openyida 2026.7.23-1 → 2026.7.23-2

package/lib/app/canvas-compile.js

@@ -29,6 +29,10 @@
  */
 
 const Babel = require('@babel/standalone');
+const {
+  assertNoEmojiInArtifactName,
+  assertNoEmojiInText,
+} = require('../core/no-emoji-guard');
 
 /**
  * 依赖 → window 别名白名单。
@@ -260,6 +264,16 @@ function esmToWindowPlugin({ types: t }, options = {}) {
  * @returns {{ runtimeCode: string, importedModules: string }}
  */
 function compileCanvasLocal(source, options = {}) {
+  if (options.sourcePath) {
+    assertNoEmojiInArtifactName(options.sourcePath, {
+      code: 'OPENYIDA_PAGE_FILENAME_EMOJI_FORBIDDEN',
+    });
+  }
+  assertNoEmojiInText(source, {
+    artifact: options.sourcePath || 'Code Canvas source',
+    code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
+  });
+
   const importedModules = extractImportedModules(source);
 
   // 第一步：剥类型 + 转 JSX（classic runtime，产出 React.createElement，
@@ -304,6 +318,10 @@ function compileCanvasLocal(source, options = {}) {
   });
 
   const runtimeCode = stage2.code || '';
+  assertNoEmojiInText(runtimeCode, {
+    artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
+    code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
+  });
   return {
     runtimeCode,
     importedModules: JSON.stringify(importedModules),

package/lib/app/create-form.js

@@ -64,6 +64,10 @@ const { createAuthRef } = require('../core/yida-client');
 const { CliError } = require('../core/cli-error');
 const { t } = require('../core/i18n');
 const { safeParseJson } = require('../core/safe-json');
+const {
+  assertNoEmojiInArtifactName,
+  assertNoEmojiInValue,
+} = require('../core/no-emoji-guard');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { banner, step, label, success, fail, warn, info, error, result, usage, hint, listItem } = require('../core/chalk');
 const { parseOpenOption: parseBrowserOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
@@ -381,6 +385,27 @@ function validateContainerChildrenArray(field, fieldPath, componentName) {
   return field.children;
 }
 
+function hasNonEmptyAssociationFormUuid(field) {
+  const associationForm = field && field.associationForm;
+  if (!associationForm || typeof associationForm !== 'object' || Array.isArray(associationForm)) {
+    return false;
+  }
+  return typeof associationForm.formUuid === 'string' && associationForm.formUuid.trim().length > 0;
+}
+
+function validateAssociationFormFieldDefinition(field, fieldPath) {
+  if (hasNonEmptyAssociationFormUuid(field)) {
+    return;
+  }
+  throwInvalidFieldDefinition(
+    'AssociationFormField.associationForm.formUuid 必须是非空字符串: ' + fieldPath,
+    'CREATE_FORM_ASSOCIATION_FORM_UUID_MISSING',
+    field,
+    fieldPath,
+    { componentName: 'AssociationFormField' }
+  );
+}
+
 function validateFieldDefinition(field, fieldPath, options) {
   const validationOptions = options || {};
   validatePlainFieldObject(field, fieldPath);
@@ -438,6 +463,10 @@ function validateFieldDefinition(field, fieldPath, options) {
     );
   }
 
+  if (componentName === 'AssociationFormField') {
+    validateAssociationFormFieldDefinition(field, fieldPath);
+  }
+
   if (componentName === 'TableField') {
     validateTableFieldChildren(field, fieldPath, validationOptions);
   }
@@ -4334,6 +4363,27 @@ function emitCreateFormPostCreateFailure(context) {
   }
 }
 
+function assertNoEmojiInFormDefinition(formTitle, fields, validations, artifact) {
+  assertNoEmojiInValue({
+    formTitle,
+    fields,
+    validations,
+  }, {
+    artifact: artifact || 'create-form input',
+    code: 'OPENYIDA_FORM_DEFINITION_EMOJI_FORBIDDEN',
+  });
+}
+
+function assertNoEmojiInDefinitionFileName(value) {
+  const raw = String(value || '').trim();
+  if (!raw || raw.startsWith('{') || raw.startsWith('[')) {
+    return;
+  }
+  assertNoEmojiInArtifactName(raw, {
+    code: 'OPENYIDA_FORM_DEFINITION_FILENAME_EMOJI_FORBIDDEN',
+  });
+}
+
 // ── 保存 Schema 并更新表单配置（create/update 共用）──
 //
 // 封装了 saveFormSchema + updateFormConfig 两步，以及各自的 302 自动重登录重试。
@@ -4348,6 +4398,10 @@ async function saveSchemaAndUpdateConfig(authRef, appType, formUuid, schema, ver
     info(t('create_form.formula_prefix_fixed', fixedRefs));
   }
   ensureDividerThemeAction(schema);
+  assertNoEmojiInValue(schema, {
+    artifact: 'Yida form schema ' + formUuid,
+    code: 'OPENYIDA_FORM_SCHEMA_EMOJI_FORBIDDEN',
+  });
   const serverRevision = requireSchemaServerRevision(version, { appType, formUuid });
 
   step(saveStep, t('create_form.step_save_schema', saveStep));
@@ -4411,7 +4465,9 @@ async function mainCreate(parsedArgs, authRef) {
   label('Fields:', fieldsJsonOrFile);
 
   step(2, t('create_form.step_read_fields', 2));
+  assertNoEmojiInDefinitionFileName(fieldsJsonOrFile);
   const { fields, columns, validations } = readFieldsDefinition(fieldsJsonOrFile);
+  assertNoEmojiInFormDefinition(formTitle, fields, validations);
   validateFormFieldDefinitions(fields);
   const fieldCount = countDataFieldDefinitions(fields);
   success(t('create_form.fields_loaded', fieldCount));
@@ -4559,7 +4615,9 @@ async function createFormForLegacyProcess(context, input) {
   };
 
   const { appType, formTitle, fieldsJsonOrFile, layout, theme, labelAlign } = parsedArgs;
+  assertNoEmojiInDefinitionFileName(fieldsJsonOrFile);
   const { fields, validations } = readFieldsDefinition(fieldsJsonOrFile);
+  assertNoEmojiInFormDefinition(formTitle, fields, validations, 'legacy create-form input');
   validateFormFieldDefinitions(fields);
   const fieldCount = countDataFieldDefinitions(fields);
   const createResult = await requestWithAutoLogin(function (auth) {

package/lib/app/generate-page.js

@@ -6,6 +6,10 @@ const { applyTemplateVariables } = require('../core/sample');
 const { t } = require('../core/i18n');
 const { safeParseJson } = require('../core/safe-json');
 const { error, success, hint, result, warn } = require('../core/chalk');
+const {
+  assertNoEmojiInArtifactName,
+  assertNoEmojiInText,
+} = require('../core/no-emoji-guard');
 const { runLintCheck } = require('./page-linter');
 const { compileSource } = require('./page-compiler');
 const { compileCanvasLocal } = require('./canvas-compile');
@@ -571,6 +575,9 @@ async function run(args) {
     options.output || spec.output || (mode === 'canvas' ? templateConfig.defaultCanvasOutput : templateConfig.defaultNativeOutput)
   );
   const outputPath = outputResolution.outputPath;
+  assertNoEmojiInArtifactName(outputPath, {
+    code: 'OPENYIDA_PAGE_FILENAME_EMOJI_FORBIDDEN',
+  });
   const manifestPath = getManifestPath(outputPath);
   const templateSource = fs.readFileSync(templateFile, 'utf-8');
   const ir = normalizePageSpec(spec, {
@@ -593,6 +600,10 @@ async function run(args) {
 
   const variables = buildTemplateVariablesFromIr(ir);
   const outputSource = applyTemplateVariables(templateSource, variables);
+  assertNoEmojiInText(outputSource, {
+    artifact: outputPath,
+    code: 'OPENYIDA_GENERATED_PAGE_EMOJI_FORBIDDEN',
+  });
 
   ensureOutputDir(outputPath);
   fs.writeFileSync(outputPath, outputSource, 'utf-8');
@@ -608,7 +619,7 @@ async function run(args) {
   reportNavigationConfig(ir);
 
   if (mode === 'canvas') {
-    const canvasResult = compileCanvasLocal(outputSource);
+    const canvasResult = compileCanvasLocal(outputSource, { sourcePath: outputPath });
     const importedModules = JSON.parse(canvasResult.importedModules);
     if (options.compile || spec.compile === true) {
       const distPath = getCanvasDistPath(outputPath);

package/lib/app/page-compiler.js

@@ -7,6 +7,10 @@ const { default: babelTransform } = require('../core/babel-transform');
 const { findProjectRoot } = require('../core/utils');
 const { t } = require('../core/i18n');
 const { info, success, error } = require('../core/chalk');
+const {
+  assertNoEmojiInArtifactName,
+  assertNoEmojiInText,
+} = require('../core/no-emoji-guard');
 const { ensureYidaRuntimeContract } = require('./page-compat');
 const { warnLargePageSource } = require('./page-size-guard');
 
@@ -16,6 +20,9 @@ const { warnLargePageSource } = require('./page-size-guard');
  * @returns {{ sourceCode: string, compiledCode: string, compiledPath: string }}
  */
 function compileSource(sourcePath) {
+  assertNoEmojiInArtifactName(sourcePath, {
+    code: 'OPENYIDA_PAGE_FILENAME_EMOJI_FORBIDDEN',
+  });
   const sourceFileName = path.basename(sourcePath);
   const parsedPath = path.parse(sourcePath);
   const compiledFileName = `${parsedPath.name}.js`;
@@ -26,6 +33,10 @@ function compileSource(sourcePath) {
   warnLargePageSource(rawSourceCode, sourcePath);
   const runtimeResult = ensureYidaRuntimeContract(rawSourceCode);
   const sourceCode = runtimeResult.code;
+  assertNoEmojiInText(sourceCode, {
+    artifact: sourcePath,
+    code: 'OPENYIDA_PAGE_SOURCE_EMOJI_FORBIDDEN',
+  });
 
   info(t('publish.compiling', sourceFileName));
   const babelResult = babelTransform(sourceCode, {}, false, { RE_VERSION: '7.4.0' });
@@ -46,6 +57,10 @@ function compileSource(sourcePath) {
   if (uglifyResult.error) {
     error(t('publish.minify_failed', uglifyResult.error.message || String(uglifyResult.error)));
   }
+  assertNoEmojiInText(uglifyResult.code, {
+    artifact: compiledPath,
+    code: 'OPENYIDA_PAGE_SOURCE_EMOJI_FORBIDDEN',
+  });
 
   const outputDir = path.dirname(compiledPath);
   if (!fs.existsSync(outputDir)) {

package/lib/app/page-linter.js

@@ -2,6 +2,10 @@
 
 const { t } = require('../core/i18n');
 const { warn, fail, hint, success } = require('../core/chalk');
+const {
+  findEmojiInArtifactName,
+  findEmojiInText,
+} = require('../core/no-emoji-guard');
 const Babel = require('@babel/standalone');
 
 const THEN_CALLBACK_LINE_LIMIT = 50;
@@ -663,6 +667,28 @@ function lintYidaSource(sourceCode, filePath) {
   const lines = sourceCode.split('\n');
   const disableMap = buildLineDisableMap(lines);
 
+  findEmojiInArtifactName(filePath, {
+    artifact: filePath || 'Yida page source',
+    maxIssues: 20,
+  }).forEach((issue) => {
+    errors.push({
+      line: 1,
+      rule: 'emoji-forbidden',
+      message: t('publish.lint_emoji_forbidden', issue.emoji),
+    });
+  });
+
+  findEmojiInText(sourceCode, {
+    artifact: filePath || 'Yida page source',
+    maxIssues: 20,
+  }).forEach((issue) => {
+    errors.push({
+      line: issue.line,
+      rule: 'emoji-forbidden',
+      message: t('publish.lint_emoji_forbidden', issue.emoji),
+    });
+  });
+
   const hasRenderJsx = /export\s+function\s+renderJsx\s*\(/.test(sourceCode);
   if (!hasRenderJsx) {
     pushIssue(errors, 1, 'missing-render-jsx', t('publish.lint_missing_render_jsx'), disableMap);

package/lib/app/publish.js

@@ -39,6 +39,7 @@ const { buildPageFile, shouldBuildPageSource } = require('./page-compat');
 const { warnLargePageSource } = require('./page-size-guard');
 const { fetchFormPageList } = require('./form-navigation');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
+const { assertNoEmojiInValue } = require('../core/no-emoji-guard');
 const {
   assertLegacyDirectWriteAllowed,
   extractLegacyGuardArgs,
@@ -193,6 +194,14 @@ async function readExistingPageDataSource(appType, formUuid, authRef) {
 
 function buildSchemaContent(sourceCode, compiledCode, formUuid, options = {}) {
   const logInfo = options.silent === true ? () => {} : info;
+  assertNoEmojiInValue({
+    sourceCode,
+    compiledCode,
+    existingDataSource: options.existingDataSource,
+  }, {
+    artifact: 'native page schema ' + formUuid,
+    code: 'OPENYIDA_PAGE_SCHEMA_EMOJI_FORBIDDEN',
+  });
   return buildNativePageSchemaContent(sourceCode, compiledCode, formUuid, {
     ...options,
     onBuildingSchema: () => logInfo(t('publish.building_schema')),
@@ -210,6 +219,14 @@ function buildSchemaContent(sourceCode, compiledCode, formUuid, options = {}) {
 
 function buildCanvasSchemaContent(sourceCode, runtimeCode, importedModules, formUuid) {
   info(t('publish.building_schema'));
+  assertNoEmojiInValue({
+    sourceCode,
+    runtimeCode,
+    importedModules,
+  }, {
+    artifact: 'canvas page schema ' + formUuid,
+    code: 'OPENYIDA_PAGE_SCHEMA_EMOJI_FORBIDDEN',
+  });
   return buildCanvasPageSchemaContent(sourceCode, runtimeCode, importedModules, formUuid);
 }
 
@@ -573,12 +590,31 @@ async function ensurePublishTargetOrExit(appType, formUuid, authRef, options = {
 
 function sendHealthCheckRequest(pageUrl, cookies) {
   return new Promise((resolve) => {
-    const parsedUrl = new URL(pageUrl);
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(pageUrl);
+    } catch (urlError) {
+      resolve({ ok: false, statusCode: 0, error: urlError.message });
+      return;
+    }
     const isHttps = parsedUrl.protocol === 'https:';
     const requestModule = isHttps ? https : http;
-    const cookieHeader = cookies
+    const cookieHeader = Array.isArray(cookies) ? cookies
+      .filter((cookie) => cookie && cookie.name !== undefined && cookie.value !== undefined)
       .map((cookie) => `${cookie.name}=${cookie.value}`)
-      .join('; ');
+      .join('; ') : '';
+
+    if (!cookieHeader) {
+      resolve({
+        ok: false,
+        skipped: true,
+        reason: 'missing_cookies',
+        statusCode: 0,
+        error: t('common.request_failed'),
+      });
+      return;
+    }
+
     const requestOptions = {
       hostname: parsedUrl.hostname,
       port: parsedUrl.port || (isHttps ? 443 : 80),
@@ -591,22 +627,28 @@ function sendHealthCheckRequest(pageUrl, cookies) {
       timeout: 30000,
     };
 
-    const request = requestModule.request(requestOptions, (response) => {
-      let responseData = '';
-      response.on('data', (chunk) => {
-        if (responseData.length < 2000) {
-          responseData += chunk;
-        }
-      });
-      response.on('end', () => {
-        const statusCode = response.statusCode || 0;
-        resolve({
-          ok: statusCode >= 200 && statusCode < 400,
-          statusCode,
-          snippet: responseData.substring(0, 300).replace(/\s+/g, ' ').trim(),
+    let request;
+    try {
+      request = requestModule.request(requestOptions, (response) => {
+        let responseData = '';
+        response.on('data', (chunk) => {
+          if (responseData.length < 2000) {
+            responseData += chunk;
+          }
+        });
+        response.on('end', () => {
+          const statusCode = response.statusCode || 0;
+          resolve({
+            ok: statusCode >= 200 && statusCode < 400,
+            statusCode,
+            snippet: responseData.substring(0, 300).replace(/\s+/g, ' ').trim(),
+          });
         });
       });
-    });
+    } catch (requestError) {
+      resolve({ ok: false, statusCode: 0, error: requestError.message });
+      return;
+    }
 
     request.on('timeout', () => {
       request.destroy();
@@ -663,7 +705,7 @@ async function main(argv) {
     step(1, t('publish.step_canvas_compile'));
     info(t('publish.canvas_compiling'));
     try {
-      canvasResult = await compileCanvas(initialSourceCode);
+      canvasResult = await compileCanvas(initialSourceCode, { sourcePath });
     } catch (canvasCompileError) {
       fail(t('publish.canvas_compile_failed', canvasCompileError.message));
       process.exit(1);
@@ -776,7 +818,15 @@ async function main(argv) {
   let healthCheckResult = null;
   if (healthCheck) {
     step(5, t('publish.step_health_check'));
-    healthCheckResult = await sendHealthCheckRequest(pageUrl, cookies);
+    try {
+      healthCheckResult = await sendHealthCheckRequest(pageUrl, cookies);
+    } catch (healthCheckError) {
+      healthCheckResult = {
+        ok: false,
+        statusCode: 0,
+        error: healthCheckError && healthCheckError.message ? healthCheckError.message : t('common.unknown_error'),
+      };
+    }
     if (healthCheckResult.ok) {
       success(t('publish.health_check_ok', healthCheckResult.statusCode));
     } else {

package/lib/app/services/canvas-page-compiler.js

@@ -2,6 +2,7 @@
 
 const crypto = require('crypto');
 const { compileCanvasLocal } = require('../canvas-compile');
+const { assertNoEmojiInText } = require('../../core/no-emoji-guard');
 const { schemaError } = require('../../schema/errors');
 const { isLoadedPageSource } = require('../../schema/page-source-loader');
 
@@ -17,10 +18,23 @@ function compileCanvasPageSource(loadedSource) {
       stage: 'canvas',
     });
   }
+  try {
+    assertNoEmojiInText(loadedSource.source, {
+      artifact: loadedSource.relativePath || 'Schema Canvas page source',
+      code: 'SCHEMA_PAGE_SOURCE_EMOJI_FORBIDDEN',
+    });
+  } catch (error) {
+    compilerError('SCHEMA_PAGE_SOURCE_EMOJI_FORBIDDEN', error.message, {
+      stage: 'emoji',
+      issues: error.details && error.details.issues,
+    });
+  }
 
   let canvasResult;
   try {
-    canvasResult = compileCanvasLocal(loadedSource.source);
+    canvasResult = compileCanvasLocal(loadedSource.source, {
+      sourcePath: loadedSource.relativePath,
+    });
   } catch (error) {
     compilerError('SCHEMA_PAGE_SOURCE_COMPILE_FAILED', 'Canvas page source could not be compiled.', {
       stage: 'canvas',

package/lib/app/services/canvas-page-schema-builder.js

@@ -5,6 +5,10 @@ const {
   generateSuffix,
   getGlobalDataSourceFitConfig,
 } = require('./native-page-schema-builder');
+const {
+  buildEmojiErrorMessage,
+  findEmojiInValue,
+} = require('../../core/no-emoji-detector');
 
 const CANVAS_ACTIONS_SOURCE = 'export function didMount() {}';
 const CANVAS_ACTIONS_COMPILED = '"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.didMount=didMount;function didMount(){}';
@@ -32,7 +36,7 @@ function buildCanvasPageSchemaObject(sourceCode, runtimeCode, importedModules, f
   );
   const constructorCode = "function constructor() {\nvar module = { exports: {} };\nvar _this = this;\nthis.__initMethods__(module.exports, module);\nObject.keys(module.exports).forEach(function(item) {\n  if(typeof module.exports[item] === 'function'){\n    _this[item] = module.exports[item];\n  }\n});\n\n}";
 
-  return {
+  const schema = {
     schemaType: 'superform',
     schemaVersion: '5.0',
     pages: [
@@ -129,6 +133,23 @@ function buildCanvasPageSchemaObject(sourceCode, runtimeCode, importedModules, f
     },
     config: { connectComponent: [] },
   };
+  assertCanvasSchemaHasNoEmoji(schema, formUuid);
+  return schema;
+}
+
+function assertCanvasSchemaHasNoEmoji(schema, formUuid) {
+  const artifact = 'canvas page schema ' + formUuid;
+  const issues = findEmojiInValue(schema, {
+    artifact,
+  });
+  if (issues.length === 0) {
+    return;
+  }
+
+  const error = new Error(buildEmojiErrorMessage(issues, { artifact }));
+  error.code = 'OPENYIDA_PAGE_SCHEMA_EMOJI_FORBIDDEN';
+  error.details = { artifact, issues };
+  throw error;
 }
 
 function resolveSchemaBuilderDependency(value, createDefault, property) {

package/lib/app/services/form-compiler.js

@@ -7,6 +7,7 @@ const {
   deepMerge,
   normalizeFieldValidationRules,
 } = require('./form-validation');
+const { assertNoEmojiInValue } = require('../../core/no-emoji-guard');
 
 const OPTION_FIELD_TYPES = Object.freeze(['RadioField', 'SelectField', 'CheckboxField', 'MultiSelectField']);
 const TABLE_FIELD_TYPE = 'TableField';
@@ -574,6 +575,38 @@ function assertSupportedFieldDefinition(field, details) {
   return componentName;
 }
 
+function hasNonEmptyAssociationFormUuid(field) {
+  const associationForm = field && field.associationForm;
+  if (!associationForm || typeof associationForm !== 'object' || Array.isArray(associationForm)) {
+    return false;
+  }
+  return typeof associationForm.formUuid === 'string' && associationForm.formUuid.trim().length > 0;
+}
+
+function hasManagedAssociationFormReference(field) {
+  if (!field || field.form === undefined || field.form === null) {
+    return false;
+  }
+  const formReference = String(field.form).trim();
+  return /^form:[A-Za-z][A-Za-z0-9_-]*$/.test(formReference);
+}
+
+function assertAssociationFormFieldDefinition(field, details) {
+  if (hasNonEmptyAssociationFormUuid(field) || hasManagedAssociationFormReference(field)) {
+    return;
+  }
+  throw createFormCompilerError(
+    'AssociationFormField 必须配置 associationForm.formUuid 或 form: 引用',
+    'FORM_COMPILER_ASSOCIATION_FORM_UUID_MISSING',
+    Object.assign({
+      label: field && field.label,
+      title: field && field.title,
+      form: field && field.form,
+      componentName: ASSOCIATION_FORM_FIELD_TYPE,
+    }, details || {})
+  );
+}
+
 const COMPONENT_ALIAS_META = Symbol('openyida.componentAlias');
 
 function normalizeComponentAlias(field) {
@@ -612,6 +645,9 @@ function buildFieldComponent(field, options) {
   const semanticPath = semanticKey
     ? (compilerOptions.semanticPath ? compilerOptions.semanticPath + '.' + semanticKey : semanticKey)
     : '';
+  if (componentName === ASSOCIATION_FORM_FIELD_TYPE) {
+    assertAssociationFormFieldDefinition(field, { semanticPath });
+  }
   const fieldId = resolveFieldId(componentName, semanticPath, compilerOptions);
   const nodeId = nextNodeId();
   recordFieldBinding(compilerOptions, semanticPath, fieldId, componentName);
@@ -1743,7 +1779,7 @@ function buildFormSchema(formTitle, fields, formUuid, corpId, appType, layout, t
   };
 
   // 顶层 Schema（与模板结构完全一致）- actions 和 config 与 pages 平级
-  return {
+  const schema = {
     schemaType: 'superform',
     schemaVersion: '5.0',
     pages: [pageSchema],
@@ -1767,6 +1803,11 @@ function buildFormSchema(formTitle, fields, formUuid, corpId, appType, layout, t
       connectComponent: [],
     },
   };
+  assertNoEmojiInValue(schema, {
+    artifact: 'compiled form schema ' + formUuid,
+    code: 'OPENYIDA_FORM_SCHEMA_EMOJI_FORBIDDEN',
+  });
+  return schema;
 }
 
 function buildEmptyFormSchema() {

package/lib/app/services/native-page-compiler.js

@@ -4,6 +4,7 @@ const crypto = require('crypto');
 const UglifyJS = require('uglify-js');
 const { default: babelTransform } = require('../../core/babel-transform');
 const { buildPageSource } = require('../page-compat');
+const { assertNoEmojiInText } = require('../../core/no-emoji-guard');
 const { schemaError } = require('../../schema/errors');
 const { isLoadedPageSource } = require('../../schema/page-source-loader');
 
@@ -32,6 +33,17 @@ function compileNativePageSource(loadedSource) {
       stage: 'normalize',
     });
   }
+  try {
+    assertNoEmojiInText(buildResult.code, {
+      artifact: loadedSource.relativePath || 'Schema native page source',
+      code: 'SCHEMA_PAGE_SOURCE_EMOJI_FORBIDDEN',
+    });
+  } catch (error) {
+    compilerError('SCHEMA_PAGE_SOURCE_EMOJI_FORBIDDEN', error.message, {
+      stage: 'emoji',
+      issues: error.details && error.details.issues,
+    });
+  }
 
   let babelResult;
   try {

package/lib/core/locales/en.js

@@ -1116,6 +1116,7 @@ Examples:
     lint_import_require: 'Found import/require. Yida custom pages cannot import modules; load third-party scripts with this.utils.loadScript',
     lint_react_hooks: 'Found React Hooks. Yida runtime uses React 16 class-component style and does not support useState/useEffect hooks',
     lint_export_default: 'Found export default. Yida needs named exports such as export function renderJsx/didMount',
+    lint_emoji_forbidden: 'Found emoji "{0}". OpenYida generated artifacts must not use emoji in UI copy, source comments, file paths, or code constants; use plain text, SVG, or icon components instead.',
     lint_jsx_extension: 'This .js file contains JSX; prefer .jsx for source files. The compiled output is still .js',
     lint_event_direct_method: 'Event binding passes this.xxx directly and will lose this; use (e) => { this.xxx(e); }',
     lint_event_bind_this: 'Event binding uses .bind(this); use (e) => { this.xxx(e); } instead',

package/lib/core/locales/zh.js

@@ -1110,6 +1110,7 @@ openyida - 宜搭命令行工具
     lint_import_require: '检测到 import/require。宜搭自定义页面禁止模块导入，第三方脚本应通过 this.utils.loadScript 加载',
     lint_react_hooks: '检测到 React Hooks。宜搭运行时基于 React 16 类组件模式，不支持 useState/useEffect 等 Hooks',
     lint_export_default: '检测到 export default。宜搭需要 export function renderJsx/didMount 等具名导出',
+    lint_emoji_forbidden: '检测到 emoji「{0}」。OpenYida 生成产物禁止在 UI 文案、源码注释、文件路径或代码常量中使用 emoji；请改用普通文字、SVG 或图标组件。',
     lint_jsx_extension: '当前文件是 .js 但包含 JSX，建议改为 .jsx，编译产物仍会输出 .js',
     lint_event_direct_method: '事件绑定直接传入 this.xxx，会导致 this 丢失；请使用 (e) => { this.xxx(e); }',
     lint_event_bind_this: '事件绑定使用了 .bind(this)，请改为 (e) => { this.xxx(e); }',

package/lib/core/no-emoji-detector.js

@@ -0,0 +1,261 @@
+'use strict';
+
+// Covers common emoji blocks and Dingbats/Misc Symbols such as ✅, ⚠️, 📊, 🚀.
+// Keep this detector scoped to generated artifacts; CLI status output may still
+// use terminal glyphs independently.
+const EMOJI_PATTERN = /(?:[0-9#*]\uFE0F?\u20E3|[\u{1F000}-\u{1FAFF}\u{2600}-\u{27BF}](?:\uFE0F|\uFE0E)?(?:\u200D[\u{1F000}-\u{1FAFF}\u{2600}-\u{27BF}](?:\uFE0F|\uFE0E)?)*)/gu;
+const HEX_DIGITS = /^[0-9a-fA-F]+$/;
+
+function normalizeArtifactName(value) {
+  return String(value || 'artifact');
+}
+
+function getLineInfo(text, index) {
+  const before = text.slice(0, index);
+  const line = before.split(/\r\n|\r|\n/).length;
+  const lineStart = Math.max(before.lastIndexOf('\n'), before.lastIndexOf('\r')) + 1;
+  const nextNewline = text.indexOf('\n', index);
+  const lineEnd = nextNewline >= 0 ? nextNewline : text.length;
+  const column = index - lineStart + 1;
+  return {
+    line,
+    column,
+    excerpt: compactExcerpt(text.slice(lineStart, lineEnd), column),
+  };
+}
+
+function compactExcerpt(lineText, column) {
+  const normalized = String(lineText || '').replace(/\s+/g, ' ').trim();
+  if (normalized.length <= 120) {
+    return normalized;
+  }
+  const center = Math.max(0, column - 1);
+  const start = Math.max(0, center - 45);
+  const end = Math.min(normalized.length, start + 110);
+  return (start > 0 ? '...' : '') + normalized.slice(start, end) + (end < normalized.length ? '...' : '');
+}
+
+function createIssue(source, index, emoji, options, extra) {
+  const lineInfo = getLineInfo(source, index);
+  return Object.assign({
+    artifact: normalizeArtifactName(options.artifact),
+    path: options.path || options.valuePath || '',
+    emoji,
+    index,
+    line: lineInfo.line,
+    column: lineInfo.column,
+    excerpt: lineInfo.excerpt,
+  }, extra || {});
+}
+
+function isEmojiCharacter(value) {
+  EMOJI_PATTERN.lastIndex = 0;
+  const matched = EMOJI_PATTERN.test(value);
+  EMOJI_PATTERN.lastIndex = 0;
+  return matched;
+}
+
+function findRawEmojiInText(source, options) {
+  const issues = [];
+  EMOJI_PATTERN.lastIndex = 0;
+
+  let match;
+  while ((match = EMOJI_PATTERN.exec(source)) !== null) {
+    issues.push(createIssue(source, match.index, match[0], options));
+  }
+  return issues;
+}
+
+function readUnicodeEscapeAt(source, index) {
+  if (source[index] !== '\\' || source[index + 1] !== 'u') {
+    return null;
+  }
+
+  if (source[index + 2] === '{') {
+    const closeIndex = source.indexOf('}', index + 3);
+    if (closeIndex < 0) {
+      return null;
+    }
+    const hex = source.slice(index + 3, closeIndex);
+    if (!hex || hex.length > 6 || !HEX_DIGITS.test(hex)) {
+      return null;
+    }
+    const codePoint = Number.parseInt(hex, 16);
+    if (!Number.isFinite(codePoint) || codePoint > 0x10FFFF) {
+      return null;
+    }
+    return {
+      raw: source.slice(index, closeIndex + 1),
+      codePoint,
+      length: closeIndex + 1 - index,
+    };
+  }
+
+  const hex = source.slice(index + 2, index + 6);
+  if (hex.length !== 4 || !HEX_DIGITS.test(hex)) {
+    return null;
+  }
+  return {
+    raw: source.slice(index, index + 6),
+    codePoint: Number.parseInt(hex, 16),
+    length: 6,
+  };
+}
+
+function isHighSurrogate(codePoint) {
+  return codePoint >= 0xD800 && codePoint <= 0xDBFF;
+}
+
+function isLowSurrogate(codePoint) {
+  return codePoint >= 0xDC00 && codePoint <= 0xDFFF;
+}
+
+function combineSurrogatePair(high, low) {
+  return ((high - 0xD800) * 0x400) + (low - 0xDC00) + 0x10000;
+}
+
+function codePointToString(codePoint) {
+  try {
+    return String.fromCodePoint(codePoint);
+  } catch {
+    return '';
+  }
+}
+
+function findEscapedEmojiInText(source, options) {
+  const issues = [];
+  for (let index = 0; index < source.length; index++) {
+    const first = readUnicodeEscapeAt(source, index);
+    if (!first) {
+      continue;
+    }
+
+    let raw = first.raw;
+    let codePoint = first.codePoint;
+    let length = first.length;
+
+    if (isHighSurrogate(first.codePoint)) {
+      const second = readUnicodeEscapeAt(source, index + first.length);
+      if (second && isLowSurrogate(second.codePoint)) {
+        raw += second.raw;
+        codePoint = combineSurrogatePair(first.codePoint, second.codePoint);
+        length += second.length;
+      }
+    }
+
+    const emoji = codePointToString(codePoint);
+    if (emoji && isEmojiCharacter(emoji)) {
+      issues.push(createIssue(source, index, emoji, options, {
+        escaped: true,
+        escape: raw,
+      }));
+    }
+
+    index += Math.max(length - 1, 0);
+  }
+  return issues;
+}
+
+function findEmojiInText(text, options = {}) {
+  const source = String(text || '');
+  const maxIssues = options.maxIssues || 20;
+  const scanOptions = {
+    artifact: normalizeArtifactName(options.artifact),
+    path: options.path || options.valuePath || '',
+    valuePath: options.valuePath,
+  };
+  return findRawEmojiInText(source, scanOptions)
+    .concat(findEscapedEmojiInText(source, scanOptions))
+    .sort((left, right) => left.index - right.index)
+    .slice(0, maxIssues);
+}
+
+function findEmojiInArtifactName(artifactName, options = {}) {
+  const artifact = normalizeArtifactName(options.artifact || artifactName);
+  return findEmojiInText(String(artifactName || ''), {
+    artifact,
+    path: options.path || 'filePath',
+    maxIssues: options.maxIssues,
+  });
+}
+
+function appendPath(parentPath, key) {
+  if (typeof key === 'number') {
+    return `${parentPath || '$'}[${key}]`;
+  }
+  if (/^[A-Za-z_$][\w$]*$/.test(String(key))) {
+    return parentPath ? `${parentPath}.${key}` : String(key);
+  }
+  return `${parentPath || '$'}[${JSON.stringify(String(key))}]`;
+}
+
+function findEmojiInValue(value, options = {}) {
+  const issues = [];
+  const seen = new WeakSet();
+  const maxIssues = options.maxIssues || 20;
+
+  function visit(current, currentPath) {
+    if (issues.length >= maxIssues) {
+      return;
+    }
+    if (typeof current === 'string') {
+      findEmojiInText(current, {
+        artifact: options.artifact,
+        path: currentPath,
+        maxIssues: maxIssues - issues.length,
+      }).forEach((issue) => issues.push(issue));
+      return;
+    }
+    if (!current || typeof current !== 'object') {
+      return;
+    }
+    if (seen.has(current)) {
+      return;
+    }
+    seen.add(current);
+
+    if (Array.isArray(current)) {
+      current.forEach((item, index) => visit(item, appendPath(currentPath, index)));
+      return;
+    }
+
+    Object.keys(current).forEach((key) => {
+      visit(current[key], appendPath(currentPath, key));
+    });
+  }
+
+  visit(value, options.path || '');
+  return issues;
+}
+
+function formatEmojiIssue(issue) {
+  const location = issue.line
+    ? `${issue.artifact}:${issue.line}:${issue.column}`
+    : issue.artifact;
+  const pathText = issue.path ? ` (${issue.path})` : '';
+  const escapeText = issue.escape ? ` via escape "${issue.escape}"` : '';
+  return `${location}${pathText} contains emoji "${issue.emoji}"${escapeText}`;
+}
+
+function buildEmojiErrorMessage(issues, options = {}) {
+  const artifact = normalizeArtifactName(options.artifact || (issues[0] && issues[0].artifact));
+  const guidance = options.guidance || 'Remove emoji from generated UI copy, Schema strings, comments, file paths, and code constants. Use plain text, SVG, or icon components instead.';
+  const lines = [
+    `${artifact} contains emoji, which is forbidden for OpenYida generated artifacts.`,
+    ...issues.slice(0, 5).map(formatEmojiIssue),
+    guidance,
+  ];
+  if (issues.length > 5) {
+    lines.splice(lines.length - 1, 0, `...and ${issues.length - 5} more emoji occurrence(s).`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = {
+  EMOJI_PATTERN,
+  buildEmojiErrorMessage,
+  findEmojiInArtifactName,
+  findEmojiInText,
+  findEmojiInValue,
+  formatEmojiIssue,
+};

package/lib/core/no-emoji-guard.js

@@ -0,0 +1,59 @@
+'use strict';
+
+const { CliError } = require('./cli-error');
+const {
+  EMOJI_PATTERN,
+  buildEmojiErrorMessage,
+  findEmojiInArtifactName,
+  findEmojiInText,
+  findEmojiInValue,
+  formatEmojiIssue,
+} = require('./no-emoji-detector');
+
+function normalizeArtifactName(value) {
+  return String(value || 'artifact');
+}
+
+function createEmojiError(issues, options = {}) {
+  return new CliError(buildEmojiErrorMessage(issues, options), {
+    code: options.code || 'OPENYIDA_ARTIFACT_EMOJI_FORBIDDEN',
+    details: {
+      artifact: normalizeArtifactName(options.artifact || (issues[0] && issues[0].artifact)),
+      issues,
+    },
+  });
+}
+
+function assertIssuesEmpty(issues, options) {
+  if (issues.length > 0) {
+    throw createEmojiError(issues, options);
+  }
+}
+
+function assertNoEmojiInText(text, options = {}) {
+  assertIssuesEmpty(findEmojiInText(text, options), options);
+}
+
+function assertNoEmojiInValue(value, options = {}) {
+  assertIssuesEmpty(findEmojiInValue(value, options), options);
+}
+
+function assertNoEmojiInArtifactName(artifactName, options = {}) {
+  assertIssuesEmpty(findEmojiInArtifactName(artifactName, options), {
+    ...options,
+    artifact: options.artifact || artifactName,
+  });
+}
+
+module.exports = {
+  EMOJI_PATTERN,
+  assertNoEmojiInArtifactName,
+  assertNoEmojiInText,
+  assertNoEmojiInValue,
+  buildEmojiErrorMessage,
+  createEmojiError,
+  findEmojiInArtifactName,
+  findEmojiInText,
+  findEmojiInValue,
+  formatEmojiIssue,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.7.23-1",
+  "version": "2026.7.23-2",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/yida-skills/SKILL.md

@@ -227,7 +227,7 @@ schema-managed create/update 必须等待用户对当前 `planId` 显式批准
 
 1. **技能加载唯一入口**：执行任何子技能前，支持 `use_skill` 的宿主必须调用 `use_skill("<技能名>", "<本阶段目的>")` 加载对应技能；不要用 `Read` / `read_file` / `cat` 读取 SKILL.md 路径，不凭记忆猜参数格式。
 2. **corpId 一致性检查**：创建或发布页面前对比 prd/resource context 与当前 auth snapshot（本地 OAuth token session 或 snapshot 明确返回的宿主注入 env token）中的 corpId，不一致必须询问用户（重新登录到目标组织，或确认在当前组织继续操作已解析资源/缺失资源）。
-3. **发布前本地校验**：普通自定义页面 `.oyd.jsx` / `.jsx` 发布前跑 `openyida check-page` + `openyida compile`；Code Canvas `.canvas.jsx` 不跑这两个普通自定义页面检查，改由 `openyida publish` 的 Canvas 编译阶段或 `compileCanvasLocal` 快检校验；JSON 配置写盘后先解析校验，再调用平台命令。
+3. **发布前本地校验**：普通自定义页面 `.oyd.jsx` / `.jsx` 发布前跑 `openyida check-page` + `openyida compile`；Code Canvas `.canvas.jsx` 不跑这两个普通自定义页面检查，改由 `openyida publish` 的 Canvas 编译阶段或 `compileCanvasLocal` 快检校验；JSON 配置写盘后先解析校验，再调用平台命令。OpenYida 生成产物硬禁 emoji：页面源码、Canvas 源码、表单 Schema、发布 Schema 和产物文件路径出现 emoji 时必须改源码/字段 JSON/路径，不得用 `--skip-lint` 或重复发布绕过。
 4. **页面源码修改必须发布闭环**：只要本轮 Write/Edit/Create 了页面源码 `project/pages/src/*.{canvas.jsx,canvas.tsx,oyd.jsx,jsx,tsx}`（含完整搭建、补齐、已有页面 update path、单点优化），final 前必须看到成功的 `openyida publish <source> <appType> <displayPageFormUuid>` 命令结果；本地文件编辑、diff、本地校验或编译只证明源码可发布，不等于远端页面已更新。若没有 publish 成功证据，final 只能说“源码已修改，尚未发布”，禁止说“页面已更新 / 已重新发布 / 已上线”。
 5. **命令输入文件禁止 shell 写入**：当 OpenYida 命令需要 JSON/YAML/CSV/config/script 文件参数时，先使用当前 agent 运行时提供的结构化文件写入工具（如 create_file / Write / file edit tool）创建文件，再把路径传给命令；禁止用 shell heredoc、`cat`/`echo`/`printf`/`tee` 加输出重定向，或把命令 stdout 重定向成业务文件。
 6. **读文件少用 Bash 噪声**：读取或定位 workspace 文件优先用宿主的 Read / Glob / Grep；OpenYida CLI 已返回成功 JSON、URL 或 `formUuid/appType` 时，不要再用 Bash `cat`/`ls` 做无意义复核。

package/yida-skills/skills/yida-app/SKILL.md

@@ -160,6 +160,7 @@ UI 不是独立替代主流程的步骤，而是按模式插入到页面生成
 
 - **模板路径**：先写业务化 `page-spec.json`，再执行 `openyida generate-page ... --spec <page-spec.json> --compile`。生成后只读取 `.openyida-page.json` / CLI 摘要判断 `domainFidelity` 和 dataBinding 状态；若需要补业务语义或样式，基于生成文件做小范围 Edit/patch。禁止在 `generate-page` 后立即 Read 500+ 行源码再全量 Write 覆盖同一路径。
 - **手写路径**：如果已经明确最终页面结构、数据桥和视觉细节，跳过 `generate-page`，直接 Write 最终 `.canvas.jsx`，再做本地快检和 publish。不要先生成模板再把模板完全覆盖。
+- **emoji 硬门禁**：表单字段 JSON、页面 spec、`.canvas.jsx` / `.oyd.jsx` 源码、发布 Schema 和产物文件路径都不能包含 emoji。OpenYida 报 emoji 错误时修改字段文案、spec、源码或路径；不要用 `--skip-lint`、重复 create/publish 或全量 rewrite 试图绕过。
 
 选择模板路径时必须：
 

package/yida-skills/skills/yida-canvas-custom-page/SKILL.md

@@ -106,6 +106,7 @@ openyida sample yida-canvas-custom-page portal-native-components --output projec
 9. **自定义主题必须页面内注入**：`--theme` 只接受平台预置 key；如果页面设计使用非预置主题（例如活力橙、深玫红、自定义暗黑金），Canvas 页面必须在自身源码中注入 `style#yida-global-theme` 或等价 scoped CSS vars，并在根节点设置 `data-theme-scope="page"`。官方 sample 每个页面都要做，避免宿主应用 `black` 主题把页面染成黑灰。
 10. **真实交付不使用前端 seed 冒充业务数据**：`openyida sample` 原样发布可以保留 sample/seed 数据，但必须在页面上标注为 sample/seed。完整应用或真实交付页只要需要列表、看板、详情记录，并且本轮已经创建/解析业务表单，就必须在 `page-spec.json` 写入 `dataBinding.mode=form`、真实 `appType/formUuid` 和字段映射，让页面从表单读取。若需要演示数据，先通过表单数据写入链路创建 demo/mock records，再由 Canvas 读取这些真实表单记录；未写入 demo records 且没有真实数据时展示空态、表单入口、刷新/登记按钮。
 11. **页面生成二选一**：选择模板路径时，`openyida generate-page ... --spec ... --compile` 之后只读取 CLI 摘要或 `.openyida-page.json` 判断 `domainFidelity` / dataBinding，并对生成源码做小范围 Edit/patch；禁止立刻 Read 大段源码后全量 Write 覆盖同一路径。选择手写路径时，直接 Write 最终 `.canvas.jsx` 并快检/发布，不要先跑 `generate-page` 再完全覆盖。
+12. **Canvas 产物硬禁 emoji**：`.canvas.jsx` 源码、模板 spec 会渲染到页面的文案、JS 注释、数据常量和产物文件路径都不能包含 emoji。`generate-page --compile`、`compileCanvasLocal` 或 `publish` 报 emoji 错误时，先改 spec/源码/路径；不要尝试跳过 lint 或重复发布。
 
 ## 数据真实性边界
 

package/yida-skills/skills/yida-create-form-page/SKILL.md

@@ -92,6 +92,7 @@ Divider > Field
 - 复杂业务表单应自然使用多种字段类型，例如文本、数值、日期、选择、成员/部门、附件、子表、关联表单；字段类型多样性服务于业务语义。
 - `TableField` 必须提供 `children` 子字段，`AssociationFormField` 必须提供关联表单信息。
 - 审批人、审批状态、审批节点等流程运行字段由流程能力承载；表单只收集业务数据。
+- 表单标题、字段 label/title、选项、提示语、校验文案、动作源码、字段 JSON 常量和字段 JSON 文件路径都禁止 emoji；`create-form` / schema compiler 报 emoji 错误时必须改字段 JSON 或路径，不能重复 create 或用同义命令绕过。
 
 ## Divider 主题规则
 

package/yida-skills/skills/yida-custom-page/SKILL.md

@@ -56,7 +56,7 @@ description: 宜搭普通自定义页面 JSX / Jsx 组件开发规范（React 16
 10. **Tabs 显隐控制**：下拉值变更后自动回退到第一个可见 Tab，内容区用 `display: none` 保留 DOM
 11. **加载态必须可恢复**：列表/看板页默认保留空态或演示数据；接口失败、超时或返回异常时必须把 `loading` 置回 `false`，不要只渲染“正在加载...”挡住整页
 12. **禁止可见原生下拉**：筛选、预约、审批等用户可见下拉交互不要使用 `<select>`；普通自定义页也不要把表单设计器里的 `SelectField` 当 React 筛选组件直接渲染。默认使用 Tailwind className 组合 `button + menu + option` 的自定义下拉组件，并带 `.oyd-select-arrow` 下箭头、`.oyd-select-check` 选中标记和页面级 focus reset；light 模式下选中项整块背景必须用 `--oyd-control-selected-bg` 这类低透明度浅色 token，不要直接用 `--color-brand1-1`
-13. **严禁 emoji**：页面渲染出来的任何位置（标题、按钮、标签、状态、空态文案、图表标题等）**一律禁止出现 emoji**（😀🚀✅⚠️📦📊 等一切彩色符号字符）。需要图标一律用功能性内联 SVG（见 `skills/yida-page-uiux` 图标策略）；需要状态标记用文字 + 语义色标签。emoji 是最明显的 AI 味来源之一，且跨端显示不一致。JS 注释里也不要留装饰性符号。
+13. **严禁 emoji**：页面渲染出来的任何位置（标题、按钮、标签、状态、空态文案、图表标题等）**一律禁止出现 emoji**（😀🚀✅⚠️📦📊 等一切彩色符号字符）。需要图标一律用功能性内联 SVG（见 `skills/yida-page-uiux` 图标策略）；需要状态标记用文字 + 语义色标签。emoji 是最明显的 AI 味来源之一，且跨端显示不一致。JS 注释、文件路径、数据常量和示例数组里也不要留装饰性符号；`check-page` / `compile` / `publish` 报 emoji 错误时必须删除或改为 SVG/图标组件，不能用 `--skip-lint` 绕过。
 14. **light 页面禁灰黑主题**：普通业务列表、协同表、录入表、工作台和门户默认不要用近黑按钮、近黑描边、灰黑重阴影作为主题；主操作、选中态、筛选焦点和批量操作使用品牌色或 sample 自带主题色，边框用浅色品牌混合。只有用户明确要求暗色/高对比时才使用深色主视觉。
 15. **发布前必须跑检查链路**：先执行 `openyida check-page <file>` 和 `openyida compile <file>`；若出现 warning/error，按规则修复后再发布
 16. **源码修改发布闭环**：只要本轮 Write/Edit/Create 了 `project/pages/src/*.{oyd.jsx,jsx,tsx}` 普通自定义页面源码，`check-page` / `compile` 只证明源码可发布，不等于远端页面已更新；final 前必须看到成功的 `openyida publish <source> <appType> <displayPageFormUuid>`。没有 publish 成功证据时，只能说“源码已修改，尚未发布”，不能说“页面已更新 / 已重新发布”。