openyida 2026.7.19 → 2026.7.21

package/lib/auth/token-auth.js

@@ -13,8 +13,10 @@ const {
 const { runDingtalkLoopback } = require('./oauth-loopback');
 const {
   clearTokenSession,
+  isHostInjectedTokenMode,
   loadTokenSession,
   maskToken,
+  normalizeTokenSession,
   saveTokenSession,
 } = require('./token-store');
 
@@ -35,6 +37,7 @@ function appendPath(baseUrl, path) {
 
 function getArgEndpoint(options = {}) {
   return options.endpoint ||
+    (options.env && options.env.OPENYIDA_ENDPOINT) ||
     null;
 }
 
@@ -49,7 +52,8 @@ function resolveTokenBaseUrl(options = {}) {
   }
 
   const { config } = getCurrentEnvConfig(options.projectRoot);
-  const baseUrl = normalizeBaseUrl(process.env.OPENYIDA_ENDPOINT || config.baseUrl, null);
+  const env = options.env || process.env;
+  const baseUrl = normalizeBaseUrl(env.OPENYIDA_ENDPOINT || config.baseUrl, null);
   if (!baseUrl) {
     throw new Error('missing base_url: pass --endpoint or set OPENYIDA_ENDPOINT');
   }
@@ -299,18 +303,29 @@ async function tokenLogin(options = {}) {
 function tokenStatus(options = {}) {
   const session = loadTokenSession(options);
   if (!session || (!session.access_token && !session.refresh_token)) {
-    return {
+    const env = options.env || process.env;
+    const hostInjected = isHostInjectedTokenMode(env);
+    const status = {
       ok: false,
       auth_mode: 'token',
+      auth_source: hostInjected ? 'env' : undefined,
       status: 'not_logged_in',
       can_auto_use: false,
-      token_file: require('./token-store').getTokenFilePath(options),
+      failure_reason: hostInjected ? 'env_token_missing' : undefined,
+      message: hostInjected
+        ? 'host-injected token is missing. Ask the host to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
+        : undefined,
     };
+    if (!hostInjected) {
+      status.token_file = require('./token-store').getTokenFilePath(options);
+    }
+    return status;
   }
   if (!session.access_token && session.refresh_token) {
     return {
       ok: true,
       auth_mode: 'token',
+      auth_source: session.auth_source,
       status: 'refresh_required',
       can_auto_use: true,
       refresh_token: maskToken(session.refresh_token),
@@ -324,6 +339,7 @@ function tokenStatus(options = {}) {
     // whether this access token must be refreshed.
     ok: true,
     auth_mode: 'token',
+    auth_source: session.auth_source,
     status: 'ok',
     can_auto_use: true,
     token_type: session.token_type,
@@ -343,6 +359,7 @@ async function tokenRefresh(options = {}) {
     return {
       ok: false,
       auth_mode: 'token',
+      auth_source: session && session.auth_source,
       status: 'missing_refresh_token',
       can_auto_use: false,
     };
@@ -380,6 +397,20 @@ async function tokenRefresh(options = {}) {
       message: normalized.message || 'auth service did not return access_token',
     };
   }
+  const env = options.env || process.env;
+  if (isHostInjectedTokenMode(env) && session.auth_source === 'env') {
+    env.OPENYIDA_ACCESS_TOKEN = normalized.access_token;
+    if (normalized.refresh_token) {
+      env.OPENYIDA_REFRESH_TOKEN = normalized.refresh_token;
+    }
+    if (normalized.expires_at) {
+      env.OPENYIDA_ACCESS_TOKEN_EXPIRES_AT = String(normalized.expires_at);
+    }
+    return normalizeTokenSession({
+      ...normalized,
+      auth_source: 'env',
+    });
+  }
   return saveTokenSession(normalized, options);
 }
 

package/lib/auth/token-store.js

@@ -119,17 +119,27 @@ function saveTokenSession(session, options = {}) {
   return normalized;
 }
 
+function isHostInjectedTokenMode(env = process.env) {
+  const authEnabled = String(env.YIDA_AUTH_ENABLED || '').trim().toLowerCase();
+  return ['1', 'true', 'yes', 'on'].includes(authEnabled);
+}
+
 function loadEnvTokenSession(env = process.env) {
+  const accessToken = String(env.OPENYIDA_ACCESS_TOKEN || '').trim();
   const refreshToken = String(env.OPENYIDA_REFRESH_TOKEN || '').trim();
-  if (!refreshToken) {
+  if (!accessToken && !refreshToken) {
     return null;
   }
   return normalizeTokenSession({
+    access_token: accessToken,
     refresh_token: refreshToken,
     base_url: env.OPENYIDA_ENDPOINT,
     client_id: env.OPENYIDA_TOKEN_CLIENT_ID,
     corp_id: env.OPENYIDA_TOKEN_CORP_ID,
     user_id: env.OPENYIDA_TOKEN_USER_ID,
+    token_type: env.OPENYIDA_TOKEN_TYPE,
+    expires_at: env.OPENYIDA_ACCESS_TOKEN_EXPIRES_AT,
+    expires_in: env.OPENYIDA_ACCESS_TOKEN_EXPIRES_IN,
     auth_source: 'env',
   });
 }
@@ -147,24 +157,31 @@ function loadLocalTokenSession(options = {}) {
 }
 
 function loadTokenSession(options = {}) {
+  const env = options.env || process.env;
+  const envSession = loadEnvTokenSession(env);
+  if (isHostInjectedTokenMode(env)) {
+    return envSession;
+  }
+
   const localSession = loadLocalTokenSession(options);
-  const envSession = loadEnvTokenSession(options.env || process.env);
   if (!localSession && !envSession) {
     return null;
   }
 
   const localAccessToken = localSession && localSession.access_token;
   const localRefreshToken = localSession && localSession.refresh_token;
+  const envAccessToken = envSession && envSession.access_token;
   const envRefreshToken = envSession && envSession.refresh_token;
   const usesLocal = Boolean(localAccessToken || localRefreshToken);
   const usesEnv = Boolean(
-    !localRefreshToken && envRefreshToken
+    (!localAccessToken && !localRefreshToken && envAccessToken) ||
+    (!localRefreshToken && envRefreshToken)
   );
 
   return normalizeTokenSession({
     ...(envSession || {}),
     ...(localSession || {}),
-    access_token: localAccessToken,
+    access_token: localAccessToken || (!localSession && envAccessToken),
     refresh_token: localRefreshToken || envRefreshToken,
     auth_source: usesLocal && usesEnv ? 'mixed' : (usesLocal ? 'local' : 'env'),
   });
@@ -210,6 +227,7 @@ module.exports = {
   normalizeTokenSession,
   loadEnvTokenSession,
   loadLocalTokenSession,
+  isHostInjectedTokenMode,
   isAccessTokenUsable,
   maskToken,
   resolveEnvName,

package/lib/bridge/bridge.js

@@ -516,6 +516,7 @@ function sanitizeLoginResult(result = {}) {
     canAutoUse: !!(result.can_auto_use || result.canAutoUse),
     loggedIn: status === 'ok',
     authMode: result.auth_mode || result.authMode,
+    authSource: result.auth_source || result.authSource,
     baseUrlOrigin: originFromUrl(result.base_url || result.baseUrl),
     corpId: maskId(result.corp_id || result.corpId),
     userId: maskId(result.user_id || result.userId),
@@ -537,6 +538,36 @@ function sanitizeQrLoginStart(result = {}, loginSessionId) {
   };
 }
 
+function isTokenLoginStartResult(result = {}) {
+  const authMode = result.auth_mode || result.authMode;
+  return authMode === 'token' || result.status === 'token_login_required';
+}
+
+function sanitizeTokenLoginStart(result = {}) {
+  const status = result.status || 'token_login_required';
+  return {
+    status,
+    canAutoUse: !!(result.can_auto_use || result.canAutoUse),
+    loggedIn: status === 'ok',
+    authMode: result.auth_mode || result.authMode || 'token',
+    authSource: result.auth_source || result.authSource,
+    baseUrlOrigin: originFromUrl(result.base_url || result.baseUrl),
+    corpId: maskId(result.corp_id || result.corpId),
+    userId: maskId(result.user_id || result.userId),
+    diagnostics: sanitizeDiagnostics(result.diagnostics || {}),
+    pollable: false,
+    loginSessionId: null,
+    message: result.message ? String(result.message).slice(0, 300) : undefined,
+  };
+}
+
+function sanitizeLoginStart(result = {}, loginSessionId) {
+  if (isTokenLoginStartResult(result)) {
+    return sanitizeTokenLoginStart(result);
+  }
+  return sanitizeQrLoginStart(result, loginSessionId);
+}
+
 function getBridgeInfo(state) {
   return {
     ok: true,
@@ -560,8 +591,8 @@ function getBridgeInfo(state) {
 }
 
 function defaultCheckLogin() {
-  const { tokenStatus } = require('../auth/token-auth');
-  return tokenStatus({ includeSecrets: false });
+  const { getAuthStatus } = require('../core/utils');
+  return getAuthStatus({ includeSecrets: false });
 }
 
 async function defaultStartLogin() {
@@ -766,8 +797,9 @@ async function handleLoginStart(req, res, state) {
 
   const startLogin = getHandler(state, 'startLogin', defaultStartLogin);
   const result = await startLogin(body);
-  const loginSessionId = randomToken();
-  if (result.session_file) {
+  const tokenLoginStart = isTokenLoginStartResult(result);
+  const loginSessionId = tokenLoginStart ? null : randomToken();
+  if (!tokenLoginStart && result && result.session_file) {
     state.loginSessions.set(loginSessionId, {
       sessionFile: result.session_file,
       createdAt: new Date().toISOString(),
@@ -776,7 +808,7 @@ async function handleLoginStart(req, res, state) {
 
   respondJson(req, res, state, 200, {
     ok: true,
-    login: sanitizeQrLoginStart(result, loginSessionId),
+    login: sanitizeLoginStart(result, loginSessionId),
   });
 }
 

package/lib/core/agent-capabilities.js

@@ -6,7 +6,7 @@ const { version } = require('../../package.json');
 const { t } = require('./i18n');
 const { buildCommandManifest } = require('./command-manifest');
 const { buildEnvironmentSnapshot } = require('./env');
-const { tokenStatus } = require('../auth/token-auth');
+const { getAuthStatus } = require('./utils');
 
 function redactLogin(login) {
   const redacted = { ...login };
@@ -18,6 +18,8 @@ function redactLogin(login) {
 function compactLogin(login) {
   return {
     status: login.status,
+    auth_mode: login.auth_mode,
+    auth_source: login.auth_source,
     can_auto_use: login.can_auto_use === true,
   };
 }
@@ -68,9 +70,9 @@ function buildCommandManifestDigest(manifest) {
 
 function buildAgentCapabilitiesSummary() {
   const envSnapshot = buildEnvironmentSnapshot();
-  const loginStatus = tokenStatus({ includeSecrets: false });
   const manifest = buildCommandManifest({ t, version });
   const projectRoot = envSnapshot.active.projectRoot;
+  const loginStatus = getAuthStatus({ projectRoot, includeSecrets: false });
 
   return {
     schema_version: 1,
@@ -90,9 +92,9 @@ function buildAgentCapabilitiesSummary() {
 
 function buildAgentCapabilities() {
   const envSnapshot = buildEnvironmentSnapshot();
-  const loginStatus = redactLogin(tokenStatus({ includeSecrets: false }));
   const manifest = buildCommandManifest({ t, version });
   const projectRoot = envSnapshot.active.projectRoot;
+  const loginStatus = redactLogin(getAuthStatus({ projectRoot, includeSecrets: false }));
 
   return {
     schema_version: 1,

package/lib/core/command-manifest.js

@@ -193,8 +193,13 @@ const COMMAND_SIDE_EFFECTS = new Map([
     'dingtalk-link',
     'formula.evaluate',
     'integration.diagnose',
+    'schema.validate',
   ], sideEffect('local_read')),
 
+  ...sideEffectEntries([
+    'schema.plan',
+  ], sideEffect('remote_read')),
+
   ...sideEffectEntries([
     'build-page',
     'cdn-config',
@@ -286,6 +291,12 @@ const COMMAND_SIDE_EFFECTS = new Map([
     read_actions: ['text', 'image --image-url'],
     mutating_actions: ['image --file'],
   })],
+  ['schema.apply', sideEffect('mixed', {
+    mutates_yida: true,
+    mutates_local: true,
+    read_actions: [],
+    mutating_actions: ['apply'],
+  })],
   ['ai-form-setting', sideEffect('mixed', {
     mutates_yida: true,
     mutates_local: false,
@@ -452,6 +463,8 @@ const COMMAND_PERMISSIONS = new Map([
     'integration.list',
     'list-forms',
     'process.preview',
+    'schema.plan',
+    'schema.validate',
     'verify-short-url',
   ], permission('allow', 'read', {
     reason: 'Read-only, diagnostic, validation, or manifest discovery command.',
@@ -510,6 +523,17 @@ const COMMAND_PERMISSIONS = new Map([
     reason: ALLOW_WRITE_REASON,
   })),
 
+  ['schema.apply', permission('allow', 'write', {
+    reason: ALLOW_WRITE_REASON,
+    action_dependent: true,
+    read_actions: [],
+    preauthorized_actions: ['apply'],
+    preauthorized_patterns: [],
+    ask_actions: [],
+    ask_patterns: [],
+    unknown_action_mode: 'ask',
+  })],
+
   ...permissionEntries([
     'login',
     'logout',
@@ -799,6 +823,22 @@ const COMMAND_GROUPS = [
       command('get-form-config', ['get-form-config'], 'get-form-config <appType> <formUuid> [--json]', 'help.cmd_get_form_config', { output: 'json' }),
     ],
   },
+  {
+    id: 'schema',
+    titleKey: 'help.group_schema',
+    commands: [
+      command('schema.validate', ['schema', 'validate'], 'schema validate <manifest> --json --quiet', 'help.cmd_schema_validate', {
+        requiresLogin: false,
+        output: 'json',
+      }),
+      command('schema.plan', ['schema', 'plan'], 'schema plan <manifest> --state <path> --json --quiet', 'help.cmd_schema_plan', {
+        output: 'json',
+      }),
+      command('schema.apply', ['schema', 'apply'], 'schema apply <manifest> --state <path> --plan-id <planId> --json --quiet', 'help.cmd_schema_apply', {
+        output: 'json',
+      }),
+    ],
+  },
   {
     id: 'data',
     titleKey: 'help.group_data',

package/lib/core/doctor.js

@@ -202,7 +202,7 @@ class EnvironmentChecker {
         label: '可选浏览器能力（Playwright 已安装）',
         passed: true,
         severity: Severity.INFO,
-        message: '当前 CLI 默认使用 OAuth token 登录；Playwright 仅用于少量浏览器预览或兼容场景',
+        message: '当前 CLI 默认使用 OAuth token 登录；Playwright 仅用于少量浏览器预览或截图评测',
         fixType: null,
       };
     } catch {
@@ -254,10 +254,21 @@ class EnvironmentChecker {
   }
 
   checkLoginStatus() {
-    const { tokenStatus } = require('../auth/token-auth');
-    const status = tokenStatus({ projectRoot: this.projectRoot });
+    const { getAuthStatus, isEnvAuthMode } = require('./utils');
+    const status = getAuthStatus({ projectRoot: this.projectRoot });
 
-    if (status.status !== 'ok') {
+    if (!status.ok) {
+      if (isEnvAuthMode()) {
+        return {
+          id: 'env-login',
+          label: '宜搭宿主 token 注入登录态',
+          passed: false,
+          severity: Severity.WARNING,
+          message: `宿主 token 注入不可用（${status.failure_reason || status.status}），请回到宿主环境注入 OPENYIDA_ACCESS_TOKEN 或 OPENYIDA_REFRESH_TOKEN`,
+          fixType: null,
+          fixCommand: null,
+        };
+      }
       return {
         id: 'env-login',
         label: '宜搭 token 登录态',

package/lib/core/env-cmd.js

@@ -145,7 +145,7 @@ function switchToEnv(envName) {
   console.log(`  地址：${config.environments[resolvedEnvName].baseUrl}`);
   console.log(`  登录：${getLoginHost(config.environments[resolvedEnvName].loginUrl)}`);
   console.log('');
-  console.log(`${DIM}下一步：运行 openyida login；在悟空中可运行 openyida login --wukong${RESET}`);
+  console.log(`${DIM}下一步：运行 openyida login；在宿主注入 token 模式中请先确认宿主已注入 OPENYIDA_ACCESS_TOKEN 或 OPENYIDA_REFRESH_TOKEN${RESET}`);
   console.log('');
 }
 

package/lib/core/env.js

@@ -12,6 +12,7 @@ const os = require('os');
 const {
   detectActiveTool,
   findProjectRoot,
+  getAuthStatus,
   resolveWukongWorkspaceRoot,
 } = require('./utils');
 const { t } = require('./i18n');
@@ -98,29 +99,29 @@ function getTokenDiagnostics(projectRoot) {
  * 检测登录态信息。
  */
 function detectLoginStatus(projectRoot) {
-  const tokenDiagnostics = getTokenDiagnostics(projectRoot);
-  const { tokenStatus } = require('../auth/token-auth');
-  const status = tokenStatus({ projectRoot });
+  const status = getAuthStatus({ projectRoot });
   const loggedIn = status.status === 'ok';
 
+  const tokenDiagnostics = getTokenDiagnostics(projectRoot);
   return {
     loggedIn,
     canAutoUse: !!status.can_auto_use,
     corpId: status.corp_id || null,
     userId: status.user_id || null,
     baseUrl: status.base_url || null,
-    authSource: 'token',
+    authSource: status.auth_source || 'token',
     authMode: 'token',
     tokenFile: status.token_file || tokenDiagnostics.tokenFile,
     diagnostics: {
       ...tokenDiagnostics,
-      authSource: 'token',
+      authSource: status.auth_source || 'token',
+      authMode: 'token',
       cacheReadable: tokenDiagnostics.tokenFileFound,
       tokenFound: loggedIn,
       corpIdFound: !!status.corp_id,
       userIdFound: !!status.user_id,
       baseUrlFound: !!status.base_url,
-      failureReason: loggedIn ? null : status.status,
+      failureReason: loggedIn ? null : (status.failure_reason || status.status),
     },
   };
 }