openyida 2026.7.6 → 2026.7.7-1

package/bin/yida.js

@@ -266,7 +266,7 @@ function printLoginResult(result) {
     corp_id: result && result.corp_id,
     user_id: result && result.user_id,
     csrf_token: result && result.csrf_token ? `${result.csrf_token.slice(0, 16)}...` : undefined,
-    cookies_count: Array.isArray(result && result.cookies) ? result.cookies.length : 0,
+    cookies_count: Array.isArray(result && result.cookies) ? result.cookies.length : (result.cookies_count || 0),
   };
   console.log(JSON.stringify(summary));
 }
@@ -559,7 +559,7 @@ async function main() {
     case 'login': {
       const { checkLoginOnly } = require('../lib/auth/login');
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { isInjectedAuthMode } = require('../lib/core/utils');
+      const { isEnvAuthMode } = require('../lib/core/utils');
       if (loginArgs.includes('--agent-poll') || loginArgs.includes('--codex-poll')) {
         const sessionFile = getArgValue(loginArgs, '--agent-poll') || getArgValue(loginArgs, '--codex-poll');
         const { pollCodexQrLogin } = require('../lib/auth/qr-login');
@@ -577,7 +577,7 @@ async function main() {
       } else if (loginArgs.includes('--check-only')) {
         const result = checkLoginOnly({ includeSecrets: loginArgs.includes('--with-cookies') });
         console.log(JSON.stringify(result, null, 2));
-      } else if (isInjectedAuthMode()) {
+      } else if (isEnvAuthMode()) {
         const result = checkLoginOnly({ includeSecrets: true });
         printLoginResult(result);
       } else if (shouldUseCodexQrLogin(loginArgs)) {

package/lib/auth/auth.js

@@ -32,6 +32,13 @@ const { t } = require('../core/i18n');
 
 const AUTH_CACHE_FILE = '.cache/auth.json';
 
+function maskIdentifier(value) {
+  const text = String(value || '');
+  if (!text) {return null;}
+  if (text.length <= 8) {return `${text.slice(0, 2)}***${text.slice(-1)}`;}
+  return `${text.slice(0, 4)}***${text.slice(-4)}`;
+}
+
 // ── 配置读取 ──────────────────────────────────────────
 
 function loadAuthConfig() {
@@ -90,6 +97,7 @@ function authStatus() {
   const userId = cookieData.user_id || cookieData.userId || cookieData.staffId || cookieInfo.userId;
   const baseUrl = resolveBaseUrl(cookieData);
   const authConfig = loadAuthConfig();
+  const isEnvAuth = cookieData.auth_source === 'env';
 
   if (!csrfToken) {
     warn(t('auth.no_csrf_token'), false);
@@ -105,12 +113,12 @@ function authStatus() {
   chalkSuccess(t('auth.logged_in'), false);
   label('Base URL', baseUrl, { stderr: false });
   if (corpId) {
-    label('Corp ID', corpId, { stderr: false });
+    label('Corp ID', isEnvAuth ? maskIdentifier(corpId) : corpId, { stderr: false });
   }
   if (userId) {
-    label('User ID', userId, { stderr: false });
+    label('User ID', isEnvAuth ? maskIdentifier(userId) : userId, { stderr: false });
   }
-  label('CSRF', `${csrfToken.slice(0, 16)}…`, { stderr: false });
+  label('CSRF', isEnvAuth ? '<redacted>' : `${csrfToken.slice(0, 16)}…`, { stderr: false });
 
   // 显示登录信息
   if (authConfig) {

package/lib/auth/login.js

@@ -27,7 +27,8 @@ const {
   loadCookieData,
   resolveBaseUrl,
   detectActiveTool,
-  isInjectedAuthMode,
+  isEnvAuthMode,
+  getLastEnvAuthError,
 } = require('../core/utils');
 const { t } = require('../core/i18n');
 
@@ -48,6 +49,9 @@ function loadConfig() {
 // ── Cookie 持久化 ─────────────────────────────────────
 
 function saveCookieCache(cookies, baseUrl) {
+  if (isEnvAuthMode()) {
+    return;
+  }
   const projectRoot = findProjectRoot();
   const cacheDir = path.join(projectRoot, '.cache');
 
@@ -61,6 +65,13 @@ function saveCookieCache(cookies, baseUrl) {
   process.stderr.write(`  ${c.green}✔${c.reset} Cookie saved to ${c.dim}${cookieFile}${c.reset}\n`);
 }
 
+function maskIdentifier(value) {
+  const text = String(value || '');
+  if (!text) {return null;}
+  if (text.length <= 8) {return `${text.slice(0, 2)}***${text.slice(-1)}`;}
+  return `${text.slice(0, 4)}***${text.slice(-4)}`;
+}
+
 // ── 仅检查登录态 ──────────────────────────────────────
 
 /**
@@ -79,9 +90,12 @@ function checkLoginOnly(options = {}) {
   const legacyCookieFile = path.join(projectRoot, '.cache', 'cookies.json');
   const cookieData = loadCookieData(projectRoot);
   const cookies = cookieData && Array.isArray(cookieData.cookies) ? cookieData.cookies : [];
-  const authMode = isInjectedAuthMode() ? 'injected' : 'default';
+  const envAuthError = getLastEnvAuthError();
+  const isEnvAuth = !!(cookieData && cookieData.auth_source === 'env');
+  const authMode = isEnvAuth || isEnvAuthMode() ? 'env' : 'default';
   const baseDiagnostics = {
     authMode,
+    authSource: authMode === 'env' ? 'env' : 'cache',
     activeTool: activeTool ? activeTool.tool : null,
     isWukong: !!(activeTool && activeTool.tool === 'wukong'),
     projectRoot,
@@ -106,10 +120,12 @@ function checkLoginOnly(options = {}) {
         corp_id_found: false,
         user_id_found: false,
         base_url_found: false,
-        failure_reason: baseDiagnostics.cookieFileFound ? 'cookie_cache_unreadable_or_invalid' : 'cookie_cache_missing',
+        failure_reason: envAuthError
+          ? envAuthError.failure_reason
+          : (baseDiagnostics.cookieFileFound ? 'cookie_cache_unreadable_or_invalid' : 'cookie_cache_missing'),
       },
-      message: authMode === 'injected'
-        ? 'No injected Cookie cache, host page refresh required'
+      message: authMode === 'env'
+        ? 'No env Cookie, host page refresh required'
         : 'No local Cookie cache, QR scan login required',
     };
   }
@@ -119,6 +135,9 @@ function checkLoginOnly(options = {}) {
   const corpId = cookieData.corp_id || cookieData.corpId || cookieInfo.corpId;
   const userId = cookieData.user_id || cookieData.userId || cookieData.staffId || cookieInfo.userId;
   const baseUrl = resolveBaseUrl(cookieData);
+  const canIncludeSecrets = includeSecrets && !isEnvAuth;
+  const outputCorpId = isEnvAuth ? maskIdentifier(corpId) : corpId;
+  const outputUserId = isEnvAuth ? maskIdentifier(userId) : userId;
   const diagnostics = {
     ...baseDiagnostics,
     cache_readable: true,
@@ -136,8 +155,8 @@ function checkLoginOnly(options = {}) {
       status: 'not_logged_in',
       can_auto_use: false,
       diagnostics,
-      message: authMode === 'injected'
-        ? 'No csrf_token in injected Cookie cache, host page refresh required'
+      message: authMode === 'env'
+        ? 'No csrf_token in env Cookie, host page refresh required'
         : 'No tianshu_csrf_token in Cookie, re-login required',
     };
   }
@@ -145,15 +164,15 @@ function checkLoginOnly(options = {}) {
   const result = {
     status: 'ok',
     can_auto_use: true,
-    csrf_token: includeSecrets ? csrfToken : `${csrfToken.slice(0, 8)}…`,
-    corp_id: corpId,
-    user_id: userId,
+    csrf_token: canIncludeSecrets ? csrfToken : `${csrfToken.slice(0, 8)}…`,
+    corp_id: outputCorpId,
+    user_id: outputUserId,
     base_url: baseUrl,
     cookies_count: cookies.length,
     diagnostics,
-    message: `✅ Valid login credentials found\n  Org: ${corpId}\n  User: ${userId}\n  Domain: ${baseUrl}`,
+    message: `✅ Valid login credentials found\n  Org: ${outputCorpId || ''}\n  User: ${outputUserId || ''}\n  Domain: ${baseUrl}`,
   };
-  if (includeSecrets) {
+  if (canIncludeSecrets) {
     result.cookies = cookies;
   }
   return result;
@@ -209,8 +228,8 @@ function refreshCsrfFromCache() {
  */
 function ensureLogin(options = {}) {
   const force = !!options.force;
-  const injectedAuth = isInjectedAuthMode();
-  if (!force || injectedAuth) {
+  const envAuth = isEnvAuthMode();
+  if (!force || envAuth) {
     const cookieData = loadCookieData();
 
     if (cookieData && cookieData.cookies) {
@@ -235,7 +254,7 @@ function ensureLogin(options = {}) {
     }
   }
 
-  if (injectedAuth) {
+  if (envAuth) {
     return null;
   }
 

package/lib/core/env.js

@@ -16,6 +16,7 @@ const {
   resolveBaseUrl,
   extractInfoFromCookies,
   resolveWukongWorkspaceRoot,
+  getLastEnvAuthError,
 } = require('./utils');
 const { t } = require('./i18n');
 
@@ -110,6 +111,7 @@ function detectLoginStatus(projectRoot) {
   const cookieDiagnostics = getCookieDiagnostics(projectRoot);
   const cookieData = loadCookieData(projectRoot);
   const cookies = cookieData && Array.isArray(cookieData.cookies) ? cookieData.cookies : [];
+  const envAuthError = getLastEnvAuthError();
 
   if (!cookieData || !cookieData.cookies) {
     return {
@@ -128,7 +130,9 @@ function detectLoginStatus(projectRoot) {
         corpIdFound: false,
         userIdFound: false,
         baseUrlFound: false,
-        failureReason: cookieDiagnostics.cookieFileFound ? 'cookie_cache_unreadable_or_invalid' : 'cookie_cache_missing',
+        failureReason: envAuthError
+          ? envAuthError.failure_reason
+          : (cookieDiagnostics.cookieFileFound ? 'cookie_cache_unreadable_or_invalid' : 'cookie_cache_missing'),
       },
     };
   }
@@ -139,6 +143,7 @@ function detectLoginStatus(projectRoot) {
   const userId = cookieData.user_id || cookieData.userId || cookieData.staffId || cookieInfo.userId;
   const baseUrl = resolveBaseUrl(cookieData);
   const loggedIn = !!csrfToken;
+  const isEnvAuth = cookieData.auth_source === 'env';
 
   return {
     loggedIn,
@@ -148,8 +153,10 @@ function detectLoginStatus(projectRoot) {
     userId,
     baseUrl,
     cookiesCount: cookies.length,
+    authSource: isEnvAuth ? 'env' : 'cache',
     diagnostics: {
       ...cookieDiagnostics,
+      authSource: isEnvAuth ? 'env' : 'cache',
       cacheReadable: true,
       cookiesArrayFound: Array.isArray(cookieData.cookies),
       csrfTokenFound: !!csrfToken,
@@ -166,6 +173,13 @@ function maskSecret(value) {
   return `${value.slice(0, 16)}...`;
 }
 
+function maskIdentifier(value) {
+  const text = String(value || '');
+  if (!text) {return null;}
+  if (text.length <= 8) {return `${text.slice(0, 2)}***${text.slice(-1)}`;}
+  return `${text.slice(0, 4)}***${text.slice(-4)}`;
+}
+
 /**
  * 构建适合 AI agent 读取的环境快照。
  */
@@ -198,9 +212,10 @@ function buildEnvironmentSnapshot() {
       loggedIn: loginStatus.loggedIn,
       canAutoUse: loginStatus.canAutoUse,
       baseUrl: loginStatus.baseUrl,
-      corpId: loginStatus.corpId,
-      userId: loginStatus.userId,
-      csrfToken: maskSecret(loginStatus.csrfToken),
+      authSource: loginStatus.authSource || null,
+      corpId: loginStatus.authSource === 'env' ? maskIdentifier(loginStatus.corpId) : loginStatus.corpId,
+      userId: loginStatus.authSource === 'env' ? maskIdentifier(loginStatus.userId) : loginStatus.userId,
+      csrfToken: loginStatus.authSource === 'env' ? null : maskSecret(loginStatus.csrfToken),
       cookiesCount: loginStatus.cookiesCount,
       diagnostics: loginStatus.diagnostics,
     },

package/lib/core/utils.js

@@ -264,6 +264,43 @@ function isInjectedAuthMode(env = process.env) {
   return ['1', 'true', 'yes', 'on'].includes(authEnabled);
 }
 
+function hasEnvCookieAuth(env = process.env) {
+  return !!String(env.OPENYIDA_COOKIE_B64 || '').trim();
+}
+
+function isEnvAuthMode(env = process.env) {
+  return isInjectedAuthMode(env) || hasEnvCookieAuth(env);
+}
+
+let lastEnvAuthError = null;
+
+function getLastEnvAuthError() {
+  return lastEnvAuthError;
+}
+
+function setLastEnvAuthError(code, failureReason, message) {
+  lastEnvAuthError = {
+    code,
+    failure_reason: failureReason,
+    message,
+    authMode: 'env',
+  };
+  return lastEnvAuthError;
+}
+
+function normalizeEnvBaseUrl(baseUrl, fallbackBaseUrl) {
+  const raw = String(baseUrl || fallbackBaseUrl || 'https://www.aliwork.com').trim();
+  try {
+    const parsed = new URL(raw);
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+      return null;
+    }
+    return raw.replace(/\/+$/, '');
+  } catch {
+    return null;
+  }
+}
+
 /**
  * 查找项目根目录（project 工作区）。
  *
@@ -354,6 +391,123 @@ function extractInfoFromCookies(cookies) {
   return { csrfToken, corpId, userId };
 }
 
+function parseCookieHeader(rawCookieHeader, options = {}) {
+  const raw = String(rawCookieHeader || '').trim();
+  if (!raw) {
+    return [];
+  }
+  let domain = '';
+  if (options.baseUrl) {
+    try {
+      domain = new URL(options.baseUrl).hostname;
+    } catch {
+      domain = '';
+    }
+  }
+  return raw
+    .split(';')
+    .map((part) => {
+      const trimmed = part.trim();
+      const equalsIndex = trimmed.indexOf('=');
+      if (equalsIndex <= 0) {
+        return null;
+      }
+      const name = trimmed.slice(0, equalsIndex).trim();
+      const value = trimmed.slice(equalsIndex + 1).trim();
+      if (!name) {
+        return null;
+      }
+      const cookie = { name, value };
+      if (domain) {
+        cookie.domain = domain;
+      }
+      return cookie;
+    })
+    .filter(Boolean);
+}
+
+function decodeCookieHeaderFromBase64(encodedCookie) {
+  const normalized = String(encodedCookie || '').trim().replace(/\s+/g, '');
+  if (!normalized) {
+    return null;
+  }
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(normalized, 'base64').toString('utf8').trim();
+    return decoded && decoded.includes('=') ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+
+function loadEnvCookieData(defaultBaseUrl, env = process.env) {
+  lastEnvAuthError = null;
+  const encodedCookie = String(env.OPENYIDA_COOKIE_B64 || '').trim();
+  const envAuthEnabled = isInjectedAuthMode(env);
+  if (!encodedCookie) {
+    if (envAuthEnabled) {
+      setLastEnvAuthError(
+        'not_logged_in',
+        'env_cookie_missing',
+        'OPENYIDA_COOKIE_B64 is required when YIDA_AUTH_ENABLED=true'
+      );
+    }
+    return null;
+  }
+
+  const baseUrl = normalizeEnvBaseUrl(env.OPENYIDA_BASE_URL, defaultBaseUrl);
+  if (!baseUrl) {
+    setLastEnvAuthError(
+      'not_logged_in',
+      'base_url_invalid',
+      'OPENYIDA_BASE_URL is invalid'
+    );
+    return null;
+  }
+
+  const rawCookieHeader = decodeCookieHeaderFromBase64(encodedCookie);
+  if (!rawCookieHeader) {
+    setLastEnvAuthError(
+      'not_logged_in',
+      'env_cookie_decode_failed',
+      'OPENYIDA_COOKIE_B64 is not a valid base64 encoded Cookie header'
+    );
+    return null;
+  }
+
+  const cookies = parseCookieHeader(rawCookieHeader, { baseUrl });
+  if (cookies.length === 0) {
+    setLastEnvAuthError(
+      'not_logged_in',
+      'env_cookie_parse_failed',
+      'OPENYIDA_COOKIE_B64 decoded to an empty or invalid Cookie header'
+    );
+    return null;
+  }
+
+  const { csrfToken, corpId, userId } = extractInfoFromCookies(cookies);
+  if (!csrfToken) {
+    setLastEnvAuthError(
+      'csrf_missing',
+      'csrf_token_missing',
+      'Env Cookie header does not contain tianshu_csrf_token'
+    );
+    return null;
+  }
+
+  return {
+    cookies,
+    csrf_token: csrfToken,
+    corp_id: corpId,
+    user_id: userId,
+    base_url: baseUrl,
+    auth_source: 'env',
+    auth_mode: 'env',
+  };
+}
+
 // ── 登录态缓存读取 ────────────────────────────────────
 
 /**
@@ -368,6 +522,14 @@ function loadCookieData(projectRoot, defaultBaseUrl) {
   const root = projectRoot || findProjectRoot();
   const fallbackBaseUrl = defaultBaseUrl || 'https://www.aliwork.com';
 
+  const envCookieData = loadEnvCookieData(fallbackBaseUrl);
+  if (envCookieData) {
+    return envCookieData;
+  }
+  if (lastEnvAuthError && isEnvAuthMode()) {
+    return null;
+  }
+
   // 尝试迁移旧版 cookies.json（仅在首次使用多环境功能时执行一次）
   const { migrateOldCookieFile, getCookieFilePath } = require('./env-manager');
   migrateOldCookieFile(root);
@@ -428,21 +590,22 @@ function loadCookieData(projectRoot, defaultBaseUrl) {
  * @returns {object} loginResult
  */
 function triggerLogin(options = {}) {
-  if (isInjectedAuthMode()) {
+  if (isEnvAuthMode()) {
     const cookieData = loadCookieData();
     if (cookieData && cookieData.cookies && cookieData.cookies.length > 0 && cookieData.csrf_token) {
       return cookieData;
     }
-    const reason = cookieData && cookieData.cookies
-      ? 'csrf_token_missing'
-      : 'cookie_cache_missing';
+    const envAuthError = getLastEnvAuthError();
+    const reason = envAuthError
+      ? envAuthError.failure_reason
+      : (cookieData && cookieData.cookies ? 'csrf_token_missing' : 'env_cookie_missing');
     const { CliError } = require('./cli-error');
     throw new CliError(
-      `not_logged_in: injected cookie is unavailable (${reason}). Refresh the host page so it can inject a fresh Yida cookie cache.`,
+      `not_logged_in: env cookie is unavailable (${reason}). Refresh the host page so it can inject a fresh Yida cookie.`,
       {
         code: 'INJECTED_AUTH_REQUIRED',
         details: {
-          authMode: 'injected',
+          authMode: 'env',
           failure_reason: reason,
         },
       }
@@ -499,10 +662,16 @@ function refreshCsrfToken() {
  * @returns {boolean}
  */
 function isLoginExpired(responseJson) {
+  if (!responseJson) {return false;}
+  const status = String(responseJson.status || '').toLowerCase();
+  const errorCode = String(responseJson.errorCode || responseJson.code || '').toLowerCase();
+  const errorMsg = String(responseJson.errorMsg || responseJson.message || '').toLowerCase();
+  if (status === 'not_logged_in' || errorCode === 'not_logged_in' || errorMsg.includes('not_logged_in')) {
+    return true;
+  }
   return (
-    responseJson &&
     responseJson.success === false &&
-    (responseJson.errorCode === '307' || responseJson.errorCode === '302')
+    ['307', '302', '401', '403'].includes(errorCode)
   );
 }
 
@@ -523,6 +692,10 @@ function isHttpRedirectStatus(statusCode) {
   return [301, 302, 303, 307, 308].includes(Number(statusCode));
 }
 
+function isHttpAuthStatus(statusCode) {
+  return [401, 403].includes(Number(statusCode));
+}
+
 // ── base_url 解析 ─────────────────────────────────────
 
 /**
@@ -612,7 +785,7 @@ function httpPost(baseUrl, requestPath, postData, cookies, optionsOverride = {})
         if (!optionsOverride.silentStatus) {
           warn(t('common.http_status', res.statusCode));
         }
-        if (isHttpRedirectStatus(res.statusCode)) {
+        if (isHttpRedirectStatus(res.statusCode) || isHttpAuthStatus(res.statusCode)) {
           resolve({
             __needLogin: true,
             __httpStatus: res.statusCode,
@@ -694,7 +867,7 @@ function httpPostJson(baseUrl, requestPath, payload, cookies, optionsOverride =
         if (!optionsOverride.silentStatus) {
           warn(t('common.http_status', res.statusCode));
         }
-        if (isHttpRedirectStatus(res.statusCode)) {
+        if (isHttpRedirectStatus(res.statusCode) || isHttpAuthStatus(res.statusCode)) {
           resolve({
             __needLogin: true,
             __httpStatus: res.statusCode,
@@ -784,7 +957,7 @@ function httpGet(baseUrl, requestPath, queryParams, cookies, optionsOverride = {
         if (!optionsOverride.silentStatus) {
           warn(t('common.http_status', res.statusCode));
         }
-        if (isHttpRedirectStatus(res.statusCode)) {
+        if (isHttpRedirectStatus(res.statusCode) || isHttpAuthStatus(res.statusCode)) {
           resolve({
             __needLogin: true,
             __httpStatus: res.statusCode,
@@ -830,14 +1003,16 @@ function httpGet(baseUrl, requestPath, queryParams, cookies, optionsOverride = {
  */
 async function requestWithAutoLogin(requestFn, authRef) {
   let result = await requestFn(authRef);
+  const usingEnvAuth = isEnvAuthMode()
+    || !!(authRef && authRef.cookieData && authRef.cookieData.auth_source === 'env');
 
   if (result && result.__csrfExpired) {
-    if (isInjectedAuthMode()) {
+    if (usingEnvAuth) {
       return {
         success: false,
         __needLogin: true,
         errorCode: 'INJECTED_AUTH_REQUIRED',
-        errorMsg: 'not_logged_in: injected cookie csrf_token expired. Refresh the host page so it can inject a fresh Yida cookie cache.',
+        errorMsg: 'not_logged_in: env cookie csrf_token expired. Refresh the host page so it can inject a fresh Yida cookie.',
       };
     }
     const refreshedData = refreshCsrfToken();
@@ -854,12 +1029,12 @@ async function requestWithAutoLogin(requestFn, authRef) {
   }
 
   if (result && result.__needLogin) {
-    if (isInjectedAuthMode()) {
+    if (usingEnvAuth) {
       return {
         success: false,
         __needLogin: true,
         errorCode: 'INJECTED_AUTH_REQUIRED',
-        errorMsg: 'not_logged_in: injected cookie missing or expired. Refresh the host page so it can inject a fresh Yida cookie cache.',
+        errorMsg: 'not_logged_in: env cookie missing or expired. Refresh the host page so it can inject a fresh Yida cookie.',
       };
     }
     const newCookieData = triggerLogin({ force: true });
@@ -886,6 +1061,9 @@ module.exports = {
   hasDesktopEnvironment,
   findProjectRoot,
   extractInfoFromCookies,
+  parseCookieHeader,
+  loadEnvCookieData,
+  getLastEnvAuthError,
   loadCookieData,
   triggerLogin,
   refreshCsrfToken,
@@ -901,4 +1079,6 @@ module.exports = {
   getNodeExecutable,
   resolveWukongWorkspaceRoot,
   isInjectedAuthMode,
+  hasEnvCookieAuth,
+  isEnvAuthMode,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.7.6",
+  "version": "2026.7.7-1",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/scripts/eval/score.js

@@ -108,6 +108,18 @@ function buildHumanScores(screenshots = []) {
   }));
 }
 
+function toMarkdownPath(abs, workDir) {
+  if (!abs) {return null;}
+  if (!workDir) {return abs.replace(/\\/g, '/');}
+
+  const isWindowsPath = /^[a-zA-Z]:[\\/]/.test(abs) || /^[a-zA-Z]:[\\/]/.test(workDir);
+  const relPath = isWindowsPath
+    ? path.win32.relative(workDir, abs)
+    : path.relative(workDir, abs);
+
+  return (relPath || abs).replace(/\\/g, '/');
+}
+
 /**
  * 生成人工打分文档（Markdown），内嵌截图与链接。
  * @param {object} options
@@ -118,11 +130,6 @@ function buildHumanScores(screenshots = []) {
  */
 function renderScoringMarkdown(options = {}) {
   const { config = {}, scores = [], workDir, rubric = DEFAULT_RUBRIC } = options;
-  const rel = (abs) => {
-    if (!abs) {return null;}
-    if (!workDir) {return abs;}
-    return path.relative(workDir, abs) || abs;
-  };
 
   const lines = [];
   lines.push('# 宜搭应用效果 · 人工打分表');
@@ -150,7 +157,7 @@ function renderScoringMarkdown(options = {}) {
     lines.push('');
     if (s.url) {lines.push(`- 链接：${s.url}`);}
     if (s.screenshot) {
-      const relPath = rel(s.screenshot);
+      const relPath = toMarkdownPath(s.screenshot, workDir);
       lines.push(`- 截图：\`${relPath}\``);
       lines.push('');
       lines.push(`![${s.stage || 'screenshot'}](${relPath})`);
@@ -193,5 +200,6 @@ module.exports = {
   autoScoreScreenshots,
   buildHumanScores,
   renderScoringMarkdown,
+  toMarkdownPath,
   writeScoringDoc,
 };