openyida 2026.9.23 → 2026.9.24-beta.0

package/README.md

@@ -74,10 +74,17 @@ openyida login
 
 OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the user auth store when available. If the user auth store is not writable, OpenYida explicitly falls back to the current project cache and reports that narrower persistence scope.
 
+In a sandbox, headless shell, or CI dashboard where the loopback callback cannot complete, use the device authorization flow. Open the displayed verification URL on any device and enter the user code. `--env-hint` optionally pins the intended environment profile at authorization time:
+
+```bash
+openyida login --device
+openyida login --device --env-hint pre
+```
+
 When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and auth profile. For example:
 
 ```bash
-openyida login https://yida-group.alibaba-inc.com/
+openyida login https://<your-yida-entry-url>/
 openyida login --alibaba
 ```
 
@@ -383,7 +390,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
 | `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |

package/bin/yida.js

@@ -193,6 +193,7 @@ function printLoginResult(result) {
 
   if (!result) {
     console.log(JSON.stringify({
+      type: 'login_result',
       ok: false,
       status: 'login_failed',
       can_auto_use: false,
@@ -205,6 +206,7 @@ function printLoginResult(result) {
     ? !!result.ok
     : (result.can_auto_use !== false && !!result.access_token);
   const summary = {
+    type: 'login_result',
     ok: tokenUsable,
     status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
     auth_mode: 'token',
@@ -279,6 +281,7 @@ function getFirstPositionalArg(cliArgs, startIndex = 0) {
     '--login-url',
     '--profile',
     '--user-id',
+    '--env-hint',
   ]);
   for (let index = startIndex; index < cliArgs.length; index++) {
     const arg = cliArgs[index];
@@ -386,6 +389,7 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--client-id',
     '--profile',
     '--user-id',
+    '--env-hint',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -537,13 +541,23 @@ function printLoginHelp() {
 }
 
 function buildTokenLoginOptions(loginArgs) {
+  const device = loginArgs.includes('--device');
   return {
     clientId: getArgValue(loginArgs, '--client-id'),
     corpId: getArgValue(loginArgs, '--corp-id'),
     userId: getArgValue(loginArgs, '--user-id'),
     authProfile: getArgValue(loginArgs, '--profile'),
     quiet: process.env.YIDA_QUIET === '1' || loginArgs.includes('--quiet'),
-    noBrowser: loginArgs.includes('--no-browser'),
+    noBrowser: device || loginArgs.includes('--no-browser'),
+    device,
+    envHint: getArgValue(loginArgs, '--env-hint'),
+    // Machine-readable progress events for agent runtimes (sandbox browsers,
+    // CI dashboards). Emits one JSON line per state transition.
+    onDeviceState: (state) => {
+      if (device) {
+        process.stdout.write(JSON.stringify({ type: 'device_login_state', ...state }) + '\n');
+      }
+    },
   };
 }
 

package/lib/auth/oauth-device.js

@@ -0,0 +1,311 @@
+/**
+ * oauth-device.js - Device Authorization Grant (RFC 8628) flow.
+ *
+ * Enables headless / sandbox login: the CLI requests a device code from the
+ * auth service, the user completes authorization on ANY device (phone,
+ * another browser, CI dashboard), and the CLI polls until tokens are issued.
+ *
+ * The /device/* endpoints use a unified camelCase contract (deviceCode,
+ * userCode, verificationUri, grantType, accessToken, ...) matching the
+ * tianshu CliAuthRpc device endpoints. Legacy CLI token endpoints
+ * (/dingtalk/token, /refresh, /status) keep their snake_case contract and are
+ * not handled here.
+ *
+ * Machine-facing state events (onState):
+ * every callback receives a plain object with a camelCase `state` field plus
+ * state-specific camelCase fields, so agent runtimes can parse one schema:
+ *   { state: 'awaiting_verification', verificationUri, verificationUriComplete,
+ *     userCode, expiresIn, interval }
+ *   { state: 'pending', nextPollMs }               (heartbeat, every poll cycle)
+ *   { state: 'slow_down', intervalMs }
+ *   { state: 'poll_retry', statusCode, body }      (transient unrecognized error)
+ *
+ * Reuses the same token normalization / profile persistence pipeline as the
+ * loopback flow in oauth-loopback.js.
+ */
+
+const { requestJson, getTokenPayload } = require('./token-auth');
+const { redactString } = require('../core/redact');
+const { t } = require('../core/i18n');
+
+const DEVICE_CODE_PATH = '/device/code';
+const DEVICE_TOKEN_PATH = '/device/token';
+const DEFAULT_DEVICE_TIMEOUT_MS = 10 * 60 * 1000; // device codes are usually valid 10 minutes
+const DEFAULT_POLL_INTERVAL_MS = 5 * 1000;
+const SLOW_DOWN_EXTRA_DELAY_MS = 5 * 1000;
+
+const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+
+function createDeviceTimeoutError() {
+  const timeout = new Error(t('login.device_timeout'));
+  timeout.code = 'device_timeout';
+  return timeout;
+}
+
+function assertBeforeDeadline(deadline) {
+  if (Date.now() >= deadline) {
+    throw createDeviceTimeoutError();
+  }
+}
+
+function positiveNumber(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+function errorDescription(payload) {
+  return payload.errorDescription || payload.error_description || payload.errorMsg
+    || payload.error_msg || payload.message || payload.raw || '';
+}
+
+/**
+ * Request a device code from the auth service.
+ *
+ * @param {object} options
+ * @param {string} options.authBaseUrl - e.g. https://<entry-host>/openapi/cli/v1/auth
+ * @param {string} options.clientId
+ * @param {string} [options.scope] - defaults handled by caller
+ * @param {string} [options.envHint] - environment name to pin the token audience
+ * @param {string} [options.timeoutMs] - overall flow timeout
+ * @returns {Promise<{deviceCode, userCode, verificationUri,
+ *   verificationUriComplete, expiresIn, interval}>}
+ */
+async function requestDeviceCode(options = {}) {
+  const { authBaseUrl, clientId } = options;
+  if (!authBaseUrl || !clientId) {
+    throw new Error(t('login.device_missing_params'));
+  }
+  const body = { clientId };
+  if (options.scope) { body.scope = options.scope; }
+  if (options.envHint) { body.envHint = options.envHint; }
+
+  const deadline = positiveNumber(
+    options.deadline,
+    Date.now() + positiveNumber(options.timeoutMs, DEFAULT_DEVICE_TIMEOUT_MS)
+  );
+  assertBeforeDeadline(deadline);
+  const remainingMs = Math.max(1, deadline - Date.now());
+  let response;
+  try {
+    response = await requestJson(
+      'POST',
+      `${authBaseUrl}${DEVICE_CODE_PATH}`,
+      body,
+      {},
+      { timeoutMs: remainingMs }
+    );
+  } catch (error) {
+    if (error.code === 'request_timeout') {
+      throw createDeviceTimeoutError();
+    }
+    throw error;
+  }
+  const payload = getTokenPayload(response);
+  if (!payload.deviceCode || !payload.userCode || !payload.verificationUri) {
+    const message = payload.message || payload.errorDescription || payload.errorMsg
+      || t('login.device_invalid_code_response');
+    const error = new Error(message);
+    error.payload = payload;
+    throw error;
+  }
+  return payload;
+}
+
+/**
+ * Poll the token endpoint until the device flow completes.
+ *
+ * @param {object} options
+ * @param {string} options.authBaseUrl
+ * @param {string} options.clientId
+ * @param {string} options.deviceCode
+ * @param {number} [options.intervalMs] - from /device/code response
+ * @param {number} [options.timeoutMs] - overall wall clock budget
+ * @param {number} [options.deadline] - absolute wall clock deadline
+ * @param {(state: object) => void} [options.onState] - progress callback for agents
+ * @returns {Promise<object>} token payload (accessToken, refreshToken, ...)
+ */
+async function pollDeviceToken(options = {}) {
+  const { authBaseUrl, clientId, deviceCode } = options;
+  if (!authBaseUrl || !clientId || !deviceCode) {
+    throw new Error(t('login.device_poll_missing_params'));
+  }
+  const intervalMs = Math.max(1, positiveNumber(options.intervalMs, DEFAULT_POLL_INTERVAL_MS));
+  const deadline = positiveNumber(
+    options.deadline,
+    Date.now() + positiveNumber(options.timeoutMs, DEFAULT_DEVICE_TIMEOUT_MS)
+  );
+  let currentInterval = intervalMs;
+
+  // First poll immediately, then honor the interval.
+  for (;;) {
+    assertBeforeDeadline(deadline);
+    const remainingMs = Math.max(1, deadline - Date.now());
+    let response;
+    try {
+      response = await requestJson('POST', `${authBaseUrl}${DEVICE_TOKEN_PATH}`, {
+        grantType: DEVICE_GRANT_TYPE,
+        deviceCode: deviceCode,
+        clientId: clientId,
+      }, {}, { timeoutMs: remainingMs });
+    } catch (error) {
+      if (error.code === 'request_timeout') {
+        throw createDeviceTimeoutError();
+      }
+      const payload = error.payload || {};
+      const errorCode = payload.error || payload.errorCode || payload.error_msg || payload.errorMsg;
+      if (errorCode === 'authorization_pending') {
+        await waitFor(deadline, currentInterval, options);
+        continue;
+      }
+      if (errorCode === 'slow_down') {
+        currentInterval += SLOW_DOWN_EXTRA_DELAY_MS;
+        if (options.onState) {
+          options.onState({ state: 'slow_down', intervalMs: currentInterval });
+        }
+        await waitFor(deadline, currentInterval, options);
+        continue;
+      }
+      if (errorCode === 'expired_token') {
+        const expired = new Error(t('login.device_code_expired'));
+        expired.code = 'device_code_expired';
+        throw expired;
+      }
+      if (errorCode === 'access_denied') {
+        const denied = new Error(t('login.device_access_denied'));
+        denied.code = 'device_access_denied';
+        throw denied;
+      }
+      if (errorCode) {
+        // RFC 8628 only permits polling to continue for
+        // authorization_pending and slow_down. Preserve the server's
+        // permanent OAuth error so callers can diagnose it immediately.
+        error.code = String(errorCode);
+        const description = errorDescription(payload);
+        if (description) { error.message = String(description); }
+        throw error;
+      }
+      if (error.statusCode === 400 || error.statusCode === 429) {
+        // Unstructured 400/429 bodies can be produced by gateways. Retry
+        // those transient shapes, while the OAuth errors above remain
+        // terminal unless the RFC explicitly permits continued polling.
+        if (options.onState) {
+          options.onState({
+            state: 'poll_retry',
+            statusCode: error.statusCode,
+            body: redactString(String(errorDescription(payload)).slice(0, 200)),
+          });
+        }
+        await waitFor(deadline, currentInterval, options);
+        continue;
+      }
+      throw error;
+    }
+
+    const payload = getTokenPayload(response);
+    if (!payload.accessToken && !payload.access_token) {
+      // 2xx without a token is unexpected; surface raw payload for diagnosis.
+      const invalid = new Error(t('login.device_2xx_no_token'));
+      invalid.payload = payload;
+      throw invalid;
+    }
+    return payload;
+  }
+}
+
+function waitFor(deadline, intervalMs, options) {
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) {
+    throw createDeviceTimeoutError();
+  }
+  if (options && options.onState) {
+    options.onState({ state: 'pending', nextPollMs: Math.min(intervalMs, remaining) });
+  }
+  return new Promise((resolve) => setTimeout(resolve, Math.min(intervalMs, remaining)));
+}
+
+/**
+ * Run the full device code flow and return a token payload for
+ * normalizeTokenResponse(). Designed to be called from tokenLogin().
+ *
+ * @param {object} options - same option bag as tokenLogin plus:
+ *   options.authBaseUrl  resolved auth base (with /openapi/cli/v1/auth prefix)
+ *   options.envHint      environment name to pin audience
+ *   options.quiet        suppress human-oriented stderr
+ *   options.onState      optional machine-readable progress callback
+ */
+async function runDeviceCodeFlow(options = {}) {
+  const flowDeadline = Date.now()
+    + positiveNumber(options.timeoutMs, DEFAULT_DEVICE_TIMEOUT_MS);
+  const code = await requestDeviceCode({
+    ...options,
+    deadline: flowDeadline,
+  });
+
+  // The server may return verification URIs as absolute paths (e.g.
+  // /openapi/cli/v1/auth/device/verify); resolve them against the business
+  // base URL so users and agent hosts get clickable links.
+  const resolveUrl = (value) => {
+    if (!value || /^https?:\/\//i.test(value)) {
+      return value;
+    }
+    try {
+      const origin = new URL(options.baseUrl || options.authBaseUrl).origin;
+      return new URL(value, origin).toString();
+    } catch {
+      return value;
+    }
+  };
+  const verificationUri = resolveUrl(code.verificationUri);
+  const verificationUriComplete = resolveUrl(code.verificationUriComplete);
+
+  const intro = [
+    '',
+    t('login.device_title'),
+    `  1. ${t('login.device_open')} ${verificationUri}`,
+    `  2. ${t('login.device_enter_code')} ${code.userCode}`,
+    '',
+  ];
+  if (verificationUriComplete) {
+    intro.push(`  ${t('login.device_or_direct')} ${verificationUriComplete}`, '');
+  }
+  if (!options.quiet) {
+    process.stderr.write(intro.join('\n') + '\n');
+  }
+
+  if (options.onState) {
+    options.onState({
+      state: 'awaiting_verification',
+      verificationUri: verificationUri,
+      verificationUriComplete: verificationUriComplete,
+      userCode: code.userCode,
+      expiresIn: code.expiresIn,
+      interval: code.interval,
+    });
+  }
+
+  const tokenPayload = await pollDeviceToken({
+    authBaseUrl: options.authBaseUrl,
+    clientId: options.clientId,
+    deviceCode: code.deviceCode,
+    intervalMs: (code.interval || 5) * 1000,
+    deadline: Math.min(
+      flowDeadline,
+      Date.now() + positiveNumber(code.expiresIn, 600) * 1000
+    ),
+    onState: options.onState,
+  });
+
+  if (!options.quiet) {
+    process.stderr.write(t('login.device_completed') + '\n');
+  }
+  return tokenPayload;
+}
+
+module.exports = {
+  runDeviceCodeFlow,
+  requestDeviceCode,
+  pollDeviceToken,
+  DEVICE_CODE_PATH,
+  DEVICE_TOKEN_PATH,
+  DEVICE_GRANT_TYPE,
+};

package/lib/auth/token-auth.js

@@ -83,11 +83,27 @@ function resolveDingtalkLoginOrigin(options = {}) {
   return DINGTALK_LOGIN_ORIGIN;
 }
 
-function requestJson(method, url, body, headers = {}) {
+function requestJson(method, url, body, headers = {}, options = {}) {
   return new Promise((resolve, reject) => {
     const parsedUrl = new URL(url);
     const data = body === undefined || body === null ? null : Buffer.from(JSON.stringify(body));
     const transport = parsedUrl.protocol === 'https:' ? https : http;
+    const socketTimeoutMs = positiveNumber(options.timeoutMs, 0);
+    let timeoutId = null;
+    let settled = false;
+    const finish = (callback, value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timeoutId) {
+        clearTimeout(timeoutId);
+      }
+      callback(value);
+    };
+    const resolveOnce = value => finish(resolve, value);
+    const rejectOnce = error => finish(reject, error);
+
     const request = transport.request({
       method,
       protocol: parsedUrl.protocol,
@@ -105,6 +121,7 @@ function requestJson(method, url, body, headers = {}) {
     }, (response) => {
       const chunks = [];
       response.on('data', (chunk) => chunks.push(chunk));
+      response.on('error', rejectOnce);
       response.on('end', () => {
         const text = Buffer.concat(chunks).toString('utf8');
         let payload = null;
@@ -125,14 +142,26 @@ function requestJson(method, url, body, headers = {}) {
           error.payload = payload;
           error.headers = response.headers;
           error.location = location;
-          reject(error);
+          rejectOnce(error);
           return;
         }
-        resolve(payload || {});
+        resolveOnce(payload || {});
       });
     });
 
-    request.on('error', reject);
+    if (socketTimeoutMs > 0) {
+      // Node's socket timeout is reset by network activity, so it cannot enforce
+      // the caller's wall-clock budget. Use an independent timer that also
+      // covers response bodies which trickle data without ever completing.
+      timeoutId = setTimeout(() => {
+        const error = new Error('request timed out');
+        error.code = 'request_timeout';
+        rejectOnce(error);
+        request.destroy(error);
+      }, socketTimeoutMs);
+    }
+
+    request.on('error', rejectOnce);
     if (data) {
       request.write(data);
     }
@@ -140,6 +169,11 @@ function requestJson(method, url, body, headers = {}) {
   });
 }
 
+function positiveNumber(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
 function sanitizeRawTokenResponse(response) {
   if (!response || typeof response !== 'object') {
     return response;
@@ -302,25 +336,43 @@ async function tokenLogin(options = {}) {
   const baseUrl = resolveTokenBaseUrl(options);
   const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
-  const callback = await runDingtalkLoopback({
-    clientId,
-    loginOrigin: resolveDingtalkLoginOrigin(options),
-    scope: options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid',
-    prompt: options.prompt,
-    port: options.port,
-    quiet: options.quiet,
-    noBrowser: options.noBrowser,
-    timeoutMs: options.timeoutMs,
-  });
+  const scope = options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid';
+
+  let response;
+  if (options.device) {
+    // Device Authorization Grant (RFC 8628): sandbox / headless login.
+    const { runDeviceCodeFlow } = require('./oauth-device');
+    response = await runDeviceCodeFlow({
+      authBaseUrl,
+      clientId,
+      scope,
+      envHint: options.envHint,
+      quiet: options.quiet,
+      onState: options.onDeviceState,
+      timeoutMs: options.timeoutMs || env.OPENYIDA_OAUTH_TIMEOUT_MS,
+    });
+    requireOkResponse(response);
+  } else {
+    const callback = await runDingtalkLoopback({
+      clientId,
+      loginOrigin: resolveDingtalkLoginOrigin(options),
+      scope,
+      prompt: options.prompt,
+      port: options.port,
+      quiet: options.quiet,
+      noBrowser: options.noBrowser,
+      timeoutMs: options.timeoutMs,
+    });
 
-  const response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
-    code: callback.code,
-    authCode: callback.authCode,
-    redirectUri: callback.redirectUri,
-    state: callback.state,
-    clientId,
-  });
-  requireOkResponse(response);
+    response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
+      code: callback.code,
+      authCode: callback.authCode,
+      redirectUri: callback.redirectUri,
+      state: callback.state,
+      clientId,
+    });
+    requireOkResponse(response);
+  }
 
   const normalized = normalizeTokenResponse(response, baseUrl, clientId);
   if (!normalized.access_token) {
@@ -624,4 +676,5 @@ module.exports = {
   resolveTokenBaseUrl,
   isRefreshAuthRequired,
   createTokenRefreshFailedError,
+  getTokenPayload,
 };

package/lib/core/command-manifest.js

@@ -1035,7 +1035,7 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', {
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]', 'help.cmd_login', {
         requiresLogin: false,
         output: 'json',
       }),

package/lib/core/locales/en.js

@@ -382,8 +382,8 @@ Examples:
     save_permission_usage: 'Usage: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>]',
     save_permission_example: "Example: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ Execution failed: {0}',
-    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
-    login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
+    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--device] [--env-hint <name>] [--check-only] [--json] [--client-id <clientId>]',
+    login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --device                # Use device authorization in a headless environment\n  openyida login --device --env-hint pre # Pin device authorization to an environment profile\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
     login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
     auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
     auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
@@ -655,6 +655,18 @@ Examples:
     oauth_success_message: 'Sign-in is complete. Return to the previous window to continue.',
     oauth_closing: 'Closing this window automatically…',
     oauth_manual_close: 'This window could not close automatically. Close it manually, then return to the previous window to continue.',
+    device_title: 'Device code login:',
+    device_open: 'Open',
+    device_enter_code: 'Enter code:',
+    device_or_direct: 'Or open directly:',
+    device_completed: 'Device authorization completed.',
+    device_timeout: 'device authorization timed out; device code may still be pending',
+    device_missing_params: 'device code flow requires authBaseUrl and clientId',
+    device_poll_missing_params: 'device token polling requires authBaseUrl, clientId and deviceCode',
+    device_invalid_code_response: 'auth service did not return a usable device code',
+    device_code_expired: 'device code expired; run login --device again',
+    device_access_denied: 'authorization was denied on the verification page',
+    device_2xx_no_token: 'auth service returned 2xx without accessToken',
     oauth_failure_title: 'Sign-in not completed',
     oauth_invalid_state: 'The sign-in request could not be verified. Return to the terminal and try again.',
     oauth_missing_code: 'No authorization information was received. Return to the terminal and try again.',

package/lib/core/locales/zh.js

@@ -382,8 +382,8 @@ openyida - 宜搭命令行工具
     save_permission_usage: '用法: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>]',
     save_permission_example: "示例: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ 执行失败: {0}',
-    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
-    login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
+    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--device] [--env-hint <name>] [--check-only] [--json] [--client-id <clientId>]',
+    login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --device                # 在无浏览器或沙箱环境使用设备授权登录\n  openyida login --device --env-hint pre # 将设备授权限定到指定环境 profile\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
     login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；env token 模式下只读取 OPENYIDA_* token。',
     first_run_title: '  🤖 OpenYida - AI 问答模式已开启！                         ',
     first_run_welcome: '  {0}欢迎首次使用 OpenYida！{1} 以下是快速上手指南：',
@@ -626,6 +626,18 @@ openyida - 宜搭命令行工具
     oauth_success_message: '登录已完成，请返回刚才的窗口继续操作。',
     oauth_closing: '正在自动关闭此窗口…',
     oauth_manual_close: '此窗口未能自动关闭，请手动关闭后返回刚才的窗口继续操作。',
+    device_title: '设备码登录：',
+    device_open: '打开',
+    device_enter_code: '输入验证码：',
+    device_or_direct: '或直接打开：',
+    device_completed: '设备授权完成。',
+    device_timeout: '设备授权超时；设备码可能仍在等待验证',
+    device_missing_params: '设备码流程需要 authBaseUrl 和 clientId',
+    device_poll_missing_params: '设备令牌轮询需要 authBaseUrl、clientId 和 deviceCode',
+    device_invalid_code_response: '认证服务未返回可用的设备码',
+    device_code_expired: '设备码已过期；请重新执行 login --device',
+    device_access_denied: '授权已在验证页面被拒绝',
+    device_2xx_no_token: '认证服务返回 2xx 但未包含 accessToken',
     oauth_failure_title: '登录未完成',
     oauth_invalid_state: '登录验证信息无效，请返回终端重新发起登录。',
     oauth_missing_code: '未收到登录授权信息，请返回终端重新发起登录。',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.9.23",
+  "version": "2026.9.24-beta.0",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",