openyida 2026.7.23-2 → 2026.7.25-beta.1

package/lib/app/canvas-compile.js

@@ -25,7 +25,7 @@
  *      这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。
  *
  * 因此本地编译 = Babel 把 JSX/TS 转成 ES5 → 把 import 改写成 window 别名引用、
- * 把 export default 改写成 `var YidaComp = ...` → 正则抽出依赖包名。
+ * 把 export default 改写成画布入口 `YidaComp` → 正则抽出依赖包名。
  */
 
 const Babel = require('@babel/standalone');
@@ -152,6 +152,15 @@ function esmToWindowPlugin({ types: t }, options = {}) {
     );
   }
 
+  function hasProgramBinding(path, name) {
+    const program = path.findParent((parentPath) => parentPath.isProgram());
+    return Boolean(program && program.scope.hasBinding(name));
+  }
+
+  function isExistingYidaCompDefault(path, decl) {
+    return t.isIdentifier(decl, { name: 'YidaComp' }) && hasProgramBinding(path, 'YidaComp');
+  }
+
   return {
     name: 'yida-esm-to-window',
     visitor: {
@@ -217,6 +226,10 @@ function esmToWindowPlugin({ types: t }, options = {}) {
         const decl = path.node.declaration;
         if (t.isFunctionDeclaration(decl) || t.isClassDeclaration(decl)) {
           if (decl.id) {
+            if (decl.id.name === 'YidaComp') {
+              path.replaceWith(decl);
+              return;
+            }
             // 具名声明：保留声明本体，再补 `var YidaComp = <name>;`
             const idName = decl.id.name;
             path.replaceWithMultiple([
@@ -235,6 +248,10 @@ function esmToWindowPlugin({ types: t }, options = {}) {
           );
           return;
         }
+        if (isExistingYidaCompDefault(path, decl)) {
+          path.remove();
+          return;
+        }
         // export default <表达式>
         path.replaceWith(
           t.variableDeclaration('var', [t.variableDeclarator(t.identifier('YidaComp'), decl)])
@@ -258,6 +275,32 @@ function esmToWindowPlugin({ types: t }, options = {}) {
   };
 }
 
+function buildCanvasRuntimeWrapper(runtimeCode) {
+  return (
+    'return function(iframeWindow, parentWindow){ const window = iframeWindow; '
+    + runtimeCode
+    + ' return YidaComp; }'
+  );
+}
+
+function assertCanvasRuntimeParseable(runtimeCode, options = {}) {
+  try {
+    // 只编译 wrapper，不执行 factory 或用户组件，避免触发源码里的运行期副作用。
+    // eslint-disable-next-line no-new-func
+    new Function(buildCanvasRuntimeWrapper(runtimeCode));
+  } catch (error) {
+    const detail = error && error.message ? error.message : String(error);
+    const sourceLabel = options.sourcePath ? ` (${options.sourcePath})` : '';
+    const compileError = new Error(
+      `Code Canvas runtimeCode 无法通过画布运行时装配校验${sourceLabel}: ${detail}`
+      + '。请检查默认导出、YidaComp 入口或 window 等运行时保留变量是否重复声明。'
+    );
+    compileError.code = 'OPENYIDA_CANVAS_RUNTIME_PARSE_FAILED';
+    compileError.cause = error;
+    throw compileError;
+  }
+}
+
 /**
  * 本地编译 Code Canvas 源码。
  * @param {string} source 原始 React/JSX/TSX 源码
@@ -322,6 +365,7 @@ function compileCanvasLocal(source, options = {}) {
     artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
     code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
   });
+  assertCanvasRuntimeParseable(runtimeCode, options);
   return {
     runtimeCode,
     importedModules: JSON.stringify(importedModules),
@@ -356,5 +400,6 @@ module.exports = {
   extractImportedModules,
   resolveWindowAlias,
   shouldAllowUnsupportedBareImports,
+  assertCanvasRuntimeParseable,
   MODULE_ALIAS_MAP,
 };

package/lib/app/create-form.js

@@ -4334,6 +4334,109 @@ function sanitizeFailureResult(result) {
   return sanitized;
 }
 
+function getUpdateFormConfigRetryDelays() {
+  const rawDelays = process.env.OPENYIDA_UPDATE_FORM_CONFIG_RETRY_DELAYS_MS;
+  if (rawDelays === undefined) {
+    return [500, 1000];
+  }
+  return String(rawDelays)
+    .split(',')
+    .map(function (part) { return Number(part.trim()); })
+    .filter(function (delay) { return Number.isFinite(delay) && delay >= 0; });
+}
+
+function waitForUpdateFormConfigRetry(delayMs) {
+  if (!delayMs) {
+    return Promise.resolve();
+  }
+  return new Promise(function (resolve) {
+    setTimeout(resolve, delayMs);
+  });
+}
+
+function getUpdateFormConfigErrorText(result) {
+  if (!result || typeof result !== 'object') {
+    return '';
+  }
+  return [
+    result.errorMsg,
+    result.message,
+    result.error,
+    result.errorCode,
+    result.code,
+  ]
+    .filter(function (part) { return part !== undefined && part !== null; })
+    .map(function (part) { return String(part); })
+    .join(' ');
+}
+
+function getUpdateFormConfigWarningMessage(result) {
+  if (!result || typeof result !== 'object') {
+    return t('common.request_failed');
+  }
+  return result.errorMsg || result.message || result.error || result.errorCode || result.code || t('common.unknown_error');
+}
+
+function isRetryablePostSaveUpdateConfigResult(result) {
+  if (!result || result.success || result.__needLogin || result.__csrfExpired) {
+    return false;
+  }
+  const status = Number(result.__httpStatus || result.status || result.statusCode);
+  if (status === 400 || status === 401 || status === 403 || status >= 500) {
+    return false;
+  }
+  const text = getUpdateFormConfigErrorText(result);
+  const lowerText = text.toLowerCase();
+  const normalizedText = lowerText.replace(/[\s_-]/g, '');
+  if (/csrf|auth|login|permission|forbidden|unauthori[sz]ed|invalid|param|权限|登录|认证|授权|参数/.test(lowerText)) {
+    return false;
+  }
+  if (text.indexOf('表单') !== -1 && text.indexOf('不存在') !== -1) {
+    return true;
+  }
+  if (text.indexOf('表单') !== -1 && text.indexOf('未找到') !== -1) {
+    return true;
+  }
+  if (
+    normalizedText.indexOf('formnotfound') !== -1 ||
+    normalizedText.indexOf('formnotexist') !== -1 ||
+    normalizedText.indexOf('formdoesnotexist') !== -1
+  ) {
+    return true;
+  }
+  return lowerText.indexOf('not found') !== -1 && /form|formuuid|form uuid/.test(lowerText);
+}
+
+async function sendPostSaveUpdateConfigRequest(authRef, appType, formUuid, version) {
+  const retryDelays = getUpdateFormConfigRetryDelays();
+  for (let attemptIndex = 0; attemptIndex <= retryDelays.length; attemptIndex += 1) {
+    let configResult;
+    try {
+      configResult = await requestWithAutoLogin(function (auth) {
+        return sendUpdateConfigRequest(auth.baseUrl, appType, formUuid, version || 1, 0, auth);
+      }, authRef);
+    } catch (err) {
+      return {
+        success: false,
+        errorMsg: err && err.message ? err.message : String(err || 'request failed'),
+        errorCode: err && err.code ? err.code : 'CREATE_FORM_UPDATE_CONFIG_FAILED',
+      };
+    }
+    if (configResult && configResult.success) {
+      return configResult;
+    }
+    if (attemptIndex >= retryDelays.length || !isRetryablePostSaveUpdateConfigResult(configResult)) {
+      return configResult;
+    }
+    await waitForUpdateFormConfigRetry(retryDelays[attemptIndex]);
+  }
+  return {
+    success: false,
+    errorMsg: t('common.request_failed'),
+    errorCode: 'CREATE_FORM_UPDATE_CONFIG_FAILED',
+  };
+}
+
 function buildCreateFormPostCreateFailurePayload(context) {
   const errorObject = context && context.error;
   const payload = {
@@ -4387,6 +4490,7 @@ function assertNoEmojiInDefinitionFileName(value) {
 // ── 保存 Schema 并更新表单配置（create/update 共用）──
 //
 // 封装了 saveFormSchema + updateFormConfig 两步，以及各自的 302 自动重登录重试。
+// direct create-form 语义：saveFormSchema 成功后，updateFormConfig 只是后置配置通知。
 // 返回 { saveResult, configResult }。
 
 async function saveSchemaAndUpdateConfig(authRef, appType, formUuid, schema, version, stepOffset, failureContext) {
@@ -4447,9 +4551,7 @@ async function saveSchemaAndUpdateConfig(authRef, appType, formUuid, schema, ver
   step(configStep, t('create_form.step_update_config', configStep));
   info(t('create_form.sending_config'));
 
-  const configResult = await requestWithAutoLogin(function (auth) {
-    return sendUpdateConfigRequest(auth.baseUrl, appType, formUuid, version || 1, 0, auth);
-  }, authRef);
+  const configResult = await sendPostSaveUpdateConfigRequest(authRef, appType, formUuid, version);
 
   return { saveResult: saveResult, configResult: configResult };
 }
@@ -4571,31 +4673,29 @@ async function mainCreate(parsedArgs, authRef) {
       parsedArgs.browserOpenMode
     )));
   } else {
-    const configErrorMsg = configResult ? configResult.errorMsg || t('common.unknown_error') : t('common.request_failed');
-    result(false, t('create_form.config_failed', configErrorMsg), [
+    const configErrorMsg = getUpdateFormConfigWarningMessage(configResult);
+    result(true, t('create_form.create_success'), [
       ['Form UUID', formUuid],
       ['URL', formUrl],
     ]);
+    warn(t('create_form.config_failed', configErrorMsg));
     hint(t('create_form.schema_ok_config_failed'));
-    const configError = createCreateFormError(configErrorMsg, 'CREATE_FORM_UPDATE_CONFIG_FAILED', {
-      appType,
-      formUuid,
-      result: sanitizeFailureResult(configResult),
-    });
-    console.log(JSON.stringify(Object.assign(
-      buildCreateFormPostCreateFailurePayload({
+    console.log(JSON.stringify(withBrowserHandoff(
+      {
+        success: true,
         appType,
         formTitle,
         formUuid,
         fieldCount,
-        stage: 'updateFormConfig',
-        error: configError,
-      }),
-      {
         url: formUrl,
+        stage: 'updateFormConfig',
         schemaSaved: true,
         configWarning: configErrorMsg,
-      }
+        configResult: sanitizeFailureResult(configResult),
+      },
+      formUrl,
+      { stage: 'create_form_success', title: formTitle },
+      parsedArgs.browserOpenMode
     )));
   }
 }
@@ -5517,15 +5617,27 @@ async function mainUpdate(parsedArgs, authRef) {
       parsedArgs.browserOpenMode
     )));
   } else {
-    const configErrorMsg = configResult ? configResult.errorMsg || t('common.unknown_error') : t('common.request_failed');
-    result(false, t('create_form.config_failed', configErrorMsg), [
+    const configErrorMsg = getUpdateFormConfigWarningMessage(configResult);
+    result(true, t('create_form.update_success'), [
       ['Form UUID', formUuid],
       ['URL', formUrl],
       ['Changes', String(appliedChanges.length)],
     ]);
+    warn(t('create_form.config_failed', configErrorMsg));
     hint(t('create_form.schema_ok_config_failed'));
     console.log(JSON.stringify(withBrowserHandoff(
-      { success: true, formUuid, appType, changesApplied: appliedChanges.length, changes: appliedChanges, url: formUrl, configWarning: configErrorMsg },
+      {
+        success: true,
+        formUuid,
+        appType,
+        changesApplied: appliedChanges.length,
+        changes: appliedChanges,
+        url: formUrl,
+        stage: 'updateFormConfig',
+        schemaSaved: true,
+        configWarning: configErrorMsg,
+        configResult: sanitizeFailureResult(configResult),
+      },
       formUrl,
       { stage: 'update_form_success', title: formUuid },
       parsedArgs.browserOpenMode

package/lib/auth/token-auth.js

@@ -17,6 +17,7 @@ const {
   loadTokenSession,
   maskToken,
   normalizeTokenSession,
+  saveBusinessContext,
   saveTokenSession,
 } = require('./token-store');
 
@@ -380,6 +381,7 @@ async function tokenRefresh(options = {}) {
   });
   requireOkResponse(response);
   const data = getTokenPayload(response);
+  const responseBusinessBaseUrl = data.base_url || data.baseUrl;
   const businessBaseUrl = session.base_url || authBaseUrlValue;
   const normalized = normalizeTokenResponse({
     ...data,
@@ -397,6 +399,17 @@ async function tokenRefresh(options = {}) {
       message: normalized.message || 'auth service did not return access_token',
     };
   }
+  if (responseBusinessBaseUrl && normalized.corp_id) {
+    try {
+      saveBusinessContext({
+        corp_id: normalized.corp_id,
+        base_url: responseBusinessBaseUrl,
+      }, options);
+    } catch {
+      // The refresh result remains usable in this process even when the
+      // cross-process business context cache cannot be written.
+    }
+  }
   const env = options.env || process.env;
   if (isHostInjectedTokenMode(env) && session.auth_source === 'env') {
     env.OPENYIDA_ACCESS_TOKEN = normalized.access_token;

package/lib/auth/token-store.js

@@ -4,6 +4,8 @@ const fs = require('fs');
 const path = require('path');
 
 const TOKEN_FILE_PREFIX = 'auth-token';
+const BUSINESS_CONTEXT_FILE_PREFIX = 'auth-token-business-context';
+const BUSINESS_CONTEXT_VERSION = 1;
 
 function sanitizeEnvName(envName) {
   return String(envName || 'public').replace(/[^a-zA-Z0-9._-]/g, '_');
@@ -36,17 +38,94 @@ function getTokenFilePath(options = {}) {
   return path.join(root, '.cache', `${TOKEN_FILE_PREFIX}-${envName}.json`);
 }
 
+function getBusinessContextFilePath(options = {}) {
+  const root = resolveProjectRoot(options);
+  const envName = resolveEnvName(options);
+  return path.join(
+    root,
+    '.cache',
+    'openyida',
+    `${BUSINESS_CONTEXT_FILE_PREFIX}-${envName}.json`
+  );
+}
+
 function normalizeBaseUrl(value) {
   if (!value) {
     return undefined;
   }
   try {
-    return new URL(String(value)).origin.replace(/\/+$/, '');
+    const parsed = new URL(String(value));
+    if (
+      !['http:', 'https:'].includes(parsed.protocol) ||
+      parsed.username ||
+      parsed.password
+    ) {
+      return undefined;
+    }
+    return parsed.origin.replace(/\/+$/, '');
   } catch {
     return undefined;
   }
 }
 
+function normalizeBusinessContext(value = {}) {
+  if (!value || typeof value !== 'object') {
+    return null;
+  }
+  const corpId = String(value.corp_id || value.corpId || '').trim();
+  const baseUrl = normalizeBaseUrl(value.base_url || value.baseUrl);
+  if (!corpId || !baseUrl) {
+    return null;
+  }
+  return {
+    version: BUSINESS_CONTEXT_VERSION,
+    corp_id: corpId,
+    base_url: baseUrl,
+    updated_at: value.updated_at || value.updatedAt || new Date().toISOString(),
+  };
+}
+
+function saveBusinessContext(value, options = {}) {
+  const normalized = normalizeBusinessContext(value);
+  if (!normalized) {
+    return null;
+  }
+
+  const contextFile = getBusinessContextFilePath(options);
+  const tempFile = `${contextFile}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  fs.mkdirSync(path.dirname(contextFile), { recursive: true });
+  try {
+    fs.writeFileSync(tempFile, JSON.stringify(normalized, null, 2), { mode: 0o600 });
+    fs.renameSync(tempFile, contextFile);
+    try {
+      fs.chmodSync(contextFile, 0o600);
+    } catch {
+      // chmod is best-effort on non-POSIX filesystems.
+    }
+  } finally {
+    try {
+      if (fs.existsSync(tempFile)) {
+        fs.unlinkSync(tempFile);
+      }
+    } catch {
+      // Cleanup is best-effort.
+    }
+  }
+  return normalized;
+}
+
+function loadBusinessContext(options = {}) {
+  const contextFile = getBusinessContextFilePath(options);
+  if (!fs.existsSync(contextFile)) {
+    return null;
+  }
+  try {
+    return normalizeBusinessContext(JSON.parse(fs.readFileSync(contextFile, 'utf8')));
+  } catch {
+    return null;
+  }
+}
+
 function normalizeExpiresAt(session) {
   if (!session) {
     return undefined;
@@ -160,7 +239,17 @@ function loadTokenSession(options = {}) {
   const env = options.env || process.env;
   const envSession = loadEnvTokenSession(env);
   if (isHostInjectedTokenMode(env)) {
-    return envSession;
+    if (!envSession || !envSession.corp_id) {
+      return envSession;
+    }
+    const businessContext = loadBusinessContext(options);
+    if (!businessContext || businessContext.corp_id !== envSession.corp_id) {
+      return envSession;
+    }
+    return normalizeTokenSession({
+      ...envSession,
+      base_url: businessContext.base_url,
+    });
   }
 
   const localSession = loadLocalTokenSession(options);
@@ -221,8 +310,11 @@ function maskToken(token) {
 
 module.exports = {
   getTokenFilePath,
+  getBusinessContextFilePath,
   loadTokenSession,
   saveTokenSession,
+  loadBusinessContext,
+  saveBusinessContext,
   clearTokenSession,
   normalizeTokenSession,
   loadEnvTokenSession,

package/lib/core/agent-capabilities.js

@@ -38,6 +38,9 @@ function hasEnvTokenCredential(env = process.env) {
 const BUILDER_CORE_COMMAND_IDS = Object.freeze([
   'agent-capabilities',
   'commands',
+  'login',
+  'logout',
+  'auth',
   'app-list',
   'list-forms',
   'get-schema',

package/lib/core/utils.js

@@ -612,8 +612,8 @@ function isHttpAuthStatus(statusCode) {
  * 从 cookieData 中解析 base_url，支持多环境配置优先级。
  *
  * 优先级（高 → 低）：
- *   1. OPENYIDA_ENDPOINT 环境变量
- *   2. cookieData.base_url（登录后实际跳转域名）
+ *   1. cookieData.base_url（鉴权服务返回的企业业务域名）
+ *   2. OPENYIDA_ENDPOINT 环境变量（鉴权端点兼业务兜底）
  *   3. 当前激活的私有化环境配置
  *   4. 当前激活的环境配置（公有云默认）
  *   5. defaultBaseUrl 参数 / 公有云兜底
@@ -623,8 +623,15 @@ function isHttpAuthStatus(statusCode) {
  * @returns {string}
  */
 function resolveBaseUrl(cookieData, defaultBaseUrl) {
-  const { resolveEndpoint } = require('./env-manager');
-  const resolved = resolveEndpoint(cookieData, undefined);
+  const { normalizeBaseUrl, resolveEndpoint } = require('./env-manager');
+  const businessBaseUrl = normalizeBaseUrl(
+    cookieData && cookieData.base_url,
+    null
+  );
+  if (businessBaseUrl) {
+    return businessBaseUrl;
+  }
+  const resolved = resolveEndpoint(null, undefined);
   if (defaultBaseUrl && resolved === 'https://www.aliwork.com' && (!cookieData || !cookieData.base_url)) {
     return defaultBaseUrl.replace(/\/+$/, '');
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.7.23-2",
+  "version": "2026.7.25-beta.1",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/yida-skills/skills/yida-canvas-custom-page/SKILL.md

@@ -24,6 +24,7 @@ Code Canvas 是宜搭的代码画布自定义页面链路：以 `YidaCodeCanvas`
 - Canvas 源码写成 `.canvas.jsx` / `.canvas.tsx`，`openyida publish` 会自动走 Canvas 链路。
 - 页面源码路径按 Bash cwd 选择：从仓库根执行命令时用 `project/pages/src/...`；如果 cwd 已是 `<workspace>/project`，用 `pages/src/...`，不要写成 `project/pages/src/...`。
 - `runtimeCode` 在宿主页真实 `window` 中执行，入口必须返回 `YidaComp` / `YidaComp.default` / 组件函数。
+- 推荐入口写法是 `function YidaComp(props) { ... }`，或 `const App = ...; export default App;`。CLI 已兼容 `const/let/class YidaComp; export default YidaComp`，但生成新代码时优先避开同名默认导出，减少不同 Canvas 运行态装配器下的重复声明风险。
 - Canvas 组件没有普通页面实例上下文；数据读写通过 fetch、开放 API、连接器代理或显式 props 数据桥完成。
 - 第三方依赖走白名单；React、antd、ahooks、d3、recharts、Radix、framer-motion 等可按规则 import。
 - 宜搭运行态组件通过“原生组件桥 + fallback + 值归一化”接入；不改 `vc-deep-yida` 时，以宿主已存在的 `window.Deep` / `window.DeepYida` 探测为主，`window.YidaNativeComponents` 仅作为兼容入口。需要嵌入门户数据管理视图时探测 `DataManageViews`，并显式传入目标表单 `form.value/formUuid`。

package/yida-skills/skills-index.json

@@ -724,6 +724,11 @@
       ],
       "aliases": [
         "登录态"
+      ],
+      "command_ids": [
+        "agent-capabilities",
+        "login",
+        "auth"
       ]
     },
     {
@@ -739,6 +744,10 @@
       ],
       "aliases": [
         "登出"
+      ],
+      "command_ids": [
+        "logout",
+        "auth"
       ]
     },
     {