openxiangda 1.0.31 → 1.0.33

package/README.md

@@ -36,7 +36,23 @@ openxiangda inspect app --profile dev --json
 openxiangda app snapshot APP_XXXX --profile dev --json
 ```
 
-User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions. Project state is stored in `.openxiangda/state.json` and contains only profile-specific resource IDs.
+User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions. Shared workspace environment values, including `APP_OSS_*`, can live in `~/.openxiangda/.env` and are inherited by new workspaces. Project `.env` files still work and override the global defaults. Project state is stored in `.openxiangda/state.json` and contains only profile-specific resource IDs.
+
+Feedback can be sent to a DingTalk custom robot from the CLI after user confirmation. Store the robot settings in `~/.openxiangda/.env`, not in project files:
+
+```env
+OPENXIANGDA_FEEDBACK_DINGTALK_WEBHOOK=https://oapi.dingtalk.com/robot/send?access_token=...
+OPENXIANGDA_FEEDBACK_DINGTALK_SECRET=SEC...
+```
+
+Preview the sanitized payload first, then submit:
+
+```bash
+openxiangda feedback preview --profile dev --summary "发布后资源 404" --description "..."
+openxiangda feedback submit --profile dev --summary "发布后资源 404" --description "..." --yes
+```
+
+Feedback messages include the logged-in user's name when available, profile/platform/app binding, workspace path, Git branch/commit, CLI/Node/OS versions, OSS bucket metadata, command, error text, logs, and optional context files. Token, cookie, secret, access key secret, phone, and email patterns are redacted before sending.
 
 Use the official npm registry for OpenXiangda updates:
 

package/lib/cli.js

@@ -7,8 +7,10 @@ const { pathToFileURL } = require('url');
 const esbuild = require('esbuild');
 const {
   CONFIG_FILE,
+  GLOBAL_ENV_FILE,
   PROJECT_STATE_FILE,
   getProfile,
+  loadGlobalEnv,
   loadConfig,
   loadProjectState,
   normalizeBaseUrl,
@@ -20,6 +22,7 @@ const { getSkillStatusReport, installSkills } = require('./skills');
 const { assertCanInitializeWorkspace, initWorkspace } = require('./workspace-init');
 const {
   fail,
+  maskText,
   openBrowser,
   parseArgs,
   print,
@@ -56,6 +59,7 @@ async function main(argv) {
   if (command === 'resource') return resource(rest);
   if (command === 'inspect') return inspect(rest);
   if (command === 'skill') return skill(rest);
+  if (command === 'feedback') return feedback(rest);
   if (command === 'commands') return commands(rest);
 
   fail(`未知命令: ${command}`);
@@ -107,8 +111,9 @@ Usage:
   openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access
   openxiangda resource validate|plan|publish|pull [--profile name] [--json]
   openxiangda inspect app|form|workflow|automation|permissions
-  openxiangda skill install [--agent codex] [--dest <skills-dir>] [--force] [--dry-run] [--json]
-  openxiangda skill status [--agent codex] [--dest <skills-dir>] [--json]
+  openxiangda feedback preview|submit --summary <text> [--type bug] [--severity medium] [--profile name] [--yes]
+  openxiangda skill install [--agent codex|claude|qoder|dual] [--dest <skills-dir>] [--force] [--dry-run] [--json]
+  openxiangda skill status [--agent codex|claude|qoder|dual] [--dest <skills-dir>] [--json]
 
 OpenXiangda 使用普通用户登录 token，不需要 AK/SK。
 表单页、流程表单页和代码页的主链路是 sy-lowcode-app-workspace + openxiangda workspace publish。
@@ -554,30 +559,462 @@ async function auth(args) {
 async function env(args) {
   const { flags } = parseArgs(args);
   const config = loadConfig();
+  const globalEnv = loadGlobalEnv();
   const profileName = flags.profile || config.currentProfile;
   const profile = profileName ? config.profiles[profileName] : null;
   const state = loadProjectState();
   const currentState = profileName ? state.profiles?.[profileName] : null;
+  const oss = summarizeOssEnv(globalEnv);
   const data = {
     configFile: CONFIG_FILE,
+    globalEnvFile: GLOBAL_ENV_FILE,
+    globalEnvExists: fs.existsSync(GLOBAL_ENV_FILE),
     projectStateFile: path.join(process.cwd(), PROJECT_STATE_FILE),
     currentProfile: profileName || null,
     baseUrl: profile?.baseUrl || null,
     loggedIn: Boolean(profile?.token?.accessToken),
     user: profile?.user || null,
     tenant: profile?.tenant || null,
+    oss,
     appType: currentState?.appType || null,
   };
 
   if (flags.json) return writeJson(data);
   print(`配置文件: ${data.configFile}`);
+  print(`全局 env: ${data.globalEnvFile}${data.globalEnvExists ? '' : ' (未创建)'}`);
   print(`项目状态: ${data.projectStateFile}`);
   print(`当前 profile: ${data.currentProfile || '-'}`);
   print(`平台地址: ${data.baseUrl || '-'}`);
   print(`登录状态: ${data.loggedIn ? '已登录' : '未登录'}`);
+  print(
+    `OSS: ${oss.configured ? '已配置' : '未完整配置'} bucket=${oss.bucket || '-'} region=${oss.region || '-'} pathPrefix=${oss.pathPrefix || '-'}`
+  );
   print(`项目绑定 appType: ${data.appType || '-'}`);
 }
 
+async function feedback(args) {
+  const [subcommand, ...rest] = args;
+  const { flags, positional } = parseArgs(rest);
+
+  if (subcommand !== 'preview' && subcommand !== 'submit') {
+    fail(
+      '用法: openxiangda feedback preview|submit --summary <text> [--type bug] [--severity medium] [--profile name] [--yes] [--json]'
+    );
+  }
+
+  const config = loadConfig();
+  const globalEnv = loadGlobalEnv();
+  const envValues = {
+    ...globalEnv,
+    ...process.env,
+  };
+  const feedbackData = buildFeedbackData(config, flags, positional, envValues);
+  const markdown = buildFeedbackMarkdown(feedbackData);
+
+  if (flags.json) {
+    if (subcommand === 'preview' || flags['dry-run']) {
+      return writeJson({
+        dryRun: true,
+        backend: 'dingtalk',
+        data: feedbackData,
+        markdown,
+      });
+    }
+  }
+
+  if (subcommand === 'preview' || flags['dry-run']) {
+    print(markdown);
+    return;
+  }
+
+  if (!flags.yes && !flags.confirm) {
+    fail('提交反馈需要用户确认。确认后请追加 --yes，或先执行 openxiangda feedback preview 查看内容。');
+  }
+
+  const webhook = readFeedbackEnv(envValues, [
+    'OPENXIANGDA_FEEDBACK_DINGTALK_WEBHOOK',
+    'OPENXIANGDA_DINGTALK_WEBHOOK',
+    'DINGTALK_ROBOT_WEBHOOK',
+  ]);
+  const secret = readFeedbackEnv(envValues, [
+    'OPENXIANGDA_FEEDBACK_DINGTALK_SECRET',
+    'OPENXIANGDA_DINGTALK_SECRET',
+    'DINGTALK_ROBOT_SECRET',
+  ]);
+
+  if (!webhook) {
+    fail(
+      `缺少钉钉机器人 webhook。请在 ${GLOBAL_ENV_FILE} 中配置 OPENXIANGDA_FEEDBACK_DINGTALK_WEBHOOK。`
+    );
+  }
+
+  const result = await submitDingTalkFeedback({
+    webhook,
+    secret,
+    title: `OpenXiangda反馈: ${feedbackData.summary}`,
+    markdown,
+  });
+
+  const response = {
+    backend: 'dingtalk',
+    fingerprint: feedbackData.fingerprint,
+    sentAt: feedbackData.createdAt,
+    result,
+  };
+  if (flags.json) return writeJson(response);
+  print(`反馈已发送到钉钉机器人: ${feedbackData.fingerprint}`);
+}
+
+function readFeedbackEnv(envValues, names) {
+  for (const name of names) {
+    const value = envValues[name];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return '';
+}
+
+function buildFeedbackData(config, flags, positional, envValues) {
+  const summary =
+    readStringFlag(flags, 'summary') ||
+    readStringFlag(flags, 'title') ||
+    positional.join(' ').trim();
+  if (!summary) {
+    fail('缺少反馈摘要。用法: openxiangda feedback submit --summary <text> --yes');
+  }
+
+  const profileName = flags.profile || config.currentProfile || null;
+  const profile = profileName ? config.profiles[profileName] || null : null;
+  const state = loadProjectState();
+  const bound = profileName ? state.profiles?.[profileName] || null : null;
+  const cwd = process.cwd();
+  const packageInfo = readWorkspacePackageInfo(cwd);
+  const gitInfo = readGitInfo(cwd);
+  const relatedFiles = splitList(readStringFlag(flags, 'files')).concat(
+    splitList(readStringFlag(flags, 'file'))
+  );
+  const description = readFeedbackLongText(flags, ['description', 'desc'], ['description-file']);
+  const error = readFeedbackLongText(flags, ['error', 'message'], ['error-file']);
+  const logs = readFeedbackLongText(flags, ['logs', 'log'], ['log-file']);
+  const context = readFeedbackLongText(flags, ['context'], ['context-file']);
+  const command = readStringFlag(flags, 'command') || readStringFlag(flags, 'cmd');
+  const createdAt = new Date().toISOString();
+  const baseUrlInfo = describeBaseUrl(profile?.baseUrl);
+
+  const data = {
+    type: readStringFlag(flags, 'type') || 'bug',
+    severity: readStringFlag(flags, 'severity') || 'medium',
+    summary: sanitizeFeedbackText(summary, 300),
+    description: sanitizeFeedbackText(description, 3000),
+    error: sanitizeFeedbackText(error, 3000),
+    logs: sanitizeFeedbackText(logs, 6000),
+    context: sanitizeFeedbackText(context, 6000),
+    command: sanitizeFeedbackText(command, 1000),
+    createdAt,
+    reporter: describeFeedbackReporter(profile),
+    platform: {
+      profile: profileName,
+      baseUrl: baseUrlInfo.safeUrl,
+      host: baseUrlInfo.host,
+      tenant: sanitizeObject(profile?.tenant || null),
+      appType: bound?.appType || null,
+    },
+    workspace: {
+      cwd,
+      packageName: packageInfo.name,
+      packageVersion: packageInfo.version,
+      stateFile: path.join(cwd, PROJECT_STATE_FILE),
+      stateExists: fs.existsSync(path.join(cwd, PROJECT_STATE_FILE)),
+      relatedFiles: unique(relatedFiles).map(file => sanitizeFeedbackText(file, 500)),
+    },
+    git: gitInfo,
+    environment: {
+      openxiangdaVersion: CURRENT_VERSION,
+      nodeVersion: process.version,
+      platform: process.platform,
+      arch: process.arch,
+      oss: {
+        bucket: sanitizeFeedbackText(envValues.APP_OSS_BUCKET || '', 300) || null,
+        region: sanitizeFeedbackText(envValues.APP_OSS_REGION || '', 300) || null,
+        pathPrefix: sanitizeFeedbackText(envValues.APP_OSS_PATH_PREFIX || '', 300) || null,
+        hasAccessKeyId: Boolean(envValues.APP_OSS_ACCESS_KEY_ID),
+        hasAccessKeySecret: Boolean(envValues.APP_OSS_ACCESS_KEY_SECRET),
+      },
+    },
+  };
+
+  data.fingerprint = createFeedbackFingerprint(data);
+  return data;
+}
+
+function readFeedbackLongText(flags, inlineKeys, fileKeys) {
+  for (const key of inlineKeys) {
+    const value = readStringFlag(flags, key);
+    if (value) return value;
+  }
+  for (const key of fileKeys) {
+    const file = readStringFlag(flags, key);
+    if (file) return readTextFileForFeedback(file);
+  }
+  return '';
+}
+
+function readTextFileForFeedback(file) {
+  const resolved = path.resolve(file);
+  try {
+    const stat = fs.statSync(resolved);
+    if (!stat.isFile()) fail(`反馈上下文不是文件: ${resolved}`);
+    const maxBytes = 256 * 1024;
+    const fd = fs.openSync(resolved, 'r');
+    try {
+      const buffer = Buffer.alloc(Math.min(stat.size, maxBytes));
+      fs.readSync(fd, buffer, 0, buffer.length, 0);
+      const suffix = stat.size > maxBytes ? '\n\n[内容过长，仅截取前 256KB]' : '';
+      return `${buffer.toString('utf8')}${suffix}`;
+    } finally {
+      fs.closeSync(fd);
+    }
+  } catch (error) {
+    if (error.message && error.message.startsWith('反馈上下文不是文件')) throw error;
+    fail(`无法读取反馈上下文文件: ${resolved}`);
+  }
+}
+
+function describeFeedbackReporter(profile) {
+  const user = profile?.user || {};
+  return sanitizeObject({
+    name:
+      user.name ||
+      user.realName ||
+      user.nick ||
+      user.nickname ||
+      user.username ||
+      user.userName ||
+      user.id ||
+      null,
+    id: user.id || user.userId || user.unionId || null,
+    username: user.username || user.userName || null,
+  });
+}
+
+function describeBaseUrl(baseUrl) {
+  if (!baseUrl) return { safeUrl: null, host: null };
+  try {
+    const parsed = new URL(baseUrl);
+    return {
+      safeUrl: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, ''),
+      host: parsed.host,
+    };
+  } catch {
+    return { safeUrl: sanitizeFeedbackText(baseUrl, 500), host: null };
+  }
+}
+
+function readWorkspacePackageInfo(cwd) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+    return {
+      name: pkg.name || null,
+      version: pkg.version || null,
+    };
+  } catch {
+    return { name: null, version: null };
+  }
+}
+
+function readGitInfo(cwd) {
+  return {
+    branch: runGitValue(cwd, ['branch', '--show-current']),
+    commit: runGitValue(cwd, ['rev-parse', '--short', 'HEAD']),
+    remote: sanitizeGitRemote(runGitValue(cwd, ['remote', 'get-url', 'origin'])),
+    dirty: runGitValue(cwd, ['status', '--porcelain']) ? true : false,
+  };
+}
+
+function runGitValue(cwd, args) {
+  const result = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+  });
+  if (result.status !== 0) return null;
+  return sanitizeFeedbackText(String(result.stdout || '').trim(), 1000) || null;
+}
+
+function sanitizeGitRemote(value) {
+  if (!value) return null;
+  return sanitizeFeedbackText(value.replace(/\/\/[^/@\s]+@/g, '//***@'), 1000);
+}
+
+function sanitizeObject(value) {
+  if (!value || typeof value !== 'object') return value || null;
+  const sanitized = sanitizeFeedbackText(JSON.stringify(value), 5000);
+  try {
+    return JSON.parse(sanitized);
+  } catch {
+    return sanitized;
+  }
+}
+
+function sanitizeFeedbackText(value, maxLength = 4000) {
+  const masked = maskText(value)
+    .replace(/([?&]access_token=)[^&\s]+/gi, '$1***redacted***')
+    .replace(/([?&]sign=)[^&\s]+/gi, '$1***redacted***')
+    .replace(/\bSEC[0-9a-f]{20,}\b/gi, '***dingtalk-secret***')
+    .replace(
+      /\b(access_token|accessToken|refreshToken|authorization|cookie|secret|token|sign|webhook|accessKeySecret|APP_OSS_ACCESS_KEY_SECRET|OPENXIANGDA_ACCESS_TOKEN)\b\s*[:=]\s*["']?[^"',\n\r\s]+["']?/gi,
+      '$1=***redacted***'
+    );
+  if (masked.length <= maxLength) return masked;
+  return `${masked.slice(0, maxLength)}\n...[已截断 ${masked.length - maxLength} 字符]`;
+}
+
+function createFeedbackFingerprint(data) {
+  const raw = [
+    data.type,
+    data.severity,
+    data.summary,
+    data.platform.host,
+    data.platform.appType,
+    data.command,
+    data.error,
+  ]
+    .filter(Boolean)
+    .join('\n');
+  return `OXD-${crypto.createHash('sha256').update(raw).digest('hex').slice(0, 12)}`;
+}
+
+function buildFeedbackMarkdown(data) {
+  const lines = [
+    `## OpenXiangda 反馈`,
+    '',
+    `**摘要**: ${escapeMarkdownLine(data.summary)}`,
+    `**类型**: ${escapeMarkdownLine(data.type)}`,
+    `**严重级别**: ${escapeMarkdownLine(data.severity)}`,
+    `**发送人**: ${escapeMarkdownLine(data.reporter?.name || '-')}`,
+    `**发送时间**: ${escapeMarkdownLine(data.createdAt)}`,
+    `**Fingerprint**: ${escapeMarkdownLine(data.fingerprint)}`,
+    '',
+    `### 登录与平台`,
+    `- profile: ${escapeMarkdownLine(data.platform.profile || '-')}`,
+    `- user: ${escapeMarkdownLine(formatObjectInline(data.reporter))}`,
+    `- tenant: ${escapeMarkdownLine(formatObjectInline(data.platform.tenant))}`,
+    `- baseUrl: ${escapeMarkdownLine(data.platform.baseUrl || '-')}`,
+    `- appType: ${escapeMarkdownLine(data.platform.appType || '-')}`,
+    '',
+    `### 工作区`,
+    `- cwd: ${escapeMarkdownLine(data.workspace.cwd)}`,
+    `- package: ${escapeMarkdownLine([data.workspace.packageName, data.workspace.packageVersion].filter(Boolean).join('@') || '-')}`,
+    `- stateFile: ${escapeMarkdownLine(data.workspace.stateFile)}`,
+    `- stateExists: ${data.workspace.stateExists ? 'true' : 'false'}`,
+    `- relatedFiles: ${escapeMarkdownLine(data.workspace.relatedFiles.join(', ') || '-')}`,
+    '',
+    `### Git`,
+    `- branch: ${escapeMarkdownLine(data.git.branch || '-')}`,
+    `- commit: ${escapeMarkdownLine(data.git.commit || '-')}`,
+    `- dirty: ${data.git.dirty ? 'true' : 'false'}`,
+    `- remote: ${escapeMarkdownLine(data.git.remote || '-')}`,
+    '',
+    `### 环境`,
+    `- openxiangda: ${escapeMarkdownLine(data.environment.openxiangdaVersion)}`,
+    `- node: ${escapeMarkdownLine(data.environment.nodeVersion)}`,
+    `- os: ${escapeMarkdownLine(`${data.environment.platform}/${data.environment.arch}`)}`,
+    `- oss: ${escapeMarkdownLine(formatObjectInline(data.environment.oss))}`,
+  ];
+
+  appendMarkdownBlock(lines, '命令', data.command, 'bash');
+  appendMarkdownBlock(lines, '问题描述', data.description);
+  appendMarkdownBlock(lines, '错误信息', data.error);
+  appendMarkdownBlock(lines, '日志', data.logs);
+  appendMarkdownBlock(lines, '补充上下文', data.context, 'json');
+
+  return sanitizeFeedbackText(lines.join('\n'), 18000);
+}
+
+function appendMarkdownBlock(lines, title, value, language = '') {
+  if (!value) return;
+  lines.push('', `### ${title}`, '```' + language, escapeMarkdownBlock(value), '```');
+}
+
+function escapeMarkdownLine(value) {
+  return String(value || '').replace(/\n/g, ' ');
+}
+
+function escapeMarkdownBlock(value) {
+  return String(value || '').replace(/```/g, '``\u200b`');
+}
+
+function formatObjectInline(value) {
+  if (!value) return '-';
+  return JSON.stringify(value);
+}
+
+async function submitDingTalkFeedback({ webhook, secret, title, markdown }) {
+  if (typeof fetch !== 'function') {
+    throw new Error('当前 Node.js 版本不支持 fetch，请使用 Node.js 18 或更高版本');
+  }
+
+  const url = buildDingTalkRobotUrl(webhook, secret);
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify({
+      msgtype: 'markdown',
+      markdown: {
+        title: sanitizeFeedbackText(title, 100),
+        text: markdown,
+      },
+    }),
+  });
+  const text = await response.text();
+  let payload = null;
+  if (text) {
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = { message: text };
+    }
+  }
+  if (!response.ok || Number(payload?.errcode || 0) !== 0) {
+    const message = payload?.errmsg || payload?.message || response.statusText || 'DingTalk robot send failed';
+    throw new Error(sanitizeFeedbackText(`钉钉反馈发送失败: ${message}`, 1000));
+  }
+  return payload || { errcode: 0 };
+}
+
+function buildDingTalkRobotUrl(webhook, secret) {
+  const url = new URL(webhook);
+  if (secret) {
+    const timestamp = Date.now();
+    const sign = crypto
+      .createHmac('sha256', secret)
+      .update(`${timestamp}\n${secret}`)
+      .digest('base64');
+    url.searchParams.set('timestamp', String(timestamp));
+    url.searchParams.set('sign', sign);
+  }
+  return url.toString();
+}
+
+function summarizeOssEnv(globalEnv) {
+  const env = {
+    ...globalEnv,
+    ...process.env,
+  };
+  const hasAccessKeyId = Boolean(env.APP_OSS_ACCESS_KEY_ID);
+  const hasAccessKeySecret = Boolean(env.APP_OSS_ACCESS_KEY_SECRET);
+  const bucket = env.APP_OSS_BUCKET || null;
+  return {
+    bucket,
+    region: env.APP_OSS_REGION || null,
+    pathPrefix: env.APP_OSS_PATH_PREFIX || null,
+    hasAccessKeyId,
+    hasAccessKeySecret,
+    configured: Boolean(bucket && hasAccessKeyId && hasAccessKeySecret),
+  };
+}
+
 async function workspace(args) {
   const [subcommand, ...rest] = args;
   const { flags, positional } = parseArgs(rest);
@@ -2170,6 +2607,7 @@ async function commands(args) {
       'settings get|save|indexes|indexes-save|data-management|data-management-save|public-access|public-access-save|public-access-delete',
       'resource validate|plan|publish|pull',
       'inspect app|form|workflow|automation|permissions',
+      'feedback preview|submit',
       'skill install|status',
     ],
   };
@@ -2222,7 +2660,7 @@ async function skill(args) {
     return;
   }
 
-  fail('用法: openxiangda skill install|status [--agent codex] [--dest <skills-dir>]');
+  fail('用法: openxiangda skill install|status [--agent codex|claude|qoder|dual] [--dest <skills-dir>]');
 }
 
 function printSkillInstallReport(result) {
@@ -5467,22 +5905,37 @@ function runWorkspacePublish(profileName, profile, appType, publishArgs = []) {
   const args = publishArgs.length
     ? ['run', scriptName, '--', ...publishArgs]
     : ['run', scriptName];
+  const globalEnv = loadGlobalEnv();
   const result = spawnSync(command, args, {
     cwd: process.cwd(),
     stdio: 'inherit',
-    env: {
-      ...process.env,
-      OPENXIANGDA_PROFILE: profileName,
-      OPENXIANGDA_BASE_URL: profile.baseUrl,
-      OPENXIANGDA_ACCESS_TOKEN: profile.token.accessToken,
-      OPENXIANGDA_APP_TYPE: appType,
-    },
+    env: buildWorkspacePublishEnv(profileName, profile, appType, globalEnv),
   });
   if (result.status !== 0) {
     process.exit(result.status || 1);
   }
 }
 
+function buildWorkspacePublishEnv(profileName, profile, appType, globalEnv) {
+  const env = { ...process.env };
+  const injectedGlobalKeys = [];
+
+  for (const [key, value] of Object.entries(globalEnv)) {
+    if (key.startsWith('APP_') && env[key] === undefined) {
+      env[key] = value;
+      injectedGlobalKeys.push(key);
+    }
+  }
+
+  env.OPENXIANGDA_PROFILE = profileName;
+  env.OPENXIANGDA_BASE_URL = profile.baseUrl;
+  env.OPENXIANGDA_ACCESS_TOKEN = profile.token.accessToken;
+  env.OPENXIANGDA_APP_TYPE = appType;
+  env.OPENXIANGDA_GLOBAL_ENV_KEYS = injectedGlobalKeys.join(',');
+
+  return env;
+}
+
 module.exports = {
   main,
 };

package/lib/config.js

@@ -1,11 +1,14 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { parse: parseDotenv } = require('dotenv');
 
 const CONFIG_DIR = path.join(os.homedir(), '.openxiangda');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'profiles.json');
+const GLOBAL_ENV_FILE = path.join(CONFIG_DIR, '.env');
 const PROJECT_DIR = '.openxiangda';
 const PROJECT_STATE_FILE = path.join(PROJECT_DIR, 'state.json');
+const LEGACY_PROJECT_CONFIG_FILE = path.join(PROJECT_DIR, 'profiles.json');
 
 function emptyConfig() {
   return {
@@ -32,23 +35,72 @@ function readJson(file, fallback) {
   }
 }
 
-function loadConfig() {
-  ensureUserConfigDir();
-  const config = readJson(CONFIG_FILE, emptyConfig());
+function normalizeConfig(config) {
   return {
     ...emptyConfig(),
-    ...config,
-    profiles: config.profiles || {},
+    ...(config || {}),
+    profiles: config?.profiles || {},
+  };
+}
+
+function mergeConfigs(...configs) {
+  const merged = emptyConfig();
+  for (const config of configs) {
+    if (!config) continue;
+    const normalized = normalizeConfig(config);
+    merged.version = normalized.version || merged.version;
+    if (normalized.currentProfile) {
+      merged.currentProfile = normalized.currentProfile;
+    }
+    for (const [name, profile] of Object.entries(normalized.profiles)) {
+      merged.profiles[name] = mergeProfile(merged.profiles[name], profile);
+    }
+  }
+  return normalizeConfig(merged);
+}
+
+function mergeProfile(previous = {}, next = {}) {
+  const merged = {
+    ...previous,
+    ...next,
   };
+  const baseUrlChanged =
+    previous.baseUrl && next.baseUrl && previous.baseUrl !== next.baseUrl;
+  for (const key of ['token', 'user', 'tenant']) {
+    if (
+      !baseUrlChanged &&
+      !Object.prototype.hasOwnProperty.call(next, key) &&
+      previous[key] != null
+    ) {
+      merged[key] = previous[key];
+    }
+  }
+  return merged;
+}
+
+function isConfigEqual(left, right) {
+  return JSON.stringify(normalizeConfig(left)) === JSON.stringify(normalizeConfig(right));
+}
+
+function loadConfig(cwd = process.cwd()) {
+  ensureUserConfigDir();
+  const globalConfig = readJson(CONFIG_FILE, null);
+  const legacyConfig = readJson(path.join(cwd, LEGACY_PROJECT_CONFIG_FILE), null);
+
+  if (legacyConfig?.profiles && Object.keys(legacyConfig.profiles).length > 0) {
+    const migrated = mergeConfigs(legacyConfig, globalConfig);
+    if (!globalConfig || !isConfigEqual(globalConfig, migrated)) {
+      saveConfig(migrated);
+    }
+    return migrated;
+  }
+
+  return normalizeConfig(globalConfig);
 }
 
 function saveConfig(config) {
   ensureUserConfigDir();
-  const normalized = {
-    ...emptyConfig(),
-    ...config,
-    profiles: config.profiles || {},
-  };
+  const normalized = normalizeConfig(config);
   const tempFile = `${CONFIG_FILE}.${process.pid}.tmp`;
   fs.writeFileSync(tempFile, `${JSON.stringify(normalized, null, 2)}\n`, {
     mode: 0o600,
@@ -109,10 +161,22 @@ function saveProjectState(state, cwd = process.cwd()) {
   );
 }
 
+function loadGlobalEnv() {
+  ensureUserConfigDir();
+  try {
+    return parseDotenv(fs.readFileSync(GLOBAL_ENV_FILE));
+  } catch {
+    return {};
+  }
+}
+
 module.exports = {
+  CONFIG_DIR,
   CONFIG_FILE,
+  GLOBAL_ENV_FILE,
   PROJECT_STATE_FILE,
   getProfile,
+  loadGlobalEnv,
   loadConfig,
   loadProjectState,
   normalizeBaseUrl,

package/lib/skills.js

@@ -302,7 +302,12 @@ function installOneSkill(spec, skillsDir) {
 }
 
 function copyRootSkill(stagingDir) {
-  fs.cpSync(SOURCE_SKILLS_DIR, stagingDir, {
+  fs.mkdirSync(stagingDir, { recursive: true });
+  const skillMarkdown = fs
+    .readFileSync(path.join(SOURCE_SKILLS_DIR, 'SKILL.md'), 'utf8')
+    .replace(/`skills\/(openxiangda-[^`]+)\/SKILL\.md`/g, '`../$1/SKILL.md`');
+  fs.writeFileSync(path.join(stagingDir, 'SKILL.md'), skillMarkdown);
+  fs.cpSync(SOURCE_REFERENCES_DIR, path.join(stagingDir, 'references'), {
     recursive: true,
     dereference: false,
   });
@@ -368,4 +373,4 @@ module.exports = {
   getSkillStatusReport,
   installSkills,
   resolveSkillsDir,
-};
+};

package/openxiangda-skills/SKILL.md

@@ -82,6 +82,8 @@ When the user provides a root domain such as `https://yida.wisejob.cn/`, use it
 - For live platform publishing, do not call `lowcode-workspace publish-all`, `pnpm publish:all`, or legacy project scripts such as `scripts/openxiangda-publish.mjs` directly. They are workspace internals and may miss the normal-user token/profile injection. Use `openxiangda workspace publish ...` so `OPENXIANGDA_PROFILE`, `OPENXIANGDA_BASE_URL`, `OPENXIANGDA_ACCESS_TOKEN`, and `OPENXIANGDA_APP_TYPE` are injected consistently.
 - For routine AI edits, avoid reflexive full publish. First run `openxiangda workspace publish --profile <name> --changed --dry-run`, then use `--changed`, `--page <pageCode>`, `--form <formCode>`, or `--only pages/a,forms/b`. Use full publish only when broad shared/config changes intentionally affect many modules.
 - Never store token data in the project directory. User tokens live in `~/.openxiangda/profiles.json`; project state lives in `.openxiangda/state.json` and stores only IDs and mappings.
+- Shared workspace env values such as `APP_OSS_*` should live in `~/.openxiangda/.env` by default. Project `.env` files are only per-workspace overrides.
+- For suspected platform defects, bugs, or product optimization requests, ask the user to confirm first, then use `openxiangda feedback preview` and `openxiangda feedback submit --yes` to send a detailed DingTalk robot report. Include the command, error, relevant files, and logs/context files when available. The CLI redacts tokens, cookies, secrets, phone numbers, and emails before sending.
 - Use logical resource codes in local files. Platform-specific IDs such as `formUuid`, `pageId`, `workflowId`, and `automationId` must be isolated by profile.
 - Put engineering-managed resources in `src/resources/` and use `openxiangda resource validate|plan|publish|pull`. `workspace publish` publishes workspace forms/pages first, then runs non-destructive resource upsert. Only pass `--prune` when the user explicitly wants local manifests to delete platform-side extras.
 - For external APIs, create a connector manifest in `src/resources/connectors/` and call it from pages through `sdk.connector`; never put third-party API keys in page source.

package/openxiangda-skills/references/workspace-state.md

@@ -2,7 +2,7 @@
 
 OpenXiangda project state lives in `.openxiangda/state.json`.
 
-Tokens never belong in the project. User tokens live in `~/.openxiangda/profiles.json`.
+Tokens never belong in the project. User tokens live in `~/.openxiangda/profiles.json`. Shared workspace env values such as `APP_OSS_*` live in `~/.openxiangda/.env` by default, while project `.env` is only a local override.
 
 ## Shape
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -17,6 +17,24 @@ The CLI creates a one-time login session, opens the platform authorization page,
 
 Do not request or generate AK/SK credentials.
 
+Shared workspace environment values such as `APP_OSS_REGION`, `APP_OSS_BUCKET`, `APP_OSS_ACCESS_KEY_ID`, `APP_OSS_ACCESS_KEY_SECRET`, and `APP_OSS_PATH_PREFIX` should live in `~/.openxiangda/.env` by default. A workspace-local `.env` may override those values for one project.
+
+Feedback robot settings also live in `~/.openxiangda/.env`:
+
+```bash
+OPENXIANGDA_FEEDBACK_DINGTALK_WEBHOOK=https://oapi.dingtalk.com/robot/send?access_token=...
+OPENXIANGDA_FEEDBACK_DINGTALK_SECRET=SEC...
+```
+
+When a user confirms that a suspected platform defect, bug, or optimization request should be reported, run:
+
+```bash
+openxiangda feedback preview --profile <name> --summary "问题摘要" --description "..." --command "..." --log-file <file>
+openxiangda feedback submit --profile <name> --summary "问题摘要" --description "..." --command "..." --log-file <file> --yes
+```
+
+Feedback includes the logged-in profile user name when available and detailed workspace/platform context. The CLI redacts tokens, cookies, secrets, phone numbers, and emails before sending.
+
 ## Private Routing
 
 OpenXiangda private deployments use fixed public paths:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/packages/sdk/src/build-source/scripts/publish-oss.mjs

@@ -52,7 +52,7 @@ if (
   !dryRun &&
   (!config.oss.accessKeyId || config.oss.accessKeyId.startsWith("your_"))
 ) {
-  console.error("❌ 请先配置 OSS 密钥（.env 文件中的 APP_OSS_* 字段）");
+  console.error("❌ 请先配置 OSS 密钥（~/.openxiangda/.env 或项目 .env 中的 APP_OSS_* 字段）");
   process.exit(1);
 }
 

package/packages/sdk/src/build-source/scripts/utils/load-config.mjs

@@ -1,8 +1,75 @@
-import { config as dotenvConfig } from "dotenv";
+import fs from "node:fs";
+import os from "node:os";
+import { parse as parseDotenv } from "dotenv";
 import { resolve } from "path";
 import { pathToFileURL } from "url";
 
 export const rootDir = resolve(process.env.LOWCODE_WORKSPACE_ROOT || process.cwd());
+const OPENXIANGDA_HOME_DIR = ".openxiangda";
+const OPENXIANGDA_GLOBAL_ENV_FILE = ".env";
+
+export function getGlobalOpenXiangdaEnvFile(env = process.env) {
+  const home = env.HOME || os.homedir();
+  return resolve(home, OPENXIANGDA_HOME_DIR, OPENXIANGDA_GLOBAL_ENV_FILE);
+}
+
+function readDotenvFile(filePath) {
+  try {
+    return parseDotenv(fs.readFileSync(filePath, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+
+export function loadWorkspaceEnv(options = {}) {
+  const workspaceRoot = options.workspaceRoot || rootDir;
+  const env = options.env || process.env;
+  const globalEnvFile = getGlobalOpenXiangdaEnvFile(env);
+  const globalEnv = readDotenvFile(globalEnvFile);
+  const mode = options.mode || env.APP_MODE || globalEnv.APP_MODE || "development";
+  const files = [
+    { filePath: globalEnvFile, values: globalEnv },
+    {
+      filePath: resolve(workspaceRoot, ".env"),
+      values: readDotenvFile(resolve(workspaceRoot, ".env")),
+    },
+  ];
+
+  if (mode !== "development") {
+    const modeFile = resolve(workspaceRoot, `.env.${mode}`);
+    files.push({ filePath: modeFile, values: readDotenvFile(modeFile) });
+  }
+
+  const injectedGlobalKeys = new Set(
+    String(env.OPENXIANGDA_GLOBAL_ENV_KEYS || "")
+      .split(",")
+      .map((key) => key.trim())
+      .filter(Boolean),
+  );
+  const originalKeys = new Set(
+    Object.keys(env).filter(
+      (key) => env[key] !== undefined && !injectedGlobalKeys.has(key),
+    ),
+  );
+  const merged = {};
+  const loadedFiles = [];
+  for (const file of files) {
+    if (fs.existsSync(file.filePath)) loadedFiles.push(file.filePath);
+    Object.assign(merged, file.values);
+  }
+
+  for (const [key, value] of Object.entries(merged)) {
+    if (!originalKeys.has(key)) {
+      env[key] = value;
+    }
+  }
+
+  return {
+    globalEnvFile,
+    loadedFiles,
+    mode,
+  };
+}
 
 /**
  * 标准化 OSS 路径前缀，去除前后斜杠
@@ -88,12 +155,7 @@ async function loadConfigModule() {
  * @returns {Promise<object>} 合并后的应用配置对象
  */
 export async function loadConfig() {
-  const mode = process.env.APP_MODE || "development";
-
-  if (mode !== "development") {
-    dotenvConfig({ path: resolve(rootDir, `.env.${mode}`) });
-  }
-  dotenvConfig({ path: resolve(rootDir, ".env") });
+  loadWorkspaceEnv();
 
   const source = await loadConfigModule();
   const openXiangdaMode = Boolean(

package/packages/sdk/src/build-source/scripts/utils/load-config.test.ts

@@ -1,10 +1,31 @@
-import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
 
 import {
   getApiBaseUrl,
+  getGlobalOpenXiangdaEnvFile,
+  loadWorkspaceEnv,
   resolveOpenXiangdaEndpointConfig,
 } from "./load-config.mjs";
 
+let tempDirs: string[] = [];
+
+function makeTempDir(prefix: string) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(() => {
+  for (const dir of tempDirs) {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+  tempDirs = [];
+});
+
 describe("OpenXiangda endpoint config", () => {
   it("treats /service base as the complete API base", () => {
     const config = resolveOpenXiangdaEndpointConfig(
@@ -42,3 +63,111 @@ describe("OpenXiangda endpoint config", () => {
     );
   });
 });
+
+describe("OpenXiangda workspace env loading", () => {
+  it("loads global env defaults and lets project env override them", () => {
+    const home = makeTempDir("openxiangda-home-");
+    const workspace = makeTempDir("openxiangda-workspace-");
+    fs.mkdirSync(path.join(home, ".openxiangda"), { recursive: true });
+    fs.writeFileSync(
+      path.join(home, ".openxiangda", ".env"),
+      [
+        "APP_OSS_REGION=oss-cn-shanghai",
+        "APP_OSS_BUCKET=global-bucket",
+        "APP_OSS_ACCESS_KEY_ID=global-key",
+        "APP_OSS_ACCESS_KEY_SECRET=global-secret",
+        "APP_OSS_PATH_PREFIX=global-prefix",
+        "",
+      ].join("\n"),
+      "utf-8",
+    );
+    fs.writeFileSync(
+      path.join(workspace, ".env"),
+      ["APP_OSS_BUCKET=project-bucket", "APP_OSS_PATH_PREFIX=project-prefix", ""].join(
+        "\n",
+      ),
+      "utf-8",
+    );
+
+    const env: Record<string, string> = {
+      HOME: home,
+      APP_OSS_ACCESS_KEY_ID: "shell-key",
+    };
+
+    const result = loadWorkspaceEnv({ workspaceRoot: workspace, env });
+
+    expect(getGlobalOpenXiangdaEnvFile(env)).toBe(
+      path.join(home, ".openxiangda", ".env"),
+    );
+    expect(result.loadedFiles).toEqual([
+      path.join(home, ".openxiangda", ".env"),
+      path.join(workspace, ".env"),
+    ]);
+    expect(env.APP_OSS_REGION).toBe("oss-cn-shanghai");
+    expect(env.APP_OSS_BUCKET).toBe("project-bucket");
+    expect(env.APP_OSS_ACCESS_KEY_ID).toBe("shell-key");
+    expect(env.APP_OSS_ACCESS_KEY_SECRET).toBe("global-secret");
+    expect(env.APP_OSS_PATH_PREFIX).toBe("project-prefix");
+  });
+
+  it("lets project env override values injected from global env by the CLI", () => {
+    const home = makeTempDir("openxiangda-home-");
+    const workspace = makeTempDir("openxiangda-workspace-");
+    fs.mkdirSync(path.join(home, ".openxiangda"), { recursive: true });
+    fs.writeFileSync(
+      path.join(home, ".openxiangda", ".env"),
+      "APP_OSS_BUCKET=global-bucket\n",
+      "utf-8",
+    );
+    fs.writeFileSync(
+      path.join(workspace, ".env"),
+      "APP_OSS_BUCKET=project-bucket\n",
+      "utf-8",
+    );
+
+    const env: Record<string, string> = {
+      HOME: home,
+      APP_OSS_BUCKET: "global-bucket",
+      OPENXIANGDA_GLOBAL_ENV_KEYS: "APP_OSS_BUCKET",
+    };
+
+    loadWorkspaceEnv({ workspaceRoot: workspace, env });
+
+    expect(env.APP_OSS_BUCKET).toBe("project-bucket");
+  });
+
+  it("keeps mode-specific project env above normal project env", () => {
+    const home = makeTempDir("openxiangda-home-");
+    const workspace = makeTempDir("openxiangda-workspace-");
+    fs.mkdirSync(path.join(home, ".openxiangda"), { recursive: true });
+    fs.writeFileSync(
+      path.join(home, ".openxiangda", ".env"),
+      "APP_OSS_BUCKET=global-bucket\n",
+      "utf-8",
+    );
+    fs.writeFileSync(
+      path.join(workspace, ".env"),
+      "APP_OSS_BUCKET=project-bucket\n",
+      "utf-8",
+    );
+    fs.writeFileSync(
+      path.join(workspace, ".env.production"),
+      "APP_OSS_BUCKET=prod-bucket\n",
+      "utf-8",
+    );
+
+    const env: Record<string, string> = { HOME: home };
+    const result = loadWorkspaceEnv({
+      workspaceRoot: workspace,
+      mode: "production",
+      env,
+    });
+
+    expect(result.loadedFiles).toEqual([
+      path.join(home, ".openxiangda", ".env"),
+      path.join(workspace, ".env"),
+      path.join(workspace, ".env.production"),
+    ]);
+    expect(env.APP_OSS_BUCKET).toBe("prod-bucket");
+  });
+});