openyida 2026.6.22-beta.0 → 2026.7.6

package/README.md

@@ -69,7 +69,7 @@ OpenYida detects the active agent environment, workspace path, login state, and
 openyida login
 ```
 
-In Codex, QoderWork, Qoder, Wukong, Claude Code, OpenCode, Cursor, and other detected AI tools, OpenYida first tries local Chrome/Edge/Chromium CDP when no valid cached login exists. If local CDP is unavailable, it falls back to an AI-dialog QR handoff. The agent should render `qr_image_markdown` or paste `agent_response_markdown` directly in the conversation so the QR code is visible, then run `poll_command` after the user scans it with DingTalk. If image rendering is unavailable, fall back to `qr_url`. The explicit `openyida login --browser` command still prefers CDP first and uses Playwright as an optional browser fallback.
+In Codex, QoderWork, Qoder, Wukong, Claude Code, MuleRun, OpenCode, Cursor, and other detected AI tools, OpenYida first tries local Chrome/Edge/Chromium CDP when no valid cached login exists. If local CDP is unavailable, it falls back to an AI-dialog QR handoff. The agent should render `qr_image_markdown` or paste `agent_response_markdown` directly in the conversation so the QR code is visible, then run `poll_command` after the user scans it with DingTalk. If image rendering is unavailable, fall back to `qr_url`. The explicit `openyida login --browser` command still prefers CDP first and uses Playwright as an optional browser fallback.
 
 When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and cookie file. For example, Alibaba intranet Yida uses `cookies-alibaba.json`:
 
@@ -126,6 +126,7 @@ export PATH="$HOME/.real/.bin/node/bin:$PATH"
 |------|---------|
 | [Codex](https://openai.com/codex/) | Full support |
 | [Claude Code](https://claude.ai/code) | Full support |
+| [MuleRun](https://mulerun.com) | Full support |
 | [Aone Copilot](https://copilot.code.alibaba-inc.com) | Full support |
 | [OpenCode](https://opencode.ai) | Full support |
 | [Cursor](https://cursor.com/) | Full support |
@@ -263,6 +264,59 @@ Useful options:
 
 Use `npm run test:e2e:real:cleanup` to list recorded disposable resources. OpenYida does not yet expose a safe app/form deletion command, so cleanup is intentionally a registry-backed audit step rather than an automatic destructive action.
 
+### Skill Evaluation Harness
+
+The E2E paths above prove the *CLI* works. The eval harness under `scripts/eval/` measures whether the *agent* still routes natural-language requests to the right sub-skill and produces good output after you edit `yida-skills/SKILL.md`. It is the feedback loop for harness engineering.
+
+```bash
+# Routing eval — "did it pick the right sub-skill?" No real resources, no login.
+# Drives a headless `claude -p` agent with each scenario prompt and checks
+# the selected sub-skill against the golden set.
+npm run eval:routing
+
+# Tool-pipeline baseline (end-to-end) — wraps the real-environment runner for one
+# sub-skill, adds guardrail assertions, screenshots the published page, and writes a
+# human scoring template. Runs deterministic CLI commands (no agent) so it serves as
+# a control that proves the build→publish→screenshot→score plumbing itself works.
+# Requires OPENYIDA_E2E=1 and a valid cookie cache.
+OPENYIDA_E2E=1 npm run eval:e2e -- --skill yida-dashboard --screenshot
+
+# Same, plus automatic screenshot scoring via the local multimodal `claude -p`.
+OPENYIDA_E2E=1 npm run eval:e2e -- --skill yida-dashboard --screenshot --auto-score
+
+# Real-generation eval — "can one sentence really build a usable app?" Feeds a
+# natural-language request ("帮我创建一个订单管理系统") to a headless `claude -p`
+# that actually reads the openyida skill and runs the CLI to build a real app, then
+# reuses the screenshot + scoring + report pipeline. Creates real 宜搭 resources, so
+# it needs OPENYIDA_E2E=1 + an authenticated agent. Unlike the deterministic baseline
+# above, here the agent self-orchestrates.
+OPENYIDA_E2E=1 npm run eval:generate -- --screenshot
+
+# Run all three in one pass (routing + tool-pipeline baseline + real generation).
+OPENYIDA_E2E=1 npm run eval:all -- --skill yida-dashboard --screenshot
+
+# Optional: a zero-dependency local web console (buttons + live streamed output)
+# that runs the tasks above on click. Binds to 127.0.0.1 only; tasks are a fixed
+# whitelist. Use the Node version you start it with, so run `nvm use 20` first.
+npm run eval:dashboard          # http://127.0.0.1:4500
+```
+
+Configuration precedence is `CLI flag > env (OPENYIDA_EVAL_*) > scripts/eval/eval.config.json > defaults`.
+
+| Flag | Purpose |
+|------|---------|
+| `--mode e2e\|routing\|generate\|all` | Which evals to run (default `e2e`; `all` = routing + tool-pipeline baseline + real generation) |
+| `--skill <name>` | Restrict the e2e run to one sub-skill; stages are reverse-looked-up from the `SKILL_COVERAGE` matrix |
+| `--stages a,b` | Explicit stage list, overriding the skill reverse-lookup |
+| `--screenshot` / `--no-screenshot` | Capture the published page (default on; skipped gracefully if Playwright is absent) |
+| `--auto-score` / `--no-auto-score` | Score screenshots with the local `claude -p` agent (default off → human template only) |
+| `--scenarios <dir>` | Routing golden-set directory (default `scripts/eval/scenarios`) |
+| `--gen-scenarios <dir>` | Real-generation golden-set directory (default `scripts/eval/scenarios/generation`) |
+
+Results are written back into the existing `acceptance-manifest.json` under a new `eval` section (guardrails, screenshots, scores) plus two sibling artifacts: a `scoring.md` human-scoring template and a self-contained `eval-report.html` visual report (screenshots inlined as base64, so the single file opens anywhere). Routing results land in `project/.cache/eval/routing-report.json`; generation results (with their own `scoring.md` + `eval-report.html`) land in `project/.cache/eval/generate/gen-<timestamp>/`. The harness degrades gracefully: a missing Playwright skips screenshots (enable with `npm install --no-save playwright && npx playwright install chromium`), and a missing `claude` CLI skips auto-scoring while keeping the human template. A guardrail failure (for example a resource-creating command issued before a successful `login --check-only`) fails the run.
+
+A zero-dependency local dashboard (`npm run eval:dashboard`, then open `http://127.0.0.1:4500`) drives these runs from buttons and streams output live; its "📊 查看最新报告" button opens the most recent `eval-report.html`.
+
 ### Connectors, Integrations, and Reports
 
 ```bash
@@ -301,7 +355,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
 | `openyida update-app <appType> [--name "..."] [--layout slide\|ver] [--theme deepBlue]` | Update app info |
-| `openyida nav-group <list\|create\|rename\|delete\|move\|hide\|show> <appType> ...` | Manage app sidebar navigation groups |
+| `openyida nav-group <list\|create\|rename\|delete\|move\|order\|hide\|show> <appType> ...` | Manage app sidebar navigation groups |
 | `openyida app-permission <get\|set\|add\|remove\|search-user> ...` | Manage app primary, data, and developer admins |
 | `openyida i18n <overview\|config\|languages\|list\|upsert\|delete\|translate\|translate-all\|upgrade> <appType> ...` | Manage app multilingual copy and language config |
 | `openyida export <appType> [output]` | Export app (generate migration package) |
@@ -322,6 +376,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida list-forms <appType> [--keyword <text>]` | List forms/pages in an app |
 | `openyida aggregate-table <list\|create-empty\|inspect\|preview\|save\|publish\|status> <appType> ...` | Manage aggregate tables (virtualView) |
 | `openyida get-schema <appType> <formUuid\|--all>` | Get one form Schema or all form Schemas |
+| `openyida er <appType> [--format mermaid\|json] [--output file] [--include-system] [--include-pages]` | Export app entity relationship diagram |
 | `openyida create-page <appType> "<name>" [--mode dashboard] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a custom display page |
 | `openyida generate-page <template>` | Generate page from curated template |
 | `openyida build-page <sourceFile> [--output file\|--write]` | Build Yida-compatible page source |
@@ -389,7 +444,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida integration create <appType> ...` | Create integration automation flow |
+| `openyida integration create <appType> ... [--spec file.json]` | Create integration automation flow |
 | `openyida integration list <appType> [--form-uuid <uuid>] [--status y\|n] [--json]` | List integration automation flows |
 | `openyida integration enable <appType> <formUuid> <processCode>` | Enable integration automation flow |
 | `openyida integration disable <appType> <formUuid> <processCode>` | Disable integration automation flow |

package/bin/yida.js

@@ -27,6 +27,8 @@ function isAgentEnvironment(env) {
     env.CODEX_HOME ||
     env.CLAUDE_CODE ||
     env.CLAUDE_CODE_ENTRYPOINT ||
+    env.MULERUN_CHAT_ID ||
+    env.MULE_DATA_DIR ||
     env.OPENCODE ||
     env.OPENCODE_CLIENT ||
     env.QODER_IDE ||
@@ -212,6 +214,16 @@ function handleFirstRunGuide() {
 function printLoginResult(result) {
   noteLoginCommandResult(result);
 
+  if (!result) {
+    console.log(JSON.stringify({
+      ok: false,
+      status: 'login_failed',
+      can_auto_use: false,
+      error: 'login_failed',
+    }));
+    return;
+  }
+
   if (result && (result.status === 'need_qr_scan' || result.status === 'need_corp_selection')) {
     console.log(JSON.stringify(result));
     return;
@@ -243,6 +255,11 @@ function printLoginResult(result) {
     return;
   }
 
+  if (result.status && result.status !== 'ok' && !result.csrf_token) {
+    console.log(JSON.stringify(result));
+    return;
+  }
+
   const summary = {
     ok: true,
     base_url: result && result.base_url,
@@ -311,9 +328,11 @@ function shouldUsePlaywrightFallbackInAgentLogin() {
   return hasDesktopEnvironment() || process.env.OPENYIDA_AGENT_PLAYWRIGHT_FALLBACK === '1';
 }
 
-function shouldUseDesktopBrowserLogin() {
-  const { hasDesktopEnvironment } = require('../lib/core/utils');
-  return hasDesktopEnvironment();
+function shouldUseLocalBrowserLogin(options = {}) {
+  const { hasLocalBrowserLoginCapability } = require('../lib/auth/login');
+  return hasLocalBrowserLoginCapability({
+    playwrightFallback: options.playwrightFallback,
+  });
 }
 
 function shouldUseCodexQrLogin(cliArgs) {
@@ -540,6 +559,7 @@ async function main() {
     case 'login': {
       const { checkLoginOnly } = require('../lib/auth/login');
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
+      const { isInjectedAuthMode } = require('../lib/core/utils');
       if (loginArgs.includes('--agent-poll') || loginArgs.includes('--codex-poll')) {
         const sessionFile = getArgValue(loginArgs, '--agent-poll') || getArgValue(loginArgs, '--codex-poll');
         const { pollCodexQrLogin } = require('../lib/auth/qr-login');
@@ -554,9 +574,12 @@ async function main() {
           corpId: getArgValue(loginArgs, '--corp-id'),
         });
         printLoginResult(result);
-      } else if (loginArgs[0] === '--check-only') {
+      } else if (loginArgs.includes('--check-only')) {
         const result = checkLoginOnly({ includeSecrets: loginArgs.includes('--with-cookies') });
         console.log(JSON.stringify(result, null, 2));
+      } else if (isInjectedAuthMode()) {
+        const result = checkLoginOnly({ includeSecrets: true });
+        printLoginResult(result);
       } else if (shouldUseCodexQrLogin(loginArgs)) {
         const { startCodexQrLogin } = require('../lib/auth/qr-login');
         const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
@@ -578,26 +601,17 @@ async function main() {
         if (cachedResult.status === 'ok') {
           printLoginResult(cachedResult);
         } else {
-          const { detectActiveTool } = require('../lib/core/utils');
-          const activeTool = detectActiveTool();
           const { interactiveLogin } = require('../lib/auth/login');
-          const browserResult = interactiveLogin({
-            playwrightFallback: shouldUsePlaywrightFallbackInAgentLogin(),
-          });
+          const playwrightFallback = shouldUsePlaywrightFallbackInAgentLogin();
+          const browserResult = shouldUseLocalBrowserLogin({ playwrightFallback })
+            ? interactiveLogin({ playwrightFallback })
+            : null;
           if (browserResult) {
             printLoginResult(browserResult);
           } else {
-            // CDP/Playwright 失败后的兜底策略：
-            // Wukong/QoderWork 有 in-app browser，优先使用 browser handoff；其余走 AI 对话框 QR handoff。
-            if (activeTool && (activeTool.tool === 'wukong' || activeTool.tool === 'qoderwork')) {
-              const { codexLogin } = require('../lib/auth/codex-login');
-              const result = await codexLogin({ tool: activeTool.tool });
-              printLoginResult(result);
-            } else {
-              const { startCodexQrLogin } = require('../lib/auth/qr-login');
-              const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
-              printLoginResult(result);
-            }
+            const { startCodexQrLogin } = require('../lib/auth/qr-login');
+            const result = await startCodexQrLogin({ corpId: getArgValue(loginArgs, '--corp-id') });
+            printLoginResult(result);
           }
         }
       } else if (shouldUseBrowserHandoffLogin(loginArgs)) {
@@ -615,7 +629,7 @@ async function main() {
           printLoginResult(cachedResult);
           break;
         }
-        if (shouldUseDesktopBrowserLogin()) {
+        if (shouldUseLocalBrowserLogin({ playwrightFallback: true })) {
           const { interactiveLogin } = require('../lib/auth/login');
           const browserResult = interactiveLogin({ playwrightFallback: true });
           if (browserResult) {
@@ -758,6 +772,12 @@ async function main() {
       break;
     }
 
+    case 'er': {
+      const { run } = require('../lib/app/er');
+      await run(args);
+      break;
+    }
+
     case 'formula': {
       const subCommand = args[0];
       const subArgs = args.slice(1);

package/lib/app/create-form.js

@@ -66,6 +66,7 @@ const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('..
 const { banner, step, label, success, fail, warn, info, error, result, usage, hint, listItem } = require('../core/chalk');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { default: babelTransform } = require('../core/babel-transform');
+const { normalizeFormulaFieldRefs } = require('../formula/evaluate');
 
 // ── 选项类字段类型 ───────────────────────────────────
 const OPTION_FIELD_TYPES = ['RadioField', 'SelectField', 'CheckboxField', 'MultiSelectField'];
@@ -3601,13 +3602,34 @@ function jsString(value) {
   return JSON.stringify(value === undefined ? '' : value);
 }
 
+function compileCustomValidateSource(source) {
+  const funcSource = String(source || 'function validateRule(value) { return true; }').trim();
+  return 'function main(){\n    \n    "use strict";\n\nvar __compiledFunc__ = '
+      + funcSource
+      + ';\n    return __compiledFunc__.apply(this, arguments);\n  }';
+}
+
 function normalizeCustomValidateParam(param) {
-  if (param && typeof param === 'object' && param.type === 'JSExpression') {
-    return param;
+  if (param && typeof param === 'object' && param.type === 'js') {
+    const source = param.source || 'function validateRule(value) { return true; }';
+    return {
+      compiled: param.compiled || compileCustomValidateSource(source),
+      source: source,
+      type: 'js',
+      error: param.error || {},
+    };
+  }
+  let funcSource = typeof param === 'string' ? param
+    : (param && typeof param === 'object' && param.type === 'JSExpression') ? String(param.value || '')
+      : String(param || '');
+  if (!funcSource || !/function/.test(funcSource)) {
+    funcSource = 'function validateRule(value) { return true; }';
   }
   return {
-    type: 'JSExpression',
-    value: String(param || 'function validateRule(value) { return true; }'),
+    compiled: compileCustomValidateSource(funcSource),
+    source: funcSource,
+    type: 'js',
+    error: {},
   };
 }
 
@@ -3617,6 +3639,9 @@ function buildCustomValidateExpressionParam(rule) {
 
 function buildCustomValidateParam(rule) {
   if (rule.type === 'customValidate' && rule.param) {
+    if (typeof rule.param === 'object' && rule.param.type === 'js') {
+      return rule.param;
+    }
     return typeof rule.param === 'object' && rule.param.type === 'JSExpression'
       ? String(rule.param.value || '')
       : String(rule.param);
@@ -4357,6 +4382,11 @@ async function saveSchemaAndUpdateConfig(authRef, appType, formUuid, schema, ver
   const saveStep = stepOffset || 4;
   const configStep = saveStep + 1;
 
+  const fixedRefs = normalizeFormulaFieldRefs(schema);
+  if (fixedRefs > 0) {
+    info(t('create_form.formula_prefix_fixed', fixedRefs));
+  }
+
   step(saveStep, t('create_form.step_save_schema', saveStep));
   info(t('create_form.sending_save'));