openyida 2026.9.22-beta.1 → 2026.9.22-beta.3

package/lib/auth/dws-sync.js

@@ -10,12 +10,19 @@ const FAILURE_STATUSES = new Set([
   'dws_identity_unmapped', 'dws_upstream_unavailable', 'dws_policy_rejected', 'dws_session_expired',
 ]);
 
-function failure(reason) {
+function failure(reason, extra = {}) {
   return new CliError(`DWS sync failed: ${reason}`, {
-    code: 'DWS_SYNC_FAILED', details: { reason },
+    code: 'DWS_SYNC_FAILED', details: { reason, ...extra },
   });
 }
 
+function rateLimitFailure(response, headers = {}) {
+  const data = response && (response.data || response.content || response);
+  if (!data || !['dws_rate_limited', 'dws_rate_limit_unavailable'].includes(data.status)) { return null; }
+  const delay = Number(data.retry_after ?? headers['retry-after']);
+  return failure(data.status, { retry_after: Number.isInteger(delay) && delay > 0 && delay <= 60 ? delay : 1 });
+}
+
 function readHandoff(input = process.stdin, timeoutMs = 10000) {
   return new Promise((resolve, reject) => {
     if (input.isTTY) { reject(failure('STDIN_REQUIRED')); return; }
@@ -46,7 +53,7 @@ function readHandoff(input = process.stdin, timeoutMs = 10000) {
           || Object.keys(data).some((key) => !['accessToken', 'corpId', 'environment'].includes(key))
           || typeof data.accessToken !== 'string' || !data.accessToken || data.accessToken.length > 8192
           || (/\s/.test(data.accessToken) || [...data.accessToken].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
-          || typeof data.corpId !== 'string' || !data.corpId || data.corpId.length > 256
+          || (data.corpId !== undefined && (typeof data.corpId !== 'string' || !data.corpId.trim() || data.corpId.length > 256))
           || !['pre', 'prod'].includes(data.environment)) {
         finish(failure('INVALID_HANDOFF')); return;
       }
@@ -73,17 +80,20 @@ async function syncDws(options = {}) {
   if (target.protocol !== 'https:' || target.username || target.password || target.search || target.hash
       || target.pathname !== '/') { throw failure('TRUSTED_HTTPS_ORIGIN_REQUIRED'); }
   const handoff = await readHandoff(options.input || process.stdin, options.stdinTimeoutMs);
-  if (options.corpId && options.corpId !== handoff.corpId) { throw failure('ORG_CONFLICT'); }
+  if (options.corpId && handoff.corpId && options.corpId !== handoff.corpId) { throw failure('ORG_CONFLICT'); }
+  const expectedCorp = options.corpId || handoff.corpId;
   let response;
   try {
     response = await requestJson('POST', `${target.origin}/openapi/cli/v1/auth/dws/token`, {
-      corpId: handoff.corpId, environment: handoff.environment,
+      ...(expectedCorp ? { corpId: expectedCorp } : {}), environment: handoff.environment,
     }, { Authorization: `Bearer ${handoff.accessToken}` }, { timeoutMs: 30000, maxResponseBytes: 65536 });
-  } catch {
-    throw failure('EXCHANGE_REQUEST_FAILED');
+  } catch (error) {
+    throw rateLimitFailure(error && error.payload, (error && error.headers) || {}) || failure('EXCHANGE_REQUEST_FAILED');
   } finally {
     delete handoff.accessToken;
   }
+  const limited = rateLimitFailure(response);
+  if (limited) { throw limited; }
   const data = response && (response.data || response.content || response);
   if (!data || response.success === false || response.ok === false || data.status !== 'ok') {
     throw failure(data && FAILURE_STATUSES.has(data.status) ? data.status : 'EXCHANGE_REJECTED');
@@ -92,7 +102,9 @@ async function syncDws(options = {}) {
   const now = Date.now() / 1000;
   if (typeof data.access_token !== 'string' || !data.access_token
       || typeof data.refresh_token !== 'string' || !data.refresh_token
-      || data.client_id !== DINGTALK_OAUTH_CLIENT_ID || data.corp_id !== handoff.corpId
+      || data.client_id !== DINGTALK_OAUTH_CLIENT_ID
+      || typeof data.corp_id !== 'string' || !data.corp_id.trim()
+      || (expectedCorp && data.corp_id !== expectedCorp)
       || typeof data.user_id !== 'string' || !data.user_id
       || data.credential_source !== 'dws' || data.environment !== handoff.environment
       || typeof data.session_id !== 'string' || !/^[a-f0-9-]{36}$/.test(data.session_id)
@@ -129,7 +141,7 @@ async function syncDws(options = {}) {
 
 async function run(args, options = {}) {
   if (args.length === 2 && args.includes('--capabilities') && args.includes('--json')) {
-    const capabilities = { protocol_version: 1, private_stdin: true, independent_profile: true };
+    const capabilities = { protocol_version: 1, private_stdin: true, independent_profile: true, server_identity: true };
     console.log(JSON.stringify(capabilities));
     return capabilities;
   }

package/lib/core/agent-capabilities.js

@@ -96,7 +96,9 @@ function compactSkillsDiagnostics(skillsDiagnostics) {
       reason: candidate.reason,
       exists: candidate.exists,
       writable: candidate.writable,
+      readable: candidate.readable,
       usable: candidate.usable,
+      installable: candidate.installable,
       workspace_only: candidate.workspace_only,
     }
     : null;
@@ -105,6 +107,7 @@ function compactSkillsDiagnostics(skillsDiagnostics) {
     schema_version: skillsDiagnostics.schema_version,
     active_tool: skillsDiagnostics.active_tool,
     selected: compactCandidate(skillsDiagnostics.selected),
+    install_target: compactCandidate(skillsDiagnostics.install_target),
     candidates: (skillsDiagnostics.candidates || []).map(compactCandidate),
     diagnostics: skillsDiagnostics.diagnostics || {},
   };

package/lib/core/copy.js

@@ -390,7 +390,7 @@ function run(args = process.argv.slice(3)) {
     // 若宿主用户级目录不可写，按 capabilities 诊断降级到工作区可发现目录。
     const activeResult = envResults.find((r) => r.isActive);
     const skillsDiagnostics = buildSkillsDiagnostics({ ...runtimeOptions, projectResolution });
-    const selectedSkills = skillsDiagnostics.selected;
+    const selectedSkills = skillsDiagnostics.install_target;
 
     if (selectedSkills && selectedSkills.path) {
       assertCopyDestinationSafe(packageYidaSkillsDir, selectedSkills.path);

package/lib/core/utils.js

@@ -670,6 +670,14 @@ function buildSkillsCandidate(destPath, source, scope, reason) {
   const parentDir = path.dirname(destPath);
   const nearestWritableBase = nearestExistingAncestor(parentDir);
   const writable = canWritePath(destPath);
+  const entryPath = path.join(destPath, 'SKILL.md');
+  let readable = false;
+  try {
+    readable = fs.statSync(entryPath).isFile();
+    fs.accessSync(entryPath, fs.constants.R_OK);
+  } catch {
+    readable = false;
+  }
   return {
     path: destPath,
     source,
@@ -680,7 +688,9 @@ function buildSkillsCandidate(destPath, source, scope, reason) {
     parent_exists: fs.existsSync(parentDir),
     nearest_existing_parent: nearestWritableBase,
     writable,
-    usable: writable,
+    readable,
+    usable: readable,
+    installable: scope !== 'package' && writable,
     workspace_only: scope === 'workspace',
   };
 }
@@ -787,7 +797,13 @@ function buildSkillsDiagnostics(options = {}) {
     );
   }
 
-  const selected = candidates.find((candidate) => candidate.usable) || candidates[0] || null;
+  // Bundled documentation is a read fallback, never an installation destination.
+  addCandidate(
+    options.bundledSkillsPath || path.resolve(__dirname, '../../yida-skills'),
+    'package:yida-skills', 'package', 'bundled_skills_read_fallback'
+  );
+  const selected = candidates.find((candidate) => candidate.usable) || null;
+  const installTarget = candidates.find((candidate) => candidate.installable) || null;
   const diagnostics = {
     config_content_error: configSkillPaths.error,
     fallback: selected && selected.workspace_only
@@ -808,6 +824,7 @@ function buildSkillsDiagnostics(options = {}) {
       }
       : null,
     selected,
+    install_target: installTarget,
     candidates,
     diagnostics,
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.9.22-beta.1",
+  "version": "2026.9.22-beta.3",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",