openyida 2026.10.28-beta.2 → 2026.10.29

package/README.md

@@ -143,27 +143,6 @@ openyida login --check-only --json
 openyida auth status
 ```
 
-In QwenWork web, `openyida login --qwenwork --json` (or ordinary `login`) sends the sandbox Agent Token and gateway origin directly to the selected YiDA authentication endpoint. YiDA validates the identity through the trusted gateway’s fixed `/api/agent-gw/yida/user_info` endpoint, then issues its own short-lived session. This login flow no longer calls the legacy exchange or `/user/info` endpoints. Login preparation stays silent; failures stop without browser OAuth. Desktop and other hosts retain their existing authentication paths.
-
-For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
-
-```bash
-openyida auth qwenwork user-info --json
-```
-
-This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
-
-Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.
-
-```js
-const { exchangeQwenWorkAgentToken, getQwenWorkUserInfo } = require('openyida/lib/auth/qwenwork-client');
-async function readCloudUser() {
-  const credential = await exchangeQwenWorkAgentToken();
-  // The result contains QwenWork identifiers, not YiDA IDs.
-  return getQwenWorkUserInfo(credential);
-}
-```
-
 To reuse an existing shared login profile for the current project, switch first instead of starting a new OAuth login:
 
 ```bash
@@ -478,9 +457,9 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [--qwenwork] [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
-| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch\|qwenwork user-info> [--json]` | Token login state and profile management |
+| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |
 | `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
@@ -491,6 +470,7 @@ When preparing a PR that needs a personal Fork, or when you ask how to support t
 | `openyida app-settings <appType> [--section theme\|basic\|data-card\|cool-card] [--json]` | Read theme, frontend/backend, native data card and cool card management links |
 | `openyida cool-card <list\|templates\|create\|get> <appType> [cardPageCode] [--type im\|onebox] [--name <title>] [--page <n>] [--size <n>] [--search <text>] [--out <file>] [--json]` | Create and read native YiDA cool cards (interactive and pinned) |
 | `openyida data-card <list\|create\|get\|save\|publish\|probe\|release-get\|release-save\|release-check\|release-test\|refs> <appType> [cardCode] [--name <title>] [--description <text>] [--schema <file>\|--config <file>] [--expected-hash <hash>] [--backup <file>] [--out <file>] [--published\|--version <version>] [--page <n>] [--size <n>] [--search <text>] [--allow-send] [--json]` | Create, configure, publish and distribute native YiDA data cards |
+| `openyida plugin <dev-list\|get\|version-list\|version-get\|extensions\|installed-list\|installed-get\|runtime-list\|probe\|create\|create-version\|save-dev\|configure\|enable\|disable\|upgrade\|uninstall> [pluginId] [version] [options]` | Manage YiDA platform plugin versions, installation state, and runtime registrations |
 | `openyida app-entry get <appType> [--json]` | Read frontend and management runtime entries |
 | `openyida app-entry set <appType> [--frontend <url>\|--frontend-page <formUuid>] [--management <url>\|--management-page <formUuid>] [--clear-frontend] [--clear-management] [--json]` | Register application entries with partial update and readback |
 | `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |

package/bin/yida.js

@@ -598,23 +598,7 @@ async function main() {
   });
   assertManagedInvocation(command, rawArgs);
   applyQuietFlag();
-  // 一次性票据只在当前进程消费，不能先自更新并重启命令。
-  switch (command) {
-    case 'login-qwenwork':
-      await require('../lib/auth/qwenwork-desktop').run(args);
-      return;
-  }
   applyGlobalEnvironmentFlags();
-  // 网页态由 CLI 消费宿主凭据；桌面态继续消费宿主准备的登录态。
-  const webLogin = (command === 'login' || (command === 'auth' && args[0] === 'login')) &&
-    require('../lib/core/qwenwork-login-guidance').isQwenWorkWebRuntime(require('../lib/core/utils').detectRuntimeCapabilities());
-  if ((command === 'login' && args.includes('--qwenwork')) || webLogin) {
-    const loginArgs = applyLoginEnvironmentFlags(command === 'auth' ? args.slice(1) : args, { inferTargetUrl: true });
-    if (hasHelpFlag(loginArgs)) { printLoginHelp(); return; }
-    assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
-    await require('../lib/auth/qwenwork-login').run(loginArgs, buildTokenLoginOptions(loginArgs));
-    return;
-  }
 
   const { maybeAutoUpdate } = require('../lib/core/update');
   const updateResult = await maybeAutoUpdate({
@@ -734,10 +718,6 @@ async function main() {
 
     case 'auth': {
       const subCommand = args[0];
-      if (subCommand === 'qwenwork') {
-        await require('../lib/auth/qwenwork').run(args.slice(1));
-        break;
-      }
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
       const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
@@ -795,6 +775,11 @@ async function main() {
       await run(args);
       break;
     }
+    case 'plugin': {
+      const { run } = require('../lib/plugin/plugin-lifecycle');
+      await run(args);
+      break;
+    }
 
     case 'app-settings': {
       const { run } = require('../lib/app/app-settings');

package/lib/app/create-app.js

@@ -20,6 +20,7 @@ const { buildApplicationEntryUrls } = require('./application-entry-urls');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { throwCommandError } = require('../core/command-errors');
+const { isPermissionGuidanceError } = require('../core/permission-guidance');
 const { resolveBuilderAiSource } = require('./builder-ai-source');
 
 const DEFAULT_APP_OPTIONS = {
@@ -358,6 +359,7 @@ async function run(args) {
       if (corpConfig.content.forcePhysicalColumn === 'y') {openPhysicColumn = 'y';}
     }
   } catch (err) {
+    if (isPermissionGuidanceError(err)) { throw err; }
     // 查询失败时使用默认值，不影响主流程
   }
 

package/lib/app/import-app.js

@@ -21,6 +21,7 @@ const { t } = require('../core/i18n');
 const { buildYidaI18n, resolveContentLocale } = require('../core/yida-i18n');
 const { banner, step, label, success, fail, warn, info, error, result, usage, hint } = require('../core/chalk');
 const { throwUsage } = require('../core/command-errors');
+const { isPermissionGuidanceError } = require('../core/permission-guidance');
 const { getSchemaServerRevision } = require('../core/server-revision');
 const { resolveBuilderAiSource } = require('./builder-ai-source');
 
@@ -243,6 +244,7 @@ async function run(args) {
   try {
     newAppType = await createApp(appName, authRef);
   } catch (err) {
+    if (isPermissionGuidanceError(err)) { throw err; }
     error(err.message);
   }
   success(t('import.app_created', newAppType));
@@ -272,6 +274,7 @@ async function run(args) {
       newFormUuid = await createBlankForm(newAppType, formName, authRef, formType);
       success(t('import.blank_form_created', newFormUuid));
     } catch (err) {
+      if (isPermissionGuidanceError(err)) { throw err; }
       fail(t('import.create_form_failed', err.message));
       migrationReport.forms.push({
         oldFormUuid,

package/lib/auth/token-auth.js

@@ -175,7 +175,6 @@ function normalizeTokenResponse(response, baseUrl, clientId) {
   );
   return {
     auth_mode: 'token',
-    credential_source: data.credential_source,
     status: data.status || 'ok',
     can_auto_use: true,
     message: data.message || data.errorMsg || response.errorMsg,
@@ -487,9 +486,7 @@ async function tokenRefreshUnlocked(options, session) {
   // Token exchange follows the active environment endpoint, just like the
   // legacy login bootstrap. The response may return a different corp base_url
   // for business requests and generated application links.
-  // 桌面会话沿用首次换票的可信 origin；刷新不受后续全局环境切换影响。
-  const desktopSession = session.credential_source === 'qwenwork_desktop';
-  const authBaseUrlValue = desktopSession ? session.base_url : resolveTokenBaseUrl({
+  const authBaseUrlValue = resolveTokenBaseUrl({
     projectRoot: options.projectRoot,
     endpoint: options.endpoint,
   });
@@ -502,13 +499,6 @@ async function tokenRefreshUnlocked(options, session) {
   requireOkResponse(response);
   const data = getTokenPayload(response);
   const responseBusinessBaseUrl = data.base_url || data.baseUrl;
-  if (desktopSession && responseBusinessBaseUrl !== undefined) {
-    try {
-      const value = new URL(responseBusinessBaseUrl);
-      if (typeof responseBusinessBaseUrl !== 'string' || responseBusinessBaseUrl.length > 2048 || /\s/.test(responseBusinessBaseUrl) ||
-        value.protocol !== 'https:' || value.username || value.password || value.pathname !== '/' || value.search || value.hash) { throw new Error(); }
-    } catch { throw createTokenAuthRequiredError('refresh_origin_mismatch'); }
-  }
   const businessBaseUrl = session.base_url || authBaseUrlValue;
   const normalized = normalizeTokenResponse({
     ...data,
@@ -517,7 +507,6 @@ async function tokenRefreshUnlocked(options, session) {
     user_id: data.user_id || data.userId || session.user_id,
     user_name: data.user_name || data.userName || session.user_name,
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
-    credential_source: data.credential_source || session.credential_source,
   }, businessBaseUrl, clientId);
   if (!normalized.access_token) {
     return {

package/lib/auth/token-store.js

@@ -276,7 +276,6 @@ function normalizeTokenSession(session = {}) {
   );
   const normalized = {
     auth_mode: 'token',
-    credential_source: session.credential_source,
     token_type: session.token_type || session.tokenType || 'Bearer',
     access_token: session.access_token || session.accessToken,
     refresh_token: session.refresh_token || session.refreshToken,

package/lib/core/agent-capabilities.js

@@ -3,13 +3,12 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-const { version, openyidaLocalBeta: localBeta } = require('../../package.json');
+const { version } = require('../../package.json');
 const { t } = require('./i18n');
-const { buildCommandManifest } = require('./command-manifest');
+const { buildCommandManifest, buildEntryDeliveryPolicy } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
 const coreUtils = require('./utils');
 const { buildHostAssetCapabilities } = require('../asset/host-capabilities');
-const { buildQwenWorkLoginInvocation, isQwenWorkWebRuntime } = require('./qwenwork-login-guidance');
 const { findProjectRoot, getAuthStatus } = coreUtils;
 
 function redactLogin(login) {
@@ -196,7 +195,7 @@ function forbiddenAliasBriefs(manifest) {
   }));
 }
 
-function buildAuthPath(login, env = process.env, runtime = null) {
+function buildAuthPath(login, env = process.env) {
   const authSource = login.auth_source || 'token_session';
   const envTokenSession = authSource === 'env' || login.failure_reason === 'env_token_missing';
   const authPath = {
@@ -231,54 +230,10 @@ function buildAuthPath(login, env = process.env, runtime = null) {
       ? 'STOP_AND_REQUEST_ENV_TOKEN'
       : 'RUN_OPENYIDA_LOGIN_IF_USER_APPROVES',
   };
-  if (isQwenWorkWebRuntime(runtime) && !envTokenSession) {
-    const invocation = buildQwenWorkLoginInvocation({ subtype: 'qwenwork_web' });
-    authPath.auth_runtime = 'qwenwork_cloud_exchange';
-    authPath.interactive_login_allowed = true;
-    authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
-    for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
-    authPath.next_step = authPath.can_auto_use
-      ? 'Silently continue the requested business operation and report its business result.'
-      : 'Run the recommended login command silently. The CLI consumes cloud runtime credentials; do not inspect credentials, open a browser, or fall back to OAuth on failure.';
-    authPath.next_step_commands = authPath.can_auto_use ? [] : [invocation.command];
-    return authPath;
-  }
-  // 桌面换票仅由当前活跃宿主和发行配置共同启用，不影响其他宿主的认证路径。
-  if (localBeta?.desktopTicketLogin && runtime?.tool === 'qwenwork' && runtime?.subtype === 'qwenwork_desktop' && !envTokenSession) {
-    const invocation = buildQwenWorkLoginInvocation();
-    authPath.auth_runtime = 'qwenwork_desktop_exchange_ticket';
-    authPath.interactive_login_allowed = true;
-    authPath.missing_token_action = 'RUN_OPENYIDA_LOGIN_QWENWORK';
-    for (const key of ['auth_profile', 'corp_id', 'corp_name', 'user_id', 'user_name', 'store', 'persistence_scope', 'warning']) { delete authPath[key]; }
-    authPath.next_step = authPath.can_auto_use
-      ? 'Silently continue the requested business operation and report its business result.'
-      : `Run the recommended login command as returned: ${invocation.command}. No extra PATH or output setup is needed. After success silently continue the requested business operation. If it fails, follow the returned invocation guidance.`;
-    authPath.next_step_commands = authPath.can_auto_use ? [] : [invocation.command];
-  }
   return authPath;
 }
 
 function buildInteractiveLogin(auth, runtime) {
-  if (auth.auth_runtime === 'qwenwork_cloud_exchange' && isQwenWorkWebRuntime(runtime)) {
-    return {
-      mode: 'cloud_token', browser_default: 'not_required', browser_owner: 'none',
-      recommended_command: auth.can_auto_use ? null : buildQwenWorkLoginInvocation({ subtype: 'qwenwork_web' }).command,
-      invocation: buildQwenWorkLoginInvocation({ subtype: 'qwenwork_web' }),
-      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_login_qwenwork_and_wait',
-      user_visible: false, success_action: 'continue_business_command_without_message',
-      reason: 'qwenwork_web_cloud_credentials', completion_signal: 'process_exit_and_final_json', playwright_required: false,
-    };
-  }
-  if (auth.auth_runtime === 'qwenwork_desktop_exchange_ticket' && runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') {
-    return {
-      mode: 'desktop_ticket', browser_default: 'not_required', browser_owner: 'cli_if_auth_required',
-      recommended_command: auth.can_auto_use ? null : buildQwenWorkLoginInvocation().command,
-      invocation: buildQwenWorkLoginInvocation(),
-      agent_action: auth.can_auto_use ? 'continue_business_command' : 'run_login_qwenwork_and_wait',
-      user_visible: false, success_action: 'continue_business_command_without_message',
-      reason: 'qwenwork_desktop_pre_beta', completion_signal: 'process_exit_and_final_json', playwright_required: false,
-    };
-  }
   const base = {
     suppress_flag: '--no-browser',
     suppress_env: 'OPENYIDA_NO_BROWSER',
@@ -338,9 +293,9 @@ function buildInteractiveLogin(auth, runtime) {
 }
 
 function buildBuilderPath(login, projectRoot, manifest, env = process.env, runtimeSnapshot = null) {
-  const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
-  const auth = buildAuthPath(login, env, runtime);
+  const auth = buildAuthPath(login, env);
   const canTrustSummaryPreflight = auth.can_auto_use === true;
+  const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
 
   return {
     schema_version: 1,
@@ -356,13 +311,6 @@ function buildBuilderPath(login, projectRoot, manifest, env = process.env, runti
     auth,
     runtime,
     interactive_login: buildInteractiveLogin(auth, runtime),
-    communication: isQwenWorkWebRuntime(runtime) || (runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop') ? {
-      preparation_visibility: 'silent',
-      completion_content: 'business_result_and_business_link_only',
-      disclose_authentication_identity_environment: false,
-      report_preparation_only_when_user_action_is_required: true,
-      bundled_skill_path: path.resolve(__dirname, '../../yida-skills'),
-    } : undefined,
     environment_check_simplification: {
       contract_role: 'machine_readable_builder_runtime_not_yida_agent_business_logic',
       minimal_probe_commands: [
@@ -484,7 +432,6 @@ function compactBuilderPath(builderPath) {
     auth,
     runtime: builderPath.runtime,
     interactive_login: builderPath.interactive_login,
-    communication: builderPath.communication,
     environment_check_simplification: {
       minimal_probe_commands: environment.minimal_probe_commands,
       can_skip_default_exploration_when_summary_ok: environment.can_skip_default_exploration_when_summary_ok,
@@ -550,7 +497,7 @@ function buildApplicationEntryPolicy(builderPath, env = process.env) {
   return {
     schema_version: 1,
     environment: injectedAuthUsable ? 'managed_cloud_agent' : 'non_cloud_agent',
-    delivery_unit: 'single_application_entry_group',
+    ...buildEntryDeliveryPolicy(),
     resource_delivery: 'summary_only',
     internal_artifact_delivery: 'never',
     frontend_delivery: 'Infer standalone for a scoped service frontend, persist page navigation hiding and return the verified publish/get-form-config standaloneUrl. No extra flag or navigation URL parameter. Missing verification is incomplete delivery; never silently omit the frontend or replace it with workbench/admin.',
@@ -654,9 +601,7 @@ function buildAgentCapabilitiesSummary() {
     schema_version: 1,
     name: 'openyida-agent-capabilities-summary',
     version,
-    login: ['qwenwork_desktop_exchange_ticket', 'qwenwork_cloud_exchange'].includes(builderPath.auth.auth_runtime)
-      ? { status: loginStatus.status, can_auto_use: loginStatus.can_auto_use === true }
-      : compactLogin(loginStatus),
+    login: compactLogin(loginStatus),
     workdir: projectRoot,
     workdir_exists: !!projectResolution.exists,
     workdir_source: projectResolution.source,
@@ -756,7 +701,7 @@ function buildAgentCapabilities() {
       ],
       retry_policy: 'Do not repeat the same failed command without changing login state, organization, parameters, files, or field IDs.',
       completion_contracts: {
-        full_app: 'Default full-app build is complete after creating or reusing the app, core forms, primary page, publishing it, and returning one named application entry group. Summarize business resources in prose; do not deliver one artifact or link card per resource.',
+        full_app: 'Default full-app build is complete after creating or reusing the app, core forms, primary page, publishing it, and returning up to three verified application entry URLs, with runtime access and developer admin included by default. Summarize business resources in prose; do not deliver one artifact or link card per resource.',
       },
       full_app_data_contract: 'Default full-app page code must not call this.dataSourceMap.* unless the same run created and bound a designer data source; use this.utils.yida.* or an entry-only page by default.',
     },

package/lib/core/cli-error.js

@@ -101,7 +101,8 @@ function shouldUseStructuredErrorOutput(error, args = []) {
     && details.mutationPerformed === false
   );
   const navigationOrderFailure = /^NAV_ORDER_/.test(error.code || '');
-  return ownedPartial || mutationOutcomeUnknown || deterministicPreflightFailure || navigationOrderFailure;
+  const permissionRequired = !!details && details.status === 'permission_required';
+  return ownedPartial || mutationOutcomeUnknown || deterministicPreflightFailure || navigationOrderFailure || permissionRequired;
 }
 
 module.exports = {

package/lib/core/command-manifest.js

@@ -10,6 +10,29 @@ const { DIVIDER_TYPES, DEFAULT_DIVIDER_TYPE } = require('../app/form-field-valid
 const { FORMULA_COMMANDS } = require('../formula/cli-contract');
 const { printTemplateCommand, printTemplateEffects, printTemplatePermission } = require('../print-template/contract');
 
+/** 应用交付只约定入口内容；展示方式由宿主负责。 */
+function buildEntryDeliveryPolicy() {
+  return {
+    delivery_unit: 'application_entries',
+    presentation: 'host_managed',
+    entry_delivery: {
+      max_count: 3,
+      deduplicate_by: 'verified_url',
+      order: ['frontend', 'management', 'admin'],
+      by_scope: {
+        'service-management': ['frontend', 'management', 'admin'],
+        'frontend-only': ['frontend', 'admin'],
+        'backend-only': ['management', 'admin'],
+        unified: ['management', 'admin'],
+      },
+      explicit_user_exclusions: 'take_precedence',
+      resource_only: 'current_resource_only',
+      missing_entry: 'report_incomplete_without_guessing',
+    },
+  };
+}
+
+
 const SIDE_EFFECT_BASES = Object.freeze({
   local_read: Object.freeze({
     kind: 'local_read',
@@ -420,7 +443,6 @@ const COMMAND_SIDE_EFFECTS = new Map([
     'export-conversation',
     'flash-to-prd',
     'login',
-    'login-qwenwork',
     'logout',
     'sample',
     'update',
@@ -565,6 +587,13 @@ const COMMAND_SIDE_EFFECTS = new Map([
     note: 'Direct enable writes a durable local request receipt before the one-shot platform copy. AI build only validates the template and returns the native builder handoff.',
   })],
   ['data-card', sideEffect('mixed', { mutates_yida: true, mutates_local: true, read_actions: ['list', 'get', 'probe', 'release-check', 'refs'], mutating_actions: ['create', 'save', 'publish', 'release-get', 'release-save', 'release-test'], note: 'release-get reads broadcast settings but the native backend may initialize the application cool app; classify it conservatively as a possible mutation.' })],
+  ['plugin', sideEffect('mixed', {
+    mutates_yida: true,
+    mutates_local: true,
+    read_actions: ['dev-list', 'get', 'version-list', 'version-get', 'extensions', 'installed-list', 'installed-get', 'runtime-list', 'probe'],
+    mutating_actions: ['create', 'create-version', 'save-dev', 'configure', 'enable', 'disable', 'upgrade', 'uninstall'],
+    note: 'Organization-level YiDA plugin lifecycle. Writes require --confirm and deterministic readback; save-dev also writes a local backup.',
+  })],
   ['print-template', sideEffect('mixed', printTemplateEffects)],
   ['form-view', sideEffect('mixed', {
     mutates_yida: true,
@@ -588,7 +617,7 @@ const COMMAND_SIDE_EFFECTS = new Map([
     mutates_yida: false,
     mutates_local: true,
     read_actions: ['status', 'profiles', 'profile list'],
-    mutating_actions: ['login', 'refresh', 'logout', 'profile switch', 'qwenwork user-info'],
+    mutating_actions: ['login', 'refresh', 'logout', 'profile switch'],
   })],
   ['batch', sideEffect('mixed', {
     mutates_yida: true,
@@ -813,7 +842,6 @@ const COMMAND_PERMISSIONS = new Map([
 
   ...permissionEntries([
     'login',
-    'login-qwenwork',
     'logout',
     'update',
   ], permission('allow', 'external', {
@@ -866,6 +894,9 @@ const COMMAND_PERMISSIONS = new Map([
   ...permissionEntries(['cool-card'], actionDependentPermission({ preauthorized_actions: ['create'] })),
   ...permissionEntries(['solution-template'], actionDependentPermission({ ask_actions: ['enable'] })),
   ...permissionEntries(['data-card'], actionDependentPermission({ preauthorized_actions: ['create', 'save', 'publish', 'release-get'], ask_actions: ['release-save', 'release-test'] })),
+  ...permissionEntries(['plugin'], actionDependentPermission({
+    ask_actions: ['create', 'create-version', 'save-dev', 'configure', 'enable', 'disable', 'upgrade', 'uninstall'],
+  })),
   ...permissionEntries([
     'form-view',
   ], actionDependentPermission({
@@ -926,7 +957,7 @@ const COMMAND_PERMISSIONS = new Map([
   ...permissionEntries([
     'auth',
   ], actionDependentPermission({
-    preauthorized_actions: ['login', 'refresh', 'logout', 'profile switch', 'qwenwork user-info'],
+    preauthorized_actions: ['login', 'refresh', 'logout', 'profile switch'],
   })),
 
   ...permissionEntries([
@@ -1161,13 +1192,12 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [--qwenwork] [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', { managedRun: { scope: 'local', allowedFlags: ['--check-only', '--json', '--quiet'], requiredFlags: ['--check-only'] },
         requiresLogin: false,
         output: 'json',
       }),
-      command('login-qwenwork', ['login-qwenwork'], 'login-qwenwork --exchange-ticket <ticket> --ticket-context <json> [--json]', 'help.cmd_login_qwenwork', { managedRun: { scope: 'denied', reason: 'identity_exchange' }, requiresLogin: false, output: 'json', hidden: true }),
       command('logout', ['logout'], 'logout', 'help.cmd_logout', { managedRun: { scope: 'denied', reason: 'scope_not_audited' }, requiresLogin: false }),
-      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] }, qwenwork: { scope: 'denied', reason: 'identity_exchange' } } }, requiresLogin: false }),
+      command('auth', ['auth'], 'auth <status|login|refresh|logout|profiles|profile switch>', 'help.cmd_auth', { managedRun: { scope: 'actions', actions: { status: { scope: 'local', allowedFlags: ['--json', '--quiet'] } } }, requiresLogin: false }),
       command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org', { managedRun: { scope: 'denied', reason: 'scope_not_audited' } }),
       command('env', ['env'], 'env [--json|setup|list|show|switch|add|remove] [options]', 'help.cmd_env', { managedRun: { scope: 'local', allowedFlags: ['--json', '--quiet'] },
         requiresLogin: false,
@@ -1240,6 +1270,25 @@ const COMMAND_GROUPS = [
         examples: ['openyida data-card create APP_XXX --name "Sales summary" --json', 'openyida data-card get APP_XXX CARD-XXX --out card-schema.json --json'],
         notes: ['Native dataCardRpc resources. Agent use requires an explicit user choice of native YiDA data cards or continuation of an already explicit native-card task; generic cards, KPIs, dashboards or broadcasts do not trigger this capability. Metric cards rendered by custom page code belong to the page; an embedded CARD reference alone does not authorize changes to its native source. get defaults to the draft; --published reads the online schema. --out exports the complete schema without overwriting a file. save accepts either a complete exported --schema or a simplified --config with charts and optional select filters (legacy indicators remains compatible), appending verified native components. Supports indicator/bar/line/pie/table/combo/gauge/funnel/calendarheatmap with real form fields, aggregates and date grain. Six-column layout, full-width tables and optional gauge min/max ranges. Five chart maximum; filters link only within the same source. probe performs read-only CARD runtime queries and returns component data; a saved schema alone is not runtime evidence. Numeric fields support COUNT/SUM/AVG/MIN/MAX; text and serial fields support COUNT. Config generation preserves the existing page and rejects unsupported keys/types. save requires its original --expected-hash; backs up and rereads before writing, then verifies readback. publish requires the current draft hash, backs up, and verifies the published schema, version and state; it does not save unsent local edits. Hash checks are not atomic server locking. New i18n bindings are synchronized before saving. Writes are not automatically replayed. Preserve platform permission and entitlement errors; never alter quotas or app tags. release-get exports broadcast configuration and releaseHash; the native GET may initialize a cool app and is conservatively classified as a possible mutation; release-save requires its original --expected-hash, backup and verified readback. Enabled schedules require explicit --allow-send; release-test also requires --allow-send and only requests a test to the current operator. release-check checks published state and broadcast entitlement; refs queries portal usage records. Group delivery still requires installation in DingTalk. Successful save or test acceptance does not prove delivery. The CLI does not mount portal components or delete cards. Mutation receipts refresh the app using the existing update_app_setting operation.'],
       }),
+      command('plugin', ['plugin'], 'plugin <dev-list|get|version-list|version-get|extensions|installed-list|installed-get|runtime-list|probe|create|create-version|save-dev|configure|enable|disable|upgrade|uninstall> [pluginId] [version] [options]', 'plugin_lifecycle.description', {
+        managedRun: { scope: 'denied', reason: 'organization_level_plugin_lifecycle' },
+        output: 'json',
+        args: [
+          { name: 'action', type: 'string', source: 'positional', position: 0, required: true },
+          { name: 'pluginId', type: 'string', source: 'positional', position: 1 },
+          { name: 'version', type: 'string', source: 'positional', position: 2 },
+          { name: 'config', type: 'file', source: 'option', builder_options: ['--config'] },
+          { name: 'expectedHash', type: 'string', source: 'option', builder_options: ['--expected-hash'] },
+          { name: 'backup', type: 'file', source: 'option', builder_options: ['--backup'] },
+          { name: 'extensions', type: 'string', source: 'option', builder_options: ['--extensions'] },
+          { name: 'checkResource', type: 'boolean', source: 'option', builder_options: ['--check-resource'] },
+          { name: 'type', type: 'string', source: 'option', builder_options: ['--type'], description: 'create only: connector (default) or other; custom-page extensions use other.' },
+          { name: 'confirm', type: 'boolean', source: 'option', builder_options: ['--confirm'] },
+          { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
+        ],
+        examples: ['openyida plugin dev-list --search AI --json', 'openyida plugin runtime-list --extensions yida.app.custom-page.component --json', 'openyida plugin create --type other --name Timeline --description "Custom page timeline" --logo https://example.com/logo.png --confirm --json'],
+        notes: ['YiDA platform plugins, not npm packages or Codex plugins. Read commands separate persisted developer configuration, static resource reachability, runtime registry candidates, enabled state, and actual consumer execution. runtime-list includes disabled candidates and does not prove that an application consumed one. probe --check-resource sends a read-only HEAD request to the resolved HTTPS entry. save-dev and configure require the original hash and a non-overwriting backup; save-dev validates extension IDs and never publishes. Organization-wide writes require --confirm and readback. disable follows platform semantics: it blocks new selection but may not unload existing uses. The CLI intentionally does not publish/release/delete developer plugins or install from the market.'],
+      }),
       command('app-entry.get', ['app-entry', 'get'], 'app-entry get <appType> [--json]', 'app_entry.desc_get', { managedRun: {'scope':'app','appPosition':1},
         args: [{ name: 'appType', type: 'string', source: 'positional', position: 0, required: true },
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] }],
@@ -1292,7 +1341,7 @@ const COMMAND_GROUPS = [
         output: 'json',
       }),
       command('create-app', ['create-app'], 'create-app "<name>"|--name <name> [options] [--locale zh_CN|en_US|ja_JP] [--open|--no-open]', 'help.cmd_create_app', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
-        notes: ['Successful results include appUrl/workbenchUrl for the business workspace and adminUrl for developer administration. Complete application delivery retains adminUrl regardless of auth runtime; route construction does not verify recipient access. Preserve the frontend URL from its own page result.'],
+        notes: ['Successful results include appUrl/workbenchUrl for the business workspace and adminUrl for developer administration. Complete application delivery retains adminUrl regardless of auth runtime; route construction does not verify recipient access. Preserve the frontend URL from its own page result.', 'In QwenWork, permission failures return a nonzero exit and structured status=permission_required. YIDA_PLATFORM_ACCESS_REQUIRED and YIDA_APP_CREATE_PERMISSION_REQUIRED include details.permissionLabel/permissionUrl and nextAction.label/url; YIDA_PERMISSION_REQUIRED preserves an unclassified permission reason without inventing a link. Explain the missing permission, display the semantic label as a Markdown link to its paired URL (or reuse nextStep), and pause resource writes; do not automatically open it, send an application, switch spaces, log in again or retry creation. Resume only after the user requests continuation and the host identity, organization and permissions are verified.'],
       }),
       command('design-plan.catalog', ['design-plan', 'catalog'], 'design-plan catalog [--json]', 'help.cmd_design_plan_catalog', { managedRun: { scope: 'local' },
         requiresLogin: false, output: 'json',
@@ -2367,7 +2416,7 @@ function summarizeLocalizedCommands(commands) {
         product_design_policy: 'yida-requirement-analysis owns shared facts and first-time intake. yida-prd owns business planning; yida-design owns visual design. Reuse the same confirmed brief and supplied details. Prepare business and base visuals concurrently, then bind visuals to settled page tasks. yida-app merges and checks the artifacts before creating resources. Plan authors scope, data and rules, page organization, business interactions and acceptance once. Ordered blocks {name,purpose} supply default priority and content layers; explicit designs remain authoritative. Project-specific acceptance criteria are merged with generated resource checks. Plan uses the compact authoring contract and selected theme context; the CLI reads full templates and renders all artifacts. Fast, Plan and single-page design share yida-design/templates/design-themes and visual_decision_policy: infer directly from supplied style intent or extracted reference DNA, and use the shared three-direction rule only when comparison is needed. Theme templates declare application-global variables from basic-tokens.json with fixed typography, spacing and Tooltip colors, plus scoped custom-page variables; component recipes consume those variables. Each selected template is the authority for navTheme, its six navigation color tokens, and its selected-item shadow token; free-creative authors its own navigation tone and tokens. Explicit project customization stays in visualStyle.tokens. The CLI declares each fixed application palette once in a shared :root and platform-mode selector block. The CLI preserves mode-independent navigation appearance tokens. Light, dark, white and gray mode classes consume the same project tokens; navTheme remains platform metadata, not a second palette. Legacy generated mode blocks are consolidated on update, while unrelated custom CSS is preserved.',
         ui_guidance_policy: 'Page implementation consumes yida-prd prd.md for positioning, information architecture, page prototype, native form entry policy, material strategy, business-specific checks, resource creation order, page implementation delivery order, navigation order, and acceptance criteria; it consumes yida-design design.md for app custom theme CSS delivery, themeColor/navTheme, visual states, visualScaffold, surface material, rounded rules, density rules, components, state styling, and page-level imageNeed. When a page is imageNeed=required, or beneficial with declared image slots, yida-image-assets prepares a traceable asset manifest alongside page layout and interaction work; wait for final images only at that page\'s image binding and acceptance. imageNeed=none skips the branch. prd.md and design.md remain the only design sources of truth. Page implementation may extract page-spec.json as a derived implementation handoff from prd.md + design.md; conflicts are resolved by sending business conflicts to yida-prd and visual conflicts to yida-design before regenerating the spec. Core normal forms default to 1-3 business sample records before page implementation, followed by query readback. An explicit opt-out, configuration dictionary, sensitive data, or lack of safely constructible values requires a recorded skip reason. Screenshots, public sharing, data-source deep binding, and fine navigation grouping are optional after explicit user request or PRD acceptance criteria.',
         default_nav_order_policy: 'For application-wide custom navigation, implement each entry menu and verify app/page navigation hiding. A standalone frontend preserves platform navigation for the management workspace; frontend-only delivery skips platform ordering. After all scoped resources and page publications finish, perform exactly one navigation order operation. Use management tasks and their default destination, without creating a homepage or putting a frontend page first. When execution.entryRecommendation exists, derive navigationOrder from its management/workspace menus. Call openyida nav-group order <appType> <items...> for an explicit order; otherwise call openyida nav-group auto-order <appType> once for legacy single-workspace plans. Do not use openyida publish ... --auto-nav-order for per-page application builds. Explicit and automatic ordering are mutually exclusive; never generate per-item move loops.',
-        final_link_policy: 'Return exactly one user-visible application entry group, never one artifact or link card per form, process, report, schema, manifest, PRD, design file, or intermediate artifact. Include one verified management entry when a management or unified workspace is in scope: the app workbench URL or a planned workbench/formUuid URL with its real viewUuid. Backend-only returns its verified business backend entry and developer admin URL without adding a frontend. Native management does not require a display homepage; frontend-only delivery includes its verified frontend entry and developer admin URL, without inventing a business backend. For scoped service frontend pages, infer standalone when entryMode is missing; preserve an explicit platform-shell choice and its verified workbenchUrl. Add the clean custom page URL only for standalone pages when get-form-config readback confirms renderNav=false (fallback to isRenderNav only when renderNav is absent). Complete application delivery defaults to 2-3 distinct entries: frontend or unified workspace, business backend when separately planned, and developer admin. agent-capabilities application_entry_policy.entries.admin=include is independent of auth runtime. Read adminUrl from create-app or app-list results; route construction does not verify recipient permissions. Explicit user exclusions take precedence; single-page tasks retain their scope. Put the business summary, verification results and remaining work in the terminal delivery artifact description; when no delivery tool is available, return the same content and entry group in the final response. Summarize business resources by capability or count, but every resource count, seed-record count, and completed/verified claim must come from that resource\'s own successful result or readback. When the user or caller explicitly requests a resource manifest, resource UUIDs/IDs, publish status, or test-data summary, include one concise verified delivery manifest in that description (or the final response when no delivery tool is available).',
+        final_link_policy: 'Return up to three verified application entry URLs in frontend, business management, developer admin order; default complete delivery includes runtime access and developer admin. Never emit one artifact or link card per form, process, report, schema, manifest, PRD, design file, or intermediate artifact. Include one verified management entry when a management or unified workspace is in scope: the app workbench URL or a planned workbench/formUuid URL with its real viewUuid. Backend-only returns its verified business backend entry and developer admin URL without adding a frontend. Native management does not require a display homepage; frontend-only delivery includes its verified frontend entry and developer admin URL, without inventing a business backend. For scoped service frontend pages, infer standalone when entryMode is missing; preserve an explicit platform-shell choice and its verified workbenchUrl. Add the clean custom page URL only for standalone pages when get-form-config readback confirms renderNav=false (fallback to isRenderNav only when renderNav is absent). agent-capabilities application_entry_policy.entries.admin=include is independent of auth runtime. Read adminUrl from create-app or app-list results; route construction does not verify recipient permissions. Explicit user exclusions take precedence; single-page tasks retain their scope. QwenWork owns link, file and result presentation; return the verified summary and URLs without prescribing styles, card counts, display tools or update identifiers. Other hosts may use their terminal delivery artifact description; return the same concise content when no delivery tool is available. Summarize business resources by capability or count, but every resource count, seed-record count, and completed/verified claim must come from that resource\'s own successful result or readback. When the user or caller explicitly requests a resource manifest, resource UUIDs/IDs, publish status, or test-data summary, include one concise verified delivery manifest in that description (or the final response when no delivery tool is available).',
         entry_navigation_contract: {
           reference: 'yida-skills/skills/yida-app/references/entry-navigation.md',
           brief_path: 'entryRecommendation',
@@ -2410,10 +2459,10 @@ function summarizeLocalizedCommands(commands) {
           },
         },
         application_entry_policy: {
-          delivery_unit: 'single_application_entry_group',
+          ...buildEntryDeliveryPolicy(),
           persistence: {
             command_ids: ['app-entry.get', 'app-entry.set'],
-            policy: 'Before final complete-application delivery, registration and readback of all verified in-scope business runtime entries is required by default: service-management writes both, frontend-only writes frontend, backend-only/unified writes management. Resolve each planned default resource/view independently; never reuse the last published page or substitute a root workbench for a task URL. Use readback urls.frontend/management for final cards. Existing identical entries can reuse the readback; set performs partial merge and readback. Missing verification or failed persistence is incomplete delivery, not a reason to emit guessed links. Respect explicit no-write constraints. Do not register admin/design URLs. Incremental resource-only work preserves existing entries. Clear only on explicit removal. Conflicts require reread and review, never blind retries.',
+            policy: 'Before final complete-application delivery, registration and readback of all verified in-scope business runtime entries is required by default: service-management writes both, frontend-only writes frontend, backend-only/unified writes management. Resolve each planned default resource/view independently; never reuse the last published page or substitute a root workbench for a task URL. Use readback urls.frontend/management for final entry URLs. Existing identical entries can reuse the readback; set performs partial merge and readback. Missing verification or failed persistence is incomplete delivery, not a reason to emit guessed links. Respect explicit no-write constraints. Do not register admin/design URLs. Incremental resource-only work preserves existing entries. Clear only on explicit removal. Conflicts require reread and review, never blind retries.',
           },
           workbench: {
             include: 'when_workspace_in_scope',
@@ -2465,7 +2514,7 @@ function summarizeLocalizedCommands(commands) {
           'yida-data-source-connectors',
           'yida-dashboard',
         ],
-        completion_contract: 'Clarify core functions and actual usage first, then resolve the required resource context and settle entry navigation before PRD planning. Fast generates prd.md and design.md in parallel; Plan uses design-plan init/preview/materialize/patch and confirms the current revision. Validate both artifacts, create or reuse app and core forms/processes, seed and query-check core normal-form samples or record an allowed skip reason, then implement the primary page in PRD resource order, publish it, apply PRD navigation order or lightweight fallback navigation order for platform navigation, or verify app and per-page hiding for application-wide custom navigation. For a standalone frontend in a platform-navigation app, verify that page independently and retain workspace navigation. Before returning one named application entry group, persist and read back the verified in-scope frontend/management access addresses through app-entry get/set; final business links come from urls.frontend/management, not the last publish result. Include workbench when a management or unified workspace is in scope; backend-only delivers its business backend and developer admin URL without adding a frontend; frontend-only delivery includes its verified frontend entry and developer admin URL, without inventing a business backend. Always include developer adminUrl for complete application delivery unless explicitly excluded by the user, regardless of auth runtime; this is separate from the optional business backend. Use create-app or app-list URL fields and state any unavailable entry instead of silently omitting it. Put the verified business summary, results and remaining work in the delivery artifact description; use the final response when no delivery tool is available.',
+        completion_contract: 'Clarify core functions and actual usage first, then resolve the required resource context and settle entry navigation before PRD planning. Fast generates prd.md and design.md in parallel; Plan uses design-plan init/preview/materialize/patch and confirms the current revision. Validate both artifacts, create or reuse app and core forms/processes, seed and query-check core normal-form samples or record an allowed skip reason, then implement the primary page in PRD resource order, publish it, apply PRD navigation order or lightweight fallback navigation order for platform navigation, or verify app and per-page hiding for application-wide custom navigation. For a standalone frontend in a platform-navigation app, verify that page independently and retain workspace navigation. Before returning up to three verified application entry URLs, persist and read back the verified in-scope frontend/management access addresses through app-entry get/set; final business links come from urls.frontend/management, not the last publish result. Include workbench when a management or unified workspace is in scope; backend-only delivers its business backend and developer admin URL without adding a frontend; frontend-only delivery includes its verified frontend entry and developer admin URL, without inventing a business backend. Always include developer adminUrl for complete application delivery unless explicitly excluded by the user, regardless of auth runtime; this is separate from the optional business backend. Use create-app or app-list URL fields and state any unavailable entry instead of silently omitting it. Put the verified business summary, results and remaining work in the delivery artifact description; use the final response when no delivery tool is available.',
       },
     },
   };
@@ -2501,6 +2550,7 @@ function buildCommandManifest(options = {}) {
 module.exports = {
   COMMAND_GROUPS,
   buildCommandManifest,
+  buildEntryDeliveryPolicy,
   findCommandSuggestion,
   findForbiddenAliasSuggestion,
   flattenCommandManifest,

package/lib/core/locales/en.js

@@ -4,21 +4,7 @@
 'use strict';
 
 module.exports = {
-  qwenwork: {
-    login_check_failed: 'Unable to verify the login session. Please retry.',
-    desktop_login_failed: 'QwenWork desktop login failed. Check the desktop identity and login handoff before retrying.',
-    desktop_login_usage: 'Usage: openyida login --qwenwork [--json] [--check-only]',
-    desktop_login_standalone: 'Run the recommended login command directly: {0}. No extra PATH or output setup is needed. After success continue the business operation silently; on failure follow the returned guidance.',
-    credential_missing: 'No cloud Agent credential is available. Run this command inside the QwenWork cloud execution environment.',
-    gateway_missing: 'QWENWORK_GATEWAY_URL or MULE_GATEWAY_URL is required.',
-    invalid_url: 'The QwenWork gateway must use HTTPS (HTTP is allowed only for loopback) and contain no credentials, query or fragment.',
-    request_failed: 'The QwenWork request failed. Check the stage and HTTP status in the diagnostic details.',
-    request_timeout: 'The QwenWork request timed out.',
-    invalid_response: 'QwenWork returned an invalid authentication or identity response.',
-    identity_mismatch: 'The returned QwenWork identity does not match the cloud execution context or exchanged credential.',
-    expired_token: 'QwenWork returned an expired user credential.',
-    usage: 'Usage: openyida auth qwenwork user-info [--json]',
-  },
+  plugin_lifecycle: { description: 'Manage YiDA platform plugin versions, installation state, and runtime registrations', failed: 'Plugin operation stopped: {0}', usage: 'Usage: openyida plugin <dev-list|get|version-list|version-get|extensions|installed-list|installed-get|runtime-list|probe|create|create-version|save-dev|configure|enable|disable|upgrade|uninstall> [pluginId] [version] [options]; create accepts --type connector|other; use other for custom-page extensions' },
   print_template: {
     'description': 'Manage native YiDA print templates, generate document layouts, back up, restore and request PDFs',
     'error': 'Print template operation failed: {0}',
@@ -191,7 +177,6 @@ module.exports = {
     alias: 'Alias:',
     group_auth: 'Auth & Environment',
     cmd_login: 'Login with OAuth token mode',
-    cmd_login_qwenwork: 'Log in to YiDA with a one-time QwenWork exchange ticket',
     cmd_logout: 'Logout / unbind current project auth',
     cmd_auth: 'Token login state and profile management',
     cmd_agent: 'Connect a local Agent (Go runtime, development preview)',
@@ -520,10 +505,10 @@ Examples:
     save_permission_usage: 'Usage: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>] [--package-type <FORM_PACKAGE_VIEW|FORM_PACKAGE_START>]',
     save_permission_example: "Example: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ Execution failed: {0}',
-    login_usage: 'Usage: openyida login [--qwenwork] [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
     login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
-    auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]',
+    auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
     auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
     org_usage: 'Usage: openyida org <list|switch> [--json] [--corp-id <corpId>]',
     org_example: 'Examples:\n  openyida org list --json                    # List accessible organizations\n  openyida org switch --corp-id dingXXX       # Switch existing profiles first; login to add one if missing',
@@ -1178,7 +1163,7 @@ Examples:
 
   import_example2: '      openyida import ./yida-export.json "Quality Traceability System (Production)"',
   exec_failed: '\n❌ Execution failed: {0}',
-  auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch|qwenwork user-info> [--json]',
+  auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
   auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
   org_usage: 'Usage: openyida org <list|switch> [--json] [--corp-id <corpId>]',
   org_example: 'Examples:\n  openyida org list --json                    # List accessible organizations\n  openyida org switch --corp-id dingXXX       # Switch existing profiles first; login to add one if missing',
@@ -2609,3 +2594,12 @@ module.exports.feedback_github = {
 };
 
 module.exports.process_dynamic_actors = { invalid: 'Invalid process actor configuration. Check details.reason, selection range and actual member fields.' };
+
+module.exports.permission_guidance = {
+  platform_access_link: 'Request YiDA access',
+  create_app_link: 'Request permission to create YiDA applications',
+  platform_access: 'The current account is not authorized to use YiDA in this organization.',
+  create_app: 'The current account cannot create applications in this organization.',
+  unknown: 'Permission denied; the permission type is unconfirmed. Contact an administrator and pause this operation.',
+  next_step: 'Open the permission request page: [{0}]({1}). After completing it, verify the current organization and permissions before continuing.',
+};