openyida 2026.7.19 → 2026.7.22

package/README.md

@@ -174,6 +174,7 @@ openyida corp-efficiency
 openyida create-form create APP_XXX "Customer" .cache/openyida/forms/customer-fields.json
 openyida create-form update APP_XXX FORM_XXX .cache/openyida/forms/customer-changes.json
 openyida get-schema APP_XXX FORM_XXX
+openyida get-schema APP_XXX FORM_XXX --compact --resolve-fields "Customer Name,Status"
 openyida get-schema APP_XXX --all --output-dir .cache/schemas
 ```
 
@@ -240,6 +241,7 @@ Most checks should stay offline, but OpenYida also includes an explicit real-env
 OPENYIDA_E2E=1 npm run test:e2e:real
 OPENYIDA_E2E=1 npm run test:e2e:real:full
 OPENYIDA_E2E=1 OPENYIDA_E2E_FULL_STAGES=auth,app,form,process npm run test:e2e:real:full
+npm run test:e2e:real:schema-source
 npm run test:e2e:real:skills
 ```
 
@@ -249,6 +251,8 @@ The runner creates a disposable app, form, and custom page with an `OY_E2E_*` pr
 
 `test:e2e:real:skills` enforces coverage for every directory under `yida-skills/skills/`. Each skill must be classified as real E2E, offline/unit, opt-in, or deprecated with an explicit reason. This prevents new skills from quietly bypassing the real-environment test plan.
 
+`test:e2e:real:schema-source` is a local process-level Schema-as-Code E2E for agent/source checkout validation. It reads `yida-skills/` in place, creates a temporary `openyida` launcher that executes the current checkout `bin/yida.js`, and runs CRM app/form/page/process create, managed-update, and noop scenarios through `schema validate -> plan -> apply -> noop` against a mock Yida service, including customer field updates and approval-flow/page changes. Report and integration automation manifests remain compatibility-boundary scenarios and must return unsupported.
+
 Each successful full run leaves a human-inspectable result app in the target organization. The final step publishes a dedicated `Full E2E Dashboard` custom page, renames the app to `OY_E2E_*_PASSED` by default, and prints direct links for the app, form, dashboard page, and report; the same links are saved under `resultApp` in the registry JSON.
 
 Useful options:
@@ -354,6 +358,8 @@ openyida append-chart APP_XXX REPORT_XXX .cache/openyida/reports/chart.json
 
 Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
+Schema-as-Code Phase 1 manages app, form, process, and native/default display page resources. Use the single [Phase 1 Manifest guide](yida-skills/references/schema-as-code-phase1.md): create any referenced page source first, run `validate`, run the read-only `plan`, review its current `planId`, then explicitly approve and run `apply`. Error `nextAction`/`ask_human` never grants the first write; `stale_replanned` only returns a replacement plan for another explicit review. State is the only persisted bindings authority; report, automation, and page config/delete/pull remain outside Phase 1.
+
 <!-- OPENYIDA_COMMANDS_START -->
 <!-- This section is generated by `npm run docs:commands`. Do not edit command rows by hand. -->
 
@@ -406,6 +412,14 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida update-form-config <appType> ...` | Update form configuration |
 | `openyida get-form-config <appType> <formUuid> [--json]` | Query form configuration |
 
+### Schema-as-Code
+
+| Command | Description |
+|---------|-------------|
+| `openyida schema validate <manifest> --json --quiet` | Validate Schema-as-Code manifest locally |
+| `openyida schema plan <manifest> --state <path> --json --quiet` | Plan Schema-as-Code changes with read-only remote observation |
+| `openyida schema apply <manifest> --state <path> --plan-id <planId> --json --quiet` | Apply a reviewed Schema-as-Code plan with checkpoints and recovery guards |
+
 ### Data & Permissions
 
 | Command | Description |

package/bin/yida.js

@@ -14,10 +14,11 @@ const { version: currentVersion } = require('../package.json');
 const { t } = require('../lib/core/i18n');
 const { warn } = require('../lib/core/chalk');
 const { CliError, isCliError, toErrorPayload } = require('../lib/core/cli-error');
-const { COMMAND_GROUPS, buildCommandManifest } = require('../lib/core/command-manifest');
+const { COMMAND_GROUPS, buildCommandManifest, findCommandSuggestion } = require('../lib/core/command-manifest');
 
 const command = process.argv[2];
 const args = process.argv.slice(3);
+const rawArgs = process.argv.slice(3);
 
 function isAgentEnvironment(env) {
   return !!(
@@ -55,6 +56,9 @@ function shouldRunUpdateCheck() {
   if (!command || command === '--help' || command === '-h' || command === '--version' || command === '-v') {
     return false;
   }
+  if (args.includes('--help') || args.includes('-h')) {
+    return false;
+  }
   if (command === 'commands' || command === 'agent-capabilities' || command === 'mcp') {
     return false;
   }
@@ -250,12 +254,15 @@ function printLoginResult(result) {
     return;
   }
 
-  const tokenUsable = result.can_auto_use !== false && !!result.access_token;
+  const tokenUsable = result.ok !== undefined
+    ? !!result.ok
+    : (result.can_auto_use !== false && !!result.access_token);
   const summary = {
     ok: tokenUsable,
     status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
     auth_mode: 'token',
-    can_auto_use: tokenUsable,
+    auth_source: result.auth_source || result.authSource,
+    can_auto_use: result.can_auto_use !== undefined ? !!result.can_auto_use : tokenUsable,
     token_type: result.token_type || 'Bearer',
     access_token: maskSensitiveAuthOutput({ access_token: result.access_token }).access_token,
     expires_at: result.expires_at ? new Date(result.expires_at).toISOString() : undefined,
@@ -263,6 +270,7 @@ function printLoginResult(result) {
     corp_id: result.corp_id,
     user_id: result.user_id,
     user_name: result.user_name,
+    failure_reason: result.failure_reason,
     message: result.message,
     raw: tokenUsable ? undefined : result.raw,
   };
@@ -308,6 +316,30 @@ function getArgValue(cliArgs, name) {
   return cliArgs[index + 1];
 }
 
+const UNSUPPORTED_LEGACY_LOGIN_FLAGS = new Set([
+  '--qr',
+  '--qr-code',
+  '--agent-qr',
+  '--codex-qr',
+  '--agent-poll',
+  '--codex-poll',
+  '--browser',
+  '--codex',
+  '--qoder',
+  '--wukong',
+]);
+
+function findUnsupportedLegacyLoginFlag(...argLists) {
+  for (const argList of argLists) {
+    for (const arg of argList || []) {
+      if (UNSUPPORTED_LEGACY_LOGIN_FLAGS.has(arg)) {
+        return arg;
+      }
+    }
+  }
+  return null;
+}
+
 function parseLoginTargetArg(value) {
   const raw = String(value || '').trim();
   if (!raw) {return null;}
@@ -445,6 +477,61 @@ function throwCliUsage(...lines) {
   });
 }
 
+function formatSuggestionMessage(suggestion) {
+  if (!suggestion) {
+    return '';
+  }
+  if (suggestion.message_key) {
+    return t(suggestion.message_key, ...(suggestion.message_args || []));
+  }
+  return '';
+}
+
+function throwUnknownCommand(commandName, commandArgs = []) {
+  const suggestion = findCommandSuggestion([commandName, ...commandArgs]);
+  const lines = [t('cli.unknown_command', commandName)];
+  if (suggestion) {
+    lines.push(t('cli.command_suggestion', suggestion.suggested_usage));
+    const suggestionMessage = formatSuggestionMessage(suggestion);
+    if (suggestionMessage) {
+      lines.push(suggestionMessage);
+    }
+  }
+  lines.push(t('cli.run_help'));
+  throw new CliError(lines.filter(Boolean).join('\n'), {
+    code: 'INVALID_ARGUMENTS',
+    details: suggestion ? { suggestion } : undefined,
+  });
+}
+
+function hasHelpFlag(cliArgs = []) {
+  return cliArgs.includes('--help') || cliArgs.includes('-h');
+}
+
+function printCommandUsage(...lines) {
+  console.log(lines.filter(Boolean).join('\n'));
+}
+
+function printLoginHelp() {
+  printCommandUsage(t('cli.login_usage'), t('cli.login_example'));
+}
+
+function printAuthHelp() {
+  printCommandUsage(t('cli.auth_usage'), t('cli.auth_example'));
+}
+
+function assertNoUnsupportedLegacyLoginFlags(...argLists) {
+  const flag = findUnsupportedLegacyLoginFlag(...argLists);
+  if (!flag) {
+    return;
+  }
+  throwCliUsage(
+    t('cli.login_unsupported_option', flag),
+    t('cli.login_usage'),
+    t('cli.login_example')
+  );
+}
+
 async function main() {
   applyQuietFlag();
   applyGlobalEnvironmentFlags();
@@ -516,15 +603,23 @@ async function main() {
 
     case 'login': {
       const loginArgs = applyLoginEnvironmentFlags(args, { inferTargetUrl: true });
-      const { tokenLogin, tokenStatus } = require('../lib/auth/token-auth');
-      if (loginArgs.includes('--check-only')) {
-        console.log(JSON.stringify(tokenStatus(), null, 2));
+      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      if (hasHelpFlag(loginArgs)) {
+        printLoginHelp();
       } else {
-        const result = await tokenLogin({
-          clientId: getArgValue(loginArgs, '--client-id'),
-          quiet: loginArgs.includes('--quiet'),
-        });
-        printLoginResult(result);
+        assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
+        if (loginArgs.includes('--check-only')) {
+          console.log(JSON.stringify(getAuthStatus(), null, 2));
+        } else if (isEnvAuthMode()) {
+          printLoginResult(getAuthStatus());
+        } else {
+          const { tokenLogin } = require('../lib/auth/token-auth');
+          const result = await tokenLogin({
+            clientId: getArgValue(loginArgs, '--client-id'),
+            quiet: loginArgs.includes('--quiet'),
+          });
+          printLoginResult(result);
+        }
       }
       break;
     }
@@ -538,15 +633,25 @@ async function main() {
     case 'auth': {
       const subCommand = args[0];
       const authArgs = applyLoginEnvironmentFlags(args.slice(1), { inferTargetUrl: true });
-      const { tokenLogin, tokenLogout, tokenRefresh, tokenStatus } = require('../lib/auth/token-auth');
-      if (subCommand === 'status') {
-        console.log(JSON.stringify(tokenStatus(), null, 2));
+      const { getAuthStatus, isEnvAuthMode } = require('../lib/core/utils');
+      const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
+      if (!subCommand || subCommand === '--help' || subCommand === '-h') {
+        printAuthHelp();
+      } else if (subCommand === 'status') {
+        console.log(JSON.stringify(getAuthStatus(), null, 2));
       } else if (subCommand === 'login') {
-        const result = await tokenLogin({
-          clientId: getArgValue(authArgs, '--client-id'),
-          quiet: authArgs.includes('--quiet'),
-        });
-        printLoginResult(result);
+        if (hasHelpFlag(authArgs)) {
+          printLoginHelp();
+        } else {
+          assertNoUnsupportedLegacyLoginFlags(rawArgs.slice(1), authArgs);
+          const result = isEnvAuthMode()
+            ? getAuthStatus()
+            : await tokenLogin({
+              clientId: getArgValue(authArgs, '--client-id'),
+              quiet: authArgs.includes('--quiet'),
+            });
+          printLoginResult(result);
+        }
       } else if (subCommand === 'refresh') {
         console.log(JSON.stringify(maskSensitiveAuthOutput(await tokenRefresh()), null, 2));
       } else if (subCommand === 'logout') {
@@ -624,6 +729,12 @@ async function main() {
       break;
     }
 
+    case 'schema': {
+      const { run } = require('../lib/schema/command');
+      await run(args);
+      break;
+    }
+
     case 'formula': {
       const subCommand = args[0];
       const subArgs = args.slice(1);
@@ -664,6 +775,11 @@ async function main() {
     }
 
     case 'publish': {
+      if (args.includes('--help') || args.includes('-h')) {
+        const publishMain = require('../lib/app/publish');
+        await publishMain(args);
+        break;
+      }
       const passThroughFlags = new Set(['--skip-lint', '--health-check', '--check', '--open', '--no-open', '--compat', '--modern', '--force', '--canvas']);
       const filteredArgs = args.filter(arg => !passThroughFlags.has(arg));
       if (filteredArgs.length < 3) {
@@ -1058,7 +1174,7 @@ async function main() {
     }
 
     default: {
-      throwCliUsage(t('cli.unknown_command', command), t('cli.run_help'));
+      throwUnknownCommand(command, args);
     }
   }
 }

package/lib/app/canvas-compile.js

@@ -35,8 +35,9 @@ const Babel = require('@babel/standalone');
  * 逐条镜像自 @ali/vc-deep-yida 的
  *   src/components/yida-code-canvas/dependencies.ts → getModuleAliasMap()
  * 只保留运行时真正用到的 windowAlias（资源 URL 由画布运行时按别名注入，
- * 本地编译不关心 CDN 地址）。若此处与物料白名单漂移，编译产物仍可运行，
- * 只是未收录的包会在浏览器端 `${name} is not found in dependencies map` 告警。
+ * 本地编译不关心 CDN 地址）。默认拒绝未收录依赖；如果宜搭物料依赖表已经
+ * 先于 CLI 升级，可临时设置 OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS=1
+ * 退回旧的 window["pkg"] 映射，避免白名单漂移阻断发布。
  * @type {Record<string, string>}
  */
 const MODULE_ALIAS_MAP = {
@@ -59,6 +60,19 @@ const IMPORT_SIDE_EFFECT_PATTERN = /import\s+['"]([^'"]+)['"]/g;
 const REQUIRE_PATTERN = /require\(\s*['"]([^'"]+)['"]\s*\)/g;
 const DYNAMIC_IMPORT_PATTERN = /import\(\s*['"]([^'"]+)['"]\s*\)/g;
 
+function isTruthy(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function shouldAllowUnsupportedBareImports(options = {}, env = process.env) {
+  return options.allowUnsupportedBareImports === true ||
+    isTruthy(env.OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS);
+}
+
+function packageTempName(pkg) {
+  return String(pkg || 'module').replace(/[^A-Za-z0-9_$]+/g, '_') || 'module';
+}
+
 function stripJsComments(code) {
   return String(code || '')
     .replace(/\/\*[\s\S]*?\*\//g, '')
@@ -113,16 +127,27 @@ function resolveWindowAlias(pkg) {
  *   export const x = ...            → const x = ...（去掉 export 关键字）
  * @param {{ types: import('@babel/types') }} babel
  */
-function esmToWindowPlugin({ types: t }) {
-  function moduleExpr(pkg) {
-    const alias = resolveWindowAlias(pkg);
+function esmToWindowPlugin({ types: t }, options = {}) {
+  const allowUnsupportedBareImports = options.allowUnsupportedBareImports === true;
+
+  function moduleExpr(pkg, alias) {
     if (alias) {
       return t.memberExpression(t.identifier('window'), t.identifier(alias));
     }
-    // 未收录包：退化为 window["pkg"]，运行时若未注入会自然报错（与线上一致）。
     return t.memberExpression(t.identifier('window'), t.stringLiteral(pkg), true);
   }
 
+  function buildUnsupportedBareImportError(path, pkg) {
+    return path.buildCodeFrameError(
+      `Code Canvas 不支持从裸包 "${pkg}" 导入绑定。`
+      + '只允许 MODULE_ALIAS_MAP 白名单依赖；'
+      + '宜搭平台运行态全局对象请显式使用 window.* 访问'
+      + '（例如 window.Deep、window.DeepYida、window.YidaNativeComponents），不要从包中 import。'
+      + '若已确认宜搭物料运行态已注入该包且 CLI 白名单滞后，可临时设置 '
+      + 'OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS=1 退回 legacy window["pkg"] 映射。'
+    );
+  }
+
   return {
     name: 'yida-esm-to-window',
     visitor: {
@@ -140,10 +165,14 @@ function esmToWindowPlugin({ types: t }) {
           path.remove();
           return;
         }
+        const alias = resolveWindowAlias(pkg);
+        if (!alias && !allowUnsupportedBareImports) {
+          throw buildUnsupportedBareImportError(path, pkg);
+        }
 
         const decls = [];
-        const tmp = path.scope.generateUidIdentifier(resolveWindowAlias(pkg) || 'mod');
-        decls.push(t.variableDeclarator(t.cloneNode(tmp), moduleExpr(pkg)));
+        const tmp = path.scope.generateUidIdentifier(alias || packageTempName(pkg));
+        decls.push(t.variableDeclarator(t.cloneNode(tmp), moduleExpr(pkg, alias)));
 
         const namedProps = [];
         for (const spec of specifiers) {
@@ -230,7 +259,7 @@ function esmToWindowPlugin({ types: t }) {
  * @param {string} source 原始 React/JSX/TSX 源码
  * @returns {{ runtimeCode: string, importedModules: string }}
  */
-function compileCanvasLocal(source) {
+function compileCanvasLocal(source, options = {}) {
   const importedModules = extractImportedModules(source);
 
   // 第一步：剥类型 + 转 JSX（classic runtime，产出 React.createElement，
@@ -265,7 +294,9 @@ function compileCanvasLocal(source) {
   // 第二步：把 import/export 改写成 window 别名 + YidaComp。
   const stage2 = Babel.transform(intermediate, {
     filename: 'canvas.js',
-    plugins: [esmToWindowPlugin],
+    plugins: [[esmToWindowPlugin, {
+      allowUnsupportedBareImports: shouldAllowUnsupportedBareImports(options),
+    }]],
     sourceType: 'module',
     compact: false,
     babelrc: false,
@@ -286,14 +317,14 @@ function compileCanvasLocal(source) {
  * @param {object} [options] 兼容占位，未使用
  * @returns {Promise<{ runtimeCode: string, importedModules: string }>}
  */
-function compileCanvas(source, options = {}) { // eslint-disable-line no-unused-vars
+function compileCanvas(source, options = {}) {
   return new Promise((resolve, reject) => {
     if (typeof source !== 'string' || source.trim() === '') {
       reject(new Error('canvas 编译源码为空'));
       return;
     }
     try {
-      resolve(compileCanvasLocal(source));
+      resolve(compileCanvasLocal(source, options));
     } catch (compileError) {
       const detail = compileError && compileError.message ? compileError.message : String(compileError);
       reject(new Error(`Code Canvas 本地编译失败: ${detail}`));
@@ -306,5 +337,6 @@ module.exports = {
   compileCanvasLocal,
   extractImportedModules,
   resolveWindowAlias,
+  shouldAllowUnsupportedBareImports,
   MODULE_ALIAS_MAP,
 };

package/lib/app/create-app.js

@@ -18,6 +18,10 @@ const { t } = require('../core/i18n');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { throwCommandError } = require('../core/command-errors');
+const {
+  assertLegacyDirectWriteAllowed,
+  extractLegacyGuardArgs,
+} = require('../core/legacy-schema-guard');
 const { assertPresetThemeKey } = require('./theme-presets');
 
 const DEFAULT_APP_OPTIONS = {
@@ -281,7 +285,8 @@ function buildCreateAppPayload(params, auth, contentLocale, openExclusive, openP
 
 async function run(args) {
   const openOption = parseOpenOption(args);
-  args = openOption.args;
+  const guardSplit = extractLegacyGuardArgs(openOption.args);
+  args = guardSplit.args;
 
   if (hasHelpFlag(args)) {
     printUsage();
@@ -301,6 +306,12 @@ async function run(args) {
     chalkError(t('create_app.usage'), { hint: t('create_app.example') });
   }
 
+  assertLegacyDirectWriteAllowed({
+    command: 'create-app',
+    resourceType: 'app',
+    action: 'create',
+  }, { guardOptions: guardSplit.guardOptions });
+
   const { appName, description, icon, iconColor, colour, navTheme, layoutDirection } = params;
 
   const { c, banner, step, label, success: chalkSuccess, result: chalkResult } = require('../core/chalk');

package/lib/app/create-form/args.js

@@ -85,6 +85,7 @@ function createParseArgs(dependencies) {
       labelAlign: 'top',
       contentLocale: null,
       browserOpenMode: openOption.mode,
+      legacyGuardOptions: openOption.legacyGuardOptions || null,
     };
 
     const args = [...rawArgs];
@@ -118,6 +119,18 @@ function createParseArgs(dependencies) {
       }
     }
 
+    if (args.includes('--help') || args.includes('-h')) {
+      usage(t('create_form.usage_create_short'));
+      hint(t('create_form.usage_update_short'));
+      hint(t('create_form.example_create'));
+      hint(t('create_form.example_update'));
+      return {
+        mode: 'help',
+        help: true,
+        ...options
+      };
+    }
+
     const mode = args[0];
 
     if (mode === 'create') {