openyida 2026.10.27-beta.1 → 2026.10.27

package/README.md

@@ -143,27 +143,6 @@ openyida login --check-only --json
 openyida auth status
 ```
 
-In QwenWork web, `openyida login --qwenwork --json` (or ordinary `login`) sends the sandbox Agent Token and gateway origin directly to the selected YiDA authentication endpoint. YiDA validates the identity through the trusted gateway’s fixed `/api/agent-gw/yida/user_info` endpoint, then issues its own short-lived session. This login flow no longer calls the legacy exchange or `/user/info` endpoints. Login preparation stays silent; failures stop without browser OAuth. Desktop and other hosts retain their existing authentication paths.
-
-For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
-
-```bash
-openyida auth qwenwork user-info --json
-```
-
-This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
-
-Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.
-
-```js
-const { exchangeQwenWorkAgentToken, getQwenWorkUserInfo } = require('openyida/lib/auth/qwenwork-client');
-async function readCloudUser() {
-  const credential = await exchangeQwenWorkAgentToken();
-  // The result contains QwenWork identifiers, not YiDA IDs.
-  return getQwenWorkUserInfo(credential);
-}
-```
-
 To reuse an existing shared login profile for the current project, switch first instead of starting a new OAuth login:
 
 ```bash
@@ -478,9 +457,9 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [--qwenwork] [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
-| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch\|qwenwork user-info> [--json]` | Token login state and profile management |
+| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |
 | `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
@@ -494,6 +473,7 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | `openyida app-entry get <appType> [--json]` | Read frontend and management runtime entries |
 | `openyida app-entry set <appType> [--frontend <url>\|--frontend-page <formUuid>] [--management <url>\|--management-page <formUuid>] [--clear-frontend] [--clear-management] [--json]` | Register application entries with partial update and readback |
 | `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |
+| `openyida solution-template <search\|detail\|prepare\|ai-build\|enable\|status> [templateId\|requestId] [options] [--json]` | Solution templates for independent local agents: discovery, cloud AI handoff and direct enable |
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
 | `openyida design-plan catalog [--json]` | List available planning themes and page patterns |
@@ -537,6 +517,7 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | `openyida print-template <list\|inspect\|fields\|build\|create\|copy\|save\|restore\|settings\|status\|order\|render\|files> <appType> <formUuid> [templateId] [--config <file>] [--scene <order\|quotation\|delivery\|receipt\|approval\|codes>] [--bindings <file>] [--name <title>] [--expected-hash <hash>] [--backup <file>] [--out <file>] [--status START\|STOP] [--instance <id>] [--page <n>] [--size <n>] [--allow-permission-change] [--json] \| print-template <list\|render> --detail-url <url> [--template-id <id>] [--json]` | Manage native YiDA print templates, generate document layouts, back up, restore and request PDFs |
 | `openyida form-view <list\|inspect\|save\|create\|order> <appType> <formUuid> [viewUuid] [--config <file>] [--name <title>] [--with-config] [--expected-hash <hash>] [--backup <file>] [--replace] [--json]` | Native form views: list, inspect and configure columns, widths, frozen columns and filters |
 | `openyida custom-button <list\|inspect\|options\|create\|update\|delete> <appType> <formUuid> [buttonUuid] [--config <file>] [--expected-hash <hash>] [--backup <file>] [--yes] [--json]` | Native custom buttons: inspect and configure form edits, automation flows and page links |
+| `openyida form-message <list\|inspect\|options\|create\|update\|delete> <appType> <formUuid> [messageId] [--config <file>] [--expected-hash <hash>] [--backup <file>] [--yes] [--json]` | Native form notifications: inspect triggers, recipients and templates, then safely maintain bindings |
 | `openyida get-schema <appType> <formUuid\|--all> [--summary-json\|--field-map-json\|--analysis-json]` | Get one form Schema or all form Schemas |
 | `openyida check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]` | Check resources, frontend menu hiding and application theme delivery |
 | `openyida check-design <design.md> [--prd <prd.md>] [--base-dir <dir>] [--json]` | Validate design documents, theme tokens and PRD handoff |
@@ -554,7 +535,7 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | Command | Description |
 |---------|-------------|
 | `openyida data <query\|get\|create\|update\|transfer> <resource> ... \| delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]` | Unified data management (form/process/task/subform) |
-| `openyida task-center <todo\|created\|done\|cc\|proxy\|capabilities\|scaffold\|options\|inspect\|count> [--spec <file.json> --output <file.canvas.jsx>] [options]` | Global task center (todo/processed/cc etc.) |
+| `openyida task-center <todo\|created\|done\|cc\|proxy\|capabilities\|link\|scaffold\|options\|inspect\|count> [--spec <file.json> --output <file.canvas.jsx>] [options]` | Global task center (todo/processed/cc etc.) |
 | `openyida basic-info <overview\|commodity\|grant\|capacity\|quota\|abs-path\|dataflow\|i18n\|domain>` | Query organization basic info, capacity, quotas, and domain settings |
 | `openyida read-dingtalk-doc <docUrl> [--output <file>] [--json]` | Fetch Markdown content from a DingTalk document |
 | `openyida read-dingtalk-tingji <taskUuid> [--json]` | Fetch DingTalk Tingji details by task UUID |

package/bin/yida.js

@@ -588,29 +588,17 @@ async function main() {
     }
     return;
   }
+  // Template-only preflight; managed runs retain their existing guard contract.
+  if (command === 'solution-template' && !hasHelpFlag(rawArgs) && !readManagedContext()) {
+    require('../lib/solution-template/solution-template').assertIndependentLocalAgent();
+  }
   commandReceipt = beginCommandReceipt({ command, args: rawArgs });
   process.once('exit', code => {
     try {commandReceipt.finish(code);} catch {process.exitCode = 1;}
   });
   assertManagedInvocation(command, rawArgs);
   applyQuietFlag();
-  // 一次性票据只在当前进程消费，不能先自更新并重启命令。
-  switch (command) {
-    case 'login-qwenwork':
-      await require('../lib/auth/qwenwork-desktop').run(args);
-      return;
-  }
   applyGlobalEnvironmentFlags();
-  // 网页态由 CLI 消费宿主凭据；桌面态继续消费宿主准备的登录态。
-  const webLogin = (command === 'login' || (command === 'auth' && args[0] === 'login')) &&
-    require('../lib/core/qwenwork-login-guidance').isQwenWorkWebRuntime(require('../lib/core/utils').detectRuntimeCapabilities());
-  if ((command === 'login' && args.includes('--qwenwork')) || webLogin) {
-    const loginArgs = applyLoginEnvironmentFlags(command === 'auth' ? args.slice(1) : args, { inferTargetUrl: true });
-    if (hasHelpFlag(loginArgs)) { printLoginHelp(); return; }
-    assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
-    await require('../lib/auth/qwenwork-login').run(loginArgs, buildTokenLoginOptions(loginArgs));
-    return;
-  }
 
   const { maybeAutoUpdate } = require('../lib/core/update');
   const updateResult = await maybeAutoUpdate({
@@ -730,10 +718,6 @@ async function main() {
 
     case 'auth': {
       const subCommand = args[0];
-      if (subCommand === 'qwenwork') {
-        await require('../lib/auth/qwenwork').run(args.slice(1));
-        break;
-      }
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
       const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
@@ -810,6 +794,12 @@ async function main() {
       break;
     }
 
+    case 'solution-template': {
+      const { run } = require('../lib/solution-template/solution-template');
+      await run(args);
+      break;
+    }
+
     case 'corp-efficiency': {
       const { run } = require('../lib/corp-efficiency/corp-efficiency');
       await run(args);
@@ -857,6 +847,11 @@ async function main() {
       await run(args);
       break;
     }
+    case 'form-message': {
+      const { run } = require('../lib/app/form-message');
+      await run(args);
+      break;
+    }
     case 'print-template': {
       const { run } = require('../lib/print-template/print-template');
       await run(args);

package/lib/app/form-message.js

@@ -0,0 +1,352 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { isDeepStrictEqual } = require('util');
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+const { resolveProjectRoot } = require('../core/utils');
+const { createYidaClient } = require('../core/yida-client');
+
+const ACTIONS = ['list', 'inspect', 'options', 'create', 'update', 'delete'];
+const RECEIVER_TYPES = new Set(['employee', 'role', 'formField', 'variable']);
+const FORM_TRIGGERS = new Set(['FORM_DATA_CREATE', 'FORM_DATA_EDIT', 'FORM_DATA_DELETE', 'FORM_COMMENT']);
+const SYSTEM_VARIABLES = new Set(['originator']);
+const MESSAGE_FIELD_COMPONENTS = new Set([
+  'TextareaField', 'EmployeeField', 'SelectField', 'MultiSelectField', 'DateField', 'TextField',
+  'RadioField', 'NumberField', 'CheckboxField', 'RateField', 'CascadeDateField', 'DepartmentSelectField',
+]);
+const RECIPIENT_FIELD_COMPONENTS = new Set(['EmployeeField']);
+const ID = /^[A-Za-z0-9_-]+$/;
+const TEMPLATES = Object.freeze({
+  workNotice: { uuid: 'system_default_work_notice', type: 'workNotice', content: true, target: 'person' },
+  detailImage: { uuid: '8fbf8a81-c775-4570-b367-86d4d719a85f', type: 'card', fields: true, target: 'person' },
+  imageCard: { uuid: '39caf717-df43-46e1-98f9-564fdd1dc789', type: 'card', content: true, target: 'person' },
+  detailText: { uuid: '97bd36d0-64d8-4c50-96e8-f02312655700', type: 'card', fields: true, target: 'person' },
+  commentCard: { uuid: 'c298cd88-0de6-44c3-9023-c93e0d7db9ac', type: 'card', content: true, target: 'person' },
+  pinnedImage: { uuid: 'cdcdf076-3625-4da7-9a61-571591594209', type: 'ceilingCard', content: true, target: 'group' },
+  pinnedText: { uuid: '68240de5-8d9e-416a-b5b2-c71dca0ab703', type: 'ceilingCard', content: true, target: 'group' },
+});
+const TEMPLATE_BY_UUID = new Map(Object.entries(TEMPLATES).map(([key, item]) => [item.uuid, { key, ...item }]));
+
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const clone = value => JSON.parse(JSON.stringify(value));
+
+/** Build a stable fingerprint for concurrency checks and destructive actions. */
+function hash(value) {
+  const stable = item => Array.isArray(item) ? item.map(stable) : object(item)
+    ? Object.fromEntries(Object.keys(item).sort().map(key => [key, stable(item[key])])) : item;
+  return crypto.createHash('sha256').update(JSON.stringify(stable(value))).digest('hex');
+}
+
+function fail(code, key, detail = '', details) {
+  throw new CliError(t(`form_message.${key}`, detail), { code: `FORM_MESSAGE_${code}`, details });
+}
+
+function safe(value) {
+  if (!value || typeof value !== 'object') {return;}
+  for (const key of Object.keys(value)) {
+    if (['__proto__', 'prototype', 'constructor'].includes(key)) {fail('INVALID_CONFIG', 'invalid_config', key);}
+    safe(value[key]);
+  }
+}
+
+function parseJson(value, label) {
+  try { return typeof value === 'string' ? JSON.parse(value) : value; }
+  catch (_) { return fail('INVALID_CONFIG', 'invalid_config', label); }
+}
+
+function unwrap(response, endpoint) {
+  if (!response || response.success !== true || response.__needLogin || response.__csrfExpired || response.content === false) {
+    fail('API_ERROR', 'api_error', response?.errorMsg || response?.message || endpoint, {
+      endpoint, platformErrorCode: response?.errorCode || null, needLogin: !!response?.__needLogin,
+    });
+  }
+  return response.content;
+}
+
+/** Normalize a native binding while retaining fields required for lossless backup and update. */
+function normalize(raw) {
+  if (!object(raw) || raw.id === undefined || raw.id === null || !String(raw.id).trim()) {
+    fail('INVALID_RESPONSE', 'invalid_response', 'id');
+  }
+  const cardConfig = raw.cardConfig ? parseJson(raw.cardConfig, 'cardConfig') : {};
+  if (!object(cardConfig)) {fail('INVALID_RESPONSE', 'invalid_response', 'cardConfig');}
+  const recipients = [];
+  const add = (source, type) => String(source || '').split(',').map(value => value.trim()).filter(Boolean)
+    .forEach(value => recipients.push({ type, value }));
+  add(raw.persons, 'employee'); add(raw.roleId, 'role'); add(raw.formField, 'formField'); add(raw.variable, 'variable');
+  const nativeGroups = Array.isArray(cardConfig.groups) ? clone(cardConfig.groups) : [];
+  const template = TEMPLATE_BY_UUID.get(cardConfig.templateUuid) || {};
+  const buttons = Array.isArray(cardConfig.buttons) ? clone(cardConfig.buttons) : [];
+  return {
+    id: String(raw.id),
+    formUuid: raw.formUuid || null,
+    trigger: raw.phase || null,
+    messageType: raw.messageType || 'NORMAL',
+    recipients,
+    groups: nativeGroups,
+    template: {
+      key: template.key || null,
+      uuid: cardConfig.templateUuid || raw.messageUuid || null,
+      type: cardConfig.templateType || template.type || null,
+      title: cardConfig.cardTitle || '',
+      content: cardConfig.mainContent || '',
+      fields: Array.isArray(cardConfig.datas) ? clone(cardConfig.datas) : [],
+      image: Array.isArray(cardConfig.messageImage) ? clone(cardConfig.messageImage) : [],
+      contentType: cardConfig.messageContentType || (raw.messageUuid ? 'TEMPLATE' : 'CUSTOM'),
+      platformTemplateUuid: raw.messageUuid && !String(raw.messageUuid).includes('#') ? raw.messageUuid : null,
+      button: buttons[0] || null,
+    },
+    advanced: {
+      openMore: !!cardConfig.openMore,
+      activityIds: String(raw.activityId || '').split(',').filter(Boolean),
+      condition: raw.conditionJson ? parseJson(raw.conditionJson, 'conditionJson') : null,
+      processId: raw.processId || null,
+      outcome: String(raw.outResult || '').split(',').filter(Boolean),
+      currentGroup: raw.curDingGroup === 'y',
+      sendWorkNotice: raw.isSendMessage === 'y',
+    },
+    native: clone(raw),
+  };
+}
+
+function parseArgs(args) {
+  const positional = [];
+  const flags = {};
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (Object.hasOwn(flags, arg)) {fail('USAGE', 'usage');}
+    if (['--json', '--yes', '--help', '-h'].includes(arg)) { flags[arg] = true; continue; }
+    if (['--config', '--backup', '--expected-hash'].includes(arg)) {
+      if (!args[i + 1] || args[i + 1].startsWith('-')) {fail('USAGE', 'usage');}
+      flags[arg] = args[++i]; continue;
+    }
+    if (arg.startsWith('-')) {fail('USAGE', 'usage');}
+    positional.push(arg);
+  }
+  if (flags['--help'] || flags['-h']) {return { help: true };}
+  const [action, appType, formUuid, messageId] = positional;
+  const targeted = ['inspect', 'update', 'delete'].includes(action);
+  if (!ACTIONS.includes(action) || positional.length !== (targeted ? 4 : 3)
+    || !ID.test(appType || '') || !ID.test(formUuid || '') || (targeted && !ID.test(messageId || ''))
+    || (['create', 'update'].includes(action) && !flags['--config'])
+    || (action === 'delete' && (!flags['--yes'] || !flags['--expected-hash']))) {fail('USAGE', 'usage');}
+  const allowed = { list: [], inspect: [], options: [], create: ['--config', '--backup'],
+    update: ['--config', '--backup', '--expected-hash'], delete: ['--yes', '--backup', '--expected-hash'] };
+  if (Object.keys(flags).some(key => key !== '--json' && !allowed[action].includes(key))) {fail('USAGE', 'usage');}
+  return { action, appType, formUuid, messageId, flags };
+}
+
+function fieldId(field) { return field.fieldId || field.id || field.componentId; }
+function fieldType(field) { return field.componentName || field.fieldType || field.type; }
+
+function normalizeTemplate(value) {
+  if (!object(value)) {fail('INVALID_CONFIG', 'invalid_config', 'template');}
+  const registry = value.key ? TEMPLATES[value.key] : TEMPLATE_BY_UUID.get(value.uuid);
+  if (!registry || (value.uuid && value.uuid !== registry.uuid) || (value.type && value.type !== registry.type)) {
+    fail('INVALID_CONFIG', 'invalid_config', 'template.key / template.uuid / template.type');
+  }
+  const result = { ...value, key: value.key || TEMPLATE_BY_UUID.get(registry.uuid).key,
+    uuid: registry.uuid, type: registry.type };
+  result.title = String(result.title || '').trim();
+  result.content = String(result.content || '').trim();
+  result.fields = result.fields || [];
+  result.image = result.image || [];
+  result.contentType = 'CUSTOM';
+  result.platformTemplateUuid = null;
+  result.button = result.button || null;
+  if (!result.title || result.title.replace(/\$!\{\w+\}/g, '').length > 50) {fail('INVALID_CONFIG', 'invalid_config', 'template.title');}
+  if (registry.content && !result.content) {fail('INVALID_CONFIG', 'invalid_config', 'template.content');}
+  if (registry.fields && (!Array.isArray(result.fields) || !result.fields.length)) {fail('INVALID_CONFIG', 'invalid_config', 'template.fields');}
+  if (!Array.isArray(result.fields) || !Array.isArray(result.image)) {fail('INVALID_CONFIG', 'invalid_config', 'template.fields / template.image');}
+  if (result.button !== undefined && result.button !== null) {
+    if (!object(result.button) || typeof result.button.name !== 'string'
+      || !['formInstDetail', 'comment', 'custom'].includes(result.button.type)) {fail('INVALID_CONFIG', 'invalid_config', 'template.button');}
+    if (result.button.type === 'custom') {
+      let url; try { url = new URL(result.button.value); } catch (_) { fail('INVALID_CONFIG', 'invalid_config', 'template.button.value'); }
+      if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password) {fail('INVALID_CONFIG', 'invalid_config', 'template.button.value');}
+    }
+  }
+  return { result, registry };
+}
+
+/** Validate references against the target form metadata before a mutation. */
+function validateConfig(value, metadata) {
+  if (!object(value) || !FORM_TRIGGERS.has(value.trigger)) {
+    fail('UNSUPPORTED_TRIGGER', 'unsupported_trigger', value?.trigger || '');
+  }
+  const formType = metadata.form.formType;
+  if (formType === 'process') {fail('UNSUPPORTED_FORM', 'unsupported_form', formType);}
+  const { result: template, registry } = normalizeTemplate(value.template);
+  const recipients = value.recipients || [];
+  const groups = value.groups || [];
+  if (!Array.isArray(recipients) || !Array.isArray(groups)) {fail('INVALID_CONFIG', 'invalid_config', 'recipients / groups');}
+  if (registry.target === 'person' && !recipients.length) {fail('INVALID_CONFIG', 'invalid_config', 'recipients');}
+  if (registry.target === 'group' && !groups.length) {fail('INVALID_CONFIG', 'invalid_config', 'groups');}
+  if (recipients.length > 100) {fail('INVALID_CONFIG', 'invalid_config', 'recipients (max 100)');}
+  const seen = new Set();
+  for (const receiver of recipients) {
+    if (!object(receiver) || !RECEIVER_TYPES.has(receiver.type) || !ID.test(String(receiver.value || ''))
+      || seen.has(`${receiver.type}:${receiver.value}`)) {fail('INVALID_CONFIG', 'invalid_config', 'recipients');}
+    seen.add(`${receiver.type}:${receiver.value}`);
+    if (receiver.type === 'variable' && !SYSTEM_VARIABLES.has(receiver.value)) {fail('INVALID_CONFIG', 'invalid_config', `recipient variable: ${receiver.value}`);}
+    if (receiver.type === 'formField' && !metadata.recipientFields.some(field => fieldId(field) === receiver.value)) {
+      fail('INVALID_CONFIG', 'invalid_config', `recipient field: ${receiver.value}`);
+    }
+  }
+  for (const group of groups) {
+    if (!object(group) || !ID.test(String(group.cid || group.id || ''))) {fail('INVALID_CONFIG', 'invalid_config', 'groups');}
+  }
+  for (const item of template.fields) {
+    if (!object(item) || !['variable', 'formField'].includes(item.type) || typeof item.title !== 'string' || !item.title.trim()
+      || !ID.test(String(item.value || ''))) {fail('INVALID_CONFIG', 'invalid_config', 'template.fields');}
+    if (item.type === 'variable' && !metadata.systemFields.some(field => field.value === item.value)) {
+      fail('INVALID_CONFIG', 'invalid_config', `template variable: ${item.value}`);
+    }
+    if (item.type === 'formField' && !metadata.messageFields.some(field => fieldId(field) === item.value)) {
+      fail('INVALID_CONFIG', 'invalid_config', `template field: ${item.value}`);
+    }
+  }
+  return { trigger: value.trigger, recipients: clone(recipients), groups: clone(groups), template };
+}
+
+function patchConfig(base, patch) {
+  if (!object(patch) || !Object.keys(patch).length || Object.keys(patch).some(key => !['trigger', 'recipients', 'groups', 'template'].includes(key))) {
+    fail('INVALID_CONFIG', 'invalid_config', 'trigger, recipients, groups, template');
+  }
+  safe(patch);
+  const next = { ...base, ...patch };
+  if (patch.template) {next.template = { ...base.template, ...patch.template };}
+  return next;
+}
+
+function editable(message) {
+  return { trigger: message.trigger, recipients: clone(message.recipients), groups: clone(message.groups), template: clone(message.template) };
+}
+
+function serialize(config, formUuid, messageId, native = {}) {
+  const byType = type => config.recipients.filter(item => item.type === type).map(item => item.value).join(',');
+  const registered = config.template.key ? TEMPLATES[config.template.key] : TEMPLATE_BY_UUID.get(config.template.uuid);
+  const nativeCardConfig = native.cardConfig ? parseJson(native.cardConfig, 'cardConfig') : {};
+  const cardConfig = {
+    ...nativeCardConfig,
+    openMore: false,
+    groups: config.groups,
+    messageImage: config.template.image,
+    cardTitle: config.template.title,
+    mainContent: config.template.content,
+    datas: config.template.fields,
+    templateUuid: config.template.uuid || registered.uuid,
+    templateType: config.template.type || registered.type,
+    messageContentType: 'CUSTOM',
+    buttons: config.template.button ? [config.template.button] : [],
+  };
+  return {
+    ...clone(native),
+    service: native.service || '', formUuid, phase: config.trigger, outResult: native.outResult || '',
+    formField: byType('formField'), studentField: native.studentField || '', roleId: byType('role'),
+    persons: byType('employee'), varField: native.varField || '', messageUuid: '', id: messageId || '',
+    variable: byType('variable'), email: native.email || '', formFieldEmail: native.formFieldEmail || '',
+    activityId: native.activityId || '', messageType: native.messageType || 'NORMAL',
+    curDingGroup: native.curDingGroup || 'n', isSendMessage: native.isSendMessage || 'n',
+    processId: native.processId || '', conditionJson: native.conditionJson || '', cardConfig: JSON.stringify(cardConfig),
+  };
+}
+
+async function execute(parsed, client = createYidaClient()) {
+  const { action, appType, formUuid, messageId, flags } = parsed;
+  const prefix = `/${appType}/query/`;
+  const read = async (endpoint, params = {}) => unwrap(await client.get(prefix + endpoint, { formUuid, ...params }), endpoint);
+  const list = async () => {
+    const rows = await read('formMsgTpl/listFormMessageBind.json');
+    if (!Array.isArray(rows)) {fail('INVALID_RESPONSE', 'invalid_response', 'messages');}
+    const messages = rows.map(normalize);
+    if (messages.some(item => item.formUuid && item.formUuid !== formUuid)
+      || new Set(messages.map(item => item.id)).size !== messages.length) {fail('INVALID_RESPONSE', 'invalid_response', 'messages');}
+    return messages;
+  };
+  const metadata = async () => {
+    const info = await read('formdesign/getFormAndAppInfo.json', { appType });
+    const form = info?.formDatas?.values?.find(item => item.formUuid === formUuid);
+    if (!form || !Array.isArray(form.fields)) {fail('INVALID_RESPONSE', 'invalid_response', 'form metadata');}
+    const fields = form.fields;
+    return {
+      form: { formUuid, formType: form.formType, title: form.title, processCode: form.processCode || null },
+      triggers: [...FORM_TRIGGERS],
+      readOnlyTriggers: ['RECUR_JOB_FIELD', 'INST_START', 'INST_COMPLETE', 'INST_NODE', 'TASK_GENERATE', 'TASK_COMPLETED'],
+      templates: Object.entries(TEMPLATES).map(([key, item]) => ({ key, ...item })),
+      systemFields: [
+        { value: 'formInstId', componentName: 'TextField' }, { value: 'originatorName', componentName: 'TextField' },
+        { value: 'originator', componentName: 'TextField' }, { value: 'createTime', componentName: 'DateField' },
+        { value: 'modifiedTime', componentName: 'DateField' }, { value: 'serialNo', componentName: 'TextField' },
+        { value: 'formTitle', componentName: 'TextField' }, { value: 'title', componentName: 'TextField' },
+      ],
+      messageFields: fields.filter(field => MESSAGE_FIELD_COMPONENTS.has(fieldType(field))),
+      recipientFields: fields.filter(field => RECIPIENT_FIELD_COMPONENTS.has(fieldType(field))),
+      recipientVariables: [...SYSTEM_VARIABLES],
+      supportsToggle: false,
+    };
+  };
+  // Link to the form's native notification settings in the authenticated environment.
+  const configUrl = new URL(`/${appType}/admin/${formUuid}/settings/messageSetting`, client.getAuthRef().baseUrl).href;
+  const output = { success: true, action, appType, formUuid, configUrl };
+  if (action === 'options') {return { ...output, options: await metadata() };}
+  const beforeList = await list();
+  const before = messageId ? beforeList.find(item => item.id === messageId) : null;
+  if (messageId && !before) {fail('NOT_FOUND', 'not_found', messageId);}
+  if (action === 'list') {return { ...output, messages: beforeList, totalCount: beforeList.length, supportsToggle: false };}
+  if (action === 'inspect') {return { ...output, messageId, message: before, configHash: hash(editable(before)), supportsToggle: false };}
+  if (flags['--expected-hash'] && flags['--expected-hash'] !== hash(editable(before))) {fail('CONFLICT', 'conflict');}
+
+  let expected;
+  if (action !== 'delete') {
+    let patch;
+    try { patch = parseJson(fs.readFileSync(path.resolve(flags['--config']), 'utf8'), 'config'); }
+    catch (error) { if (error instanceof CliError) {throw error;} fail('INVALID_CONFIG', 'invalid_config', 'config file'); }
+    const defaults = { trigger: 'FORM_DATA_CREATE', recipients: [{ type: 'variable', value: 'originator' }], groups: [],
+      template: { key: 'workNotice', title: '', content: '', fields: [], image: [], button: null } };
+    expected = validateConfig(patchConfig(before ? editable(before) : defaults, patch), await metadata());
+    if (before && isDeepStrictEqual(editable(before), expected)) {
+      return { ...output, messageId, changed: false, message: before, configHash: hash(expected), readbackVerified: true };
+    }
+  }
+  const snapshot = beforeList.map(item => [item.id, hash(item.native)]);
+  if (!isDeepStrictEqual(snapshot, (await list()).map(item => [item.id, hash(item.native)]))) {fail('CONFLICT', 'conflict');}
+  const backupPath = flags['--backup'] ? path.resolve(flags['--backup']) : path.join(resolveProjectRoot().projectRoot,
+    '.cache', 'openyida', 'form-message', `${Date.now()}-${crypto.randomUUID()}.json`);
+  fs.mkdirSync(path.dirname(backupPath), { recursive: true });
+  fs.writeFileSync(backupPath, JSON.stringify({ appType, formUuid, action, messages: beforeList }, null, 2), { flag: 'wx', mode: 0o600 });
+  const details = { target: { appType, formUuid, ...(messageId ? { messageId } : {}) }, backupPath,
+    retrySafe: false, sideEffectState: 'unknown', readbackAllowed: true };
+  const endpoint = action === 'delete' ? 'formMsgTpl/removeMessageBind.json' : 'formMsgTpl/saveOrUpdateMessageBind.json';
+  const params = action === 'delete' ? { id: messageId } : serialize(expected, formUuid, messageId, before?.native);
+  try { unwrap(await client.postFormOnce(prefix + endpoint, params), endpoint); }
+  catch (error) { throw new CliError(error.message, { code: error.code || 'FORM_MESSAGE_WRITE_FAILED', details: { ...error.details, ...details } }); }
+  try {
+    const after = await list();
+    if (action === 'delete') {
+      if (after.some(item => item.id === messageId)) {fail('READBACK_MISMATCH', 'readback_mismatch');}
+      return { ...output, messageId, changed: true, backupPath, readbackVerified: true };
+    }
+    const added = after.filter(item => !beforeList.some(old => old.id === item.id));
+    const saved = action === 'create' ? (added.length === 1 ? added[0] : null) : after.find(item => item.id === messageId);
+    if (!saved || !isDeepStrictEqual(editable(saved), expected)) {fail('READBACK_MISMATCH', 'readback_mismatch');}
+    return { ...output, messageId: saved.id, changed: true, backupPath, readbackVerified: true,
+      message: saved, configHash: hash(expected) };
+  } catch (error) {
+    throw new CliError(error.message, { code: error.code || 'FORM_MESSAGE_READBACK_FAILED',
+      details: { ...details, mutationAccepted: true, sideEffectState: 'accepted_unverified' } });
+  }
+}
+
+async function run(args, options = {}) {
+  const parsed = parseArgs(args);
+  if (parsed.help) { process.stdout.write(t('form_message.usage') + '\n'); return; }
+  const result = await execute(parsed, options.client);
+  process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+  return result;
+}
+
+module.exports = { ACTIONS, TEMPLATES, run, execute, parseArgs, normalize, validateConfig, patchConfig, serialize, hash, editable };

package/lib/app/services/canvas-page-schema-builder.js

@@ -10,7 +10,16 @@ const {
   findEmojiInValue,
 } = require('../../core/no-emoji-detector');
 
-const CANVAS_YIDA_API_BRIDGE_SOURCE = `var OPENYIDA_YIDA_FORM_API_METHODS = [
+const { createPageNavigation } = require('../../navigation/page-navigation');
+const { createTaskCenterContract } = require('../../task-center/contract');
+const { createTaskCenterLoader } = require('../../task-center/loader');
+const { createTaskCenterNavigation } = require('../../task-center/navigation');
+
+const CANVAS_YIDA_API_BRIDGE_SOURCE = `${createPageNavigation.toString()}
+${createTaskCenterNavigation.toString()}
+${createTaskCenterContract.toString()}
+${createTaskCenterLoader.toString()}
+var OPENYIDA_YIDA_FORM_API_METHODS = [
   'saveFormData',
   'updateFormData',
   'searchFormDataIds',
@@ -239,8 +248,15 @@ function openyidaCreateRouterBridge(utils) {
 
 function openyidaCreateUtilsBridge(context, yidaBridge) {
   var utils = context && context.utils;
+  var navigation = createPageNavigation(window);
+  var taskNavigation = createTaskCenterNavigation();
+  var taskCounts = createTaskCenterLoader(createTaskCenterContract(), function() { return yidaBridge; });
   var methodNames = openyidaCollectUtilsMethodNames(utils);
   function invoke(methodName) {
+    if (methodName === 'openPage') { return navigation.open.apply(null, Array.prototype.slice.call(arguments, 1)); }
+    if (['taskCenterCount', 'taskCenterLink', 'openTaskCenter'].indexOf(methodName) !== -1) {
+      return bridge[methodName].apply(null, Array.prototype.slice.call(arguments, 1));
+    }
     if (!utils || typeof utils[methodName] !== 'function') {
       throw new Error('this.utils.' + methodName + ' is not available');
     }
@@ -251,6 +267,8 @@ function openyidaCreateUtilsBridge(context, yidaBridge) {
     apiGroups: {
       utility: OPENYIDA_UTIL_API_METHODS.slice(),
       router: ['push'],
+      navigation: ['openPage', 'taskCenterLink', 'openTaskCenter'],
+      tasks: ['taskCenterCount'],
       yida: OPENYIDA_KNOWN_YIDA_API_METHODS.slice()
     },
     knownMethods: OPENYIDA_UTIL_API_METHODS.slice(),
@@ -259,9 +277,33 @@ function openyidaCreateUtilsBridge(context, yidaBridge) {
       return !utils || typeof utils[methodName] !== 'function';
     }),
     invoke: invoke,
+    openPage: navigation.open,
+    taskCenterLink: function(options) {
+      return taskNavigation.target(Object.assign({ baseUrl: window.location.origin }, options));
+    },
+    taskCenterCount: async function(options) {
+      if (!options || typeof options !== 'object' || Array.isArray(options)
+        || Object.keys(options).some(function(key) { return ['scope', 'appType', 'kind', 'filters'].indexOf(key) === -1; })) {
+        var error = new Error('TASK_FILTER_INVALID: options');
+        error.code = 'TASK_FILTER_INVALID';
+        throw error;
+      }
+      var target = taskNavigation.target({ scope: options.scope, appType: options.appType, kind: options.kind, baseUrl: window.location.origin });
+      var filters = createTaskCenterContract().normalizeFilters(target.kind, options.filters === undefined ? {} : options.filters, 'app-query');
+      return taskCounts.count(target.kind, Object.assign({}, filters, { transport: 'app-query' },
+        target.scope === 'corp' ? { scope: 'corp' } : { appType: target.appType }));
+    },
+    openTaskCenter: function(options) {
+      var target = taskNavigation.target(Object.assign({ baseUrl: window.location.origin }, options));
+      return navigation.open(target.pageUrl, { mode: target.mode });
+    },
     router: openyidaCreateRouterBridge(utils),
     yida: yidaBridge
   };
+  ['openPage', 'taskCenterLink', 'openTaskCenter', 'taskCenterCount'].forEach(function(methodName) {
+    if (bridge.availableMethods.indexOf(methodName) === -1) { bridge.availableMethods.push(methodName); }
+  });
+  bridge.missingKnownMethods = bridge.missingKnownMethods.filter(function(name) { return name !== 'openPage'; });
   methodNames.forEach(function(methodName) {
     if (!bridge[methodName]) {
       bridge[methodName] = function() {

package/lib/auth/token-auth.js

@@ -175,7 +175,6 @@ function normalizeTokenResponse(response, baseUrl, clientId) {
   );
   return {
     auth_mode: 'token',
-    credential_source: data.credential_source,
     status: data.status || 'ok',
     can_auto_use: true,
     message: data.message || data.errorMsg || response.errorMsg,
@@ -487,9 +486,7 @@ async function tokenRefreshUnlocked(options, session) {
   // Token exchange follows the active environment endpoint, just like the
   // legacy login bootstrap. The response may return a different corp base_url
   // for business requests and generated application links.
-  // 桌面会话沿用首次换票的可信 origin；刷新不受后续全局环境切换影响。
-  const desktopSession = session.credential_source === 'qwenwork_desktop';
-  const authBaseUrlValue = desktopSession ? session.base_url : resolveTokenBaseUrl({
+  const authBaseUrlValue = resolveTokenBaseUrl({
     projectRoot: options.projectRoot,
     endpoint: options.endpoint,
   });
@@ -502,13 +499,6 @@ async function tokenRefreshUnlocked(options, session) {
   requireOkResponse(response);
   const data = getTokenPayload(response);
   const responseBusinessBaseUrl = data.base_url || data.baseUrl;
-  if (desktopSession && responseBusinessBaseUrl !== undefined) {
-    try {
-      const value = new URL(responseBusinessBaseUrl);
-      if (typeof responseBusinessBaseUrl !== 'string' || responseBusinessBaseUrl.length > 2048 || /\s/.test(responseBusinessBaseUrl) ||
-        value.protocol !== 'https:' || value.username || value.password || value.pathname !== '/' || value.search || value.hash) { throw new Error(); }
-    } catch { throw createTokenAuthRequiredError('refresh_origin_mismatch'); }
-  }
   const businessBaseUrl = session.base_url || authBaseUrlValue;
   const normalized = normalizeTokenResponse({
     ...data,
@@ -517,7 +507,6 @@ async function tokenRefreshUnlocked(options, session) {
     user_id: data.user_id || data.userId || session.user_id,
     user_name: data.user_name || data.userName || session.user_name,
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
-    credential_source: data.credential_source || session.credential_source,
   }, businessBaseUrl, clientId);
   if (!normalized.access_token) {
     return {

package/lib/auth/token-store.js

@@ -276,7 +276,6 @@ function normalizeTokenSession(session = {}) {
   );
   const normalized = {
     auth_mode: 'token',
-    credential_source: session.credential_source,
     token_type: session.token_type || session.tokenType || 'Bearer',
     access_token: session.access_token || session.accessToken,
     refresh_token: session.refresh_token || session.refreshToken,