openyida 2026.10.23-beta.2 → 2026.10.23-beta.4

package/README.md

@@ -476,8 +476,7 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
-| `openyida login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]` | Log in to YiDA with a one-time QwenWork exchange ticket |
+| `openyida login [--qwenwork] [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
 | `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch\|qwenwork user-info> [--json]` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |

package/bin/yida.js

@@ -296,7 +296,6 @@ function getFirstPositionalArg(cliArgs, startIndex = 0) {
 }
 
 const UNSUPPORTED_LEGACY_LOGIN_FLAGS = new Set([
-  '--qwenwork',
   '--qr',
   '--qr-code',
   '--agent-qr',
@@ -596,11 +595,20 @@ async function main() {
   assertManagedInvocation(command, rawArgs);
   applyQuietFlag();
   // 一次性票据只在当前进程消费，不能先自更新并重启命令。
-  if (command === 'login-qwenwork') {
-    await require('../lib/auth/qwenwork-desktop').run(args);
-    return;
+  switch (command) {
+    case 'login-qwenwork':
+      await require('../lib/auth/qwenwork-desktop').run(args);
+      return;
   }
   applyGlobalEnvironmentFlags();
+  // 桌面准备完成后继续执行公开命令，由真实登录态决定结果。
+  if (command === 'login' && args.includes('--qwenwork')) {
+    const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
+    if (hasHelpFlag(loginArgs)) { printLoginHelp(); return; }
+    assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
+    await require('../lib/auth/qwenwork-login').run(loginArgs, buildTokenLoginOptions(loginArgs));
+    return;
+  }
 
   const { maybeAutoUpdate } = require('../lib/core/update');
   const updateResult = await maybeAutoUpdate({

package/lib/auth/qwenwork-desktop.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { CliError } = require('../core/cli-error');
+const { buildQwenWorkLoginInvocation } = require('../core/qwenwork-login-guidance');
 const { t } = require('../core/i18n');
 const { DINGTALK_OAUTH_CLIENT_ID } = require('../core/env-manager');
 const { saveTokenSession, loadTokenSession, isEnvTokenAuthMode } = require('./token-store');
@@ -12,7 +13,10 @@ const CONSUME_PATH = '/openapi/cli/v1/auth/qwenwork/desktop/consume';
 const MAX_RESPONSE_BYTES = 65536;
 
 function fail(code) {
-  return new CliError(t('qwenwork.desktop_login_failed'), { code: `QWENWORK_DESKTOP_${code}` });
+  return new CliError(t('qwenwork.desktop_login_failed'), {
+    code: `QWENWORK_DESKTOP_${code}`,
+    details: { invocation: buildQwenWorkLoginInvocation() },
+  });
 }
 
 function parseTicket(raw, context) {
@@ -74,11 +78,11 @@ async function requestJson(url, init, options) {
   }
 }
 
-/** 专用免登入口：只消费环境中的一次性兑换票，不调用或重启普通 login。 */
+/** 客户端内部入口：消费一次性兑换票并持久化双 Token，不调用或重启普通 login。 */
 async function loginQwenWork(options = {}) {
   const env = options.env || process.env;
-  const raw = env[TICKET_ENV];
-  const context = env[TICKET_CONTEXT_ENV];
+  const raw = options.exchangeTicket || env[TICKET_ENV];
+  const context = options.ticketContext || env[TICKET_CONTEXT_ENV];
   delete env[TICKET_ENV];
   delete env[TICKET_CONTEXT_ENV];
   if (isEnvTokenAuthMode(env) || readManagedContext(env)) { throw fail('MANAGED_AUTH_CONFLICT'); }
@@ -95,9 +99,12 @@ async function loginQwenWork(options = {}) {
   const expiresAt = startedAt + Number(value.expires_in) * 1000;
   if (value.status !== 'ok' || value.auth_mode !== 'token' || value.can_auto_use !== true ||
     value.token_type !== 'Bearer' || value.credential_source !== 'qwenwork_desktop' ||
-    'refresh_token' in value || 'refreshToken' in value || 'exchange_ticket' in value ||
+    'refreshToken' in value || 'exchange_ticket' in value ||
     typeof value.access_token !== 'string' || !value.access_token || /\s/.test(value.access_token) || value.access_token.length > 32768 ||
     !Number.isInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 1800 ||
+    typeof value.refresh_token !== 'string' || !value.refresh_token || /\s/.test(value.refresh_token) || value.refresh_token.length > 32768 ||
+    !Number.isInteger(value.refresh_token_expires_in) || value.refresh_token_expires_in < 1 ||
+    (value.client_id && value.client_id !== DINGTALK_OAUTH_CLIENT_ID) ||
     value.corp_id !== ticket.corp_id || value.user_id !== ticket.user_id || value.exchange_id !== ticket.exchange_id ||
     (value.base_url && origin(value.base_url) !== baseUrl)) { throw fail('CREDENTIAL_INVALID'); }
   const verified = await requestJson(`${baseUrl}/openapi/cli/v1/auth/status`, {
@@ -106,34 +113,40 @@ async function loginQwenWork(options = {}) {
   if (verified.status !== 'ok' || verified.auth_mode !== 'token' || verified.can_auto_use !== true ||
     verified.corp_id !== value.corp_id || verified.user_id !== value.user_id || expiresAt <= Date.now()) { throw fail('IDENTITY_MISMATCH'); }
   const session = saveTokenSession({
-    auth_mode: 'token', token_type: 'Bearer', access_token: value.access_token,
+    auth_mode: 'token', token_type: 'Bearer', access_token: value.access_token, refresh_token: value.refresh_token,
     expires_at: expiresAt, base_url: baseUrl, client_id: DINGTALK_OAUTH_CLIENT_ID,
     corp_id: value.corp_id, user_id: value.user_id, credential_source: 'qwenwork_desktop',
   }, options);
   const restored = loadTokenSession(options);
   if (!['user', 'project'].includes(session.persistence_scope) || !restored ||
-    restored.access_token !== value.access_token || restored.base_url !== baseUrl ||
+    restored.access_token !== value.access_token || restored.refresh_token !== value.refresh_token || restored.base_url !== baseUrl ||
     restored.corp_id !== value.corp_id || restored.user_id !== value.user_id) { throw fail('PERSISTENCE_FAILED'); }
   // 身份、环境和存储细节仅用于内部校验，不进入模型可见的登录结果。
   return { ok: true, status: 'ok', can_auto_use: true };
 }
 
 async function run(args, options = {}) {
-  if (args.includes('--help') || args.includes('-h')) { console.log(t('qwenwork.desktop_login_usage')); return; }
+  if (args.includes('--help') || args.includes('-h')) {
+    const invocation = buildQwenWorkLoginInvocation();
+    if (args.includes('--json')) { console.log(JSON.stringify({ usage: t('qwenwork.desktop_login_usage'), invocation })); }
+    else { console.log(`${t('qwenwork.desktop_login_usage')}\n${t('qwenwork.desktop_login_standalone', invocation.command)}`); }
+    return;
+  }
   const parsed = {};
   const seen = new Set();
   for (let index = 0; index < args.length; index++) {
     const flag = args[index];
-    if (seen.has(flag)) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 }); }
+    if (seen.has(flag)) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2, details: { invocation: buildQwenWorkLoginInvocation() } }); }
     seen.add(flag);
     if (['--json', '--quiet'].includes(flag)) { continue; }
-    const key = flag === '--corp-id' ? 'corpId' : flag === '--endpoint' ? 'endpoint' : null;
+    const key = flag === '--corp-id' ? 'corpId' : flag === '--endpoint' ? 'endpoint'
+      : flag === '--exchange-ticket' ? 'exchangeTicket' : flag === '--ticket-context' ? 'ticketContext' : null;
     const value = args[++index];
-    if (!key || !value || value.startsWith('--')) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2 }); }
+    if (!key || !value || value.startsWith('--')) { throw new CliError(t('qwenwork.desktop_login_usage'), { code: 'CLI_USAGE_ERROR', exitCode: 2, details: { invocation: buildQwenWorkLoginInvocation() } }); }
     parsed[key] = value;
   }
   const result = await loginQwenWork({ ...options, ...parsed });
-  if (args.includes('--json') && !args.includes('--quiet') && (options.env || process.env).YIDA_QUIET !== '1') { console.log(JSON.stringify(result)); }
+  if (args.includes('--json') && !args.includes('--quiet') && (options.env || process.env).YIDA_QUIET !== '1') { console.log(JSON.stringify({ ...result, next_action: 'continue_business_operation_silently', user_visible: false })); }
   return result;
 }
 

package/lib/auth/qwenwork-login.js

@@ -0,0 +1,86 @@
+'use strict';
+const { t } = require('../core/i18n');
+const { CliError } = require('../core/cli-error');
+const { loadTokenSession, resolveTokenSession } = require('./token-store');
+const { tokenLogin, tokenRefresh, isRefreshAuthRequired } = require('./token-auth');
+
+function failure(code) {
+  return new CliError(t('qwenwork.login_check_failed'), { code });
+}
+function summary(ok) { return { ok, status: ok ? 'ok' : 'not_logged_in', can_auto_use: ok }; }
+
+/** 以服务端状态为准；网络异常不能触发浏览器登录。 */
+async function verify(session, options = {}) {
+  if (!session || !session.access_token) { return false; }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs || 15000);
+  try {
+    const response = await (options.fetch || globalThis.fetch)(`${session.base_url.replace(/\/$/, '')}/openapi/cli/v1/auth/status`, {
+      headers: { authorization: `Bearer ${session.access_token}`, accept: 'application/json' },
+      redirect: 'error', signal: controller.signal,
+    });
+    if ([401, 403].includes(response.status)) { await response.body?.cancel(); return false; }
+    if (!response.ok) { await response.body?.cancel(); throw failure('QWENWORK_LOGIN_CHECK_FAILED'); }
+    const reader = response.body?.getReader();
+    if (!reader) { throw failure('QWENWORK_LOGIN_CHECK_FAILED'); }
+    const chunks = []; let size = 0;
+    try {
+      for (let part = await reader.read(); !part.done; part = await reader.read()) {
+        size += part.value.byteLength;
+        if (size > 65536) { await reader.cancel(); throw failure('QWENWORK_LOGIN_CHECK_FAILED'); }
+        chunks.push(part.value);
+      }
+    } finally { reader.releaseLock(); }
+    const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    if (value.status !== 'ok' || value.can_auto_use !== true || value.auth_mode !== 'token') {
+      if (['not_logged_in', 'invalid_access_token', 'token_expired', 'auth_required'].includes(value.status)) { return false; }
+      throw failure('QWENWORK_LOGIN_CHECK_FAILED');
+    }
+    if (value.corp_id !== session.corp_id || value.user_id !== session.user_id ||
+      (options.corpId && value.corp_id !== options.corpId)) { throw failure('QWENWORK_LOGIN_IDENTITY_MISMATCH'); }
+    return true;
+  } catch (error) {
+    if (error instanceof CliError) { throw error; }
+    throw failure('QWENWORK_LOGIN_CHECK_FAILED');
+  } finally { clearTimeout(timer); }
+}
+
+/** 公开入口只复用、刷新或按需发起 OAuth，不接收客户端的一次性票据。 */
+async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
+  const resolution = resolveTokenSession(options);
+  if (resolution.status === 'profile_required') { throw failure('AUTH_PROFILE_REQUIRED'); }
+  let session = loadTokenSession(options);
+  if (session && options.endpoint && new URL(session.base_url).origin !== new URL(options.endpoint).origin) {
+    session = null;
+  }
+  if (await verify(session, options)) { return summary(true); }
+  if (session?.refresh_token) {
+    try {
+      const refreshed = await (dependencies.refresh || tokenRefresh)(options);
+      if (refreshed && refreshed.ok !== false && refreshed.access_token) {
+        if (await verify(refreshed, options)) { return summary(true); }
+      } else if (!isRefreshAuthRequired(refreshed)) { throw failure('QWENWORK_LOGIN_REFRESH_FAILED'); }
+    } catch (error) {
+      if (!isRefreshAuthRequired(error) && ![401, 403].includes(error.statusCode)) {
+        if (error instanceof CliError) { throw error; }
+        throw failure('QWENWORK_LOGIN_REFRESH_FAILED');
+      }
+    }
+  }
+  if (options.checkOnly) { return summary(false); }
+  const result = await (dependencies.login || tokenLogin)(options);
+  if (!result || result.ok === false || !result.access_token || !await verify(result, options)) {
+    throw failure('QWENWORK_LOGIN_FAILED');
+  }
+  return summary(true);
+}
+
+async function run(args, options = {}) {
+  const result = await ensureQwenWorkLogin({ ...options, checkOnly: args.includes('--check-only') });
+  if (args.includes('--json') && !args.includes('--quiet') && process.env.YIDA_QUIET !== '1') {
+    console.log(JSON.stringify(result));
+  }
+  if (!result.ok) { process.exitCode = 1; }
+  return result;
+}
+module.exports = { ensureQwenWorkLogin, run };

package/lib/auth/token-auth.js

@@ -175,6 +175,7 @@ function normalizeTokenResponse(response, baseUrl, clientId) {
   );
   return {
     auth_mode: 'token',
+    credential_source: data.credential_source,
     status: data.status || 'ok',
     can_auto_use: true,
     message: data.message || data.errorMsg || response.errorMsg,
@@ -486,7 +487,9 @@ async function tokenRefreshUnlocked(options, session) {
   // Token exchange follows the active environment endpoint, just like the
   // legacy login bootstrap. The response may return a different corp base_url
   // for business requests and generated application links.
-  const authBaseUrlValue = resolveTokenBaseUrl({
+  // 桌面会话沿用首次换票的可信 origin；刷新不受后续全局环境切换影响。
+  const desktopSession = session.credential_source === 'qwenwork_desktop';
+  const authBaseUrlValue = desktopSession ? session.base_url : resolveTokenBaseUrl({
     projectRoot: options.projectRoot,
     endpoint: options.endpoint,
   });
@@ -499,6 +502,9 @@ async function tokenRefreshUnlocked(options, session) {
   requireOkResponse(response);
   const data = getTokenPayload(response);
   const responseBusinessBaseUrl = data.base_url || data.baseUrl;
+  if (desktopSession && responseBusinessBaseUrl && normalizeBaseUrl(responseBusinessBaseUrl, null) !== session.base_url) {
+    throw createTokenAuthRequiredError('refresh_origin_mismatch');
+  }
   const businessBaseUrl = session.base_url || authBaseUrlValue;
   const normalized = normalizeTokenResponse({
     ...data,
@@ -507,6 +513,7 @@ async function tokenRefreshUnlocked(options, session) {
     user_id: data.user_id || data.userId || session.user_id,
     user_name: data.user_name || data.userName || session.user_name,
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
+    credential_source: data.credential_source || session.credential_source,
   }, businessBaseUrl, clientId);
   if (!normalized.access_token) {
     return {

package/lib/core/agent-capabilities.js

@@ -9,6 +9,7 @@ const { buildCommandManifest } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
 const coreUtils = require('./utils');
 const { buildHostAssetCapabilities } = require('../asset/host-capabilities');
+const { buildQwenWorkLoginInvocation } = require('./qwenwork-login-guidance');
 const { findProjectRoot, getAuthStatus } = coreUtils;
 
 function redactLogin(login) {
@@ -232,14 +233,15 @@ function buildAuthPath(login, env = process.env, runtime = null) {
   };
   // 桌面换票仅由当前活跃宿主和发行配置共同启用，不影响其他宿主的认证路径。
   if (localBeta?.desktopTicketLogin && runtime?.tool === 'qwenwork' && runtime?.subtype === 'qwenwork_desktop' && !envTokenSession) {
+    const invocation = buildQwenWorkLoginInvocation();
     authPath.auth_runtime = 'qwenwork_desktop_exchange_ticket';
-    authPath.interactive_login_allowed = false;
+    authPath.interactive_login_allowed = true;
     authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
     for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
     authPath.next_step = authPath.can_auto_use
-      ? 'Silently continue the requested business operation. Do not announce login or identity details.'
-      : 'Silently run standalone openyida login-qwenwork --json, then continue the requested business operation. Do not narrate login, add shell operators, start OAuth, or edit environment files.';
-    authPath.next_step_commands = authPath.can_auto_use ? [] : ['openyida login-qwenwork --json'];
+      ? 'Silently continue the requested business operation and report its business result.'
+      : `Run the recommended login command as returned: ${invocation.command}. No extra PATH or output setup is needed. After success silently continue the requested business operation. If it fails, follow the returned invocation guidance.`;
+    authPath.next_step_commands = authPath.can_auto_use ? [] : [invocation.command];
   }
   return authPath;
 }
@@ -247,9 +249,10 @@ function buildAuthPath(login, env = process.env, runtime = null) {
 function buildInteractiveLogin(auth, runtime) {
   if (auth.auth_runtime === 'qwenwork_desktop_exchange_ticket' && runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') {
     return {
-      mode: 'desktop_ticket', browser_default: 'not_required', browser_owner: 'none',
-      recommended_command: auth.can_auto_use ? null : 'openyida login-qwenwork --json',
-      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_standalone_login_qwenwork_and_wait',
+      mode: 'desktop_ticket', browser_default: 'not_required', browser_owner: 'cli_if_auth_required',
+      recommended_command: auth.can_auto_use ? null : buildQwenWorkLoginInvocation().command,
+      invocation: buildQwenWorkLoginInvocation(),
+      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_login_qwenwork_and_wait',
       user_visible: false, success_action: 'continue_business_command_without_message',
       reason: 'qwenwork_desktop_pre_beta', completion_signal: 'process_exit_and_final_json', playwright_required: false,
     };

package/lib/core/command-manifest.js

@@ -1140,11 +1140,11 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
+      command('login', ['login'], 'login [--qwenwork] [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
         requiresLogin: false,
         output: 'json',
       }),
-      command('login-qwenwork', ['login-qwenwork'], 'login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]', 'help.cmd_login_qwenwork', { managedRun: { scope: 'denied', reason: 'identity_exchange' }, requiresLogin: false, output: 'json' }),
+      command('login-qwenwork', ['login-qwenwork'], 'login-qwenwork --exchange-ticket <ticket> --ticket-context <json> [--json]', 'help.cmd_login_qwenwork', { managedRun: { scope: 'denied', reason: 'identity_exchange' }, requiresLogin: false, output: 'json', hidden: true }),
       command('logout', ['logout'], 'logout', 'help.cmd_logout', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
       command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] }, qwenwork: { scope: 'denied', reason: 'identity_exchange' } } }, requiresLogin: false }),
       command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),

package/lib/core/env-manager.js

@@ -24,7 +24,6 @@
 const fs = require('fs');
 const path = require('path');
 const { findProjectRoot } = require('./utils');
-const localBeta = require('../../package.json').openyidaLocalBeta;
 
 const DEFAULT_BASE_URL = 'https://www.aliwork.com';
 const DEFAULT_LOGIN_URL = 'https://www.aliwork.com/workPlatform';
@@ -108,7 +107,6 @@ const DEFAULT_INTERNATIONAL_ENV = {
 };
 
 const BUILTIN_ENVIRONMENTS = {
-  ...(localBeta ? { [localBeta.environment]: { baseUrl: localBeta.baseUrl, loginUrl: localBeta.baseUrl + '/workPlatform', description: localBeta.description } } : {}),
   public: DEFAULT_PUBLIC_ENV,
   intl: DEFAULT_INTERNATIONAL_ENV,
   alibaba: DEFAULT_ALIBABA_INTERNAL_ENV,
@@ -167,7 +165,7 @@ function cloneBuiltinEnvironments() {
 
 function buildDefaultEnvsConfig() {
   return {
-    current: localBeta?.environment || 'public',
+    current: 'public',
     environments: cloneBuiltinEnvironments(),
   };
 }

package/lib/core/locales/en.js

@@ -5,8 +5,10 @@
 
 module.exports = {
   qwenwork: {
+    login_check_failed: 'Unable to verify the login session. Please retry.',
     desktop_login_failed: 'QwenWork desktop login failed. Check the desktop identity and login handoff before retrying.',
-    desktop_login_usage: 'Usage: openyida login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]',
+    desktop_login_usage: 'Usage: openyida login --qwenwork [--json] [--check-only]',
+    desktop_login_standalone: 'Run the recommended login command directly: {0}. No extra PATH or output setup is needed. After success continue the business operation silently; on failure follow the returned guidance.',
     credential_missing: 'No cloud Agent credential is available. Run this command inside the QwenWork cloud execution environment.',
     gateway_missing: 'QWENWORK_GATEWAY_URL or MULE_GATEWAY_URL is required.',
     invalid_url: 'The QwenWork gateway must use HTTPS (HTTP is allowed only for loopback) and contain no credentials, query or fragment.',
@@ -491,7 +493,7 @@ Examples:
     save_permission_usage: 'Usage: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>] [--package-type <FORM_PACKAGE_VIEW|FORM_PACKAGE_START>]',
     save_permission_example: "Example: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ Execution failed: {0}',
-    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_usage: 'Usage: openyida login [--qwenwork] [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
     login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
     auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]',

package/lib/core/locales/zh.js

@@ -5,8 +5,10 @@
 
 module.exports = {
   qwenwork: {
+    login_check_failed: '登录状态暂时无法确认，请重试。',
     desktop_login_failed: '千问办公桌面免登失败，请确认桌面登录身份和免登通道后重试。',
-    desktop_login_usage: '用法：openyida login-qwenwork [--corp-id <corpId>] [--endpoint <url>] [--json]',
+    desktop_login_usage: '用法：openyida login --qwenwork [--json] [--check-only]',
+    desktop_login_standalone: '请直接执行推荐的登录命令：{0}。无需额外处理 PATH 和输出；成功后静默继续业务，失败时按提示修正调用。',
     credential_missing: '未发现云端 Agent 凭证，请在千问办公云端执行环境中运行此命令。',
     gateway_missing: '缺少 QWENWORK_GATEWAY_URL 或 MULE_GATEWAY_URL。',
     invalid_url: '千问网关必须使用 HTTPS（仅回环地址允许 HTTP），且不能包含账号密码、查询参数或片段。',
@@ -491,7 +493,7 @@ openyida - 宜搭命令行工具
     save_permission_usage: '用法: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>] [--package-type <FORM_PACKAGE_VIEW|FORM_PACKAGE_START>]',
     save_permission_example: "示例: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ 执行失败: {0}',
-    login_usage: '用法： openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_usage: '用法： openyida login [--qwenwork] [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
     login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；env token 模式下只读取 OPENYIDA_* token。',
     first_run_title: '  🤖 OpenYida - AI 问答模式已开启！                         ',

package/lib/core/qwenwork-login-guidance.js

@@ -0,0 +1,32 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** 从当前调用或同一安装前缀定位入口，不依赖模型重写 PATH。 */
+function resolveExecutable(invoked = process.argv[1], packageRoot = path.resolve(__dirname, '../..')) {
+  const usable = value => typeof value === 'string' && /^(?:\/|[a-z]:[\\/])/i.test(value)
+    && /^[\w./:\\-]+$/.test(value) && /^openyida(?:\.cmd|\.exe)?$/i.test(path.basename(value.replace(/\\/g, '/')));
+  if (usable(invoked)) { return invoked.replace(/\\/g, '/'); }
+  const candidates = [path.resolve(packageRoot, '../../../bin/openyida'), path.resolve(packageRoot, '../../openyida.cmd')];
+  for (const candidate of candidates) {
+    if (!usable(candidate) || !fs.existsSync(candidate)) { continue; }
+    try {
+      if (fs.realpathSync(candidate).startsWith(`${fs.realpathSync(packageRoot)}${path.sep}`)) { return candidate.replace(/\\/g, '/'); }
+    } catch { /* 不可用入口不扩展到其他安装目录。 */ }
+  }
+  return 'openyida';
+}
+
+function buildQwenWorkLoginInvocation(options = {}) {
+  const executable = resolveExecutable(options.executablePath, options.packageRoot);
+  return {
+    command: `${executable} login --qwenwork --json`,
+    required_runtime: { tool: 'qwenwork', subtype: 'qwenwork_desktop' },
+    execution: 'command',
+    preserve_command_verbatim: true,
+    output_visibility: 'internal',
+    success_next_step: 'continue_business_operation_silently',
+    failure_next_step: 'follow_returned_invocation_guidance',
+  };
+}
+module.exports = { buildQwenWorkLoginInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.10.23-beta.2",
+  "version": "2026.10.23-beta.4",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida-pre-beta.js",

package/yida-skills/references/qwenwork-desktop-login.md

@@ -1,33 +1,10 @@
-# 千问办公桌面端后台准备
+# 千问办公登录
 
-## 用户沟通
+仅在运行环境为千问办公桌面端时，使用 `openyida login --qwenwork`。
+优先使用能力摘要返回的当前版本入口；成功后静默继续用户请求的业务操作，只汇报业务结果。
 
-安装、版本核验、环境检查、自动登录和登录恢复均为内部准备，不加入用户可见的步骤、待办或完成总结，也不播报「免登成功」「正在换票」等状态。准备完成后直接继续用户请求的业务操作。
+客户端在执行公开登录命令前，内部调用 `login-qwenwork` 消费短期一次性票据并保存登录态。
+公开命令回查服务端，已有登录态可用则直接成功，失效时尝试 refresh token，确需重新授权时复用浏览器登录流程。
+网络错误不会触发浏览器登录。安装、认证准备、组织和用户标识不作为面向用户的业务结果。
 
-登录命令和能力快照的 JSON 仅用于内部判断。不向用户展示或解释认证方式、环境名、后端域名、用户 ID、组织 ID、profile、凭据路径、有效期和令牌，即使掩码后也不展示。最终只交付用户需要的业务结果、应用名称和应用访问链接；应用链接属于业务交付，可正常展示。
-
-仅在确实需要用户操作才能继续时，用一句普通语言说明阻塞和所需操作，不展开协议、接口、路径或内部错误细节。用户明确要求排障或查看认证信息时，再按其指定范围说明。
-
-## 安装与技能
-
-用户指定版本时先安装该版本，再做一次能力检查。镜像尚未同步时，直接使用官方 npm 源安装；短暂的下载 404 先重试核验，不据此断言包已损坏或擅自换成正式版。随包技能通过能力快照的 `builder_path.communication.bundled_skill_path` 定位，安装后优先读取该版本技能。
-
-配套技能复制是可选步骤。宿主技能目录写入受限时保留旧目录，CLI 安装继续完成，使用包内技能；不要求用户修改沙箱规则，不反复申请宿主目录权限。
-
-## 自动登录
-
-只以当前 `openyida agent-capabilities --summary-json` 的 `runtime.tool=qwenwork`、`runtime.subtype=qwenwork_desktop` 和 `builder_path.interactive_login.mode=desktop_ticket` 判断桌面换票能力。安装目录、产品名称和历史会话不能替代当前快照。
-
-快照显示登录可用时直接执行用户请求；登录不可用且上述条件全部成立时，单独执行下面一条命令，成功后直接继续业务操作：
-
-```bash
-openyida login-qwenwork --json
-```
-
-这条命令不拼接 `cd`、`env`、重定向、管道、`head`、`echo` 或任何其他 Shell 命令；执行工具已提供退出状态，无需追加输出。专用命令只消费本次私有通道的短期一次性兑换票，不调用或递归进入普通 `login`。
-
-真实宜搭凭据仅由 CLI 校验并持久化，不读取、填写或展示任何令牌、兑换票和认证文件。保持包内配置及实际认证 origin，不根据历史记忆猜测环境等价或切换到其他环境、组织。凭据过期时重新执行专用命令；票据缺失、过期、重放、签发或消费失败时停止，不回退 OAuth、直接凭据或手改环境文件。
-
-多组织确实需要用户选择时，仅询问完成业务操作所需的组织，不由模型猜测。其他宿主继续遵循原认证快照。
-
-用户只要求新建空白应用时，直接创建该应用，无需展开 PRD、表单、页面或主题设计。创建命令以当前版本契约为准，成功后只交付应用名称和访问链接。
+内部命令及其票据参数由客户端管理，模型无需了解或生成。