openyida 2026.7.13 → 2026.7.14-2

package/README.md

@@ -55,10 +55,10 @@ If Codex is already installed, OpenYida also imports a local Codex plugin during
 Run this from the AI coding workspace where you want OpenYida to operate:
 
 ```bash
-openyida agent-capabilities --json
+openyida agent-capabilities --summary-json
 ```
 
-OpenYida detects the active agent environment, workspace path, login state, organization context, command manifest, and side-effect hints in one machine-readable snapshot. `openyida commands --json` remains available when an agent only needs the command manifest.
+OpenYida returns a compact machine-readable summary with the version, login state, workspace/cache paths, and command manifest digest. `openyida agent-capabilities --json` is the full diagnostic snapshot, where compact `workdir` maps to `active.projectRoot` and `workdir_exists` maps to `active.projectRootExists`. `openyida commands --json` remains available when an agent only needs the command manifest.
 
 ### 3. Log In
 
@@ -66,27 +66,20 @@ OpenYida detects the active agent environment, workspace path, login state, orga
 openyida login
 ```
 
-In Codex, QoderWork, Qoder, Wukong, Claude Code, MuleRun, OpenCode, Cursor, and other detected AI tools, OpenYida first tries local Chrome/Edge/Chromium CDP when no valid cached login exists. If local CDP is unavailable, it falls back to an AI-dialog QR handoff. The agent should render `qr_image_markdown` or paste `agent_response_markdown` directly in the conversation so the QR code is visible, then run `poll_command` after the user scans it with DingTalk. If image rendering is unavailable, fall back to `qr_url`. The explicit `openyida login --browser` command still prefers CDP first and uses Playwright as an optional browser fallback.
+OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the current project cache.
 
-When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and cookie file. For example, Alibaba intranet Yida uses `cookies-alibaba.json`:
+When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and token session file. For example, Alibaba intranet Yida uses `auth-token-alibaba.json`:
 
 ```bash
 openyida login https://yida-group.alibaba-inc.com/
 openyida login --alibaba
 ```
 
-The explicit QR polling command remains available:
+For token status checks, use:
 
 ```bash
-openyida login --agent-qr
-```
-
-For terminal QR login, use:
-
-```bash
-openyida login --qr
-openyida login --qr --corp-id dingxxxxxxxx
 openyida login --check-only --json
+openyida auth status
 ```
 
 OpenYida does not install Playwright by default.
@@ -239,7 +232,7 @@ OPENYIDA_E2E=1 OPENYIDA_E2E_FULL_STAGES=auth,app,form,process npm run test:e2e:r
 npm run test:e2e:real:skills
 ```
 
-The runner creates a disposable app, form, and custom page with an `OY_E2E_*` prefix, then verifies login, app listing, schema fetch, data query, and page publish. It writes a registry to `project/.cache/e2e-real/` so created resources can be audited later. To inject CI cookies without relying on a local login cache, pass `OPENYIDA_E2E_COOKIES_BASE64` as a base64 encoded cookie array or `{ "cookies": [...] }` object.
+The runner creates a disposable app, form, and custom page with an `OY_E2E_*` prefix, then verifies token login, app listing, schema fetch, data query, and page publish. It writes a registry to `project/.cache/e2e-real/` so created resources can be audited later. Run `openyida login` for the target environment before starting the real E2E runner.
 
 `test:e2e:real:full` extends the smoke path into a broad deterministic feature matrix: auth/env, app update, form update and option mutation, page build/compile/generate/publish, data create/get/update/query, permission read, page config and short URL check, report create/append, dashboard skill verification, export/import, batch, task-center, formula/doctor/sample/CDN config, and local connector parsing/template generation. AI-backed commands such as `flash-to-prd` are available as the optional `ai` stage because they depend on remote model availability. Workflow mutation is available as the opt-in `process` stage; it creates and republishes a workflow on the disposable E2E form and records advanced official-node fixtures for review.
 
@@ -339,11 +332,11 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--qr\|--agent-qr\|--codex\|--browser] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--corp-id <corpId>]` | Login (cache first, --browser or --agent-qr when needed) |
-| `openyida logout` | Logout / switch account |
-| `openyida auth <status\|login\|refresh\|logout>` | Login state management |
-| `openyida org <list\|switch>` | Organization management (list / switch) |
-| `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & login state |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>]` | Login with OAuth token mode |
+| `openyida logout` | Logout / clear token |
+| `openyida auth <status\|login\|refresh\|logout>` | Token login state management |
+| `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch by OAuth re-login) |
+| `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
 ### App Management
 
@@ -457,7 +450,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida commands [--json]` | Output machine-readable command manifest |
-| `openyida agent-capabilities [--json]` | Output one-shot agent capability snapshot |
+| `openyida agent-capabilities [--json] [--summary-json\|--compact]` | Output one-shot agent capability snapshot |
 | `openyida a2a <serve\|agent-card> [options]` | Start local read-only A2A adapter or print Agent Card |
 | `openyida bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open\|--no-open]` | Start OpenYida local web bridge service |
 | `openyida copy [--force]` | Copy project working directory |
@@ -585,9 +578,9 @@ When adding new CLI commands, register the route in `bin/yida.js`, add it to `li
 
 ## Security and Configuration
 
-- Login cookies are cached locally and should never be hard-coded into source files.
+- OAuth token sessions are cached locally and should never be hard-coded into source files.
 - Private deployment environments are managed through `lib/core/env-manager.js`.
-- Yida API requests should use the active environment base URL and authenticated cookies.
+- Yida API requests should use the active environment base URL and Bearer token auth.
 - For multi-organization accounts, prefer explicit `--corp-id` values in non-interactive automation.
 
 ## Community

package/bin/yida.js

@@ -211,6 +211,38 @@ function handleFirstRunGuide() {
   console.log('');
 }
 
+const TOKEN_OUTPUT_SECRET_KEYS = new Set([
+  'access_token',
+  'accessToken',
+  'refresh_token',
+  'refreshToken',
+  'ai_app_user_auth_token',
+  'aiAppUserAuthToken',
+  'tianshu_csrf_token',
+  'tianshuCsrfToken',
+  'csrf_token',
+  'csrfToken',
+]);
+
+function maskSensitiveAuthOutput(value) {
+  if (!value || typeof value !== 'object') {
+    return value;
+  }
+  const { maskToken } = require('../lib/auth/token-store');
+  if (Array.isArray(value)) {
+    return value.map((item) => maskSensitiveAuthOutput(item));
+  }
+  const output = {};
+  Object.entries(value).forEach(([key, item]) => {
+    if (TOKEN_OUTPUT_SECRET_KEYS.has(key)) {
+      output[key] = maskToken(item);
+    } else {
+      output[key] = maskSensitiveAuthOutput(item);
+    }
+  });
+  return output;
+}
+
 function printLoginResult(result) {
   noteLoginCommandResult(result);
 
@@ -224,49 +256,21 @@ function printLoginResult(result) {
     return;
   }
 
-  if (result && (result.status === 'need_qr_scan' || result.status === 'need_corp_selection')) {
-    console.log(JSON.stringify(result));
-    return;
-  }
-
-  if (result && result.status === 'need_codex_browser_login') {
-    const handoff = {
-      status: result.status,
-      handoff_type: result.handoff_type || 'browser',
-      can_auto_use: false,
-      browser: result.browser,
-      login_url: result.login_url,
-      message: result.message,
-    };
-    [
-      'agent_action',
-      'browser_open_strategy',
-      'browser_use_local_redirect_fallback',
-      'required_agent_tool',
-      'required_runtime_tool',
-      'cookie_export_file',
-      'cookie_file',
-      'post_login_check_command',
-      'fallback_command',
-    ].forEach((key) => {
-      if (result[key]) {handoff[key] = result[key];}
-    });
-    console.log(JSON.stringify(handoff));
-    return;
-  }
-
-  if (result.status && result.status !== 'ok' && !result.csrf_token) {
-    console.log(JSON.stringify(result));
-    return;
-  }
-
+  const tokenUsable = result.can_auto_use !== false && !!result.access_token;
   const summary = {
-    ok: true,
-    base_url: result && result.base_url,
-    corp_id: result && result.corp_id,
-    user_id: result && result.user_id,
-    csrf_token: result && result.csrf_token ? `${result.csrf_token.slice(0, 16)}...` : undefined,
-    cookies_count: Array.isArray(result && result.cookies) ? result.cookies.length : (result.cookies_count || 0),
+    ok: tokenUsable,
+    status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
+    auth_mode: 'token',
+    can_auto_use: tokenUsable,
+    token_type: result.token_type || 'Bearer',
+    access_token: maskSensitiveAuthOutput({ access_token: result.access_token }).access_token,
+    expires_at: result.expires_at ? new Date(result.expires_at).toISOString() : undefined,
+    base_url: result.base_url,
+    corp_id: result.corp_id,
+    user_id: result.user_id,
+    user_name: result.user_name,
+    message: result.message,
+    raw: tokenUsable ? undefined : result.raw,
   };
   console.log(JSON.stringify(summary));
 }
@@ -277,15 +281,11 @@ function noteLoginCommandResult(result) {
     let status = 'failed';
     let reason = 'login_failed';
 
-    if (result && (result.csrf_token || (result.status === 'ok' && result.can_auto_use))) {
+    const tokenLoginOk = result && result.auth_mode === 'token' &&
+      (result.access_token || (result.status === 'ok' && result.can_auto_use));
+    if (result && (tokenLoginOk || (result.status === 'ok' && result.can_auto_use))) {
       status = 'success';
       reason = 'login_ok';
-    } else if (result && result.status === 'need_qr_scan') {
-      status = 'need_qr_scan';
-      reason = 'need_qr_scan';
-    } else if (result && result.status === 'need_codex_browser_login') {
-      status = 'need_browser_login';
-      reason = 'need_browser_login';
     } else if (result && result.status === 'need_corp_selection') {
       status = 'success';
       reason = 'need_corp_selection';
@@ -306,40 +306,6 @@ function noteLoginCommandResult(result) {
   }
 }
 
-function isAgentConversationEnvironment() {
-  const { detectActiveTool } = require('../lib/core/utils');
-  return !!detectActiveTool() || process.env.OPENYIDA_AGENT_MODE === '1';
-}
-
-function shouldUseBrowserHandoffLogin(cliArgs) {
-  if (cliArgs.includes('--qr') || cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return false;}
-  if (cliArgs.includes('--browser') || cliArgs.includes('--codex') || cliArgs.includes('--qoder') || cliArgs.includes('--wukong')) {return true;}
-  return false;
-}
-
-function shouldUseAgentLogin(cliArgs) {
-  if (cliArgs.includes('--qr') || cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return false;}
-  if (shouldUseBrowserHandoffLogin(cliArgs)) {return false;}
-  return isAgentConversationEnvironment();
-}
-
-function shouldUsePlaywrightFallbackInAgentLogin() {
-  const { hasDesktopEnvironment } = require('../lib/core/utils');
-  return hasDesktopEnvironment() || process.env.OPENYIDA_AGENT_PLAYWRIGHT_FALLBACK === '1';
-}
-
-function shouldUseLocalBrowserLogin(options = {}) {
-  const { hasLocalBrowserLoginCapability } = require('../lib/auth/login');
-  return hasLocalBrowserLoginCapability({
-    playwrightFallback: options.playwrightFallback,
-  });
-}
-
-function shouldUseCodexQrLogin(cliArgs) {
-  if (cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return true;}
-  return false;
-}
-
 function getArgValue(cliArgs, name) {
   const index = cliArgs.indexOf(name);
   if (index === -1 || !cliArgs[index + 1] || cliArgs[index + 1].startsWith('--')) {
@@ -414,11 +380,9 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--intranet': 'alibaba',
   };
   const valuePassthroughFlags = new Set([
-    '--agent-poll',
-    '--codex-poll',
-    '--agent-select',
-    '--codex-select',
     '--corp-id',
+    '--client-id',
+    '--user-id',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -563,129 +527,42 @@ async function main() {
     }
 
     case 'login': {
-      const { checkLoginOnly } = require('../lib/auth/login');
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { isEnvAuthMode } = require('../lib/core/utils');
-      if (loginArgs.includes('--agent-poll') || loginArgs.includes('--codex-poll')) {
-        const sessionFile = getArgValue(loginArgs, '--agent-poll') || getArgValue(loginArgs, '--codex-poll');
-        const { pollCodexQrLogin } = require('../lib/auth/qr-login');
-        const result = await pollCodexQrLogin(sessionFile, {
-          corpId: getArgValue(loginArgs, '--corp-id'),
-        });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--agent-select') || loginArgs.includes('--codex-select')) {
-        const sessionFile = getArgValue(loginArgs, '--agent-select') || getArgValue(loginArgs, '--codex-select');
-        const { selectCodexQrCorp } = require('../lib/auth/qr-login');
-        const result = await selectCodexQrCorp(sessionFile, {
-          corpId: getArgValue(loginArgs, '--corp-id'),
-        });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--check-only')) {
-        const result = checkLoginOnly({ includeSecrets: loginArgs.includes('--with-cookies') });
-        console.log(JSON.stringify(result, null, 2));
-      } else if (isEnvAuthMode()) {
-        const result = checkLoginOnly({ includeSecrets: true });
-        printLoginResult(result);
-      } else if (shouldUseCodexQrLogin(loginArgs)) {
-        const { startCodexQrLogin } = require('../lib/auth/qr-login');
-        const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--browser')) {
-        const { interactiveLogin } = require('../lib/auth/login');
-        const result = interactiveLogin({ force: true });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--qoder') || loginArgs.includes('--wukong')) {
-        const { codexLogin } = require('../lib/auth/codex-login');
-        const result = await codexLogin({ tool: loginArgs.includes('--qoder') ? 'qoder' : 'wukong' });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--qr')) {
-        const { qrLogin } = require('../lib/auth/qr-login');
-        const result = await qrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-        printLoginResult(result);
-      } else if (shouldUseAgentLogin(loginArgs)) {
-        const cachedResult = checkLoginOnly({ includeSecrets: true });
-        if (cachedResult.status === 'ok') {
-          printLoginResult(cachedResult);
-        } else {
-          const { interactiveLogin } = require('../lib/auth/login');
-          const playwrightFallback = shouldUsePlaywrightFallbackInAgentLogin();
-          const browserResult = shouldUseLocalBrowserLogin({ playwrightFallback })
-            ? interactiveLogin({ playwrightFallback })
-            : null;
-          if (browserResult) {
-            printLoginResult(browserResult);
-          } else {
-            const { startCodexQrLogin } = require('../lib/auth/qr-login');
-            const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-            printLoginResult(result);
-          }
-        }
-      } else if (shouldUseBrowserHandoffLogin(loginArgs)) {
-        const cachedResult = checkLoginOnly({ includeSecrets: true });
-        if (cachedResult.status === 'ok') {
-          printLoginResult(cachedResult);
-        } else {
-          const { codexLogin } = require('../lib/auth/codex-login');
-          const result = await codexLogin({ tool: loginArgs.includes('--codex') ? 'codex' : undefined });
-          printLoginResult(result);
-        }
+      const { tokenLogin, tokenStatus } = require('../lib/auth/token-auth');
+      if (loginArgs.includes('--check-only')) {
+        console.log(JSON.stringify(tokenStatus(), null, 2));
       } else {
-        const cachedResult = checkLoginOnly({ includeSecrets: true });
-        if (cachedResult.status === 'ok') {
-          printLoginResult(cachedResult);
-          break;
-        }
-        if (shouldUseLocalBrowserLogin({ playwrightFallback: true })) {
-          const { interactiveLogin } = require('../lib/auth/login');
-          const browserResult = interactiveLogin({ playwrightFallback: true });
-          if (browserResult) {
-            printLoginResult(browserResult);
-            break;
-          }
-        }
-        const { qrLogin } = require('../lib/auth/qr-login');
-        const result = await qrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+        const result = await tokenLogin({
+          clientId: getArgValue(loginArgs, '--client-id'),
+          quiet: loginArgs.includes('--quiet'),
+        });
         printLoginResult(result);
       }
       break;
     }
 
     case 'logout': {
-      const { logout } = require('../lib/auth/login');
-      logout();
+      const { tokenLogout } = require('../lib/auth/token-auth');
+      console.log(JSON.stringify(await tokenLogout(), null, 2));
       break;
     }
 
     case 'auth': {
       const subCommand = args[0];
-      const { authStatus, authLogin, authRefresh, authLogout } = require('../lib/auth/auth');
-
+      const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
+      const { tokenLogin, tokenLogout, tokenRefresh, tokenStatus } = require('../lib/auth/token-auth');
       if (subCommand === 'status') {
-        authStatus();
+        console.log(JSON.stringify(tokenStatus(), null, 2));
       } else if (subCommand === 'login') {
-        const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-        let loginType = 'qrcode';
-        if (authArgs.includes('--codex')) {
-          loginType = 'codex';
-        } else if (authArgs.includes('--qoder')) {
-          loginType = 'qoder';
-        } else if (authArgs.includes('--wukong')) {
-          loginType = 'wukong';
-        } else if (authArgs.includes('--browser')) {
-          loginType = 'browser';
-        }
-        const result = await authLogin({
-          type: loginType,
-          corpId: getArgValue(authArgs, '--corp-id'),
-          forceTerminalQr: authArgs.includes('--qr'),
+        const result = await tokenLogin({
+          clientId: getArgValue(authArgs, '--client-id'),
+          quiet: authArgs.includes('--quiet'),
         });
-        if (result) {
-          printLoginResult(result);
-        }
+        printLoginResult(result);
       } else if (subCommand === 'refresh') {
-        authRefresh();
+        console.log(JSON.stringify(maskSensitiveAuthOutput(await tokenRefresh()), null, 2));
       } else if (subCommand === 'logout') {
-        authLogout();
+        console.log(JSON.stringify(await tokenLogout(), null, 2));
       } else {
         throwCliUsage(t('cli.auth_usage'), t('cli.auth_example'));
       }
@@ -693,34 +570,9 @@ async function main() {
     }
 
     case 'org': {
-      const subCommand = args[0];
-      const { listOrganizations, switchOrganization, interactiveSwitch } = require('../lib/auth/org');
-      const { loadCookieData } = require('../lib/core/utils');
-
-      if (subCommand === 'list') {
-        const cookieData = loadCookieData();
-        if (!cookieData || !cookieData.cookies) {
-          throwNeedLogin(t('org.no_login'));
-        }
-        await listOrganizations(cookieData);
-      } else if (subCommand === 'switch') {
-        const cookieData = loadCookieData();
-        if (!cookieData || !cookieData.cookies) {
-          throwNeedLogin(t('org.no_login'));
-        }
-
-        // 解析 --corp-id 参数
-        const corpIdIndex = args.indexOf('--corp-id');
-        if (corpIdIndex !== -1 && args[corpIdIndex + 1]) {
-          const targetCorpId = args[corpIdIndex + 1];
-          await switchOrganization(targetCorpId, cookieData);
-        } else {
-          // 交互式选择
-          await interactiveSwitch(cookieData);
-        }
-      } else {
-        throwCliUsage(t('cli.org_usage'), t('cli.org_example'));
-      }
+      const orgArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
+      const { run } = require('../lib/auth/org');
+      await run(orgArgs);
       break;
     }
 

package/lib/agent-center/api.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { createAuthRef, createYidaClient } = require('../core/yida-client');
+const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 
 const AGENT_TYPE_ALIASES = {
   normal: 'NORMAL',
@@ -70,7 +70,7 @@ const AGENT_RANGE_ALIASES = {
 
 function getAuthRef() {
   const authRef = createAuthRef();
-  if (!authRef.cookies || !authRef.cookies.length || !authRef.csrfToken) {
+  if (!isAuthRefReady(authRef)) {
     throw new Error('无法获取有效登录态或 CSRF Token');
   }
   return authRef;

package/lib/aggregate-table/aggregate-table.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 const querystring = require('querystring');
 
-const { createAuthRef: createCoreAuthRef, createYidaClient } = require('../core/yida-client');
+const { createAuthRef: createCoreAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { buildYidaTitleI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
@@ -97,7 +97,7 @@ function assertSuccess(result, action) {
 
 async function createAuthRef() {
   const authRef = createCoreAuthRef();
-  if (!authRef.cookies || authRef.cookies.length === 0) {
+  if (!isAuthRefReady(authRef)) {
     throw new Error(t('aggregate_table.no_login'));
   }
   return authRef;

package/lib/ai/ai.js

@@ -15,7 +15,7 @@ const {
   findProjectRoot,
 } = require('../core/utils');
 const { CliError } = require('../core/cli-error');
-const { createAuthRef, createYidaClient } = require('../core/yida-client');
+const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 
 const DEFAULT_MAX_TOKENS = 3000;
 const DEFAULT_IMAGE_CONNECTOR = {
@@ -46,7 +46,7 @@ function printHelp() {
   image    上传本地图片并调用识图连接器；也可直接传入 --image-url
 
 image 选项:
-  --app-type <APP_XXX>        上传图片使用的宜搭应用 ID；未传时尝试读取当前 project/config.json 或 Cookie
+  --app-type <APP_XXX>        上传图片使用的宜搭应用 ID；未传时尝试读取当前 project/config.json
   --form-uuid <FORM_XXX>      可选，上传回调关联的表单 ID
   --connector-id <id>         识图 HTTP 连接器 ID，默认使用 HAR 中的植物识别连接器
   --action-id <id>            识图动作 ID，默认 flowerrecognize
@@ -146,7 +146,7 @@ function getAuthRef(options = {}) {
   if (options.baseUrl) {
     authRef.baseUrl = options.baseUrl;
   }
-  if (!authRef.cookies || authRef.cookies.length === 0 || !authRef.csrfToken) {
+  if (!isAuthRefReady(authRef)) {
     throw new CliError('未获取到有效宜搭登录态，请先执行 openyida login', {
       code: 'NEED_LOGIN',
     });
@@ -154,12 +154,7 @@ function getAuthRef(options = {}) {
   return authRef;
 }
 
-function getCookieValue(authRef, name) {
-  const matched = (authRef.cookies || []).filter(cookie => cookie.name === name);
-  return matched.length ? matched[0].value : '';
-}
-
-function inferAppType(options, authRef) {
+function inferAppType(options) {
   if (options.appType) {
     return options.appType;
   }
@@ -173,11 +168,11 @@ function inferAppType(options, authRef) {
         return config.appType;
       }
     } catch {
-      // ignore invalid local config and continue with cookie fallback
+      // ignore invalid local config and continue with explicit appType validation
     }
   }
 
-  return getCookieValue(authRef, 'tianshu_app_type');
+  return '';
 }
 
 function getSuccessContent(response, fallbackMessage, code = 'AI_REQUEST_FAILED') {
@@ -334,7 +329,7 @@ async function uploadImageForAI(filePath, options, authRef) {
     });
   }
 
-  const appType = inferAppType(options, authRef);
+  const appType = inferAppType(options);
   if (!appType) {
     throw new CliError('上传图片需要 appType，请传入 --app-type APP_XXX', {
       code: 'AI_IMAGE_APP_TYPE_REQUIRED',

package/lib/app/canvas-compile.js

@@ -273,8 +273,8 @@ function compileCanvasLocal(source) {
 }
 
 /**
- * 兼容既有调用方（publish.js `await compileCanvas(src, { cookies })`）的异步入口。
- * 本地编译不需要 cookies/endpoint，options 保留但忽略。
+ * 兼容既有调用方传入 options 的异步入口。
+ * 本地编译不需要 endpoint，options 保留但忽略。
  * @param {string} source
  * @param {object} [options] 兼容占位，未使用
  * @returns {Promise<{ runtimeCode: string, importedModules: string }>}

package/lib/app/create-app.js

@@ -10,12 +10,10 @@ const fs = require('fs');
 const path = require('path');
 const querystring = require('querystring');
 const {
-  loadCookieData,
-  triggerLogin,
-  resolveBaseUrl,
   httpPost,
   requestWithAutoLogin,
 } = require('../core/utils');
+const { createAuthRef } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
@@ -232,18 +230,7 @@ async function run(args) {
 
   // Step 1: 读取登录态
   step(1, t('common.step_login', 1));
-  let cookieData = loadCookieData();
-  if (!cookieData) {
-    info(t('common.login_no_cache'));
-    cookieData = triggerLogin();
-  }
-
-  const authRef = {
-    csrfToken: cookieData.csrf_token,
-    cookies: cookieData.cookies,
-    baseUrl: resolveBaseUrl(cookieData),
-    cookieData,
-  };
+  const authRef = createAuthRef();
   chalkSuccess(t('common.login_ready', authRef.baseUrl));
 
   const contentLocale = resolveContentLocale({ locale: params.locale, baseUrl: authRef.baseUrl });
@@ -260,8 +247,7 @@ async function run(args) {
     const corpConfig = await httpPost(
       authRef.baseUrl,
       `/query/exclusive/queryCorpAppConfig.json?_api=Global.queryCorpAppConfig&_mock=false&_csrf_token=${authRef.csrfToken}&_locale_time_zone_offset=28800000&_stamp=${Date.now()}`,
-      '',
-      authRef.cookies
+      ''
     );
     if (corpConfig && corpConfig.content) {
       if (corpConfig.content.forceExclusiveDb === 'y') {openExclusive = 'y';}
@@ -289,14 +275,14 @@ async function run(args) {
       openExclusiveUnit: 'n',
       group: 'ALL',
     });
-    return httpPost(auth.baseUrl, '/query/app/registerApp.json', postData, auth.cookies);
+    return httpPost(auth.baseUrl, '/query/app/registerApp.json', postData);
   }, authRef);
 
   // 输出结果
   if (response && response.success && response.content) {
     const appType = response.content;
     const appUrl = `${authRef.baseUrl}/${appType}/admin`;
-    const corpId = authRef.cookieData.corp_id || '';
+    const corpId = authRef.corpId || (authRef.authData && authRef.authData.corp_id) || '';
 
     chalkResult(true, t('create_app.success'), [
       ['appType', appType],