> [templateId] [--config <file>] [--scene <order\|quotation\|delivery\|receipt\|approval\|codes>] [--bindings <file>] [--name <title>] [--expected-hash <hash>] [--backup <file>] [--out <file>] [--status START\|STOP] [--instance <id>] [--page <n>] [--size <n>] [--allow-permission-change] [--json] \| print-template <list\|render> --detail-url <url> [--template-id <id>] [--json]` | Manage native YiDA print templates, generate document layouts, back up, restore and request PDFs |
 | `openyida form-view <list\|inspect\|save\|create\|order> <appType> <formUuid> [viewUuid] [--config <file>] [--name <title>] [--with-config] [--expected-hash <hash>] [--backup <file>] [--replace] [--json]` | Native form views: list, inspect and configure columns, widths, frozen columns and filters |
 | `openyida custom-button <list\|inspect\|options\|create\|update\|delete> <appType> <formUuid> [buttonUuid] [--config <file>] [--expected-hash <hash>] [--backup <file>] [--yes] [--json]` | Native custom buttons: inspect and configure form edits, automation flows and page links |
-| `openyida form-message <list\|inspect\|options\|create\|update\|delete> <appType> <formUuid> [messageId] [--config <file>] [--expected-hash <hash>] [--backup <file>] [--yes] [--json]` | Native form notifications: inspect triggers, recipients and templates, then safely maintain bindings |
 | `openyida get-schema <appType> <formUuid\|--all> [--summary-json\|--field-map-json\|--analysis-json]` | Get one form Schema or all form Schemas |
 | `openyida check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]` | Check resources, frontend menu hiding and application theme delivery |
 | `openyida check-design <design.md> [--prd <prd.md>] [--base-dir <dir>] [--json]` | Validate design documents, theme tokens and PRD handoff |
@@ -534,7 +553,7 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | Command | Description |
 |---------|-------------|
 | `openyida data <query\|get\|create\|update\|transfer> <resource> ... \| delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]` | Unified data management (form/process/task/subform) |
-| `openyida task-center <todo\|created\|done\|cc\|proxy\|capabilities\|link\|scaffold\|options\|inspect\|count> [--spec <file.json> --output <file.canvas.jsx>] [options]` | Global task center (todo/processed/cc etc.) |
+| `openyida task-center <todo\|created\|done\|cc\|proxy\|capabilities\|scaffold\|options\|inspect\|count> [--spec <file.json> --output <file.canvas.jsx>] [options]` | Global task center (todo/processed/cc etc.) |
 | `openyida basic-info <overview\|commodity\|grant\|capacity\|quota\|abs-path\|dataflow\|i18n\|domain>` | Query organization basic info, capacity, quotas, and domain settings |
 | `openyida read-dingtalk-doc <docUrl> [--output <file>] [--json]` | Fetch Markdown content from a DingTalk document |
 | `openyida read-dingtalk-tingji <taskUuid> [--json]` | Fetch DingTalk Tingji details by task UUID |

package/bin/yida-pre-beta.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+'use strict';
+const os = require('node:os');
+const path = require('node:path');
+const config = require('../package.json').openyidaLocalBeta;
+// PRE beta 消费包内测试默认值，真实凭据仍由原认证模块管理。
+process.env.OPENYIDA_ENDPOINT ||= config.baseUrl;
+process.env.OPENYIDA_ENV ||= config.environment;
+process.env.OPENYIDA_AUTH_DIR ||= path.join(os.homedir(), '.openyida', config.authDirectory);
+process.env.OPENYIDA_SKIP_UPDATE_CHECK = '1';
+require('./yida.js');

package/bin/yida.js

@@ -296,6 +296,7 @@ function getFirstPositionalArg(cliArgs, startIndex = 0) {
 }
 
 const UNSUPPORTED_LEGACY_LOGIN_FLAGS = new Set([
+  '--qwenwork',
   '--qr',
   '--qr-code',
   '--agent-qr',
@@ -594,6 +595,11 @@ async function main() {
   });
   assertManagedInvocation(command, rawArgs);
   applyQuietFlag();
+  // 一次性票据只在当前进程消费，不能先自更新并重启命令。
+  if (command === 'login-qwenwork') {
+    await require('../lib/auth/qwenwork-desktop').run(args);
+    return;
+  }
   applyGlobalEnvironmentFlags();
 
   const { maybeAutoUpdate } = require('../lib/core/update');
@@ -714,6 +720,10 @@ async function main() {
 
     case 'auth': {
       const subCommand = args[0];
+      if (subCommand === 'qwenwork') {
+        await require('../lib/auth/qwenwork').run(args.slice(1));
+        break;
+      }
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
       const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
@@ -837,11 +847,6 @@ async function main() {
       await run(args);
       break;
     }
-    case 'form-message': {
-      const { run } = require('../lib/app/form-message');
-      await run(args);
-      break;
-    }
     case 'print-template': {
       const { run } = require('../lib/print-template/print-template');
       await run(args);

package/lib/app/services/canvas-page-schema-builder.js

@@ -10,16 +10,7 @@ const {
   findEmojiInValue,
 } = require('../../core/no-emoji-detector');
 
-const { createPageNavigation } = require('../../navigation/page-navigation');
-const { createTaskCenterContract } = require('../../task-center/contract');
-const { createTaskCenterLoader } = require('../../task-center/loader');
-const { createTaskCenterNavigation } = require('../../task-center/navigation');
-
-const CANVAS_YIDA_API_BRIDGE_SOURCE = `${createPageNavigation.toString()}
-${createTaskCenterNavigation.toString()}
-${createTaskCenterContract.toString()}
-${createTaskCenterLoader.toString()}
-var OPENYIDA_YIDA_FORM_API_METHODS = [
+const CANVAS_YIDA_API_BRIDGE_SOURCE = `var OPENYIDA_YIDA_FORM_API_METHODS = [
   'saveFormData',
   'updateFormData',
   'searchFormDataIds',
@@ -248,15 +239,8 @@ function openyidaCreateRouterBridge(utils) {
 
 function openyidaCreateUtilsBridge(context, yidaBridge) {
   var utils = context && context.utils;
-  var navigation = createPageNavigation(window);
-  var taskNavigation = createTaskCenterNavigation();
-  var taskCounts = createTaskCenterLoader(createTaskCenterContract(), function() { return yidaBridge; });
   var methodNames = openyidaCollectUtilsMethodNames(utils);
   function invoke(methodName) {
-    if (methodName === 'openPage') { return navigation.open.apply(null, Array.prototype.slice.call(arguments, 1)); }
-    if (['taskCenterCount', 'taskCenterLink', 'openTaskCenter'].indexOf(methodName) !== -1) {
-      return bridge[methodName].apply(null, Array.prototype.slice.call(arguments, 1));
-    }
     if (!utils || typeof utils[methodName] !== 'function') {
       throw new Error('this.utils.' + methodName + ' is not available');
     }
@@ -267,8 +251,6 @@ function openyidaCreateUtilsBridge(context, yidaBridge) {
     apiGroups: {
       utility: OPENYIDA_UTIL_API_METHODS.slice(),
       router: ['push'],
-      navigation: ['openPage', 'taskCenterLink', 'openTaskCenter'],
-      tasks: ['taskCenterCount'],
       yida: OPENYIDA_KNOWN_YIDA_API_METHODS.slice()
     },
     knownMethods: OPENYIDA_UTIL_API_METHODS.slice(),
@@ -277,33 +259,9 @@ function openyidaCreateUtilsBridge(context, yidaBridge) {
       return !utils || typeof utils[methodName] !== 'function';
     }),
     invoke: invoke,
-    openPage: navigation.open,
-    taskCenterLink: function(options) {
-      return taskNavigation.target(Object.assign({ baseUrl: window.location.origin }, options));
-    },
-    taskCenterCount: async function(options) {
-      if (!options || typeof options !== 'object' || Array.isArray(options)
-        || Object.keys(options).some(function(key) { return ['scope', 'appType', 'kind', 'filters'].indexOf(key) === -1; })) {
-        var error = new Error('TASK_FILTER_INVALID: options');
-        error.code = 'TASK_FILTER_INVALID';
-        throw error;
-      }
-      var target = taskNavigation.target({ scope: options.scope, appType: options.appType, kind: options.kind, baseUrl: window.location.origin });
-      var filters = createTaskCenterContract().normalizeFilters(target.kind, options.filters === undefined ? {} : options.filters, 'app-query');
-      return taskCounts.count(target.kind, Object.assign({}, filters, { transport: 'app-query' },
-        target.scope === 'corp' ? { scope: 'corp' } : { appType: target.appType }));
-    },
-    openTaskCenter: function(options) {
-      var target = taskNavigation.target(Object.assign({ baseUrl: window.location.origin }, options));
-      return navigation.open(target.pageUrl, { mode: target.mode });
-    },
     router: openyidaCreateRouterBridge(utils),
     yida: yidaBridge
   };
-  ['openPage', 'taskCenterLink', 'openTaskCenter', 'taskCenterCount'].forEach(function(methodName) {
-    if (bridge.availableMethods.indexOf(methodName) === -1) { bridge.availableMethods.push(methodName); }
-  });
-  bridge.missingKnownMethods = bridge.missingKnownMethods.filter(function(name) { return name !== 'openPage'; });
   methodNames.forEach(function(methodName) {
     if (!bridge[methodName]) {
       bridge[methodName] = function() {

package/lib/auth/qwenwork-client.js

@@ -0,0 +1,190 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+
+const DEFAULT_TIMEOUT_MS = 20000;
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+
+function failure(code, message, stage, details = {}) {
+  return new CliError(t(`qwenwork.${message}`), {
+    code: `QWENWORK_${code}`,
+    details: { stage, ...details },
+  });
+}
+
+function pick(env, names) {
+  for (const name of names) {
+    const value = String(env[name] || '').trim();
+    if (value) {
+      return { name, value };
+    }
+  }
+  return null;
+}
+
+function normalizeBaseUrl(value) {
+  try {
+    const url = new URL(value);
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) ||
+      url.username || url.password || url.search || url.hash) {
+      throw new Error('invalid_url');
+    }
+    return url.href.replace(/\/+$/, '');
+  } catch {
+    throw failure('INVALID_GATEWAY', 'invalid_url', 'resolve_credentials');
+  }
+}
+
+function isObject(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+// Do not include upstream bodies, headers or exception messages in diagnostics:
+// an authentication endpoint may echo credentials even in an error response.
+async function requestJson(method, url, accessToken, options, stage) {
+  const timeoutMs = options.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : options.timeoutMs;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw failure('INVALID_TIMEOUT', 'request_failed', stage);
+  }
+  const controller = new globalThis.AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await globalThis.fetch(url, {
+      method,
+      headers: { accept: 'application/json', authorization: `Bearer ${accessToken}` },
+      redirect: 'manual',
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      if (response.body) {
+        await response.body.cancel();
+      }
+      throw failure('HTTP_ERROR', 'request_failed', stage, { status_code: response.status });
+    }
+    const chunks = [];
+    let size = 0;
+    if (response.body) {
+      const reader = response.body.getReader();
+      let next = await reader.read();
+      while (!next.done) {
+        const { value } = next;
+        size += value.byteLength;
+        if (size > MAX_RESPONSE_BYTES) {
+          await reader.cancel();
+          throw failure('RESPONSE_TOO_LARGE', 'invalid_response', stage);
+        }
+        chunks.push(Buffer.from(value));
+        next = await reader.read();
+      }
+    }
+    let payload;
+    try {
+      payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    } catch {
+      throw failure('INVALID_RESPONSE', 'invalid_response', stage);
+    }
+    if (!isObject(payload) || (payload.code !== undefined && payload.code !== 'ok')) {
+      throw failure('INVALID_RESPONSE', 'invalid_response', stage);
+    }
+    return payload;
+  } catch (error) {
+    if (error && error.isCliError) {
+      throw error;
+    }
+    throw controller.signal.aborted
+      ? failure('TIMEOUT', 'request_timeout', stage)
+      : failure('NETWORK_ERROR', 'request_failed', stage);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function decodeClaims(token) {
+  try {
+    const value = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8'));
+    return isObject(value) ? value : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Exchange a cloud Agent credential for an in-memory scoped user credential.
+ * This does not issue or persist an OpenYida session.
+ */
+async function exchangeQwenWorkAgentToken(options = {}) {
+  const env = options.env || process.env;
+  const agent = pick(env, ['QWENWORK_AGENT_TOKEN', 'MULE_AGENT_TOKEN', 'AGENT_TOKEN']);
+  if (!agent || /[\r\n]/.test(agent.value)) {
+    throw failure('CREDENTIAL_MISSING', 'credential_missing', 'resolve_credentials');
+  }
+  const gateway = pick(env, ['QWENWORK_GATEWAY_URL', 'MULE_GATEWAY_URL']);
+  if (!gateway) {
+    throw failure('GATEWAY_MISSING', 'gateway_missing', 'resolve_credentials');
+  }
+  const baseUrl = normalizeBaseUrl(gateway.value);
+  const response = await requestJson('POST', `${baseUrl}/api/agent-gw/token/exchange`, agent.value, options, 'exchange');
+  // The current cloud endpoint returns {token, scope, ttl} without an envelope.
+  const payload = isObject(response.data) ? response.data : response;
+  if (typeof payload.token !== 'string' || !payload.token.trim() || /\s/.test(payload.token) ||
+    typeof payload.scope !== 'string' || !Number.isFinite(payload.ttl) || payload.ttl <= 0) {
+    throw failure('INVALID_RESPONSE', 'invalid_response', 'exchange');
+  }
+  const decoded = decodeClaims(payload.token);
+  if (typeof decoded.exp === 'number' && decoded.exp * 1000 <= Date.now()) {
+    throw failure('TOKEN_EXPIRED', 'expired_token', 'exchange');
+  }
+  return {
+    access_token: payload.token,
+    base_url: baseUrl,
+    credential_source: agent.name,
+    scope: payload.scope,
+    expires_in: payload.ttl,
+    expires_at: typeof decoded.exp === 'number' ? decoded.exp * 1000 : Date.now() + payload.ttl * 1000,
+  };
+}
+
+/** Query the credential's own origin; never infer a YiDA endpoint or organization. */
+async function getQwenWorkUserInfo(credential, options = {}) {
+  const accessToken = credential && credential.access_token;
+  if (typeof accessToken !== 'string' || !accessToken || /[\r\n]/.test(accessToken)) {
+    throw failure('CREDENTIAL_MISSING', 'credential_missing', 'user_info');
+  }
+  const baseUrl = normalizeBaseUrl(credential.base_url);
+  const response = await requestJson('GET', `${baseUrl}/user/info`, accessToken, options, 'user_info');
+  if (response.code !== 'ok' || !isObject(response.data) ||
+    typeof response.data.user_id !== 'string' || !response.data.user_id.trim()) {
+    throw failure('INVALID_RESPONSE', 'invalid_response', 'user_info');
+  }
+  const env = options.env || process.env;
+  const decoded = decodeClaims(accessToken);
+  // Decoding is not local signature verification. The authenticated /user/info
+  // response establishes identity; these comparisons catch context drift.
+  for (const expected of [env.QWENWORK_USER_ID, env.MULE_USER_ID, decoded.user_id, decoded.sub]) {
+    if (expected && String(expected) !== response.data.user_id) {
+      throw failure('IDENTITY_MISMATCH', 'identity_mismatch', 'user_info');
+    }
+  }
+  const orgId = response.data.biz && response.data.biz.org_id;
+  if (orgId && decoded.biz_org_id && orgId !== decoded.biz_org_id) {
+    throw failure('IDENTITY_MISMATCH', 'identity_mismatch', 'user_info');
+  }
+  return response.data;
+}
+
+/** Safe composition for identity consumers: the returned object has no credential. */
+async function getQwenWorkIdentity(options = {}) {
+  const credential = await exchangeQwenWorkAgentToken(options);
+  const profile = await getQwenWorkUserInfo(credential, options);
+  return {
+    base_url: credential.base_url,
+    credential_source: credential.credential_source,
+    scope: credential.scope,
+    expires_in: credential.expires_in,
+    expires_at: credential.expires_at,
+    profile,
+  };
+}
+
+module.exports = { exchangeQwenWorkAgentToken, getQwenWorkUserInfo, getQwenWorkIdentity };

package/lib/auth/qwenwork-desktop.js

@@ -0,0 +1,140 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+const { DINGTALK_OAUTH_CLIENT_ID } = require('../core/env-manager');
+const { saveTokenSession, loadTokenSession, isEnvTokenAuthMode } = require('./token-store');
+const { readManagedContext } = require('../agent/managed-context');
+
+const TICKET_ENV = 'OPENYIDA_QWENWORK_EXCHANGE_TICKET';
+const TICKET_CONTEXT_ENV = 'OPENYIDA_QWENWORK_EXCHANGE_TICKET_CONTEXT';
+const CONSUME_PATH = '/openapi/cli/v1/auth/qwenwork/desktop/consume';
+const MAX_RESPONSE_BYTES = 65536;
+
+function fail(code) {
+  return new CliError(t('qwenwork.desktop_login_failed'), { code: `QWENWORK_DESKTOP_${code}` });
+}
+
+function parseTicket(raw, context) {
+  try {
+    if (typeof raw !== 'string' || !raw || /\s/.test(raw) || raw.length > 32768 || typeof context !== 'string' || context.length > 8192) { throw new Error(); }
+    const value = JSON.parse(context);
+    if (!value || typeof value !== 'object' || Array.isArray(value) ||
+      !Number.isSafeInteger(value.expires_at) || value.expires_at <= Date.now() || value.expires_at > Date.now() + 300000 ||
+      typeof value.corp_id !== 'string' || !value.corp_id || typeof value.user_id !== 'string' || !value.user_id ||
+      typeof value.exchange_id !== 'string' || !value.exchange_id ||
+      'access_token' in value || 'refresh_token' in value || 'accessToken' in value || 'refreshToken' in value) { throw new Error(); }
+    return { ...value, exchange_ticket: raw };
+  } catch {
+    throw fail('TICKET_MISSING_OR_INVALID');
+  }
+}
+
+function origin(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/') { throw new Error(); }
+    return url.origin;
+  } catch {
+    throw fail('ENDPOINT_INVALID');
+  }
+}
+
+async function requestJson(url, init, options) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs || 15000);
+  try {
+    const response = await (options.fetch || globalThis.fetch)(url, { ...init, redirect: 'error', signal: controller.signal });
+    if (!response.ok) {
+      if (response.body) { await response.body.cancel(); }
+      throw fail('REQUEST_REJECTED');
+    }
+    const reader = response.body && response.body.getReader();
+    if (!reader) { throw fail('RESPONSE_INVALID'); }
+    const chunks = [];
+    let bytes = 0;
+    try {
+      for (let next = await reader.read(); !next.done; next = await reader.read()) {
+        bytes += next.value.byteLength;
+        if (bytes > MAX_RESPONSE_BYTES) { await reader.cancel(); throw fail('RESPONSE_INVALID'); }
+        chunks.push(next.value);
+      }
+    } finally {
+      reader.releaseLock();
+    }
+    const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value)) { throw fail('RESPONSE_INVALID'); }
+    return value;
+  } catch (error) {
+    // 服务端和网络异常可能回显凭据，只透传本模块生成的固定错误。
+    if (error instanceof CliError && /^QWENWORK_DESKTOP_/.test(error.code)) { throw error; }
+    throw fail(controller.signal.aborted ? 'REQUEST_TIMED_OUT' : 'REQUEST_FAILED');
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** 专用免登入口：只消费环境中的一次性兑换票，不调用或重启普通 login。 */
+async function loginQwenWork(options = {}) {
+  const env = options.env || process.env;
+  const raw = env[TICKET_ENV];
+  const context = env[TICKET_CONTEXT_ENV];
+  delete env[TICKET_ENV];
+  delete env[TICKET_CONTEXT_ENV];
+  if (isEnvTokenAuthMode(env) || readManagedContext(env)) { throw fail('MANAGED_AUTH_CONFLICT'); }
+  const ticket = parseTicket(raw, context);
+  const baseUrl = origin(ticket.base_url);
+  const expectedEndpoint = options.endpoint || env.OPENYIDA_ENDPOINT;
+  if (expectedEndpoint && origin(expectedEndpoint) !== baseUrl) { throw fail('ENDPOINT_MISMATCH'); }
+  if (options.corpId && options.corpId !== ticket.corp_id) { throw fail('IDENTITY_MISMATCH'); }
+  const startedAt = Date.now();
+  const value = await requestJson(`${baseUrl}${CONSUME_PATH}`, {
+    method: 'POST', headers: { accept: 'application/json', 'content-type': 'application/json', authorization: `Bearer ${ticket.exchange_ticket}` },
+    body: '{}',
+  }, options);
+  const expiresAt = startedAt + Number(value.expires_in) * 1000;
+  if (value.status !== 'ok' || value.auth_mode !== 'token' || value.can_auto_use !== true ||
+    value.token_type !== 'Bearer' || value.credential_source !== 'qwenwork_desktop' ||
+    'refresh_token' in value || 'refreshToken' in value || 'exchange_ticket' in value ||
+    typeof value.access_token !== 'string' || !value.access_token || /\s/.test(value.access_token) || value.access_token.length > 32768 ||
+    !Number.isInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 1800 ||
+    value.corp_id !== ticket.corp_id || value.user_id !== ticket.user_id || value.exchange_id !== ticket.exchange_id ||
+    (value.base_url && origin(value.base_url) !== baseUrl)) { throw fail('CREDENTIAL_INVALID'); }
+  const verified = await requestJson(`${baseUrl}/openapi/cli/v1/auth/status`, {
+    method: 'GET', headers: { authorization: `Bearer ${value.access_token}`, accept: 'application/json' },
+  }, options);
+  if (verified.status !== 'ok' || verified.auth_mode !== 'token' || verified.can_auto_use !== true ||
+    verified.corp_id !== value.corp_id || verified.user_id !== value.user_id || expiresAt <= Date.now()) { throw fail('IDENTITY_MISMATCH'); }
+  const session = saveTokenSession({
+    auth_mode: 'token', token_type: 'Bearer', access_token: value.access_token,
+    expires_at: expiresAt, base_url: baseUrl, client_id: DINGTALK_OAUTH_CLIENT_ID,
+    corp_id: value.corp_id, user_id: value.user_id, credential_source: 'qwenwork_desktop',
+  }, options);
+  const restored = loadTokenSession(options);
+  if (!['user', 'project'].includes(session.persistence_scope) || !restored ||
+    restored.access_token !== value.access_token || restored.base_url !== baseUrl ||
+    restored.corp_id !== value.corp_id || restored.user_id !== value.user_id) { throw fail('PERSISTENCE_FAILED'); }
+  // 身份、环境和存储细节仅用于内部校验，不进入模型可见的登录结果。
+  return { ok: true, status: 'ok', can_auto_use: true };
+}
+
+async function run(args, options = {}) {
+  if (args.includes('--help') || args.includes('-h')) { console.log(t('qwenwork.desktop_login_usage')); return; }
+  const parsed = {};
+  const seen = new Set();
+  for (let index = 0; index < args.length; index++) {
+    const flag = args[index];
+    if (seen.has(flag)) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 }); }
+    seen.add(flag);
+    if (['--json', '--quiet'].includes(flag)) { continue; }
+    const key = flag === '--corp-id' ? 'corpId' : flag === '--endpoint' ? 'endpoint' : null;
+    const value = args[++index];
+    if (!key || !value || value.startsWith('--')) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 }); }
+    parsed[key] = value;
+  }
+  const result = await loginQwenWork({ ...options, ...parsed });
+  if (args.includes('--json') && !args.includes('--quiet') && (options.env || process.env).YIDA_QUIET !== '1') { console.log(JSON.stringify(result)); }
+  return result;
+}
+
+module.exports = { TICKET_ENV, TICKET_CONTEXT_ENV, loginQwenWork, run };

package/lib/auth/qwenwork.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+const { redactSensitive } = require('../core/redact');
+const { getQwenWorkIdentity } = require('./qwenwork-client');
+
+async function run(args, options = {}) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(t('qwenwork.usage'));
+    return;
+  }
+  if (args[0] !== 'user-info' || args.slice(1).some(arg => arg !== '--json')) {
+    throw new CliError(t('qwenwork.usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 });
+  }
+  const identity = await getQwenWorkIdentity(options);
+  const { profile, ...metadata } = identity;
+  const result = redactSensitive({
+    ok: true,
+    provider: 'qwenwork',
+    ...metadata,
+    user: {
+      user_id: profile.user_id,
+      nickname: profile.nickname,
+      username: profile.username,
+      email: profile.email,
+      is_biz: profile.is_biz,
+      biz_org_id: profile.biz && profile.biz.org_id,
+      biz_org_name: profile.biz && profile.biz.org_name,
+    },
+    yida_session_created: false,
+  });
+  console.log(JSON.stringify(result, null, 2));
+  return result;
+}
+
+module.exports = { run };

package/lib/auth/token-store.js

@@ -276,6 +276,7 @@ function normalizeTokenSession(session = {}) {
   );
   const normalized = {
     auth_mode: 'token',
+    credential_source: session.credential_source,
     token_type: session.token_type || session.tokenType || 'Bearer',
     access_token: session.access_token || session.accessToken,
     refresh_token: session.refresh_token || session.refreshToken,

package/lib/core/agent-capabilities.js

@@ -3,7 +3,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-const { version } = require('../../package.json');
+const { version, openyidaLocalBeta: localBeta } = require('../../package.json');
 const { t } = require('./i18n');
 const { buildCommandManifest } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
@@ -195,7 +195,7 @@ function forbiddenAliasBriefs(manifest) {
   }));
 }
 
-function buildAuthPath(login, env = process.env) {
+function buildAuthPath(login, env = process.env, runtime = null) {
   const authSource = login.auth_source || 'token_session';
   const envTokenSession = authSource === 'env' || login.failure_reason === 'env_token_missing';
   const authPath = {
@@ -230,10 +230,30 @@ function buildAuthPath(login, env = process.env) {
       ? 'STOP_AND_REQUEST_ENV_TOKEN'
       : 'RUN_OPENYIDA_LOGIN_IF_USER_APPROVES',
   };
+  // 桌面换票仅由当前活跃宿主和发行配置共同启用，不影响其他宿主的认证路径。
+  if (localBeta?.desktopTicketLogin && runtime?.tool === 'qwenwork' && runtime?.subtype === 'qwenwork_desktop' && !envTokenSession) {
+    authPath.auth_runtime = 'qwenwork_desktop_exchange_ticket';
+    authPath.interactive_login_allowed = false;
+    authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
+    for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
+    authPath.next_step = authPath.can_auto_use
+      ? 'Silently continue the requested business operation. Do not announce login or identity details.'
+      : 'Silently run standalone openyida login-qwenwork --json, then continue the requested business operation. Do not narrate login, add shell operators, start OAuth, or edit environment files.';
+    authPath.next_step_commands = authPath.can_auto_use ? [] : ['openyida login-qwenwork --json'];
+  }
   return authPath;
 }
 
 function buildInteractiveLogin(auth, runtime) {
+  if (auth.auth_runtime === 'qwenwork_desktop_exchange_ticket' && runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') {
+    return {
+      mode: 'desktop_ticket', browser_default: 'not_required', browser_owner: 'none',
+      recommended_command: auth.can_auto_use ? null : 'openyida login-qwenwork --json',
+      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_standalone_login_qwenwork_and_wait',
+      user_visible: false, success_action: 'continue_business_command_without_message',
+      reason: 'qwenwork_desktop_pre_beta', completion_signal: 'process_exit_and_final_json', playwright_required: false,
+    };
+  }
   const base = {
     suppress_flag: '--no-browser',
     suppress_env: 'OPENYIDA_NO_BROWSER',
@@ -293,9 +313,9 @@ function buildInteractiveLogin(auth, runtime) {
 }
 
 function buildBuilderPath(login, projectRoot, manifest, env = process.env, runtimeSnapshot = null) {
-  const auth = buildAuthPath(login, env);
-  const canTrustSummaryPreflight = auth.can_auto_use === true;
   const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
+  const auth = buildAuthPath(login, env, runtime);
+  const canTrustSummaryPreflight = auth.can_auto_use === true;
 
   return {
     schema_version: 1,
@@ -311,6 +331,13 @@ function buildBuilderPath(login, projectRoot, manifest, env = process.env, runti
     auth,
     runtime,
     interactive_login: buildInteractiveLogin(auth, runtime),
+    communication: runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop' ? {
+      preparation_visibility: 'silent',
+      completion_content: 'business_result_and_business_link_only',
+      disclose_authentication_identity_environment: false,
+      report_preparation_only_when_user_action_is_required: true,
+      bundled_skill_path: path.resolve(__dirname, '../../yida-skills'),
+    } : undefined,
     environment_check_simplification: {
       contract_role: 'machine_readable_builder_runtime_not_yida_agent_business_logic',
       minimal_probe_commands: [
@@ -432,6 +459,7 @@ function compactBuilderPath(builderPath) {
     auth,
     runtime: builderPath.runtime,
     interactive_login: builderPath.interactive_login,
+    communication: builderPath.communication,
     environment_check_simplification: {
       minimal_probe_commands: environment.minimal_probe_commands,
       can_skip_default_exploration_when_summary_ok: environment.can_skip_default_exploration_when_summary_ok,
@@ -601,7 +629,9 @@ function buildAgentCapabilitiesSummary() {
     schema_version: 1,
     name: 'openyida-agent-capabilities-summary',
     version,
-    login: compactLogin(loginStatus),
+    login: builderPath.auth.auth_runtime === 'qwenwork_desktop_exchange_ticket'
+      ? { status: loginStatus.status, can_auto_use: loginStatus.can_auto_use === true }
+      : compactLogin(loginStatus),
     workdir: projectRoot,
     workdir_exists: !!projectResolution.exists,
     workdir_source: projectResolution.source,