openyida 2026.10.28-beta.2 → 2026.10.28

package/README.md

@@ -143,27 +143,6 @@ openyida login --check-only --json
 openyida auth status
 ```
 
-In QwenWork web, `openyida login --qwenwork --json` (or ordinary `login`) sends the sandbox Agent Token and gateway origin directly to the selected YiDA authentication endpoint. YiDA validates the identity through the trusted gateway’s fixed `/api/agent-gw/yida/user_info` endpoint, then issues its own short-lived session. This login flow no longer calls the legacy exchange or `/user/info` endpoints. Login preparation stays silent; failures stop without browser OAuth. Desktop and other hosts retain their existing authentication paths.
-
-For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
-
-```bash
-openyida auth qwenwork user-info --json
-```
-
-This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
-
-Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.
-
-```js
-const { exchangeQwenWorkAgentToken, getQwenWorkUserInfo } = require('openyida/lib/auth/qwenwork-client');
-async function readCloudUser() {
-  const credential = await exchangeQwenWorkAgentToken();
-  // The result contains QwenWork identifiers, not YiDA IDs.
-  return getQwenWorkUserInfo(credential);
-}
-```
-
 To reuse an existing shared login profile for the current project, switch first instead of starting a new OAuth login:
 
 ```bash
@@ -478,9 +457,9 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [--qwenwork] [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
-| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch\|qwenwork user-info> [--json]` | Token login state and profile management |
+| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |
 | `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 

package/bin/yida.js

@@ -598,23 +598,7 @@ async function main() {
   });
   assertManagedInvocation(command, rawArgs);
   applyQuietFlag();
-  // 一次性票据只在当前进程消费，不能先自更新并重启命令。
-  switch (command) {
-    case 'login-qwenwork':
-      await require('../lib/auth/qwenwork-desktop').run(args);
-      return;
-  }
   applyGlobalEnvironmentFlags();
-  // 网页态由 CLI 消费宿主凭据；桌面态继续消费宿主准备的登录态。
-  const webLogin = (command === 'login' || (command === 'auth' && args[0] === 'login')) &&
-    require('../lib/core/qwenwork-login-guidance').isQwenWorkWebRuntime(require('../lib/core/utils').detectRuntimeCapabilities());
-  if ((command === 'login' && args.includes('--qwenwork')) || webLogin) {
-    const loginArgs = applyLoginEnvironmentFlags(command === 'auth' ? args.slice(1) : args, { inferTargetUrl: true });
-    if (hasHelpFlag(loginArgs)) { printLoginHelp(); return; }
-    assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
-    await require('../lib/auth/qwenwork-login').run(loginArgs, buildTokenLoginOptions(loginArgs));
-    return;
-  }
 
   const { maybeAutoUpdate } = require('../lib/core/update');
   const updateResult = await maybeAutoUpdate({
@@ -734,10 +718,6 @@ async function main() {
 
     case 'auth': {
       const subCommand = args[0];
-      if (subCommand === 'qwenwork') {
-        await require('../lib/auth/qwenwork').run(args.slice(1));
-        break;
-      }
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
       const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');

package/lib/app/create-app.js

@@ -20,6 +20,7 @@ const { buildApplicationEntryUrls } = require('./application-entry-urls');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { throwCommandError } = require('../core/command-errors');
+const { isPermissionGuidanceError } = require('../core/permission-guidance');
 const { resolveBuilderAiSource } = require('./builder-ai-source');
 
 const DEFAULT_APP_OPTIONS = {
@@ -358,6 +359,7 @@ async function run(args) {
       if (corpConfig.content.forcePhysicalColumn === 'y') {openPhysicColumn = 'y';}
     }
   } catch (err) {
+    if (isPermissionGuidanceError(err)) { throw err; }
     // 查询失败时使用默认值，不影响主流程
   }
 

package/lib/app/import-app.js

@@ -21,6 +21,7 @@ const { t } = require('../core/i18n');
 const { buildYidaI18n, resolveContentLocale } = require('../core/yida-i18n');
 const { banner, step, label, success, fail, warn, info, error, result, usage, hint } = require('../core/chalk');
 const { throwUsage } = require('../core/command-errors');
+const { isPermissionGuidanceError } = require('../core/permission-guidance');
 const { getSchemaServerRevision } = require('../core/server-revision');
 const { resolveBuilderAiSource } = require('./builder-ai-source');
 
@@ -243,6 +244,7 @@ async function run(args) {
   try {
     newAppType = await createApp(appName, authRef);
   } catch (err) {
+    if (isPermissionGuidanceError(err)) { throw err; }
     error(err.message);
   }
   success(t('import.app_created', newAppType));
@@ -272,6 +274,7 @@ async function run(args) {
       newFormUuid = await createBlankForm(newAppType, formName, authRef, formType);
       success(t('import.blank_form_created', newFormUuid));
     } catch (err) {
+      if (isPermissionGuidanceError(err)) { throw err; }
       fail(t('import.create_form_failed', err.message));
       migrationReport.forms.push({
         oldFormUuid,

package/lib/auth/token-auth.js

@@ -175,7 +175,6 @@ function normalizeTokenResponse(response, baseUrl, clientId) {
   );
   return {
     auth_mode: 'token',
-    credential_source: data.credential_source,
     status: data.status || 'ok',
     can_auto_use: true,
     message: data.message || data.errorMsg || response.errorMsg,
@@ -487,9 +486,7 @@ async function tokenRefreshUnlocked(options, session) {
   // Token exchange follows the active environment endpoint, just like the
   // legacy login bootstrap. The response may return a different corp base_url
   // for business requests and generated application links.
-  // 桌面会话沿用首次换票的可信 origin；刷新不受后续全局环境切换影响。
-  const desktopSession = session.credential_source === 'qwenwork_desktop';
-  const authBaseUrlValue = desktopSession ? session.base_url : resolveTokenBaseUrl({
+  const authBaseUrlValue = resolveTokenBaseUrl({
     projectRoot: options.projectRoot,
     endpoint: options.endpoint,
   });
@@ -502,13 +499,6 @@ async function tokenRefreshUnlocked(options, session) {
   requireOkResponse(response);
   const data = getTokenPayload(response);
   const responseBusinessBaseUrl = data.base_url || data.baseUrl;
-  if (desktopSession && responseBusinessBaseUrl !== undefined) {
-    try {
-      const value = new URL(responseBusinessBaseUrl);
-      if (typeof responseBusinessBaseUrl !== 'string' || responseBusinessBaseUrl.length > 2048 || /\s/.test(responseBusinessBaseUrl) ||
-        value.protocol !== 'https:' || value.username || value.password || value.pathname !== '/' || value.search || value.hash) { throw new Error(); }
-    } catch { throw createTokenAuthRequiredError('refresh_origin_mismatch'); }
-  }
   const businessBaseUrl = session.base_url || authBaseUrlValue;
   const normalized = normalizeTokenResponse({
     ...data,
@@ -517,7 +507,6 @@ async function tokenRefreshUnlocked(options, session) {
     user_id: data.user_id || data.userId || session.user_id,
     user_name: data.user_name || data.userName || session.user_name,
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
-    credential_source: data.credential_source || session.credential_source,
   }, businessBaseUrl, clientId);
   if (!normalized.access_token) {
     return {

package/lib/auth/token-store.js

@@ -276,7 +276,6 @@ function normalizeTokenSession(session = {}) {
   );
   const normalized = {
     auth_mode: 'token',
-    credential_source: session.credential_source,
     token_type: session.token_type || session.tokenType || 'Bearer',
     access_token: session.access_token || session.accessToken,
     refresh_token: session.refresh_token || session.refreshToken,

package/lib/core/agent-capabilities.js

@@ -3,13 +3,12 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-const { version, openyidaLocalBeta: localBeta } = require('../../package.json');
+const { version } = require('../../package.json');
 const { t } = require('./i18n');
 const { buildCommandManifest } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
 const coreUtils = require('./utils');
 const { buildHostAssetCapabilities } = require('../asset/host-capabilities');
-const { buildQwenWorkLoginInvocation, isQwenWorkWebRuntime } = require('./qwenwork-login-guidance');
 const { findProjectRoot, getAuthStatus } = coreUtils;
 
 function redactLogin(login) {
@@ -196,7 +195,7 @@ function forbiddenAliasBriefs(manifest) {
   }));
 }
 
-function buildAuthPath(login, env = process.env, runtime = null) {
+function buildAuthPath(login, env = process.env) {
   const authSource = login.auth_source || 'token_session';
   const envTokenSession = authSource === 'env' || login.failure_reason === 'env_token_missing';
   const authPath = {
@@ -231,54 +230,10 @@ function buildAuthPath(login, env = process.env, runtime = null) {
       ? 'STOP_AND_REQUEST_ENV_TOKEN'
       : 'RUN_OPENYIDA_LOGIN_IF_USER_APPROVES',
   };
-  if (isQwenWorkWebRuntime(runtime) && !envTokenSession) {
-    const invocation = buildQwenWorkLoginInvocation({ subtype: 'qwenwork_web' });
-    authPath.auth_runtime = 'qwenwork_cloud_exchange';
-    authPath.interactive_login_allowed = true;
-    authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
-    for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
-    authPath.next_step = authPath.can_auto_use
-      ? 'Silently continue the requested business operation and report its business result.'
-      : 'Run the recommended login command silently. The CLI consumes cloud runtime credentials; do not inspect credentials, open a browser, or fall back to OAuth on failure.';
-    authPath.next_step_commands = authPath.can_auto_use ? [] : [invocation.command];
-    return authPath;
-  }
-  // 桌面换票仅由当前活跃宿主和发行配置共同启用，不影响其他宿主的认证路径。
-  if (localBeta?.desktopTicketLogin && runtime?.tool === 'qwenwork' && runtime?.subtype === 'qwenwork_desktop' && !envTokenSession) {
-    const invocation = buildQwenWorkLoginInvocation();
-    authPath.auth_runtime = 'qwenwork_desktop_exchange_ticket';
-    authPath.interactive_login_allowed = true;
-    authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
-    for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
-    authPath.next_step = authPath.can_auto_use
-      ? 'Silently continue the requested business operation and report its business result.'
-      : `Run the recommended login command as returned: ${invocation.command}. No extra PATH or output setup is needed. After success silently continue the requested business operation. If it fails, follow the returned invocation guidance.`;
-    authPath.next_step_commands = authPath.can_auto_use ? [] : [invocation.command];
-  }
   return authPath;
 }
 
 function buildInteractiveLogin(auth, runtime) {
-  if (auth.auth_runtime === 'qwenwork_cloud_exchange' && isQwenWorkWebRuntime(runtime)) {
-    return {
-      mode: 'cloud_token', browser_default: 'not_required', browser_owner: 'none',
-      recommended_command: auth.can_auto_use ? null : buildQwenWorkLoginInvocation({ subtype: 'qwenwork_web' }).command,
-      invocation: buildQwenWorkLoginInvocation({ subtype: 'qwenwork_web' }),
-      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_login_qwenwork_and_wait',
-      user_visible: false, success_action: 'continue_business_command_without_message',
-      reason: 'qwenwork_web_cloud_credentials', completion_signal: 'process_exit_and_final_json', playwright_required: false,
-    };
-  }
-  if (auth.auth_runtime === 'qwenwork_desktop_exchange_ticket' && runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') {
-    return {
-      mode: 'desktop_ticket', browser_default: 'not_required', browser_owner: 'cli_if_auth_required',
-      recommended_command: auth.can_auto_use ? null : buildQwenWorkLoginInvocation().command,
-      invocation: buildQwenWorkLoginInvocation(),
-      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_login_qwenwork_and_wait',
-      user_visible: false, success_action: 'continue_business_command_without_message',
-      reason: 'qwenwork_desktop_pre_beta', completion_signal: 'process_exit_and_final_json', playwright_required: false,
-    };
-  }
   const base = {
     suppress_flag: '--no-browser',
     suppress_env: 'OPENYIDA_NO_BROWSER',
@@ -338,9 +293,9 @@ function buildInteractiveLogin(auth, runtime) {
 }
 
 function buildBuilderPath(login, projectRoot, manifest, env = process.env, runtimeSnapshot = null) {
-  const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
-  const auth = buildAuthPath(login, env, runtime);
+  const auth = buildAuthPath(login, env);
   const canTrustSummaryPreflight = auth.can_auto_use === true;
+  const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
 
   return {
     schema_version: 1,
@@ -356,13 +311,6 @@ function buildBuilderPath(login, projectRoot, manifest, env = process.env, runti
     auth,
     runtime,
     interactive_login: buildInteractiveLogin(auth, runtime),
-    communication: isQwenWorkWebRuntime(runtime) || (runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') ? {
-      preparation_visibility: 'silent',
-      completion_content: 'business_result_and_business_link_only',
-      disclose_authentication_identity_environment: false,
-      report_preparation_only_when_user_action_is_required: true,
-      bundled_skill_path: path.resolve(__dirname, '../../yida-skills'),
-    } : undefined,
     environment_check_simplification: {
       contract_role: 'machine_readable_builder_runtime_not_yida_agent_business_logic',
       minimal_probe_commands: [
@@ -484,7 +432,6 @@ function compactBuilderPath(builderPath) {
     auth,
     runtime: builderPath.runtime,
     interactive_login: builderPath.interactive_login,
-    communication: builderPath.communication,
     environment_check_simplification: {
       minimal_probe_commands: environment.minimal_probe_commands,
       can_skip_default_exploration_when_summary_ok: environment.can_skip_default_exploration_when_summary_ok,
@@ -654,9 +601,7 @@ function buildAgentCapabilitiesSummary() {
     schema_version: 1,
     name: 'openyida-agent-capabilities-summary',
     version,
-    login: ['qwenwork_desktop_exchange_ticket', 'qwenwork_cloud_exchange'].includes(builderPath.auth.auth_runtime)
-      ? { status: loginStatus.status, can_auto_use: loginStatus.can_auto_use === true }
-      : compactLogin(loginStatus),
+    login: compactLogin(loginStatus),
     workdir: projectRoot,
     workdir_exists: !!projectResolution.exists,
     workdir_source: projectResolution.source,

package/lib/core/cli-error.js

@@ -101,7 +101,8 @@ function shouldUseStructuredErrorOutput(error, args = []) {
     && details.mutationPerformed === false
   );
   const navigationOrderFailure = /^NAV_ORDER_/.test(error.code || '');
-  return ownedPartial || mutationOutcomeUnknown || deterministicPreflightFailure || navigationOrderFailure;
+  const permissionRequired = !!details && details.status === 'permission_required';
+  return ownedPartial || mutationOutcomeUnknown || deterministicPreflightFailure || navigationOrderFailure || permissionRequired;
 }
 
 module.exports = {

package/lib/core/command-manifest.js

@@ -420,7 +420,6 @@ const COMMAND_SIDE_EFFECTS = new Map([
     'export-conversation',
     'flash-to-prd',
     'login',
-    'login-qwenwork',
     'logout',
     'sample',
     'update',
@@ -588,7 +587,7 @@ const COMMAND_SIDE_EFFECTS = new Map([
     mutates_yida: false,
     mutates_local: true,
     read_actions: ['status', 'profiles', 'profile list'],
-    mutating_actions: ['login', 'refresh', 'logout', 'profile switch', 'qwenwork user-info'],
+    mutating_actions: ['login', 'refresh', 'logout', 'profile switch'],
   })],
   ['batch', sideEffect('mixed', {
     mutates_yida: true,
@@ -813,7 +812,6 @@ const COMMAND_PERMISSIONS = new Map([
 
   ...permissionEntries([
     'login',
-    'login-qwenwork',
     'logout',
     'update',
   ], permission('allow', 'external', {
@@ -926,7 +924,7 @@ const COMMAND_PERMISSIONS = new Map([
   ...permissionEntries([
     'auth',
   ], actionDependentPermission({
-    preauthorized_actions: ['login', 'refresh', 'logout', 'profile switch', 'qwenwork user-info'],
+    preauthorized_actions: ['login', 'refresh', 'logout', 'profile switch'],
   })),
 
   ...permissionEntries([
@@ -1161,13 +1159,12 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [--qwenwork] [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
         requiresLogin: false,
         output: 'json',
       }),
-      command('login-qwenwork', ['login-qwenwork'], 'login-qwenwork --exchange-ticket <ticket> --ticket-context <json> [--json]', 'help.cmd_login_qwenwork', { managedRun: { scope: 'denied', reason: 'identity_exchange' }, requiresLogin: false, output: 'json', hidden: true }),
       command('logout', ['logout'], 'logout', 'help.cmd_logout', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
-      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] }, qwenwork: { scope: 'denied', reason: 'identity_exchange' } } }, requiresLogin: false }),
+      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch>', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] } } }, requiresLogin: false }),
       command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
       command('env', ['env'], 'env [--json|setup|list|show|switch|add|remove] [options]', 'help.cmd_env', { managedRun: { scope: 'local', allowedFlags: ['--json', '--quiet'] },
         requiresLogin: false,
@@ -1292,7 +1289,7 @@ const COMMAND_GROUPS = [
         output: 'json',
       }),
       command('create-app', ['create-app'], 'create-app "<name>"|--name <name> [options] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_app', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
-        notes: ['Successful results include appUrl/workbenchUrl for the business workspace and adminUrl for developer administration. Complete application delivery retains adminUrl regardless of auth runtime; route construction does not verify recipient access. Preserve the frontend URL from its own page result.'],
+        notes: ['Successful results include appUrl/workbenchUrl for the business workspace and adminUrl for developer administration. Complete application delivery retains adminUrl regardless of auth runtime; route construction does not verify recipient access. Preserve the frontend URL from its own page result.', 'In QwenWork, permission failures return a nonzero exit and structured status=permission_required. YIDA_PLATFORM_ACCESS_REQUIRED and YIDA_APP_CREATE_PERMISSION_REQUIRED include details.permissionLabel/permissionUrl and nextAction.label/url; YIDA_PERMISSION_REQUIRED preserves an unclassified permission reason without inventing a link. Explain the missing permission, display the semantic label as a Markdown link to its paired URL (or reuse nextStep), and pause resource writes; do not automatically open it, send an application, switch spaces, log in again or retry creation. Resume only after the user requests continuation and the host identity, organization and permissions are verified.'],
       }),
       command('design-plan.catalog', ['design-plan', 'catalog'], 'design-plan catalog [--json]', 'help.cmd_design_plan_catalog', { managedRun: { scope: 'local' },
         requiresLogin: false, output: 'json',

package/lib/core/locales/en.js

@@ -4,21 +4,6 @@
 'use strict';
 
 module.exports = {
-  qwenwork: {
-    login_check_failed: 'Unable to verify the login session. Please retry.',
-    desktop_login_failed: 'QwenWork desktop login failed. Check the desktop identity and login handoff before retrying.',
-    desktop_login_usage: 'Usage: openyida login --qwenwork [--json] [--check-only]',
-    desktop_login_standalone: 'Run the recommended login command directly: {0}. No extra PATH or output setup is needed. After success continue the business operation silently; on failure follow the returned guidance.',
-    credential_missing: 'No cloud Agent credential is available. Run this command inside the QwenWork cloud execution environment.',
-    gateway_missing: 'QWENWORK_GATEWAY_URL or MULE_GATEWAY_URL is required.',
-    invalid_url: 'The QwenWork gateway must use HTTPS (HTTP is allowed only for loopback) and contain no credentials, query or fragment.',
-    request_failed: 'The QwenWork request failed. Check the stage and HTTP status in the diagnostic details.',
-    request_timeout: 'The QwenWork request timed out.',
-    invalid_response: 'QwenWork returned an invalid authentication or identity response.',
-    identity_mismatch: 'The returned QwenWork identity does not match the cloud execution context or exchanged credential.',
-    expired_token: 'QwenWork returned an expired user credential.',
-    usage: 'Usage: openyida auth qwenwork user-info [--json]',
-  },
   print_template: {
     'description': 'Manage native YiDA print templates, generate document layouts, back up, restore and request PDFs',
     'error': 'Print template operation failed: {0}',
@@ -191,7 +176,6 @@ module.exports = {
     alias: 'Alias:',
     group_auth: 'Auth & Environment',
     cmd_login: 'Login with OAuth token mode',
-    cmd_login_qwenwork: 'Log in to YiDA with a one-time QwenWork exchange ticket',
     cmd_logout: 'Logout / unbind current project auth',
     cmd_auth: 'Token login state and profile management',
     cmd_agent: 'Connect a local Agent (Go runtime, development preview)',
@@ -520,10 +504,10 @@ Examples:
     save_permission_usage: 'Usage: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>] [--package-type <FORM_PACKAGE_VIEW|FORM_PACKAGE_START>]',
     save_permission_example: "Example: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ Execution failed: {0}',
-    login_usage: 'Usage: openyida login [--qwenwork] [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
     login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
-    auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]',
+    auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
     auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
     org_usage: 'Usage: openyida org <list|switch> [--json] [--corp-id <corpId>]',
     org_example: 'Examples:\n  openyida org list --json                    # List accessible organizations\n  openyida org switch --corp-id dingXXX       # Switch existing profiles first; login to add one if missing',
@@ -1178,7 +1162,7 @@ Examples:
 
   import_example2: '      openyida import ./yida-export.json "Quality Traceability System (Production)"',
   exec_failed: '\n❌ Execution failed: {0}',
-  auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]',
+  auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
   auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
   org_usage: 'Usage: openyida org <list|switch> [--json] [--corp-id <corpId>]',
   org_example: 'Examples:\n  openyida org list --json                    # List accessible organizations\n  openyida org switch --corp-id dingXXX       # Switch existing profiles first; login to add one if missing',
@@ -2609,3 +2593,12 @@ module.exports.feedback_github = {
 };
 
 module.exports.process_dynamic_actors = { invalid: 'Invalid process actor configuration. Check details.reason, selection range and actual member fields.' };
+
+module.exports.permission_guidance = {
+  platform_access_link: 'Request YiDA access',
+  create_app_link: 'Request permission to create YiDA applications',
+  platform_access: 'The current account is not authorized to use YiDA in this organization.',
+  create_app: 'The current account cannot create applications in this organization.',
+  unknown: 'Permission denied; the permission type is unconfirmed. Contact an administrator and pause this operation.',
+  next_step: 'Open the permission request page: [{0}]({1}). After completing it, verify the current organization and permissions before continuing.',
+};

package/lib/core/locales/zh.js

@@ -4,21 +4,6 @@
 'use strict';
 
 module.exports = {
-  qwenwork: {
-    login_check_failed: '登录状态暂时无法确认，请重试。',
-    desktop_login_failed: '千问办公桌面免登失败，请确认桌面登录身份和免登通道后重试。',
-    desktop_login_usage: '用法：openyida login --qwenwork [--json] [--check-only]',
-    desktop_login_standalone: '请直接执行推荐的登录命令：{0}。无需额外处理 PATH 和输出；成功后静默继续业务，失败时按提示修正调用。',
-    credential_missing: '未发现云端 Agent 凭证，请在千问办公云端执行环境中运行此命令。',
-    gateway_missing: '缺少 QWENWORK_GATEWAY_URL 或 MULE_GATEWAY_URL。',
-    invalid_url: '千问网关必须使用 HTTPS（仅回环地址允许 HTTP），且不能包含账号密码、查询参数或片段。',
-    request_failed: '千问接口请求失败，请查看诊断信息中的阶段和 HTTP 状态码。',
-    request_timeout: '千问接口请求超时。',
-    invalid_response: '千问返回的认证或身份响应格式不正确。',
-    identity_mismatch: '千问返回的用户身份与云端执行上下文或兑换凭证不一致。',
-    expired_token: '千问返回的用户凭证已过期。',
-    usage: '用法：openyida auth qwenwork user-info [--json]',
-  },
   print_template: {
     'description': '管理宜搭原生打印模板、按字段生成多种单据、备份恢复与生成PDF',
     'error': '打印模板操作失败：{0}',
@@ -191,7 +176,6 @@ module.exports = {
     alias: '别名:',
     group_auth: '环境 & 认证',
     cmd_login: '登录（OAuth token 模式）',
-    cmd_login_qwenwork: '使用千问办公的一次性兑换票登录宜搭',
     cmd_logout: '退出登录 / 解绑当前项目登录态',
     cmd_auth: 'token 登录态与 profile 管理',
     cmd_agent: '连接本地 Agent（Go runtime，开发预览）',
@@ -520,7 +504,7 @@ openyida - 宜搭命令行工具
     save_permission_usage: '用法: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>] [--package-type <FORM_PACKAGE_VIEW|FORM_PACKAGE_START>]',
     save_permission_example: "示例: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ 执行失败: {0}',
-    login_usage: '用法： openyida login [--qwenwork] [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
     login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；env token 模式下只读取 OPENYIDA_* token。',
     first_run_title: '  🤖 OpenYida - AI 问答模式已开启！                         ',
@@ -1150,7 +1134,7 @@ openyida - 宜搭命令行工具
   // ── lib/import-app.js ──────────────────────────────
   import_example2: '      openyida import ./yida-export.json "质量追溯系统（生产环境）"',
   exec_failed: '\n❌ 执行失败: {0}',
-  auth_usage: '用法: openyida auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]',
+  auth_usage: '用法: openyida auth <status|login|refresh|logout|profiles|profile switch>',
   auth_example: '示例:\n  openyida auth status                         # 查看登录状态\n  openyida auth profiles                       # 列出已有登录 profile\n  openyida auth profile switch <auth_profile>  # 切换当前项目到已有 profile\n  openyida auth login                          # 目标 profile 不存在时登录新增\n  openyida auth refresh                        # 刷新登录态\n  openyida auth logout                         # 解绑当前项目登录态\n  openyida auth logout --profile <auth_profile> # 删除指定共享 profile',
   org_usage: '用法: openyida org <list|switch> [--json] [--corp-id <corpId>]',
   org_example: '示例:\n  openyida org list --json                    # 列出可访问的组织\n  openyida org switch --corp-id dingXXX       # 优先切换已有 profile；不存在时登录新增',
@@ -2563,3 +2547,12 @@ module.exports.feedback_github = {
 };
 
 module.exports.process_dynamic_actors = { invalid: '流程人员来源配置无效，请按 details.reason 检查来源、范围与真实成员字段。' };
+
+module.exports.permission_guidance = {
+  platform_access_link: '申请宜搭使用授权',
+  create_app_link: '申请宜搭应用创建权限',
+  platform_access: '当前没有此组织的宜搭使用权限，可申请宜搭使用授权。',
+  create_app: '当前没有此组织的宜搭应用创建权限，可申请应用创建权限。',
+  unknown: '权限不足，具体权限类型尚未确认。请联系管理员核实，暂不重试当前操作。',
+  next_step: '请打开申请页面：[{0}]({1})。处理完成后确认当前组织和权限，再继续搭建。',
+};

package/lib/core/permission-guidance.js

@@ -0,0 +1,98 @@
+'use strict';
+
+const { CliError } = require('./cli-error');
+const { t } = require('./i18n');
+const { redactString } = require('./redact');
+
+const TYPES = { unauth: 'platform_access', noAppCreationAuth: 'create_app' };
+const CODES = {
+  platform_access: 'YIDA_PLATFORM_ACCESS_REQUIRED',
+  create_app: 'YIDA_APP_CREATE_PERMISSION_REQUIRED',
+  unknown: 'YIDA_PERMISSION_REQUIRED',
+};
+const AUTH_CODES = new Set([
+  'not_logged_in', 'invalid_access_token', 'expired_access_token',
+  'access_token_expired', 'missing_access_token',
+]);
+
+function normalizeMessage(value) {
+  return String(value || '').replace(/[\s，,。.!！]/g, '');
+}
+
+// 仅接受当前宜搭域名的两类申请页；重建查询参数，避免传递凭据或任意回跳地址。
+function resolvePermissionPage(location, baseUrl) {
+  if (!location || !baseUrl) { return null; }
+  try {
+    const base = new URL(baseUrl);
+    const target = new URL(location, base);
+    if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password
+      || target.origin !== base.origin || target.username || target.password
+      || target.pathname !== '/defaultPage.html') { return null; }
+    const values = target.searchParams.getAll('type');
+    if (values.length !== 1 || !Object.hasOwn(TYPES, values[0])) { return null; }
+    const url = new URL('/defaultPage.html', base);
+    url.searchParams.set('type', values[0]);
+    for (const key of ['corpid', 'appType']) {
+      const value = target.searchParams.get(key);
+      if (value && /^[A-Za-z0-9_-]{1,200}$/.test(value)) { url.searchParams.set(key, value); }
+    }
+    return { permissionType: TYPES[values[0]], url: url.href };
+  } catch { return null; }
+}
+
+function createPermissionError(response, options = {}) {
+  if (options.tool !== 'qwenwork') { return null; }
+  let payload = response;
+  if (typeof payload === 'string') {
+    try { payload = JSON.parse(payload); } catch { payload = {}; }
+  }
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) { payload = {}; }
+  const content = payload.content && typeof payload.content === 'object' && !Array.isArray(payload.content)
+    ? payload.content : {};
+  const code = String(payload.errorCode || payload.code || content.errorCode || content.code || '');
+  const status = String(payload.status || content.status || '').toLowerCase();
+  const message = String(payload.errorMsg || payload.message || content.errorMsg || content.message || '');
+  const httpStatus = Number(options.httpStatus || payload.__httpStatus || 0);
+  // 明确的凭据失效继续由原有认证链路处理。
+  if (httpStatus === 401 || AUTH_CODES.has(code.toLowerCase()) || AUTH_CODES.has(status)
+    || /not_logged_in|invalid_access_token|expired_access_token|access_token_expired|access token is invalid or expired/i.test(message)) { return null; }
+  const failed = payload.success === false || payload.__needLogin || httpStatus >= 300;
+  if (!failed) { return null; }
+  let page = resolvePermissionPage(options.location || payload.__location, options.baseUrl);
+  const legacyDenied = /^(?:TIANSHU_)?000006$/.test(code);
+  if (!page && legacyDenied) {
+    const normalized = normalizeMessage(message);
+    if (normalized === '已升级宜搭你未在授权范围内因此无法使用如要使用请联系管理员授权') {
+      page = resolvePermissionPage('/defaultPage.html?type=unauth', options.baseUrl);
+    } else if (normalized === '管理员暂未为您分配权限请联系管理员授权'
+      && /^\/query\/app\/registerApp(?:\.json)?(?:\?|$)/.test(options.requestPath || '')) {
+      // 000006 被多个权限检查共用，只有已核实的创建接口及文案组合才可归类。
+      page = resolvePermissionPage('/defaultPage.html?type=noAppCreationAuth', options.baseUrl);
+    }
+  }
+  if (!page && !legacyDenied && httpStatus !== 403 && code !== '403' && status !== '403') { return null; }
+  const permissionType = page ? page.permissionType : 'unknown';
+  const label = page ? t(`permission_guidance.${permissionType}_link`) : '';
+  const details = {
+    status: 'permission_required', permissionType,
+    platformErrorCode: code || undefined, httpStatus: httpStatus || undefined,
+    platformErrorMessage: message ? redactString(message) : undefined,
+    retryable: false,
+    nextStep: page ? t('permission_guidance.next_step', label, page.url) : t('permission_guidance.unknown'),
+  };
+  if (page) {
+    details.permissionLabel = label;
+    details.permissionUrl = page.url;
+    details.nextAction = { type: 'open_url', label, url: page.url };
+  }
+  const displayMessage = page || !message ? t(`permission_guidance.${permissionType}`) : redactString(message);
+  return new CliError(displayMessage, {
+    code: CODES[permissionType], details,
+  });
+}
+
+function isPermissionGuidanceError(error) {
+  return !!error && error.isCliError === true && Object.values(CODES).includes(error.code);
+}
+
+module.exports = { createPermissionError, isPermissionGuidanceError };