openyida 2026.10.29-beta.2 → 2026.10.29-beta.3

package/README.md

@@ -145,12 +145,16 @@ openyida auth status
 
 In QwenWork web, `openyida login --qwenwork --json` (or ordinary `login`) sends the sandbox Agent Token and gateway origin directly to the selected YiDA authentication endpoint. YiDA validates the identity through the trusted gateway’s fixed `/api/agent-gw/yida/user_info` endpoint, then issues its own short-lived session. This login flow no longer calls the legacy exchange or `/user/info` endpoints. Login preparation stays silent; failures stop without browser OAuth. Desktop and other hosts retain their existing authentication paths.
 
+QwenWork login supports DingTalk organizations, QwenWork organizations and personal ODS identities. Local ODS tenant IDs retain their `yida` prefix. When the server supplies a refresh token, the CLI stores it for the standard refresh flow. Optional server fields `identity_type` (`PERSONAL` / `ORGANIZATION`) and `organization_type` (`DINGTALK` / `QWENWORK` / `OTHER`, organizations only) are preserved in the session and `auth status`; historical sessions with both fields absent, null or empty default to `ORGANIZATION` / `DINGTALK`. Authentication failures expose bounded `status`, `stage`, `exchange_id`, HTTP `status_code` and local validation `reason` in JSON diagnostics, without response bodies or credentials.
+
 For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
 
 ```bash
 openyida auth qwenwork user-info --json
 ```
 
+This diagnostic command uses the legacy user-token protocol; it does not validate the current web Agent Token login flow. Use `openyida login --check-only --json` to check the YiDA session.
+
 This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
 
 Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.

package/lib/auth/org.js

@@ -19,6 +19,10 @@ const {
   saveTokenSession,
 } = require('./token-store');
 const { tokenLogin } = require('./token-auth');
+const { sessionIdentity } = require('./session-identity');
+const { detectRuntimeCapabilities } = require('../core/utils');
+const { isQwenWorkWebRuntime } = require('../core/qwenwork-login-guidance');
+const { t } = require('../core/i18n');
 
 const LIST_CORP_INFOS_PATH = '/query/userservice/listCorpInfos.json';
 
@@ -146,6 +150,7 @@ function buildSwitchResult(status, currentSession, nextSession, message, extra =
     auth_mode: 'token',
     status,
     can_auto_use: true,
+    ...sessionIdentity(nextSession),
     previous_corp_id: currentSession && currentSession.corp_id,
     corp_id: nextSession.corp_id,
     corp_name: nextSession.corp_name,
@@ -191,6 +196,7 @@ async function switchOrganization(targetCorpId, options = {}) {
       ok: true,
       auth_mode: 'token',
       status: 'already_in_org',
+      ...sessionIdentity(currentSession),
       can_auto_use: true,
       corp_id: currentSession.corp_id,
       corp_name: currentSession.corp_name,
@@ -231,7 +237,12 @@ async function switchOrganization(targetCorpId, options = {}) {
     corpId: targetCorpId,
   };
 
-  const login = options.tokenLogin || tokenLogin;
+  const cloud = isQwenWorkWebRuntime(options.runtime || detectRuntimeCapabilities({ env: options.env || process.env }));
+  const login = options.tokenLogin || (cloud ? async opts => {
+    const { ensureQwenWorkLogin } = require('./qwenwork-login');
+    await ensureQwenWorkLogin(opts);
+    return loadTokenSession(opts);
+  } : tokenLogin);
   const temporaryLogin = createTemporaryLoginOptions(loginOptions);
   let loginResult;
   try {
@@ -266,8 +277,8 @@ async function switchOrganization(targetCorpId, options = {}) {
     'switched',
     currentSession,
     savedSession,
-    'switched organization by OAuth login',
-    { switch_source: 'oauth_login' }
+    cloud ? t('qwenwork.organization_switch_success') : 'switched organization by OAuth login',
+    { switch_source: cloud ? 'qwenwork_cloud' : 'oauth_login' }
   );
 }
 

package/lib/auth/qwenwork-cloud.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { sessionIdentity } = require('./session-identity');
+
 const { CliError } = require('../core/cli-error');
 const { t } = require('../core/i18n');
 const { DINGTALK_OAUTH_CLIENT_ID } = require('../core/env-manager');
@@ -9,12 +11,30 @@ function failure(code, details = {}) {
   return new CliError(t('qwenwork.login_check_failed'), { code: `QWENWORK_CLOUD_${code}`, details });
 }
 
-function origin(value) {
+const ODS_CORP_ID = /^yida[0-9a-f]{32}$/;
+const CORP_ID = /^(?:(?:ding|yida)[0-9a-f]{32}|dingd8e1123006514592)$/;
+
+// Only bounded protocol identifiers are diagnostic data; never forward the response body or message.
+function diagnostics(value, statusCode, credential = {}) {
+  const details = { stage: 'yida_exchange', status_code: statusCode };
+  if (!value || typeof value !== 'object' || Array.isArray(value)) { return details; }
+  const secrets = [credential.access_token, value.access_token, value.refresh_token, value.refreshToken].filter(token => typeof token === 'string' && token);
+  const publicValue = text => typeof text === 'string' && !secrets.some(token => text.includes(token));
+  if (publicValue(value.status) && value.status.length <= 64 && /^(?:ok|error|failure|[a-z][a-z0-9]*_[a-z0-9_]+)$/.test(value.status)
+    && !/^(?:qwex|dws)_/.test(value.status)) { details.status = value.status; }
+  if (publicValue(value.stage) && ['request', 'qwen_verify', 'token_issue'].includes(value.stage)) { details.stage = value.stage; }
+  if (publicValue(value.exchange_id) && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value.exchange_id)) {
+    details.exchange_id = value.exchange_id;
+  }
+  return details;
+}
+
+function origin(value, details = {}) {
   try {
     const url = new URL(value);
     if (typeof value !== 'string' || value.length > 2048 || /\s/.test(value) || url.protocol !== 'https:' || url.username || url.password || url.pathname !== '/' || url.search || url.hash) { throw new Error(); }
     return url.origin;
-  } catch { throw failure('ENDPOINT_INVALID'); }
+  } catch { throw failure('ENDPOINT_INVALID', details); }
 }
 
 async function exchangeSession(credential, baseUrl, options) {
@@ -26,27 +46,29 @@ async function exchangeSession(credential, baseUrl, options) {
     const response = await (options.fetch || globalThis.fetch)(`${baseUrl}/openapi/cli/v1/auth/qwenwork/token`, {
       method: 'POST', redirect: 'error', signal: controller.signal,
       headers: { authorization: `Bearer ${credential.access_token}`, accept: 'application/json', 'content-type': 'application/json' },
-      body: JSON.stringify({ gateway_url: credential.base_url, ...(options.corpId ? { corp_id: options.corpId } : {}) }),
+      // corp_id selects a DingTalk organization upstream; ODS identity is checked locally after exchange.
+      body: JSON.stringify({ gateway_url: credential.base_url, ...(options.corpId && !ODS_CORP_ID.test(options.corpId) ? { corp_id: options.corpId } : {}) }),
     });
-    if (!response.ok) {
-      await response.body?.cancel();
-      throw failure('HTTP_ERROR', { stage: 'yida_exchange', status_code: response.status });
-    }
     const reader = response.body?.getReader();
-    if (!reader) { throw failure('RESPONSE_INVALID'); }
+    if (!reader) { throw failure(response.ok ? 'RESPONSE_INVALID' : 'HTTP_ERROR', diagnostics(null, response.status)); }
     const chunks = []; let bytes = 0;
     try {
       for (let part = await reader.read(); !part.done; part = await reader.read()) {
         bytes += part.value.byteLength;
-        if (bytes > 65536) { await reader.cancel(); throw failure('RESPONSE_INVALID'); }
+        if (bytes > 65536) { await reader.cancel(); throw failure(response.ok ? 'RESPONSE_INVALID' : 'HTTP_ERROR', { ...diagnostics(null, response.status), reason: 'response_too_large' }); }
         chunks.push(part.value);
       }
     } finally { reader.releaseLock(); }
-    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    let value;
+    try { value = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
+    catch { throw failure(response.ok ? 'RESPONSE_INVALID' : 'HTTP_ERROR', { ...diagnostics(null, response.status), reason: 'invalid_json' }); }
+    const details = diagnostics(value, response.status, credential);
+    if (!response.ok) { throw failure('HTTP_ERROR', details); }
+    return { value, details };
   } catch (error) {
     // 上游正文和异常可能回显凭据，仅保留本模块生成的固定错误码。
     if (error instanceof CliError && /^QWENWORK_CLOUD_/.test(error.code)) { throw error; }
-    throw failure(controller.signal.aborted ? 'REQUEST_TIMED_OUT' : 'REQUEST_FAILED');
+    throw failure(controller.signal.aborted ? 'REQUEST_TIMED_OUT' : 'REQUEST_FAILED', { stage: 'yida_exchange' });
   } finally { clearTimeout(timer); }
 }
 
@@ -67,24 +89,38 @@ async function exchangeQwenWorkCloudSession(options = {}) {
   const credential = sandboxCredential(options);
   try {
     const startedAt = Date.now();
-    const value = await exchangeSession(credential, baseUrl, options);
-    if (!value || value.status !== 'ok' || value.auth_mode !== 'token' || value.can_auto_use !== true ||
-      value.token_type !== 'Bearer' || value.credential_source !== 'qwenwork_cloud' ||
-      typeof value.access_token !== 'string' || !value.access_token || /\s/.test(value.access_token) || value.access_token.length > 32768 ||
-      value.access_token === credential.access_token ||
-      ['QWENWORK_AGENT_TOKEN', 'MULE_AGENT_TOKEN', 'AGENT_TOKEN'].some(name => value.access_token === (options.env || process.env)[name]) ||
-      !Number.isInteger(value.expires_in) || value.expires_in <= 0 || value.expires_in > 1800 ||
-      typeof value.corp_id !== 'string' || !/^(?:ding[0-9a-f]{32}|dingd8e1123006514592)$/.test(value.corp_id) ||
-      typeof value.user_id !== 'string' || !value.user_id || value.user_id.trim() !== value.user_id || value.user_id.length > 256 ||
-      (options.corpId && value.corp_id !== options.corpId) ||
-      (options.userId && value.user_id !== options.userId) ||
-      'exchange_ticket' in value) { throw failure('RESPONSE_INVALID'); }
+    const { value, details } = await exchangeSession(credential, baseUrl, options);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) { throw failure('RESPONSE_INVALID', { ...details, reason: 'response_shape' }); }
+    if (value.status !== 'ok') { throw failure('EXCHANGE_REJECTED', details); }
+    const env = options.env || process.env;
+    const hostTokens = ['QWENWORK_AGENT_TOKEN', 'MULE_AGENT_TOKEN', 'AGENT_TOKEN'].map(name => env[name]).filter(Boolean);
+    const validToken = token => typeof token === 'string' && !!token && !/\s/.test(token) && token.length <= 32768 && !hostTokens.includes(token);
+    // Older cloud deployments may return access-only sessions. Preserve a refresh token when supplied.
+    const refreshToken = value.refresh_token === undefined ? value.refreshToken : value.refresh_token;
+    const invalid = [
+      [value.auth_mode !== 'token', 'auth_mode'],
+      [value.can_auto_use !== true, 'can_auto_use'],
+      [value.token_type !== 'Bearer', 'token_type'],
+      [value.credential_source !== 'qwenwork_cloud', 'credential_source'],
+      [!validToken(value.access_token), 'access_token'],
+      [!Number.isInteger(value.expires_in) || value.expires_in <= 0 || value.expires_in > 1800, 'expires_in'],
+      [typeof value.corp_id !== 'string' || !CORP_ID.test(value.corp_id), 'corp_id'],
+      [typeof value.user_id !== 'string' || !value.user_id || value.user_id.trim() !== value.user_id || value.user_id.length > 256, 'user_id'],
+      [options.corpId && value.corp_id !== options.corpId, 'corp_id_mismatch'],
+      [options.userId && value.user_id !== options.userId, 'user_id_mismatch'],
+      ['exchange_ticket' in value, 'exchange_ticket'],
+      [refreshToken !== undefined && !validToken(refreshToken), 'refresh_token'],
+      [value.client_id !== undefined && value.client_id !== (options.clientId || DINGTALK_OAUTH_CLIENT_ID), 'client_id'],
+    ].find(([rejected]) => rejected);
+    if (invalid) { throw failure('RESPONSE_INVALID', { ...details, reason: invalid[1] }); }
     return {
+      ...sessionIdentity(value),
       auth_mode: 'token', credential_source: 'qwenwork_cloud', token_type: 'Bearer',
       // 可信宜搭签发服务决定业务域名；认证请求仍只发往最初选择的 origin。
-      access_token: value.access_token, base_url: value.base_url === undefined ? baseUrl : origin(value.base_url),
+      access_token: value.access_token, refresh_token: refreshToken, base_url: value.base_url === undefined ? baseUrl : origin(value.base_url, { ...details, reason: 'base_url' }),
       client_id: options.clientId || DINGTALK_OAUTH_CLIENT_ID,
       corp_id: value.corp_id, user_id: value.user_id,
+      user_name: typeof value.user_name === 'string' ? value.user_name : undefined,
       expires_at: startedAt + value.expires_in * 1000,
     };
   } finally { credential.access_token = undefined; }

package/lib/auth/qwenwork-desktop.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { sessionIdentity } = require('./session-identity');
+
 const { CliError } = require('../core/cli-error');
 const { buildQwenWorkLoginInvocation } = require('../core/qwenwork-login-guidance');
 const { t } = require('../core/i18n');
@@ -114,6 +116,7 @@ async function loginQwenWork(options = {}) {
   if (verified.status !== 'ok' || verified.auth_mode !== 'token' || verified.can_auto_use !== true ||
     verified.corp_id !== value.corp_id || verified.user_id !== value.user_id || expiresAt <= Date.now()) { throw fail('IDENTITY_MISMATCH'); }
   const session = saveTokenSession({
+    ...sessionIdentity(value),
     auth_mode: 'token', token_type: 'Bearer', access_token: value.access_token, refresh_token: value.refresh_token,
     expires_at: expiresAt, base_url: businessBaseUrl, client_id: DINGTALK_OAUTH_CLIENT_ID,
     corp_id: value.corp_id, user_id: value.user_id, credential_source: 'qwenwork_desktop',
@@ -122,8 +125,8 @@ async function loginQwenWork(options = {}) {
   if (!['user', 'project'].includes(session.persistence_scope) || !restored ||
     restored.access_token !== value.access_token || restored.refresh_token !== value.refresh_token || restored.base_url !== businessBaseUrl ||
     restored.corp_id !== value.corp_id || restored.user_id !== value.user_id) { throw fail('PERSISTENCE_FAILED'); }
-  // 身份、环境和存储细节仅用于内部校验，不进入模型可见的登录结果。
-  return { ok: true, status: 'ok', can_auto_use: true };
+  // 只返回分类和登录结果；组织/用户标识、环境和存储细节不进入模型可见结果。
+  return { ok: true, status: 'ok', can_auto_use: true, ...sessionIdentity(session) };
 }
 
 async function run(args, options = {}) {

package/lib/auth/qwenwork-login.js

@@ -1,5 +1,6 @@
 'use strict';
 const { t } = require('../core/i18n');
+const { sessionIdentity } = require('./session-identity');
 const { CliError } = require('../core/cli-error');
 const { loadTokenSession, resolveTokenSession, isEnvTokenAuthMode, hasEnvTokenCredential, saveTokenSession } = require('./token-store');
 const { detectRuntimeCapabilities } = require('../core/utils');
@@ -10,7 +11,7 @@ const { tokenLogin, tokenRefresh, isRefreshAuthRequired } = require('./token-aut
 function failure(code) {
   return new CliError(t('qwenwork.login_check_failed'), { code });
 }
-function summary(ok) { return { ok, status: ok ? 'ok' : 'not_logged_in', can_auto_use: ok }; }
+function summary(ok, session = {}) { return { ok, status: ok ? 'ok' : 'not_logged_in', can_auto_use: ok, ...(ok ? sessionIdentity(session) : {}) }; }
 
 /** 以服务端状态为准；网络异常不能触发浏览器登录。 */
 async function verify(session, options = {}) {
@@ -53,7 +54,10 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
   const env = options.env || process.env;
   const runtime = options.runtime || detectRuntimeCapabilities({ env });
   if (isQwenWorkWebRuntime(runtime) && !isEnvTokenAuthMode(env) && !hasEnvTokenCredential(env)) {
-    if (options.checkOnly) { return summary(await verify(loadTokenSession(options), options)); }
+    if (options.checkOnly) {
+      const session = loadTokenSession(options);
+      return summary(await verify(session, options), session || {});
+    }
     const selectedProfile = options.authProfile || options.profile || env.OPENYIDA_AUTH_PROFILE;
     const selectedSession = selectedProfile ? loadTokenSession(options) : null;
     if (selectedProfile && !selectedSession) { throw failure('AUTH_PROFILE_REQUIRED'); }
@@ -66,7 +70,7 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
     const session = await exchangeQwenWorkCloudSession(cloudOptions);
     if (!await verify(session, options)) { throw failure('QWENWORK_LOGIN_CHECK_FAILED'); }
     saveTokenSession(session, options);
-    return summary(true);
+    return summary(true, session);
   }
   const resolution = resolveTokenSession(options);
   if (resolution.status === 'profile_required') { throw failure('AUTH_PROFILE_REQUIRED'); }
@@ -74,12 +78,12 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
   if (session && options.endpoint && new URL(session.base_url).origin !== new URL(options.endpoint).origin) {
     session = null;
   }
-  if (await verify(session, options)) { return summary(true); }
+  if (await verify(session, options)) { return summary(true, session); }
   if (session?.refresh_token) {
     try {
       const refreshed = await (dependencies.refresh || tokenRefresh)(options);
       if (refreshed && refreshed.ok !== false && refreshed.access_token) {
-        if (await verify(refreshed, options)) { return summary(true); }
+        if (await verify(refreshed, options)) { return summary(true, refreshed); }
       } else if (!isRefreshAuthRequired(refreshed)) { throw failure('QWENWORK_LOGIN_REFRESH_FAILED'); }
     } catch (error) {
       if (!isRefreshAuthRequired(error) && ![401, 403].includes(error.statusCode)) {
@@ -94,7 +98,7 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
   if (!result || result.ok === false || !result.access_token || !await verify(result, options)) {
     throw failure('QWENWORK_LOGIN_FAILED');
   }
-  return summary(true);
+  return summary(true, result);
 }
 
 async function run(args, options = {}) {

package/lib/auth/session-identity.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+
+/** Explicit server classification wins; historical sessions without either field default to DingTalk organizations. */
+function sessionIdentity(value = {}) {
+  const empty = field => field === undefined || field === null || field === '';
+  const identity = empty(value.identity_type) ? undefined : value.identity_type;
+  const organization = empty(value.organization_type) ? undefined : value.organization_type;
+  if (identity === undefined && organization === undefined) {
+    return { identity_type: 'ORGANIZATION', organization_type: 'DINGTALK' };
+  }
+  if ((identity === 'PERSONAL' && organization === undefined) ||
+      (identity === 'ORGANIZATION' && ['DINGTALK', 'QWENWORK', 'OTHER'].includes(organization))) {
+    return { identity_type: identity, ...(organization === undefined ? {} : { organization_type: organization }) };
+  }
+  throw new CliError(t('qwenwork.login_check_failed'), {
+    code: 'AUTH_IDENTITY_TYPE_INVALID', details: { reason: 'identity_classification' },
+  });
+}
+
+module.exports = { sessionIdentity };

package/lib/auth/token-auth.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { sessionIdentity } = require('./session-identity');
+
 const http = require('http');
 const https = require('https');
 
@@ -174,6 +176,7 @@ function normalizeTokenResponse(response, baseUrl, clientId) {
     baseUrl
   );
   return {
+    ...sessionIdentity(data),
     auth_mode: 'token',
     credential_source: data.credential_source,
     status: data.status || 'ok',
@@ -445,6 +448,7 @@ function tokenStatus(options = {}) {
     refresh_token: maskToken(session.refresh_token),
     expires_at: session.expires_at ? new Date(session.expires_at).toISOString() : undefined,
     base_url: session.base_url,
+    ...sessionIdentity(session),
     corp_id: session.corp_id,
     corp_name: session.corp_name,
     user_id: session.user_id,
@@ -510,11 +514,16 @@ async function tokenRefreshUnlocked(options, session) {
     } catch { throw createTokenAuthRequiredError('refresh_origin_mismatch'); }
   }
   const businessBaseUrl = session.base_url || authBaseUrlValue;
+  const corpId = data.corp_id || data.corpId || session.corp_id;
+  const userId = data.user_id || data.userId || session.user_id;
+  const inheritClassification = [data.identity_type, data.organization_type].every(value => value === undefined || value === null || value === '')
+    && corpId === session.corp_id && userId === session.user_id;
   const normalized = normalizeTokenResponse({
     ...data,
-    corp_id: data.corp_id || data.corpId || session.corp_id,
+    ...(inheritClassification ? sessionIdentity(session) : {}),
+    corp_id: corpId,
     corp_name: data.corp_name || data.corpName || data.name || session.corp_name,
-    user_id: data.user_id || data.userId || session.user_id,
+    user_id: userId,
     user_name: data.user_name || data.userName || session.user_name,
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
     credential_source: data.credential_source || session.credential_source,

package/lib/auth/token-store.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { sessionIdentity } = require('./session-identity');
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -275,6 +277,7 @@ function normalizeTokenSession(session = {}) {
     session.tokenEndpoint
   );
   const normalized = {
+    ...sessionIdentity(session),
     auth_mode: 'token',
     credential_source: session.credential_source,
     token_type: session.token_type || session.tokenType || 'Bearer',

package/lib/core/locales/en.js

@@ -5,6 +5,7 @@
 
 module.exports = {
   qwenwork: {
+    organization_switch_success: 'Switched organization through QwenWork login.',
     login_check_failed: 'Unable to verify the login session. Please retry.',
     desktop_login_failed: 'QwenWork desktop login failed. Check the desktop identity and login handoff before retrying.',
     desktop_login_usage: 'Usage: openyida login --qwenwork [--json] [--check-only]',

package/lib/core/locales/zh.js

@@ -5,6 +5,7 @@
 
 module.exports = {
   qwenwork: {
+    organization_switch_success: '已通过千问办公登录切换组织。',
     login_check_failed: '登录状态暂时无法确认，请重试。',
     desktop_login_failed: '千问办公桌面免登失败，请确认桌面登录身份和免登通道后重试。',
     desktop_login_usage: '用法：openyida login --qwenwork [--json] [--check-only]',

package/lib/core/utils.js

@@ -829,11 +829,13 @@ function resolveTokenBaseUrl(root, fallbackBaseUrl, session) {
 function loadTokenAuthData(projectRoot, defaultBaseUrl) {
   try {
     const { loadTokenSession } = require('../auth/token-store');
+    const { sessionIdentity } = require('../auth/session-identity');
     const session = loadTokenSession({ projectRoot });
     if (!session || (!session.access_token && !session.refresh_token)) {
       return null;
     }
     return {
+      ...sessionIdentity(session),
       corp_id: session.corp_id,
       corp_name: session.corp_name,
       user_id: session.user_id,
@@ -1884,7 +1886,9 @@ function normalizeRefreshedTokenAuthData(refreshResult, fallbackBaseUrl) {
   if (!refreshResult || !refreshResult.access_token) {
     return null;
   }
+  const { sessionIdentity } = require('../auth/session-identity');
   return {
+    ...sessionIdentity(refreshResult),
     corp_id: refreshResult.corp_id,
     corp_name: refreshResult.corp_name,
     user_id: refreshResult.user_id,

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "openyida",
-  "version": "2026.10.29-beta.2",
+  "version": "2026.10.29-beta.3",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
-    "openyida": "bin/yida-beta.js",
-    "yida": "bin/yida-beta.js"
+    "openyida": "bin/yida.js",
+    "yida": "bin/yida.js"
   },
   "files": [
     "bin/",
@@ -15,8 +15,7 @@
     "!lib/samples/**/assets/**",
     "scripts/postinstall.js",
     "README.md",
-    "LICENSE",
-    "scripts/install-qwenwork-pre-beta.js"
+    "LICENSE"
   ],
   "scripts": {
     "test": "jest",
@@ -64,7 +63,7 @@
     "check:package": "npm pack --dry-run",
     "check:release": "npm run check:ci",
     "check:ci": "bash scripts/validate-ci.sh",
-    "postinstall": "node scripts/install-qwenwork-pre-beta.js"
+    "postinstall": "node scripts/postinstall.js"
   },
   "keywords": [
     "yida",
@@ -120,16 +119,5 @@
     "@openyida/local-agent-runtime-darwin-x64": "0.1.4",
     "@openyida/local-agent-runtime-win32-x64": "0.1.4",
     "@openyida/local-agent-runtime-win32-arm64": "0.1.4"
-  },
-  "openyidaLocalBeta": {
-    "desktopTicketLogin": true
-  },
-  "openyidaBuild": {
-    "sourceCommit": "32eae192ec36e6764878e7123d2902170924911d",
-    "sourceBranch": "feature/qwenwork-cloud-auth",
-    "mergedMainCommit": "ab4ccf97e03a7469df7eee731b300c59289b8231",
-    "distTag": "beta",
-    "presetScope": "none",
-    "environmentRouting": "standard"
   }
 }

package/scripts/install-qwenwork-pre-beta.js

@@ -1,40 +0,0 @@
-'use strict';
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-
-/** 技能复制属于可选安装步骤，权限不足时保留旧目录，CLI 仍可使用随包技能。 */
-function install(options = {}) {
-  const io = options.fs || fs;
-  const home = options.home || os.homedir();
-  const root = path.join(home, '.qwenworkcn');
-  if (!options.target && !io.existsSync(root)) { return { status: 'skipped' }; }
-  const source = options.source || path.resolve(__dirname, '../yida-skills');
-  const target = options.target || path.join(root, 'skills', 'yida-skills');
-  const unique = `${Date.now()}-${process.pid}`;
-  const backup = path.join(options.backupRoot || path.join(options.target ? path.dirname(target) : root, '.openyida-beta-backups'), unique);
-  const stage = path.join(path.dirname(target), `.openyida-installing-${unique}`);
-  let moved = false;
-  try {
-    io.mkdirSync(path.dirname(target), { recursive: true });
-    io.cpSync(source, stage, { recursive: true });
-    if (io.existsSync(target)) {
-      io.mkdirSync(path.dirname(backup), { recursive: true });
-      io.renameSync(target, backup);
-      moved = true;
-    }
-    io.renameSync(stage, target);
-    return { status: 'updated' };
-  } catch {
-    // 可选复制失败不使 npm 回滚；旧技能已移动时先恢复，备份始终保留在扫描目录外。
-    try { if (moved && !io.existsSync(target)) { io.renameSync(backup, target); } } catch { /* 保留备份，避免覆盖现有内容。 */ }
-    try { io.rmSync(stage, { recursive: true, force: true }); } catch { /* 权限不足时不扩大清理范围。 */ }
-    return { status: 'skipped' };
-  }
-}
-
-if (require.main === module) {
-  const index = process.argv.indexOf('--target-dir');
-  install(index >= 0 && process.argv[index + 1] ? { target: path.resolve(process.argv[index + 1]) } : {});
-}
-module.exports = { install };