openyida 2026.7.13 → 2026.7.14-2

package/lib/core/agent-capabilities.js

@@ -1,22 +1,96 @@
 'use strict';
 
+const crypto = require('crypto');
 const path = require('path');
 const { version } = require('../../package.json');
 const { t } = require('./i18n');
 const { buildCommandManifest } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
-const { checkLoginOnly } = require('../auth/login');
+const { tokenStatus } = require('../auth/token-auth');
 
 function redactLogin(login) {
   const redacted = { ...login };
-  delete redacted.csrf_token;
-  delete redacted.cookies;
+  delete redacted.access_token;
+  delete redacted.refresh_token;
   return redacted;
 }
 
+function compactLogin(login) {
+  return {
+    status: login.status,
+    can_auto_use: login.can_auto_use === true,
+  };
+}
+
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
+  }
+  if (!value || typeof value !== 'object') {
+    return value;
+  }
+
+  return Object.keys(value)
+    .sort()
+    .reduce((result, key) => {
+      result[key] = canonicalize(value[key]);
+      return result;
+    }, {});
+}
+
+function buildCommandManifestDigest(manifest) {
+  const digestPayload = {
+    schema_version: manifest.schema_version,
+    command_prefix: manifest.command_prefix,
+    summary: {
+      command_count: manifest.summary.command_count,
+      group_count: manifest.summary.group_count,
+      side_effect_counts: manifest.summary.side_effect_counts,
+      permission_mode_counts: manifest.summary.permission_mode_counts,
+      core_workflows: manifest.summary.core_workflows,
+    },
+    commands: manifest.commands.map(entry => ({
+      id: entry.id,
+      usage: entry.usage,
+      requires_login: entry.requires_login,
+      output: entry.output,
+      side_effect_kind: entry.side_effect && entry.side_effect.kind,
+      permission_mode: entry.permission && entry.permission.mode,
+      permission_effect: entry.permission && entry.permission.effect,
+    })),
+  };
+
+  return crypto
+    .createHash('sha256')
+    .update(JSON.stringify(canonicalize(digestPayload)))
+    .digest('hex');
+}
+
+function buildAgentCapabilitiesSummary() {
+  const envSnapshot = buildEnvironmentSnapshot();
+  const loginStatus = tokenStatus({ includeSecrets: false });
+  const manifest = buildCommandManifest({ t, version });
+  const projectRoot = envSnapshot.active.projectRoot;
+
+  return {
+    schema_version: 1,
+    name: 'openyida-agent-capabilities-summary',
+    version,
+    login: compactLogin(loginStatus),
+    workdir: projectRoot,
+    workdir_exists: !!envSnapshot.active.projectRootExists,
+    cache_dir: path.join(projectRoot, '.cache'),
+    openyida_task_cache_dir: path.join(projectRoot, '.cache', 'openyida'),
+    command_manifest_digest: buildCommandManifestDigest(manifest),
+    command_manifest_digest_algorithm: 'sha256',
+    command_count: manifest.summary.command_count,
+    full_capabilities_command: 'openyida agent-capabilities --json',
+  };
+}
+
 function buildAgentCapabilities() {
   const envSnapshot = buildEnvironmentSnapshot();
-  const loginStatus = redactLogin(checkLoginOnly({ includeSecrets: false }));
+  const loginStatus = redactLogin(tokenStatus({ includeSecrets: false }));
   const manifest = buildCommandManifest({ t, version });
   const projectRoot = envSnapshot.active.projectRoot;
 
@@ -32,7 +106,8 @@ function buildAgentCapabilities() {
     active: envSnapshot.active,
     login: loginStatus,
     recommended: {
-      preflight_command: 'openyida agent-capabilities --json',
+      preflight_command: 'openyida agent-capabilities --summary-json',
+      full_capabilities_command: 'openyida agent-capabilities --json',
       mutation_guard: 'Run mutating commands only when login.status is ok or after a successful openyida login.',
       workdir: projectRoot,
       cache_dir: path.join(projectRoot, '.cache'),
@@ -58,7 +133,7 @@ function buildAgentCapabilities() {
     },
     sideEffects: {
       read_only_preflight: [
-        'openyida agent-capabilities --json',
+        'openyida agent-capabilities --summary-json',
         'openyida env --json',
         'openyida login --check-only --json',
         'openyida commands --json',
@@ -80,11 +155,20 @@ function buildAgentCapabilities() {
   };
 }
 
-async function run() {
-  console.log(JSON.stringify(buildAgentCapabilities(), null, 2));
+function shouldUseSummary(args = []) {
+  return args.includes('--summary-json') || args.includes('--compact');
+}
+
+async function run(args = []) {
+  const payload = shouldUseSummary(args)
+    ? buildAgentCapabilitiesSummary()
+    : buildAgentCapabilities();
+  console.log(JSON.stringify(payload, null, 2));
 }
 
 module.exports = {
   buildAgentCapabilities,
+  buildAgentCapabilitiesSummary,
+  buildCommandManifestDigest,
   run,
 };

package/lib/core/batch.js

@@ -1,5 +1,5 @@
 /**
- * batch.js - 批量命令编排（一次登录，多条命令复用 Cookie 缓存）
+ * batch.js - 批量命令编排（一次登录，多条命令复用 token 缓存）
  *
  * 用法：
  *   openyida batch <commands-file>                 # 从文件读取，每行一条命令
@@ -14,9 +14,9 @@
  * 设计要点：
  * - 零侵入：不修改任何已有命令的 run() 函数
  * - 每条子命令通过 child_process.execFileSync 调用 bin/yida.js，
- *   Cookie 文件已在磁盘上，各命令读取时直接命中缓存（零登录开销）
+ *   token 文件已在磁盘上，各命令读取时直接命中缓存（零登录开销）
  * - 子命令自动注入 --quiet，stdout 只收 JSON，stderr 静默
- * - batch 启动时先做一次 loadCookieData 预检，确保登录态可用
+ * - batch 启动时先做一次 loadAuthData 预检，确保登录态可用
  */
 
 'use strict';
@@ -24,7 +24,7 @@
 const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { loadCookieData, triggerLogin } = require('./utils');
+const { loadAuthData, triggerLogin } = require('./utils');
 const { banner, step, success, fail, info, warn, result, label } = require('./chalk');
 
 const YIDA_BIN = path.resolve(__dirname, '../../bin/yida.js');
@@ -211,12 +211,12 @@ async function run(args) {
     step(1, '检查登录态');
   }
 
-  let cookieData = loadCookieData();
-  if (!cookieData) {
+  let authData = loadAuthData();
+  if (!authData) {
     if (!quiet) { info('未找到登录缓存，触发登录...'); }
-    cookieData = triggerLogin();
+    authData = triggerLogin();
   }
-  if (!cookieData) {
+  if (!authData) {
     fail('登录失败，无法执行批量命令');
     console.log(JSON.stringify({ success: false, error: 'login_failed' }));
     process.exit(1);

package/lib/core/check-data.js

@@ -17,7 +17,7 @@ const fs = require('fs');
 const path = require('path');
 const { warn } = require('./chalk');
 const { CliError } = require('./cli-error');
-const { createAuthRef, createYidaClient } = require('./yida-client');
+const { createAuthRef, createYidaClient, isAuthRefReady } = require('./yida-client');
 
 const USAGE = `openyida data check - 流程表单异常数据检测
 
@@ -78,7 +78,7 @@ function parseError(message) {
 
 function ensureSession() {
   const authRef = createAuthRef();
-  if (!authRef.cookies || authRef.cookies.length === 0 || !authRef.csrfToken) {
+  if (!isAuthRefReady(authRef)) {
     fail('无法获取有效登录态或 CSRF Token');
   }
   return authRef;

package/lib/core/command-manifest.js

@@ -703,13 +703,13 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [target-url] [--qr|--agent-qr|--codex|--browser] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--corp-id <corpId>]', 'help.cmd_login', {
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>]', 'help.cmd_login', {
         requiresLogin: false,
         output: 'json',
       }),
       command('logout', ['logout'], 'logout', 'help.cmd_logout', { requiresLogin: false }),
       command('auth', ['auth'], 'auth <status|login|refresh|logout>', 'help.cmd_auth', { requiresLogin: false }),
-      command('org', ['org'], 'org <list|switch>', 'help.cmd_org'),
+      command('org', ['org'], 'org <list|switch> [--json] [--corp-id <corpId>]', 'help.cmd_org'),
       command('env', ['env'], 'env [--json|setup|list|show|switch|add|remove] [options]', 'help.cmd_env', {
         requiresLogin: false,
         output: 'text|json',
@@ -871,7 +871,7 @@ const COMMAND_GROUPS = [
         requiresLogin: false,
         output: 'json',
       }),
-      command('agent-capabilities', ['agent-capabilities'], 'agent-capabilities [--json]', 'help.cmd_agent_capabilities', {
+      command('agent-capabilities', ['agent-capabilities'], 'agent-capabilities [--json] [--summary-json|--compact]', 'help.cmd_agent_capabilities', {
         requiresLogin: false,
         output: 'json',
       }),

package/lib/core/doctor.js

@@ -199,19 +199,19 @@ class EnvironmentChecker {
       require.resolve('playwright');
       return {
         id: 'env-playwright',
-        label: '可选浏览器登录（Playwright 已安装）',
+        label: '可选浏览器能力（Playwright 已安装）',
         passed: true,
         severity: Severity.INFO,
-        message: '已安装 Playwright，可使用兼容的本地浏览器扫码登录路径',
+        message: '当前 CLI 默认使用 OAuth token 登录；Playwright 仅用于少量浏览器预览或兼容场景',
         fixType: null,
       };
     } catch {
       return {
         id: 'env-playwright',
-        label: '可选浏览器登录（Playwright 未安装）',
+        label: '可选浏览器能力（Playwright 未安装）',
         passed: true,
         severity: Severity.INFO,
-        message: '默认登录优先使用终端二维码或本地 CDP；AI 工具在 CDP 不可用时返回对话框二维码 handoff，不需要 Playwright',
+        message: '当前 CLI 默认使用 OAuth token 登录，不依赖 Playwright',
         fixType: null,
       };
     }
@@ -254,32 +254,29 @@ class EnvironmentChecker {
   }
 
   checkLoginStatus() {
-    // 使用统一的 loadCookieData 加载登录态（兼容多环境 cookie 文件）
-    const { loadCookieData } = require('./utils');
-    const cookieData = loadCookieData(this.projectRoot);
+    const { tokenStatus } = require('../auth/token-auth');
+    const status = tokenStatus({ projectRoot: this.projectRoot });
 
-    if (!cookieData || !cookieData.cookies || cookieData.cookies.length === 0) {
+    if (status.status !== 'ok') {
       return {
         id: 'env-login',
-        label: '宜搭登录态',
+        label: '宜搭 token 登录态',
         passed: false,
         severity: Severity.WARNING,
-        message: '未登录（运行 openyida login 登录）',
+        message: '未登录或 token 已过期（运行 openyida login 登录）',
         fixType: FixType.COMMAND,
-        fixCommand: 'openyida login --qr',
+        fixCommand: 'openyida login',
       };
     }
 
-    const hasToken = cookieData.cookies.some((c) => c.name === 'tianshu_csrf_token');
-    const passed = hasToken;
     return {
       id: 'env-login',
-      label: `宜搭登录态：${passed ? '已登录' : 'Cookie 存在但可能已过期'}`,
-      passed,
-      severity: passed ? Severity.INFO : Severity.WARNING,
-      message: passed ? null : 'Cookie 可能已过期，运行 openyida login 重新登录',
-      fixType: passed ? null : FixType.COMMAND,
-      fixCommand: passed ? null : 'openyida login --qr',
+      label: '宜搭 token 登录态：已登录',
+      passed: true,
+      severity: Severity.INFO,
+      message: null,
+      fixType: null,
+      fixCommand: null,
     };
   }
 
@@ -287,10 +284,10 @@ class EnvironmentChecker {
     try {
       const https = require('https');
       const http = require('http');
-      const { loadCookieData } = require('./utils');
+      const { loadAuthData } = require('./utils');
       const { resolveEndpoint } = require('./env-manager');
-      const cookieData = loadCookieData(this.projectRoot);
-      const baseUrl = resolveEndpoint(cookieData, this.projectRoot);
+      const authData = loadAuthData(this.projectRoot);
+      const baseUrl = resolveEndpoint(authData, this.projectRoot);
       const parsedUrl = new URL(baseUrl);
       const requestModule = parsedUrl.protocol === 'https:' ? https : http;
       await new Promise((resolve, reject) => {

package/lib/core/env-cmd.js

@@ -214,7 +214,6 @@ function cmdShow(envName) {
   if (envConfig.tenantId) {
     console.log(`  ${BOLD}租户 ID：${RESET}   ${envConfig.tenantId}`);
   }
-  console.log(`  ${BOLD}Cookie 文件：${RESET}${envConfig.cookieFile || 'cookies-public.json'}`);
   console.log('');
 }
 
@@ -358,7 +357,6 @@ async function cmdAdd(envName) {
     baseUrl: baseUrl.replace(/\/+$/, ''),
     loginUrl: loginUrl || inferredLoginUrl,
     description: description || undefined,
-    cookieFile: `cookies-${envName}.json`,
   };
 
   if (dwsEndpoint) { newEnvConfig.dwsEndpoint = dwsEndpoint; }
@@ -381,7 +379,7 @@ async function cmdAdd(envName) {
   console.log('');
   console.log(`${YELLOW}下一步：切换到该环境并登录${RESET}`);
   console.log(`  ${CYAN}openyida env switch ${envName}${RESET}`);
-  console.log(`  ${CYAN}openyida login --qr${RESET}`);
+  console.log(`  ${CYAN}openyida login${RESET}`);
   console.log('');
 }
 

package/lib/core/env-manager.js

@@ -1,14 +1,12 @@
 /**
  * env-manager.js - 多环境配置管理
  *
- * 支持公有云与私有化宜搭并存，通过环境配置文件管理多套端点和登录态。
+ * 支持公有云与私有化宜搭并存，通过环境配置文件管理多套端点。
  *
  * 配置文件：{projectRoot}/.cache/openyida-envs.json
- * Cookie 隔离：.cache/cookies-{envName}.json
- *
  * 优先级（高 → 低）：
  *   1. 环境变量 OPENYIDA_ENDPOINT
- *   2. cookieData.base_url（登录后实际跳转域名）
+ *   2. authData.base_url（登录后实际跳转域名）
  *   3. 环境变量 OPENYIDA_ENV 指定的环境配置
  *   4. 当前激活的环境配置（openyida-envs.json current 字段）
  *   5. 默认公有云 https://www.aliwork.com
@@ -17,11 +15,8 @@
  *   loadEnvsConfig()          - 读取环境配置文件（不存在则返回默认公有云配置）
  *   saveEnvsConfig(config)    - 写入环境配置文件
  *   getCurrentEnvConfig()     - 获取当前激活的环境配置（含环境变量覆盖）
- *   getCookieFilePath(root)   - 获取当前环境的 Cookie 文件绝对路径
- *   migrateOldCookieFile()    - 迁移旧版 cookies.json → cookies-public.json
  *   resolveEndpoint()         - 解析最终 baseUrl（含完整优先级）
  *   resolveLoginUrl()         - 解析最终登录 URL
- *   deriveBaseUrlFromLoginState() - 从 Cookie + 浏览器当前 URL 解析实际 baseUrl
  */
 
 'use strict';
@@ -95,7 +90,6 @@ const DEFAULT_PUBLIC_ENV = {
   baseUrl: DEFAULT_BASE_URL,
   loginUrl: DEFAULT_LOGIN_URL,
   description: '阿里云公有云宜搭',
-  cookieFile: 'cookies-public.json',
 };
 
 /** 阿里内网宜搭环境配置 */
@@ -103,7 +97,6 @@ const DEFAULT_ALIBABA_INTERNAL_ENV = {
   baseUrl: ALIBABA_INTERNAL_BASE_URL,
   loginUrl: ALIBABA_INTERNAL_LOGIN_URL,
   description: '阿里内网宜搭',
-  cookieFile: 'cookies-alibaba.json',
 };
 
 /** 海外版 YiDA / DingTalk International 环境配置 */
@@ -111,7 +104,6 @@ const DEFAULT_INTERNATIONAL_ENV = {
   baseUrl: INTERNATIONAL_BASE_URL,
   loginUrl: INTERNATIONAL_LOGIN_URL,
   description: '海外版 YiDA Apps / DingTalk International（www.yidaapps.com）',
-  cookieFile: 'cookies-intl.json',
 };
 
 const BUILTIN_ENVIRONMENTS = {
@@ -158,13 +150,6 @@ const ENV_ALIASES = {
   '内网': 'alibaba',
 };
 
-const SHARED_COOKIE_DOMAINS = new Set([
-  'aliwork.com',
-  'yidaapps.com',
-  'alibaba-inc.com',
-  'yidaapps.com',
-]);
-
 const KNOWN_YIDA_HOSTS = new Set([
   'www.aliwork.com',
   'www.yidaapps.com',
@@ -208,8 +193,7 @@ function isLegacyInternationalEnv(envConfig) {
   return !!(
     envConfig &&
     normalizeBaseUrl(envConfig.baseUrl, null) === DEFAULT_BASE_URL &&
-    (!envConfig.loginUrl || envConfig.loginUrl === LEGACY_INTERNATIONAL_LOGIN_URL) &&
-    (!envConfig.cookieFile || envConfig.cookieFile === 'cookies-intl.json')
+    (!envConfig.loginUrl || envConfig.loginUrl === LEGACY_INTERNATIONAL_LOGIN_URL)
   );
 }
 
@@ -244,10 +228,6 @@ function normalizeHostname(value) {
   return trimmed;
 }
 
-function isSharedCookieDomain(hostname) {
-  return SHARED_COOKIE_DOMAINS.has(normalizeHostname(hostname));
-}
-
 function isYidaServiceHost(hostname) {
   const host = normalizeHostname(hostname);
   if (!host) { return false; }
@@ -323,55 +303,6 @@ function inferLoginUrlForBaseUrl(baseUrl, fallbackLoginUrl) {
   return fallbackLoginUrl || `${normalizedBaseUrl}/workPlatform`;
 }
 
-function cookieDomainToBaseUrl(domain, fallbackUrl) {
-  const host = normalizeHostname(domain);
-  if (!host || isSharedCookieDomain(host)) {
-    return null;
-  }
-
-  const fallbackOrigin = normalizeBaseUrl(fallbackUrl, null);
-  if (fallbackOrigin) {
-    const fallbackHost = normalizeHostname(fallbackOrigin);
-    if (host === fallbackHost) {
-      return fallbackOrigin;
-    }
-  }
-
-  if (isYidaServiceHost(host)) {
-    return `https://${host}`;
-  }
-
-  return null;
-}
-
-function deriveBaseUrlFromCookies(cookies = [], fallbackUrl = DEFAULT_BASE_URL) {
-  const fallbackOrigin = normalizeBaseUrl(fallbackUrl, DEFAULT_BASE_URL);
-  const cookieList = Array.isArray(cookies) ? cookies : [];
-  const preferredCookieNames = ['yida_user_cookie', 'tianshu_csrf_token'];
-
-  for (const cookieName of preferredCookieNames) {
-    const cookie = cookieList.find((item) => item && item.name === cookieName && item.domain);
-    const baseUrl = cookie ? cookieDomainToBaseUrl(cookie.domain, fallbackOrigin) : null;
-    if (baseUrl) { return baseUrl; }
-  }
-
-  return fallbackOrigin;
-}
-
-function deriveBaseUrlFromLoginState(cookies = [], loginUrl = DEFAULT_LOGIN_URL, currentUrl = null) {
-  const fallbackBaseUrl = deriveBaseUrlFromUrl(loginUrl, currentUrl);
-  const cookieBaseUrl = deriveBaseUrlFromCookies(cookies, fallbackBaseUrl);
-  const currentOrigin = normalizeBaseUrl(currentUrl, null);
-  const currentHost = normalizeHostname(currentOrigin);
-  const loginHost = normalizeHostname(normalizeBaseUrl(loginUrl, null));
-
-  if (currentOrigin && isYidaServiceHost(currentHost) && currentHost !== loginHost) {
-    return currentOrigin;
-  }
-
-  return cookieBaseUrl;
-}
-
 function deriveBaseUrlFromUrl(fallbackBaseUrl, candidateUrl) {
   let fallbackOrigin = normalizeBaseUrl(fallbackBaseUrl, DEFAULT_BASE_URL);
   const fallbackHost = normalizeHostname(fallbackOrigin);
@@ -468,67 +399,27 @@ function getCurrentEnvConfig(projectRoot) {
   return { name: envName, config: envConfig };
 }
 
-// ── Cookie 文件路径 ───────────────────────────────────
-
-/**
- * 获取当前环境的 Cookie 文件绝对路径。
- * 若环境配置不存在，兜底使用 cookies-public.json。
- * @param {string} [projectRoot]
- * @returns {string}
- */
-function getCookieFilePath(projectRoot) {
-  const root = projectRoot || findProjectRoot();
-  const { config: envConfig } = getCurrentEnvConfig(root);
-  const cookieFileName = envConfig.cookieFile || 'cookies-public.json';
-  return path.join(root, '.cache', cookieFileName);
-}
-
-// ── 旧版 Cookie 迁移 ──────────────────────────────────
-
-/**
- * 将旧版 cookies.json 迁移为 cookies-public.json。
- * 仅在旧文件存在且新文件不存在时执行，保证向后兼容。
- * @param {string} [projectRoot]
- * @returns {boolean} 是否执行了迁移
- */
-function migrateOldCookieFile(projectRoot) {
-  const root = projectRoot || findProjectRoot();
-  const oldFile = path.join(root, '.cache', 'cookies.json');
-  const newFile = path.join(root, '.cache', 'cookies-public.json');
-
-  if (fs.existsSync(oldFile) && !fs.existsSync(newFile)) {
-    try {
-      fs.copyFileSync(oldFile, newFile);
-      // 保留旧文件作为备份，不删除，避免其他工具依赖
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-
 // ── 端点解析 ──────────────────────────────────────────
 
 /**
  * 解析最终的 baseUrl，按优先级：
  *   1. OPENYIDA_ENDPOINT 环境变量
- *   2. cookieData.base_url（登录后实际跳转域名）
+ *   2. authData.base_url（登录后实际跳转域名）
  *   3. 当前激活环境配置的 baseUrl
  *   4. 默认公有云
- * @param {object} [cookieData]
+ * @param {object} [authData]
  * @param {string} [projectRoot]
  * @returns {string}
  */
-function resolveEndpoint(cookieData, projectRoot) {
+function resolveEndpoint(authData, projectRoot) {
   // 优先级 1：环境变量强制指定
   if (process.env.OPENYIDA_ENDPOINT) {
     return normalizeBaseUrl(process.env.OPENYIDA_ENDPOINT, DEFAULT_BASE_URL);
   }
 
   // 优先级 2：登录缓存中记录的实际服务域名
-  if (cookieData && cookieData.base_url) {
-    return normalizeBaseUrl(cookieData.base_url, DEFAULT_BASE_URL);
+  if (authData && authData.base_url) {
+    return normalizeBaseUrl(authData.base_url, DEFAULT_BASE_URL);
   }
 
   // 优先级 3：当前激活环境配置
@@ -584,8 +475,6 @@ module.exports = {
   loadEnvsConfig,
   saveEnvsConfig,
   getCurrentEnvConfig,
-  getCookieFilePath,
-  migrateOldCookieFile,
   resolveEndpoint,
   resolveLoginUrl,
   normalizeBaseUrl,
@@ -595,7 +484,5 @@ module.exports = {
   inferEnvironmentNameFromUrl,
   inferLoginUrlForBaseUrl,
   deriveBaseUrlFromDingtalkOAuthUrl,
-  deriveBaseUrlFromCookies,
-  deriveBaseUrlFromLoginState,
   deriveBaseUrlFromUrl,
 };