openyida 2026.10.30-beta.1 → 2026.10.31

package/README.md

@@ -143,9 +143,9 @@ openyida login --check-only --json
 openyida auth status
 ```
 
-In QwenWork web, `openyida login --qwenwork --json` (or ordinary `login`) sends the sandbox Agent Token and gateway origin directly to the selected YiDA authentication endpoint. YiDA validates the identity through the trusted gateway’s fixed `/api/agent-gw/yida/user_info` endpoint, then issues its own short-lived session. This login flow no longer calls the legacy exchange or `/user/info` endpoints. Login preparation stays silent; failures stop without browser OAuth. Desktop and other hosts retain their existing authentication paths.
+In QwenWork web, `openyida login --qwenwork --json` (or ordinary `login`) reuses the sandbox identity. If cloud authentication fails, the same command falls back to OAuth; follow its authorization URL and wait for completion. Desktop and other hosts keep their existing login paths.
 
-QwenWork login supports DingTalk organizations, QwenWork organizations and personal ODS identities. Local ODS tenant IDs retain their `yida` prefix. When the server supplies a refresh token, the CLI stores it for the standard refresh flow. Optional server fields `identity_type` (`PERSONAL` / `ORGANIZATION`) and `organization_type` (`DINGTALK` / `QWENWORK` / `OTHER`, organizations only) are preserved in the session and `auth status`; historical sessions with both fields absent, null or empty default to `ORGANIZATION` / `DINGTALK`. Authentication failures expose bounded `status`, `stage`, `exchange_id`, HTTP `status_code` and local validation `reason` in JSON diagnostics, without response bodies or credentials.
+Login supports DingTalk and QwenWork organizations, ODS and personal spaces. Sessions preserve server-provided identity classification, business domain and refresh credentials. Historical sessions default to DingTalk organizations. JSON errors include bounded diagnostics without credentials or response bodies.
 
 For QwenWork cloud identity diagnostics, run inside the actual cloud execution environment:
 
@@ -153,20 +153,7 @@ For QwenWork cloud identity diagnostics, run inside the actual cloud execution e
 openyida auth qwenwork user-info --json
 ```
 
-This diagnostic command uses the legacy user-token protocol; it does not validate the current web Agent Token login flow. Use `openyida login --check-only --json` to check the YiDA session.
-
-This command exchanges the injected `QWENWORK_AGENT_TOKEN` (legacy: `MULE_AGENT_TOKEN` / `AGENT_TOKEN`) at `QWENWORK_GATEWAY_URL` (legacy: `MULE_GATEWAY_URL`), then queries `/user/info` on the same origin. It reports identity and scope metadata without printing or persisting either credential. It does not create an OpenYida login session, and QwenWork organization IDs are not YiDA `corpId` values. Existing OAuth/profile behavior is unchanged.
-
-Programmatic callers can use `exchangeQwenWorkAgentToken`, `getQwenWorkUserInfo` and `getQwenWorkIdentity` from `lib/auth/qwenwork-client.js`. The exchange function returns an in-memory `access_token` credential for the identity query or a future server-side login exchange; callers must not log or persist it.
-
-```js
-const { exchangeQwenWorkAgentToken, getQwenWorkUserInfo } = require('openyida/lib/auth/qwenwork-client');
-async function readCloudUser() {
-  const credential = await exchangeQwenWorkAgentToken();
-  // The result contains QwenWork identifiers, not YiDA IDs.
-  return getQwenWorkUserInfo(credential);
-}
-```
+This legacy diagnostic reads the injected host credentials and reports identity and scope without printing or saving tokens. It does not create or validate a YiDA session; QwenWork organization IDs are not YiDA `corpId` values. Check the YiDA session with `openyida login --check-only --json`. See [QwenWork login guidance](yida-skills/references/qwenwork-cloud-login.md) for authentication behavior.
 
 To reuse an existing shared login profile for the current project, switch first instead of starting a new OAuth login:
 

package/lib/app/app-theme-state.js

@@ -0,0 +1,80 @@
+'use strict';
+
+const { httpGet, requestWithAutoLogin } = require('../core/utils');
+const { throwCommandError } = require('../core/command-errors');
+const { t } = require('../core/i18n');
+const { isAgentAppType } = require('./agent-app-type');
+
+function themeContextFailure(reason) {
+  throwCommandError(t('upgrade_app_theme.context_failed'), {
+    code: 'APP_THEME_CONTEXT_UNVERIFIED', details: { reason },
+  });
+}
+
+// The application API exposes persisted mode/provenance. These establish the
+// configured theme, not proof that a browser loaded the stylesheet.
+function resolveAppThemeState(app = {}) {
+  const config = app.config && typeof app.config === 'object' && !Array.isArray(app.config) ? app.config : {};
+  const mode = app.appThemeMode ?? config.APP_THEME_MODE;
+  const enabled = app.appThemeEnable;
+  const createdModern = config.CREATED_WITH_MODERN_THEME;
+  if (enabled === 'n' || mode === 'legacy' || createdModern === 'n') {
+    return { mode: 'legacy', source: 'server_settings' };
+  }
+  if (enabled === 'y' && mode === 'modern') {
+    return { mode: 'modern', source: 'server_theme_state' };
+  }
+  if (enabled !== undefined && enabled !== null && enabled !== 'y') {
+    return { mode: 'unknown', source: 'server_settings' };
+  }
+  if (createdModern === 'y' &&
+      (mode === 'modern' || ((mode === undefined || mode === null || mode === '') && isAgentAppType(app.agentAppType)))) {
+    return { mode: 'modern', source: 'server_creation_config' };
+  }
+  return { mode: 'unknown', source: 'server_settings' };
+}
+
+async function fetchCurrentApp(appType, authRef, verifyIdentity = false) {
+  const target = { baseUrl: authRef.baseUrl, corpId: authRef.corpId, userId: authRef.userId };
+  if (verifyIdentity && (typeof appType !== 'string' || !/^[A-Za-z0-9_-]+$/.test(appType) ||
+      typeof target.corpId !== 'string' || !target.corpId || !target.baseUrl)) {
+    themeContextFailure('invalid_target');
+  }
+  const assertIdentity = auth => {
+    if (verifyIdentity && Object.keys(target).some(key => auth[key] !== target[key])) {
+      themeContextFailure('identity_changed');
+    }
+  };
+  const response = await requestWithAutoLogin((auth) => {
+    assertIdentity(auth);
+    return httpGet(
+      auth.baseUrl,
+      `/${encodeURIComponent(appType)}/query/app/getAppIncludingAecpInfo.json`,
+      {
+        _api: 'nattyFetch',
+        _mock: 'false',
+        appKey: appType,
+        _csrf_token: auth.csrfToken,
+        _stamp: Date.now(),
+      }
+    );
+  }, authRef);
+  assertIdentity(authRef);
+
+  if (verifyIdentity) {
+    const app = response?.content;
+    if (response?.success !== true || !app || typeof app !== 'object' || Array.isArray(app)) {
+      themeContextFailure('app_query_failed');
+    }
+    if (app.appType !== appType || app.corpId !== target.corpId) {
+      themeContextFailure('app_identity_mismatch');
+    }
+  }
+
+  if (!response || !response.success) {
+    throw new Error(response ? response.errorMsg || '查询应用详情失败' : '查询应用详情失败');
+  }
+  return response.content || {};
+}
+
+module.exports = { fetchCurrentApp, resolveAppThemeState };

package/lib/app/create-app.js

@@ -22,6 +22,7 @@ const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff
 const { throwCommandError } = require('../core/command-errors');
 const { isPermissionGuidanceError } = require('../core/permission-guidance');
 const { resolveBuilderAiSource } = require('./builder-ai-source');
+const { fetchCurrentApp, resolveAppThemeState } = require('./app-theme-state');
 
 const DEFAULT_APP_OPTIONS = {
   iconColor: '#0089FF',
@@ -376,6 +377,35 @@ async function run(args) {
     const appUrl = entryUrls.appUrl;
     const corpId = authRef.corpId || (authRef.authData && authRef.authData.corp_id) || '';
 
+    let themeVerification;
+    try {
+      const app = await fetchCurrentApp(appType, authRef, true);
+      const theme = resolveAppThemeState(app);
+      if (theme.mode !== 'modern') {
+        throwCommandError(t('create_app.modern_theme_unverified'), {
+          code: 'APP_THEME_NOT_MODERN', details: { themeMode: theme.mode },
+        });
+      }
+      themeVerification = { verified: true, appThemeMode: 'modern', source: theme.source,
+        scope: 'configuration_readback', runtimeVerified: false };
+    } catch (error) {
+      const created = { appCreated: true, appType, corpId, url: appUrl, retryCreate: false,
+        partial: true, residual: { appType, corpId }, retrySafe: false, mutationPerformed: true,
+        sideEffectState: 'applied', readbackAllowed: true };
+      if (isPermissionGuidanceError(error)) {
+        error.details = { ...error.details, ...created };
+        throw error;
+      }
+      throwCommandError(t('create_app.modern_theme_unverified'), {
+        code: 'APP_CREATED_THEME_UNVERIFIED', details: {
+          ...created,
+          causeCode: error.code || 'APP_THEME_READ_FAILED',
+          ...(error.details?.themeMode ? { themeMode: error.details.themeMode } : {}),
+          ...(error.details?.reason ? { reason: error.details.reason } : {}),
+        },
+      });
+    }
+
     chalkResult(true, t('create_app.success'), [
       ['appType', appType],
       ['Corp ID', corpId || t('common.unknown_error')],
@@ -391,6 +421,7 @@ async function run(args) {
         appType,
         appName,
         corpId,
+        themeVerification,
         url: appUrl,
         ...entryUrls,
       },

package/lib/app/custom-theme.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { createHash } = require('crypto');
 const { resolveBearerAuthHeaders } = require('../core/utils');
 const { readManagedContext, managedError } = require('../agent/managed-context');
 const { CliError } = require('../core/cli-error');
@@ -306,7 +307,26 @@ async function uploadCustomThemeFile(appType, filePath, authRef, options = {}) {
   if (!response.ok) {
     throw new Error((payload && (payload.errorMsg || payload.message)) || `主题文件上传失败: HTTP ${response.status}`);
   }
-  return payload;
+  // Hash multipart bytes, not reread files or server-supplied receipt fields.
+  if (payload?.success === false) {
+    return { ...payload, themeUpload: { requested: true, status: 'rejected', uploadedThisRun: false, appType } };
+  }
+  const upload = unwrapUploadResponse(payload);
+  return { ...payload, themeUpload: {
+    requested: true,
+    status: 'uploaded',
+    uploadedThisRun: true,
+    appType,
+    baseUrl: new URL(authRef.baseUrl).origin,
+    corpId: authRef.corpId || null,
+    sourceFileName: file.name,
+    sourceBytes: file.content.length,
+    sourceSha256: createHash('sha256').update(file.content).digest('hex'),
+    themeColor: file.themeColor,
+    cssUrl: upload.downloadUrl || upload.url,
+    cssFileName: upload.name || '',
+    resourceContentVerified: false,
+  } };
 }
 
 module.exports = {

package/lib/app/services/canvas-page-schema-builder.js

@@ -81,6 +81,10 @@ var OPENYIDA_UTIL_API_METHODS = [
 function openyidaYidaApiBridgeTargets() {
   var targets = [];
   function pushTarget(target) {
+    if (target !== window) {
+      var origin = window.location.origin;
+      if (!origin || origin === 'null' || target.location.origin !== origin) { return; }
+    }
     if (target && targets.indexOf(target) === -1) {
       targets.push(target);
     }

package/lib/app/update-app.js

@@ -7,8 +7,8 @@
 'use strict';
 
 const querystring = require('querystring');
+const { fetchCurrentApp, resolveAppThemeState } = require('./app-theme-state');
 const {
-  httpGet,
   httpPost,
   requestWithAutoLogin,
 } = require('../core/utils');
@@ -376,35 +376,24 @@ function preserveBasicSettings(payload, app) {
   }
 }
 
-function requireAppStyleConfirmation(params, context) {
-  const modern = pickAppField(context, 'appThemeEnable', 'APP_THEME_ENABLE') === 'y' &&
-    pickAppField(context, 'appThemeMode', 'APP_THEME_MODE') === 'modern';
-  if (!modern && params.confirmLegacyAppStyle !== true) {
+function requireAppStyleConfirmation(params, app) {
+  const theme = resolveAppThemeState(app);
+  if (theme.mode !== 'modern' && params.confirmLegacyAppStyle !== true) {
+    const storedMode = pickAppField(app, 'appThemeMode', 'APP_THEME_MODE');
     throwCommandError(t('update_app.legacy_style_confirm_required'), {
       code: 'LEGACY_APP_CUSTOM_THEME_CONFIRMATION_REQUIRED',
-      details: { appType: params.appType, applicationSettingsWritten: false, nextAction: 'ask_user_for_application_style_injection' },
+      details: { appType: params.appType, applicationSettingsWritten: false,
+        themeCapability: theme.mode, storedThemeMode: typeof storedMode === 'string' ? storedMode : null,
+        nextAction: 'ask_user_for_application_style_injection' },
     });
   }
 }
 
-// Runtime capability is resolved by the server. Stored APP_THEME_MODE alone is insufficient.
 async function checkAppStyleInjection(params, authRef) {
-  const html = await requestWithAutoLogin(auth => httpGet(auth.baseUrl,
-    `/${encodeURIComponent(params.appType)}/admin`, { _stamp: Date.now() }, { responseType: 'text' }), authRef);
-  const { parseThemeContext } = require('./upgrade-app-theme');
-  // Even human approval cannot waive target application and organization identity.
-  const identity = parseThemeContext(html, ['appType', 'corpId']);
-  if (identity.appType !== params.appType || !authRef.corpId || identity.corpId !== authRef.corpId) {
-    throwCommandError(t('upgrade_app_theme.context_failed'), { code: 'APP_THEME_CONTEXT_UNVERIFIED' });
-  }
-  let context;
-  try {
-    context = parseThemeContext(html, ['appType', 'corpId', 'appThemeEnable', 'appThemeMode']);
-  } catch (error) {
-    if (error.code !== 'APP_THEME_CONTEXT_UNVERIFIED') {throw error;}
-    return requireAppStyleConfirmation(params, {});
-  }
-  requireAppStyleConfirmation(params, context);
+  // AppRpc#getAppIncludingAecpInfo returns the application's own identity.
+  // Never open /admin or follow a browser login redirect to validate an API write.
+  const app = await fetchCurrentApp(params.appType, authRef, true);
+  requireAppStyleConfirmation(params, app);
 }
 
 function buildUpdateAppPostData(params, currentApp = {}, authRef) {
@@ -520,25 +509,6 @@ function buildUpdateAppPostData(params, currentApp = {}, authRef) {
   return postDataObj;
 }
 
-async function fetchCurrentApp(appType, authRef) {
-  const response = await requestWithAutoLogin((auth) => httpGet(
-    auth.baseUrl,
-    `/${appType}/query/app/getAppIncludingAecpInfo.json`,
-    {
-      _api: 'nattyFetch',
-      _mock: 'false',
-      appKey: appType,
-      _csrf_token: auth.csrfToken,
-      _stamp: Date.now(),
-    }
-  ), authRef);
-
-  if (!response || !response.success) {
-    throw new Error(response ? response.errorMsg || '查询应用详情失败' : '查询应用详情失败');
-  }
-  return response.content || {};
-}
-
 function getThemeSettings(app) {
   const rawStyle = pickAppField(app, 'customThemeStyle', 'CUSTOM_THEME_STYLE');
   let customThemeStyle = rawStyle || null;
@@ -566,6 +536,51 @@ function themeSettingsMatch(expected, actual) {
     ['cssUrl', 'cssFileName'].every((key) => (expectedStyle[key] || '') === (actualStyle[key] || ''));
 }
 
+function themeReadbackEvidence(params, details) {
+  const operation = params.disableCustomTheme ? 'disable'
+    : params.customThemeStyle ? 'bind_resource'
+      : params.colour || params.themeColor ? 'update_theme' : 'preserve';
+  return { ...details, scope: 'configuration_readback', operation, runtimeVerified: false };
+}
+
+/** Configuration completion is separate from rendering. */
+function getThemeCompletion(params, currentApp, app, themeVerified, navigationVerified) {
+  const before = resolveAppThemeState(currentApp);
+  const theme = resolveAppThemeState(app);
+  const operation = params.customThemeStyle ? 'application_css'
+    : params.disableCustomTheme ? 'disable'
+      : params.colour && params.colour !== 'custom' ? 'preset' : 'partial_update';
+  const actual = getThemeSettings(app);
+  const checks = {
+    themeModeVerified: theme.mode !== 'unknown' && theme.mode === before.mode,
+    settingsVerified: themeVerified === true,
+    navigationVerified: navigationVerified === true,
+  };
+  if (operation === 'application_css') {
+    checks.resourceBound = actual.colour === 'custom' && !!normalizeCssColorToHex(actual.themeColor) &&
+      actual.customThemeStyle?.enabled === true &&
+      typeof actual.customThemeStyle?.cssUrl === 'string' && !!actual.customThemeStyle.cssUrl.trim();
+    // Legacy overlays require scope approval.
+    if (theme.mode === 'legacy') {checks.legacyScopeConfirmed = params.confirmLegacyAppStyle === true;}
+  }
+  const complete = operation !== 'partial_update' && Object.values(checks).every(value => value === true);
+  return { scope: 'configuration_readback', operation, mode: theme.mode, modeSource: theme.source,
+    complete, status: complete ? 'complete' : operation === 'partial_update' ? 'partial' : 'incomplete',
+    checks, missing: Object.keys(checks).filter(key => !checks[key]), runtimeVerified: false };
+}
+
+function noThemeUpload(appType) {
+  return { requested: false, status: 'not_requested', uploadedThisRun: false, appType };
+}
+
+function themeFailureEvidence(themeUpload) {
+  const uncertain = themeUpload.uploadedThisRun === true || themeUpload.status === 'unknown';
+  return { themeUpload, runtimeVerification: { verified: false, status: 'not_checked' },
+    ...(uncertain ? { target: { appType: themeUpload.appType }, retrySafe: false,
+      sideEffectState: 'unknown', readbackAllowed: true } : {}),
+  };
+}
+
 function getRequestedNavigationSettings(params, payload) {
   return Object.fromEntries(['navTheme', 'layoutDirection', 'hideAppNav', 'logoSource']
     .filter((name) => params[name] !== undefined && params[name] !== null && params[name] !== '')
@@ -614,6 +629,7 @@ async function saveAppSettings(params, authRef) {
   const navigationFields = Object.keys(expectedNavigation);
   if (!verifyTheme && !navigationFields.length) {return response;}
   let actual;
+  let actualApp = {};
   let actualNavigation;
   let readbackError;
   let themeVerified = !verifyTheme;
@@ -623,15 +639,17 @@ async function saveAppSettings(params, authRef) {
     if (attempt) { await new Promise((resolve) => setTimeout(resolve, attempt * 250)); }
     try {
       const app = await fetchCurrentApp(params.appType, authRef);
+      actualApp = app;
       actual = getThemeSettings(app);
       actualNavigation = getNavigationSettings(app, navigationFields, currentApp, params.disableCustomTheme);
       readbackError = undefined;
       themeVerified = !verifyTheme || themeSettingsMatch(expected, actual);
       navigationVerified = navigationFields.every((name) => expectedNavigation[name] === actualNavigation[name]);
-      if (themeVerified && navigationVerified) {
-        return { ...response,
+      const themeCompletion = getThemeCompletion(params, currentApp, app, themeVerified, navigationVerified);
+      if (themeVerified && navigationVerified && (!params.customThemeStyle || themeCompletion.complete)) {
+        return { ...response, themeCompletion,
           ...(submittedFields ? { submittedFields } : {}),
-          ...(verifyTheme ? { themeVerification: { verified: true, ...actual } } : {}),
+          ...(verifyTheme ? { themeVerification: themeReadbackEvidence(params, { verified: true, ...actual }) } : {}),
           ...(navigationFields.length ? { navigationVerification: { verified: true, ...actualNavigation } } : {}),
         };
       }
@@ -643,11 +661,14 @@ async function saveAppSettings(params, authRef) {
   }
   return {
     success: false,
+    themeCompletion: getThemeCompletion(params, currentApp, actualApp, themeVerified, navigationVerified),
     ...(submittedFields ? { submittedFields } : {}),
-    errorCode: themeVerified ? 'APP_NAVIGATION_NOT_PERSISTED' : 'APP_THEME_NOT_PERSISTED',
-    errorMsg: t(themeVerified ? 'update_app.navigation_not_persisted' : 'update_app.theme_not_persisted'),
-    ...(verifyTheme ? { themeVerification: themeVerified
-      ? { verified: true, ...actual } : { verified: false, expected, actual, readbackError } } : {}),
+    errorCode: !themeVerified ? 'APP_THEME_NOT_PERSISTED' : !navigationVerified
+      ? 'APP_NAVIGATION_NOT_PERSISTED' : 'APP_THEME_CONFIGURATION_INCOMPLETE',
+    errorMsg: t(!themeVerified ? 'update_app.theme_not_persisted' : !navigationVerified
+      ? 'update_app.navigation_not_persisted' : 'update_app.theme_configuration_incomplete'),
+    ...(verifyTheme ? { themeVerification: themeReadbackEvidence(params, themeVerified
+      ? { verified: true, ...actual } : { verified: false, expected, actual, readbackError }) } : {}),
     ...(navigationFields.length ? { navigationVerification: navigationVerified
       ? { verified: true, ...actualNavigation }
       : { verified: false, expected: expectedNavigation, actual: actualNavigation, readbackError } } : {}),
@@ -663,22 +684,25 @@ async function applyCustomThemeUpdate(appType, themeParams, authRef) {
   assertNavTheme(params.navTheme);
   assertLogoSource(params.logoSource);
 
-  assertCustomThemeOptions(params);
-  await checkAppStyleInjection(params, authRef);
-  const themeFile = readThemeCssFile(params.themeFile);
-  params.themeColor = themeFile.themeColor;
-  const uploadResponse = await requestWithAutoLogin(
-    (auth) => uploadCustomThemeFile(appType, params.themeFile, auth),
-    authRef
-  );
-  params.customThemeStyle = buildCustomThemeStyle(uploadResponse);
-
+  let themeUpload = { requested: true, status: 'not_started', uploadedThisRun: false, appType };
   try {
-    return await saveAppSettings(params, authRef);
+    assertCustomThemeOptions(params);
+    await checkAppStyleInjection(params, authRef);
+    readThemeCssFile(params.themeFile);
+    // Lost responses leave upload state unknown.
+    themeUpload = { ...themeUpload, status: 'unknown', uploadedThisRun: null };
+    const uploadResponse = await requestWithAutoLogin(
+      (auth) => uploadCustomThemeFile(appType, params.themeFile, auth),
+      authRef
+    );
+    if (uploadResponse.themeUpload) {themeUpload = uploadResponse.themeUpload;}
+    params.customThemeStyle = buildCustomThemeStyle(uploadResponse);
+    params.themeColor = themeUpload.themeColor;
+    return { ...await saveAppSettings(params, authRef), themeUpload };
   } catch (error) {
-    error.details = { ...error.details, appType, uploadedResource: params.customThemeStyle,
-      applicationSettingsVerified: false };
-    throw error;
+    throwCommandError(error.message, { code: error.code || 'APP_THEME_UPDATE_FAILED', exitCode: error.exitCode,
+      details: { ...error.details, appType, uploadedResource: params.customThemeStyle,
+        ...themeFailureEvidence(themeUpload), applicationSettingsVerified: false } });
   }
 }
 
@@ -767,6 +791,8 @@ async function run(args) {
         postData
       );
     }, authRef);
+  const themeUpload = params.themeFile ? response?.themeUpload : noThemeUpload(params.appType);
+  if (themeUpload?.uploadedThisRun) {params.themeColor = themeUpload.themeColor;}
 
   // Verify the persisted resource before exposing success or a mutation receipt.
   let nameVerification;
@@ -789,9 +815,11 @@ async function run(args) {
       success: true,
       appType: params.appType,
       themeVerification: response.themeVerification,
+      themeCompletion: response.themeCompletion,
+      themeUpload,
       nameVerification,
       navigationVerification: response.navigationVerification,
-      ...(params.disableCustomTheme ? { runtimeVerification: { verified: false } } : {}),
+      runtimeVerification: { verified: false, status: 'not_checked' },
       updatedFields: {
         name: params.name || undefined,
         desc: params.desc || undefined,
@@ -810,11 +838,15 @@ async function run(args) {
     const errorMsg = response ? response.errorMsg || t('common.unknown_error') : t('common.request_failed');
     chalkResult(false, t('update_app.failed', errorMsg));
     console.log(JSON.stringify({ success: false, appType: params.appType, error: errorMsg,
+      themeUpload,
+      runtimeVerification: { verified: false, status: 'not_checked' },
       submittedFields: response && response.submittedFields,
+      themeCompletion: response && response.themeCompletion,
       errorCode: response && response.errorCode, themeVerification: response && response.themeVerification,
       navigationVerification: response && response.navigationVerification }));
     throwCommandError(errorMsg, { code: response && response.errorCode,
-      details: response && (response.errorCode === 'APP_NAVIGATION_NOT_PERSISTED' ? response.navigationVerification : response.themeVerification) });
+      details: response && { ...(response.errorCode === 'APP_NAVIGATION_NOT_PERSISTED' ? response.navigationVerification : response.themeVerification),
+        themeCompletion: response.themeCompletion, ...themeFailureEvidence(themeUpload) } });
   }
 }
 

package/lib/auth/qwenwork-desktop.js

@@ -17,7 +17,8 @@ const MAX_RESPONSE_BYTES = 65536;
 function fail(code) {
   return new CliError(t('qwenwork.desktop_login_failed'), {
     code: `QWENWORK_DESKTOP_${code}`,
-    details: { invocation: buildQwenWorkLoginInvocation() },
+    details: { stage: 'authentication', owner: 'openyida', retryable: false,
+      nextAction: 'retry_after_host_state_changes', output_visibility: 'internal', invocation: buildQwenWorkLoginInvocation() },
   });
 }
 

package/lib/auth/qwenwork-login.js

@@ -9,7 +9,13 @@ const { exchangeQwenWorkCloudSession } = require('./qwenwork-cloud');
 const { tokenLogin, tokenRefresh, isRefreshAuthRequired } = require('./token-auth');
 
 function failure(code) {
-  return new CliError(t('qwenwork.login_check_failed'), { code });
+  return new CliError(t('qwenwork.login_check_failed'), { code, details: {
+    stage: 'authentication', owner: 'openyida',
+    retryable: false,
+    nextAction: code === 'QWENWORK_LOGIN_IDENTITY_MISMATCH'
+      ? 'select_target_organization_in_host_then_retry' : 'retry_after_host_state_changes',
+    output_visibility: 'internal',
+  } });
 }
 function summary(ok, session = {}) { return { ok, status: ok ? 'ok' : 'not_logged_in', can_auto_use: ok, ...(ok ? sessionIdentity(session) : {}) }; }
 
@@ -72,7 +78,8 @@ async function verify(session, options = {}) {
       throw failure('QWENWORK_LOGIN_CHECK_FAILED');
     }
     if (value.corp_id !== session.corp_id || value.user_id !== session.user_id ||
-      (options.corpId && value.corp_id !== options.corpId)) { throw failure('QWENWORK_LOGIN_IDENTITY_MISMATCH'); }
+      (options.corpId && value.corp_id !== options.corpId) ||
+      (options.userId && value.user_id !== options.userId)) { throw failure('QWENWORK_LOGIN_IDENTITY_MISMATCH'); }
     return true;
   } catch (error) {
     if (error instanceof CliError) { throw error; }
@@ -81,7 +88,7 @@ async function verify(session, options = {}) {
 }
 
 /** 网页态优先消费宿主凭据，认证失败回退普通 OAuth；其他宿主保持原流程。 */
-async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
+async function performQwenWorkLogin(options = {}, dependencies = {}) {
   const env = options.env || process.env;
   const runtime = options.runtime || detectRuntimeCapabilities({ env });
   if (isQwenWorkWebRuntime(runtime) && !isEnvTokenAuthMode(env) && !hasEnvTokenCredential(env)) {
@@ -110,12 +117,26 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
     return summary(true, session);
   }
   const resolution = resolveTokenSession(options);
-  if (resolution.status === 'profile_required') { throw failure('AUTH_PROFILE_REQUIRED'); }
+  if (resolution.status === 'profile_required') {
+    // 受管桌面的身份由客户端绑定；历史 profile 歧义不能让状态检查跳过宿主签票。
+    // 只返回未就绪，不选择凭据、发起 OAuth 或放宽显式身份约束。
+    const hostCheck = options.checkOnly && runtime.tool === 'qwenwork' && runtime.subtype === 'qwenwork_desktop' &&
+      /^[a-f0-9]{64}$/.test(env.QWENWORK_CLIENT_OPENYIDA_IDENTITY || '') &&
+      ![options.authProfile, options.profile, options.corpId, options.userId,
+        env.OPENYIDA_AUTH_PROFILE, env.OPENYIDA_AUTH_CORP_ID, env.OPENYIDA_AUTH_USER_ID].some(Boolean);
+    if (hostCheck) { return summary(false); }
+    throw failure('AUTH_PROFILE_REQUIRED');
+  }
+  if (runtime.tool === 'qwenwork' && resolution.status === 'profile_not_found' &&
+    (options.corpId || options.userId || env.OPENYIDA_AUTH_CORP_ID || env.OPENYIDA_AUTH_USER_ID)) {
+    throw failure('QWENWORK_LOGIN_IDENTITY_MISMATCH');
+  }
   let session = loadTokenSession(options);
   if (session && options.endpoint && new URL(session.base_url).origin !== new URL(options.endpoint).origin) {
     session = null;
   }
   if (await verify(session, options)) { return summary(true, session); }
+  if (options.checkOnly) { return summary(false); }
   if (session?.refresh_token) {
     try {
       const refreshed = await (dependencies.refresh || tokenRefresh)(options);
@@ -129,7 +150,6 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
       }
     }
   }
-  if (options.checkOnly) { return summary(false); }
   if (isEnvTokenAuthMode(env) || isQwenWorkWebRuntime(runtime)) { throw failure('QWENWORK_LOGIN_FAILED'); }
   const result = await (dependencies.login || tokenLogin)(options);
   if (!result || result.ok === false || !result.access_token || !await verify(result, options)) {
@@ -138,6 +158,21 @@ async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
   return summary(true, result);
 }
 
+async function ensureQwenWorkLogin(options = {}, dependencies = {}) {
+  try {
+    const result = await performQwenWorkLogin(options, dependencies);
+    return result.ok && (options.corpId || options.userId) ? { ...result, target_match: 'matched' } : result;
+  } catch (error) {
+    const terminal = failure(error instanceof CliError ? error.code : 'QWENWORK_LOGIN_FAILED');
+    if (error instanceof CliError) {
+      error.details = { ...terminal.details, ...error.details,
+        retryable: false, nextAction: terminal.details.nextAction, output_visibility: 'internal' };
+      throw error;
+    }
+    throw terminal;
+  }
+}
+
 async function run(args, options = {}) {
   const result = await ensureQwenWorkLogin({ ...options, checkOnly: args.includes('--check-only') });
   if (args.includes('--json') && !args.includes('--quiet') && process.env.YIDA_QUIET !== '1') {