openyida 2026.8.16-beta.0 → 2026.8.17

package/README.md

@@ -68,9 +68,9 @@ OpenYida returns a compact machine-readable summary with the version, login stat
 openyida login
 ```
 
-OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the user auth store when available. If the user auth store is not writable, OpenYida explicitly falls back to the current project cache and reports that narrower persistence scope.
+OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the current project cache.
 
-When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and auth profile. For example:
+When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and token session file. For example, Alibaba intranet Yida uses `auth-token-alibaba.json`:
 
 ```bash
 openyida login https://yida-group.alibaba-inc.com/
@@ -185,16 +185,14 @@ Form definitions support 19 business field types plus verified presentation/layo
 
 ```bash
 openyida create-page APP_XXX "Dashboard" --mode dashboard
-openyida check-page pages/src/home.canvas.jsx --json
-openyida compile pages/src/home.canvas.jsx
 openyida publish pages/src/home.canvas.jsx APP_XXX FORM_XXX
 ```
 
-Custom page source is authored directly from PRD and design guidance. Code Canvas is the default output (`.canvas.jsx`); use `.oyd.jsx` only when the page must use the 普通自定义页面 JSX/Jsx 组件链路.
+Custom page source is authored directly from PRD and design guidance. Custom page development uses `yida-canvas-custom-page` and `.canvas.jsx`.
 
-For member, department, attachment, and image upload components, choose the page chain first. Code Canvas pages should follow `yida-canvas-custom-page/references/native-components-bridge.md` for feature detection, fallback, and value normalization. 普通自定义页面 JSX/Jsx pages should use `.oyd.jsx`, read `yida-custom-page/references/component-jsx-guide.md`, and read `attachment-upload-guide.md` when upload fields are involved.
+For member, department, attachment, and image upload components, `.canvas.jsx` pages should follow `yida-canvas-custom-page/references/native-components-bridge.md` for feature detection, fallback, and value normalization.
 
-For the current AI custom page native-component support matrix, see [Yida native components supported by AI custom pages](https://demo.aliwork.com/o/openyida/sample/canvas-native-components).
+For the current custom page native-component support matrix, see [Yida native components supported by custom pages](https://demo.aliwork.com/o/openyida/sample/canvas-native-components).
 
 ### Workflow, Data, and Permissions
 
@@ -395,7 +393,6 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida list-forms <appType> [--keyword <text>]` | List forms/pages in an app |
 | `openyida aggregate-table <list\|create-empty\|inspect\|preview\|save\|publish\|status> <appType> ...` | Manage aggregate tables (virtualView) |
 | `openyida get-schema <appType> <formUuid\|--all> [--summary-json\|--field-map-json]` | Get one form Schema or all form Schemas |
-| `openyida check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]` | Check PRD page/resource count risk |
 | `openyida er <appType> [--format mermaid\|json] [--output file] [--include-system] [--include-pages]` | Export app entity relationship diagram |
 | `openyida create-page <appType> "<name>" [--mode dashboard] [--hide-nav] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a custom display page |
 | `openyida build-page <sourceFile> [--output file\|--write]` | Build Yida-compatible page source |

package/bin/yida.js

@@ -30,22 +30,13 @@ function isAgentEnvironment(env) {
     env.CLAUDE_CODE_ENTRYPOINT ||
     env.MULERUN_CHAT_ID ||
     env.MULE_DATA_DIR ||
-    env.MULE_WORKSPACE_DIR ||
     env.OPENCODE ||
     env.OPENCODE_CLIENT ||
     env.QODER_IDE ||
     env.QODER_AGENT ||
     env.QODERCLI_INTEGRATION_MODE ||
-    env.QODER_WORK_INTEGRATION_PRODUCT ||
     env.QWENWORK_INTEGRATION_MODE ||
     env.QWENWORKCN_INTEGRATION_MODE ||
-    env.QWENWORK ||
-    env.QWENWORK_CLIENT ||
-    env.QWENWORK_WORKSPACE_DIR ||
-    env.QWENWORK_SANDBOX_ID ||
-    env.QWENWORK_PREVIEW_URL ||
-    env.QWENWORK_VNC_URL ||
-    (env.AGENT_PLATFORM || '').toLowerCase().includes('qwenwork') ||
     env.CURSOR_TRACE_ID ||
     env.AGENT_WORK_ROOT ||
     env.OPENYIDA_AGENT_MODE ||
@@ -275,12 +266,6 @@ function printLoginResult(result) {
     status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
     auth_mode: 'token',
     auth_source: result.auth_source || result.authSource,
-    auth_store: result.auth_store || result.authStore,
-    auth_profile: result.auth_profile || result.authProfile,
-    persistence_scope: result.persistence_scope || result.persistenceScope,
-    user_auth_store_writable: result.user_auth_store_writable !== undefined
-      ? result.user_auth_store_writable
-      : result.userAuthStoreWritable,
     can_auto_use: result.can_auto_use !== undefined ? !!result.can_auto_use : tokenUsable,
     token_type: result.token_type || 'Bearer',
     access_token: maskSensitiveAuthOutput({ access_token: result.access_token }).access_token,
@@ -291,7 +276,6 @@ function printLoginResult(result) {
     user_name: result.user_name,
     failure_reason: result.failure_reason,
     message: result.message,
-    warning: result.warning,
     raw: tokenUsable ? undefined : result.raw,
   };
   console.log(JSON.stringify(summary));
@@ -428,7 +412,6 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
   const valuePassthroughFlags = new Set([
     '--corp-id',
     '--client-id',
-    '--profile',
     '--user-id',
   ]);
   const targetUrlFlags = new Set([
@@ -540,9 +523,6 @@ function printLoginHelp() {
 function buildTokenLoginOptions(loginArgs) {
   return {
     clientId: getArgValue(loginArgs, '--client-id'),
-    corpId: getArgValue(loginArgs, '--corp-id'),
-    userId: getArgValue(loginArgs, '--user-id'),
-    authProfile: getArgValue(loginArgs, '--profile'),
     quiet: process.env.YIDA_QUIET === '1' || loginArgs.includes('--quiet'),
     noBrowser: loginArgs.includes('--no-browser'),
   };
@@ -646,9 +626,9 @@ async function main() {
       } else {
         assertNoUnsupportedLegacyLoginFlags(rawArgs, loginArgs);
         if (loginArgs.includes('--check-only')) {
-          console.log(JSON.stringify(getAuthStatus(buildTokenLoginOptions(loginArgs)), null, 2));
+          console.log(JSON.stringify(getAuthStatus(), null, 2));
         } else if (isEnvAuthMode()) {
-          printLoginResult(getAuthStatus(buildTokenLoginOptions(loginArgs)));
+          printLoginResult(getAuthStatus());
         } else {
           const { tokenLogin } = require('../lib/auth/token-auth');
           const result = await tokenLogin(buildTokenLoginOptions(loginArgs));
@@ -672,14 +652,14 @@ async function main() {
       if (!subCommand || subCommand === '--help' || subCommand === '-h') {
         printAuthHelp();
       } else if (subCommand === 'status') {
-        console.log(JSON.stringify(getAuthStatus(buildTokenLoginOptions(authArgs)), null, 2));
+        console.log(JSON.stringify(getAuthStatus(), null, 2));
       } else if (subCommand === 'login') {
         if (hasHelpFlag(authArgs)) {
           printLoginHelp();
         } else {
           assertNoUnsupportedLegacyLoginFlags(rawArgs.slice(1), authArgs);
           const result = isEnvAuthMode()
-            ? getAuthStatus(buildTokenLoginOptions(authArgs))
+            ? getAuthStatus()
             : await tokenLogin(buildTokenLoginOptions(authArgs));
           printLoginResult(result);
         }
@@ -754,12 +734,6 @@ async function main() {
       break;
     }
 
-    case 'check-prd-completeness': {
-      const { run } = require('../lib/app/check-prd-completeness');
-      await run(args);
-      break;
-    }
-
     case 'er': {
       const { run } = require('../lib/app/er');
       await run(args);

package/lib/app/publish.js

@@ -53,9 +53,6 @@ const {
 const {
   buildCanvasPageSchemaContent,
 } = require('./services/canvas-page-schema-builder');
-const {
-  verifyPublishedContentMatch,
-} = require('./display-page-readback');
 
 // ── 配置读取 ──────────────────────────────────────────
 const CONFIG = fs.existsSync(path.resolve(findProjectRoot(), 'config.json')) ? JSON.parse(fs.readFileSync(path.resolve(findProjectRoot(), 'config.json'), 'utf-8')) : {};
@@ -648,55 +645,79 @@ async function ensurePublishTargetOrExit(appType, formUuid, authRef, options = {
   return null;
 }
 
-async function runPublishReadbackHealthCheck(appType, formUuid, authRef, schemaContent, publishMode) {
-  const baseResult = {
-    ok: false,
-    mode: 'publish_readback',
-    authMode: 'token',
-    targetReadable: false,
-    schemaParsed: false,
-    displayComponentPresent: false,
-    publishedContentMatched: false,
-  };
+function sendHealthCheckRequest(pageUrl, cookies) {
+  return new Promise((resolve) => {
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(pageUrl);
+    } catch (urlError) {
+      resolve({ ok: false, statusCode: 0, error: urlError.message });
+      return;
+    }
+    const isHttps = parsedUrl.protocol === 'https:';
+    const requestModule = isHttps ? https : http;
+    const cookieHeader = Array.isArray(cookies) ? cookies
+      .filter((cookie) => cookie && cookie.name !== undefined && cookie.value !== undefined)
+      .map((cookie) => `${cookie.name}=${cookie.value}`)
+      .join('; ') : '';
 
-  let readback;
-  try {
-    readback = await fetchExistingSchemaContent(appType, formUuid, authRef);
-  } catch (readbackError) {
-    return {
-      ...baseResult,
-      reason: 'schema_readback_failed',
-      error: readbackError && readbackError.message ? readbackError.message : t('common.unknown_error'),
+    if (!cookieHeader) {
+      resolve({
+        ok: false,
+        skipped: true,
+        reason: 'missing_cookies',
+        statusCode: 0,
+        error: t('common.request_failed'),
+      });
+      return;
+    }
+
+    const requestOptions = {
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (isHttps ? 443 : 80),
+      path: `${parsedUrl.pathname}${parsedUrl.search}`,
+      method: 'GET',
+      headers: {
+        Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+        Cookie: cookieHeader,
+      },
+      timeout: 30000,
     };
-  }
 
-  const match = verifyPublishedContentMatch(readback.schema, schemaContent, publishMode);
-  const resultPayload = {
-    ...baseResult,
-    targetReadable: true,
-    schemaParsed: true,
-    displayComponentPresent: match.displayComponentPresent,
-    publishedContentMatched: match.publishedContentMatched,
-  };
+    let request;
+    try {
+      request = requestModule.request(requestOptions, (response) => {
+        let responseData = '';
+        response.on('data', (chunk) => {
+          if (responseData.length < 2000) {
+            responseData += chunk;
+          }
+        });
+        response.on('end', () => {
+          const statusCode = response.statusCode || 0;
+          resolve({
+            ok: statusCode >= 200 && statusCode < 400,
+            statusCode,
+            snippet: responseData.substring(0, 300).replace(/\s+/g, ' ').trim(),
+          });
+        });
+      });
+    } catch (requestError) {
+      resolve({ ok: false, statusCode: 0, error: requestError.message });
+      return;
+    }
 
-  if (!match.displayComponentPresent) {
-    return {
-      ...resultPayload,
-      reason: 'display_component_missing',
-    };
-  }
+    request.on('timeout', () => {
+      request.destroy();
+      resolve({ ok: false, statusCode: 0, error: t('common.request_timeout') });
+    });
 
-  if (!match.publishedContentMatched) {
-    return {
-      ...resultPayload,
-      reason: 'published_content_mismatch',
-    };
-  }
+    request.on('error', (requestError) => {
+      resolve({ ok: false, statusCode: 0, error: requestError.message });
+    });
 
-  return {
-    ...resultPayload,
-    ok: true,
-  };
+    request.end();
+  });
 }
 
 // ── 主流程 ────────────────────────────────────────────
@@ -727,7 +748,7 @@ async function runMain(argv) {
     process.exit(1);
   }
 
-  // 路由：默认 native；.canvas.jsx / .canvas.tsx 源文件自动走 Code Canvas 链路，
+  // 路由：默认平台 JSX 组件；.canvas.jsx / .canvas.tsx 源文件自动走 YidaCodeCanvas 发布分支，
   // --canvas 作为显式覆盖（用于扩展名不规范但确为 canvas 源码的场景）。
   const isCanvas = canvasFlag || /\.canvas\.(jsx|tsx)$/i.test(sourcePath);
 
@@ -741,7 +762,7 @@ async function runMain(argv) {
   let canvasResult = null;
 
   if (isCanvas) {
-    // Code Canvas 链路：跳过 native 编译/lint，改用本地 Babel 编译
+    // YidaCodeCanvas 发布分支：跳过平台 JSX 组件编译/lint，改用本地 Babel 编译
     // （JSX/TS → runtimeCode + importedModules），无需登录态，可在开浏览器前失败快。
     step(1, t('publish.step_canvas_compile'));
     info(t('publish.canvas_compiling'));
@@ -791,8 +812,10 @@ async function runMain(argv) {
 
   step(2, t('common.step_login', 2));
   const authRef = createAuthRef();
+  let cookies = authRef.cookies;
   let baseUrl = authRef.baseUrl;
   await ensurePublishTargetOrExit(appType, formUuid, authRef, { force });
+  cookies = authRef.cookies;
   baseUrl = authRef.baseUrl;
 
   let schemaContent;
@@ -816,6 +839,7 @@ async function runMain(argv) {
       fail(t('publish.data_source_fetch_failed', dataSourceError.message));
       process.exit(1);
     }
+    cookies = authRef.cookies;
     baseUrl = authRef.baseUrl;
     schemaContent = buildSchemaContent(sourceCode, compiledCode, formUuid, { existingDataSource });
   }
@@ -849,6 +873,7 @@ async function runMain(argv) {
   step(4, t('publish.step_config'));
   info(t('publish.sending_config'));
   const configResponse = await sendUpdateConfigRequestWithAuth(authRef, appType, savedFormUuid, version, 8);
+  cookies = authRef.cookies;
   baseUrl = authRef.baseUrl || baseUrl;
 
   const pageUrl = `${baseUrl}/${appType}/workbench/${savedFormUuid}`;
@@ -858,30 +883,18 @@ async function runMain(argv) {
   if (healthCheck) {
     step(5, t('publish.step_health_check'));
     try {
-      healthCheckResult = await runPublishReadbackHealthCheck(
-        appType,
-        savedFormUuid,
-        authRef,
-        schemaContent,
-        isCanvas ? 'canvas' : 'native'
-      );
+      healthCheckResult = await sendHealthCheckRequest(pageUrl, cookies);
     } catch (healthCheckError) {
       healthCheckResult = {
         ok: false,
-        mode: 'publish_readback',
-        authMode: 'token',
-        targetReadable: false,
-        schemaParsed: false,
-        displayComponentPresent: false,
-        publishedContentMatched: false,
-        reason: 'schema_readback_failed',
+        statusCode: 0,
         error: healthCheckError && healthCheckError.message ? healthCheckError.message : t('common.unknown_error'),
       };
     }
     if (healthCheckResult.ok) {
-      success(t('publish.health_check_ok', healthCheckResult.mode));
+      success(t('publish.health_check_ok', healthCheckResult.statusCode));
     } else {
-      warn(t('publish.health_check_failed', healthCheckResult.reason || '-', healthCheckResult.error || t('common.unknown_error')));
+      warn(t('publish.health_check_failed', healthCheckResult.statusCode || '-', healthCheckResult.error || healthCheckResult.snippet || t('common.unknown_error')));
     }
   }
 
@@ -946,7 +959,7 @@ if (require.main === module) {
   module.exports.buildMissingSourceHints = buildMissingSourceHints;
   module.exports.findDuplicateSourceMismatches = findDuplicateSourceMismatches;
   module.exports.loadPublishSource = loadPublishSource;
-  module.exports.runPublishReadbackHealthCheck = runPublishReadbackHealthCheck;
+  module.exports.sendHealthCheckRequest = sendHealthCheckRequest;
   module.exports.normalizeFormType = normalizeFormType;
   module.exports.findPublishTarget = findPublishTarget;
   module.exports.isCustomPageTarget = isCustomPageTarget;

package/lib/auth/oauth-loopback.js

@@ -290,17 +290,13 @@ function resolveBrowserLauncher(url, platform = process.platform, openMode = 'le
 function isQwenWorkEnvironment(env = process.env) {
   const bundleId = String(env.__CFBundleIdentifier || '').toLowerCase();
   const product = String(env.QODER_WORK_INTEGRATION_PRODUCT || '').toLowerCase();
-  const qoderConfigDir = String(`${env.QODER_CONFIG_DIR || ''} ${env.QODERCN_CONFIG_DIR || ''}`).toLowerCase();
-  const qoderWorkerCwd = String(env.QODER_WORKER_CWD || '').replace(/\\/g, '/').toLowerCase();
+  const qoderConfigDir = String(env.QODER_CONFIG_DIR || env.QODERCN_CONFIG_DIR || '');
   return !!(
     env.QWENWORK_INTEGRATION_MODE ||
     env.QWENWORKCN_INTEGRATION_MODE ||
     product.includes('qwenwork') ||
     product.includes('qwen-work') ||
-    product.includes('qwenworkcn') ||
     qoderConfigDir.includes('.qwenworkcn') ||
-    qoderWorkerCwd.includes('.qwenworkcn/workspace') ||
-    qoderWorkerCwd.includes('/.qwenworkcn/') ||
     bundleId.includes('qwenwork') ||
     bundleId.includes('qwen-work')
   );
@@ -423,13 +419,8 @@ function openBrowser(url, options = {}) {
   return runLegacy();
 }
 
-function callerOwnsLoginBrowser(options = {}) {
-  const env = options.env || process.env;
-  return !!options.noBrowser || env.OPENYIDA_NO_BROWSER === '1';
-}
-
 function launchLoginBrowser(authUrl, options = {}) {
-  if (callerOwnsLoginBrowser(options)) {
+  if (options.noBrowser) {
     return false;
   }
   const openBrowserImpl = options.openBrowser || openBrowser;
@@ -580,11 +571,8 @@ function runDingtalkLoopback(options = {}) {
         scope: options.scope,
         prompt: options.prompt,
       });
-      const callerOwnsBrowser = callerOwnsLoginBrowser(options);
-      if (!options.quiet || callerOwnsBrowser) {
-        process.stderr.write(`Open this URL to login:\n${authUrl}\n`);
-      }
       if (!options.quiet) {
+        process.stderr.write(`Open this URL to login:\n${authUrl}\n`);
         process.stderr.write(`Waiting for browser authorization (timeout: ${Math.ceil(timeoutMs / 1000)} seconds). Stop the task or press Ctrl+C to cancel.\n`);
       }
       launchLoginBrowser(authUrl, options);

package/lib/auth/token-auth.js

@@ -17,7 +17,6 @@ const {
   loadTokenSession,
   maskToken,
   normalizeTokenSession,
-  resolveTokenSession,
   saveBusinessContext,
   saveTokenSession,
 } = require('./token-store');
@@ -304,27 +303,20 @@ async function tokenLogin(options = {}) {
 }
 
 function tokenStatus(options = {}) {
-  const resolution = resolveTokenSession(options);
-  const session = resolution.session;
+  const session = loadTokenSession(options);
   if (!session || (!session.access_token && !session.refresh_token)) {
     const env = options.env || process.env;
     const hostInjected = isHostInjectedTokenMode(env);
     const status = {
       ok: false,
       auth_mode: 'token',
-      auth_source: resolution.auth_source || (hostInjected ? 'env' : undefined),
-      auth_store: resolution.auth_store,
-      auth_profile: resolution.auth_profile,
-      status: resolution.status === 'profile_required' ? 'profile_required' : 'not_logged_in',
+      auth_source: hostInjected ? 'env' : undefined,
+      status: 'not_logged_in',
       can_auto_use: false,
-      failure_reason: hostInjected ? 'env_token_missing' : resolution.status,
-      message: resolution.message || (hostInjected
+      failure_reason: hostInjected ? 'env_token_missing' : undefined,
+      message: hostInjected
         ? 'host-injected token is missing. Ask the host to inject OPENYIDA_ACCESS_TOKEN or OPENYIDA_REFRESH_TOKEN.'
-        : undefined),
-      candidate_count: resolution.candidate_count,
-      user_auth_store_writable: resolution.user_auth_store_writable,
-      persistence_scope: resolution.persistence_scope,
-      warning: resolution.warning,
+        : undefined,
     };
     if (!hostInjected) {
       status.token_file = require('./token-store').getTokenFilePath(options);
@@ -336,11 +328,6 @@ function tokenStatus(options = {}) {
       ok: true,
       auth_mode: 'token',
       auth_source: session.auth_source,
-      auth_store: session.auth_store,
-      auth_profile: session.auth_profile,
-      persistence_scope: session.persistence_scope,
-      user_auth_store_writable: session.user_auth_store_writable,
-      warning: session.warning,
       status: 'refresh_required',
       can_auto_use: true,
       refresh_token: maskToken(session.refresh_token),
@@ -355,11 +342,6 @@ function tokenStatus(options = {}) {
     ok: true,
     auth_mode: 'token',
     auth_source: session.auth_source,
-    auth_store: session.auth_store,
-    auth_profile: session.auth_profile,
-    persistence_scope: session.persistence_scope,
-    user_auth_store_writable: session.user_auth_store_writable,
-    warning: session.warning,
     status: 'ok',
     can_auto_use: true,
     token_type: session.token_type,
@@ -467,10 +449,7 @@ async function tokenLogout(options = {}) {
       // Local logout should still clear the credential cache.
     }
   }
-  clearTokenSession({
-    ...options,
-    authProfile: session && session.auth_profile,
-  });
+  clearTokenSession(options);
   return {
     ok: true,
     auth_mode: 'token',