openyida 2026.8.19 → 2026.8.25-1

package/README.md

@@ -461,7 +461,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector list` | List HTTP connectors |
 | `openyida connector create "name" "domain" ...` | Create a connector |
 | `openyida connector detail <id>` | View connector details |
-| `openyida connector delete <id>` | Delete a connector |
+| `openyida connector delete <id> [--force]` | Show manual deletion guidance (CLI does not delete) |
 | `openyida connector add-action --operations <file> --connector-id <id>` | Add an action |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |

package/bin/yida.js

@@ -670,15 +670,13 @@ async function main() {
 
     case 'login': {
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { getAuthStatus } = require('../lib/core/utils');
       if (hasHelpFlag(loginArgs)) {
         printLoginHelp();
       } else {
         assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
         if (loginArgs.includes('--check-only')) {
           console.log(JSON.stringify(getAuthStatus(buildTokenLoginOptions(loginArgs)), null, 2));
-        } else if (isEnvAuthMode()) {
-          printLoginResult(getAuthStatus(buildTokenLoginOptions(loginArgs)));
         } else {
           const { tokenLogin } = require('../lib/auth/token-auth');
           const result = await tokenLogin(buildTokenLoginOptions(loginArgs));
@@ -697,7 +695,7 @@ async function main() {
     case 'auth': {
       const subCommand = args[0];
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { getAuthStatus } = require('../lib/core/utils');
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
       if (!subCommand || subCommand === '--help' || subCommand === '-h') {
         printAuthHelp();
@@ -720,9 +718,7 @@ async function main() {
           printLoginHelp();
         } else {
           assertNoUnsupportedLegacyLoginFlags(rawArgs.slice(1), authArgs);
-          const result = isEnvAuthMode()
-            ? getAuthStatus(buildTokenLoginOptions(authArgs))
-            : await tokenLogin(buildTokenLoginOptions(authArgs));
+          const result = await tokenLogin(buildTokenLoginOptions(authArgs));
           printLoginResult(result);
         }
       } else if (subCommand === 'refresh') {

package/lib/aggregate-table/aggregate-table.js

@@ -8,16 +8,13 @@ const { t } = require('../core/i18n');
 const { buildYidaTitleI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { fetchFormPageList, resolveLocalizedText } = require('../app/form-navigation');
+const {
+  DESIGN_KEYS,
+  assertAggregateDesignConfig,
+  assertAggregateDesignReadback,
+} = require('./contract');
 
 const FORM_TYPE_VIRTUAL_VIEW = 'virtualView';
-const DESIGN_KEYS = [
-  'relationForms',
-  'relationships',
-  'aggregatedFields',
-  'auxFields',
-  'formulaFields',
-  'validators',
-];
 
 function hasHelpFlag(args) {
   return (args || []).includes('--help') || (args || []).includes('-h');
@@ -133,7 +130,7 @@ async function checkVirtualViewFeature(authRef, appType) {
 }
 
 async function createEmptyVirtualView(authRef, appType, title) {
-  return createYidaClient({ authRef }).postForm(
+  return createYidaClient({ authRef }).postFormOnce(
     `/dingtalk/web/${appType}/query/formdesign/saveFormSchemaInfo.json`,
     buildCreateEmptyPostData(title)
   );
@@ -157,7 +154,11 @@ async function postVirtualViewDesign(authRef, appType, formUuid, designInfo, act
     throw new Error(`Unknown aggregate table action: ${action}`);
   }
 
-  return createYidaClient({ authRef }).postForm(
+  const client = createYidaClient({ authRef });
+  const post = action === 'save' || action === 'publish'
+    ? client.postFormOnce.bind(client)
+    : client.postForm.bind(client);
+  return post(
     `/alibaba/web/${appType}/query/virtualview/${endpoint}`,
     buildDesignPostData(formUuid, designInfo, gmtModified)
   );
@@ -318,6 +319,11 @@ async function runCreateEmpty(args) {
   const createResult = await createEmptyVirtualView(authRef, appType, name);
   const created = assertSuccess(createResult, t('aggregate_table.create_empty'));
   const formUuid = (created && created.formUuid) || created;
+  if ((typeof formUuid !== 'string' && typeof formUuid !== 'number') || String(formUuid).length === 0) {
+    const error = new Error('Aggregate table creation returned no recoverable identity.');
+    error.code = 'AGGREGATE_CREATE_IDENTITY_MISSING';
+    throw error;
+  }
   const designUrl = buildDesignUrl(authRef.baseUrl, appType, formUuid, { fromNew: true });
   const workbenchUrl = buildWorkbenchUrl(authRef.baseUrl, appType, formUuid);
 
@@ -401,6 +407,7 @@ async function runPreview(args) {
 
   const authRef = await createAuthRef();
   const designInfo = normalizeDesignConfig(readJsonInput(input), formUuid);
+  assertAggregateDesignConfig(designInfo, { mode: 'draft' });
   const result = await postVirtualViewDesign(authRef, appType, formUuid, designInfo, 'preview');
   const rows = assertSuccess(result, t('aggregate_table.preview'));
   const rowCount = Array.isArray(rows) ? rows.length : 0;
@@ -439,13 +446,28 @@ async function runSaveOrPublish(args, action) {
   }
 
   const authRef = await createAuthRef();
-  const { designInfo, gmtModified } = await loadDesignForMutation(authRef, appType, formUuid, input, action);
-  if (isPublish && designInfo.relationForms.length === 0) {
-    throw new Error(t('aggregate_table.publish_requires_source'));
-  }
+  const { designInfo, currentConfig, gmtModified } = await loadDesignForMutation(authRef, appType, formUuid, input, action);
+  assertAggregateDesignConfig(designInfo, { mode: isPublish ? 'publish' : 'draft' });
 
   const result = await postVirtualViewDesign(authRef, appType, formUuid, designInfo, action, gmtModified);
   const content = assertSuccess(result, isPublish ? t('aggregate_table.publish') : t('aggregate_table.save'));
+  const readbackResult = await getVirtualViewConfig(authRef, appType, formUuid);
+  const readback = assertSuccess(readbackResult, t('aggregate_table.inspect'));
+  assertAggregateDesignReadback(designInfo, readback);
+  const responseRevision = content && content.gmtModified;
+  const readbackRevision = readback && readback.gmtModified;
+  if ((responseRevision === undefined || responseRevision === null) &&
+      (readbackRevision === undefined || readbackRevision === null)) {
+    const error = new Error('AGGREGATE_WRITE_REVISION_MISSING');
+    error.code = 'AGGREGATE_WRITE_REVISION_MISSING';
+    throw error;
+  }
+  if ((responseRevision === undefined || responseRevision === null) &&
+      currentConfig && String(readbackRevision) === String(currentConfig.gmtModified)) {
+    const error = new Error('AGGREGATE_WRITE_REVISION_UNCHANGED');
+    error.code = 'AGGREGATE_WRITE_REVISION_UNCHANGED';
+    throw error;
+  }
   const designUrl = buildDesignUrl(authRef.baseUrl, appType, formUuid);
   const workbenchUrl = buildWorkbenchUrl(authRef.baseUrl, appType, formUuid);
 
@@ -465,6 +487,7 @@ async function runSaveOrPublish(args, action) {
     formUuid,
     gmtModified: content && content.gmtModified,
     response: content,
+    readbackVerified: true,
     designUrl,
     workbenchUrl,
   }, designUrl, { stage: `aggregate_table_${action}_success`, title: formUuid }, flags.openMode), null, 2));

package/lib/aggregate-table/contract.js

@@ -0,0 +1,234 @@
+'use strict';
+
+const { isDeepStrictEqual } = require('util');
+
+const DESIGN_KEYS = [
+  'relationForms',
+  'relationships',
+  'aggregatedFields',
+  'auxFields',
+  'formulaFields',
+  'validators',
+];
+
+// Mirrors the designer defaults read from configLimit. Only limits that map to
+// persisted design arrays are enforced here.
+const DEFAULT_LIMITS = Object.freeze({
+  relationForms: 10,
+  relationships: 10,
+  formulaFields: 10,
+  auxFields: 10,
+});
+
+function addError(errors, code, path) {
+  errors.push({ code, path });
+}
+
+function isNonEmptyValue(value) {
+  return value !== null && value !== undefined && String(value).length > 0;
+}
+
+function validateArrayShapes(config, errors) {
+  for (const key of DESIGN_KEYS) {
+    if (!Array.isArray(config && config[key])) {
+      addError(errors, 'AGGREGATE_DESIGN_ARRAY_REQUIRED', key);
+    }
+  }
+}
+
+function validateLimits(config, limits, errors) {
+  const limitCodes = {
+    relationForms: 'AGGREGATE_RELATION_FORMS_LIMIT',
+    relationships: 'AGGREGATE_RELATIONSHIPS_LIMIT',
+    formulaFields: 'AGGREGATE_FORMULA_FIELDS_LIMIT',
+    auxFields: 'AGGREGATE_AUX_FIELDS_LIMIT',
+  };
+
+  for (const [key, limit] of Object.entries(limits)) {
+    if (Array.isArray(config[key]) && config[key].length > limit) {
+      addError(errors, limitCodes[key] || 'AGGREGATE_DESIGN_LIMIT', key);
+    }
+  }
+}
+
+function validateEntries(config, errors) {
+  if (Array.isArray(config.relationForms)) {
+    config.relationForms.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.formUuid)) {
+        addError(errors, 'AGGREGATE_RELATION_FORM_INVALID', `relationForms[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.relationships)) {
+    config.relationships.forEach((item, index) => {
+      const relationshipInfos = item && item.relationshipInfos;
+      if (!Array.isArray(relationshipInfos) || relationshipInfos.length === 0 ||
+          relationshipInfos.some((entry) => entry === null || entry === undefined)) {
+        addError(errors, 'AGGREGATE_RELATIONSHIP_INVALID', `relationships[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.aggregatedFields)) {
+    config.aggregatedFields.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.name)) {
+        addError(errors, 'AGGREGATE_COLUMN_INVALID', `aggregatedFields[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.formulaFields)) {
+    config.formulaFields.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.formula)) {
+        addError(errors, 'AGGREGATE_FORMULA_FIELD_INVALID', `formulaFields[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.validators)) {
+    config.validators.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.formula)) {
+        addError(errors, 'AGGREGATE_VALIDATOR_INVALID', `validators[${index}]`);
+      }
+    });
+  }
+}
+
+function validatePublishCompleteness(config, errors) {
+  const required = [
+    ['relationForms', 'AGGREGATE_RELATION_FORMS_REQUIRED'],
+    ['relationships', 'AGGREGATE_RELATIONSHIPS_REQUIRED'],
+    ['aggregatedFields', 'AGGREGATE_COLUMNS_REQUIRED'],
+    ['formulaFields', 'AGGREGATE_FORMULA_FIELDS_REQUIRED'],
+  ];
+
+  for (const [key, code] of required) {
+    if (!Array.isArray(config[key]) || config[key].length === 0) {
+      addError(errors, code, key);
+    }
+  }
+}
+
+function validateAggregateDesignConfig(config, options = {}) {
+  const mode = options.mode || 'draft';
+  if (mode !== 'draft' && mode !== 'publish') {
+    throw new Error(`Unsupported aggregate contract mode: ${mode}`);
+  }
+
+  const safeConfig = config && typeof config === 'object' && !Array.isArray(config)
+    ? config
+    : {};
+  const limits = { ...DEFAULT_LIMITS, ...(options.limits || {}) };
+  const errors = [];
+
+  validateArrayShapes(safeConfig, errors);
+  validateLimits(safeConfig, limits, errors);
+  validateEntries(safeConfig, errors);
+  if (mode === 'publish') {
+    validatePublishCompleteness(safeConfig, errors);
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+function assertAggregateDesignConfig(config, options = {}) {
+  const result = validateAggregateDesignConfig(config, options);
+  if (result.valid) {
+    return config;
+  }
+
+  const error = new Error(result.errors.map((item) => item.code).join(', '));
+  error.name = 'AggregateDesignContractError';
+  error.code = 'AGGREGATE_DESIGN_CONTRACT_INVALID';
+  error.details = result.errors;
+  throw error;
+}
+
+function projectAggregateDesignConfig(config) {
+  const safeConfig = config && typeof config === 'object' ? config : {};
+  const projected = {};
+  for (const key of DESIGN_KEYS) {
+    projected[key] = Array.isArray(safeConfig[key]) ? safeConfig[key] : [];
+  }
+  return projected;
+}
+
+function isI18nValue(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) && (
+    value.type === 'i18n' ||
+    Object.prototype.hasOwnProperty.call(value, 'zh_CN') ||
+    Object.prototype.hasOwnProperty.call(value, 'en_US') ||
+    Object.prototype.hasOwnProperty.call(value, 'pureEn_US')
+  );
+}
+
+function canonicalizeI18nValue(value) {
+  const zhCN = value.zh_CN || value.value || '';
+  const enUS = value.en_US || value.pureEn_US || zhCN;
+  return {
+    type: value.type || 'i18n',
+    zh_CN: String(zhCN),
+    en_US: String(enUS),
+  };
+}
+
+function isEmptyFilter(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return false;
+  }
+  const rules = value.rules;
+  return (rules === undefined || rules === null || (Array.isArray(rules) && rules.length === 0)) &&
+    !value.logicOperator;
+}
+
+function canonicalizeAggregateValue(value, key = '') {
+  if (isI18nValue(value)) {
+    return canonicalizeI18nValue(value);
+  }
+  if (key === 'filter' && isEmptyFilter(value)) {
+    return {};
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => canonicalizeAggregateValue(item));
+  }
+  if (!value || typeof value !== 'object') {
+    if (key === 'precision' && value !== undefined && value !== null && value !== '') {
+      return String(value);
+    }
+    return value;
+  }
+
+  const result = {};
+  for (const childKey of Object.keys(value)) {
+    const childValue = value[childKey];
+    if ((childKey === 'filterState' && (childValue === null || childValue === undefined)) ||
+        (childKey === 'parentId' && (childValue === '' || childValue === null || childValue === undefined))) {
+      continue;
+    }
+    result[childKey] = canonicalizeAggregateValue(childValue, childKey);
+  }
+  return result;
+}
+
+function assertAggregateDesignReadback(expected, actual) {
+  const expectedProjection = canonicalizeAggregateValue(projectAggregateDesignConfig(expected));
+  const actualProjection = canonicalizeAggregateValue(projectAggregateDesignConfig(actual));
+  if (isDeepStrictEqual(expectedProjection, actualProjection)) {
+    return actualProjection;
+  }
+
+  const error = new Error('AGGREGATE_DESIGN_READBACK_MISMATCH');
+  error.name = 'AggregateDesignReadbackError';
+  error.code = 'AGGREGATE_DESIGN_READBACK_MISMATCH';
+  throw error;
+}
+
+module.exports = {
+  DEFAULT_LIMITS,
+  DESIGN_KEYS,
+  assertAggregateDesignConfig,
+  assertAggregateDesignReadback,
+  projectAggregateDesignConfig,
+  validateAggregateDesignConfig,
+};

package/lib/app-permission/app-permission.js

@@ -2,6 +2,7 @@
 
 const { createAuthRef, createYidaClient, isAuthRefReady } = require('../core/yida-client');
 const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
 const { searchUsers } = require('../corp-manager/api');
 
 const ROLE_CONFIGS = {
@@ -140,6 +141,12 @@ function unique(values) {
   return [...new Set((values || []).map(value => String(value).trim()).filter(Boolean))];
 }
 
+function sameUserIds(left, right) {
+  const leftIds = unique(left).sort();
+  const rightIds = unique(right).sort();
+  return JSON.stringify(leftIds) === JSON.stringify(rightIds);
+}
+
 function toPositiveInt(value, defaultValue) {
   const parsed = Number.parseInt(value || `${defaultValue}`, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
@@ -310,11 +317,7 @@ async function updateRoleManagers(options = {}, authRef = getAuthRef()) {
   const action = options.action || 'set';
   const inputUserIds = unique(options.userIds || options.users || []);
 
-  if (action === 'set') {
-    return saveRoleManagers({ appType, roleType, userIds: inputUserIds }, authRef);
-  }
-
-  if (inputUserIds.length === 0) {
+  if (action !== 'set' && inputUserIds.length === 0) {
     throw new Error(`${action} 操作必须提供 --users`);
   }
 
@@ -323,7 +326,9 @@ async function updateRoleManagers(options = {}, authRef = getAuthRef()) {
   const previousUserIds = current.roles[roleKey].userIds;
   let nextUserIds;
 
-  if (action === 'add') {
+  if (action === 'set') {
+    nextUserIds = inputUserIds;
+  } else if (action === 'add') {
     nextUserIds = unique(previousUserIds.concat(inputUserIds));
   } else if (action === 'remove') {
     const removeSet = new Set(inputUserIds);
@@ -387,9 +392,22 @@ async function runUpdate(action, positionals, options) {
   });
   const current = await getAppPermission(appType);
   const roleKey = ROLE_CONFIGS[saved.roleType].key;
+  if (!sameUserIds(saved.userIds, current.roles[roleKey].userIds)) {
+    throw new CliError(t('app_permission.verify_failed'), {
+      code: 'APP_PERMISSION_VERIFY_FAILED',
+      details: {
+        expected: saved.userIds,
+        actual: current.roles[roleKey].userIds,
+      },
+    });
+  }
 
   printJson({
     ...saved,
+    before: {
+      userIds: saved.previousUserIds,
+    },
+    after: current.roles[roleKey],
     currentRole: current.roles[roleKey],
   });
 }
@@ -420,6 +438,7 @@ module.exports = {
   USAGE,
   parseCliOptions,
   splitList,
+  sameUserIds,
   normalizeRole,
   normalizeText,
   normalizeMember,

package/lib/auth/org.js

@@ -13,7 +13,7 @@ const {
   loadTokenSession,
   normalizeCorpName,
   resolveTokenSession,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   saveAuthProfilePointer,
   saveProjectLegacyTokenSession,
   saveTokenSession,
@@ -70,15 +70,15 @@ function createProfileRequiredError(targetCorpId, resolution = {}) {
   return error;
 }
 
-function createHostInjectedSwitchError(targetCorpId, currentSession, resolution = {}) {
+function createEnvTokenSwitchError(targetCorpId, currentSession, resolution = {}) {
   const actualCorpId = currentSession && currentSession.corp_id;
-  const error = new Error(`当前为宿主注入登录态，不能通过 OAuth 切换组织：target=${targetCorpId}, actual=${actualCorpId || 'unknown'}`);
-  error.code = 'ORG_SWITCH_HOST_INJECTED_MISMATCH';
-  error.status = 'host_injected_token_mismatch';
+  const error = new Error(`当前为 env token 登录态，不能通过 OAuth 切换组织：target=${targetCorpId}, actual=${actualCorpId || 'unknown'}`);
+  error.code = 'ORG_SWITCH_ENV_TOKEN_MISMATCH';
+  error.status = 'env_token_mismatch';
   error.targetCorpId = targetCorpId;
   error.actualCorpId = actualCorpId;
   error.auth_source = resolution.auth_source || (currentSession && currentSession.auth_source) || 'env';
-  error.auth_store = resolution.auth_store || (currentSession && currentSession.auth_store) || 'host_injected';
+  error.auth_store = resolution.auth_store || (currentSession && currentSession.auth_store) || 'env';
   error.can_auto_use = false;
   return error;
 }
@@ -220,8 +220,8 @@ async function switchOrganization(targetCorpId, options = {}) {
   if (targetResolution.status === 'profile_required') {
     throw createProfileRequiredError(targetCorpId, targetResolution);
   }
-  if (isHostInjectedTokenMode(projectOptions.env)) {
-    throw createHostInjectedSwitchError(targetCorpId, currentSession, targetResolution);
+  if (isEnvTokenAuthMode(projectOptions.env)) {
+    throw createEnvTokenSwitchError(targetCorpId, currentSession, targetResolution);
   }
 
   const loginOptions = {

package/lib/auth/profile.js

@@ -2,7 +2,7 @@
 
 const { CliError } = require('../core/cli-error');
 const {
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   listUserAuthProfiles,
   loadAuthProfilePointer,
   loadTokenSession,
@@ -129,14 +129,14 @@ function resolveSwitchTarget(target, options = {}) {
 }
 
 function switchAuthProfile(target, options = {}) {
-  if (isHostInjectedTokenMode(options.env || process.env)) {
+  if (isEnvTokenAuthMode(options.env || process.env)) {
     throw new CliError(
-      'host-injected token mode cannot switch local auth profiles',
+      'env token mode cannot switch local auth profiles',
       {
-        code: 'AUTH_PROFILE_SWITCH_HOST_INJECTED',
+        code: 'AUTH_PROFILE_SWITCH_ENV_TOKEN',
         details: {
-          nextStep: 'Ask the host runtime to inject the target organization token instead of switching local profiles.',
-          next_step: 'Ask the host runtime to inject the target organization token instead of switching local profiles.',
+          nextStep: 'Ask the runtime to inject the target organization token instead of switching local profiles.',
+          next_step: 'Ask the runtime to inject the target organization token instead of switching local profiles.',
         },
       }
     );

package/lib/auth/token-auth.js

@@ -15,14 +15,13 @@ const {
   clearAllUserAuthProfiles,
   clearTokenSession,
   deleteUserAuthProfile,
-  isHostInjectedTokenMode,
+  isEnvTokenAuthMode,
   listUserAuthProfiles,
   loadLocalTokenSession,
   loadTokenSession,
   loadUserProfileFile,
   maskToken,
   normalizeCorpName,
-  normalizeTokenSession,
   resolveTokenSession,
   saveBusinessContext,
   saveTokenSession,
@@ -274,6 +273,32 @@ function isRefreshAuthRequired(value) {
 }
 
 async function tokenLogin(options = {}) {
+  const env = options.env || process.env;
+  if (isEnvTokenAuthMode(env)) {
+    const status = tokenStatus(options);
+    if (status && status.can_auto_use) {
+      return {
+        ...status,
+        ok: true,
+        status: 'ok',
+        can_auto_use: true,
+        message: 'env token bootstrap credentials are already available; OAuth login was skipped',
+      };
+    }
+    return {
+      ...status,
+      ok: false,
+      auth_mode: 'token',
+      auth_source: status && status.auth_source ? status.auth_source : 'env',
+      auth_store: status && status.auth_store ? status.auth_store : 'env',
+      status: status && status.status ? status.status : 'not_logged_in',
+      can_auto_use: false,
+      message: status && status.message
+        ? status.message
+        : 'env token bootstrap credential is missing. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.',
+    };
+  }
+
   const baseUrl = resolveTokenBaseUrl(options);
   const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
@@ -315,21 +340,21 @@ function tokenStatus(options = {}) {
   const session = resolution.session;
   if (!session || (!session.access_token && !session.refresh_token)) {
     const env = options.env || process.env;
-    const hostInjected = isHostInjectedTokenMode(env);
+    const envTokenMode = isEnvTokenAuthMode(env);
     const status = {
       ok: false,
       auth_mode: 'token',
-      auth_source: resolution.auth_source || (hostInjected ? 'env' : undefined),
+      auth_source: resolution.auth_source || (envTokenMode ? 'env' : undefined),
       auth_store: resolution.auth_store,
       auth_profile: resolution.auth_profile,
       status: resolution.status === 'profile_required' ? 'profile_required' : 'not_logged_in',
       can_auto_use: false,
-      failure_reason: hostInjected ? 'env_token_missing' : resolution.status,
-      message: resolution.message || (hostInjected
-        ? 'host-injected token is missing. Ask the host to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
+      failure_reason: envTokenMode ? 'env_token_missing' : resolution.status,
+      message: resolution.message || (envTokenMode
+        ? 'env token bootstrap credential is missing. Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
         : undefined),
-      next_step: resolution.next_step || (hostInjected
-        ? 'Ask the host runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN; do not run OAuth login in host-injected token mode.'
+      next_step: resolution.next_step || (envTokenMode
+        ? 'Ask the runtime to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN; stop until credentials are available.'
         : 'Run openyida login to add an auth profile.'),
       next_step_commands: resolution.next_step_commands,
       candidate_count: resolution.candidate_count,
@@ -338,7 +363,7 @@ function tokenStatus(options = {}) {
       persistence_scope: resolution.persistence_scope,
       warning: resolution.warning,
     };
-    if (!hostInjected) {
+    if (!envTokenMode) {
       status.token_file = require('./token-store').getTokenFilePath(options);
     }
     return status;
@@ -353,7 +378,7 @@ function tokenStatus(options = {}) {
       persistence_scope: session.persistence_scope,
       user_auth_store_writable: session.user_auth_store_writable,
       warning: session.warning,
-      status: 'refresh_required',
+      status: 'ok',
       can_auto_use: true,
       refresh_token: maskToken(session.refresh_token),
       base_url: session.base_url,
@@ -446,7 +471,7 @@ async function tokenRefresh(options = {}) {
     }
   }
   const env = options.env || process.env;
-  if (isHostInjectedTokenMode(env) && session.auth_source === 'env') {
+  if (isEnvTokenAuthMode(env) && ['env', 'project_legacy'].includes(session.auth_source)) {
     env.OPENYIDA_ACCESS_TOKEN = normalized.access_token;
     if (normalized.refresh_token) {
       env.OPENYIDA_REFRESH_TOKEN = normalized.refresh_token;
@@ -454,10 +479,10 @@ async function tokenRefresh(options = {}) {
     if (normalized.expires_at) {
       env.OPENYIDA_ACCESS_TOKEN_EXPIRES_AT = String(normalized.expires_at);
     }
-    return normalizeTokenSession({
+    return saveTokenSession({
       ...normalized,
       auth_source: 'env',
-    });
+    }, options);
   }
   return saveTokenSession(normalized, options);
 }
@@ -496,20 +521,6 @@ function toLogoutProfileSummary(session = {}) {
 }
 
 async function tokenLogout(options = {}) {
-  const env = options.env || process.env;
-  if (isHostInjectedTokenMode(env)) {
-    return {
-      ok: true,
-      auth_mode: 'token',
-      status: 'host_injected_noop',
-      can_auto_use: false,
-      auth_source: 'env',
-      auth_store: 'host_injected',
-      persistence_scope: 'host',
-      message: 'host-injected token mode does not write or delete local auth profiles',
-    };
-  }
-
   const authProfile = options.authProfile || options.profile;
   const deleteAllProfiles = options.allProfiles === true || options.all === true;
   if (deleteAllProfiles) {