Merge remote-tracking branch 'origin/main' into feat/generic-oauth-client

# Conflicts:
#	apps/workspace/server/src/middleware/errors.ts

Author: hexf00

.github/workflows/push.yml

@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing stable Workspace release tag in vX.Y.Z form
+        description: Optional existing stable Workspace release tag in vX.Y.Z form
         type: string
-        required: true
+        required: false
 
       environment:
         description: 'Environment to run deploy'
@@ -38,6 +38,8 @@ jobs:
     name: BuildDockerImage
     runs-on: ${{ inputs.runner-name == 'github-runner' && 'ubuntu-latest' || inputs.runner-name }}
     environment: ${{ inputs.environment }}
+    outputs:
+      image_tag: ${{ steps.release.outputs.image_tag }}
     env:
       GH_ACCESS_TOKEN: ${{ secrets.GH_TOKEN }}
       CR: univer-acr-registry.cn-shenzhen.cr.aliyuncs.com
@@ -49,29 +51,35 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: refs/tags/${{ inputs.release_tag }}
+          ref: ${{ inputs.release_tag == '' && github.sha || format('refs/tags/{0}', inputs.release_tag) }}
 
-      - name: Validate release tag
+      - name: Resolve deployment source
         id: release
         shell: bash
         env:
           BASE_BRANCH: ${{ github.event.repository.default_branch }}
+          DISPATCH_SHA: ${{ github.sha }}
           RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           set -euo pipefail
-          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
-            echo "release_tag must use stable vX.Y.Z form" >&2
-            exit 1
-          fi
-          if [[ "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" != "$(git rev-parse HEAD)" ]]; then
-            echo "Checkout does not match release tag $RELEASE_TAG" >&2
-            exit 1
-          fi
-          if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/$BASE_BRANCH"; then
-            echo "Release tag commit must be contained in origin/$BASE_BRANCH" >&2
-            exit 1
+          if [[ -n "$RELEASE_TAG" ]]; then
+            if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+              echo "release_tag must use stable vX.Y.Z form" >&2
+              exit 1
+            fi
+            if [[ "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" != "$(git rev-parse HEAD)" ]]; then
+              echo "Checkout does not match release tag $RELEASE_TAG" >&2
+              exit 1
+            fi
+            if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/$BASE_BRANCH"; then
+              echo "Release tag commit must be contained in origin/$BASE_BRANCH" >&2
+              exit 1
+            fi
+            IMAGE_TAG="$RELEASE_TAG"
+          else
+            IMAGE_TAG="sha-$DISPATCH_SHA"
           fi
-          echo "image_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
+          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
 
       - uses: ./.github/actions/setup
         id: setup
@@ -82,6 +90,7 @@ jobs:
       - name: Build and Push Image
         env:
           IMAGE_TAG: ${{ steps.release.outputs.image_tag }}
+          UNIVER_WORKSPACE_BROWSER_LICENSE: ${{ secrets.UNIVER_WORKSPACE_BROWSER_LICENSE }}
         run: |
           make push_image "IMAGE_TAG=$IMAGE_TAG" "CR=$CR"
 
@@ -92,12 +101,8 @@ jobs:
     environment: ${{ inputs.environment }}
     env:
       CR: univer-acr-registry.cn-shenzhen.cr.aliyuncs.com
+      IMAGE_TAG: ${{ needs.build-docker-image.outputs.image_tag }}
     steps:
-      - name: Set IMAGE_TAG environment variable
-        env:
-          RELEASE_TAG: ${{ inputs.release_tag }}
-        run: echo "IMAGE_TAG=$RELEASE_TAG" >> "$GITHUB_ENV"
-
       - name: Set FEATURE environment variable
         if: ${{ startsWith(inputs.environment, 'feature') }}
         run: echo "FEATURE=$(echo ${GITHUB_REF#refs/heads/feat/})" >> "$GITHUB_ENV"

AGENTS.md

@@ -89,8 +89,9 @@ pnpm update:sdk --sdk_version <exact-sdk-version>
   发布前必须检查整个 workspace 的单一 SDK baseline；`dev` 明确跳过该检查。
 - CLI package artifact 必须只包含运行所需代码、资源和版本匹配的 Skills，不得依赖当前 checkout。
 - `packages/reference-provider` 不增加独立发布、版本或外部 consumer 合同。
-- 稳定 `vX.Y.Z` tag 是 CLI release 与 Workspace deployment 共享的不可变源码坐标；tag push 只发布
-  CLI，部署 workflow 只手动部署所选 tag。Docker image 和 CLI artifact 的交付时机与执行流程仍然独立。
+- 稳定 `vX.Y.Z` tag 在被选择时是 CLI release 与 Workspace deployment 共享的不可变源码坐标；tag push
+  只发布 CLI。部署 workflow 也可以不选 tag，改为手动部署 workflow dispatch 的精确 commit，并使用
+  `sha-<commit>` image tag。Docker image 和 CLI artifact 的交付时机与执行流程仍然独立。
 - 当前 release workflow 只写 insider-npm；公开 npm Promotion 属于独立后续工作，不得加入该 workflow。
 
 ## 文档维护

DREAMNUM.md

@@ -23,7 +23,8 @@
   collaboration entry points, and background recovery processes. Contract: [Workspace README](apps/workspace/README.md)
   and [OpenAPI source](apps/workspace/contracts/http/openapi.yaml).
 - **Univer Workspace CLI** — the internally packaged `univer-workspace-cli` application for agent-driven remote
-  Workspace authoring, inspection, rendering, exchange, Worktree, and review workflows. Contract:
+  Workspace authoring, inspection, rendering, exchange, Worktree, and review workflows, with browser-approved
+  passwordless CLI session handoff for password and external-identity users. Contract:
   [CLI README](apps/cli/README.md) and [release workflow](.github/workflows/release-cli.yml).
 
 ## Depends on
@@ -63,12 +64,15 @@
   retain their identities, metadata, and recovery state.
 - Login sessions, password hashes, stable GitHub and Discord user identifiers, ACLs, sharing state, and user-authored
   content are protected application data. OAuth access tokens are used only during sign-in and are not persisted.
+- Short-lived pending CLI browser authorizations are bounded process-local state; approval issues a separate normal
+  persisted login session and does not pass a browser cookie, password, or OAuth access token through the agent.
 - OAuth secrets, trusted Bot credentials, registry credentials, production licenses, and deployment credentials are
   environment or build configuration and must not be committed to the repository.
-- Stable `vX.Y.Z` tags are immutable source coordinates shared by the stable CLI release and manually selected
-  Workspace deployments. Tag push publishes only the CLI; deployment remains a separate manual workflow.
-- Production images use the selected release tag and are handed off to the private deployment repository; database
-  migration and rollout ordering remain part of the Workspace application contract.
+- Stable `vX.Y.Z` tags are immutable source coordinates shared by the stable CLI release and Workspace deployments
+  that select a release tag. Tag push publishes only the CLI; deployment remains a separate manual workflow.
+- Workspace images use either the selected release tag or `sha-<commit>` for an untagged workflow dispatch and are
+  handed off to the private deployment repository; database migration and rollout ordering remain part of the
+  Workspace application contract.
 
 ## Update contract
 

Makefile

@@ -6,4 +6,4 @@ IMAGE_TAG ?= latest
 IMAGE_DIR = ./apps/workspace
 
 push_image:
-	@docker build -f $(IMAGE_DIR)/Dockerfile -t $(CR)/$(NS)/$(REPOSITORY):$(IMAGE_TAG) . --push
+	@docker build --build-arg VITE_UNIVER_LICENSE="$${UNIVER_WORKSPACE_BROWSER_LICENSE}" -f $(IMAGE_DIR)/Dockerfile -t $(CR)/$(NS)/$(REPOSITORY):$(IMAGE_TAG) . --push

README.md

@@ -84,10 +84,11 @@ that graph check. All three paths build, verify, install, and smoke-test the act
 tarball before publication. This workflow ends at insider-npm and does not perform a
 Public Registry Promotion.
 
-Workspace deployment is a separate manual workflow. It requires an existing stable
-`vX.Y.Z` release tag, builds that exact commit, pushes an image with the same tag, and
-hands the image to the selected deployment environment. Pushing the tag does not deploy
-the server.
+Workspace deployment is a separate manual workflow. It can build a selected existing
+stable `vX.Y.Z` release tag and use that tag for the image, or, when no release tag is
+provided, build the workflow dispatch commit and tag the image as `sha-<commit>`. It
+hands the resulting image to the selected deployment environment. Pushing a tag does
+not deploy the server.
 
 ## Runtime development license
 

apps/cli/README.md

@@ -77,6 +77,38 @@ Workspace deployment, run `univer-workspace-cli config set workspace.origin <ori
 agent access to the executable and the intended Workspace; the bundled guidance supplies the
 version-correct workflow.
 
+## Login
+
+The default login does not ask the agent for a Workspace password:
+
+```bash
+univer-workspace-cli login
+```
+
+The command prints a short-lived Workspace URL and verification code, saves the pending request
+locally, and exits immediately. The agent must send the URL and code to the user, then stop and wait
+for the user's reply—it must not poll while approval is pending. Open that URL in your own browser,
+sign in if necessary, and confirm the matching code. Existing browser sessions and all browser
+sign-in methods—including GitHub and Discord—work with this flow.
+
+Only after the user confirms approval, complete the one-time exchange:
+
+```bash
+univer-workspace-cli login --complete
+```
+
+`--complete` checks once and exits; it does not wait or poll. Approval creates a separate CLI session
+without copying the browser cookie or an OAuth access token through the agent.
+
+For compatibility, a user at an interactive terminal can still sign in directly with a Workspace
+username and password:
+
+```bash
+univer-workspace-cli login --username <name>
+```
+
+`--password-stdin` remains available for controlled automation that already owns a password secret.
+
 ## License policy
 
 The CLI bundles the same application-owned runtime development license as the