openyida 2026.7.14-2 → 2026.7.14

package/README.md

@@ -55,10 +55,10 @@ If Codex is already installed, OpenYida also imports a local Codex plugin during
 Run this from the AI coding workspace where you want OpenYida to operate:
 
 ```bash
-openyida agent-capabilities --summary-json
+openyida agent-capabilities --json
 ```
 
-OpenYida returns a compact machine-readable summary with the version, login state, workspace/cache paths, and command manifest digest. `openyida agent-capabilities --json` is the full diagnostic snapshot, where compact `workdir` maps to `active.projectRoot` and `workdir_exists` maps to `active.projectRootExists`. `openyida commands --json` remains available when an agent only needs the command manifest.
+OpenYida detects the active agent environment, workspace path, login state, organization context, command manifest, and side-effect hints in one machine-readable snapshot. `openyida commands --json` remains available when an agent only needs the command manifest.
 
 ### 3. Log In
 
@@ -66,20 +66,27 @@ OpenYida returns a compact machine-readable summary with the version, login stat
 openyida login
 ```
 
-OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the current project cache.
+In Codex, QoderWork, Qoder, Wukong, Claude Code, MuleRun, OpenCode, Cursor, and other detected AI tools, OpenYida first tries local Chrome/Edge/Chromium CDP when no valid cached login exists. If local CDP is unavailable, it falls back to an AI-dialog QR handoff. The agent should render `qr_image_markdown` or paste `agent_response_markdown` directly in the conversation so the QR code is visible, then run `poll_command` after the user scans it with DingTalk. If image rendering is unavailable, fall back to `qr_url`. The explicit `openyida login --browser` command still prefers CDP first and uses Playwright as an optional browser fallback.
 
-When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and token session file. For example, Alibaba intranet Yida uses `auth-token-alibaba.json`:
+When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and cookie file. For example, Alibaba intranet Yida uses `cookies-alibaba.json`:
 
 ```bash
 openyida login https://yida-group.alibaba-inc.com/
 openyida login --alibaba
 ```
 
-For token status checks, use:
+The explicit QR polling command remains available:
 
 ```bash
+openyida login --agent-qr
+```
+
+For terminal QR login, use:
+
+```bash
+openyida login --qr
+openyida login --qr --corp-id dingxxxxxxxx
 openyida login --check-only --json
-openyida auth status
 ```
 
 OpenYida does not install Playwright by default.
@@ -232,7 +239,7 @@ OPENYIDA_E2E=1 OPENYIDA_E2E_FULL_STAGES=auth,app,form,process npm run test:e2e:r
 npm run test:e2e:real:skills
 ```
 
-The runner creates a disposable app, form, and custom page with an `OY_E2E_*` prefix, then verifies token login, app listing, schema fetch, data query, and page publish. It writes a registry to `project/.cache/e2e-real/` so created resources can be audited later. Run `openyida login` for the target environment before starting the real E2E runner.
+The runner creates a disposable app, form, and custom page with an `OY_E2E_*` prefix, then verifies login, app listing, schema fetch, data query, and page publish. It writes a registry to `project/.cache/e2e-real/` so created resources can be audited later. To inject CI cookies without relying on a local login cache, pass `OPENYIDA_E2E_COOKIES_BASE64` as a base64 encoded cookie array or `{ "cookies": [...] }` object.
 
 `test:e2e:real:full` extends the smoke path into a broad deterministic feature matrix: auth/env, app update, form update and option mutation, page build/compile/generate/publish, data create/get/update/query, permission read, page config and short URL check, report create/append, dashboard skill verification, export/import, batch, task-center, formula/doctor/sample/CDN config, and local connector parsing/template generation. AI-backed commands such as `flash-to-prd` are available as the optional `ai` stage because they depend on remote model availability. Workflow mutation is available as the opt-in `process` stage; it creates and republishes a workflow on the disposable E2E form and records advanced official-node fixtures for review.
 
@@ -332,11 +339,11 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>]` | Login with OAuth token mode |
-| `openyida logout` | Logout / clear token |
-| `openyida auth <status\|login\|refresh\|logout>` | Token login state management |
-| `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch by OAuth re-login) |
-| `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
+| `openyida login [target-url] [--qr\|--agent-qr\|--codex\|--browser] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--corp-id <corpId>]` | Login (cache first, --browser or --agent-qr when needed) |
+| `openyida logout` | Logout / switch account |
+| `openyida auth <status\|login\|refresh\|logout>` | Login state management |
+| `openyida org <list\|switch>` | Organization management (list / switch) |
+| `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & login state |
 
 ### App Management
 
@@ -450,7 +457,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida commands [--json]` | Output machine-readable command manifest |
-| `openyida agent-capabilities [--json] [--summary-json\|--compact]` | Output one-shot agent capability snapshot |
+| `openyida agent-capabilities [--json]` | Output one-shot agent capability snapshot |
 | `openyida a2a <serve\|agent-card> [options]` | Start local read-only A2A adapter or print Agent Card |
 | `openyida bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open\|--no-open]` | Start OpenYida local web bridge service |
 | `openyida copy [--force]` | Copy project working directory |
@@ -578,9 +585,9 @@ When adding new CLI commands, register the route in `bin/yida.js`, add it to `li
 
 ## Security and Configuration
 
-- OAuth token sessions are cached locally and should never be hard-coded into source files.
+- Login cookies are cached locally and should never be hard-coded into source files.
 - Private deployment environments are managed through `lib/core/env-manager.js`.
-- Yida API requests should use the active environment base URL and Bearer token auth.
+- Yida API requests should use the active environment base URL and authenticated cookies.
 - For multi-organization accounts, prefer explicit `--corp-id` values in non-interactive automation.
 
 ## Community

package/bin/yida.js

@@ -211,38 +211,6 @@ function handleFirstRunGuide() {
   console.log('');
 }
 
-const TOKEN_OUTPUT_SECRET_KEYS = new Set([
-  'access_token',
-  'accessToken',
-  'refresh_token',
-  'refreshToken',
-  'ai_app_user_auth_token',
-  'aiAppUserAuthToken',
-  'tianshu_csrf_token',
-  'tianshuCsrfToken',
-  'csrf_token',
-  'csrfToken',
-]);
-
-function maskSensitiveAuthOutput(value) {
-  if (!value || typeof value !== 'object') {
-    return value;
-  }
-  const { maskToken } = require('../lib/auth/token-store');
-  if (Array.isArray(value)) {
-    return value.map((item) => maskSensitiveAuthOutput(item));
-  }
-  const output = {};
-  Object.entries(value).forEach(([key, item]) => {
-    if (TOKEN_OUTPUT_SECRET_KEYS.has(key)) {
-      output[key] = maskToken(item);
-    } else {
-      output[key] = maskSensitiveAuthOutput(item);
-    }
-  });
-  return output;
-}
-
 function printLoginResult(result) {
   noteLoginCommandResult(result);
 
@@ -256,21 +224,49 @@ function printLoginResult(result) {
     return;
   }
 
-  const tokenUsable = result.can_auto_use !== false && !!result.access_token;
+  if (result && (result.status === 'need_qr_scan' || result.status === 'need_corp_selection')) {
+    console.log(JSON.stringify(result));
+    return;
+  }
+
+  if (result && result.status === 'need_codex_browser_login') {
+    const handoff = {
+      status: result.status,
+      handoff_type: result.handoff_type || 'browser',
+      can_auto_use: false,
+      browser: result.browser,
+      login_url: result.login_url,
+      message: result.message,
+    };
+    [
+      'agent_action',
+      'browser_open_strategy',
+      'browser_use_local_redirect_fallback',
+      'required_agent_tool',
+      'required_runtime_tool',
+      'cookie_export_file',
+      'cookie_file',
+      'post_login_check_command',
+      'fallback_command',
+    ].forEach((key) => {
+      if (result[key]) {handoff[key] = result[key];}
+    });
+    console.log(JSON.stringify(handoff));
+    return;
+  }
+
+  if (result.status && result.status !== 'ok' && !result.csrf_token) {
+    console.log(JSON.stringify(result));
+    return;
+  }
+
   const summary = {
-    ok: tokenUsable,
-    status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
-    auth_mode: 'token',
-    can_auto_use: tokenUsable,
-    token_type: result.token_type || 'Bearer',
-    access_token: maskSensitiveAuthOutput({ access_token: result.access_token }).access_token,
-    expires_at: result.expires_at ? new Date(result.expires_at).toISOString() : undefined,
-    base_url: result.base_url,
-    corp_id: result.corp_id,
-    user_id: result.user_id,
-    user_name: result.user_name,
-    message: result.message,
-    raw: tokenUsable ? undefined : result.raw,
+    ok: true,
+    base_url: result && result.base_url,
+    corp_id: result && result.corp_id,
+    user_id: result && result.user_id,
+    csrf_token: result && result.csrf_token ? `${result.csrf_token.slice(0, 16)}...` : undefined,
+    cookies_count: Array.isArray(result && result.cookies) ? result.cookies.length : (result.cookies_count || 0),
   };
   console.log(JSON.stringify(summary));
 }
@@ -281,11 +277,15 @@ function noteLoginCommandResult(result) {
     let status = 'failed';
     let reason = 'login_failed';
 
-    const tokenLoginOk = result && result.auth_mode === 'token' &&
-      (result.access_token || (result.status === 'ok' && result.can_auto_use));
-    if (result && (tokenLoginOk || (result.status === 'ok' && result.can_auto_use))) {
+    if (result && (result.csrf_token || (result.status === 'ok' && result.can_auto_use))) {
       status = 'success';
       reason = 'login_ok';
+    } else if (result && result.status === 'need_qr_scan') {
+      status = 'need_qr_scan';
+      reason = 'need_qr_scan';
+    } else if (result && result.status === 'need_codex_browser_login') {
+      status = 'need_browser_login';
+      reason = 'need_browser_login';
     } else if (result && result.status === 'need_corp_selection') {
       status = 'success';
       reason = 'need_corp_selection';
@@ -306,6 +306,40 @@ function noteLoginCommandResult(result) {
   }
 }
 
+function isAgentConversationEnvironment() {
+  const { detectActiveTool } = require('../lib/core/utils');
+  return !!detectActiveTool() || process.env.OPENYIDA_AGENT_MODE === '1';
+}
+
+function shouldUseBrowserHandoffLogin(cliArgs) {
+  if (cliArgs.includes('--qr') || cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return false;}
+  if (cliArgs.includes('--browser') || cliArgs.includes('--codex') || cliArgs.includes('--qoder') || cliArgs.includes('--wukong')) {return true;}
+  return false;
+}
+
+function shouldUseAgentLogin(cliArgs) {
+  if (cliArgs.includes('--qr') || cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return false;}
+  if (shouldUseBrowserHandoffLogin(cliArgs)) {return false;}
+  return isAgentConversationEnvironment();
+}
+
+function shouldUsePlaywrightFallbackInAgentLogin() {
+  const { hasDesktopEnvironment } = require('../lib/core/utils');
+  return hasDesktopEnvironment() || process.env.OPENYIDA_AGENT_PLAYWRIGHT_FALLBACK === '1';
+}
+
+function shouldUseLocalBrowserLogin(options = {}) {
+  const { hasLocalBrowserLoginCapability } = require('../lib/auth/login');
+  return hasLocalBrowserLoginCapability({
+    playwrightFallback: options.playwrightFallback,
+  });
+}
+
+function shouldUseCodexQrLogin(cliArgs) {
+  if (cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return true;}
+  return false;
+}
+
 function getArgValue(cliArgs, name) {
   const index = cliArgs.indexOf(name);
   if (index === -1 || !cliArgs[index + 1] || cliArgs[index + 1].startsWith('--')) {
@@ -380,9 +414,11 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--intranet': 'alibaba',
   };
   const valuePassthroughFlags = new Set([
+    '--agent-poll',
+    '--codex-poll',
+    '--agent-select',
+    '--codex-select',
     '--corp-id',
-    '--client-id',
-    '--user-id',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -527,42 +563,129 @@ async function main() {
     }
 
     case 'login': {
+      const { checkLoginOnly } = require('../lib/auth/login');
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { tokenLogin, tokenStatus } = require('../lib/auth/token-auth');
-      if (loginArgs.includes('--check-only')) {
-        console.log(JSON.stringify(tokenStatus(), null, 2));
-      } else {
-        const result = await tokenLogin({
-          clientId: getArgValue(loginArgs, '--client-id'),
-          quiet: loginArgs.includes('--quiet'),
+      const { isEnvAuthMode } = require('../lib/core/utils');
+      if (loginArgs.includes('--agent-poll') || loginArgs.includes('--codex-poll')) {
+        const sessionFile = getArgValue(loginArgs, '--agent-poll') || getArgValue(loginArgs, '--codex-poll');
+        const { pollCodexQrLogin } = require('../lib/auth/qr-login');
+        const result = await pollCodexQrLogin(sessionFile, {
+          corpId: getArgValue(loginArgs, '--corp-id'),
         });
         printLoginResult(result);
+      } else if (loginArgs.includes('--agent-select') || loginArgs.includes('--codex-select')) {
+        const sessionFile = getArgValue(loginArgs, '--agent-select') || getArgValue(loginArgs, '--codex-select');
+        const { selectCodexQrCorp } = require('../lib/auth/qr-login');
+        const result = await selectCodexQrCorp(sessionFile, {
+          corpId: getArgValue(loginArgs, '--corp-id'),
+        });
+        printLoginResult(result);
+      } else if (loginArgs.includes('--check-only')) {
+        const result = checkLoginOnly({ includeSecrets: loginArgs.includes('--with-cookies') });
+        console.log(JSON.stringify(result, null, 2));
+      } else if (isEnvAuthMode()) {
+        const result = checkLoginOnly({ includeSecrets: true });
+        printLoginResult(result);
+      } else if (shouldUseCodexQrLogin(loginArgs)) {
+        const { startCodexQrLogin } = require('../lib/auth/qr-login');
+        const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+        printLoginResult(result);
+      } else if (loginArgs.includes('--browser')) {
+        const { interactiveLogin } = require('../lib/auth/login');
+        const result = interactiveLogin({ force: true });
+        printLoginResult(result);
+      } else if (loginArgs.includes('--qoder') || loginArgs.includes('--wukong')) {
+        const { codexLogin } = require('../lib/auth/codex-login');
+        const result = await codexLogin({ tool: loginArgs.includes('--qoder') ? 'qoder' : 'wukong' });
+        printLoginResult(result);
+      } else if (loginArgs.includes('--qr')) {
+        const { qrLogin } = require('../lib/auth/qr-login');
+        const result = await qrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+        printLoginResult(result);
+      } else if (shouldUseAgentLogin(loginArgs)) {
+        const cachedResult = checkLoginOnly({ includeSecrets: true });
+        if (cachedResult.status === 'ok') {
+          printLoginResult(cachedResult);
+        } else {
+          const { interactiveLogin } = require('../lib/auth/login');
+          const playwrightFallback = shouldUsePlaywrightFallbackInAgentLogin();
+          const browserResult = shouldUseLocalBrowserLogin({ playwrightFallback })
+            ? interactiveLogin({ playwrightFallback })
+            : null;
+          if (browserResult) {
+            printLoginResult(browserResult);
+          } else {
+            const { startCodexQrLogin } = require('../lib/auth/qr-login');
+            const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+            printLoginResult(result);
+          }
+        }
+      } else if (shouldUseBrowserHandoffLogin(loginArgs)) {
+        const cachedResult = checkLoginOnly({ includeSecrets: true });
+        if (cachedResult.status === 'ok') {
+          printLoginResult(cachedResult);
+        } else {
+          const { codexLogin } = require('../lib/auth/codex-login');
+          const result = await codexLogin({ tool: loginArgs.includes('--codex') ? 'codex' : undefined });
+          printLoginResult(result);
+        }
+      } else {
+        const cachedResult = checkLoginOnly({ includeSecrets: true });
+        if (cachedResult.status === 'ok') {
+          printLoginResult(cachedResult);
+          break;
+        }
+        if (shouldUseLocalBrowserLogin({ playwrightFallback: true })) {
+          const { interactiveLogin } = require('../lib/auth/login');
+          const browserResult = interactiveLogin({ playwrightFallback: true });
+          if (browserResult) {
+            printLoginResult(browserResult);
+            break;
+          }
+        }
+        const { qrLogin } = require('../lib/auth/qr-login');
+        const result = await qrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+        printLoginResult(result);
       }
       break;
     }
 
     case 'logout': {
-      const { tokenLogout } = require('../lib/auth/token-auth');
-      console.log(JSON.stringify(await tokenLogout(), null, 2));
+      const { logout } = require('../lib/auth/login');
+      logout();
       break;
     }
 
     case 'auth': {
       const subCommand = args[0];
-      const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-      const { tokenLogin, tokenLogout, tokenRefresh, tokenStatus } = require('../lib/auth/token-auth');
+      const { authStatus, authLogin, authRefresh, authLogout } = require('../lib/auth/auth');
+
       if (subCommand === 'status') {
-        console.log(JSON.stringify(tokenStatus(), null, 2));
+        authStatus();
       } else if (subCommand === 'login') {
-        const result = await tokenLogin({
-          clientId: getArgValue(authArgs, '--client-id'),
-          quiet: authArgs.includes('--quiet'),
+        const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
+        let loginType = 'qrcode';
+        if (authArgs.includes('--codex')) {
+          loginType = 'codex';
+        } else if (authArgs.includes('--qoder')) {
+          loginType = 'qoder';
+        } else if (authArgs.includes('--wukong')) {
+          loginType = 'wukong';
+        } else if (authArgs.includes('--browser')) {
+          loginType = 'browser';
+        }
+        const result = await authLogin({
+          type: loginType,
+          corpId: getArgValue(authArgs, '--corp-id'),
+          forceTerminalQr: authArgs.includes('--qr'),
         });
-        printLoginResult(result);
+        if (result) {
+          printLoginResult(result);
+        }
       } else if (subCommand === 'refresh') {
-        console.log(JSON.stringify(maskSensitiveAuthOutput(await tokenRefresh()), null, 2));
+        authRefresh();
       } else if (subCommand === 'logout') {
-        console.log(JSON.stringify(await tokenLogout(), null, 2));
+        authLogout();
       } else {
         throwCliUsage(t('cli.auth_usage'), t('cli.auth_example'));
       }
@@ -570,9 +693,34 @@ async function main() {
     }
 
     case 'org': {
-      const orgArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { run } = require('../lib/auth/org');
-      await run(orgArgs);
+      const subCommand = args[0];
+      const { listOrganizations, switchOrganization, interactiveSwitch } = require('../lib/auth/org');
+      const { loadCookieData } = require('../lib/core/utils');
+
+      if (subCommand === 'list') {
+        const cookieData = loadCookieData();
+        if (!cookieData || !cookieData.cookies) {
+          throwNeedLogin(t('org.no_login'));
+        }
+        await listOrganizations(cookieData);
+      } else if (subCommand === 'switch') {
+        const cookieData = loadCookieData();
+        if (!cookieData || !cookieData.cookies) {
+          throwNeedLogin(t('org.no_login'));
+        }
+
+        // 解析 --corp-id 参数
+        const corpIdIndex = args.indexOf('--corp-id');
+        if (corpIdIndex !== -1 && args[corpIdIndex + 1]) {
+          const targetCorpId = args[corpIdIndex + 1];
+          await switchOrganization(targetCorpId, cookieData);
+        } else {
+          // 交互式选择
+          await interactiveSwitch(cookieData);
+        }
+      } else {
+        throwCliUsage(t('cli.org_usage'), t('cli.org_example'));
+      }
       break;
     }
 

package/lib/agent-center/api.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
+const { createAuthRef, createYidaClient } = require('../core/yida-client');
 
 const AGENT_TYPE_ALIASES = {
   normal: 'NORMAL',
@@ -70,7 +70,7 @@ const AGENT_RANGE_ALIASES = {
 
 function getAuthRef() {
   const authRef = createAuthRef();
-  if (!isAuthRefReady(authRef)) {
+  if (!authRef.cookies || !authRef.cookies.length || !authRef.csrfToken) {
     throw new Error('无法获取有效登录态或 CSRF Token');
   }
   return authRef;

package/lib/aggregate-table/aggregate-table.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 const querystring = require('querystring');
 
-const { createAuthRef: createCoreAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
+const { createAuthRef: createCoreAuthRef, createYidaClient } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { buildYidaTitleI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
@@ -97,7 +97,7 @@ function assertSuccess(result, action) {
 
 async function createAuthRef() {
   const authRef = createCoreAuthRef();
-  if (!isAuthRefReady(authRef)) {
+  if (!authRef.cookies || authRef.cookies.length === 0) {
     throw new Error(t('aggregate_table.no_login'));
   }
   return authRef;

package/lib/ai/ai.js

@@ -15,7 +15,7 @@ const {
   findProjectRoot,
 } = require('../core/utils');
 const { CliError } = require('../core/cli-error');
-const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
+const { createAuthRef, createYidaClient } = require('../core/yida-client');
 
 const DEFAULT_MAX_TOKENS = 3000;
 const DEFAULT_IMAGE_CONNECTOR = {
@@ -46,7 +46,7 @@ function printHelp() {
   image    上传本地图片并调用识图连接器；也可直接传入 --image-url
 
 image 选项:
-  --app-type <APP_XXX>        上传图片使用的宜搭应用 ID；未传时尝试读取当前 project/config.json
+  --app-type <APP_XXX>        上传图片使用的宜搭应用 ID；未传时尝试读取当前 project/config.json 或 Cookie
   --form-uuid <FORM_XXX>      可选，上传回调关联的表单 ID
   --connector-id <id>         识图 HTTP 连接器 ID，默认使用 HAR 中的植物识别连接器
   --action-id <id>            识图动作 ID，默认 flowerrecognize
@@ -146,7 +146,7 @@ function getAuthRef(options = {}) {
   if (options.baseUrl) {
     authRef.baseUrl = options.baseUrl;
   }
-  if (!isAuthRefReady(authRef)) {
+  if (!authRef.cookies || authRef.cookies.length === 0 || !authRef.csrfToken) {
     throw new CliError('未获取到有效宜搭登录态，请先执行 openyida login', {
       code: 'NEED_LOGIN',
     });
@@ -154,7 +154,12 @@ function getAuthRef(options = {}) {
   return authRef;
 }
 
-function inferAppType(options) {
+function getCookieValue(authRef, name) {
+  const matched = (authRef.cookies || []).filter(cookie => cookie.name === name);
+  return matched.length ? matched[0].value : '';
+}
+
+function inferAppType(options, authRef) {
   if (options.appType) {
     return options.appType;
   }
@@ -168,11 +173,11 @@ function inferAppType(options) {
         return config.appType;
       }
     } catch {
-      // ignore invalid local config and continue with explicit appType validation
+      // ignore invalid local config and continue with cookie fallback
     }
   }
 
-  return '';
+  return getCookieValue(authRef, 'tianshu_app_type');
 }
 
 function getSuccessContent(response, fallbackMessage, code = 'AI_REQUEST_FAILED') {
@@ -329,7 +334,7 @@ async function uploadImageForAI(filePath, options, authRef) {
     });
   }
 
-  const appType = inferAppType(options);
+  const appType = inferAppType(options, authRef);
   if (!appType) {
     throw new CliError('上传图片需要 appType，请传入 --app-type APP_XXX', {
       code: 'AI_IMAGE_APP_TYPE_REQUIRED',

package/lib/app/canvas-compile.js

@@ -273,8 +273,8 @@ function compileCanvasLocal(source) {
 }
 
 /**
- * 兼容既有调用方传入 options 的异步入口。
- * 本地编译不需要 endpoint，options 保留但忽略。
+ * 兼容既有调用方（publish.js `await compileCanvas(src, { cookies })`）的异步入口。
+ * 本地编译不需要 cookies/endpoint，options 保留但忽略。
  * @param {string} source
  * @param {object} [options] 兼容占位，未使用
  * @returns {Promise<{ runtimeCode: string, importedModules: string }>}

package/lib/app/create-app.js

@@ -10,10 +10,12 @@ const fs = require('fs');
 const path = require('path');
 const querystring = require('querystring');
 const {
+  loadCookieData,
+  triggerLogin,
+  resolveBaseUrl,
   httpPost,
   requestWithAutoLogin,
 } = require('../core/utils');
-const { createAuthRef } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
@@ -230,7 +232,18 @@ async function run(args) {
 
   // Step 1: 读取登录态
   step(1, t('common.step_login', 1));
-  const authRef = createAuthRef();
+  let cookieData = loadCookieData();
+  if (!cookieData) {
+    info(t('common.login_no_cache'));
+    cookieData = triggerLogin();
+  }
+
+  const authRef = {
+    csrfToken: cookieData.csrf_token,
+    cookies: cookieData.cookies,
+    baseUrl: resolveBaseUrl(cookieData),
+    cookieData,
+  };
   chalkSuccess(t('common.login_ready', authRef.baseUrl));
 
   const contentLocale = resolveContentLocale({ locale: params.locale, baseUrl: authRef.baseUrl });
@@ -247,7 +260,8 @@ async function run(args) {
     const corpConfig = await httpPost(
       authRef.baseUrl,
       `/query/exclusive/queryCorpAppConfig.json?_api=Global.queryCorpAppConfig&_mock=false&_csrf_token=${authRef.csrfToken}&_locale_time_zone_offset=28800000&_stamp=${Date.now()}`,
-      ''
+      '',
+      authRef.cookies
     );
     if (corpConfig && corpConfig.content) {
       if (corpConfig.content.forceExclusiveDb === 'y') {openExclusive = 'y';}
@@ -275,14 +289,14 @@ async function run(args) {
       openExclusiveUnit: 'n',
       group: 'ALL',
     });
-    return httpPost(auth.baseUrl, '/query/app/registerApp.json', postData);
+    return httpPost(auth.baseUrl, '/query/app/registerApp.json', postData, auth.cookies);
   }, authRef);
 
   // 输出结果
   if (response && response.success && response.content) {
     const appType = response.content;
     const appUrl = `${authRef.baseUrl}/${appType}/admin`;
-    const corpId = authRef.corpId || (authRef.authData && authRef.authData.corp_id) || '';
+    const corpId = authRef.cookieData.corp_id || '';
 
     chalkResult(true, t('create_app.success'), [
       ['appType', appType],