openyida 2026.8.19 → 2026.8.25

package/bin/yida.js

@@ -670,15 +670,13 @@ async function main() {
 
     case 'login': {
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { getAuthStatus } = require('../lib/core/utils');
       if (hasHelpFlag(loginArgs)) {
         printLoginHelp();
       } else {
         assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
         if (loginArgs.includes('--check-only')) {
           console.log(JSON.stringify(getAuthStatus(buildTokenLoginOptions(loginArgs)), null, 2));
-        } else if (isEnvAuthMode()) {
-          printLoginResult(getAuthStatus(buildTokenLoginOptions(loginArgs)));
         } else {
           const { tokenLogin } = require('../lib/auth/token-auth');
           const result = await tokenLogin(buildTokenLoginOptions(loginArgs));
@@ -697,7 +695,7 @@ async function main() {
     case 'auth': {
       const subCommand = args[0];
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
       if (!subCommand || subCommand === '--help' || subCommand === '-h') {
         printAuthHelp();
@@ -720,9 +718,7 @@ async function main() {
           printLoginHelp();
         } else {
           assertNoUnsupportedLegacyLoginFlags(rawArgs.slice(1), authArgs);
-          const result = isEnvAuthMode()
-            ? getAuthStatus(buildTokenLoginOptions(authArgs))
-            : await tokenLogin(buildTokenLoginOptions(authArgs));
+          const result = await tokenLogin(buildTokenLoginOptions(authArgs));
           printLoginResult(result);
         }
       } else if (subCommand === 'refresh') {

package/lib/app-permission/app-permission.js

@@ -2,6 +2,7 @@
 
 const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
 const { searchUsers } = require('../corp-manager/api');
 
 const ROLE_CONFIGS = {
@@ -140,6 +141,12 @@ function unique(values) {
   return [...new Set((values || []).map(value => String(value).trim()).filter(Boolean))];
 }
 
+function sameUserIds(left, right) {
+  const leftIds = unique(left).sort();
+  const rightIds = unique(right).sort();
+  return JSON.stringify(leftIds) === JSON.stringify(rightIds);
+}
+
 function toPositiveInt(value, defaultValue) {
   const parsed = Number.parseInt(value || `${defaultValue}`, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
@@ -310,11 +317,7 @@ async function updateRoleManagers(options = {}, authRef = getAuthRef()) {
   const action = options.action || 'set';
   const inputUserIds = unique(options.userIds || options.users || []);
 
-  if (action === 'set') {
-    return saveRoleManagers({ appType, roleType, userIds: inputUserIds }, authRef);
-  }
-
-  if (inputUserIds.length === 0) {
+  if (action !== 'set' && inputUserIds.length === 0) {
     throw new Error(`${action} 操作必须提供 --users`);
   }
 
@@ -323,7 +326,9 @@ async function updateRoleManagers(options = {}, authRef = getAuthRef()) {
   const previousUserIds = current.roles[roleKey].userIds;
   let nextUserIds;
 
-  if (action === 'add') {
+  if (action === 'set') {
+    nextUserIds = inputUserIds;
+  } else if (action === 'add') {
     nextUserIds = unique(previousUserIds.concat(inputUserIds));
   } else if (action === 'remove') {
     const removeSet = new Set(inputUserIds);
@@ -387,9 +392,22 @@ async function runUpdate(action, positionals, options) {
   });
   const current = await getAppPermission(appType);
   const roleKey = ROLE_CONFIGS[saved.roleType].key;
+  if (!sameUserIds(saved.userIds, current.roles[roleKey].userIds)) {
+    throw new CliError(t('app_permission.verify_failed'), {
+      code: 'APP_PERMISSION_VERIFY_FAILED',
+      details: {
+        expected: saved.userIds,
+        actual: current.roles[roleKey].userIds,
+      },
+    });
+  }
 
   printJson({
     ...saved,
+    before: {
+      userIds: saved.previousUserIds,
+    },
+    after: current.roles[roleKey],
     currentRole: current.roles[roleKey],
   });
 }
@@ -420,6 +438,7 @@ module.exports = {
   USAGE,
   parseCliOptions,
   splitList,
+  sameUserIds,
   normalizeRole,
   normalizeText,
   normalizeMember,

package/lib/auth/org.js

@@ -13,7 +13,7 @@ const {
   loadTokenSession,
   normalizeCorpName,
   resolveTokenSession,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   saveAuthProfilePointer,
   saveProjectLegacyTokenSession,
   saveTokenSession,
@@ -70,15 +70,15 @@ function createProfileRequiredError(targetCorpId, resolution = {}) {
   return error;
 }
 
-function createHostInjectedSwitchError(targetCorpId, currentSession, resolution = {}) {
+function createEnvTokenSwitchError(targetCorpId, currentSession, resolution = {}) {
   const actualCorpId = currentSession && currentSession.corp_id;
-  const error = new Error(`当前为宿主注入登录态，不能通过 OAuth 切换组织：target=${targetCorpId}, actual=${actualCorpId || 'unknown'}`);
-  error.code = 'ORG_SWITCH_HOST_INJECTED_MISMATCH';
-  error.status = 'host_injected_token_mismatch';
+  const error = new Error(`当前为 env token 登录态，不能通过 OAuth 切换组织：target=${targetCorpId}, actual=${actualCorpId || 'unknown'}`);
+  error.code = 'ORG_SWITCH_ENV_TOKEN_MISMATCH';
+  error.status = 'env_token_mismatch';
   error.targetCorpId = targetCorpId;
   error.actualCorpId = actualCorpId;
   error.auth_source = resolution.auth_source || (currentSession && currentSession.auth_source) || 'env';
-  error.auth_store = resolution.auth_store || (currentSession && currentSession.auth_store) || 'host_injected';
+  error.auth_store = resolution.auth_store || (currentSession && currentSession.auth_store) || 'env';
   error.can_auto_use = false;
   return error;
 }
@@ -220,8 +220,8 @@ async function switchOrganization(targetCorpId, options = {}) {
   if (targetResolution.status === 'profile_required') {
     throw createProfileRequiredError(targetCorpId, targetResolution);
   }
-  if (isHostInjectedTokenMode(projectOptions.env)) {
-    throw createHostInjectedSwitchError(targetCorpId, currentSession, targetResolution);
+  if (isEnvTokenAuthMode(projectOptions.env)) {
+    throw createEnvTokenSwitchError(targetCorpId, currentSession, targetResolution);
   }
 
   const loginOptions = {

package/lib/auth/profile.js

@@ -2,7 +2,7 @@
 
 const { CliError } = require('../core/cli-error');
 const {
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   listUserAuthProfiles,
   loadAuthProfilePointer,
   loadTokenSession,
@@ -129,14 +129,14 @@ function resolveSwitchTarget(target, options = {}) {
 }
 
 function switchAuthProfile(target, options = {}) {
-  if (isHostInjectedTokenMode(options.env || process.env)) {
+  if (isEnvTokenAuthMode(options.env || process.env)) {
     throw new CliError(
-      'host-injected token mode cannot switch local auth profiles',
+      'env token mode cannot switch local auth profiles',
       {
-        code: 'AUTH_PROFILE_SWITCH_HOST_INJECTED',
+        code: 'AUTH_PROFILE_SWITCH_ENV_TOKEN',
         details: {
-          nextStep: 'Ask the host runtime to inject the target organization token instead of switching local profiles.',
-          next_step: 'Ask the host runtime to inject the target organization token instead of switching local profiles.',
+          nextStep: 'Ask the runtime to inject the target organization token instead of switching local profiles.',
+          next_step: 'Ask the runtime to inject the target organization token instead of switching local profiles.',
         },
       }
     );

package/lib/auth/token-auth.js

@@ -15,14 +15,13 @@ const {
   clearAllUserAuthProfiles,
   clearTokenSession,
   deleteUserAuthProfile,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   listUserAuthProfiles,
   loadLocalTokenSession,
   loadTokenSession,
   loadUserProfileFile,
   maskToken,
   normalizeCorpName,
-  normalizeTokenSession,
   resolveTokenSession,
   saveBusinessContext,
   saveTokenSession,
@@ -274,6 +273,32 @@ function isRefreshAuthRequired(value) {
 }
 
 async function tokenLogin(options = {}) {
+  const env = options.env || process.env;
+  if (isEnvTokenAuthMode(env)) {
+    const status = tokenStatus(options);
+    if (status && status.can_auto_use) {
+      return {
+        ...status,
+        ok: true,
+        status: 'ok',
+        can_auto_use: true,
+        message: 'env token bootstrap credentials are already available; OAuth login was skipped',
+      };
+    }
+    return {
+      ...status,
+      ok: false,
+      auth_mode: 'token',
+      auth_source: status && status.auth_source ? status.auth_source : 'env',
+      auth_store: status && status.auth_store ? status.auth_store : 'env',
+      status: status && status.status ? status.status : 'not_logged_in',
+      can_auto_use: false,
+      message: status && status.message
+        ? status.message
+        : 'env token bootstrap credential is missing. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.',
+    };
+  }
+
   const baseUrl = resolveTokenBaseUrl(options);
   const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
@@ -315,21 +340,21 @@ function tokenStatus(options = {}) {
   const session = resolution.session;
   if (!session || (!session.access_token && !session.refresh_token)) {
     const env = options.env || process.env;
-    const hostInjected = isHostInjectedTokenMode(env);
+    const envTokenMode = isEnvTokenAuthMode(env);
     const status = {
       ok: false,
       auth_mode: 'token',
-      auth_source: resolution.auth_source || (hostInjected ? 'env' : undefined),
+      auth_source: resolution.auth_source || (envTokenMode ? 'env' : undefined),
       auth_store: resolution.auth_store,
       auth_profile: resolution.auth_profile,
       status: resolution.status === 'profile_required' ? 'profile_required' : 'not_logged_in',
       can_auto_use: false,
-      failure_reason: hostInjected ? 'env_token_missing' : resolution.status,
-      message: resolution.message || (hostInjected
-        ? 'host-injected token is missing. Ask the host to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
+      failure_reason: envTokenMode ? 'env_token_missing' : resolution.status,
+      message: resolution.message || (envTokenMode
+        ? 'env token bootstrap credential is missing. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
         : undefined),
-      next_step: resolution.next_step || (hostInjected
-        ? 'Ask the host runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN; do not run OAuth login in host-injected token mode.'
+      next_step: resolution.next_step || (envTokenMode
+        ? 'Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN; stop until credentials are available.'
         : 'Run openyida login to add an auth profile.'),
       next_step_commands: resolution.next_step_commands,
       candidate_count: resolution.candidate_count,
@@ -338,7 +363,7 @@ function tokenStatus(options = {}) {
       persistence_scope: resolution.persistence_scope,
       warning: resolution.warning,
     };
-    if (!hostInjected) {
+    if (!envTokenMode) {
       status.token_file = require('./token-store').getTokenFilePath(options);
     }
     return status;
@@ -353,7 +378,7 @@ function tokenStatus(options = {}) {
       persistence_scope: session.persistence_scope,
       user_auth_store_writable: session.user_auth_store_writable,
       warning: session.warning,
-      status: 'refresh_required',
+      status: 'ok',
       can_auto_use: true,
       refresh_token: maskToken(session.refresh_token),
       base_url: session.base_url,
@@ -446,7 +471,7 @@ async function tokenRefresh(options = {}) {
     }
   }
   const env = options.env || process.env;
-  if (isHostInjectedTokenMode(env) && session.auth_source === 'env') {
+  if (isEnvTokenAuthMode(env) && ['env', 'project_legacy'].includes(session.auth_source)) {
     env.OPENYIDA_ACCESS_TOKEN = normalized.access_token;
     if (normalized.refresh_token) {
       env.OPENYIDA_REFRESH_TOKEN = normalized.refresh_token;
@@ -454,10 +479,10 @@ async function tokenRefresh(options = {}) {
     if (normalized.expires_at) {
       env.OPENYIDA_ACCESS_TOKEN_EXPIRES_AT = String(normalized.expires_at);
     }
-    return normalizeTokenSession({
+    return saveTokenSession({
       ...normalized,
       auth_source: 'env',
-    });
+    }, options);
   }
   return saveTokenSession(normalized, options);
 }
@@ -496,20 +521,6 @@ function toLogoutProfileSummary(session = {}) {
 }
 
 async function tokenLogout(options = {}) {
-  const env = options.env || process.env;
-  if (isHostInjectedTokenMode(env)) {
-    return {
-      ok: true,
-      auth_mode: 'token',
-      status: 'host_injected_noop',
-      can_auto_use: false,
-      auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
-      message: 'host-injected token mode does not write or delete local auth profiles',
-    };
-  }
-
   const authProfile = options.authProfile || options.profile;
   const deleteAllProfiles = options.allProfiles === true || options.all === true;
   if (deleteAllProfiles) {

package/lib/auth/token-store.js

@@ -394,6 +394,7 @@ function buildAuthProfileNextStep(status) {
 
 function getAuthProfileSelector(options = {}) {
   const env = options.env || process.env;
+  const envTokenMode = isEnvTokenAuthMode(env);
   return {
     authProfile: sanitizeProfileName(
       options.authProfile ||
@@ -401,8 +402,18 @@ function getAuthProfileSelector(options = {}) {
       env.OPENYIDA_AUTH_PROFILE ||
       ''
     ),
-    corpId: String(options.corpId || env.OPENYIDA_AUTH_CORP_ID || '').trim(),
-    userId: String(options.userId || env.OPENYIDA_AUTH_USER_ID || '').trim(),
+    corpId: String(
+      options.corpId ||
+      env.OPENYIDA_AUTH_CORP_ID ||
+      (envTokenMode ? env.OPENYIDA_TOKEN_CORP_ID : '') ||
+      ''
+    ).trim(),
+    userId: String(
+      options.userId ||
+      env.OPENYIDA_AUTH_USER_ID ||
+      (envTokenMode ? env.OPENYIDA_TOKEN_USER_ID : '') ||
+      ''
+    ).trim(),
   };
 }
 
@@ -585,13 +596,8 @@ function saveUserTokenSession(session, options = {}) {
 function saveTokenSession(session, options = {}) {
   const env = options.env || process.env;
   const normalized = normalizeTokenSession(session);
-  if (isHostInjectedTokenMode(env) && normalized.auth_source === 'env') {
-    return attachAuthStoreMetadata(normalized, {
-      auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
-      user_auth_store_writable: null,
-    });
+  if (isEnvTokenAuthMode(env) && normalized.auth_source === 'env') {
+    return saveProjectLegacyTokenSession(normalized, options);
   }
 
   try {
@@ -616,9 +622,15 @@ function saveTokenSession(session, options = {}) {
   }
 }
 
-function isHostInjectedTokenMode(env = process.env) {
-  const authEnabled = String(env.YIDA_AUTH_ENABLED || '').trim().toLowerCase();
-  return ['1', 'true', 'yes', 'on'].includes(authEnabled);
+function isEnvTokenAuthMode(env = process.env) {
+  return String(env.OPENYIDA_AUTH_MODE || '').trim().toLowerCase() === 'token';
+}
+
+function hasEnvTokenCredential(env = process.env) {
+  return !!(
+    String(env.OPENYIDA_ACCESS_TOKEN || '').trim() ||
+    String(env.OPENYIDA_REFRESH_TOKEN || '').trim()
+  );
 }
 
 function loadEnvTokenSession(env = process.env) {
@@ -773,29 +785,40 @@ function resolveTokenSession(options = {}) {
   const env = options.env || process.env;
   const selector = getAuthProfileSelector(options);
   const envSession = applyBusinessContextToEnvSession(loadEnvTokenSession(env), options);
-  if (
-    isHostInjectedTokenMode(env) &&
-    envSession &&
-    (envSession.access_token || envSession.refresh_token) &&
-    sessionMatchesSelector(envSession, selector, { allowMissingIdentity: true })
-  ) {
-    return {
-      session: attachAuthStoreMetadata(envSession, {
-        auth_source: 'env',
-        auth_store: 'host_injected',
-        persistence_scope: 'host',
-        user_auth_store_writable: null,
-      }),
-      status: 'ok',
-    };
-  }
-  if (isHostInjectedTokenMode(env)) {
+  if (isEnvTokenAuthMode(env)) {
+    const localSession = loadLocalTokenSession(options);
+    if (
+      localSession &&
+      (localSession.access_token || localSession.refresh_token) &&
+      sessionMatchesSelector(localSession, selector)
+    ) {
+      return {
+        session: localSession,
+        status: 'ok',
+      };
+    }
+    if (
+      hasEnvTokenCredential(env) &&
+      envSession &&
+      (envSession.access_token || envSession.refresh_token) &&
+      sessionMatchesSelector(envSession, selector, { allowMissingIdentity: true })
+    ) {
+      return {
+        session: attachAuthStoreMetadata(envSession, {
+          auth_source: 'env',
+          auth_store: 'env',
+          persistence_scope: 'process',
+          user_auth_store_writable: null,
+        }),
+        status: 'ok',
+      };
+    }
     return {
       session: null,
       status: 'env_token_missing',
       auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
+      auth_store: 'env',
+      persistence_scope: 'process',
       user_auth_store_writable: null,
     };
   }
@@ -807,7 +830,7 @@ function resolveTokenSession(options = {}) {
     return {
       session: attachAuthStoreMetadata(envSession, {
         auth_source: 'env',
-        auth_store: 'host_injected',
+        auth_store: 'env',
         persistence_scope: 'process',
         user_auth_store_writable: getUserAuthStoreWritable(options),
       }),
@@ -895,7 +918,7 @@ function resolveTokenSession(options = {}) {
     return {
       session: attachAuthStoreMetadata(envSession, {
         auth_source: 'env',
-        auth_store: 'host_injected',
+        auth_store: 'env',
         persistence_scope: 'process',
         user_auth_store_writable: getUserAuthStoreWritable(options),
       }),
@@ -975,7 +998,8 @@ module.exports = {
   loadEnvTokenSession,
   loadLocalTokenSession,
   saveProjectLegacyTokenSession,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
+  hasEnvTokenCredential,
   isAccessTokenUsable,
   maskToken,
   resolveEnvName,

package/lib/core/agent-capabilities.js

@@ -105,38 +105,6 @@ function compactSkillsDiagnostics(skillsDiagnostics) {
   };
 }
 
-function isTruthyEnv(value) {
-  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
-}
-
-function hasEnvTokenCredential(env = process.env) {
-  return !!(
-    String(env.OPENYIDA_ACCESS_TOKEN || '').trim() ||
-    String(env.OPENYIDA_REFRESH_TOKEN || '').trim()
-  );
-}
-
-function hasRuntimeProvisionedAccessToken(env = process.env) {
-  return isTruthyEnv(env.YIDA_AUTH_ENABLED) &&
-    !!String(env.OPENYIDA_ACCESS_TOKEN || '').trim();
-}
-
-function buildRuntimeProvisionedLoginStatus(env = process.env) {
-  return {
-    ok: true,
-    auth_mode: 'token',
-    auth_source: 'env',
-    auth_store: 'host_injected',
-    corp_id: env.OPENYIDA_TOKEN_CORP_ID,
-    corp_name: env.OPENYIDA_TOKEN_CORP_NAME,
-    user_id: env.OPENYIDA_TOKEN_USER_ID,
-    user_auth_store_writable: null,
-    persistence_scope: 'host',
-    status: 'ok',
-    can_auto_use: true,
-  };
-}
-
 function buildRuntimeSnapshot(projectRoot) {
   const detected = typeof coreUtils.detectRuntimeCapabilities === 'function'
     ? coreUtils.detectRuntimeCapabilities()
@@ -204,18 +172,12 @@ function forbiddenAliasBriefs(manifest) {
 }
 
 function buildAuthPath(login, env = process.env) {
-  const hostInjectedTokenMode = isTruthyEnv(env.YIDA_AUTH_ENABLED);
-  const envTokenPresent = hasEnvTokenCredential(env);
-  const authSource = login.auth_source || (hostInjectedTokenMode || envTokenPresent ? 'env' : 'token_session');
-  const hostTokenEnvDetected = hostInjectedTokenMode || envTokenPresent || authSource === 'env';
-  const authStore = login.auth_store || (hostTokenEnvDetected ? 'host_injected' : undefined);
-  const runtimeAuthProvisioned = hasRuntimeProvisionedAccessToken(env) &&
-    authSource === 'env' &&
-    login.status === 'ok';
+  const authSource = login.auth_source || 'token_session';
+  const envTokenSession = authSource === 'env' || login.failure_reason === 'env_token_missing';
   const authPath = {
     mode: login.auth_mode || 'token',
     source: authSource,
-    store: authStore,
+    store: login.auth_store,
     auth_profile: login.auth_profile,
     corp_id: login.corp_id,
     corp_name: login.corp_name,
@@ -227,12 +189,9 @@ function buildAuthPath(login, env = process.env) {
     next_step: login.next_step,
     next_step_commands: login.next_step_commands,
     can_auto_use: login.can_auto_use === true,
-    host_injected_token_mode: hostInjectedTokenMode,
-    host_token_env_detected: hostTokenEnvDetected,
-    env_token_present: envTokenPresent,
-    interactive_login_allowed: !hostTokenEnvDetected,
+    interactive_login_allowed: !envTokenSession,
     browser_session_auth_allowed: false,
-    auth_runtime: 'token_oauth_session',
+    auth_runtime: envTokenSession ? 'env_token_bootstrap' : 'token_oauth_session',
     cookie_auth_supported: false,
     cookie_check_required: false,
     playwright_cookie_check_required: false,
@@ -243,13 +202,10 @@ function buildAuthPath(login, env = process.env) {
       'qr_login',
       'cookie_cache',
     ],
-    missing_token_action: hostInjectedTokenMode
-      ? 'STOP_AND_REQUEST_HOST_TOKEN'
+    missing_token_action: envTokenSession
+      ? 'STOP_AND_REQUEST_ENV_TOKEN'
       : 'RUN_OPENYIDA_LOGIN_IF_USER_APPROVES',
   };
-  if (runtimeAuthProvisioned) {
-    authPath.runtime_auth_provisioned = true;
-  }
   return authPath;
 }
 
@@ -261,14 +217,14 @@ function buildInteractiveLogin(auth, runtime) {
     playwright_required: false,
   };
 
-  if (auth.host_token_env_detected) {
+  if (!auth.interactive_login_allowed) {
     return {
       mode: 'not_required',
       browser_default: 'not_required',
       browser_owner: 'none',
       recommended_command: null,
       agent_action: 'do_not_run_oauth_login',
-      reason: auth.env_token_present ? 'host_token_env_detected' : 'host_token_required',
+      reason: auth.source === 'env' ? 'env_token_bootstrap' : 'login_not_required',
       ...base,
     };
   }
@@ -306,7 +262,7 @@ function buildInteractiveLogin(auth, runtime) {
     browser_default: 'unsupported',
     browser_owner: 'none',
     recommended_command: null,
-    agent_action: 'ask_user_for_browser_or_host_token',
+    agent_action: 'ask_user_for_browser_access',
     reason: 'no_desktop_shell_or_agent_browser_detected',
     ...base,
   };
@@ -314,7 +270,7 @@ function buildInteractiveLogin(auth, runtime) {
 
 function buildBuilderPath(login, projectRoot, manifest, env = process.env, runtimeSnapshot = null) {
   const auth = buildAuthPath(login, env);
-  const canTrustSummaryPreflight = auth.can_auto_use === true || auth.host_injected_token_mode === true;
+  const canTrustSummaryPreflight = auth.can_auto_use === true;
   const runtime = runtimeSnapshot || buildRuntimeSnapshot(projectRoot);
 
   return {
@@ -352,10 +308,10 @@ function buildBuilderPath(login, projectRoot, manifest, env = process.env, runti
       skip_help_discovery_default: true,
       skip_env_noise_default: true,
       skip_login_check_only_default: canTrustSummaryPreflight,
-      skip_browser_login_default: auth.host_token_env_detected,
+      skip_browser_login_default: !auth.interactive_login_allowed,
       skip_cookie_or_playwright_checks_default: true,
       default_app_list_policy: 'skip_when_bound_app_type_unique',
-      stop_when_host_token_missing: auth.host_injected_token_mode && !auth.env_token_present,
+      stop_when_env_token_missing: auth.missing_token_action === 'STOP_AND_REQUEST_ENV_TOKEN' && !auth.can_auto_use,
     },
     command_contract: {
       command_prefix: manifest.command_prefix,
@@ -437,9 +393,6 @@ function compactBuilderPath(builderPath) {
     next_step: builderPath.auth.next_step,
     next_step_commands: builderPath.auth.next_step_commands,
     can_auto_use: builderPath.auth.can_auto_use,
-    host_injected_token_mode: builderPath.auth.host_injected_token_mode,
-    host_token_env_detected: builderPath.auth.host_token_env_detected,
-    env_token_present: builderPath.auth.env_token_present,
     interactive_login_allowed: builderPath.auth.interactive_login_allowed,
     browser_session_auth_allowed: builderPath.auth.browser_session_auth_allowed,
     auth_runtime: builderPath.auth.auth_runtime,
@@ -449,10 +402,6 @@ function compactBuilderPath(builderPath) {
     qr_login_required: builderPath.auth.qr_login_required,
     missing_token_action: builderPath.auth.missing_token_action,
   };
-  if (builderPath.auth.runtime_auth_provisioned === true) {
-    auth.runtime_auth_provisioned = true;
-  }
-
   return {
     schema_version: builderPath.schema_version,
     preflight: builderPath.preflight,
@@ -465,7 +414,7 @@ function compactBuilderPath(builderPath) {
       skip_login_check_only_default: environment.skip_login_check_only_default,
       skip_browser_login_default: environment.skip_browser_login_default,
       skip_cookie_or_playwright_checks_default: environment.skip_cookie_or_playwright_checks_default,
-      stop_when_host_token_missing: environment.stop_when_host_token_missing,
+      stop_when_env_token_missing: environment.stop_when_env_token_missing,
       default_app_list_policy: environment.default_app_list_policy,
     },
     command_contract: {
@@ -541,43 +490,6 @@ function buildCommandManifestDigest(manifest) {
 
 function buildAgentCapabilitiesSummary() {
   const manifest = buildCommandManifest({ t, version });
-
-  if (hasRuntimeProvisionedAccessToken(process.env)) {
-    const projectResolution = resolveProjectRootCompat();
-    const projectRoot = projectResolution.projectRoot;
-    const skillsDiagnostics = compactSkillsDiagnostics(buildSkillsDiagnosticsCompat(projectResolution));
-    const loginStatus = buildRuntimeProvisionedLoginStatus();
-    const runtime = buildRuntimeSnapshot(projectRoot);
-    const builderPath = compactBuilderPath(
-      buildBuilderPath(loginStatus, projectRoot, manifest, process.env, runtime)
-    );
-
-    return {
-      schema_version: 1,
-      name: 'openyida-agent-capabilities-summary',
-      version,
-      login: compactLogin(loginStatus),
-      precheck: {
-        skipped: true,
-        reason: 'runtime_auth_provisioned',
-      },
-      workdir: projectRoot,
-      workdir_exists: fs.existsSync(projectRoot),
-      workdir_source: projectResolution.source,
-      workdir_reason: projectResolution.reason,
-      project_root: compactProjectRootResolution(projectResolution),
-      cache_dir: path.join(projectRoot, '.cache'),
-      openyida_task_cache_dir: path.join(projectRoot, '.cache', 'openyida'),
-      skills: skillsDiagnostics,
-      command_manifest_digest: buildCommandManifestDigest(manifest),
-      command_manifest_digest_algorithm: 'sha256',
-      command_count: manifest.summary.command_count,
-      full_capabilities_command: 'openyida agent-capabilities --json',
-      runtime,
-      builder_path: builderPath,
-    };
-  }
-
   const envSnapshot = buildEnvironmentSnapshot();
   const projectResolution = resolveProjectRootCompat({
     projectRoot: envSnapshot.active.projectRoot,