openyida 2026.7.14-2 → 2026.7.17-2

package/bin/yida.js

@@ -216,12 +216,6 @@ const TOKEN_OUTPUT_SECRET_KEYS = new Set([
   'accessToken',
   'refresh_token',
   'refreshToken',
-  'ai_app_user_auth_token',
-  'aiAppUserAuthToken',
-  'tianshu_csrf_token',
-  'tianshuCsrfToken',
-  'csrf_token',
-  'csrfToken',
 ]);
 
 function maskSensitiveAuthOutput(value) {
@@ -451,12 +445,6 @@ function throwCliUsage(...lines) {
   });
 }
 
-function throwNeedLogin(message) {
-  throw new CliError(message, {
-    code: 'NEED_LOGIN',
-  });
-}
-
 async function main() {
   applyQuietFlag();
   applyGlobalEnvironmentFlags();

package/lib/agent-center/api.js

@@ -71,7 +71,7 @@ const AGENT_RANGE_ALIASES = {
 function getAuthRef() {
   const authRef = createAuthRef();
   if (!isAuthRefReady(authRef)) {
-    throw new Error('无法获取有效登录态或 CSRF Token');
+    throw new Error('无法获取有效 token 登录态');
   }
   return authRef;
 }
@@ -128,7 +128,6 @@ function normalizeYesNo(value, defaultValue = 'n') {
 function buildCommonParams(authRef, apiName, params = {}) {
   const base = {
     _mock: 'false',
-    _csrf_token: authRef.csrfToken,
     _locale_time_zone_offset: '28800000',
     _stamp: String(Date.now()),
   };
@@ -150,7 +149,7 @@ async function agentPost(path, apiName, params = {}, authRef = getAuthRef()) {
 }
 
 function assertSuccess(result, action) {
-  if (result && result.success !== false && !result.__needLogin && !result.__csrfExpired) {
+  if (result && result.success !== false && !result.__needLogin) {
     return result;
   }
   const message = result && (result.errorMsg || result.message || result.errorCode);

package/lib/aggregate-table/aggregate-table.js

@@ -86,7 +86,7 @@ function unwrapContent(result) {
 }
 
 function assertSuccess(result, action) {
-  if (!result || result.success === false || result.__needLogin || result.__csrfExpired) {
+  if (!result || result.success === false || result.__needLogin) {
     const message = result
       ? result.errorMsg || result.error || result.message || t('common.unknown_error')
       : t('common.request_failed');
@@ -103,9 +103,8 @@ async function createAuthRef() {
   return authRef;
 }
 
-function buildCreateEmptyPostData(csrfToken, title) {
+function buildCreateEmptyPostData(title) {
   return querystring.stringify({
-    _csrf_token: csrfToken,
     formType: 'receipt',
     isVirtualView: 'y',
     title: JSON.stringify(buildYidaTitleI18n(title, {
@@ -115,9 +114,8 @@ function buildCreateEmptyPostData(csrfToken, title) {
   });
 }
 
-function buildDesignPostData(csrfToken, formUuid, designInfo, gmtModified) {
+function buildDesignPostData(formUuid, designInfo, gmtModified) {
   const payload = {
-    _csrf_token: csrfToken,
     formUuid,
     designInfo: JSON.stringify(designInfo),
   };
@@ -130,14 +128,14 @@ function buildDesignPostData(csrfToken, formUuid, designInfo, gmtModified) {
 async function checkVirtualViewFeature(authRef, appType) {
   return createYidaClient({ authRef }).postForm(
     `/dingtalk/web/${appType}/query/virtualview/show.json`,
-    auth => ({ _csrf_token: auth.csrfToken })
+    {}
   );
 }
 
 async function createEmptyVirtualView(authRef, appType, title) {
   return createYidaClient({ authRef }).postForm(
     `/dingtalk/web/${appType}/query/formdesign/saveFormSchemaInfo.json`,
-    auth => buildCreateEmptyPostData(auth.csrfToken, title)
+    buildCreateEmptyPostData(title)
   );
 }
 
@@ -161,7 +159,7 @@ async function postVirtualViewDesign(authRef, appType, formUuid, designInfo, act
 
   return createYidaClient({ authRef }).postForm(
     `/alibaba/web/${appType}/query/virtualview/${endpoint}`,
-    auth => buildDesignPostData(auth.csrfToken, formUuid, designInfo, gmtModified)
+    buildDesignPostData(formUuid, designInfo, gmtModified)
   );
 }
 

package/lib/ai/ai.js

@@ -188,12 +188,11 @@ function getSuccessContent(response, fallbackMessage, code = 'AI_REQUEST_FAILED'
 async function callTextFromAI(prompt, options, authRef) {
   const response = await createYidaClient({ authRef }).postForm(
     '/query/intelligent/txtFromAI.json',
-    auth => ({
-      _csrf_token: auth.csrfToken,
+    {
       prompt,
       maxTokens: String(options.maxTokens || DEFAULT_MAX_TOKENS),
       skill: 'ToText',
-    })
+    }
   );
 
   const content = getSuccessContent(response, 'AI 接口调用失败', 'AI_TEXT_REQUEST_FAILED');
@@ -226,11 +225,10 @@ async function getOssSign(filePath, appType, authRef) {
 
   return createYidaClient({ authRef }).get(
     '/ossSign',
-    auth => ({
+    {
       scene: 'ImageField',
       _api: 'nattyFetch',
       _mock: 'false',
-      _csrf_token: auth.csrfToken,
       appType,
       fileName,
       fileSize: String(stat.size),
@@ -242,7 +240,7 @@ async function getOssSign(filePath, appType, authRef) {
       businessType: '',
       accelerate: 'y',
       _stamp: String(Date.now()),
-    })
+    }
   );
 }
 
@@ -283,10 +281,9 @@ async function postToOss(filePath, signContent) {
 async function convertToPublicImageUrl(downloadUrl, authRef) {
   const response = await createYidaClient({ authRef }).get(
     '/aliyun/sdk/upload2Oss.json',
-    auth => ({
+    {
       imageUrl: downloadUrl,
-      _csrf_token: auth.csrfToken,
-    })
+    }
   );
 
   if (!response || !response.success) {
@@ -306,8 +303,7 @@ async function uploadCallback(filePath, appType, formUuid, signContent, ossResul
   const stat = fs.statSync(filePath);
   return createYidaClient({ authRef }).postForm(
     '/query/attach/uploadCallBack.json',
-    auth => ({
-      _csrf_token: auth.csrfToken,
+    {
       appType,
       fileName: path.basename(filePath),
       fileSize: String(stat.size),
@@ -316,7 +312,7 @@ async function uploadCallback(filePath, appType, formUuid, signContent, ossResul
       procInstId: '',
       ossRequestId: ossResult.requestId || '',
       businessType: 'inst',
-    })
+    }
   );
 }
 
@@ -388,11 +384,10 @@ async function invokeImageRecognition(imageUrl, options, authRef) {
 
   const response = await createYidaClient({ authRef }).postForm(
     '/query/publicService/invokeService.json',
-    auth => ({
+    {
       inputs: JSON.stringify(inputs),
       serviceInfo: JSON.stringify(serviceInfo),
-      _csrf_token: auth.csrfToken,
-    })
+    }
   );
 
   if (!response || !response.success) {

package/lib/app/app-list.js

@@ -25,7 +25,6 @@ function fetchAppListPage(auth, pageIndex, pageSize) {
     pageIndex,
     pageSize,
     creator: ref.userId,
-    _csrf_token: ref.csrfToken,
     _stamp: Date.now(),
   }));
 }
@@ -36,9 +35,8 @@ function fetchAppListPage(auth, pageIndex, pageSize) {
 async function fetchAllApps(auth, pageSize) {
   const firstResult = await fetchAppListPage(auth, 1, pageSize);
 
-  // 如果首次请求就提示需要登录或 CSRF 过期，直接返回原始结果
-  // 让外层 requestWithAutoLogin 处理自动重试
-  if (firstResult.__needLogin || firstResult.__csrfExpired) {
+  // 如果首次请求就提示需要登录，直接返回原始结果让外层自动刷新 token 后重试。
+  if (firstResult.__needLogin) {
     return firstResult;
   }
 
@@ -59,7 +57,7 @@ async function fetchAllApps(auth, pageSize) {
   const remainingResults = await Promise.all(remainingFetches);
   for (const result of remainingResults) {
     // 如果后续翻页也出现登录态问题，同样返回标记对象
-    if (result.__needLogin || result.__csrfExpired) {
+    if (result.__needLogin) {
       return result;
     }
     if (result.success && result.content && result.content.data) {
@@ -122,7 +120,7 @@ async function run(args) {
   }
 
   // 如果重试后仍然返回登录失效标记，说明登录态确实不可用
-  if (apps && (apps.__needLogin || apps.__csrfExpired)) {
+  if (apps && apps.__needLogin) {
     console.error('登录态已失效，请重新登录');
     process.exit(1);
   }

package/lib/app/create-app.js

@@ -246,7 +246,7 @@ async function run(args) {
   try {
     const corpConfig = await httpPost(
       authRef.baseUrl,
-      `/query/exclusive/queryCorpAppConfig.json?_api=Global.queryCorpAppConfig&_mock=false&_csrf_token=${authRef.csrfToken}&_locale_time_zone_offset=28800000&_stamp=${Date.now()}`,
+      `/query/exclusive/queryCorpAppConfig.json?_api=Global.queryCorpAppConfig&_mock=false&_locale_time_zone_offset=28800000&_stamp=${Date.now()}`,
       ''
     );
     if (corpConfig && corpConfig.content) {
@@ -260,7 +260,6 @@ async function run(args) {
   const iconValue = `${icon}%%${iconColor}`;
   const response = await requestWithAutoLogin((auth) => {
     const postData = querystring.stringify({
-      _csrf_token: auth.csrfToken,
       appName: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
       description: JSON.stringify(buildYidaI18n(description, { en_US: description, ja_JP: description })),
       icon: iconValue,

package/lib/app/create-form.js

@@ -4325,10 +4325,8 @@ function applyChangesToSchema(schema, changes) {
 
 // ── 发送 POST 请求（支持 302 自动重登录） ────────────
 
-function sendPostRequest(baseUrl, csrfToken, requestPath, extraParams, formUuid) {
-  const postData = querystring.stringify(
-    Object.assign({ _csrf_token: csrfToken }, extraParams)
-  );
+function sendPostRequest(baseUrl, requestPath, extraParams, formUuid) {
+  const postData = querystring.stringify(extraParams);
   const referer = formUuid
     ? `${baseUrl}/alibaba/web/${extraParams.appType || ''}/design/pageDesigner?formUuid=${formUuid}`
     : baseUrl + '/';
@@ -4337,9 +4335,8 @@ function sendPostRequest(baseUrl, csrfToken, requestPath, extraParams, formUuid)
 
 // ── 发送 updateFormConfig 请求 ───────────────────────
 
-function sendUpdateConfigRequest(baseUrl, csrfToken, appType, formUuid, version, value) {
+function sendUpdateConfigRequest(baseUrl, appType, formUuid, version, value) {
   const postData = querystring.stringify({
-    _csrf_token: csrfToken,
     formUuid: formUuid,
     version: version,
     configType: 'MINI_RESOURCE',
@@ -4378,7 +4375,7 @@ async function saveSchemaAndUpdateConfig(authRef, appType, formUuid, schema, ver
 
   const saveResult = await requestWithAutoLogin(function (auth) {
     return sendPostRequest(
-      auth.baseUrl, auth.csrfToken,
+      auth.baseUrl,
       buildApiPath(appType, 'saveFormSchema', { prefix: '_view' }),
       { appType: appType, formUuid: formUuid, content: JSON.stringify(schema), schemaVersion: 'V5', prefix: '_view' },
       formUuid
@@ -4408,7 +4405,7 @@ async function saveSchemaAndUpdateConfig(authRef, appType, formUuid, schema, ver
   info(t('create_form.sending_config'));
 
   const configResult = await requestWithAutoLogin(function (auth) {
-    return sendUpdateConfigRequest(auth.baseUrl, auth.csrfToken, appType, formUuid, version || 1, 0);
+    return sendUpdateConfigRequest(auth.baseUrl, appType, formUuid, version || 1, 0);
   }, authRef);
 
   return { saveResult: saveResult, configResult: configResult };
@@ -4436,7 +4433,7 @@ async function mainCreate(parsedArgs, authRef) {
   info(t('create_form.sending_create'));
   const createResult = await requestWithAutoLogin(function (auth) {
     return sendPostRequest(
-      auth.baseUrl, auth.csrfToken,
+      auth.baseUrl,
       buildApiPath(appType, 'saveFormSchemaInfo'),
       { formType: 'receipt', title: JSON.stringify(i18n(formTitle)) }
     );
@@ -5410,7 +5407,6 @@ async function run(args) {
   }
   const baseUrl = resolveBaseUrl(authData);
   const authRef = {
-    csrfToken: authData.csrf_token,
     baseUrl,
     authData,
     authMode: authData.auth_mode || '',

package/lib/app/create-page.js

@@ -48,7 +48,7 @@ function parseArgs(args) {
   };
 }
 
-function buildPageInfoPostData(csrfToken, formUuid, pageName, isRenderNav) {
+function buildPageInfoPostData(formUuid, pageName, isRenderNav) {
   const titleJson = JSON.stringify(buildYidaTitleI18n(pageName, {
     en_US: pageName,
     ja_JP: pageName,
@@ -56,7 +56,6 @@ function buildPageInfoPostData(csrfToken, formUuid, pageName, isRenderNav) {
 
   return querystring.stringify({
     _api: 'Form.updateFormSchemaInfo',
-    _csrf_token: csrfToken,
     _locale_time_zone_offset: '28800000',
     formUuid,
     serialSwitch: 'n',
@@ -90,7 +89,7 @@ async function configureDashboardMode(authRef, appType, pageId, pageName) {
     return httpPost(
       auth.baseUrl,
       `/dingtalk/web/${appType}/query/formdesign/updateFormSchemaInfo.json`,
-      buildPageInfoPostData(auth.csrfToken, pageId, pageName, false)
+      buildPageInfoPostData(pageId, pageName, false)
     );
   }, authRef);
 }
@@ -138,7 +137,6 @@ async function run(args) {
 
   const response = await requestWithAutoLogin((auth) => {
     const postData = querystring.stringify({
-      _csrf_token: auth.csrfToken,
       formType: 'display',
       title: JSON.stringify(buildYidaI18n(pageName, { en_US: pageName, ja_JP: pageName })),
     });

package/lib/app/er.js

@@ -588,7 +588,6 @@ function createAuthRef() {
   }
 
   const authRef = {
-    csrfToken: authData.csrf_token,
     baseUrl: resolveBaseUrl(authData),
     authData,
     authMode: authData.auth_mode || '',

package/lib/app/externalize-form.js

@@ -534,7 +534,6 @@ function createAuthRef() {
     authData = triggerLogin();
   }
   return {
-    csrfToken: authData.csrf_token,
     baseUrl: resolveBaseUrl(authData),
     authData,
     authMode: authData.auth_mode || '',
@@ -555,7 +554,7 @@ async function fetchSchema(appType, formUuid, authRef) {
 }
 
 function ensureSuccessfulSchema(result) {
-  if (!result || result.success === false || result.__needLogin || result.__csrfExpired) {
+  if (!result || result.success === false || result.__needLogin) {
     const message = result && (result.errorMsg || result.message)
       ? result.errorMsg || result.message
       : 'Failed to fetch form schema';

package/lib/app/get-schema.js

@@ -329,7 +329,6 @@ function createAuthRef() {
   }
 
   const authRef = {
-    csrfToken: authData.csrf_token,
     baseUrl: resolveBaseUrl(authData),
     authData,
     authMode: authData.auth_mode || '',
@@ -352,7 +351,7 @@ async function fetchSchema(appType, formUuid, authRef) {
 }
 
 function isSuccessfulSchemaResult(result) {
-  return !!(result && result.success !== false && !result.__needLogin && !result.__csrfExpired);
+  return !!(result && result.success !== false && !result.__needLogin);
 }
 
 function printFieldSummary(result) {

package/lib/app/import-app.js

@@ -25,7 +25,6 @@ const { banner, step, label, success, fail, warn, info, error, result, usage, hi
 async function createApp(appName, authRef) {
   const contentLocale = resolveContentLocale({ baseUrl: authRef.baseUrl });
   const postData = querystring.stringify({
-    _csrf_token: authRef.csrfToken,
     appName: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
     description: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
     icon: 'xian-yingyong%%#0089FF',
@@ -58,9 +57,8 @@ function normalizeImportFormType(formType) {
   return normalized;
 }
 
-function buildCreateFormPostData(csrfToken, formTitle, formType = 'receipt') {
+function buildCreateFormPostData(formTitle, formType = 'receipt') {
   return querystring.stringify({
-    _csrf_token: csrfToken,
     formType: normalizeImportFormType(formType),
     title: JSON.stringify(buildYidaI18n(formTitle, { en_US: formTitle, ja_JP: formTitle })),
   });
@@ -69,7 +67,7 @@ function buildCreateFormPostData(csrfToken, formTitle, formType = 'receipt') {
 // ── 创建空白表单/页面/报表 ──────────────────────────────
 
 async function createBlankForm(appType, formTitle, authRef, formType = 'receipt') {
-  const postData = buildCreateFormPostData(authRef.csrfToken, formTitle, formType);
+  const postData = buildCreateFormPostData(formTitle, formType);
   const result = await requestWithAutoLogin((auth) => {
     return httpPost(
       auth.baseUrl,
@@ -90,7 +88,6 @@ async function createBlankForm(appType, formTitle, authRef, formType = 'receipt'
 
 async function saveFormSchema(appType, formUuid, schema, authRef, formType = 'receipt') {
   const payload = {
-    _csrf_token: authRef.csrfToken,
     appType,
     formUuid,
     content: JSON.stringify(schema),
@@ -116,7 +113,6 @@ async function saveFormSchema(appType, formUuid, schema, authRef, formType = 're
 
 async function updateFormConfig(appType, formUuid, authRef) {
   const postData = querystring.stringify({
-    _csrf_token: authRef.csrfToken,
     appType,
     formUuid,
     setting: JSON.stringify({ MINI_RESOURCE: 0 }),

package/lib/app/list-forms.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { createAuthRef } = require('../core/yida-client');
+const { createAuthRef, isAuthRefReady } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { fetchFormPageList } = require('./form-navigation');
 
@@ -57,7 +57,7 @@ async function run(args) {
 
   console.error(t('common.step_login', 1));
   const authRef = createAuthRef();
-  if (!authRef || !authRef.csrfToken) {
+  if (!isAuthRefReady(authRef)) {
     console.error(t('list_forms.no_login'));
     process.exit(1);
   }

package/lib/app/nav-group.js

@@ -6,7 +6,7 @@ const {
   httpPost,
   requestWithAutoLogin,
 } = require('../core/utils');
-const { createAuthRef } = require('../core/yida-client');
+const { createAuthRef, isAuthRefReady } = require('../core/yida-client');
 
 const ROOT_NAV_UUID = 'NAV-SYSTEM-PARENT-UUID';
 const FORM_UUID_FALLBACK = 'NAV-SYSTEM-FROM-ME-UUID';
@@ -364,7 +364,7 @@ function countChildren(list, navUuid) {
 
 function loadAuthRef() {
   const authRef = createAuthRef();
-  if (!authRef || !authRef.csrfToken) {
+  if (!isAuthRefReady(authRef)) {
     throw new Error('No valid Yida login cache found. Run openyida login first.');
   }
   return authRef;
@@ -378,7 +378,6 @@ async function fetchNavigationList(appType, authRef) {
       {
         _api: 'Nav.queryList',
         _mock: false,
-        _csrf_token: auth.csrfToken,
         _locale_time_zone_offset: 28800000,
         _stamp: Date.now(),
       }
@@ -415,7 +414,7 @@ async function postNavAction(appType, action, payload, authRef) {
   const result = await requestWithAutoLogin((auth) => {
     const path = `/dingtalk/web/${appType}/query/formnav/${endpoint}` +
       `?_api=${encodeURIComponent(apiNames[action])}` +
-      `&_mock=false&_csrf_token=${encodeURIComponent(auth.csrfToken)}` +
+      '&_mock=false' +
       `&_stamp=${Date.now()}`;
     return httpPost(auth.baseUrl, path, querystring.stringify(payload));
   }, authRef);

package/lib/app/publish.js

@@ -322,7 +322,7 @@ async function fetchExistingSchemaContent(appType, formUuid, authRef) {
     );
   }, authRef);
 
-  if (!result || result.success === false || result.__needLogin || result.__csrfExpired) {
+  if (!result || result.success === false || result.__needLogin) {
     const errorMsg = result ? result.errorMsg || t('common.unknown_error') : t('common.request_failed');
     throw new Error(errorMsg);
   }
@@ -655,10 +655,9 @@ function buildCanvasSchemaContent(sourceCode, runtimeCode, importedModules, form
 
 // ── 4. 发送 saveFormSchema 请求 ──────────────────────
 
-function sendSaveRequest(csrfToken, schemaContent, baseUrl, appType, formUuid) {
+function sendSaveRequest(schemaContent, baseUrl, appType, formUuid) {
   const saveSchemaPath = `/alibaba/web/${appType}/${PREFIX}/query/formdesign/saveFormSchema.json?_stamp=${Date.now()}`;
   const postData = querystring.stringify({
-    _csrf_token: csrfToken,
     prefix: PREFIX,
     content: schemaContent,
     formUuid: formUuid,
@@ -671,10 +670,9 @@ function sendSaveRequest(csrfToken, schemaContent, baseUrl, appType, formUuid) {
 
 // ── 5. 发送 updateFormConfig 请求 ────────────────────
 
-function sendUpdateConfigRequest(csrfToken, baseUrl, appType, formUuid, version, value) {
+function sendUpdateConfigRequest(baseUrl, appType, formUuid, version, value) {
   const updateConfigPath = `/dingtalk/web/${appType}/query/formdesign/updateFormConfig.json`;
   const postData = querystring.stringify({
-    _csrf_token: csrfToken,
     formUuid: formUuid,
     version: version,
     configType: 'MINI_RESOURCE',
@@ -942,14 +940,12 @@ async function main(argv) {
 
   step(2, t('common.step_login', 2));
   let authData = loadAuthData();
-  if (!authData || !authData.csrf_token) {
+  if (!authData) {
     warn(t('common.login_no_cache'));
     authData = triggerLogin();
   }
-  let csrfToken = authData.csrf_token;
   let baseUrl = resolveBaseUrl(authData);
   const authRef = {
-    csrfToken,
     baseUrl,
     authData,
     authMode: authData.auth_mode || '',
@@ -958,7 +954,6 @@ async function main(argv) {
     userId: authData.user_id || '',
   };
   await ensurePublishTargetOrExit(appType, formUuid, authRef, { force });
-  csrfToken = authRef.csrfToken;
   baseUrl = authRef.baseUrl;
 
   let schemaContent;
@@ -973,7 +968,6 @@ async function main(argv) {
       fail(t('publish.data_source_fetch_failed', dataSourceError.message));
       process.exit(1);
     }
-    csrfToken = authRef.csrfToken;
     baseUrl = authRef.baseUrl;
     schemaContent = buildSchemaContent(sourceCode, compiledCode, formUuid, { existingDataSource });
   }
@@ -987,19 +981,17 @@ async function main(argv) {
   label('Compiled:', compiledPath);
   step(3, t('publish.step_publish'));
   const response = await requestWithAutoLogin((ref) => sendSaveRequest(
-    ref.csrfToken,
     schemaContent,
     ref.baseUrl,
     appType,
     formUuid
   ), authRef);
-  csrfToken = authRef.csrfToken;
   baseUrl = authRef.baseUrl;
 
   if (!response || !response.success) {
     const errorMsg = response ? response.errorMsg || t('common.unknown_error') : t('common.request_failed');
     fail(t('publish.publish_failed', errorMsg));
-    if (response && !response.__needLogin && !response.__csrfExpired) {
+    if (response && !response.__needLogin) {
       hint(t('common.response_detail', JSON.stringify(response, null, 2)));
     }
     process.exit(1);
@@ -1015,14 +1007,12 @@ async function main(argv) {
   step(4, t('publish.step_config'));
   info(t('publish.sending_config'));
   const configResponse = await requestWithAutoLogin((ref) => sendUpdateConfigRequest(
-    ref.csrfToken,
     ref.baseUrl,
     appType,
     savedFormUuid,
     version,
     8
   ), authRef);
-  csrfToken = authRef.csrfToken;
   baseUrl = authRef.baseUrl;
 
   const pageUrl = `${baseUrl}/${appType}/workbench/${savedFormUuid}`;

package/lib/app/update-app.js

@@ -144,7 +144,6 @@ async function run(args) {
 
   // 构建请求参数
   const postDataObj = {
-    _csrf_token: authRef.csrfToken,
     _locale_time_zone_offset: '28800000',
     appType: params.appType,
   };

package/lib/app/update-form-config.js

@@ -35,7 +35,7 @@ function parseArgs() {
   };
 }
 
-function buildPostData(csrfToken, formUuid, isRenderNav, title) {
+function buildPostData(formUuid, isRenderNav, title) {
   const titleJson = JSON.stringify(buildYidaTitleI18n(title, {
     en_US: title,
     ja_JP: title,
@@ -43,7 +43,6 @@ function buildPostData(csrfToken, formUuid, isRenderNav, title) {
 
   return querystring.stringify({
     _api: 'Form.updateFormSchemaInfo',
-    _csrf_token: csrfToken,
     _locale_time_zone_offset: '28800000',
     formUuid: formUuid,
     serialSwitch: 'n',
@@ -93,7 +92,6 @@ async function main() {
     authData = triggerLogin();
   }
   const authRef = {
-    csrfToken: authData.csrf_token,
     baseUrl: resolveBaseUrl(authData),
     authData,
     authMode: authData.auth_mode || '',
@@ -110,10 +108,10 @@ async function main() {
   const apiResult = await requestWithAutoLogin((ref) => sendPostRequest(
     ref.baseUrl,
     `/dingtalk/web/${appType}/query/formdesign/updateFormSchemaInfo.json`,
-    buildPostData(ref.csrfToken, formUuid, isRenderNav, title)
+    buildPostData(formUuid, isRenderNav, title)
   ), authRef);
 
-  if (apiResult && !apiResult.__needLogin && !apiResult.__csrfExpired) {
+  if (apiResult && !apiResult.__needLogin) {
     if (apiResult.success) {
       result(true, t('update_form_config.update_ok'), [
         ['Render Nav', isRenderNav === 'true' ? t('update_form_config.nav_shown') : t('update_form_config.nav_hidden')],

package/lib/app-permission/app-permission.js

@@ -82,7 +82,7 @@ function printJson(payload) {
 function getAuthRef() {
   const authRef = createAuthRef();
   if (!isAuthRefReady(authRef)) {
-    throw new Error('无法获取有效登录态或 CSRF Token');
+    throw new Error('无法获取有效 token 登录态');
   }
   return authRef;
 }
@@ -173,7 +173,6 @@ function parseCliOptions(tokens) {
 
 function buildCommonParams(authRef, params = {}) {
   return {
-    _csrf_token: authRef.csrfToken,
     _locale_time_zone_offset: '28800000',
     _stamp: String(Date.now()),
     ...params,