openyida 2026.10.21-2 → 2026.10.22

package/README.md

@@ -446,7 +446,9 @@ openyida feedback report --input summary.json --output-dir feedback-draft-001
 
 Your AI prepares the summary from observed evidence and selected reproduction screenshots. PRs include before/after test comparisons. Before anything is published, review the final text and images, confirm sensitive information, and remove anything you do not want to share. See the [report input format](yida-skills/skills/yida-feedback/references/report-input.md). Review business information before sharing. With a GitHub account, authorize your AI to submit an Issue or contribute a verified public OpenYida fix through your personal Fork. Without an account, create a GitHub account first. If that is not possible, share the report in the AI开发者群 (AI developer group).
 
-When you choose to submit an OpenYida Issue, the feedback Skill can check your signed-in GitHub account with `openyida feedback github status --json`. Star and a personal Fork are optional: `feedback github star --confirm` and `feedback github fork --confirm` run only after you choose them. Existing actions are reused. This check is separate from installation and automatic updates; neither action is required to submit an Issue.
+To configure a submission tool, your AI can first run `openyida feedback github setup --json` to check gh and the current account. After you approve the installation plan, it can run `openyida feedback github setup --install --confirm --json`, using existing Homebrew on macOS/Linux or WinGet on Windows. Without a supported manager, official instructions or the web remain available. Browser authorization is a separate step performed by you; installation does not log you in, request passwords or tokens, or replace public-content approval. Resume the original draft after setup. See the [account and tool guide](yida-skills/skills/yida-feedback/references/github-setup.md).
+
+When preparing a PR that needs a personal Fork, or when you ask how to support the project, the feedback Skill can inspect account support state with `openyida feedback github status --json`. Star and a personal Fork are optional: `feedback github star --confirm` and `feedback github fork --confirm` run only after you choose them. Existing actions are reused. This check is separate from installation and automatic updates; neither action is required to submit an Issue.
 
 <!-- OPENYIDA_COMMANDS_START -->
 <!-- This section is generated by `npm run docs:commands`. Do not edit command rows by hand. -->

package/lib/app/canvas-compile.js

@@ -55,6 +55,7 @@ const { assertCanvasThemeStructure } = require('./canvas-theme-guard');
 const { assertCanvasIconExports } = require('./canvas-icon-guard');
 const { assertCanvasNavigationStructure } = require('./canvas-navigation-guard');
 const { assertCanvasNavigationPaths } = require('./canvas-path-guard');
+const { findResponsiveLayoutIssues } = require('./responsive-layout-guard');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -977,6 +978,13 @@ function compileCanvasLocal(source, options = {}) {
   assertCanvasNavigationPaths(source, options);
   assertInlineCssStructure(source, options);
   const warnings = [];
+  findResponsiveLayoutIssues(source).forEach((issue) => {
+    warnings.push({
+      line: issue.line,
+      rule: issue.rule,
+      message: t(issue.messageKey, ...(issue.params || [])),
+    });
+  });
   assertCanvasThemeStructure(source, { ...options, onThemeWarning(message, details) {
     warnings.push({ ...details, message });
     if (options.onThemeWarning) { options.onThemeWarning(message, details); }

package/lib/app/page-linter.js

@@ -9,6 +9,7 @@ const {
 const { findBareCjkJsxTextIdentifiers } = require('./jsx-text-guard');
 const { findDirectFormOpenIssues } = require('./form-open-guard');
 const { findFormDetailLinkIssues } = require('./form-detail-link-guard');
+const { findResponsiveLayoutIssues } = require('./responsive-layout-guard');
 const Babel = require('@babel/standalone');
 
 const THEN_CALLBACK_LINE_LIMIT = 50;
@@ -1051,6 +1052,15 @@ function lintYidaSource(sourceCode, filePath) {
   findFormDetailLinkIssues(sourceCode, { parserOptions: PARSER_OPTIONS }).forEach((issue) => {
     pushIssue(errors, issue.line, 'form-detail-link', t('publish.lint_form_detail_link'), disableMap);
   });
+  findResponsiveLayoutIssues(sourceCode).forEach((issue) => {
+    pushIssue(
+      warnings,
+      issue.line,
+      issue.rule,
+      t(issue.messageKey, ...(issue.params || [])),
+      disableMap
+    );
+  });
   return { errors, warnings };
 }
 

package/lib/app/responsive-layout-guard.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const FIXED_WIDTH_THRESHOLD = 480;
+
+function getLine(source, index) {
+  return source.slice(0, index).split('\n').length;
+}
+
+function lineHasOptOut(source, index, marker) {
+  const lineStart = source.lastIndexOf('\n', index) + 1;
+  const lineEnd = source.indexOf('\n', index);
+  const line = source.slice(lineStart, lineEnd < 0 ? source.length : lineEnd);
+  return line.includes(marker);
+}
+
+/**
+ * Find high-confidence responsive layout risks shared by Canvas and legacy JSX pages.
+ * The checks stay advisory because viewport-owned overlays and fixed-size visualizations
+ * can be intentional; authors can add the documented line marker after reviewing one.
+ * @param {string} source
+ * @returns {Array<{line: number, rule: string, messageKey: string, params?: Array<unknown>}>>}
+ */
+function findResponsiveLayoutIssues(source) {
+  const text = String(source || '');
+  const issues = [];
+
+  const observerMatch = /new\s+(?:window\.)?ResizeObserver\s*\(/.exec(text);
+  if (observerMatch && !/\.\s*(?:disconnect|unobserve)\s*\(/.test(text)) {
+    issues.push({
+      line: getLine(text, observerMatch.index),
+      rule: 'resize-observer-cleanup',
+      messageKey: 'publish.lint_resize_observer_cleanup',
+    });
+  }
+
+  const viewportMatch = /(?:window\s*\.\s*innerWidth|matchMedia\s*\(\s*['"`]\s*\([^'"`]*(?:min|max)-width)/.exec(text);
+  const hasLayoutBranch = /(?:@media|grid-template-columns|gridTemplateColumns|flex-direction|flexDirection|\bmobile\b|\bisMobile\b)/.test(text);
+  const hasContainerSignal = /(?:@container|container-type|containerType|ResizeObserver|getBoundingClientRect\s*\(\s*\)\s*\.\s*width|\.\s*clientWidth\b)/.test(text);
+  if (
+    viewportMatch && hasLayoutBranch && !hasContainerSignal &&
+    !text.includes('openyida-responsive-viewport-ok')
+  ) {
+    issues.push({
+      line: getLine(text, viewportMatch.index),
+      rule: 'responsive-viewport-only',
+      messageKey: 'publish.lint_responsive_viewport_only',
+    });
+  }
+
+  const fixedWidthPattern = /(?:^|[\s{;,])width\s*:\s*['"]?(\d{3,})px?['"]?(?=\s*[,;}])/gm;
+  let fixedWidthMatch;
+  while ((fixedWidthMatch = fixedWidthPattern.exec(text)) !== null) {
+    const width = Number(fixedWidthMatch[1]);
+    if (
+      width >= FIXED_WIDTH_THRESHOLD &&
+      !lineHasOptOut(text, fixedWidthMatch.index, 'openyida-responsive-fixed-width-ok')
+    ) {
+      issues.push({
+        line: getLine(text, fixedWidthMatch.index),
+        rule: 'responsive-fixed-width',
+        messageKey: 'publish.lint_responsive_fixed_width',
+        params: [width],
+      });
+    }
+  }
+
+  const scaleMatch = /(?:transform\s*:\s*[^;\n}]*\bscale\s*\(|\bzoom\s*:)/.exec(text);
+  if (scaleMatch && !text.includes('openyida-responsive-scale-ok')) {
+    issues.push({
+      line: getLine(text, scaleMatch.index),
+      rule: 'responsive-page-scale',
+      messageKey: 'publish.lint_responsive_page_scale',
+    });
+  }
+
+  return issues;
+}
+
+module.exports = {
+  FIXED_WIDTH_THRESHOLD,
+  findResponsiveLayoutIssues,
+};

package/lib/core/command-manifest.js

@@ -648,7 +648,7 @@ const COMMAND_SIDE_EFFECTS = new Map([
     mutates_yida: true,
     mutates_local: true,
     read_actions: ['url', 'status', 'github status'],
-    mutating_actions: ['setup', 'dismiss', 'report', 'github star', 'github fork'],
+    mutating_actions: ['setup', 'dismiss', 'report', 'github setup --install --confirm', 'github star', 'github fork'],
   })],
   ['i18n', sideEffect('mixed', {
     mutates_yida: true,
@@ -2058,11 +2058,13 @@ const COMMAND_GROUPS = [
         requiresLogin: false,
       }),
       command('feedback', ['feedback'], 'feedback <report|github|setup|url|dismiss|status> [options]', 'help.cmd_feedback', { managedRun: { scope: 'actions', actions: { report: { scope: 'local' } } },
-        permission: actionDependentPermission({ preauthorized_actions: ['report', 'url', 'status', 'dismiss', 'github status'], ask_actions: ['setup', 'github star', 'github fork'] }),
+        permission: actionDependentPermission({ preauthorized_actions: ['report', 'url', 'status', 'dismiss', 'github status'], ask_actions: ['setup', 'github setup', 'github setup --install --confirm', 'github star', 'github fork'] }),
         requiresLogin: false,
         output: 'text|json',
-        examples: ['openyida feedback report --input summary.json --output-dir feedback-draft-001'],
-        notes: ['report prepares local review drafts only; no login, source checkout, update check or network submission. github status [--json] checks the authenticated github.com user, Star and personal Fork through an existing gh installation; it performs no writes. github star|fork --confirm [--json] requires the user to explicitly choose that account action. Missing gh/login, unknown status and declined actions never block Issue submission. Already applied actions are reused; writes are single-attempt with readback. No auto-update/install hook, Issue submission, clone or git remote modification. Managed runs permit only offline report preparation.'],
+        examples: ['openyida feedback report --input summary.json --output-dir feedback-draft-001', 'openyida feedback github setup --json', 'openyida feedback github setup --install --confirm --json'],
+        // Keep setup conservative in permission metadata: --install changes the local machine.
+        // The parser distinguishes read-only setup from a separately confirmed installation.
+        notes: ['github setup [--json] detects gh and verifies the current account without installing or logging in. github setup --install --confirm performs one user-approved installation via existing Homebrew (macOS/Linux) or WinGet (Windows), then checks gh again. No manager bootstrap, source changes, automatic retry, upgrade, or automatic login; unsupported environments use official instructions or the web. Browser authorization requires separate consent and public submission still requires content review. report prepares local review drafts only; no login, source checkout, update check or network submission. github status [--json] checks the authenticated github.com user, Star and personal Fork through an existing gh installation; it performs no writes. github star|fork --confirm [--json] requires the user to explicitly choose that account action. Missing gh/login, unknown status and declined actions never block Issue submission. Already applied actions are reused; writes are single-attempt with readback. No auto-update/install hook, Issue submission, clone or git remote modification. Managed runs permit only offline report preparation.'],
       }),
       command('batch', ['batch'], 'batch <file>|--commands "cmd1 ; cmd2" [--stop-on-error] [--json]', 'help.cmd_batch', { managedRun: { scope: 'denied', reason: 'scope_not_audited' },
         output: 'text|json',

package/lib/core/locales/en.js

@@ -1534,6 +1534,10 @@ Examples:
     lint_setstate_non_timestamp: 'this.setState writes a non-timestamp field. Custom page business state should live in _customState and be updated via forceUpdate()/setCustomState(); this.setState should only carry the timestamp contract field',
     lint_self_binding_missing: 'renderJsx uses this without declaring var self = this;. Add var self = this; at the top of renderJsx and use self inside closures/callbacks to avoid losing this',
     lint_echarts_dom_ready: 'echarts.init is not wrapped in setTimeout; the container may not be mounted yet so the chart may not render. Use setTimeout(function(){ /* echarts.init */ }, 300)',
+    lint_resize_observer_cleanup: 'ResizeObserver has no disconnect()/unobserve() cleanup and may keep measuring after unmount. Release it from the effect or lifecycle cleanup.',
+    lint_responsive_viewport_only: 'Layout changes only from viewport width, so a narrow desktop sidebar, drawer, or iframe may not degrade. Measure the content container with @container or a cleaned-up ResizeObserver. Add openyida-responsive-viewport-ok only for intentional viewport-owned behavior.',
+    lint_responsive_fixed_width: 'A fixed width of %spx may overflow a narrow container. Prefer max-width, minmax(0, 1fr), or local scrolling. Add openyida-responsive-fixed-width-ok only for an intentional fixed canvas.',
+    lint_responsive_page_scale: 'Whole-page scale/zoom was detected. Responsive layouts should reflow content while preserving readable text and touch targets. Add openyida-responsive-scale-ok only for an intentionally scaled local visualization.',
     lint_yida_api_catch: 'this.utils.yida API call has no detected .catch(); add error handling and toast the user',
     lint_echarts_legacy_map_china: 'ECharts 5 no longer supports echarts/map/js/china.js. Load DataV GeoJSON and call echarts.registerMap("china", geoJson) instead',
     lint_echarts_rich_label_formatter: 'ECharts label.formatter returning rich text templates is unstable in Yida custom pages; prefer plain formatter strings or precomputed label text',
@@ -2440,6 +2444,26 @@ Object.assign(module.exports.help, {'cmd_formula_contracts': 'Show formula forma
 Object.assign(module.exports.formula_v2, {'parallel_formula': 'Use conditions/rules or all:true for parallel branches; expression is currently supported only for route branches.'});
 
 module.exports.feedback_report = {
+  body: {
+    summary: 'Your goal',
+    actual: 'What happened',
+    expected: 'Expected result',
+    incident: 'Environment when the problem occurred',
+    command: 'Related operation',
+    steps: 'How to reproduce',
+    impact: 'Impact',
+    evidence: 'Observed evidence',
+    attempts: 'Attempts and results',
+    cause: 'Cause and confidence',
+    cause_evidence: 'Evidence for assessment',
+    next: 'Next verification',
+    screenshots: 'Screenshots',
+    review_image: 'Review image before sharing',
+    limitations: 'Test limitations',
+    generator: 'Report generator environment (not the incident environment)',
+    unknown: 'Unknown / not verified',
+    draft: 'Local draft — not submitted. Review text and screenshots for customer data, credentials and private information before sharing.',
+  },
   comparison: 'Test pass/fail requires a command, actual result and evidence.',
   screenshots: 'Choose at most five PNG/JPEG/WebP screenshots of at most 10 MiB each.',
   text: 'Feedback text fields must be strings of at most 12000 characters.',
@@ -2527,7 +2551,16 @@ module.exports.task_center = {
 };
 
 module.exports.feedback_github = {
-  usage: 'Usage: openyida feedback github <status|star|fork> [--confirm] [--json]',
+  setup_inspect_installation: 'Installation is unverified. Check gh --version, package-manager state or reopen the terminal before deciding to retry; keep the draft.',
+  setup_check_execution: 'gh could not run. Check execution permissions or the local environment; do not reinstall or switch accounts automatically.',
+  setup_confirm_install: 'GitHub CLI can be installed. Explain the plan and obtain consent before openyida feedback github setup --install --confirm --json; the web option remains available.',
+  setup_manual_install: 'Automatic installation is unavailable. Use the official instructions, an existing connector or the web; keep the draft.',
+  setup_ready: 'GitHub CLI and the current account are verified. Resume the draft; confirm public content and required permissions before submission.',
+  setup_browser_login: 'GitHub CLI is available and login is required. With consent, guide browser authorization, then rerun setup --json to verify.',
+  setup_check_account: 'GitHub CLI is available, but the account is unverified. Check network, authorization or rate limits; do not infer a missing account or reinstall.',
+  setup_consent: 'Use --install --confirm only after consent to install GitHub CLI and required dependencies in the package manager default location. Windows accepts WinGet source/package agreements and may need user-approved system permissions. No automatic manager installation, privilege escalation or login.',
+  setup_privacy: 'Installation is not consent to publish. The user authorizes in the browser; never request passwords, codes or tokens. If gh cannot store credentials securely, use the web or a secure connector. Keep account and tool diagnostics out of feedback reports.',
+  usage: 'Usage: openyida feedback github setup [--install --confirm] [--json]; openyida feedback github <status|star|fork> [--confirm] [--json]',
   confirmation: 'Star or Fork requires the user to explicitly choose that action before --confirm. Neither is required to submit an Issue.',
   failed: 'The GitHub action could not be verified. Inspect its status before retrying; this does not block Issue submission.',
 };

package/lib/core/locales/zh.js

@@ -1531,6 +1531,10 @@ openyida - 宜搭命令行工具
     lint_setstate_non_timestamp: '检测到 this.setState 写入非 timestamp 字段。业务态应写入 _customState 并调用 forceUpdate()/setCustomState() 触发重渲染；this.setState 仅用于 timestamp 契约字段',
     lint_self_binding_missing: 'renderJsx 内使用了 this 但未声明 var self = this;。请在 renderJsx 开头加入 var self = this;，闭包/回调内改用 self，避免 this 指向丢失',
     lint_echarts_dom_ready: 'echarts.init 未包裹在 setTimeout 中，容器可能尚未挂载导致图表不渲染。建议 setTimeout(function(){ /* echarts.init */ }, 300)',
+    lint_resize_observer_cleanup: 'ResizeObserver 缺少 disconnect()/unobserve() 清理，页面卸载后可能继续测量。请在 effect 或生命周期清理函数中释放 observer。',
+    lint_responsive_viewport_only: '布局只依据视口宽度变化，桌面侧栏、抽屉或 iframe 窄容器可能无法降级。请用 @container 或带清理的 ResizeObserver 测量实际内容容器；若确实是视口级行为，添加 openyida-responsive-viewport-ok 说明。',
+    lint_responsive_fixed_width: '检测到固定宽度 %spx，窄容器可能产生整页横向溢出。请改用 max-width、minmax(0, 1fr) 或局部滚动；确有固定画布需求时添加 openyida-responsive-fixed-width-ok 说明。',
+    lint_responsive_page_scale: '检测到 scale/zoom 整体缩放。响应式布局应重排内容并保留可读字号和点击区域；仅局部可视化确需缩放时添加 openyida-responsive-scale-ok 说明。',
     lint_yida_api_catch: 'this.utils.yida API 调用未检测到 .catch()，请补充错误处理并 toast 给用户',
     lint_echarts_legacy_map_china: 'ECharts 5 已废弃 echarts/map/js/china.js，请加载 DataV GeoJSON 后调用 echarts.registerMap("china", geoJson)',
     lint_echarts_rich_label_formatter: 'ECharts label.formatter 返回 rich text 模板在宜搭自定义页面环境不稳定，建议使用普通 formatter 字符串或预先拼好的标签文本',
@@ -2394,6 +2398,26 @@ Object.assign(module.exports.help, {'cmd_formula_contracts': '查看公式保存
 Object.assign(module.exports.formula_v2, {'parallel_formula': '并行分支使用 conditions/rules 或 all:true；expression 目前只适用于 route 分支。'});
 
 module.exports.feedback_report = {
+  body: {
+    summary: '想完成什么',
+    actual: '实际发生了什么',
+    expected: '希望看到什么结果',
+    incident: '问题发生时的环境',
+    command: '相关操作',
+    steps: '怎样重现',
+    impact: '影响',
+    evidence: '已观察的证据',
+    attempts: '尝试过的方法与结果',
+    cause: '可能的原因及确认程度',
+    cause_evidence: '判断依据',
+    next: '下一步验证',
+    screenshots: '问题截图',
+    review_image: '公开前请检查图片',
+    limitations: '尚未验证的范围',
+    generator: '报告生成环境（不代表问题发生时）',
+    unknown: '未知 / 尚未确认',
+    draft: '本地草稿，尚未提交。请检查文字和截图，确认没有客户数据、凭证或内部信息后再公开。',
+  },
   comparison: '测试通过或失败须提供真实命令、实际结果及证据。',
   screenshots: '截图须为明确选择的 PNG/JPEG/WebP，每张至多 10 MiB，最多 5 张。',
   text: '反馈文本字段须为不超过 12000 字符的字符串。',
@@ -2481,7 +2505,16 @@ module.exports.task_center = {
 };
 
 module.exports.feedback_github = {
-  usage: '用法：openyida feedback github <status|star|fork> [--confirm] [--json]',
+  setup_inspect_installation: '安装结果尚未核实。先检查 gh --version、包管理器状态或重新打开终端，再决定是否重试；草稿仍保留。',
+  setup_check_execution: 'gh 暂时无法运行。请检查执行权限或本机环境；不要重复安装或更换账号。',
+  setup_confirm_install: '可安装 GitHub CLI。先说明安装计划并取得用户同意，再执行 openyida feedback github setup --install --confirm --json；也可使用网页。',
+  setup_manual_install: '当前没有可用的自动安装方式。可查看官方安装说明、使用已有连接器或网页，草稿仍保留。',
+  setup_ready: 'GitHub CLI 和当前账号已验证。继续原草稿，提交前仍需核对公开内容和所需权限。',
+  setup_browser_login: 'GitHub CLI 已可用，需要登录。用户同意后引导浏览器授权，完成后再次运行 setup --json 核实。',
+  setup_check_account: 'GitHub CLI 已可用，但当前账号尚未核实。先检查网络、授权或限流；不要据此判断用户没有账号或要求重新安装。',
+  setup_consent: '仅在用户同意安装 GitHub CLI 及其必要依赖后使用 --install --confirm。使用包管理器默认位置；Windows 安装会接受 WinGet 来源和软件协议，可能需要用户批准系统权限。不自动安装包管理器、提权或登录。',
+  setup_privacy: '安装不代表同意公开提交。浏览器授权由用户完成；不索取密码、验证码或 Token。若 gh 无法安全保存凭证，改用网页或安全连接器；账号和工具诊断不写入反馈报告。',
+  usage: '用法：openyida feedback github setup [--install --confirm] [--json]; openyida feedback github <status|star|fork> [--confirm] [--json]',
   confirmation: 'Star 或 Fork 需要用户明确选择后再传入 --confirm；提交 Issue 不要求这两项操作。',
   failed: 'GitHub 操作未能核实完成，请先查询状态；这不影响提交 Issue。',
 };

package/lib/core/sample.js

@@ -60,6 +60,7 @@ const SAMPLES = {
     'canvas-theme': 'canvas-theme-provider.template.jsx',
     'canvas-navigation': 'canvas-navigation.jsx',
     'canvas-view-state': 'canvas-view-state.jsx',
+    'canvas-responsive-layout': 'canvas-responsive-layout.jsx',
     'canvas-admin-entry': 'canvas-admin-entry.jsx',
     'canvas-nav-side': 'canvas-nav/side.jsx',
     'canvas-nav-top': 'canvas-nav/top.jsx',
@@ -109,6 +110,7 @@ const SAMPLE_OUTPUT_FILENAMES = {
   'openyida-page-template/form-open-container': 'form-open-container.jsx',
   'openyida-page-template/canvas-dialog': 'canvas-dialog.jsx',
   'openyida-page-template/canvas-theme': 'canvas-theme.jsx',
+  'openyida-page-template/canvas-responsive-layout': 'canvas-responsive-layout.jsx',
   'yida-design/app-theme': 'app-theme.css',
 };
 
@@ -116,6 +118,7 @@ const SAMPLE_HINTS = {
   'openyida-page-template/canvas-admin-entry': '已包含统一跳转 helper；在 CanvasThemeProvider 内渲染 CanvasAdminWorkbenchButton，填写当前 appType 与真实 workbenchFormUuid。身份读取当前应用 loginUser.isAppAdmin，未知时隐藏；默认不跳开发后台或猜测管理首页。',
   'openyida-page-template/canvas-navigation': '先从资源回读填写 appType、目标类型与页面 ID；本页 Tab 用 selectView，独立前台用 custom，管理入口用 page，表单入口接 openForm；按钮和链接共用 buildCanvasPageUrl。',
   'openyida-page-template/canvas-theme': '以 CanvasThemeProvider 包住业务组件；Tabs 用于内容切换，Segmented/Radio 用于筛选，Button 用于动作。默认轻底选中态与可读文字，controls 可供自绘控件复用；避免内层固定色覆盖。保留内置加载遮罩防闪边样式；旧页面需更新 Provider 并重新发布。',
+  'openyida-page-template/canvas-responsive-layout': '合并 useContainerLayout 与 ResponsiveLayout；按实际内容容器重排筛选栏和主辅面板，宽表仅局部滚动，图表按 data-chart-width resize。业务状态放在布局壳之上，断点切换不得修改 key 或重挂载。',
   'openyida-page-template/canvas-nav-top': '顶部默认贴顶通栏；长页先合并 canvas-nav-content，CanvasNav 传 headerOnly，有首屏背景时传 overlay；悬浮外观仅显式 floating=true。',
   'openyida-page-template/canvas-nav-content': '合并 CanvasNavigationContent；长页用 layout=document，CanvasNav 传 headerOnly/overlay；默认 sticky，受宿主限制时用 navigationPosition=fixed。工作区用 workspace，宿主已分配高度时传 height。',
   'openyida-page-template/canvas-nav-data': '页内展示用 mode=local（key/viewKey/targetType=local），不请求平台菜单；platform 需真实资源 ID；independent 或声明 access 时必须接入真实 resolveAccess。保留 PRD 顺序与分组。',

package/lib/feedback/feedback.js

@@ -51,6 +51,7 @@ function printUsage() {
   openyida feedback setup <appType> [--name "OpenYida 体验反馈"] [--path /o/openyida-feedback] [--open|--no-open]
   openyida feedback setup --create-app [--app-name "OpenYida 体验反馈"] [--name "OpenYida 体验反馈"]
   openyida feedback report --input <summary.json> --output-dir <new-directory>
+  openyida feedback github setup [--install --confirm] [--json]
   openyida feedback github <status|star|fork> [--confirm] [--json]
   openyida feedback url [--tool Codex] [--model gpt-5] [--command publish] [--diagnostics "..."]
   openyida feedback dismiss --today|--forever|--reset
@@ -58,7 +59,7 @@ function printUsage() {
 
 说明:
   ${t('feedback_report.help')}
-  setup 会在宜搭创建一个公开反馈表单，并写入本地 .cache/openyida/feedback/config.json。
+  feedback setup 会在宜搭创建一个公开反馈表单，并写入本地 .cache/openyida/feedback/config.json。
   url 只生成带脱敏元数据的填写链接，不提交任何网络请求。
   dismiss/status 只读写本地提醒状态。
 `);

package/lib/feedback/github-setup.js

@@ -0,0 +1,97 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+const { t } = require('../core/i18n');
+
+const INSTALL_URL = 'https://github.com/cli/cli#installation';
+const LOGIN_COMMAND = 'gh auth login --hostname github.com --web --skip-ssh-key';
+
+/** Fixed argv only. Capture diagnostics privately, including package-manager failures. */
+function invoke(binary, args, options, installing = false) {
+  try {
+    return (options.spawnSyncFn || spawnSync)(binary, args, {
+      shell: false, encoding: 'utf8', timeout: installing ? 300000 : 15000,
+      maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
+      env: { ...(options.env || process.env), GH_HOST: 'github.com', GH_PROMPT_DISABLED: '1',
+        GIT_TERMINAL_PROMPT: '0', HOMEBREW_NO_AUTO_UPDATE: '1', HOMEBREW_NO_INSTALL_CLEANUP: '1',
+        HOMEBREW_NO_INSTALL_UPGRADE: '1', HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: '1', HOMEBREW_NO_SUDO: '1',
+        ...(installing ? { HOMEBREW_NO_ASK: '1' } : {}) },
+    });
+  } catch { return { status: null }; }
+}
+
+function toolState(options) {
+  const result = invoke('gh', ['--version'], options);
+  if (result.error?.code === 'ENOENT') { return { state: 'missing', version: null }; }
+  const version = String(result.stdout || '').match(/^gh version (\d+\.\d+\.\d+)\b/)?.[1];
+  return result.status === 0 && !result.error && version
+    ? { state: 'available', version } : { state: 'unverified', version: null };
+}
+
+function installPlan(options) {
+  const platform = options.platform || process.platform;
+  const binary = platform === 'win32' ? 'winget' : ['darwin', 'linux'].includes(platform) ? 'brew' : null;
+  if (!binary) { return { available: false, reason: 'unsupported_platform', url: INSTALL_URL }; }
+  const probe = invoke(binary, ['--version'], options);
+  if (probe.error || probe.status !== 0) {
+    return { available: false, reason: probe.error?.code === 'ENOENT' ? 'manager_missing' : 'manager_unverified', url: INSTALL_URL };
+  }
+  const args = binary === 'brew' ? ['install', 'homebrew/core/gh']
+    : ['install', '--id', 'GitHub.cli', '--exact', '--source', 'winget', '--no-upgrade', '--disable-interactivity',
+      '--accept-source-agreements', '--accept-package-agreements'];
+  return { available: true, binary, args, url: INSTALL_URL, requiresConsent: true };
+}
+
+function accountState(options) {
+  const result = invoke('gh', ['api', '--hostname', 'github.com', '--method', 'GET', 'user'], options);
+  if (result.status === 4 && !result.error) { return { state: 'login_required', login: null }; }
+  let account;
+  try { account = JSON.parse(result.stdout); } catch { /* Unknown response stays unverified. */ }
+  if (result.status === 0 && !result.error && account?.type === 'User'
+    && /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(account.login || '')) {
+    return { state: 'verified', login: account.login };
+  }
+  return { state: 'unverified', login: null };
+}
+
+/** Called only after the router validates consent and the managed-run boundary. */
+function setup(parsed, options) {
+  let tool = toolState(options);
+  const installation = { attempted: false, state: 'not_requested', plan: null };
+  if (tool.state === 'missing') {
+    installation.plan = installPlan(options);
+    if (parsed.install) {
+      installation.state = 'unavailable';
+      if (installation.plan.available) {
+        installation.attempted = true;
+        const result = invoke(installation.plan.binary, installation.plan.args, options, true);
+        tool = toolState(options);
+        installation.state = result.status === 0 && !result.error && tool.state === 'available'
+          ? 'verified' : 'unverified';
+      }
+    }
+  } else if (parsed.install) {
+    installation.state = tool.state === 'available' ? 'already_available' : 'unavailable';
+  }
+  const account = tool.state === 'available' ? accountState(options) : { state: 'not_checked', login: null };
+  const ready = tool.state === 'available' && account.state === 'verified';
+  const nextStep = installation.state === 'unverified' ? 'inspect_installation'
+    : tool.state === 'unverified' ? 'check_execution'
+      : tool.state === 'missing' ? (installation.plan?.available ? 'confirm_install' : 'manual_install')
+        : ready ? 'ready' : account.state === 'login_required' ? 'browser_login' : 'check_account';
+  return {
+    success: !parsed.install || ['verified', 'already_available'].includes(installation.state),
+    action: 'setup', tool, account, ready, installation, nextStep,
+    message: t(`feedback_github.setup_${nextStep}`),
+    consentNotice: t('feedback_github.setup_consent'),
+    privacyNotice: t('feedback_github.setup_privacy'),
+    authorization: { performed: false, requiresSeparateConsent: true,
+      command: tool.state === 'available' && !ready ? LOGIN_COMMAND : null,
+      url: 'https://cli.github.com/manual/gh_auth_login' },
+    links: { install: INSTALL_URL, signup: 'https://github.com/signup', issue: 'https://github.com/openyida/openyida/issues/new' },
+    submissionPerformed: false, publicConfirmationRequired: true,
+    inspectBeforeRetry: installation.state === 'unverified',
+  };
+}
+
+module.exports = { setup };

package/lib/feedback/github.js

@@ -11,15 +11,18 @@ const links = Object.freeze({ repository: `https://github.com/${REPOSITORY}`,
 /** Parse explicit account actions; submitting an Issue never implies Star or Fork consent. */
 function parseArgs(args = []) {
   const [action, ...flags] = args;
-  if (!['status', 'star', 'fork'].includes(action) || new Set(flags).size !== flags.length
-    || flags.some(flag => !['--json', '--confirm'].includes(flag))
-    || (action === 'status' && flags.includes('--confirm'))) {
+  const install = flags.includes('--install');
+  if (!['status', 'star', 'fork', 'setup'].includes(action) || new Set(flags).size !== flags.length
+    || flags.some(flag => !['--json', '--confirm', '--install'].includes(flag))
+    || (install && action !== 'setup')
+    || (action === 'status' && flags.includes('--confirm'))
+    || (action === 'setup' && !install && flags.includes('--confirm'))) {
     throw new CliError(t('feedback_github.usage'), { code: 'FEEDBACK_GITHUB_USAGE' });
   }
-  if (action !== 'status' && !flags.includes('--confirm')) {
-    throw new CliError(t('feedback_github.confirmation'), { code: 'FEEDBACK_GITHUB_CONFIRMATION_REQUIRED' });
+  if ((['star', 'fork'].includes(action) || install) && !flags.includes('--confirm')) {
+    throw new CliError(t(install ? 'feedback_github.setup_consent' : 'feedback_github.confirmation'), { code: 'FEEDBACK_GITHUB_CONFIRMATION_REQUIRED' });
   }
-  return { action, confirm: flags.includes('--confirm') };
+  return { action, confirm: flags.includes('--confirm'), ...(action === 'setup' ? { install } : {}) };
 }
 
 /** Run gh against github.com only. Never expose its raw output or credential diagnostics. */
@@ -90,10 +93,12 @@ function inspect(options) {
 
 /** Execute one explicitly authorized action, then read it back. No retry, clone, remote change or Issue submission. */
 function execute(parsed, options = {}) {
-  const { action } = parseArgs([parsed.action, ...(parsed.confirm === true ? ['--confirm'] : [])]);
+  const validated = parseArgs([parsed.action, ...(parsed.confirm === true ? ['--confirm'] : []), ...(parsed.install === true ? ['--install'] : [])]);
+  const { action } = validated;
   if ((options.env || process.env).OPENYIDA_MANAGED_RUN === '1') {
     throw new CliError(t('feedback_github.failed'), { code: 'FEEDBACK_GITHUB_MANAGED_DENIED' });
   }
+  if (action === 'setup') { return require('./github-setup').setup(validated, options); }
   const result = inspect(options);
   if (action === 'status') { return result; }
   const fail = (stage, mutationPerformed = false) => {
@@ -124,7 +129,11 @@ function execute(parsed, options = {}) {
 /** CLI entrypoint. The confirmation flag attests to the user's explicit choice of this action. */
 function run(args = []) {
   const parsed = parseArgs(args);
-  console.log(JSON.stringify(execute(parsed), null, 2));
+  const result = execute(parsed);
+  if (result.success === false) {
+    throw new CliError(result.message, { code: 'FEEDBACK_GITHUB_SETUP_FAILED', details: result });
+  }
+  console.log(JSON.stringify(result, null, 2));
 }
 
 module.exports = { parseArgs, execute, run };

package/lib/feedback/report.js

@@ -13,6 +13,15 @@ const MAX_INPUT_BYTES = 1024 * 1024;
 const REPOSITORY = 'openyida/openyida';
 const TEXT_FIELDS = ['title', 'summary', 'command', 'expected', 'actual', 'impact', 'tool', 'model'];
 const LIST_FIELDS = ['steps', 'evidence', 'attempts'];
+const INCIDENT_FIELDS = ['openyida', 'node', 'platform', 'arch', 'installation', 'browser', 'deployment', 'organizationContext'];
+
+function incidentEnvironment(value) {
+  if (value === undefined) {value = {};}
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {throw invalid('object');}
+  // Only explicit incident facts belong here. The reporting process may run
+  // after an upgrade or on another machine; never infer incident versions.
+  return Object.fromEntries(INCIDENT_FIELDS.map(key => [key, sanitizeText(value[key])]));
+}
 
 function comparisonRun(value) {
   if (value === undefined) {return { status: 'not_run', evidence: [] };}
@@ -98,6 +107,8 @@ function buildReport(input) {
     throw invalid('confirmed');
   }
   report.screenshots = [];
+  report.incidentEnvironment = incidentEnvironment(input.incidentEnvironment);
+  // Retain this output contract for existing consumers: generator context only.
   report.environment = {
     openyida: require('../../package.json').version,
     node: process.version,
@@ -114,17 +125,28 @@ function buildReport(input) {
 
 // Escape markup so copied diagnostics cannot inject images, links or HTML in an issue.
 function markdownText(value) {
-  return String(value || 'Unknown / not verified').replace(/[\\`*_{}[\]<>()#!|~]/g, '\\$&');
+  return String(value || t('feedback_report.body.unknown')).replace(/[\\`*_{}[\]<>()#!|~]/g, '\\$&');
 }
 
 function renderMarkdown(report) {
+  const label = key => t('feedback_report.body.' + key);
+  const incident = report.incidentEnvironment || {};
+  const environmentLines = Object.entries({
+    openyida: incident.openyida, node: incident.node, platform: incident.platform, arch: incident.arch,
+    installation: incident.installation, tool: report.tool, model: report.model,
+    ...Object.fromEntries(['browser', 'deployment', 'organizationContext']
+      .filter(key => incident[key]).map(key => [key, incident[key]])),
+  }).map(([key, value]) => `${key}: ${value || label('unknown')}`);
   const sections = [
-    ['Summary', report.summary], ['Command scenario', report.command],
-    ['Steps to reproduce', report.steps], ['Expected', report.expected], ['Actual', report.actual],
-    ['Impact', report.impact], ['Evidence (observed)', report.evidence], ['Attempts and results', report.attempts],
-    ['Root cause assessment', `${report.cause.category} / ${report.cause.status}\n${report.cause.summary || 'Not established'}`],
-    ['Evidence for assessment', report.cause.evidence], ['Next verification', report.cause.nextSteps],
-    ['Reproduction screenshots', report.screenshots.map(item => `${item.file}: ${item.description || 'Review image before sharing'}`)],
+    [label('summary'), report.summary || label('unknown')],
+    [label('actual'), report.actual], [label('expected'), report.expected || label('unknown')],
+    [label('incident'), environmentLines],
+    [label('command'), report.command], [label('steps'), report.steps],
+    [label('impact'), report.impact], [label('evidence'), report.evidence], [label('attempts'), report.attempts],
+    ...(report.cause.summary || report.cause.status !== 'unknown' || report.cause.category !== 'unknown'
+      ? [[label('cause'), `${report.cause.category} / ${report.cause.status}\n${report.cause.summary}`]] : []),
+    [label('cause_evidence'), report.cause.evidence], [label('next'), report.cause.nextSteps],
+    [label('screenshots'), report.screenshots.map(item => `${item.file}: ${item.description || label('review_image')}`)],
     ...(['before', 'after', 'regression'].some(key => report.comparison[key].status !== 'not_run') || report.comparison.limitations.length ? ['before', 'after', 'regression'] : []).map(key => [
       `Test comparison: ${key}`, [
         `Status: ${report.comparison[key].status}`,
@@ -134,19 +156,17 @@ function renderMarkdown(report) {
         ...(report.comparison[key].evidence || []),
       ],
     ]),
-    ...(report.comparison.limitations.length ? [['Test limitations', report.comparison.limitations]] : []),
-  ];
+    ...(report.comparison.limitations.length ? [[label('limitations'), report.comparison.limitations]] : []),
+    [label('generator'), Object.entries(report.environment).map(([key, value]) => `${key}: ${value}`)],
+  ].filter(([, value]) => Array.isArray(value) ? value.length : Boolean(value));
   return [
     `# ${markdownText(report.title)}`, '',
-    'Local draft — not submitted. Review business data and private repository information before sharing.', '',
-    `Fingerprint: ${report.fingerprint}`, `Observed occurrences: ${report.occurrenceCount || 'Unknown'}`, '',
-    '## Environment', '',
-    ...Object.entries({ ...report.environment, tool: report.tool, model: report.model })
-      .map(([key, value]) => `- ${key}: ${markdownText(value)}`), '',
+    label('draft'), '',
     ...sections.flatMap(([heading, value]) => [
       `## ${heading}`, '',
-      Array.isArray(value) ? (value.length ? value.map(item => `- ${markdownText(item)}`).join('\n') : 'Unknown / not verified') : markdownText(value), '',
+      Array.isArray(value) ? value.map(item => `- ${markdownText(item)}`).join('\n') : markdownText(value), '',
     ]),
+    `Fingerprint: ${report.fingerprint}`, `Observed occurrences: ${report.occurrenceCount || label('unknown')}`, '',
   ].join('\n');
 }
 

package/lib/samples/openyida-scaffold/canvas-nav/mixed.jsx

@@ -12,7 +12,7 @@ function CanvasNav({ items = [], activeKey, onSelect, title, logo, actions, chil
       .oy-canvas-nav.oy-nav-mixed .oy-nav-sidebar { padding: var(--pod-nav-l-aside-padding, 8px); }
       .oy-nav-mixed .oy-nav-content { flex: 1; }
       .oy-nav-mixed .oy-nav-menu { display: flex; flex-direction: column; gap: var(--pod-nav-menu-gap, 8px); }
-      @media (max-width: 767px) {
+      @container (max-width: 767px) {
         .oy-nav-mixed .oy-nav-groups { flex-basis: 100%; }
         .oy-nav-mixed .oy-nav-body { display: block; }
         .oy-nav-mixed .oy-nav-menu { flex-direction: row; overflow-x: auto; border-right: 0; border-bottom: 1px solid var(--pod-nav-sub-divider-color, var(--color-line1-1, #ddd)); }

package/lib/samples/openyida-scaffold/canvas-nav/shared.jsx

@@ -4,7 +4,7 @@ import React from 'react';
 // 这是可选实现示例；导航外观按 design.md 设计，已有 UI 无需替换成示例默认样式。
 // 选中菜单标识当前页面，main 用 aria-label 命名，children 直接承载业务内容。
 const CANVAS_NAV_CSS = `
-  .oy-canvas-nav { display: flow-root; min-width: 0; min-height: 100vh; background: var(--pod-page-bg-color, var(--color-white, #fff)); }
+  .oy-canvas-nav { container-type: inline-size; display: flow-root; min-width: 0; min-height: 100vh; background: var(--pod-page-bg-color, var(--color-white, #fff)); }
   .oy-canvas-nav .oy-nav-surface {
     background: var(--pod-shell-theme-bg-color, var(--pod-nav-popup-bg-color, var(--color-white, #fff)));
     color: var(--pod-nav-item-text-color, var(--color-text1-4, #1f2329));

package/lib/samples/openyida-scaffold/canvas-nav/side.jsx

@@ -6,7 +6,7 @@ function CanvasNav({ items = [], activeKey, onSelect, title, logo, actions, chil
       .oy-nav-side .oy-nav-content { flex: 1; }
       .oy-nav-side .oy-nav-brand { min-height: var(--pod-nav-platform-header-height, 48px); }
       .oy-nav-side .oy-nav-menu { display: flex; flex-direction: column; gap: var(--pod-nav-menu-gap, 8px); }
-      @media (max-width: 767px) { .oy-nav-side { display: block; } }
+      @container (max-width: 767px) { .oy-nav-side { display: block; } }
     `}</style>
     <CanvasSidebar title={title} logo={logo} actions={actions} activeKey={activeKey} defaultWidth={sidebarWidth} defaultCollapsed={defaultCollapsed}>
       <nav aria-label="应用导航" className="oy-nav-menu">