openyida 2026.7.14 → 2026.7.17-2

package/README.md

@@ -55,10 +55,10 @@ If Codex is already installed, OpenYida also imports a local Codex plugin during
 Run this from the AI coding workspace where you want OpenYida to operate:
 
 ```bash
-openyida agent-capabilities --json
+openyida agent-capabilities --summary-json
 ```
 
-OpenYida detects the active agent environment, workspace path, login state, organization context, command manifest, and side-effect hints in one machine-readable snapshot. `openyida commands --json` remains available when an agent only needs the command manifest.
+OpenYida returns a compact machine-readable summary with the version, login state, workspace/cache paths, and command manifest digest. `openyida agent-capabilities --json` is the full diagnostic snapshot, where compact `workdir` maps to `active.projectRoot` and `workdir_exists` maps to `active.projectRootExists`. `openyida commands --json` remains available when an agent only needs the command manifest.
 
 ### 3. Log In
 
@@ -66,27 +66,20 @@ OpenYida detects the active agent environment, workspace path, login state, orga
 openyida login
 ```
 
-In Codex, QoderWork, Qoder, Wukong, Claude Code, MuleRun, OpenCode, Cursor, and other detected AI tools, OpenYida first tries local Chrome/Edge/Chromium CDP when no valid cached login exists. If local CDP is unavailable, it falls back to an AI-dialog QR handoff. The agent should render `qr_image_markdown` or paste `agent_response_markdown` directly in the conversation so the QR code is visible, then run `poll_command` after the user scans it with DingTalk. If image rendering is unavailable, fall back to `qr_url`. The explicit `openyida login --browser` command still prefers CDP first and uses Playwright as an optional browser fallback.
+OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the current project cache.
 
-When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and cookie file. For example, Alibaba intranet Yida uses `cookies-alibaba.json`:
+When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and token session file. For example, Alibaba intranet Yida uses `auth-token-alibaba.json`:
 
 ```bash
 openyida login https://yida-group.alibaba-inc.com/
 openyida login --alibaba
 ```
 
-The explicit QR polling command remains available:
+For token status checks, use:
 
 ```bash
-openyida login --agent-qr
-```
-
-For terminal QR login, use:
-
-```bash
-openyida login --qr
-openyida login --qr --corp-id dingxxxxxxxx
 openyida login --check-only --json
+openyida auth status
 ```
 
 OpenYida does not install Playwright by default.
@@ -239,7 +232,7 @@ OPENYIDA_E2E=1 OPENYIDA_E2E_FULL_STAGES=auth,app,form,process npm run test:e2e:r
 npm run test:e2e:real:skills
 ```
 
-The runner creates a disposable app, form, and custom page with an `OY_E2E_*` prefix, then verifies login, app listing, schema fetch, data query, and page publish. It writes a registry to `project/.cache/e2e-real/` so created resources can be audited later. To inject CI cookies without relying on a local login cache, pass `OPENYIDA_E2E_COOKIES_BASE64` as a base64 encoded cookie array or `{ "cookies": [...] }` object.
+The runner creates a disposable app, form, and custom page with an `OY_E2E_*` prefix, then verifies token login, app listing, schema fetch, data query, and page publish. It writes a registry to `project/.cache/e2e-real/` so created resources can be audited later. Run `openyida login` for the target environment before starting the real E2E runner.
 
 `test:e2e:real:full` extends the smoke path into a broad deterministic feature matrix: auth/env, app update, form update and option mutation, page build/compile/generate/publish, data create/get/update/query, permission read, page config and short URL check, report create/append, dashboard skill verification, export/import, batch, task-center, formula/doctor/sample/CDN config, and local connector parsing/template generation. AI-backed commands such as `flash-to-prd` are available as the optional `ai` stage because they depend on remote model availability. Workflow mutation is available as the opt-in `process` stage; it creates and republishes a workflow on the disposable E2E form and records advanced official-node fixtures for review.
 
@@ -339,11 +332,11 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--qr\|--agent-qr\|--codex\|--browser] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--corp-id <corpId>]` | Login (cache first, --browser or --agent-qr when needed) |
-| `openyida logout` | Logout / switch account |
-| `openyida auth <status\|login\|refresh\|logout>` | Login state management |
-| `openyida org <list\|switch>` | Organization management (list / switch) |
-| `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & login state |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>]` | Login with OAuth token mode |
+| `openyida logout` | Logout / clear token |
+| `openyida auth <status\|login\|refresh\|logout>` | Token login state management |
+| `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch by OAuth re-login) |
+| `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
 ### App Management
 
@@ -457,7 +450,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida commands [--json]` | Output machine-readable command manifest |
-| `openyida agent-capabilities [--json]` | Output one-shot agent capability snapshot |
+| `openyida agent-capabilities [--json] [--summary-json\|--compact]` | Output one-shot agent capability snapshot |
 | `openyida a2a <serve\|agent-card> [options]` | Start local read-only A2A adapter or print Agent Card |
 | `openyida bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open\|--no-open]` | Start OpenYida local web bridge service |
 | `openyida copy [--force]` | Copy project working directory |
@@ -585,9 +578,9 @@ When adding new CLI commands, register the route in `bin/yida.js`, add it to `li
 
 ## Security and Configuration
 
-- Login cookies are cached locally and should never be hard-coded into source files.
+- OAuth token sessions are cached locally and should never be hard-coded into source files.
 - Private deployment environments are managed through `lib/core/env-manager.js`.
-- Yida API requests should use the active environment base URL and authenticated cookies.
+- Yida API requests should use the active environment base URL and Bearer token auth.
 - For multi-organization accounts, prefer explicit `--corp-id` values in non-interactive automation.
 
 ## Community

package/bin/yida.js

@@ -211,6 +211,32 @@ function handleFirstRunGuide() {
   console.log('');
 }
 
+const TOKEN_OUTPUT_SECRET_KEYS = new Set([
+  'access_token',
+  'accessToken',
+  'refresh_token',
+  'refreshToken',
+]);
+
+function maskSensitiveAuthOutput(value) {
+  if (!value || typeof value !== 'object') {
+    return value;
+  }
+  const { maskToken } = require('../lib/auth/token-store');
+  if (Array.isArray(value)) {
+    return value.map((item) => maskSensitiveAuthOutput(item));
+  }
+  const output = {};
+  Object.entries(value).forEach(([key, item]) => {
+    if (TOKEN_OUTPUT_SECRET_KEYS.has(key)) {
+      output[key] = maskToken(item);
+    } else {
+      output[key] = maskSensitiveAuthOutput(item);
+    }
+  });
+  return output;
+}
+
 function printLoginResult(result) {
   noteLoginCommandResult(result);
 
@@ -224,49 +250,21 @@ function printLoginResult(result) {
     return;
   }
 
-  if (result && (result.status === 'need_qr_scan' || result.status === 'need_corp_selection')) {
-    console.log(JSON.stringify(result));
-    return;
-  }
-
-  if (result && result.status === 'need_codex_browser_login') {
-    const handoff = {
-      status: result.status,
-      handoff_type: result.handoff_type || 'browser',
-      can_auto_use: false,
-      browser: result.browser,
-      login_url: result.login_url,
-      message: result.message,
-    };
-    [
-      'agent_action',
-      'browser_open_strategy',
-      'browser_use_local_redirect_fallback',
-      'required_agent_tool',
-      'required_runtime_tool',
-      'cookie_export_file',
-      'cookie_file',
-      'post_login_check_command',
-      'fallback_command',
-    ].forEach((key) => {
-      if (result[key]) {handoff[key] = result[key];}
-    });
-    console.log(JSON.stringify(handoff));
-    return;
-  }
-
-  if (result.status && result.status !== 'ok' && !result.csrf_token) {
-    console.log(JSON.stringify(result));
-    return;
-  }
-
+  const tokenUsable = result.can_auto_use !== false && !!result.access_token;
   const summary = {
-    ok: true,
-    base_url: result && result.base_url,
-    corp_id: result && result.corp_id,
-    user_id: result && result.user_id,
-    csrf_token: result && result.csrf_token ? `${result.csrf_token.slice(0, 16)}...` : undefined,
-    cookies_count: Array.isArray(result && result.cookies) ? result.cookies.length : (result.cookies_count || 0),
+    ok: tokenUsable,
+    status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
+    auth_mode: 'token',
+    can_auto_use: tokenUsable,
+    token_type: result.token_type || 'Bearer',
+    access_token: maskSensitiveAuthOutput({ access_token: result.access_token }).access_token,
+    expires_at: result.expires_at ? new Date(result.expires_at).toISOString() : undefined,
+    base_url: result.base_url,
+    corp_id: result.corp_id,
+    user_id: result.user_id,
+    user_name: result.user_name,
+    message: result.message,
+    raw: tokenUsable ? undefined : result.raw,
   };
   console.log(JSON.stringify(summary));
 }
@@ -277,15 +275,11 @@ function noteLoginCommandResult(result) {
     let status = 'failed';
     let reason = 'login_failed';
 
-    if (result && (result.csrf_token || (result.status === 'ok' && result.can_auto_use))) {
+    const tokenLoginOk = result && result.auth_mode === 'token' &&
+      (result.access_token || (result.status === 'ok' && result.can_auto_use));
+    if (result && (tokenLoginOk || (result.status === 'ok' && result.can_auto_use))) {
       status = 'success';
       reason = 'login_ok';
-    } else if (result && result.status === 'need_qr_scan') {
-      status = 'need_qr_scan';
-      reason = 'need_qr_scan';
-    } else if (result && result.status === 'need_codex_browser_login') {
-      status = 'need_browser_login';
-      reason = 'need_browser_login';
     } else if (result && result.status === 'need_corp_selection') {
       status = 'success';
       reason = 'need_corp_selection';
@@ -306,40 +300,6 @@ function noteLoginCommandResult(result) {
   }
 }
 
-function isAgentConversationEnvironment() {
-  const { detectActiveTool } = require('../lib/core/utils');
-  return !!detectActiveTool() || process.env.OPENYIDA_AGENT_MODE === '1';
-}
-
-function shouldUseBrowserHandoffLogin(cliArgs) {
-  if (cliArgs.includes('--qr') || cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return false;}
-  if (cliArgs.includes('--browser') || cliArgs.includes('--codex') || cliArgs.includes('--qoder') || cliArgs.includes('--wukong')) {return true;}
-  return false;
-}
-
-function shouldUseAgentLogin(cliArgs) {
-  if (cliArgs.includes('--qr') || cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return false;}
-  if (shouldUseBrowserHandoffLogin(cliArgs)) {return false;}
-  return isAgentConversationEnvironment();
-}
-
-function shouldUsePlaywrightFallbackInAgentLogin() {
-  const { hasDesktopEnvironment } = require('../lib/core/utils');
-  return hasDesktopEnvironment() || process.env.OPENYIDA_AGENT_PLAYWRIGHT_FALLBACK === '1';
-}
-
-function shouldUseLocalBrowserLogin(options = {}) {
-  const { hasLocalBrowserLoginCapability } = require('../lib/auth/login');
-  return hasLocalBrowserLoginCapability({
-    playwrightFallback: options.playwrightFallback,
-  });
-}
-
-function shouldUseCodexQrLogin(cliArgs) {
-  if (cliArgs.includes('--codex-qr') || cliArgs.includes('--agent-qr')) {return true;}
-  return false;
-}
-
 function getArgValue(cliArgs, name) {
   const index = cliArgs.indexOf(name);
   if (index === -1 || !cliArgs[index + 1] || cliArgs[index + 1].startsWith('--')) {
@@ -414,11 +374,9 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--intranet': 'alibaba',
   };
   const valuePassthroughFlags = new Set([
-    '--agent-poll',
-    '--codex-poll',
-    '--agent-select',
-    '--codex-select',
     '--corp-id',
+    '--client-id',
+    '--user-id',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -487,12 +445,6 @@ function throwCliUsage(...lines) {
   });
 }
 
-function throwNeedLogin(message) {
-  throw new CliError(message, {
-    code: 'NEED_LOGIN',
-  });
-}
-
 async function main() {
   applyQuietFlag();
   applyGlobalEnvironmentFlags();
@@ -563,129 +515,42 @@ async function main() {
     }
 
     case 'login': {
-      const { checkLoginOnly } = require('../lib/auth/login');
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { isEnvAuthMode } = require('../lib/core/utils');
-      if (loginArgs.includes('--agent-poll') || loginArgs.includes('--codex-poll')) {
-        const sessionFile = getArgValue(loginArgs, '--agent-poll') || getArgValue(loginArgs, '--codex-poll');
-        const { pollCodexQrLogin } = require('../lib/auth/qr-login');
-        const result = await pollCodexQrLogin(sessionFile, {
-          corpId: getArgValue(loginArgs, '--corp-id'),
-        });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--agent-select') || loginArgs.includes('--codex-select')) {
-        const sessionFile = getArgValue(loginArgs, '--agent-select') || getArgValue(loginArgs, '--codex-select');
-        const { selectCodexQrCorp } = require('../lib/auth/qr-login');
-        const result = await selectCodexQrCorp(sessionFile, {
-          corpId: getArgValue(loginArgs, '--corp-id'),
-        });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--check-only')) {
-        const result = checkLoginOnly({ includeSecrets: loginArgs.includes('--with-cookies') });
-        console.log(JSON.stringify(result, null, 2));
-      } else if (isEnvAuthMode()) {
-        const result = checkLoginOnly({ includeSecrets: true });
-        printLoginResult(result);
-      } else if (shouldUseCodexQrLogin(loginArgs)) {
-        const { startCodexQrLogin } = require('../lib/auth/qr-login');
-        const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--browser')) {
-        const { interactiveLogin } = require('../lib/auth/login');
-        const result = interactiveLogin({ force: true });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--qoder') || loginArgs.includes('--wukong')) {
-        const { codexLogin } = require('../lib/auth/codex-login');
-        const result = await codexLogin({ tool: loginArgs.includes('--qoder') ? 'qoder' : 'wukong' });
-        printLoginResult(result);
-      } else if (loginArgs.includes('--qr')) {
-        const { qrLogin } = require('../lib/auth/qr-login');
-        const result = await qrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-        printLoginResult(result);
-      } else if (shouldUseAgentLogin(loginArgs)) {
-        const cachedResult = checkLoginOnly({ includeSecrets: true });
-        if (cachedResult.status === 'ok') {
-          printLoginResult(cachedResult);
-        } else {
-          const { interactiveLogin } = require('../lib/auth/login');
-          const playwrightFallback = shouldUsePlaywrightFallbackInAgentLogin();
-          const browserResult = shouldUseLocalBrowserLogin({ playwrightFallback })
-            ? interactiveLogin({ playwrightFallback })
-            : null;
-          if (browserResult) {
-            printLoginResult(browserResult);
-          } else {
-            const { startCodexQrLogin } = require('../lib/auth/qr-login');
-            const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-            printLoginResult(result);
-          }
-        }
-      } else if (shouldUseBrowserHandoffLogin(loginArgs)) {
-        const cachedResult = checkLoginOnly({ includeSecrets: true });
-        if (cachedResult.status === 'ok') {
-          printLoginResult(cachedResult);
-        } else {
-          const { codexLogin } = require('../lib/auth/codex-login');
-          const result = await codexLogin({ tool: loginArgs.includes('--codex') ? 'codex' : undefined });
-          printLoginResult(result);
-        }
+      const { tokenLogin, tokenStatus } = require('../lib/auth/token-auth');
+      if (loginArgs.includes('--check-only')) {
+        console.log(JSON.stringify(tokenStatus(), null, 2));
       } else {
-        const cachedResult = checkLoginOnly({ includeSecrets: true });
-        if (cachedResult.status === 'ok') {
-          printLoginResult(cachedResult);
-          break;
-        }
-        if (shouldUseLocalBrowserLogin({ playwrightFallback: true })) {
-          const { interactiveLogin } = require('../lib/auth/login');
-          const browserResult = interactiveLogin({ playwrightFallback: true });
-          if (browserResult) {
-            printLoginResult(browserResult);
-            break;
-          }
-        }
-        const { qrLogin } = require('../lib/auth/qr-login');
-        const result = await qrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+        const result = await tokenLogin({
+          clientId: getArgValue(loginArgs, '--client-id'),
+          quiet: loginArgs.includes('--quiet'),
+        });
         printLoginResult(result);
       }
       break;
     }
 
     case 'logout': {
-      const { logout } = require('../lib/auth/login');
-      logout();
+      const { tokenLogout } = require('../lib/auth/token-auth');
+      console.log(JSON.stringify(await tokenLogout(), null, 2));
       break;
     }
 
     case 'auth': {
       const subCommand = args[0];
-      const { authStatus, authLogin, authRefresh, authLogout } = require('../lib/auth/auth');
-
+      const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
+      const { tokenLogin, tokenLogout, tokenRefresh, tokenStatus } = require('../lib/auth/token-auth');
       if (subCommand === 'status') {
-        authStatus();
+        console.log(JSON.stringify(tokenStatus(), null, 2));
       } else if (subCommand === 'login') {
-        const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-        let loginType = 'qrcode';
-        if (authArgs.includes('--codex')) {
-          loginType = 'codex';
-        } else if (authArgs.includes('--qoder')) {
-          loginType = 'qoder';
-        } else if (authArgs.includes('--wukong')) {
-          loginType = 'wukong';
-        } else if (authArgs.includes('--browser')) {
-          loginType = 'browser';
-        }
-        const result = await authLogin({
-          type: loginType,
-          corpId: getArgValue(authArgs, '--corp-id'),
-          forceTerminalQr: authArgs.includes('--qr'),
+        const result = await tokenLogin({
+          clientId: getArgValue(authArgs, '--client-id'),
+          quiet: authArgs.includes('--quiet'),
         });
-        if (result) {
-          printLoginResult(result);
-        }
+        printLoginResult(result);
       } else if (subCommand === 'refresh') {
-        authRefresh();
+        console.log(JSON.stringify(maskSensitiveAuthOutput(await tokenRefresh()), null, 2));
       } else if (subCommand === 'logout') {
-        authLogout();
+        console.log(JSON.stringify(await tokenLogout(), null, 2));
       } else {
         throwCliUsage(t('cli.auth_usage'), t('cli.auth_example'));
       }
@@ -693,34 +558,9 @@ async function main() {
     }
 
     case 'org': {
-      const subCommand = args[0];
-      const { listOrganizations, switchOrganization, interactiveSwitch } = require('../lib/auth/org');
-      const { loadCookieData } = require('../lib/core/utils');
-
-      if (subCommand === 'list') {
-        const cookieData = loadCookieData();
-        if (!cookieData || !cookieData.cookies) {
-          throwNeedLogin(t('org.no_login'));
-        }
-        await listOrganizations(cookieData);
-      } else if (subCommand === 'switch') {
-        const cookieData = loadCookieData();
-        if (!cookieData || !cookieData.cookies) {
-          throwNeedLogin(t('org.no_login'));
-        }
-
-        // 解析 --corp-id 参数
-        const corpIdIndex = args.indexOf('--corp-id');
-        if (corpIdIndex !== -1 && args[corpIdIndex + 1]) {
-          const targetCorpId = args[corpIdIndex + 1];
-          await switchOrganization(targetCorpId, cookieData);
-        } else {
-          // 交互式选择
-          await interactiveSwitch(cookieData);
-        }
-      } else {
-        throwCliUsage(t('cli.org_usage'), t('cli.org_example'));
-      }
+      const orgArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
+      const { run } = require('../lib/auth/org');
+      await run(orgArgs);
       break;
     }
 

package/lib/agent-center/api.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { createAuthRef, createYidaClient } = require('../core/yida-client');
+const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 
 const AGENT_TYPE_ALIASES = {
   normal: 'NORMAL',
@@ -70,8 +70,8 @@ const AGENT_RANGE_ALIASES = {
 
 function getAuthRef() {
   const authRef = createAuthRef();
-  if (!authRef.cookies || !authRef.cookies.length || !authRef.csrfToken) {
-    throw new Error('无法获取有效登录态或 CSRF Token');
+  if (!isAuthRefReady(authRef)) {
+    throw new Error('无法获取有效 token 登录态');
   }
   return authRef;
 }
@@ -128,7 +128,6 @@ function normalizeYesNo(value, defaultValue = 'n') {
 function buildCommonParams(authRef, apiName, params = {}) {
   const base = {
     _mock: 'false',
-    _csrf_token: authRef.csrfToken,
     _locale_time_zone_offset: '28800000',
     _stamp: String(Date.now()),
   };
@@ -150,7 +149,7 @@ async function agentPost(path, apiName, params = {}, authRef = getAuthRef()) {
 }
 
 function assertSuccess(result, action) {
-  if (result && result.success !== false && !result.__needLogin && !result.__csrfExpired) {
+  if (result && result.success !== false && !result.__needLogin) {
     return result;
   }
   const message = result && (result.errorMsg || result.message || result.errorCode);

package/lib/aggregate-table/aggregate-table.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 const querystring = require('querystring');
 
-const { createAuthRef: createCoreAuthRef, createYidaClient } = require('../core/yida-client');
+const { createAuthRef: createCoreAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { buildYidaTitleI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
@@ -86,7 +86,7 @@ function unwrapContent(result) {
 }
 
 function assertSuccess(result, action) {
-  if (!result || result.success === false || result.__needLogin || result.__csrfExpired) {
+  if (!result || result.success === false || result.__needLogin) {
     const message = result
       ? result.errorMsg || result.error || result.message || t('common.unknown_error')
       : t('common.request_failed');
@@ -97,15 +97,14 @@ function assertSuccess(result, action) {
 
 async function createAuthRef() {
   const authRef = createCoreAuthRef();
-  if (!authRef.cookies || authRef.cookies.length === 0) {
+  if (!isAuthRefReady(authRef)) {
     throw new Error(t('aggregate_table.no_login'));
   }
   return authRef;
 }
 
-function buildCreateEmptyPostData(csrfToken, title) {
+function buildCreateEmptyPostData(title) {
   return querystring.stringify({
-    _csrf_token: csrfToken,
     formType: 'receipt',
     isVirtualView: 'y',
     title: JSON.stringify(buildYidaTitleI18n(title, {
@@ -115,9 +114,8 @@ function buildCreateEmptyPostData(csrfToken, title) {
   });
 }
 
-function buildDesignPostData(csrfToken, formUuid, designInfo, gmtModified) {
+function buildDesignPostData(formUuid, designInfo, gmtModified) {
   const payload = {
-    _csrf_token: csrfToken,
     formUuid,
     designInfo: JSON.stringify(designInfo),
   };
@@ -130,14 +128,14 @@ function buildDesignPostData(csrfToken, formUuid, designInfo, gmtModified) {
 async function checkVirtualViewFeature(authRef, appType) {
   return createYidaClient({ authRef }).postForm(
     `/dingtalk/web/${appType}/query/virtualview/show.json`,
-    auth => ({ _csrf_token: auth.csrfToken })
+    {}
   );
 }
 
 async function createEmptyVirtualView(authRef, appType, title) {
   return createYidaClient({ authRef }).postForm(
     `/dingtalk/web/${appType}/query/formdesign/saveFormSchemaInfo.json`,
-    auth => buildCreateEmptyPostData(auth.csrfToken, title)
+    buildCreateEmptyPostData(title)
   );
 }
 
@@ -161,7 +159,7 @@ async function postVirtualViewDesign(authRef, appType, formUuid, designInfo, act
 
   return createYidaClient({ authRef }).postForm(
     `/alibaba/web/${appType}/query/virtualview/${endpoint}`,
-    auth => buildDesignPostData(auth.csrfToken, formUuid, designInfo, gmtModified)
+    buildDesignPostData(formUuid, designInfo, gmtModified)
   );
 }