openyida 2026.9.21 → 2026.9.22-beta.1

package/lib/asset/asset-resolve.js

@@ -10,8 +10,6 @@ const { minimumSize, prepareAssetPlan } = require('./asset-plan');
 const { readImageMetadata, parseImageMetadata } = require('./image-metadata');
 const { MAX_IMAGE_BYTES, uploadAttachment } = require('./attachment-upload');
 const { getAssetStatus } = require('./asset-status');
-const { t } = require('../core/i18n');
-const { verifyImageUrl } = require('./url-verify');
 
 const ALLOWED_STOCK_IMAGE_PROVIDERS = Object.freeze({
   unsplash: Object.freeze(['images.unsplash.com']),
@@ -44,20 +42,8 @@ function getCollectedImageProvider(rawUrl) {
   return null;
 }
 
-function deliveryRights(rawUrl, ctx = {}) {
-  const provider = getCollectedImageProvider(rawUrl) || ctx.provider;
-  const stock = (ctx.assetSource || 'search') === 'search';
-  return {
-    hotlinkAllowed: ctx.hotlinkAllowed ?? (isHttpUrl(rawUrl) && stock && !!ALLOWED_STOCK_IMAGE_PROVIDERS[provider]),
-    rehostAllowed: ctx.rehostAllowed ?? !(stock && provider === 'unsplash'),
-  };
-}
-
-function getExternalDeliveryPolicy(rawUrl, ctx = {}) {
-  if (!isHttpUrl(rawUrl)) {return 'standard';}
-  const rights = deliveryRights(rawUrl, ctx);
-  if (rights.hotlinkAllowed && ctx.deliveryMode !== 'upload') {return 'original-url';}
-  return rights.rehostAllowed ? 'yida-attachment' : 'blocked';
+function getExternalDeliveryPolicy(rawUrl) {
+  return isHttpUrl(rawUrl) ? 'yida-attachment' : 'standard';
 }
 
 function extensionFromUrl(rawUrl) {
@@ -194,29 +180,15 @@ async function resolveOne(candidate, ctx = {}) {
         allowedProviders: Object.keys(ALLOWED_STOCK_IMAGE_PROVIDERS),
       };
     }
-    const deliveryPolicy = getExternalDeliveryPolicy(raw, ctx);
-    const rights = deliveryRights(raw, ctx);
+    const deliveryPolicy = getExternalDeliveryPolicy(raw);
     const common = { provider: inputProvider || ctx.provider || assetSource };
-    const original = (metadata, reason = 'ASSET_TOO_LARGE') => {
-      if (!rights.hotlinkAllowed) {return { ...common, resolved: false, reason };}
+    const original = metadata => {
       const failure = sizeFailure(metadata, ctx);
       if (failure) {return { ...common, resolved: false, reason: failure };}
       return { ...common, ...metadata, imageType: metadata.type, resolved: true, url: raw,
-        source: 'external', reason, deliveryPolicy: 'original-url' };
+        source: 'external', reason: 'ASSET_TOO_LARGE', deliveryPolicy: 'original-url' };
     };
-    if (deliveryPolicy === 'blocked') {
-      return { ...common, resolved: false, reason: 'REHOST_NOT_ALLOWED', deliveryPolicy };
-    }
-    if (deliveryPolicy === 'original-url') {
-      const verified = await (ctx.verifyFn || verifyImageUrl)(raw, {
-        timeout: ctx.timeout, minWidth: ctx.minWidth, minHeight: ctx.minHeight,
-        allowUrl: assetSource === 'search' ? url => getCollectedImageProvider(url) === inputProvider : undefined,
-      });
-      if (!verified.ok) {return { ...common, resolved: false, reason: verified.reason };}
-      return original({ ...verified, type: verified.imageType }, 'OK_DIRECT');
-    }
     let tempPath = '';
-    let verifiedMetadata;
     try {
       tempPath = await (ctx.downloadFn || downloadUrlToTemp)(raw, { timeout: ctx.timeout, stockOnly: assetSource === 'search' });
       if (fs.statSync(tempPath).size > MAX_IMAGE_BYTES) {return original(readImageMetadata(tempPath));}
@@ -224,20 +196,18 @@ async function resolveOne(candidate, ctx = {}) {
       const failure = sizeFailure(downloaded, ctx);
       if (failure) {return { resolved: false, url: raw, source: 'external', reason: failure };}
       Object.assign(common, downloaded, { contentHash: fileHash(tempPath), imageType: downloaded.type });
-      verifiedMetadata = { ...common, type: downloaded.type };
       const reused = await reuseDelivery(raw, common, ctx);
       if (reused) {return reused;}
-      if (!ctx.canUpload) {return original(verifiedMetadata, 'YIDA_ATTACHMENT_UNAVAILABLE');}
+      if (!ctx.canUpload) {return { resolved: false, url: raw, source: 'external', reason: 'YIDA_ATTACHMENT_UNAVAILABLE' };}
       const results = await ctx.uploadFn([tempPath]);
       const hit = (results || []).find(result => result.success && result.originalPath === tempPath)
         || (results || []).find(result => result.success);
       if (hit && isHttpUrl(hit.cdnUrl)) {
         return { ...common, resolved: true, url: hit.cdnUrl, source: 'yida-attachment', reason: 'OK', deliveryPolicy };
       }
-      return original(verifiedMetadata, ((results || [])[0] || {}).error || 'UPLOAD_FAILED');
+      return { ...common, resolved: false, url: raw, source: 'external', reason: ((results || [])[0] || {}).error || 'UPLOAD_FAILED' };
     } catch (error) {
       if (error.message === 'ASSET_TOO_LARGE') {return original(error.metadata || {});}
-      if (verifiedMetadata) {return original(verifiedMetadata, error.code || error.message || 'UPLOAD_FAILED');}
       return { ...common, resolved: false, url: raw, source: 'external', reason: error.code || error.message || 'UPLOAD_FAILED' };
     } finally {
       if (tempPath) {
@@ -260,7 +230,6 @@ async function resolveOne(candidate, ctx = {}) {
         allowedProviders: Object.keys(ALLOWED_STOCK_IMAGE_PROVIDERS),
       };
     }
-    if (!deliveryRights(raw, ctx).rehostAllowed) {return { resolved: false, reason: 'REHOST_NOT_ALLOWED' };}
     const metadata = readImageMetadata(raw);
     const failure = sizeFailure(metadata, ctx);
     if (failure) {
@@ -289,9 +258,7 @@ async function resolveOne(candidate, ctx = {}) {
     }
   }
 
-  return { resolved: false, url: raw, source: 'unknown', reason: 'NOT_FOUND',
-    message: t('asset.localFileUnavailable', path.resolve(raw)),
-    details: { input: raw, resolvedPath: path.resolve(raw), baseDir: process.cwd(), pathBase: 'cwd' } };
+  return { resolved: false, url: raw, source: 'unknown', reason: 'NOT_FOUND' };
 }
 
 function normalizeSource(source, fallback) {
@@ -317,7 +284,7 @@ function metadataGaps(asset) {
 }
 
 async function resolveAssets(assets = [], options = {}) {
-  const plan = prepareAssetPlan(assets, options.assetStrategy, options.pageId);
+  const plan = prepareAssetPlan(assets, options.assetStrategy);
   const entries = plan.entries;
   const online = options.online !== false;
   const status = options.status || getAssetStatus({ online, env: options.env, runtime: options.runtime });
@@ -345,14 +312,10 @@ async function resolveAssets(assets = [], options = {}) {
         previous: asset,
         assetSource: source,
         provider: asset.provider,
-        hotlinkAllowed: asset.hotlinkAllowed,
-        rehostAllowed: asset.rehostAllowed,
-        deliveryMode: options.uploadAssets ? 'upload' : asset.deliveryMode,
         online,
         canUpload,
         timeout: options.timeout,
         downloadFn: options.downloadFn,
-        verifyFn: options.verifyFn,
         uploadFn,
         ...size,
       });
@@ -371,8 +334,6 @@ async function resolveAssets(assets = [], options = {}) {
       slotId,
       pageId: asset.pageId || '',
       input,
-      deliveryMode: options.uploadAssets ? 'upload' : asset.deliveryMode || 'auto',
-      ...Object.fromEntries(['hotlinkAllowed', 'rehostAllowed'].filter(key => asset[key] !== undefined).map(key => [key, asset[key]])),
       ...minimumSize(asset),
       ...(asset.minSize !== undefined ? { minSize: asset.minSize } : {}),
       usage: asset.usage || '',
@@ -381,13 +342,9 @@ async function resolveAssets(assets = [], options = {}) {
       localPath: isLocalFile(input) ? input : '',
       source,
       provider,
-      assetId: asset.assetId || '',
       sourcePage: asset.sourcePage || '',
       creator: asset.creator || '',
       license: asset.license || '',
-      licenseUrl: asset.licenseUrl || '',
-      licenseCheckedAt: asset.licenseCheckedAt || '',
-      authorizationEvidence: [...(asset.authorizationEvidence || [])],
       attribution: asset.attribution || '',
       downloadLocation: asset.downloadLocation || '',
       downloadTracked: asset.downloadTracked === true,
@@ -406,8 +363,7 @@ async function resolveAssets(assets = [], options = {}) {
         slotId: slotId || `slot-${index + 1}`,
         pageId: output.pageId,
         code: result.reason,
-        message: result.message || `图片未落地：${result.reason}`,
-        ...(result.details ? { details: result.details } : {}),
+        message: `图片未落地：${result.reason}`,
       });
       gaps.push(...output.gaps.map(gap => ({ ...gap })));
       return;
@@ -445,7 +401,6 @@ async function resolveAssets(assets = [], options = {}) {
     capabilityEvidence: {
       host: status.hostCapabilities,
       cdnConfigured: status.cdnConfigured,
-      deliveryPreference: 'verified-direct-url',
       uploadTarget: 'yida-attachment',
       maxUploadBytes: MAX_IMAGE_BYTES,
       online,

package/lib/asset/asset-status.js

@@ -41,8 +41,8 @@ function getAssetStatus(options = {}) {
 
   let recommendedStrategy;
   if (online) {
-    recommendedStrategy = STRATEGY.EXTERNAL_URL;
-    reasons.push('允许外链的图片检查通过后直接使用；上传本地图或需托管的图片时才需要登录态和 appType。');
+    recommendedStrategy = STRATEGY.YIDA_ATTACHMENT;
+    reasons.push('图片默认上传宜搭附件，需要登录态和 appType；超过 20 MiB 的外链保留原链接。');
   } else {
     recommendedStrategy = STRATEGY.LOW_FIDELITY;
     reasons.push('离线模式不校验外链，也不上传图片。');
@@ -56,9 +56,8 @@ function getAssetStatus(options = {}) {
     cdnConfigured: valid,
     canUpload: online,
     uploadTarget: 'yida-attachment',
-    requiresLogin: false,
-    requiresAppType: false,
-    uploadRequirements: { requiresLogin: true, requiresAppType: true },
+    requiresLogin: true,
+    requiresAppType: true,
     canGenerate: generator.available,
     hostCapabilities,
     recommendedStrategy,

package/lib/asset/host-capabilities.js

@@ -1,13 +1,9 @@
 'use strict';
 
-const { getAssetExecutionContract, selectAssetExecutionMode } = require('./asset-execution');
-
 const CAPABILITY_ENV = Object.freeze({
   onlineSearch: 'OPENYIDA_AGENT_ONLINE_SEARCH',
   imageSearch: 'OPENYIDA_AGENT_IMAGE_SEARCH',
   imageGeneration: 'OPENYIDA_AGENT_IMAGE_GENERATION',
-  backgroundAgent: 'OPENYIDA_AGENT_BACKGROUND_AGENT',
-  backgroundShell: 'OPENYIDA_AGENT_BACKGROUND_SHELL',
 });
 
 function readDeclaredCapability(value) {
@@ -67,9 +63,7 @@ function buildHostAssetCapabilities(options = {}) {
   const onlineSearch = resolveCapability(env[CAPABILITY_ENV.onlineSearch], searchDefault());
   const imageSearch = resolveCapability(env[CAPABILITY_ENV.imageSearch], searchDefault());
   const imageGeneration = resolveCapability(env[CAPABILITY_ENV.imageGeneration], generationDefault);
-  const backgroundAgent = readDeclaredCapability(env[CAPABILITY_ENV.backgroundAgent]);
-  const backgroundShell = readDeclaredCapability(env[CAPABILITY_ENV.backgroundShell]);
-  const capabilities = [onlineSearch, imageSearch, imageGeneration, backgroundAgent, backgroundShell];
+  const capabilities = [onlineSearch, imageSearch, imageGeneration];
 
   return {
     schema_version: 1,
@@ -82,13 +76,10 @@ function buildHostAssetCapabilities(options = {}) {
     online_search: onlineSearch,
     image_search: imageSearch,
     image_generation: imageGeneration,
-    background_agent: backgroundAgent,
-    background_shell: backgroundShell,
-    execution: { selected_mode: selectAssetExecutionMode(backgroundAgent, backgroundShell), ...getAssetExecutionContract() },
     requires_host_tool_inventory_check: capabilities.some(item => item.status === 'unknown'),
     declaration_env: { ...CAPABILITY_ENV },
     detection_policy:
-      'Explicit declarations override runtime defaults. QwenWork provides image generation, and verified non-cloud runtimes provide online and image search. Managed-cloud or unknown runtimes use the host tool inventory. Background agent and shell execution are separate capabilities; neither is inferred from host name. Declarations must match actual nonblocking tool semantics.',
+      'Explicit declarations override runtime defaults. QwenWork provides image generation, and verified non-cloud runtimes provide online and image search. Managed-cloud or unknown runtimes use the host tool inventory.',
   };
 }
 

package/lib/asset/url-verify.js

@@ -43,12 +43,6 @@ function requestOnce(rawUrl, options = {}) {
         ...(method === 'GET' ? { Range: `bytes=0-${MAX_HEADER_BYTES - 1}` } : {}),
       },
     }, (res) => {
-      // Redirects and denied requests need no response-body download.
-      if (res.statusCode < 200 || res.statusCode >= 300) {
-        resolve({ status: res.statusCode || 0, headers: res.headers || {}, body: Buffer.alloc(0) });
-        res.destroy();
-        return;
-      }
       if (method !== 'GET') {
         resolve({ status: res.statusCode || 0, headers: res.headers || {}, body: Buffer.alloc(0) });
         return;
@@ -78,10 +72,7 @@ function requestOnce(rawUrl, options = {}) {
       });
       res.on('end', finish);
       res.on('error', reject);
-      res.on('aborted', () => reject(new Error('DOWNLOAD_ABORTED')));
     });
-    const timer = setTimeout(() => req.destroy(new Error('TIMEOUT')), timeout);
-    req.on('close', () => clearTimeout(timer));
     req.setTimeout(timeout, () => req.destroy(new Error('TIMEOUT')));
     req.on('error', reject);
     req.end();
@@ -89,12 +80,8 @@ function requestOnce(rawUrl, options = {}) {
 }
 
 async function requestFollow(rawUrl, options, depth = 0) {
-  if (options.allowUrl && !options.allowUrl(rawUrl)) {throw new Error('STOCK_PROVIDER_REDIRECT_NOT_ALLOWED');}
-  const timeout = options.deadline - Date.now();
-  if (timeout <= 0) {throw new Error('TIMEOUT');}
-  const response = await requestOnce(rawUrl, { ...options, timeout });
-  if (response.status >= 300 && response.status < 400 && response.headers.location) {
-    if (depth >= MAX_REDIRECTS) {throw new Error('TOO_MANY_REDIRECTS');}
+  const response = await requestOnce(rawUrl, options);
+  if (response.status >= 300 && response.status < 400 && response.headers.location && depth < MAX_REDIRECTS) {
     const next = new URL(response.headers.location, rawUrl).toString();
     return requestFollow(next, options, depth + 1);
   }
@@ -121,9 +108,7 @@ async function verifyImageUrl(rawUrl, options = {}) {
 
   let response;
   try {
-    response = await requestFollow(trimmed, {
-      method: 'GET', deadline: Date.now() + (options.timeout || DEFAULT_TIMEOUT), allowUrl: options.allowUrl,
-    });
+    response = await requestFollow(trimmed, { method: 'GET', timeout: options.timeout });
   } catch (error) {
     return { ...base, url: trimmed, reason: normalizeError(error) };
   }
@@ -180,7 +165,7 @@ async function verifyImageUrls(urls, options = {}) {
 
 function normalizeError(error) {
   const message = (error && error.message) || String(error);
-  if (['TIMEOUT', 'INVALID_URL', 'UNSUPPORTED_PROTOCOL', 'STOCK_PROVIDER_REDIRECT_NOT_ALLOWED', 'TOO_MANY_REDIRECTS', 'DOWNLOAD_ABORTED'].includes(message)) {return message;}
+  if (['TIMEOUT', 'INVALID_URL', 'UNSUPPORTED_PROTOCOL'].includes(message)) {return message;}
   return (error && error.code) || 'REQUEST_FAILED';
 }
 

package/lib/auth/dws-sync.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { DINGTALK_OAUTH_CLIENT_ID } = require('../core/env-manager');
+const { requestJson, resolveTokenBaseUrl, normalizeTokenResponse } = require('./token-auth');
+const { isEnvTokenAuthMode, hasEnvTokenCredential, saveDwsTokenSession } = require('./token-store');
+
+const FAILURE_STATUSES = new Set([
+  'dws_not_enabled', 'invalid_dws_token', 'unsupported_dws_source', 'insufficient_dws_scope',
+  'dws_identity_unmapped', 'dws_upstream_unavailable', 'dws_policy_rejected', 'dws_session_expired',
+]);
+
+function failure(reason) {
+  return new CliError(`DWS sync failed: ${reason}`, {
+    code: 'DWS_SYNC_FAILED', details: { reason },
+  });
+}
+
+function readHandoff(input = process.stdin, timeoutMs = 10000) {
+  return new Promise((resolve, reject) => {
+    if (input.isTTY) { reject(failure('STDIN_REQUIRED')); return; }
+    let chunks = [];
+    let size = 0;
+    const finish = (error, value) => {
+      clearTimeout(timer);
+      input.removeListener('data', onData);
+      input.removeListener('end', onEnd);
+      input.removeListener('error', onError);
+      input.pause();
+      chunks = [];
+      if (error) { reject(error); } else { resolve(value); }
+    };
+    const onData = (chunk) => {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      size += bytes.length;
+      if (size > 16384) { finish(failure('HANDOFF_TOO_LARGE')); return; }
+      chunks.push(bytes);
+    };
+    const onError = () => finish(failure('HANDOFF_READ_FAILED'));
+    const onEnd = () => {
+      let data;
+      try { data = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch {
+        finish(failure('INVALID_HANDOFF')); return;
+      }
+      if (!data || typeof data !== 'object' || Array.isArray(data)
+          || Object.keys(data).some((key) => !['accessToken', 'corpId', 'environment'].includes(key))
+          || typeof data.accessToken !== 'string' || !data.accessToken || data.accessToken.length > 8192
+          || (/\s/.test(data.accessToken) || [...data.accessToken].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+          || typeof data.corpId !== 'string' || !data.corpId || data.corpId.length > 256
+          || !['pre', 'prod'].includes(data.environment)) {
+        finish(failure('INVALID_HANDOFF')); return;
+      }
+      finish(null, data);
+    };
+    const timer = setTimeout(() => finish(failure('HANDOFF_TIMEOUT')), timeoutMs);
+    input.on('data', onData);
+    input.on('end', onEnd);
+    input.on('error', onError);
+  });
+}
+
+async function syncDws(options = {}) {
+  const env = options.env || process.env;
+  if (isEnvTokenAuthMode(env) || hasEnvTokenCredential(env)
+      || options.authProfile || options.profile || options.userId
+      || env.OPENYIDA_AUTH_PROFILE || env.OPENYIDA_AUTH_USER_ID || env.OPENYIDA_AUTH_CORP_ID) {
+    throw failure('AUTH_OVERRIDE_CONFLICT');
+  }
+  const clientId = options.clientId || env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
+  if (clientId !== DINGTALK_OAUTH_CLIENT_ID) { throw failure('CLIENT_CONFLICT'); }
+  const baseUrl = resolveTokenBaseUrl(options);
+  const target = new URL(baseUrl);
+  if (target.protocol !== 'https:' || target.username || target.password || target.search || target.hash
+      || target.pathname !== '/') { throw failure('TRUSTED_HTTPS_ORIGIN_REQUIRED'); }
+  const handoff = await readHandoff(options.input || process.stdin, options.stdinTimeoutMs);
+  if (options.corpId && options.corpId !== handoff.corpId) { throw failure('ORG_CONFLICT'); }
+  let response;
+  try {
+    response = await requestJson('POST', `${target.origin}/openapi/cli/v1/auth/dws/token`, {
+      corpId: handoff.corpId, environment: handoff.environment,
+    }, { Authorization: `Bearer ${handoff.accessToken}` }, { timeoutMs: 30000, maxResponseBytes: 65536 });
+  } catch {
+    throw failure('EXCHANGE_REQUEST_FAILED');
+  } finally {
+    delete handoff.accessToken;
+  }
+  const data = response && (response.data || response.content || response);
+  if (!data || response.success === false || response.ok === false || data.status !== 'ok') {
+    throw failure(data && FAILURE_STATUSES.has(data.status) ? data.status : 'EXCHANGE_REJECTED');
+  }
+  const session = normalizeTokenResponse(response, baseUrl, clientId);
+  const now = Date.now() / 1000;
+  if (typeof data.access_token !== 'string' || !data.access_token
+      || typeof data.refresh_token !== 'string' || !data.refresh_token
+      || data.client_id !== DINGTALK_OAUTH_CLIENT_ID || data.corp_id !== handoff.corpId
+      || typeof data.user_id !== 'string' || !data.user_id
+      || data.credential_source !== 'dws' || data.environment !== handoff.environment
+      || typeof data.session_id !== 'string' || !/^[a-f0-9-]{36}$/.test(data.session_id)
+      || !Number.isInteger(data.session_expires_at) || data.session_expires_at <= now
+      || !Number.isInteger(data.expires_in) || data.expires_in <= 0
+      || data.expires_in > data.session_expires_at - now + 2) {
+    throw failure('INVALID_EXCHANGE_RESPONSE');
+  }
+  const business = new URL(session.base_url);
+  // Token-bearing business requests must remain within this configured environment.
+  if (business.origin !== target.origin) { throw failure('ENVIRONMENT_MISMATCH'); }
+  delete session.raw;
+  delete session.message;
+  session.auth_base_url = target.origin;
+  session.credential_source = 'dws';
+  session.session_id = data.session_id;
+  session.session_expires_at = data.session_expires_at;
+  session.environment = data.environment;
+  let saved;
+  try {
+    saved = saveDwsTokenSession(session, options);
+  } catch {
+    // Best-effort revoke only the newly issued session; never touch an existing profile.
+    try {
+      await requestJson('POST', `${target.origin}/openapi/cli/v1/auth/logout`, {
+        refreshToken: session.refresh_token,
+      }, { Authorization: `Bearer ${session.access_token}` }, { timeoutMs: 10000, maxResponseBytes: 65536 });
+    } catch { /* The fixed server deadline still bounds an unreachable session. */ }
+    throw failure('PERSISTENCE_FAILED');
+  }
+  return { ok: true, status: 'ready', auth_profile: saved.auth_profile,
+    corp_id: saved.corp_id, user_id: saved.user_id };
+}
+
+async function run(args, options = {}) {
+  if (args.length === 2 && args.includes('--capabilities') && args.includes('--json')) {
+    const capabilities = { protocol_version: 1, private_stdin: true, independent_profile: true };
+    console.log(JSON.stringify(capabilities));
+    return capabilities;
+  }
+  if (!args.includes('--stdin') || !args.includes('--json')
+      || args.some((arg) => !['--stdin', '--json'].includes(arg))) {
+    throw failure('USE_AUTH_SYNC_DWS_STDIN_JSON');
+  }
+  const result = await syncDws(options);
+  console.log(JSON.stringify(result));
+  return result;
+}
+
+module.exports = { run, syncDws, readHandoff };

package/lib/auth/token-auth.js

@@ -25,6 +25,7 @@ const {
   resolveTokenSession,
   saveBusinessContext,
   saveTokenSession,
+  saveDwsTokenSession,
 } = require('./token-store');
 
 const DEFAULT_AUTH_PATH_PREFIX = '/openapi/cli/v1/auth';
@@ -83,7 +84,7 @@ function resolveDingtalkLoginOrigin(options = {}) {
   return DINGTALK_LOGIN_ORIGIN;
 }
 
-function requestJson(method, url, body, headers = {}) {
+function requestJson(method, url, body, headers = {}, options = {}) {
   return new Promise((resolve, reject) => {
     const parsedUrl = new URL(url);
     const data = body === undefined || body === null ? null : Buffer.from(JSON.stringify(body));
@@ -104,7 +105,16 @@ function requestJson(method, url, body, headers = {}) {
       },
     }, (response) => {
       const chunks = [];
-      response.on('data', (chunk) => chunks.push(chunk));
+      let size = 0;
+      response.on('error', reject);
+      response.on('data', (chunk) => {
+        size += chunk.length;
+        if (options.maxResponseBytes && size > options.maxResponseBytes) {
+          response.destroy(new Error('response_too_large'));
+          return;
+        }
+        chunks.push(chunk);
+      });
       response.on('end', () => {
         const text = Buffer.concat(chunks).toString('utf8');
         let payload = null;
@@ -132,6 +142,10 @@ function requestJson(method, url, body, headers = {}) {
       });
     });
 
+    if (options.timeoutMs > 0) {
+      const timer = setTimeout(() => request.destroy(new Error('request_timeout')), options.timeoutMs);
+      request.once('close', () => clearTimeout(timer));
+    }
     request.on('error', reject);
     if (data) {
       request.write(data);
@@ -368,6 +382,16 @@ function tokenStatus(options = {}) {
     }
     return status;
   }
+  if (session.credential_source === 'dws'
+      && (!Number.isInteger(session.session_expires_at) || session.session_expires_at <= Date.now() / 1000)) {
+    return {
+      ok: false, status: 'expired', can_auto_use: false, auth_mode: 'token',
+      auth_source: session.auth_source, auth_store: session.auth_store, auth_profile: session.auth_profile,
+      base_url: session.base_url, credential_source: 'dws', environment: session.environment,
+      session_expires_at: session.session_expires_at, corp_id: session.corp_id, user_id: session.user_id,
+      failure_reason: 'dws_session_expired',
+    };
+  }
   if (!session.access_token && session.refresh_token) {
     return {
       ok: true,
@@ -381,6 +405,9 @@ function tokenStatus(options = {}) {
       status: 'ok',
       can_auto_use: true,
       refresh_token: maskToken(session.refresh_token),
+      credential_source: session.credential_source,
+      environment: session.environment,
+      session_expires_at: session.session_expires_at,
       base_url: session.base_url,
       corp_id: session.corp_id,
       corp_name: session.corp_name,
@@ -404,6 +431,9 @@ function tokenStatus(options = {}) {
     access_token: maskToken(session.access_token),
     refresh_token: maskToken(session.refresh_token),
     expires_at: session.expires_at ? new Date(session.expires_at).toISOString() : undefined,
+    credential_source: session.credential_source,
+    environment: session.environment,
+    session_expires_at: session.session_expires_at,
     base_url: session.base_url,
     corp_id: session.corp_id,
     corp_name: session.corp_name,
@@ -427,17 +457,31 @@ async function tokenRefresh(options = {}) {
   // Token exchange follows the active environment endpoint, just like the
   // legacy login bootstrap. The response may return a different corp base_url
   // for business requests and generated application links.
-  const authBaseUrlValue = resolveTokenBaseUrl({
+  const authBaseUrlValue = (session.credential_source === 'dws' && session.auth_base_url) || resolveTokenBaseUrl({
     projectRoot: options.projectRoot,
     endpoint: options.endpoint,
   });
   const authBaseUrl = appendPath(authBaseUrlValue, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || session.client_id || DINGTALK_OAUTH_CLIENT_ID;
-  const response = await requestJson('POST', appendPath(authBaseUrl, '/refresh'), {
-    refreshToken: session.refresh_token,
-    clientId,
-  });
-  requireOkResponse(response);
+  let response;
+  if (session.credential_source === 'dws') {
+    try {
+      response = await requestJson('POST', appendPath(authBaseUrl, '/refresh'), {
+        refreshToken: session.refresh_token, clientId,
+      }, {}, { timeoutMs: 30000, maxResponseBytes: 65536 });
+      requireOkResponse(response);
+    } catch (error) {
+      if (isRefreshAuthRequired(error)) {
+        throw createTokenAuthRequiredError('invalid_refresh_token');
+      }
+      throw createTokenRefreshFailedError('refresh_request_failed');
+    }
+  } else {
+    response = await requestJson('POST', appendPath(authBaseUrl, '/refresh'), {
+      refreshToken: session.refresh_token, clientId,
+    });
+    requireOkResponse(response);
+  }
   const data = getTokenPayload(response);
   const responseBusinessBaseUrl = data.base_url || data.baseUrl;
   const businessBaseUrl = session.base_url || authBaseUrlValue;
@@ -450,6 +494,9 @@ async function tokenRefresh(options = {}) {
     refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
   }, businessBaseUrl, clientId);
   if (!normalized.access_token) {
+    if (session.credential_source === 'dws') {
+      throw createTokenRefreshFailedError('refresh_response_invalid');
+    }
     return {
       ...normalized,
       ok: false,
@@ -458,6 +505,23 @@ async function tokenRefresh(options = {}) {
       message: normalized.message || 'auth service did not return access_token',
     };
   }
+  if (session.credential_source === 'dws') {
+    if (normalized.corp_id !== session.corp_id || normalized.user_id !== session.user_id
+        || data.client_id !== session.client_id || data.credential_source !== 'dws'
+        || data.session_id !== session.session_id || data.session_expires_at !== session.session_expires_at
+        || data.environment !== session.environment || !data.refresh_token
+        || normalized.base_url !== session.base_url
+        || !Number.isInteger(data.expires_in) || data.expires_in <= 0
+        || data.expires_in > session.session_expires_at - Date.now() / 1000 + 2) {
+      throw createTokenAuthRequiredError('dws_refresh_identity_mismatch');
+    }
+    delete normalized.raw;
+    delete normalized.message;
+    return saveDwsTokenSession({ ...normalized, credential_source: 'dws',
+      auth_base_url: session.auth_base_url, session_id: session.session_id,
+      session_expires_at: session.session_expires_at, environment: session.environment,
+    }, { ...options, bindProject: false });
+  }
   if (responseBusinessBaseUrl && normalized.corp_id) {
     try {
       saveBusinessContext({
@@ -492,7 +556,7 @@ async function revokeTokenSession(session) {
     return;
   }
   try {
-    await requestJson('POST', appendPath(appendPath(session.base_url, DEFAULT_AUTH_PATH_PREFIX), '/logout'), {
+    await requestJson('POST', appendPath(appendPath(session.auth_base_url || session.base_url, DEFAULT_AUTH_PATH_PREFIX), '/logout'), {
       refreshToken: session.refresh_token,
     }, session.access_token ? {
       authorization: `${session.token_type || 'Bearer'} ${session.access_token}`,

package/lib/auth/token-store.js

@@ -290,6 +290,11 @@ function normalizeTokenSession(session = {}) {
     open_user_id: session.open_user_id || session.openUserId,
     scope: session.scope,
     last_used_at: session.last_used_at || session.lastUsedAt || session.updated_at || session.updatedAt,
+    credential_source: session.credential_source,
+    session_id: session.session_id,
+    session_expires_at: session.session_expires_at,
+    environment: session.environment,
+    auth_base_url: session.auth_base_url,
     auth_source: session.auth_source || session.authSource,
     auth_store: session.auth_store || session.authStore,
     auth_profile: session.auth_profile || session.authProfile,
@@ -594,6 +599,50 @@ function saveUserTokenSession(session, options = {}) {
   return profileSession;
 }
 
+function saveDwsTokenSession(session, options = {}) {
+  const normalized = normalizeTokenSession(session);
+  const identity = buildAuthProfileIdentity(normalized);
+  if (!identity || normalized.credential_source !== 'dws' || !normalized.session_id
+      || !normalized.auth_base_url || !normalized.refresh_token) {
+    throw new Error('dws_profile_incomplete');
+  }
+  // Isolate independent login and each server-side DWS session, including same user/corp.
+  const authProfile = crypto.createHash('sha256').update(JSON.stringify({
+    ...identity, credential_source: 'dws', session_id: normalized.session_id,
+    auth_base_url: normalized.auth_base_url,
+  })).digest('hex').slice(0, 32);
+  const saved = normalizeTokenSession({ ...normalized, auth_profile: authProfile,
+    auth_source: 'user_profile', auth_store: 'user', persistence_scope: 'user' });
+  const file = getUserProfileFilePath(authProfile, options);
+  const previous = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : null;
+  const previousPointer = loadAuthProfilePointer(options);
+  try {
+    writeJsonFileAtomic(file, saved);
+    const readback = loadUserProfileFile(authProfile, options);
+    if (!readback || readback.access_token !== saved.access_token || readback.refresh_token !== saved.refresh_token) {
+      throw new Error('dws_profile_readback_failed');
+    }
+    // Refresh a pinned running command's session without switching a newer project binding.
+    if (options.bindProject !== false) {
+      saveAuthProfilePointer(saved, options);
+      const effective = loadTokenSession(options);
+      if (!effective || effective.auth_profile !== authProfile || effective.access_token !== saved.access_token) {
+        throw new Error('dws_binding_readback_failed');
+      }
+    }
+    return saved;
+  } catch (error) {
+    const current = loadAuthProfilePointer(options);
+    if (current && current.auth_profile === authProfile) {
+      if (previousPointer) { writeJsonFileAtomic(getAuthProfilePointerFilePath(options), previousPointer); }
+      else { clearAuthProfilePointer(options); }
+    }
+    if (previous) { writeJsonFileAtomic(file, previous); }
+    else if (fs.existsSync(file)) { fs.unlinkSync(file); }
+    throw error;
+  }
+}
+
 function saveTokenSession(session, options = {}) {
   const env = options.env || process.env;
   const normalized = normalizeTokenSession(session);
@@ -995,6 +1044,7 @@ module.exports = {
   loadTokenSession,
   resolveTokenSession,
   saveTokenSession,
+  saveDwsTokenSession,
   loadBusinessContext,
   saveBusinessContext,
   loadAuthProfilePointer,