openyida 2026.8.19 → 2026.8.20

package/bin/yida.js

@@ -670,15 +670,13 @@ async function main() {
 
     case 'login': {
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { getAuthStatus } = require('../lib/core/utils');
       if (hasHelpFlag(loginArgs)) {
         printLoginHelp();
       } else {
         assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
         if (loginArgs.includes('--check-only')) {
           console.log(JSON.stringify(getAuthStatus(buildTokenLoginOptions(loginArgs)), null, 2));
-        } else if (isEnvAuthMode()) {
-          printLoginResult(getAuthStatus(buildTokenLoginOptions(loginArgs)));
         } else {
           const { tokenLogin } = require('../lib/auth/token-auth');
           const result = await tokenLogin(buildTokenLoginOptions(loginArgs));
@@ -697,7 +695,7 @@ async function main() {
     case 'auth': {
       const subCommand = args[0];
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
       if (!subCommand || subCommand === '--help' || subCommand === '-h') {
         printAuthHelp();
@@ -720,9 +718,7 @@ async function main() {
           printLoginHelp();
         } else {
           assertNoUnsupportedLegacyLoginFlags(rawArgs.slice(1), authArgs);
-          const result = isEnvAuthMode()
-            ? getAuthStatus(buildTokenLoginOptions(authArgs))
-            : await tokenLogin(buildTokenLoginOptions(authArgs));
+          const result = await tokenLogin(buildTokenLoginOptions(authArgs));
           printLoginResult(result);
         }
       } else if (subCommand === 'refresh') {

package/lib/auth/org.js

@@ -13,7 +13,7 @@ const {
   loadTokenSession,
   normalizeCorpName,
   resolveTokenSession,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   saveAuthProfilePointer,
   saveProjectLegacyTokenSession,
   saveTokenSession,
@@ -70,15 +70,15 @@ function createProfileRequiredError(targetCorpId, resolution = {}) {
   return error;
 }
 
-function createHostInjectedSwitchError(targetCorpId, currentSession, resolution = {}) {
+function createEnvTokenSwitchError(targetCorpId, currentSession, resolution = {}) {
   const actualCorpId = currentSession && currentSession.corp_id;
-  const error = new Error(`当前为宿主注入登录态，不能通过 OAuth 切换组织：target=${targetCorpId}, actual=${actualCorpId || 'unknown'}`);
-  error.code = 'ORG_SWITCH_HOST_INJECTED_MISMATCH';
-  error.status = 'host_injected_token_mismatch';
+  const error = new Error(`当前为 env token 登录态，不能通过 OAuth 切换组织：target=${targetCorpId}, actual=${actualCorpId || 'unknown'}`);
+  error.code = 'ORG_SWITCH_ENV_TOKEN_MISMATCH';
+  error.status = 'env_token_mismatch';
   error.targetCorpId = targetCorpId;
   error.actualCorpId = actualCorpId;
   error.auth_source = resolution.auth_source || (currentSession && currentSession.auth_source) || 'env';
-  error.auth_store = resolution.auth_store || (currentSession && currentSession.auth_store) || 'host_injected';
+  error.auth_store = resolution.auth_store || (currentSession && currentSession.auth_store) || 'env';
   error.can_auto_use = false;
   return error;
 }
@@ -220,8 +220,8 @@ async function switchOrganization(targetCorpId, options = {}) {
   if (targetResolution.status === 'profile_required') {
     throw createProfileRequiredError(targetCorpId, targetResolution);
   }
-  if (isHostInjectedTokenMode(projectOptions.env)) {
-    throw createHostInjectedSwitchError(targetCorpId, currentSession, targetResolution);
+  if (isEnvTokenAuthMode(projectOptions.env)) {
+    throw createEnvTokenSwitchError(targetCorpId, currentSession, targetResolution);
   }
 
   const loginOptions = {

package/lib/auth/profile.js

@@ -2,7 +2,7 @@
 
 const { CliError } = require('../core/cli-error');
 const {
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   listUserAuthProfiles,
   loadAuthProfilePointer,
   loadTokenSession,
@@ -129,14 +129,14 @@ function resolveSwitchTarget(target, options = {}) {
 }
 
 function switchAuthProfile(target, options = {}) {
-  if (isHostInjectedTokenMode(options.env || process.env)) {
+  if (isEnvTokenAuthMode(options.env || process.env)) {
     throw new CliError(
-      'host-injected token mode cannot switch local auth profiles',
+      'env token mode cannot switch local auth profiles',
       {
-        code: 'AUTH_PROFILE_SWITCH_HOST_INJECTED',
+        code: 'AUTH_PROFILE_SWITCH_ENV_TOKEN',
         details: {
-          nextStep: 'Ask the host runtime to inject the target organization token instead of switching local profiles.',
-          next_step: 'Ask the host runtime to inject the target organization token instead of switching local profiles.',
+          nextStep: 'Ask the runtime to inject the target organization token instead of switching local profiles.',
+          next_step: 'Ask the runtime to inject the target organization token instead of switching local profiles.',
         },
       }
     );

package/lib/auth/token-auth.js

@@ -15,14 +15,13 @@ const {
   clearAllUserAuthProfiles,
   clearTokenSession,
   deleteUserAuthProfile,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   listUserAuthProfiles,
   loadLocalTokenSession,
   loadTokenSession,
   loadUserProfileFile,
   maskToken,
   normalizeCorpName,
-  normalizeTokenSession,
   resolveTokenSession,
   saveBusinessContext,
   saveTokenSession,
@@ -274,6 +273,32 @@ function isRefreshAuthRequired(value) {
 }
 
 async function tokenLogin(options = {}) {
+  const env = options.env || process.env;
+  if (isEnvTokenAuthMode(env)) {
+    const status = tokenStatus(options);
+    if (status && status.can_auto_use) {
+      return {
+        ...status,
+        ok: true,
+        status: 'ok',
+        can_auto_use: true,
+        message: 'env token bootstrap credentials are already available; OAuth login was skipped',
+      };
+    }
+    return {
+      ...status,
+      ok: false,
+      auth_mode: 'token',
+      auth_source: status && status.auth_source ? status.auth_source : 'env',
+      auth_store: status && status.auth_store ? status.auth_store : 'env',
+      status: status && status.status ? status.status : 'not_logged_in',
+      can_auto_use: false,
+      message: status && status.message
+        ? status.message
+        : 'env token bootstrap credential is missing. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.',
+    };
+  }
+
   const baseUrl = resolveTokenBaseUrl(options);
   const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
@@ -315,21 +340,21 @@ function tokenStatus(options = {}) {
   const session = resolution.session;
   if (!session || (!session.access_token && !session.refresh_token)) {
     const env = options.env || process.env;
-    const hostInjected = isHostInjectedTokenMode(env);
+    const envTokenMode = isEnvTokenAuthMode(env);
     const status = {
       ok: false,
       auth_mode: 'token',
-      auth_source: resolution.auth_source || (hostInjected ? 'env' : undefined),
+      auth_source: resolution.auth_source || (envTokenMode ? 'env' : undefined),
       auth_store: resolution.auth_store,
       auth_profile: resolution.auth_profile,
       status: resolution.status === 'profile_required' ? 'profile_required' : 'not_logged_in',
       can_auto_use: false,
-      failure_reason: hostInjected ? 'env_token_missing' : resolution.status,
-      message: resolution.message || (hostInjected
-        ? 'host-injected token is missing. Ask the host to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
+      failure_reason: envTokenMode ? 'env_token_missing' : resolution.status,
+      message: resolution.message || (envTokenMode
+        ? 'env token bootstrap credential is missing. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
         : undefined),
-      next_step: resolution.next_step || (hostInjected
-        ? 'Ask the host runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN; do not run OAuth login in host-injected token mode.'
+      next_step: resolution.next_step || (envTokenMode
+        ? 'Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN; stop until credentials are available.'
         : 'Run openyida login to add an auth profile.'),
       next_step_commands: resolution.next_step_commands,
       candidate_count: resolution.candidate_count,
@@ -338,7 +363,7 @@ function tokenStatus(options = {}) {
       persistence_scope: resolution.persistence_scope,
       warning: resolution.warning,
     };
-    if (!hostInjected) {
+    if (!envTokenMode) {
       status.token_file = require('./token-store').getTokenFilePath(options);
     }
     return status;
@@ -353,7 +378,7 @@ function tokenStatus(options = {}) {
       persistence_scope: session.persistence_scope,
       user_auth_store_writable: session.user_auth_store_writable,
       warning: session.warning,
-      status: 'refresh_required',
+      status: 'ok',
       can_auto_use: true,
       refresh_token: maskToken(session.refresh_token),
       base_url: session.base_url,
@@ -446,7 +471,7 @@ async function tokenRefresh(options = {}) {
     }
   }
   const env = options.env || process.env;
-  if (isHostInjectedTokenMode(env) && session.auth_source === 'env') {
+  if (isEnvTokenAuthMode(env) && ['env', 'project_legacy'].includes(session.auth_source)) {
     env.OPENYIDA_ACCESS_TOKEN = normalized.access_token;
     if (normalized.refresh_token) {
       env.OPENYIDA_REFRESH_TOKEN = normalized.refresh_token;
@@ -454,10 +479,10 @@ async function tokenRefresh(options = {}) {
     if (normalized.expires_at) {
       env.OPENYIDA_ACCESS_TOKEN_EXPIRES_AT = String(normalized.expires_at);
     }
-    return normalizeTokenSession({
+    return saveTokenSession({
       ...normalized,
       auth_source: 'env',
-    });
+    }, options);
   }
   return saveTokenSession(normalized, options);
 }
@@ -496,20 +521,6 @@ function toLogoutProfileSummary(session = {}) {
 }
 
 async function tokenLogout(options = {}) {
-  const env = options.env || process.env;
-  if (isHostInjectedTokenMode(env)) {
-    return {
-      ok: true,
-      auth_mode: 'token',
-      status: 'host_injected_noop',
-      can_auto_use: false,
-      auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
-      message: 'host-injected token mode does not write or delete local auth profiles',
-    };
-  }
-
   const authProfile = options.authProfile || options.profile;
   const deleteAllProfiles = options.allProfiles === true || options.all === true;
   if (deleteAllProfiles) {

package/lib/auth/token-store.js

@@ -394,6 +394,7 @@ function buildAuthProfileNextStep(status) {
 
 function getAuthProfileSelector(options = {}) {
   const env = options.env || process.env;
+  const envTokenMode = isEnvTokenAuthMode(env);
   return {
     authProfile: sanitizeProfileName(
       options.authProfile ||
@@ -401,8 +402,18 @@ function getAuthProfileSelector(options = {}) {
       env.OPENYIDA_AUTH_PROFILE ||
       ''
     ),
-    corpId: String(options.corpId || env.OPENYIDA_AUTH_CORP_ID || '').trim(),
-    userId: String(options.userId || env.OPENYIDA_AUTH_USER_ID || '').trim(),
+    corpId: String(
+      options.corpId ||
+      env.OPENYIDA_AUTH_CORP_ID ||
+      (envTokenMode ? env.OPENYIDA_TOKEN_CORP_ID : '') ||
+      ''
+    ).trim(),
+    userId: String(
+      options.userId ||
+      env.OPENYIDA_AUTH_USER_ID ||
+      (envTokenMode ? env.OPENYIDA_TOKEN_USER_ID : '') ||
+      ''
+    ).trim(),
   };
 }
 
@@ -585,13 +596,8 @@ function saveUserTokenSession(session, options = {}) {
 function saveTokenSession(session, options = {}) {
   const env = options.env || process.env;
   const normalized = normalizeTokenSession(session);
-  if (isHostInjectedTokenMode(env) && normalized.auth_source === 'env') {
-    return attachAuthStoreMetadata(normalized, {
-      auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
-      user_auth_store_writable: null,
-    });
+  if (isEnvTokenAuthMode(env) && normalized.auth_source === 'env') {
+    return saveProjectLegacyTokenSession(normalized, options);
   }
 
   try {
@@ -616,9 +622,15 @@ function saveTokenSession(session, options = {}) {
   }
 }
 
-function isHostInjectedTokenMode(env = process.env) {
-  const authEnabled = String(env.YIDA_AUTH_ENABLED || '').trim().toLowerCase();
-  return ['1', 'true', 'yes', 'on'].includes(authEnabled);
+function isEnvTokenAuthMode(env = process.env) {
+  return String(env.OPENYIDA_AUTH_MODE || '').trim().toLowerCase() === 'token';
+}
+
+function hasEnvTokenCredential(env = process.env) {
+  return !!(
+    String(env.OPENYIDA_ACCESS_TOKEN || '').trim() ||
+    String(env.OPENYIDA_REFRESH_TOKEN || '').trim()
+  );
 }
 
 function loadEnvTokenSession(env = process.env) {
@@ -773,29 +785,40 @@ function resolveTokenSession(options = {}) {
   const env = options.env || process.env;
   const selector = getAuthProfileSelector(options);
   const envSession = applyBusinessContextToEnvSession(loadEnvTokenSession(env), options);
-  if (
-    isHostInjectedTokenMode(env) &&
-    envSession &&
-    (envSession.access_token || envSession.refresh_token) &&
-    sessionMatchesSelector(envSession, selector, { allowMissingIdentity: true })
-  ) {
-    return {
-      session: attachAuthStoreMetadata(envSession, {
-        auth_source: 'env',
-        auth_store: 'host_injected',
-        persistence_scope: 'host',
-        user_auth_store_writable: null,
-      }),
-      status: 'ok',
-    };
-  }
-  if (isHostInjectedTokenMode(env)) {
+  if (isEnvTokenAuthMode(env)) {
+    const localSession = loadLocalTokenSession(options);
+    if (
+      localSession &&
+      (localSession.access_token || localSession.refresh_token) &&
+      sessionMatchesSelector(localSession, selector)
+    ) {
+      return {
+        session: localSession,
+        status: 'ok',
+      };
+    }
+    if (
+      hasEnvTokenCredential(env) &&
+      envSession &&
+      (envSession.access_token || envSession.refresh_token) &&
+      sessionMatchesSelector(envSession, selector, { allowMissingIdentity: true })
+    ) {
+      return {
+        session: attachAuthStoreMetadata(envSession, {
+          auth_source: 'env',
+          auth_store: 'env',
+          persistence_scope: 'process',
+          user_auth_store_writable: null,
+        }),
+        status: 'ok',
+      };
+    }
     return {
       session: null,
       status: 'env_token_missing',
       auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
+      auth_store: 'env',
+      persistence_scope: 'process',
       user_auth_store_writable: null,
     };
   }
@@ -807,7 +830,7 @@ function resolveTokenSession(options = {}) {
     return {
       session: attachAuthStoreMetadata(envSession, {
         auth_source: 'env',
-        auth_store: 'host_injected',
+        auth_store: 'env',
         persistence_scope: 'process',
         user_auth_store_writable: getUserAuthStoreWritable(options),
       }),
@@ -895,7 +918,7 @@ function resolveTokenSession(options = {}) {
     return {
       session: attachAuthStoreMetadata(envSession, {
         auth_source: 'env',
-        auth_store: 'host_injected',
+        auth_store: 'env',
         persistence_scope: 'process',
         user_auth_store_writable: getUserAuthStoreWritable(options),
       }),
@@ -975,7 +998,8 @@ module.exports = {
   loadEnvTokenSession,
   loadLocalTokenSession,
   saveProjectLegacyTokenSession,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
+  hasEnvTokenCredential,
   isAccessTokenUsable,
   maskToken,
   resolveEnvName,

package/lib/core/agent-capabilities.js

@@ -105,38 +105,6 @@ function compactSkillsDiagnostics(skillsDiagnostics) {
   };
 }
 
-function isTruthyEnv(value) {
-  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
-}
-
-function hasEnvTokenCredential(env = process.env) {
-  return !!(
-    String(env.OPENYIDA_ACCESS_TOKEN || '').trim() ||
-    String(env.OPENYIDA_REFRESH_TOKEN || '').trim()
-  );
-}
-
-function hasRuntimeProvisionedAccessToken(env = process.env) {
-  return isTruthyEnv(env.YIDA_AUTH_ENABLED) &&
-    !!String(env.OPENYIDA_ACCESS_TOKEN || '').trim();
-}
-
-function buildRuntimeProvisionedLoginStatus(env = process.env) {
-  return {
-    ok: true,
-    auth_mode: 'token',
-    auth_source: 'env',
-    auth_store: 'host_injected',
-    corp_id: env.OPENYIDA_TOKEN_CORP_ID,
-    corp_name: env.OPENYIDA_TOKEN_CORP_NAME,
-    user_id: env.OPENYIDA_TOKEN_USER_ID,
-    user_auth_store_writable: null,
-    persistence_scope: 'host',
-    status: 'ok',
-    can_auto_use: true,
-  };
-}
-
 function buildRuntimeSnapshot(projectRoot) {
   const detected = typeof coreUtils.detectRuntimeCapabilities === 'function'
     ? coreUtils.detectRuntimeCapabilities()
@@ -204,18 +172,12 @@ function forbiddenAliasBriefs(manifest) {
 }
 
 function buildAuthPath(login, env = process.env) {
-  const hostInjectedTokenMode = isTruthyEnv(env.YIDA_AUTH_ENABLED);
-  const envTokenPresent = hasEnvTokenCredential(env);
-  const authSource = login.auth_source || (hostInjectedTokenMode || envTokenPresent ? 'env' : 'token_session');
-  const hostTokenEnvDetected = hostInjectedTokenMode || envTokenPresent || authSource === 'env';
-  const authStore = login.auth_store || (hostTokenEnvDetected ? 'host_injected' : undefined);
-  const runtimeAuthProvisioned = hasRuntimeProvisionedAccessToken(env) &&
-    authSource === 'env' &&
-    login.status === 'ok';
+  const authSource = login.auth_source || 'token_session';
+  const envTokenSession = authSource === 'env' || login.failure_reason === 'env_token_missing';
   const authPath = {
     mode: login.auth_mode || 'token',
     source: authSource,
-    store: authStore,
+    store: login.auth_store,
     auth_profile: login.auth_profile,
     corp_id: login.corp_id,
     corp_name: login.corp_name,
@@ -227,12 +189,9 @@ function buildAuthPath(login, env = process.env) {
     next_step: login.next_step,
     next_step_commands: login.next_step_commands,
     can_auto_use: login.can_auto_use === true,
-    host_injected_token_mode: hostInjectedTokenMode,
-    host_token_env_detected: hostTokenEnvDetected,
-    env_token_present: envTokenPresent,
-    interactive_login_allowed: !hostTokenEnvDetected,
+    interactive_login_allowed: !envTokenSession,
     browser_session_auth_allowed: false,
-    auth_runtime: 'token_oauth_session',
+    auth_runtime: envTokenSession ? 'env_token_bootstrap' : 'token_oauth_session',
     cookie_auth_supported: false,
     cookie_check_required: false,
     playwright_cookie_check_required: false,
@@ -243,13 +202,10 @@ function buildAuthPath(login, env = process.env) {
       'qr_login',
       'cookie_cache',
     ],
-    missing_token_action: hostInjectedTokenMode
-      ? 'STOP_AND_REQUEST_HOST_TOKEN'
+    missing_token_action: envTokenSession
+      ? 'STOP_AND_REQUEST_ENV_TOKEN'
       : 'RUN_OPENYIDA_LOGIN_IF_USER_APPROVES',
   };
-  if (runtimeAuthProvisioned) {
-    authPath.runtime_auth_provisioned = true;
-  }
   return authPath;
 }
 
@@ -261,14 +217,14 @@ function buildInteractiveLogin(auth, runtime) {
     playwright_required: false,
   };
 
-  if (auth.host_token_env_detected) {
+  if (!auth.interactive_login_allowed) {
     return {
       mode: 'not_required',
       browser_default: 'not_required',
       browser_owner: 'none',
       recommended_command: null,
       agent_action: 'do_not_run_oauth_login',
-      reason: auth.env_token_present ? 'host_token_env_detected' : 'host_token_required',
+      reason: auth.source === 'env' ? 'env_token_bootstrap' : 'login_not_required',
       ...base,
     };
   }
@@ -306,7 +262,7 @@ function buildInteractiveLogin(auth, runtime) {
     browser_default: 'unsupported',
     browser_owner: 'none',
     recommended_command: null,
-    agent_action: 'ask_user_for_browser_or_host_token',
+    agent_action: 'ask_user_for_browser_access',
     reason: 'no_desktop_shell_or_agent_browser_detected',
     ...base,
   };
@@ -314,7 +270,7 @@ function buildInteractiveLogin(auth, runtime) {
 
 function buildBuilderPath(login, projectRoot, manifest, env = process.env, runtimeSnapshot = null) {
   const auth = buildAuthPath(login, env);
-  const canTrustSummaryPreflight = auth.can_auto_use === true || auth.host_injected_token_mode === true;
+  const canTrustSummaryPreflight = auth.can_auto_use === true;
   const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
 
   return {
@@ -352,10 +308,10 @@ function buildBuilderPath(login, projectRoot, manifest, env = process.env, runti
       skip_help_discovery_default: true,
       skip_env_noise_default: true,
       skip_login_check_only_default: canTrustSummaryPreflight,
-      skip_browser_login_default: auth.host_token_env_detected,
+      skip_browser_login_default: !auth.interactive_login_allowed,
       skip_cookie_or_playwright_checks_default: true,
       default_app_list_policy: 'skip_when_bound_app_type_unique',
-      stop_when_host_token_missing: auth.host_injected_token_mode && !auth.env_token_present,
+      stop_when_env_token_missing: auth.missing_token_action === 'STOP_AND_REQUEST_ENV_TOKEN' && !auth.can_auto_use,
     },
     command_contract: {
       command_prefix: manifest.command_prefix,
@@ -437,9 +393,6 @@ function compactBuilderPath(builderPath) {
     next_step: builderPath.auth.next_step,
     next_step_commands: builderPath.auth.next_step_commands,
     can_auto_use: builderPath.auth.can_auto_use,
-    host_injected_token_mode: builderPath.auth.host_injected_token_mode,
-    host_token_env_detected: builderPath.auth.host_token_env_detected,
-    env_token_present: builderPath.auth.env_token_present,
     interactive_login_allowed: builderPath.auth.interactive_login_allowed,
     browser_session_auth_allowed: builderPath.auth.browser_session_auth_allowed,
     auth_runtime: builderPath.auth.auth_runtime,
@@ -449,10 +402,6 @@ function compactBuilderPath(builderPath) {
     qr_login_required: builderPath.auth.qr_login_required,
     missing_token_action: builderPath.auth.missing_token_action,
   };
-  if (builderPath.auth.runtime_auth_provisioned === true) {
-    auth.runtime_auth_provisioned = true;
-  }
-
   return {
     schema_version: builderPath.schema_version,
     preflight: builderPath.preflight,
@@ -465,7 +414,7 @@ function compactBuilderPath(builderPath) {
       skip_login_check_only_default: environment.skip_login_check_only_default,
       skip_browser_login_default: environment.skip_browser_login_default,
       skip_cookie_or_playwright_checks_default: environment.skip_cookie_or_playwright_checks_default,
-      stop_when_host_token_missing: environment.stop_when_host_token_missing,
+      stop_when_env_token_missing: environment.stop_when_env_token_missing,
       default_app_list_policy: environment.default_app_list_policy,
     },
     command_contract: {
@@ -541,43 +490,6 @@ function buildCommandManifestDigest(manifest) {
 
 function buildAgentCapabilitiesSummary() {
   const manifest = buildCommandManifest({ t, version });
-
-  if (hasRuntimeProvisionedAccessToken(process.env)) {
-    const projectResolution = resolveProjectRootCompat();
-    const projectRoot = projectResolution.projectRoot;
-    const skillsDiagnostics = compactSkillsDiagnostics(buildSkillsDiagnosticsCompat(projectResolution));
-    const loginStatus = buildRuntimeProvisionedLoginStatus();
-    const runtime = buildRuntimeSnapshot(projectRoot);
-    const builderPath = compactBuilderPath(
-      buildBuilderPath(loginStatus, projectRoot, manifest, process.env, runtime)
-    );
-
-    return {
-      schema_version: 1,
-      name: 'openyida-agent-capabilities-summary',
-      version,
-      login: compactLogin(loginStatus),
-      precheck: {
-        skipped: true,
-        reason: 'runtime_auth_provisioned',
-      },
-      workdir: projectRoot,
-      workdir_exists: fs.existsSync(projectRoot),
-      workdir_source: projectResolution.source,
-      workdir_reason: projectResolution.reason,
-      project_root: compactProjectRootResolution(projectResolution),
-      cache_dir: path.join(projectRoot, '.cache'),
-      openyida_task_cache_dir: path.join(projectRoot, '.cache', 'openyida'),
-      skills: skillsDiagnostics,
-      command_manifest_digest: buildCommandManifestDigest(manifest),
-      command_manifest_digest_algorithm: 'sha256',
-      command_count: manifest.summary.command_count,
-      full_capabilities_command: 'openyida agent-capabilities --json',
-      runtime,
-      builder_path: builderPath,
-    };
-  }
-
   const envSnapshot = buildEnvironmentSnapshot();
   const projectResolution = resolveProjectRootCompat({
     projectRoot: envSnapshot.active.projectRoot,

package/lib/core/locales/en.js

@@ -306,7 +306,7 @@ Examples:
     exec_failed: '\n❌ Execution failed: {0}',
     login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
-    login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; runtime-environment injected mode only checks the injected token.',
+    login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
     auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
     auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
     org_usage: 'Usage: openyida org <list|switch> [--json] [--corp-id <corpId>]',

package/lib/core/locales/zh.js

@@ -307,7 +307,7 @@ openyida - 宜搭命令行工具
     exec_failed: '\n❌ 执行失败: {0}',
     login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
     login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
-    login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；运行环境注入模式下只检查运行环境注入的 token。',
+    login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；env token 模式下只读取 OPENYIDA_* token。',
     first_run_title: '  🤖 OpenYida - AI 问答模式已开启！                         ',
     first_run_welcome: '  {0}欢迎首次使用 OpenYida！{1} 以下是快速上手指南：',
     first_run_way1_title: '  📝 方式一：直接描述需求',

package/lib/core/query-data.js

@@ -18,6 +18,7 @@ const { CliError } = require('./cli-error');
 const { createAuthRef, createYidaClient, isAuthRefReady } = require('./yida-client');
 
 const { buildComponentAliasMaps } = require('../app/get-schema');
+const { getProcessCodeFromFormBinding } = require('../app/services/form-mode-service');
 
 const USAGE = `openyida data - Unified Yida data CLI
 
@@ -25,6 +26,7 @@ Usage:
   openyida data query form <appType> <formUuid> [--page N] [--size N] [--all] [--max-pages N] [--search-json JSON|--search-file .cache/openyida/search.json] [--resolve-aliases] [--inst-id ID] [--no-hydrate-subforms]
   openyida data get form <appType> --inst-id <formInstId> [--form-uuid <formUuid>] [--no-hydrate-subforms]
   openyida data create form <appType> <formUuid> (--data-json <JSON>|--data-file .cache/openyida/data.json) [--dept-id ID] [--resolve-aliases]
+    说明：若目标表单为流程表单，会自动使用 /v1/process/startInstance.json 发起流程。
   openyida data update form <appType> --inst-id <formInstId> (--data-json <JSON>|--data-file .cache/openyida/data.json) [--form-uuid <formUuid>] [--use-latest-version y] [--resolve-aliases]
   openyida data query subform <appType> <formUuid> --inst-id <formInstId> --table-field-id <fieldId|alias> [--page N] [--size N] [--resolve-aliases]
 
@@ -592,6 +594,15 @@ async function getForm(positionals, options, session) {
   }));
 }
 
+async function resolveProcessCode(session, appType, formUuid) {
+  try {
+    return await getProcessCodeFromFormBinding(session, appType, formUuid);
+  } catch (err) {
+    console.warn(`⚠️  无法判断表单 ${formUuid} 是否为流程表单，将使用 saveFormData 提交：${err.message}`);
+    return null;
+  }
+}
+
 async function createForm(positionals, options, session) {
   requirePositionals(positionals, 2, ['appType', 'formUuid']);
   const dataJson = requireJsonOption(options, 'data_json', 'data_file', '数据');
@@ -603,6 +614,16 @@ async function createForm(positionals, options, session) {
     formDataJson: translateJsonWithAliases(dataJson, aliasContext, translateFormDataObject),
   };
   if (options.dept_id) {params.deptId = options.dept_id;}
+
+  const processCode = await resolveProcessCode(session, appType, formUuid);
+  if (processCode) {
+    printResult(await sendPost(session, appType, `/dingtalk/web/${appType}/v1/process/startInstance.json`, {
+      ...params,
+      processCode,
+    }));
+    return;
+  }
+
   printResult(await sendPost(session, appType, `/dingtalk/web/${appType}/v1/form/saveFormData.json`, params));
 }
 

package/lib/core/utils.js

@@ -454,13 +454,9 @@ function getNodeExecutable() {
   return 'node';
 }
 
-function isInjectedAuthMode(env = process.env) {
-  const authEnabled = String(env.YIDA_AUTH_ENABLED || '').trim().toLowerCase();
-  return ['1', 'true', 'yes', 'on'].includes(authEnabled);
-}
-
 function isEnvAuthMode(env = process.env) {
-  return isInjectedAuthMode(env);
+  const { isEnvTokenAuthMode } = require('../auth/token-store');
+  return isEnvTokenAuthMode(env);
 }
 
 function isTokenAuthMode(_env = process.env) {
@@ -942,7 +938,7 @@ function loadCookieData(projectRoot, defaultBaseUrl) {
 
 /**
  * 读取当前默认登录态。
- * 默认使用 OAuth token session；YIDA_AUTH_ENABLED=true 时仅使用运行环境注入 token。
+ * 默认使用 OAuth token session；env token mode 时仅使用项目缓存或运行环境注入 token。
  * @param {string} [projectRoot]
  * @param {string} [defaultBaseUrl]
  * @returns {object|null}
@@ -961,7 +957,7 @@ function getAuthStatus(options = {}) {
 // ── 登录触发 ──────────────────────────────────────────
 
 /**
- * 校验默认登录态；host mode 下不会触发 OAuth，本地模式提示用户执行 openyida login。
+ * 校验默认登录态；env token mode 下不会触发 OAuth，本地模式提示用户执行 openyida login。
  * @param {object} [options]
  * @param {boolean} [options.force=false] - 是否跳过本地缓存，强制重新登录
  * @returns {object} loginResult
@@ -977,11 +973,12 @@ function triggerLogin(options = {}) {
       : 'env_token_missing';
     const { CliError } = require('./cli-error');
     throw new CliError(
-      `not_logged_in: host-injected token is unavailable (${reason}). Ask the host to inject an OpenYida token.`,
+      `not_logged_in: env token bootstrap is unavailable (${reason}). Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.`,
       {
-        code: 'INJECTED_AUTH_REQUIRED',
+        code: 'ENV_TOKEN_AUTH_REQUIRED',
         details: {
           authMode: 'token',
+          authSource: 'env',
           failure_reason: reason,
         },
       }
@@ -1462,6 +1459,14 @@ function normalizeRefreshedTokenAuthData(refreshResult, fallbackBaseUrl) {
 }
 
 function tokenAuthRequiredResult() {
+  if (isEnvAuthMode()) {
+    return {
+      success: false,
+      __needLogin: true,
+      errorCode: 'TOKEN_AUTH_REQUIRED',
+      errorMsg: 'not_logged_in: env token bootstrap is unavailable. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.',
+    };
+  }
   return {
     success: false,
     __needLogin: true,
@@ -1502,7 +1507,6 @@ module.exports = {
   getNpmExecutable,
   getNodeExecutable,
   resolveWukongWorkspaceRoot,
-  isInjectedAuthMode,
   isEnvAuthMode,
   isTokenAuthMode,
 };

package/lib/permission/matrix-service.js

@@ -0,0 +1,56 @@
+/**
+ * matrix-service.js - 宜搭权限矩阵查询服务
+ *
+ * 提供权限矩阵列表查询与单个矩阵详情查询，供 save-permission 等命令使用。
+ */
+'use strict';
+
+const { createAuthRef, createYidaClient } = require('../core/yida-client');
+
+/**
+ * 查询权限矩阵列表
+ *
+ * @param {object} authRef - 认证引用对象
+ * @param {object} options - 查询选项
+ * @param {string} [options.keyword] - 搜索关键词
+ * @param {number} [options.page=1] - 页码
+ * @param {number} [options.limit=10] - 每页条数
+ * @returns {Promise<Array>} 权限矩阵列表
+ */
+async function getMatrixList(authRef, options = {}) {
+  const ref = authRef || createAuthRef();
+  const { keyword = '', page = 1, limit = 10 } = options;
+  const client = createYidaClient({ authRef: ref });
+  const result = await client.getContent('/query/matrix/getMatrixList.json', {
+    keyword,
+    page,
+    limit,
+  }, {
+    action: 'getMatrixList',
+    failMessage: '获取权限矩阵列表失败',
+  });
+  return (result && result.data) || [];
+}
+
+/**
+ * 根据 ID 查询单个权限矩阵详情
+ *
+ * @param {object} authRef - 认证引用对象
+ * @param {string} matrixId - 权限矩阵 ID
+ * @returns {Promise<object>} 权限矩阵详情
+ */
+async function getMatrixById(authRef, matrixId) {
+  const ref = authRef || createAuthRef();
+  const client = createYidaClient({ authRef: ref });
+  return client.getContent('/query/matrix/getMatrixById.json', {
+    matrixId,
+  }, {
+    action: 'getMatrixById',
+    failMessage: `获取权限矩阵 ${matrixId} 详情失败`,
+  });
+}
+
+module.exports = {
+  getMatrixList,
+  getMatrixById,
+};

package/lib/permission/save-permission.js

@@ -6,6 +6,7 @@
  *   openyida save-permission <appType> <formUuid> --action-permission <json>
  *   openyida save-permission <appType> <formUuid> --field-permission <json>
  *   openyida save-permission <appType> <formUuid> --members <userIds> --data-permission <json>
+ *   openyida save-permission <appType> <formUuid> --matrix <json> --data-permission <json>
  *
  * 用法（新增权限组）：
  *   openyida save-permission <appType> <formUuid> --create --name <权限组名称> [--members <userIds>] [--data-permission <json>] [--action-permission <json>] [--field-permission <json>]
@@ -13,6 +14,9 @@
  * --members 参数：指定权限组成员，多个钉钉 userId 用逗号分隔
  *   示例：--members "54255850977641,12345678901234"
  *   不传则保持原有成员配置不变（更新模式）或仅包含管理员（新增模式）
+ * --all-members 参数：新增/更新权限组时设置为「全员可见」（roleType=DEFAULT, roleValue=ALL）
+ * --matrix 参数：使用权限矩阵作为权限成员，JSON 格式 {"matrixId":"MATRIX-XXX","columnId":"column_YYY"}
+ *   与 --members / --all-members 互斥
  *
  * 注意：--field-permission 透传宜搭 fieldPermit 原始 JSON，使用前建议先通过 get-permission 查看现有结构。
  */
@@ -39,6 +43,7 @@ const DATA_RANGE_TO_PERMIT_TYPE = {
   FREE_LOGIN: 'FREE_LOGIN',
   CUSTOM_DEPARTMENT: 'CUSTOM_DEPARTMENT',
   FORMULA: 'FORMULA',
+  MATRIX: 'MATRIX',
 };
 
 // 所有支持的操作权限 key
@@ -62,9 +67,11 @@ const VALID_OPERATE_KEYS = [
 function parseArgs(args) {
   if (args.length < 2) {
     throw new CliError([
-      '用法: openyida save-permission <appType> <formUuid> [--create --name <名称>] [--data-permission <json>] [--action-permission <json>] [--field-permission <json>] [--members <userIds>]',
+      '用法: openyida save-permission <appType> <formUuid> [--create --name <名称>] [--data-permission <json>] [--action-permission <json>] [--field-permission <json>] [--members <userIds>] [--all-members] [--matrix <json>]',
       '示例（更新）: openyida save-permission APP_XXX FORM-XXX --data-permission \'{"role":"DEFAULT","dataRange":"SELF"}\'',
-      '示例（新增）: openyida save-permission APP_XXX FORM-XXX --create --name "只读权限组" --members "54255850977641"',
+      '示例（新增全员）: openyida save-permission APP_XXX FORM-XXX --create --name "全部人员看全部数据" --all-members --data-permission \'{"dataRange":"ALL"}\'',
+      '示例（新增指定人员）: openyida save-permission APP_XXX FORM-XXX --create --name "只读权限组" --members "54255850977641"',
+      '示例（新增矩阵）: openyida save-permission APP_XXX FORM-XXX --create --name "矩阵权限组" --matrix \'{"matrixId":"MATRIX-XXX","columnId":"column_YYY"}\' --data-permission \'{"rule":[{"type":"ORIGINATOR","value":"y"},{"type":"MATRIX","value":"y"}]}\'',
     ].join('\n'), {
       code: 'SAVE_PERMISSION_INVALID_ARGUMENTS',
     });
@@ -76,6 +83,8 @@ function parseArgs(args) {
   let actionPermission = null;
   let fieldPermission = null;
   let members = null;
+  let allMembers = false;
+  let matrix = null;
   let createMode = false;
   let groupName = null;
 
@@ -116,6 +125,17 @@ function parseArgs(args) {
       // 多个钉钉 userId 用逗号分隔，如 "54255850977641,12345678901234"
       members = args[index + 1].split(',').map((id) => id.trim()).filter(Boolean);
       index++;
+    } else if (args[index] === '--all-members') {
+      allMembers = true;
+    } else if (args[index] === '--matrix' && args[index + 1]) {
+      try {
+        matrix = JSON.parse(args[index + 1]);
+      } catch {
+        throw new CliError(`--matrix 参数 JSON 解析失败: ${args[index + 1]}，格式: {"matrixId":"MATRIX-XXX","columnId":"column_YYY"}`, {
+          code: 'SAVE_PERMISSION_INVALID_ARGUMENTS',
+        });
+      }
+      index++;
     }
   }
 
@@ -125,16 +145,39 @@ function parseArgs(args) {
     });
   }
 
-  if (!createMode && !dataPermission && !actionPermission && !fieldPermission && !members) {
-    throw new CliError('请至少提供 --data-permission、--action-permission、--field-permission 或 --members 参数之一', {
+  if (!createMode && !dataPermission && !actionPermission && !fieldPermission && !members && !matrix) {
+    throw new CliError('请至少提供 --data-permission、--action-permission、--field-permission、--members 或 --matrix 参数之一', {
       code: 'SAVE_PERMISSION_INVALID_ARGUMENTS',
     });
   }
 
-  return { appType, formUuid, dataPermission, actionPermission, fieldPermission, members, createMode, groupName };
+  return { appType, formUuid, dataPermission, actionPermission, fieldPermission, members, allMembers, matrix, createMode, groupName };
+}
+
+function buildDataPermit(dataPermission) {
+  if (dataPermission && Array.isArray(dataPermission.rule)) {
+    return JSON.stringify(dataPermission);
+  }
+  const dataRange = (dataPermission && dataPermission.dataRange) || 'ALL';
+  const permitType = DATA_RANGE_TO_PERMIT_TYPE[dataRange] || dataRange;
+  return JSON.stringify({ rule: [{ type: permitType, value: 'y' }] });
 }
 
 function validateDataPermission(dataPermission) {
+  if (dataPermission && Array.isArray(dataPermission.rule)) {
+    const validTypes = new Set([
+      ...Object.keys(DATA_RANGE_TO_PERMIT_TYPE),
+      ...Object.values(DATA_RANGE_TO_PERMIT_TYPE),
+    ]);
+    for (const item of dataPermission.rule) {
+      if (item.type && !validTypes.has(item.type)) {
+        throw new Error(
+          `无效的 rule type: ${item.type}，有效值: ${Array.from(validTypes).join(', ')}`
+        );
+      }
+    }
+    return;
+  }
   const validRanges = Object.keys(DATA_RANGE_TO_PERMIT_TYPE);
   if (dataPermission.dataRange && !validRanges.includes(dataPermission.dataRange)) {
     throw new Error(
@@ -143,6 +186,18 @@ function validateDataPermission(dataPermission) {
   }
 }
 
+function validateMatrix(matrix) {
+  if (!matrix || typeof matrix !== 'object') {
+    throw new Error('--matrix 参数必须是 JSON 对象');
+  }
+  if (!matrix.matrixId || typeof matrix.matrixId !== 'string') {
+    throw new Error('--matrix 参数必须包含 matrixId 字符串');
+  }
+  if (!matrix.columnId || typeof matrix.columnId !== 'string') {
+    throw new Error('--matrix 参数必须包含 columnId 字符串');
+  }
+}
+
 function validateActionPermission(actionPermission) {
   if (!actionPermission.operations || typeof actionPermission.operations !== 'object') {
     throw new Error(
@@ -280,7 +335,7 @@ function savePermitPackage(appType, formUuid, permitPackage, overrideMembers, au
 }
 
 async function run(args) {
-  const { appType, formUuid, dataPermission, actionPermission, fieldPermission, members, createMode, groupName } = parseArgs(args);
+  const { appType, formUuid, dataPermission, actionPermission, fieldPermission, members, allMembers, matrix, createMode, groupName } = parseArgs(args);
 
   warn(SEP);
   warn('  save-permission - 宜搭表单权限配置保存');
@@ -296,10 +351,17 @@ async function run(args) {
   // Step 0: 参数校验
   warn('\n📋 Step 0: 验证参数');
   try {
+    if (matrix && (members || allMembers)) {
+      throw new Error('--matrix 与 --members / --all-members 互斥，请勿同时指定');
+    }
     if (dataPermission) {
       validateDataPermission(dataPermission);
       warn(`  ✅ 数据权限验证通过（dataRange: ${dataPermission.dataRange || 'ALL'}）`);
     }
+    if (matrix) {
+      validateMatrix(matrix);
+      warn(`  ✅ 权限矩阵验证通过（matrixId: ${matrix.matrixId}, columnId: ${matrix.columnId}）`);
+    }
     if (actionPermission) {
       validateActionPermission(actionPermission);
       warn('  ✅ 操作权限验证通过');
@@ -335,6 +397,7 @@ async function run(args) {
     // 构建新权限组数据
     const dataRange = (dataPermission && dataPermission.dataRange) || 'ALL';
     const permitType = DATA_RANGE_TO_PERMIT_TYPE[dataRange] || dataRange;
+    const dataPermitStr = buildDataPermit(dataPermission);
 
     const newOperatePermit = {};
     if (actionPermission) {
@@ -346,10 +409,19 @@ async function run(args) {
       newOperatePermit['OPERATE_VIEW'] = 'y';
     }
 
-    // 构建 roleData：默认包含管理员，如果指定了 members 则追加 PERSONS 条目
-    const roleInclude = [{ roleType: 'MANAGER', roleValue: 'appMainAdminRole,corpAdminRole' }];
-    if (members && members.length > 0) {
-      roleInclude.push({ roleType: 'PERSONS', roleValue: members.join(',') });
+    // 构建 roleData：--matrix / --all-members / --members / 默认管理员 四选一
+    let roleInclude;
+    if (matrix) {
+      roleInclude = [{ roleType: 'MATRIX', roleValue: [{ matrixId: matrix.matrixId, columnId: matrix.columnId }] }];
+    } else if (allMembers) {
+      roleInclude = [{ roleType: 'DEFAULT', roleValue: 'ALL' }];
+    } else if (members && members.length > 0) {
+      roleInclude = [
+        { roleType: 'MANAGER', roleValue: 'appMainAdminRole,corpAdminRole' },
+        { roleType: 'PERSONS', roleValue: members.join(',') },
+      ];
+    } else {
+      roleInclude = [{ roleType: 'MANAGER', roleValue: 'appMainAdminRole,corpAdminRole' }];
     }
 
     const newPkg = {
@@ -357,7 +429,7 @@ async function run(args) {
       packageName: { zh_CN: groupName, en_US: groupName, type: 'i18n' },
       description: { zh_CN: groupName, en_US: groupName, type: 'i18n' },
       roleData: JSON.stringify({ include: roleInclude }),
-      dataPermit: JSON.stringify({ rule: [{ type: permitType, value: 'y' }] }),
+      dataPermit: dataPermitStr,
       operatePermit: JSON.stringify(newOperatePermit),
       customButtonPermit: '[]',
       fieldPermit: JSON.stringify(normalizedFieldPermission || { fieldRange: 'FORM' }),
@@ -366,10 +438,18 @@ async function run(args) {
     };
 
     warn(`  → 权限组名称: ${groupName}`);
-    warn(`  → 数据范围: ${dataRange} → ${permitType}`);
+    if (dataPermission && Array.isArray(dataPermission.rule)) {
+      warn(`  → 数据范围: 自定义规则（${dataPermission.rule.length} 条）`);
+    } else {
+      warn(`  → 数据范围: ${dataRange} → ${permitType}`);
+    }
     warn(`  → 操作权限: ${Object.keys(newOperatePermit).join(', ') || '（无）'}`);
     if (normalizedFieldPermission) {warn('  → 字段权限: 自定义 fieldPermit');}
-    if (members) {warn(`  → 成员: ${members.join(', ')}`);}
+    if (matrix) {
+      warn(`  → 权限矩阵: ${matrix.matrixId} / ${matrix.columnId}`);
+    } else if (members) {
+      warn(`  → 成员: ${members.join(', ')}`);
+    }
 
     const createResult = await savePermitPackage(appType, formUuid, newPkg, null, authRef);
 
@@ -378,15 +458,28 @@ async function run(args) {
       const newPackageUuid = createResult.content || '';
       warn('  ✅ 权限组新增成功！');
       warn(SEP);
+      const dataPermissionSummary = (dataPermission && Array.isArray(dataPermission.rule))
+        ? `数据范围: 自定义规则（${dataPermission.rule.length} 条）`
+        : `数据范围: ${dataRange}`;
+      let membersSummary;
+      if (matrix) {
+        membersSummary = `权限矩阵: ${matrix.matrixId} / ${matrix.columnId}`;
+      } else if (allMembers) {
+        membersSummary = '成员: 全员';
+      } else if (members) {
+        membersSummary = `成员: ${members.join(', ')}`;
+      } else {
+        membersSummary = '仅管理员';
+      }
       console.log(JSON.stringify({
         success: true,
         packageUuid: newPackageUuid,
         summary: {
           name: groupName,
-          dataPermission: `数据范围: ${dataRange}`,
+          dataPermission: dataPermissionSummary,
           actionPermission: `操作权限: ${Object.keys(newOperatePermit).join(', ') || '（无）'}`,
           fieldPermission: normalizedFieldPermission ? '自定义 fieldPermit' : '全部字段',
-          members: members ? `成员: ${members.join(', ')}` : '仅管理员',
+          members: membersSummary,
         },
         message: '权限组已新增',
       }, null, 2));
@@ -424,7 +517,10 @@ async function run(args) {
   warn(`  ✅ 获取到 ${packages.length} 个权限组`);
 
   // 根据 role 筛选要更新的权限组
-  const targetRole = (dataPermission || actionPermission || fieldPermission || {}).role || 'DEFAULT';
+  let targetRole = (dataPermission || actionPermission || fieldPermission || {}).role || 'DEFAULT';
+  if (matrix) {
+    targetRole = 'MATRIX';
+  }
   const packagesToUpdate = packages.filter((pkg) => {
     if (targetRole === 'DEFAULT') {
       return pkg.roleMembers && pkg.roleMembers.some((rm) => rm.roleType === 'DEFAULT');
@@ -432,6 +528,9 @@ async function run(args) {
     if (targetRole === 'MANAGER') {
       return pkg.roleMembers && pkg.roleMembers.some((rm) => rm.roleType === 'MANAGER');
     }
+    if (targetRole === 'MATRIX') {
+      return pkg.roleMembers && pkg.roleMembers.some((rm) => rm.roleType === 'MATRIX');
+    }
     return true;
   });
 
@@ -447,8 +546,12 @@ async function run(args) {
   let permitType = null;
   const stepParts = [];
   if (dataPermission) {
-    permitType = DATA_RANGE_TO_PERMIT_TYPE[dataPermission.dataRange] || dataPermission.dataRange;
-    stepParts.push(`数据权限: ${dataPermission.dataRange} → ${permitType}`);
+    if (Array.isArray(dataPermission.rule)) {
+      stepParts.push(`数据权限: 自定义规则（${dataPermission.rule.length} 条）`);
+    } else {
+      permitType = DATA_RANGE_TO_PERMIT_TYPE[dataPermission.dataRange] || dataPermission.dataRange;
+      stepParts.push(`数据权限: ${dataPermission.dataRange} → ${permitType}`);
+    }
   }
   if (actionPermission) {
     stepParts.push('操作权限: 同步更新');
@@ -456,6 +559,9 @@ async function run(args) {
   if (normalizedFieldPermission) {
     stepParts.push('字段权限: 同步更新');
   }
+  if (matrix) {
+    stepParts.push(`权限矩阵: ${matrix.matrixId} / ${matrix.columnId}`);
+  }
   if (members) {
     stepParts.push(`成员: ${members.join(', ')}`);
   }
@@ -469,7 +575,7 @@ async function run(args) {
     const updatedPkg = { ...pkg };
 
     if (dataPermission) {
-      updatedPkg.dataPermit = JSON.stringify({ rule: [{ type: permitType, value: 'y' }] });
+      updatedPkg.dataPermit = buildDataPermit(dataPermission);
     }
 
     if (actionPermission) {
@@ -487,6 +593,18 @@ async function run(args) {
       updatedPkg.fieldPermit = JSON.stringify(normalizedFieldPermission);
     }
 
+    // --all-members 时强制将权限组改为全员可见
+    if (allMembers) {
+      updatedPkg.roleData = JSON.stringify({ include: [{ roleType: 'DEFAULT', roleValue: 'ALL' }] });
+    }
+
+    // --matrix 时强制将权限组改为权限矩阵
+    if (matrix) {
+      updatedPkg.roleData = JSON.stringify({
+        include: [{ roleType: 'MATRIX', roleValue: [{ matrixId: matrix.matrixId, columnId: matrix.columnId }] }],
+      });
+    }
+
     // members 参数传给 savePermitPackage，null 表示不修改成员
     const overrideMembers = members || null;
 
@@ -524,7 +642,9 @@ module.exports = {
   parseArgs,
   validateDataPermission,
   validateActionPermission,
+  validateMatrix,
   normalizeFieldPermission,
+  buildDataPermit,
   fetchPermitPackages,
   buildRoleData,
   savePermitPackage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.8.19",
+  "version": "2026.8.20",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/yida-skills/skills/yida-data-management/SKILL.md

@@ -110,6 +110,7 @@ openyida data query form <appType> <formUuid> [--page 1 --size 20] [--search-jso
 openyida data get form <appType> --inst-id <formInstId>
 openyida data create form <appType> <formUuid> --data-json '<json>' [--resolve-aliases]
 openyida data create form <appType> <formUuid> --data-file .cache/openyida/<项目名或任务名>/data-import/record.json [--resolve-aliases]
+> `create form` 会自动探测表单类型；当目标表单为流程表单时，会改用 `/v1/process/startInstance.json` 发起流程。若已知 `processCode`，仍推荐显式使用 `create process`。
 openyida data update form <appType> --inst-id <formInstId> --form-uuid <formUuid> --data-json '<json>' [--resolve-aliases]
 openyida data update form <appType> --inst-id <formInstId> --form-uuid <formUuid> --data-file .cache/openyida/<项目名或任务名>/data-import/patch.json [--resolve-aliases]
 openyida data query subform <appType> <formUuid> --inst-id <formInstId> --table-field-id <fieldId|alias> [--page 1 --size 100] [--resolve-aliases]

package/yida-skills/skills/yida-form-permission/SKILL.md

@@ -55,6 +55,8 @@ openyida save-permission <appType> <formUuid> [选项]
 | `--action-permission <json>` | 修改操作权限（完全替换，只保留 true 的项） |
 | `--field-permission <json>` | 修改字段权限，传入宜搭 `fieldPermit` 对象或 `{ "role": "DEFAULT", "fieldPermit": {...} }` |
 | `--members <userIds>` | 修改成员，多个 userId 逗号分隔 |
+| `--all-members` | 设置权限组为「全员可见」（`roleData.include` 为 `DEFAULT/ALL`） |
+| `--matrix <json>` | 使用权限矩阵作为权限成员，JSON 格式 `{"matrixId":"MATRIX-XXX","columnId":"column_YYY"}`，与 `--members` / `--all-members` 互斥 |
 
 ### 数据权限 `dataRange` 可选值
 
@@ -65,6 +67,42 @@ openyida save-permission <appType> <formUuid> [选项]
 | `DEPARTMENT` / `ORIGINATOR_DEPARTMENT` | 本部门提交 |
 | `SAME_LEVEL_DEPARTMENT` | 同级部门 |
 | `SUBORDINATE_DEPARTMENT` | 下级部门 |
+| `MATRIX` | 权限矩阵条件 |
+
+> 如需同时设置多个数据范围、自定义部门或自定义过滤条件，可直接传入宜搭完整的 `dataPermit` JSON（必须包含 `rule` 数组）。例如截图中的「本人提交 + 本部门 + 同级部门 + 下级部门 + 免登 + 自定义部门 + 自定义过滤条件」可表示为：
+>
+> ```json
+> {
+>   "rule": [
+>     { "type": "ORIGINATOR", "value": "y" },
+>     { "type": "ORIGINATOR_DEPARTMENT", "value": "y" },
+>     { "type": "SAME_LEVEL_DEPARTMENT", "value": "y" },
+>     { "type": "SUBORDINATE_DEPARTMENT", "value": "y" },
+>     { "type": "FREE_LOGIN", "value": "y" },
+>     { "type": "CUSTOM_DEPARTMENT", "value": "y" },
+>     { "type": "FORMULA", "value": "y" }
+>   ],
+>   "customDepartmentData": {
+>     "departmentIds": ["637215248"],
+>     "drillDown": "n"
+>   },
+>   "formulaData": {
+>     "condition": "OR",
+>     "ruleId": "group-xxx",
+>     "rules": []
+>   }
+> }
+> ```
+>
+> 命令示例：
+>
+> ```bash
+> openyida save-permission APP_XXX FORM_XXX \
+>   --create --name "全部成员可查看本人提交数据" \
+>   --all-members \
+>   --data-permission '{"rule":[{"type":"ORIGINATOR","value":"y"},{"type":"ORIGINATOR_DEPARTMENT","value":"y"},{"type":"SAME_LEVEL_DEPARTMENT","value":"y"},{"type":"SUBORDINATE_DEPARTMENT","value":"y"},{"type":"FREE_LOGIN","value":"y"},{"type":"CUSTOM_DEPARTMENT","value":"y"},{"type":"FORMULA","value":"y"}],"customDepartmentData":{"departmentIds":["637215248"],"drillDown":"n"},"formulaData":{"condition":"OR","ruleId":"group-xxx","rules":[]}}' \
+>   --action-permission '{"operations":{"OPERATE_VIEW":true,"OPERATE_EDIT":true,"OPERATE_DELETE":true,"OPERATE_HISTORY":true,"OPERATE_COMMENT":true,"OPERATE_PRINT":true}}'
+> ```
 
 ### 操作权限 key
 
@@ -79,7 +117,7 @@ openyida save-permission <appType> <formUuid> --create --name <名称> [选项]
 示例：
 
 ```bash
-openyida save-permission APP_XXX FORM-XXX \
+openyida save-permission APP_XXX FORM_XXX \
   --create --name "部门数据查看组" \
   --members "54255850977641" \
   --data-permission '{"dataRange":"ORIGINATOR_DEPARTMENT"}' \
@@ -87,6 +125,30 @@ openyida save-permission APP_XXX FORM-XXX \
   --field-permission '{"fieldRange":"FORM"}'
 ```
 
+> 设置「全部人员看全部数据」时，必须加上 `--all-members`，确保 `roleData.include` 为 `DEFAULT/ALL`：
+>
+> ```bash
+> openyida save-permission APP_XXX FORM_XXX \
+>   --create --name "全部人员看全部数据" \
+>   --all-members \
+>   --data-permission '{"dataRange":"ALL"}' \
+>   --action-permission '{"operations":{"OPERATE_VIEW":true}}'
+> ```
+>
+> 若目标表单已存在 DEFAULT 权限组，也可直接用 `--all-members --data-permission '{"dataRange":"ALL"}'` 更新该组。
+>
+> ### 使用权限矩阵
+> 1. 先在宜搭后台「权限矩阵」中获取目标矩阵 ID 与结果列 columnId；或调用底层服务 `/query/matrix/getMatrixList.json` / `/query/matrix/getMatrixById.json` 查询。
+> 2. 创建/更新权限组时指定 `--matrix '{"matrixId":"MATRIX-XXX","columnId":"column_YYY"}'`，并配合 `--data-permission` 设置包含 `MATRIX` 的数据范围。
+>
+> ```bash
+> openyida save-permission APP_XXX FORM_XXX \
+>   --create --name "使用权限矩阵的权限组" \
+>   --matrix '{"matrixId":"MATRIX-XNCVJYB60YW7L0HPY9HE","columnId":"column_1767839664612"}' \
+>   --data-permission '{"rule":[{"type":"ORIGINATOR","value":"y"},{"type":"MATRIX","value":"y"}]}' \
+>   --action-permission '{"operations":{"OPERATE_VIEW":true,"OPERATE_EDIT":true,"OPERATE_DELETE":true,"OPERATE_HISTORY":true,"OPERATE_COMMENT":true,"OPERATE_PRINT":true}}'
+> ```
+
 ## 字段权限
 
 - 默认结构通常是 `{ "fieldRange": "FORM" }`，表示继承表单设计中组件状态。