openyida 2026.7.7 → 2026.7.9

package/lib/core/locales/zh.js

@@ -250,7 +250,7 @@ openyida - 宜搭命令行工具
     generate_page_example: '示例: openyida generate-page product-homepage --brand-name OpenKuma --brand-initials OK --output pages/src/home.oyd.jsx --compile',
     build_page_usage: '用法: openyida build-page <源文件路径> [--output pages/build/page.yida.jsx|--write] [--json]',
     build_page_example: '示例: openyida build-page pages/src/dashboard.oyd.jsx --output pages/build/dashboard.yida.jsx',
-    publish_usage: '用法: openyida publish <源文件路径> <appType> <formUuid> [--health-check]',
+    publish_usage: '用法: openyida publish <源文件路径> <appType> <formUuid> [--health-check] [--canvas]',
     publish_example: '示例: openyida publish pages/src/home.oyd.jsx APP_XXX FORM-XXX --health-check',
     formula_usage: '用法: openyida formula evaluate <公式或文件> [--schema schema.json] [--json] [--strict]',
     formula_example: '示例: openyida formula evaluate \'IF(GT(#{numberField_total}, 100), "高", "低")\' --schema .cache/schema.json',
@@ -1066,7 +1066,7 @@ openyida - 宜搭命令行工具
     lint_array_callback_function: '.{0}(function ...) 会导致回调内 this 丢失，请改为 .{0}((item) => ...)',
     lint_foreach_callback_function: '.forEach(function ...) 可能导致回调内 this 丢失，建议改为 .forEach((item) => ...)',
     lint_controlled_input: 'input 使用了 value 受控模式，宜搭页面应使用 defaultValue + onChange 写入 _customState',
-    lint_native_select_ui: '检测到原生 <select>，样式不一致且移动端兼容性差。请改用宜搭内置的 SelectField 组件（this.$(fieldId) 或 <SelectField>），或用 div+button+onClick 实现自定义下拉',
+    lint_native_select_ui: '检测到原生 <select>，样式不一致且移动端兼容性差。普通自定义页请用 div+button+onClick 实现自定义下拉；只有 Code Canvas 场景在确认依赖映射可用后，才使用宜搭字段组件。',
     lint_iframe_self_navigation: '宜搭自定义页面运行在 iframe 中，跳转宜搭页面时请使用 target="_top"/target="_blank" 或 window.top.location，避免页面套娃',
     lint_page_size_limit: 'pageSize={0} 超过宜搭接口上限 100，请改为 100 或更小',
     lint_page_size_recommend: 'pageSize={0} 偏大，推荐使用 50（性能最佳，最大 100），优先选择 10/20/50',
@@ -1113,6 +1113,10 @@ openyida - 宜搭命令行工具
     building_schema: '[4/4] 构建 Schema...',
     formula_prefix_fixed: '  🔧 已自动修正 {0} 处子表公式前缀引用',
     schema_built: '  ✅ Schema 构建完成！',
+    step_canvas_compile: '\n📦 Step 1: 编译 Code Canvas 源码\n',
+    canvas_compiling: '  🎨 本地编译 Code Canvas 源码...',
+    canvas_compile_done: '  ✅ Code Canvas 编译完成！',
+    canvas_compile_failed: '  ❌ Code Canvas 编译失败：{0}',
     step_login: '\n🔑 Step 2: 读取登录态',
     step_publish: '\n📤 Step 3: 发布 Schema\n',
     resend_save_csrf: '  🔄 重新发送 saveFormSchema 请求（csrf_token 已刷新）...',
@@ -1142,7 +1146,7 @@ openyida - 宜搭命令行工具
     exception: '\n❌ 发布异常: {0}',
     error: '\n❌ 发布异常: {0}',
     source_not_found: '❌ 源文件不存在：{0}',
-    usage: '用法: openyida publish <源文件路径> <appType> <formUuid> [--health-check]',
+    usage: '用法: openyida publish <源文件路径> <appType> <formUuid> [--health-check] [--canvas]',
     example: '示例：openyida publish pages/src/xxx.js APP_XXX FORM-XXX --health-check',
   },
 

package/lib/core/utils.js

@@ -264,6 +264,43 @@ function isInjectedAuthMode(env = process.env) {
   return ['1', 'true', 'yes', 'on'].includes(authEnabled);
 }
 
+function hasEnvCookieAuth(env = process.env) {
+  return !!String(env.OPENYIDA_COOKIE_B64 || '').trim();
+}
+
+function isEnvAuthMode(env = process.env) {
+  return isInjectedAuthMode(env) || hasEnvCookieAuth(env);
+}
+
+let lastEnvAuthError = null;
+
+function getLastEnvAuthError() {
+  return lastEnvAuthError;
+}
+
+function setLastEnvAuthError(code, failureReason, message) {
+  lastEnvAuthError = {
+    code,
+    failure_reason: failureReason,
+    message,
+    authMode: 'env',
+  };
+  return lastEnvAuthError;
+}
+
+function normalizeEnvBaseUrl(baseUrl, fallbackBaseUrl) {
+  const raw = String(baseUrl || fallbackBaseUrl || 'https://www.aliwork.com').trim();
+  try {
+    const parsed = new URL(raw);
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+      return null;
+    }
+    return raw.replace(/\/+$/, '');
+  } catch {
+    return null;
+  }
+}
+
 /**
  * 查找项目根目录（project 工作区）。
  *
@@ -354,6 +391,123 @@ function extractInfoFromCookies(cookies) {
   return { csrfToken, corpId, userId };
 }
 
+function parseCookieHeader(rawCookieHeader, options = {}) {
+  const raw = String(rawCookieHeader || '').trim();
+  if (!raw) {
+    return [];
+  }
+  let domain = '';
+  if (options.baseUrl) {
+    try {
+      domain = new URL(options.baseUrl).hostname;
+    } catch {
+      domain = '';
+    }
+  }
+  return raw
+    .split(';')
+    .map((part) => {
+      const trimmed = part.trim();
+      const equalsIndex = trimmed.indexOf('=');
+      if (equalsIndex <= 0) {
+        return null;
+      }
+      const name = trimmed.slice(0, equalsIndex).trim();
+      const value = trimmed.slice(equalsIndex + 1).trim();
+      if (!name) {
+        return null;
+      }
+      const cookie = { name, value };
+      if (domain) {
+        cookie.domain = domain;
+      }
+      return cookie;
+    })
+    .filter(Boolean);
+}
+
+function decodeCookieHeaderFromBase64(encodedCookie) {
+  const normalized = String(encodedCookie || '').trim().replace(/\s+/g, '');
+  if (!normalized) {
+    return null;
+  }
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(normalized, 'base64').toString('utf8').trim();
+    return decoded && decoded.includes('=') ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+
+function loadEnvCookieData(defaultBaseUrl, env = process.env) {
+  lastEnvAuthError = null;
+  const encodedCookie = String(env.OPENYIDA_COOKIE_B64 || '').trim();
+  const envAuthEnabled = isInjectedAuthMode(env);
+  if (!encodedCookie) {
+    if (envAuthEnabled) {
+      setLastEnvAuthError(
+        'not_logged_in',
+        'env_cookie_missing',
+        'OPENYIDA_COOKIE_B64 is required when YIDA_AUTH_ENABLED=true'
+      );
+    }
+    return null;
+  }
+
+  const baseUrl = normalizeEnvBaseUrl(env.OPENYIDA_BASE_URL, defaultBaseUrl);
+  if (!baseUrl) {
+    setLastEnvAuthError(
+      'not_logged_in',
+      'base_url_invalid',
+      'OPENYIDA_BASE_URL is invalid'
+    );
+    return null;
+  }
+
+  const rawCookieHeader = decodeCookieHeaderFromBase64(encodedCookie);
+  if (!rawCookieHeader) {
+    setLastEnvAuthError(
+      'not_logged_in',
+      'env_cookie_decode_failed',
+      'OPENYIDA_COOKIE_B64 is not a valid base64 encoded Cookie header'
+    );
+    return null;
+  }
+
+  const cookies = parseCookieHeader(rawCookieHeader, { baseUrl });
+  if (cookies.length === 0) {
+    setLastEnvAuthError(
+      'not_logged_in',
+      'env_cookie_parse_failed',
+      'OPENYIDA_COOKIE_B64 decoded to an empty or invalid Cookie header'
+    );
+    return null;
+  }
+
+  const { csrfToken, corpId, userId } = extractInfoFromCookies(cookies);
+  if (!csrfToken) {
+    setLastEnvAuthError(
+      'csrf_missing',
+      'csrf_token_missing',
+      'Env Cookie header does not contain tianshu_csrf_token'
+    );
+    return null;
+  }
+
+  return {
+    cookies,
+    csrf_token: csrfToken,
+    corp_id: corpId,
+    user_id: userId,
+    base_url: baseUrl,
+    auth_source: 'env',
+    auth_mode: 'env',
+  };
+}
+
 // ── 登录态缓存读取 ────────────────────────────────────
 
 /**
@@ -368,6 +522,14 @@ function loadCookieData(projectRoot, defaultBaseUrl) {
   const root = projectRoot || findProjectRoot();
   const fallbackBaseUrl = defaultBaseUrl || 'https://www.aliwork.com';
 
+  const envCookieData = loadEnvCookieData(fallbackBaseUrl);
+  if (envCookieData) {
+    return envCookieData;
+  }
+  if (lastEnvAuthError && isEnvAuthMode()) {
+    return null;
+  }
+
   // 尝试迁移旧版 cookies.json（仅在首次使用多环境功能时执行一次）
   const { migrateOldCookieFile, getCookieFilePath } = require('./env-manager');
   migrateOldCookieFile(root);
@@ -428,21 +590,22 @@ function loadCookieData(projectRoot, defaultBaseUrl) {
  * @returns {object} loginResult
  */
 function triggerLogin(options = {}) {
-  if (isInjectedAuthMode()) {
+  if (isEnvAuthMode()) {
     const cookieData = loadCookieData();
     if (cookieData && cookieData.cookies && cookieData.cookies.length > 0 && cookieData.csrf_token) {
       return cookieData;
     }
-    const reason = cookieData && cookieData.cookies
-      ? 'csrf_token_missing'
-      : 'cookie_cache_missing';
+    const envAuthError = getLastEnvAuthError();
+    const reason = envAuthError
+      ? envAuthError.failure_reason
+      : (cookieData && cookieData.cookies ? 'csrf_token_missing' : 'env_cookie_missing');
     const { CliError } = require('./cli-error');
     throw new CliError(
-      `not_logged_in: injected cookie is unavailable (${reason}). Refresh the host page so it can inject a fresh Yida cookie cache.`,
+      `not_logged_in: env cookie is unavailable (${reason}). Refresh the host page so it can inject a fresh Yida cookie.`,
       {
         code: 'INJECTED_AUTH_REQUIRED',
         details: {
-          authMode: 'injected',
+          authMode: 'env',
           failure_reason: reason,
         },
       }
@@ -499,10 +662,16 @@ function refreshCsrfToken() {
  * @returns {boolean}
  */
 function isLoginExpired(responseJson) {
+  if (!responseJson) {return false;}
+  const status = String(responseJson.status || '').toLowerCase();
+  const errorCode = String(responseJson.errorCode || responseJson.code || '').toLowerCase();
+  const errorMsg = String(responseJson.errorMsg || responseJson.message || '').toLowerCase();
+  if (status === 'not_logged_in' || errorCode === 'not_logged_in' || errorMsg.includes('not_logged_in')) {
+    return true;
+  }
   return (
-    responseJson &&
     responseJson.success === false &&
-    (responseJson.errorCode === '307' || responseJson.errorCode === '302')
+    ['307', '302', '401', '403'].includes(errorCode)
   );
 }
 
@@ -523,6 +692,10 @@ function isHttpRedirectStatus(statusCode) {
   return [301, 302, 303, 307, 308].includes(Number(statusCode));
 }
 
+function isHttpAuthStatus(statusCode) {
+  return [401, 403].includes(Number(statusCode));
+}
+
 // ── base_url 解析 ─────────────────────────────────────
 
 /**
@@ -612,7 +785,7 @@ function httpPost(baseUrl, requestPath, postData, cookies, optionsOverride = {})
         if (!optionsOverride.silentStatus) {
           warn(t('common.http_status', res.statusCode));
         }
-        if (isHttpRedirectStatus(res.statusCode)) {
+        if (isHttpRedirectStatus(res.statusCode) || isHttpAuthStatus(res.statusCode)) {
           resolve({
             __needLogin: true,
             __httpStatus: res.statusCode,
@@ -694,7 +867,7 @@ function httpPostJson(baseUrl, requestPath, payload, cookies, optionsOverride =
         if (!optionsOverride.silentStatus) {
           warn(t('common.http_status', res.statusCode));
         }
-        if (isHttpRedirectStatus(res.statusCode)) {
+        if (isHttpRedirectStatus(res.statusCode) || isHttpAuthStatus(res.statusCode)) {
           resolve({
             __needLogin: true,
             __httpStatus: res.statusCode,
@@ -784,7 +957,7 @@ function httpGet(baseUrl, requestPath, queryParams, cookies, optionsOverride = {
         if (!optionsOverride.silentStatus) {
           warn(t('common.http_status', res.statusCode));
         }
-        if (isHttpRedirectStatus(res.statusCode)) {
+        if (isHttpRedirectStatus(res.statusCode) || isHttpAuthStatus(res.statusCode)) {
           resolve({
             __needLogin: true,
             __httpStatus: res.statusCode,
@@ -830,14 +1003,16 @@ function httpGet(baseUrl, requestPath, queryParams, cookies, optionsOverride = {
  */
 async function requestWithAutoLogin(requestFn, authRef) {
   let result = await requestFn(authRef);
+  const usingEnvAuth = isEnvAuthMode()
+    || !!(authRef && authRef.cookieData && authRef.cookieData.auth_source === 'env');
 
   if (result && result.__csrfExpired) {
-    if (isInjectedAuthMode()) {
+    if (usingEnvAuth) {
       return {
         success: false,
         __needLogin: true,
         errorCode: 'INJECTED_AUTH_REQUIRED',
-        errorMsg: 'not_logged_in: injected cookie csrf_token expired. Refresh the host page so it can inject a fresh Yida cookie cache.',
+        errorMsg: 'not_logged_in: env cookie csrf_token expired. Refresh the host page so it can inject a fresh Yida cookie.',
       };
     }
     const refreshedData = refreshCsrfToken();
@@ -854,12 +1029,12 @@ async function requestWithAutoLogin(requestFn, authRef) {
   }
 
   if (result && result.__needLogin) {
-    if (isInjectedAuthMode()) {
+    if (usingEnvAuth) {
       return {
         success: false,
         __needLogin: true,
         errorCode: 'INJECTED_AUTH_REQUIRED',
-        errorMsg: 'not_logged_in: injected cookie missing or expired. Refresh the host page so it can inject a fresh Yida cookie cache.',
+        errorMsg: 'not_logged_in: env cookie missing or expired. Refresh the host page so it can inject a fresh Yida cookie.',
       };
     }
     const newCookieData = triggerLogin({ force: true });
@@ -886,6 +1061,9 @@ module.exports = {
   hasDesktopEnvironment,
   findProjectRoot,
   extractInfoFromCookies,
+  parseCookieHeader,
+  loadEnvCookieData,
+  getLastEnvAuthError,
   loadCookieData,
   triggerLogin,
   refreshCsrfToken,
@@ -901,4 +1079,6 @@ module.exports = {
   getNodeExecutable,
   resolveWukongWorkspaceRoot,
   isInjectedAuthMode,
+  hasEnvCookieAuth,
+  isEnvAuthMode,
 };

package/lib/samples/yida-custom-page/custom-page-template.js

@@ -165,7 +165,7 @@ export function injectTailwindSource() {
     '@import "tailwindcss/theme";',
     '@import "tailwindcss/preflight";',
     '@import "tailwindcss/utilities";',
-    '@theme { --color-brand: #2F6FED; }',
+    '@theme { --color-brand: var(--color-brand1-6, #2F6FED); }',
   ].join('\n');
   document.head.appendChild(style);
 }
@@ -183,11 +183,11 @@ export function injectTailwindFallback() {
   style.innerHTML = [
     '.oyd-btn,.oyd-select-trigger,.oyd-select-option{appearance:none;-webkit-appearance:none;font-family:inherit;}',
     '.oyd-btn{height:36px;border-radius:6px;border:1px solid #D0D5DD;background:#fff;padding:0 12px;font-size:14px;cursor:pointer;}',
-    '.oyd-btn-primary{background:#2F6FED;border-color:#2F6FED;color:#fff;}',
+    '.oyd-btn-primary{background:var(--color-brand1-6,#2F6FED);border-color:var(--color-brand1-6,#2F6FED);color:#fff;}',
     '.oyd-select-trigger{height:38px;border-radius:6px;border:1px solid #D0D5DD;background:#fff;padding:0 12px;font-size:14px;text-align:left;box-shadow:0 6px 14px rgba(15,23,42,.06);}',
     '.oyd-select-menu{position:absolute;z-index:30;margin-top:6px;width:100%;padding:6px;border:1px solid #E4E7EC;border-radius:10px;background:#fff;box-shadow:0 16px 32px rgba(16,24,40,.14);}',
     '.oyd-select-option{width:100%;min-height:36px;border:0;border-radius:8px;background:#fff;padding:0 10px;text-align:left;font-size:14px;cursor:pointer;}',
-    '.oyd-select-option-active{background:#EFF6FF;color:#1D4ED8;font-weight:600;}',
+    '.oyd-select-option-active{background:var(--color-brand1-1,#EFF6FF);color:var(--color-brand1-6,#1D4ED8);font-weight:600;}',
   ].join('');
   document.head.appendChild(style);
 }
@@ -351,7 +351,7 @@ var styles = {
     marginBottom: '16px'
   },
   button: {
-    backgroundColor: '#1677FF',
+    backgroundColor: 'var(--color-brand1-6, #1677FF)',
     color: '#fff',
     border: 'none',
     borderRadius: '4px',
@@ -424,10 +424,10 @@ var styles = {
     minHeight: 36,
     padding: '8px 12px',
     textAlign: 'left',
-    background: '#EFF6FF',
+    background: 'var(--color-brand1-1, #EFF6FF)',
     border: 0,
     borderRadius: 8,
-    color: '#1D4ED8',
+    color: 'var(--color-brand1-6, #1D4ED8)',
     appearance: 'none',
     WebkitAppearance: 'none',
     fontFamily: 'inherit',

package/lib/samples/yida-custom-page/design-tokens.js

@@ -2,23 +2,25 @@
 
 // ── 色彩系统 ─────────────────────────────────────────
 var colors = {
-  // 主色（使用宜搭平台 CSS 变量）
-  primary:      'var(--color-brand1-6)',
-  primaryHover: 'var(--color-brand1-1)',
-  hover:        'var(--color-brand1-9)',
-  active:       'var(--color-brand1-9)',
-  disabled:     'var(--color-brand1-8)',
-  primaryLight: 'var(--color-brand1-2)',
-  
-  // 语义色
+  // 主色（跟随宜搭平台品牌变量，自动适配 App 主题；色阶 1 最浅、6 主色、10 最深）
+  primary:       'var(--color-brand1-6)',  // 主色：主按钮、链接、选中态高亮
+  primaryHover:  'var(--color-brand1-5)',  // 主色 hover：填充按钮/链接 hover，比主色亮一档
+  primaryActive: 'var(--color-brand1-7)',  // 主色按下：填充按钮 active，比主色深一档
+  hover:         'var(--color-brand1-1)',  // 通用浅色 hover 底：列表行、菜单项 hover
+  active:        'var(--color-brand1-2)',  // 通用浅色激活/按下底
+  disabled:      'var(--color-brand1-3)',  // 禁用态：浅、去饱和
+  primaryLight:  'var(--color-brand1-2)',  // 主色浅背景：选中行底、标签高亮底
+
+  // 语义色（固定，不随主题变——保证成功/警告/错误语义稳定）
   success:        '#52C41A',
   successLight:   '#F6FFED',
   warning:        '#FAAD14',
   warningLight:   '#FFFBE6',
   error:          '#FF4D4F',
   errorLight:     '#FFF2F0',
-  info:           '#1677FF',
-  infoLight:      '#E6F4FF',
+  // info = 品牌信息色，跟随主题（不再固定蓝）
+  info:           'var(--color-brand1-6)',
+  infoLight:      'var(--color-brand1-1)',
   
   // 中性色
   text:           '#1D2129',
@@ -168,7 +170,7 @@ var styles = {
       success: { color: '#52C41A', bg: '#F6FFED', border: '#B7EB8F' },
       warning: { color: '#FAAD14', bg: '#FFFBE6', border: '#FFE58F' },
       error:   { color: '#FF4D4F', bg: '#FFF2F0', border: '#FFCCC7' },
-      info:    { color: '#1677FF', bg: '#E6F4FF', border: '#91CAFF' },
+      info:    { color: 'var(--color-brand1-6)', bg: 'var(--color-brand1-1)', border: 'var(--color-brand1-3)' },
       default: { color: '#4E5969', bg: '#F2F3F5', border: '#E5E6EB' },
     };
     var c = colorMap[type] || colorMap.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.7.7",
+  "version": "2026.7.9",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/scripts/e2e-real/skill-coverage.js

@@ -15,6 +15,8 @@ const SKILL_COVERAGE = {
   'yida-app-permission': { level: 'offline-unit', tests: ['tests/app-permission.test.js'], reason: 'app admin mutations affect real application access; shared real E2E only validates safe read paths' },
   'yida-basic-info': { level: 'offline-unit', tests: ['tests/basic-info.test.js'], reason: 'basic-info reads org admin metadata and can update domains; unit coverage avoids mutating shared real org settings' },
   'yida-business-rule': { level: 'opt-in', reason: 'business association rules mutate form event configuration; validate in a dedicated real-form/UI stage before adding to deterministic shared E2E' },
+  'yida-canvas-custom-page': { level: 'offline-unit', tests: ['skill metadata and packaging validation'], reason: 'Code Canvas authoring skill has no dedicated CLI command; runtimeCode/importedModules are produced by the platform compile service and a YidaCodeCanvas schema cannot be published via openyida, so shared real E2E validates skill metadata and routing rather than mutating a real page' },
+  'yida-canvas-upgrade': { level: 'offline-unit', tests: ['skill metadata and packaging validation'], reason: 'native-to-Code-Canvas migration skill emits source/report artifacts but has no CLI publish path for YidaCodeCanvas; validated via skill metadata and routing until a Canvas publish stage exists' },
   'yida-chart': { level: 'real-e2e', stages: ['report', 'dashboard'], tests: ['report chart config generation'] },
   'yida-connector': { level: 'offline', stages: ['connector-local'], commands: ['connector gen-template', 'connector parse-api'] },
   'yida-connector-safe-actions': { level: 'offline', stages: ['connector-local'], commands: ['connector parse-api', 'connector test --action <operationId>'], reason: 'skill documents conservative HTTP connector action generation and repair workflow; shared E2E should validate local parsing without mutating tenant connectors' },
@@ -43,8 +45,10 @@ const SKILL_COVERAGE = {
   'yida-login': { level: 'real-e2e', stages: ['auth'], commands: ['login --check-only --json'] },
   'yida-logout': { level: 'offline-unit', tests: ['login/auth unit coverage'], reason: 'real logout would destroy the shared E2E session' },
   'yida-nav-group': { level: 'offline-unit', tests: ['tests/nav-group.test.js'], reason: 'navigation grouping mutates app sidebar order; unit coverage validates payloads and tree operations until a dedicated cleanup-safe nav stage exists' },
+  'yida-nav-shell': { level: 'offline-unit', tests: ['skill metadata and packaging validation'], reason: 'page-internal JSX navigation shell is an authoring pattern, not a standalone CLI command; validate skill packaging and use custom-page/page-uiux generation fixtures for runtime page coverage' },
   'yida-openyida-publish-guard': { level: 'offline-unit', tests: ['skill metadata and packaging validation'], reason: 'publish guard is an agent workflow safety rule for comparing live schema before publish; real page publish behavior remains covered by yida-publish-page E2E stages' },
   'yida-page-config': { level: 'real-e2e', stages: ['share'], commands: ['get-page-config', 'verify-short-url', 'save-share-config'] },
+  'yida-page-uiux': { level: 'offline-unit', tests: ['skill metadata and packaging validation', 'routing eval scenarios'], reason: 'visual direction skill emits a decision block before JSX authoring and should be validated through routing/packaging rather than mutating Yida resources' },
   'yida-ppt': { level: 'deprecated', reason: 'skill is deprecated in favor of yida-ppt-slider' },
   'yida-ppt-slider': { level: 'offline-unit', reason: 'presentation-style custom page skill should be validated by page generation/check-page fixtures' },
   'yida-process-rule': { level: 'opt-in-real-e2e', stages: ['process'], commands: ['configure-process'], reason: 'process stage publishes workflow rules on the disposable E2E form and is excluded from default full E2E unless explicitly requested' },

package/scripts/validate-ci.sh

@@ -3,6 +3,12 @@ set -euo pipefail
 
 cd "$(dirname "$0")/.."
 
+if [ -z "${npm_config_cache:-}" ]; then
+  npm_config_cache="$(mktemp -d "${TMPDIR:-/tmp}/openyida-npm-cache-XXXXXX")"
+  export npm_config_cache
+  trap 'rm -rf "$npm_config_cache"' EXIT
+fi
+
 echo "=== Step 1: Install dependencies ==="
 npm ci --ignore-scripts
 

package/scripts/validate-package-size.js

@@ -3,10 +3,13 @@
 'use strict';
 
 const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 
 const MAX_TARBALL_BYTES = 1536 * 1024;
 const MAX_UNPACKED_BYTES = 4608 * 1024;
-const MAX_ENTRY_COUNT = 330;
+const MAX_ENTRY_COUNT = 350;
 const MAX_SINGLE_FILE_BYTES = 512 * 1024;
 
 function formatBytes(bytes) {
@@ -26,10 +29,18 @@ function fail(message) {
 }
 
 function runNpmPackDryRun() {
+  const shouldCreateCache = !process.env.OPENYIDA_NPM_CACHE;
+  const npmCache = shouldCreateCache
+    ? fs.mkdtempSync(path.join(os.tmpdir(), 'openyida-npm-cache-'))
+    : process.env.OPENYIDA_NPM_CACHE;
   const result = spawnSync('npm', ['pack', '--dry-run', '--json'], {
     encoding: 'utf8',
+    env: { ...process.env, npm_config_cache: npmCache, NPM_CONFIG_CACHE: npmCache },
     stdio: 'pipe',
   });
+  if (shouldCreateCache) {
+    fs.rmSync(npmCache, { recursive: true, force: true });
+  }
 
   if (result.status !== 0) {
     process.stderr.write(result.stderr || result.stdout);

package/yida-skills/SKILL.md

@@ -54,7 +54,8 @@ description: >
               ↓
 [Step 4]（按需）创建/更新表单 → openyida create-form → 获得 formUuid（表单）
               ↓
-[Step 5] 编写自定义页面代码 → yida-custom-page 规范 → pages/src/<项目名>.oyd.jsx
+[Step 5] 编写自定义页面代码 → 先按「自定义页面选路」定链路（**默认 Code Canvas yida-canvas-custom-page**，含开放 API 读数据页；仅强依赖原生实例数据桥的页回退 native yida-custom-page）
+              ↓  （首次生成面向用户的页必做：先用 yida-page-uiux 产出「视觉方向决策块」，避免统一灰白圆角的 AI 味模板脸，再交所选链路落地）
               ↓
 [Step 6] 发布页面 → openyida publish
               ↓
@@ -69,6 +70,8 @@ description: >
 [Step 10] 输出访问链接，用系统浏览器打开
 ```
 
+> **Step 5 先定视觉方向（首次生成面向用户页必做）**：写 JSX 前先用 `yida-page-uiux` 锁定视觉方向（页面类型判定 → 意图解码 → 差异化决策 → 去 AI 味自检），产出「视觉方向决策块」，再交所选链路（默认 `yida-canvas-custom-page`，回退 `yida-custom-page`）按 `design-system.md` token 落地。跳过此步会直接套用统一灰白圆角模板，生成有 AI 味的平庸页面。详见 `skills/yida-page-uiux/SKILL.md`。
+>
 > **Step 7 导航整理（含看板/多页面时必做）**：首次生成完整应用后，必须基于业务信息架构重排导航，不能保留创建时的默认顺序。默认原则：面向决策者的**总览/驾驶舱看板作为应用门面靠前**，数据录入/明细表单在其后；同级多个专题看板按业务优先级排，不要把所有页面无脑堆最前。详见 `skills/yida-nav-group/SKILL.md`。
 >
 > **Step 8 灌入示例数据（有表单时默认执行）**：新建应用的表单默认无数据，看板会空。导航整理完成后，默认向核心表单灌入 **2-3 条**覆盖关键维度（如不同活动/渠道/日期）的示例记录，让看板首屏可展示真实聚合效果。`DateField`/`CascadeDateField` 必须用 13 位毫秒时间戳；灌后执行 `openyida data query` 抽查至少 1 条，确认字段值非空。详见 `skills/yida-data-management/SKILL.md`。
@@ -78,12 +81,19 @@ description: >
 ## 技能路由（单一 / 增量任务）
 
 > 选定 **1 个**最匹配的项执行。表**按业务域分组**，每组内既可能是 skill 也可能是 CLI：
-> - 行名为 `yida-xxx` / `sls-log-workbench` / `large-file-write` 的是 **skill** → 先读它的 `skills/<技能名>/SKILL.md` 再执行；
+> - 行名为 `yida-xxx` / `sls-log-workbench` / `large-file-write` 的是 **skill** → 先读对应子技能文档再执行；
 > - 行名为 `openyida xxx` 并标 **`CLI`** 的**无 SKILL.md** → 识别到诉求直接执行命令、**不要当 skill 去 read**。
 >
 > 按分组 +「何时选择」内联区别对号入座即可。
 
-> ⚠️ **同类易错先分清**：改字段结构→`create-form-page`｜只读 Schema→`get-schema`｜改数据记录→`data-management`｜详情页美化→`form-detail`；字段实时校验→`formula`｜提交后编排→`integration`｜跨表高级函数→`business-rule`；从零建流程→`create-process`｜改已有流程→`process-rule`；权限按层级：组织→`corp-manager`／应用→`app-permission`／表单→`form-permission`／页面分享→`page-config`。
+> ⚠️ **同类易错先分清**：改字段结构→`create-form-page`｜只读 Schema→`get-schema`｜改数据记录→`data-management`｜详情页美化→`form-detail`；自定义页视觉方向/去AI味→`page-uiux`(定方向)｜token/组件实现→`custom-page`(design-system)；加导航先分清→平台左侧菜单分组/排序→`nav-group`｜页面隐藏应用导航后页面内自绘导航壳→`nav-shell`（必须隐藏原导航，并让导航项 URL 带 `isRenderNav=false` 等参数）；字段实时校验→`formula`｜提交后编排→`integration`｜跨表高级函数→`business-rule`；从零建流程→`create-process`｜改已有流程→`process-rule`；权限按层级：组织→`corp-manager`／应用→`app-permission`／表单→`form-permission`／页面分享→`page-config`；**自定义页面选路见下方专表**。
+
+> 🧭 **自定义页面选路（默认 Code Canvas，按顺序命中即停）**：
+> 1. **默认 → Code Canvas** `yida-canvas-custom-page`：现代 React 交互 / hooks 状态 / 可视化 / AI 生成 / 需崩溃隔离，**以及只需通过开放 API（HTTP）读取宜搭数据的页面**（Canvas 自写 fetch 即可拿数据）；
+> 2. 仅当页面强依赖**原生实例数据桥**——表单内字段双向绑定 `this.$(fieldId)`、`this.utils.yida.*`、`dataSourceMap`、提交流程 / 设计器数据源深度耦合，且用开放 API 重写代价过高 → 回退 **native** `yida-custom-page`；
+> 3. 已有普通 `.oyd.jsx` 要迁到 Canvas → `yida-canvas-upgrade`。
+>
+> 依据（源码核实）：Canvas 代码在宿主页真实 `window` 中 `new Function` 执行，但物料只透传 `code/runtimeCode/importedModules/pageType`，**无 `this` 上下文、无 `dataSourceMap`**，`this.utils.yida.*` 不可用；宿主 window 全局（`__yida_plugin_runtime__` 插件系统、`__VcDeepYidaUtils__`）均非表单数据桥，也无 `window.Deep` 字段组件。Canvas 读宜搭数据 = 在 `YidaComp` 内自写 HTTP 调开放 API。只有需要免费 `this` 实例桥的页才留 native。
 
 | 分组 | 技能 | 何时选择（关键区别已内联） |
 |------|------|--------------------------|
@@ -94,7 +104,11 @@ description: >
 | **页面与表单** | `yida-create-page` | 创建空白自定义页面拿 formUuid，后续写 JSX |
 | | `yida-create-form-page` | 创建/更新表单、增删改**字段结构**（普通表单，无审批） |
 | | `yida-create-process` | 从零建**带审批**流程表单（表单还不存在，一步到位） |
-| | `yida-custom-page` | 编写自定义页面 JSX 逻辑与 UI |
+| | `yida-page-uiux` | 写自定义页面 UI 前先定视觉方向、去 AI 味（工作台/看板/列表/详情/官网落地页；产出决策块，不写代码；canvas / native 两链路通用） |
+| | `yida-canvas-custom-page` | **自定义页面默认链路**：现代 React 交互 / hooks / 可视化 / AI 页，含只需开放 API HTTP 读数据的页（Code Canvas，`runtimeCode` + `importedModules`，真 React18 + 崩溃隔离） |
+| | `yida-custom-page` | 回退项：仅当强依赖原生实例数据桥（`this.$(fieldId)` 双向绑定 / `this.utils.yida.*` / `dataSourceMap` / 提交流程深度耦合）时才用（native `.oyd.jsx` 链路） |
+| | `yida-canvas-upgrade` | 将已有普通 `.oyd.jsx` / `Jsx` 页面升级迁移到 Code Canvas / `YidaCodeCanvas` 链路 |
+| | `yida-nav-shell` | 自定义页**隐藏应用导航**（`isRenderNav=false`，沉浸/门户/大屏/分享）后，页面内用 JSX 自绘侧边/顶部/浮动/标签导航壳；发布后要配置隐藏原导航，跨页导航项要拼完整 URL 并合并 `isRenderNav=false` / `corpid` / 业务参数（**区别** `yida-nav-group` 平台左侧菜单分组：那是真实导航树，本项是页面内自建导航） |
 | | `yida-publish-page` | JSX 写完后编译并发布 |
 | | `yida-openyida-publish-guard` | 发布已有自定义页面前检查线上设计器状态，避免本地旧源码覆盖用户在线改动 |
 | | `yida-table-form` | Excel 式表格批量录入提交 |
@@ -119,7 +133,7 @@ description: >
 | | `yida-app-permission` | **单应用级**权限（应用管理员/开发成员） |
 | | `yida-form-permission` | **单表单级**权限（权限组/数据范围） |
 | | `yida-page-config` | **页面级**：公开访问 / 组织内分享 |
-| **应用配置与平台** | `yida-nav-group` | 应用左侧菜单分组/排序 |
+| **应用配置与平台** | `yida-nav-group` | 应用**左侧菜单**分组/排序（真实导航树；页面内自绘导航壳见 `yida-nav-shell`） |
 | | `yida-form-detail` | 只注 **CSS** 美化详情页，不改字段 |
 | | `yida-density` | 列表/表格信息密度选择 |
 | | `yida-i18n` | 应用多语言 / 国际化 |
@@ -143,6 +157,7 @@ description: >
 1. **先读后执行**：执行任何子技能前，必须先读取其 SKILL.md，不凭记忆猜参数格式。
 2. **corpId 一致性检查**：创建页面前对比 prd 与 `.cache/cookies.json` 的 corpId，不一致必须询问用户（重新登录 or 当前组织新建）。
 3. **发布前本地校验**：自定义页面发布前跑 `openyida check-page` + `openyida compile`；JSON 配置写盘后先解析校验，再调用平台命令。
+4. **命令输入文件禁止 shell 写入**：当 OpenYida 命令需要 JSON/YAML/CSV/config/script 文件参数时，先使用当前 agent 运行时提供的结构化文件写入工具（如 create_file / Write / file edit tool）创建文件，再把路径传给命令；禁止用 shell heredoc、`cat`/`echo`/`printf`/`tee` 加输出重定向，或把命令 stdout 重定向成业务文件。
 
 ### 重要规则（IMPORTANT，影响质量/性能/可维护性）
 
@@ -153,7 +168,7 @@ description: >
 5. **数据性能优先**：统计聚合用 `yida-report` 服务端聚合，不在前端拉全量后自行聚合。
 6. **避免无效重试**：失败先查登录态/组织/参数/字段 ID，无修改不连续重试超 1 次。
 7. **配置分两处存**：业务语义 → `prd/<项目名>.md`；Schema ID → `.cache/<项目名>-schema.json`（prd 不记 ID）。
-8. **临时文件入 `.cache/`**：cookies/schema/配置/脚本一律放 `.cache/openyida/`，不写仓库根目录。
+8. **临时文件入 project `.cache/`**：OpenYida 业务中间文件写入 `<projectRoot>/.cache/openyida/<项目名或任务名>/`；Schema ID 映射仍写 `<projectRoot>/.cache/<项目名>-schema.json`。从 workspace 根执行命令时使用 `project/.cache/...`，从 project 工作目录内执行时使用 `.cache/...`；不要写仓库根目录或系统临时目录。
 9. **报表美化先问方案**：用户说"优化/美化报表"时先问选原生报表(`yida-report`)还是 ECharts(`yida-chart`)。
 10. **按 schema 证据选技能**：先看 `formType`、组件树、`dataSource.online`；`receipt/process/report` 分别落到表单/流程/报表技能。
 11. **官方示例范式优先**：蒸馏官方示例时先理解脱敏 schema 承载方式，不凭截图/标题/视觉判断。