openyida 2026.10.23-beta.2 → 2026.10.23-beta.3

package/lib/auth/qwenwork-desktop.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { CliError } = require('../core/cli-error');
+const { buildQwenWorkLoginInvocation } = require('../core/qwenwork-login-guidance');
 const { t } = require('../core/i18n');
 const { DINGTALK_OAUTH_CLIENT_ID } = require('../core/env-manager');
 const { saveTokenSession, loadTokenSession, isEnvTokenAuthMode } = require('./token-store');
@@ -12,7 +13,10 @@ const CONSUME_PATH = '/openapi/cli/v1/auth/qwenwork/desktop/consume';
 const MAX_RESPONSE_BYTES = 65536;
 
 function fail(code) {
-  return new CliError(t('qwenwork.desktop_login_failed'), { code: `QWENWORK_DESKTOP_${code}` });
+  return new CliError(t('qwenwork.desktop_login_failed'), {
+    code: `QWENWORK_DESKTOP_${code}`,
+    details: { invocation: buildQwenWorkLoginInvocation() },
+  });
 }
 
 function parseTicket(raw, context) {
@@ -95,9 +99,12 @@ async function loginQwenWork(options = {}) {
   const expiresAt = startedAt + Number(value.expires_in) * 1000;
   if (value.status !== 'ok' || value.auth_mode !== 'token' || value.can_auto_use !== true ||
     value.token_type !== 'Bearer' || value.credential_source !== 'qwenwork_desktop' ||
-    'refresh_token' in value || 'refreshToken' in value || 'exchange_ticket' in value ||
+    'refreshToken' in value || 'exchange_ticket' in value ||
     typeof value.access_token !== 'string' || !value.access_token || /\s/.test(value.access_token) || value.access_token.length > 32768 ||
     !Number.isInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 1800 ||
+    typeof value.refresh_token !== 'string' || !value.refresh_token || /\s/.test(value.refresh_token) || value.refresh_token.length > 32768 ||
+    !Number.isInteger(value.refresh_token_expires_in) || value.refresh_token_expires_in < 1 ||
+    (value.client_id && value.client_id !== DINGTALK_OAUTH_CLIENT_ID) ||
     value.corp_id !== ticket.corp_id || value.user_id !== ticket.user_id || value.exchange_id !== ticket.exchange_id ||
     (value.base_url && origin(value.base_url) !== baseUrl)) { throw fail('CREDENTIAL_INVALID'); }
   const verified = await requestJson(`${baseUrl}/openapi/cli/v1/auth/status`, {
@@ -106,34 +113,39 @@ async function loginQwenWork(options = {}) {
   if (verified.status !== 'ok' || verified.auth_mode !== 'token' || verified.can_auto_use !== true ||
     verified.corp_id !== value.corp_id || verified.user_id !== value.user_id || expiresAt <= Date.now()) { throw fail('IDENTITY_MISMATCH'); }
   const session = saveTokenSession({
-    auth_mode: 'token', token_type: 'Bearer', access_token: value.access_token,
+    auth_mode: 'token', token_type: 'Bearer', access_token: value.access_token, refresh_token: value.refresh_token,
     expires_at: expiresAt, base_url: baseUrl, client_id: DINGTALK_OAUTH_CLIENT_ID,
     corp_id: value.corp_id, user_id: value.user_id, credential_source: 'qwenwork_desktop',
   }, options);
   const restored = loadTokenSession(options);
   if (!['user', 'project'].includes(session.persistence_scope) || !restored ||
-    restored.access_token !== value.access_token || restored.base_url !== baseUrl ||
+    restored.access_token !== value.access_token || restored.refresh_token !== value.refresh_token || restored.base_url !== baseUrl ||
     restored.corp_id !== value.corp_id || restored.user_id !== value.user_id) { throw fail('PERSISTENCE_FAILED'); }
   // 身份、环境和存储细节仅用于内部校验，不进入模型可见的登录结果。
   return { ok: true, status: 'ok', can_auto_use: true };
 }
 
 async function run(args, options = {}) {
-  if (args.includes('--help') || args.includes('-h')) { console.log(t('qwenwork.desktop_login_usage')); return; }
+  if (args.includes('--help') || args.includes('-h')) {
+    const invocation = buildQwenWorkLoginInvocation();
+    if (args.includes('--json')) { console.log(JSON.stringify({ usage: t('qwenwork.desktop_login_usage'), invocation })); }
+    else { console.log(`${t('qwenwork.desktop_login_usage')}\n${t('qwenwork.desktop_login_standalone', invocation.command)}`); }
+    return;
+  }
   const parsed = {};
   const seen = new Set();
   for (let index = 0; index < args.length; index++) {
     const flag = args[index];
-    if (seen.has(flag)) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 }); }
+    if (seen.has(flag)) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2, details: { invocation: buildQwenWorkLoginInvocation() } }); }
     seen.add(flag);
     if (['--json', '--quiet'].includes(flag)) { continue; }
     const key = flag === '--corp-id' ? 'corpId' : flag === '--endpoint' ? 'endpoint' : null;
     const value = args[++index];
-    if (!key || !value || value.startsWith('--')) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 }); }
+    if (!key || !value || value.startsWith('--')) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2, details: { invocation: buildQwenWorkLoginInvocation() } }); }
     parsed[key] = value;
   }
   const result = await loginQwenWork({ ...options, ...parsed });
-  if (args.includes('--json') && !args.includes('--quiet') && (options.env || process.env).YIDA_QUIET !== '1') { console.log(JSON.stringify(result)); }
+  if (args.includes('--json') && !args.includes('--quiet') && (options.env || process.env).YIDA_QUIET !== '1') { console.log(JSON.stringify({ ...result, next_action: 'continue_business_operation_silently', user_visible: false })); }
   return result;
 }
 

package/lib/auth/token-auth.js

@@ -175,6 +175,7 @@ function normalizeTokenResponse(response, baseUrl, clientId) {
   );
   return {
     auth_mode: 'token',
+    credential_source: data.credential_source,
     status: data.status || 'ok',
     can_auto_use: true,
     message: data.message || data.errorMsg || response.errorMsg,
@@ -486,7 +487,9 @@ async function tokenRefreshUnlocked(options, session) {
   // Token exchange follows the active environment endpoint, just like the
   // legacy login bootstrap. The response may return a different corp base_url
   // for business requests and generated application links.
-  const authBaseUrlValue = resolveTokenBaseUrl({
+  // 桌面会话沿用首次换票的可信 origin；刷新不受后续全局环境切换影响。
+  const desktopSession = session.credential_source === 'qwenwork_desktop';
+  const authBaseUrlValue = desktopSession ? session.base_url : resolveTokenBaseUrl({
     projectRoot: options.projectRoot,
     endpoint: options.endpoint,
   });
@@ -499,6 +502,9 @@ async function tokenRefreshUnlocked(options, session) {
   requireOkResponse(response);
   const data = getTokenPayload(response);
   const responseBusinessBaseUrl = data.base_url || data.baseUrl;
+  if (desktopSession && responseBusinessBaseUrl && normalizeBaseUrl(responseBusinessBaseUrl, null) !== session.base_url) {
+    throw createTokenAuthRequiredError('refresh_origin_mismatch');
+  }
   const businessBaseUrl = session.base_url || authBaseUrlValue;
   const normalized = normalizeTokenResponse({
     ...data,
@@ -507,6 +513,7 @@ async function tokenRefreshUnlocked(options, session) {
     user_id: data.user_id || data.userId || session.user_id,
     user_name: data.user_name || data.userName || session.user_name,
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
+    credential_source: data.credential_source || session.credential_source,
   }, businessBaseUrl, clientId);
   if (!normalized.access_token) {
     return {

package/lib/core/agent-capabilities.js

@@ -9,6 +9,7 @@ const { buildCommandManifest } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
 const coreUtils = require('./utils');
 const { buildHostAssetCapabilities } = require('../asset/host-capabilities');
+const { buildQwenWorkLoginInvocation } = require('./qwenwork-login-guidance');
 const { findProjectRoot, getAuthStatus } = coreUtils;
 
 function redactLogin(login) {
@@ -232,14 +233,15 @@ function buildAuthPath(login, env = process.env, runtime = null) {
   };
   // 桌面换票仅由当前活跃宿主和发行配置共同启用，不影响其他宿主的认证路径。
   if (localBeta?.desktopTicketLogin && runtime?.tool === 'qwenwork' && runtime?.subtype === 'qwenwork_desktop' && !envTokenSession) {
+    const invocation = buildQwenWorkLoginInvocation();
     authPath.auth_runtime = 'qwenwork_desktop_exchange_ticket';
     authPath.interactive_login_allowed = false;
     authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
     for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
     authPath.next_step = authPath.can_auto_use
-      ? 'Silently continue the requested business operation. Do not announce login or identity details.'
-      : 'Silently run standalone openyida login-qwenwork --json, then continue the requested business operation. Do not narrate login, add shell operators, start OAuth, or edit environment files.';
-    authPath.next_step_commands = authPath.can_auto_use ? [] : ['openyida login-qwenwork --json'];
+      ? 'Silently continue the requested business operation and report its business result.'
+      : `Run the recommended login command as returned: ${invocation.command}. No extra PATH or output setup is needed. After success silently continue the requested business operation. If it fails, follow the returned invocation guidance.`;
+    authPath.next_step_commands = authPath.can_auto_use ? [] : [invocation.command];
   }
   return authPath;
 }
@@ -248,7 +250,8 @@ function buildInteractiveLogin(auth, runtime) {
   if (auth.auth_runtime === 'qwenwork_desktop_exchange_ticket' && runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') {
     return {
       mode: 'desktop_ticket', browser_default: 'not_required', browser_owner: 'none',
-      recommended_command: auth.can_auto_use ? null : 'openyida login-qwenwork --json',
+      recommended_command: auth.can_auto_use ? null : buildQwenWorkLoginInvocation().command,
+      invocation: buildQwenWorkLoginInvocation(),
       agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_standalone_login_qwenwork_and_wait',
       user_visible: false, success_action: 'continue_business_command_without_message',
       reason: 'qwenwork_desktop_pre_beta', completion_signal: 'process_exit_and_final_json', playwright_required: false,

package/lib/core/env-manager.js

@@ -24,7 +24,6 @@
 const fs = require('fs');
 const path = require('path');
 const { findProjectRoot } = require('./utils');
-const localBeta = require('../../package.json').openyidaLocalBeta;
 
 const DEFAULT_BASE_URL = 'https://www.aliwork.com';
 const DEFAULT_LOGIN_URL = 'https://www.aliwork.com/workPlatform';
@@ -108,7 +107,6 @@ const DEFAULT_INTERNATIONAL_ENV = {
 };
 
 const BUILTIN_ENVIRONMENTS = {
-  ...(localBeta ? { [localBeta.environment]: { baseUrl: localBeta.baseUrl, loginUrl: localBeta.baseUrl + '/workPlatform', description: localBeta.description } } : {}),
   public: DEFAULT_PUBLIC_ENV,
   intl: DEFAULT_INTERNATIONAL_ENV,
   alibaba: DEFAULT_ALIBABA_INTERNAL_ENV,
@@ -167,7 +165,7 @@ function cloneBuiltinEnvironments() {
 
 function buildDefaultEnvsConfig() {
   return {
-    current: localBeta?.environment || 'public',
+    current: 'public',
     environments: cloneBuiltinEnvironments(),
   };
 }

package/lib/core/locales/en.js

@@ -7,6 +7,7 @@ module.exports = {
   qwenwork: {
     desktop_login_failed: 'QwenWork desktop login failed. Check the desktop identity and login handoff before retrying.',
     desktop_login_usage: 'Usage: openyida login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]',
+    desktop_login_standalone: 'Run the recommended login command directly: {0}. No extra PATH or output setup is needed. After success continue the business operation silently; on failure follow the returned guidance.',
     credential_missing: 'No cloud Agent credential is available. Run this command inside the QwenWork cloud execution environment.',
     gateway_missing: 'QWENWORK_GATEWAY_URL or MULE_GATEWAY_URL is required.',
     invalid_url: 'The QwenWork gateway must use HTTPS (HTTP is allowed only for loopback) and contain no credentials, query or fragment.',

package/lib/core/locales/zh.js

@@ -7,6 +7,7 @@ module.exports = {
   qwenwork: {
     desktop_login_failed: '千问办公桌面免登失败，请确认桌面登录身份和免登通道后重试。',
     desktop_login_usage: '用法：openyida login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]',
+    desktop_login_standalone: '请直接执行推荐的登录命令：{0}。无需额外处理 PATH 和输出；成功后静默继续业务，失败时按提示修正调用。',
     credential_missing: '未发现云端 Agent 凭证，请在千问办公云端执行环境中运行此命令。',
     gateway_missing: '缺少 QWENWORK_GATEWAY_URL 或 MULE_GATEWAY_URL。',
     invalid_url: '千问网关必须使用 HTTPS（仅回环地址允许 HTTP），且不能包含账号密码、查询参数或片段。',

package/lib/core/qwenwork-login-guidance.js

@@ -0,0 +1,32 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** 从当前调用或同一安装前缀定位入口，不依赖模型重写 PATH。 */
+function resolveExecutable(invoked = process.argv[1], packageRoot = path.resolve(__dirname, '../..')) {
+  const usable = value => typeof value === 'string' && /^(?:\/|[a-z]:[\\/])/i.test(value)
+    && /^[\w./:\\-]+$/.test(value) && /^openyida(?:\.cmd|\.exe)?$/i.test(path.basename(value.replace(/\\/g, '/')));
+  if (usable(invoked)) { return invoked.replace(/\\/g, '/'); }
+  const candidates = [path.resolve(packageRoot, '../../../bin/openyida'), path.resolve(packageRoot, '../../openyida.cmd')];
+  for (const candidate of candidates) {
+    if (!usable(candidate) || !fs.existsSync(candidate)) { continue; }
+    try {
+      if (fs.realpathSync(candidate).startsWith(`${fs.realpathSync(packageRoot)}${path.sep}`)) { return candidate.replace(/\\/g, '/'); }
+    } catch { /* 不可用入口不扩展到其他安装目录。 */ }
+  }
+  return 'openyida';
+}
+
+function buildQwenWorkLoginInvocation(options = {}) {
+  const executable = resolveExecutable(options.executablePath, options.packageRoot);
+  return {
+    command: `${executable} login-qwenwork --json`,
+    required_runtime: { tool: 'qwenwork', subtype: 'qwenwork_desktop' },
+    execution: 'standalone_command',
+    preserve_command_verbatim: true,
+    output_visibility: 'internal',
+    success_next_step: 'continue_business_operation_silently',
+    failure_next_step: 'follow_returned_invocation_guidance',
+  };
+}
+module.exports = { buildQwenWorkLoginInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.10.23-beta.2",
+  "version": "2026.10.23-beta.3",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida-pre-beta.js",

package/yida-skills/references/qwenwork-desktop-login.md

@@ -18,13 +18,13 @@
 
 只以当前 `openyida agent-capabilities --summary-json` 的 `runtime.tool=qwenwork`、`runtime.subtype=qwenwork_desktop` 和 `builder_path.interactive_login.mode=desktop_ticket` 判断桌面换票能力。安装目录、产品名称和历史会话不能替代当前快照。
 
-快照显示登录可用时直接执行用户请求；登录不可用且上述条件全部成立时，单独执行下面一条命令，成功后直接继续业务操作：
+快照显示登录可用时直接执行用户请求；登录不可用且上述条件全部成立时，原样执行 `builder_path.interactive_login.recommended_command`。该命令优先使用当前 CLI 的绝对路径，后续复用同一入口，不自行补 PATH。执行规则以 `builder_path.interactive_login.invocation` 为准；成功后直接继续业务操作。下面仅为命令形式示例：
 
 ```bash
 openyida login-qwenwork --json
 ```
 
-这条命令不拼接 `cd`、`env`、重定向、管道、`head`、`echo` 或任何其他 Shell 命令；执行工具已提供退出状态，无需追加输出。专用命令只消费本次私有通道的短期一次性兑换票，不调用或递归进入普通 `login`。
+直接使用推荐的完整命令即可，无需额外处理 PATH 和输出；执行工具会提供结果和退出状态。调用格式不匹配时，按返回的推荐命令修正后继续。专用命令只消费本次私有通道的短期一次性兑换票，不调用或递归进入普通 `login`。
 
 真实宜搭凭据仅由 CLI 校验并持久化，不读取、填写或展示任何令牌、兑换票和认证文件。保持包内配置及实际认证 origin，不根据历史记忆猜测环境等价或切换到其他环境、组织。凭据过期时重新执行专用命令；票据缺失、过期、重放、签发或消费失败时停止，不回退 OAuth、直接凭据或手改环境文件。