openyida 2026.8.25-1 → 2026.8.26

package/README.md

@@ -349,6 +349,9 @@ openyida connector list
 openyida integration create APP_XXX FORM_XXX "Sync customer data"
 openyida integration create APP_XXX FORM_XXX "Approval result notify" \
   --events processFinish --approval-actions agree,disagree --receivers 123456
+# Capability probe only; currently fails closed before auth/spec reads/remote writes
+openyida integration update APP_XXX FORM_XXX LPROC_XXX \
+  --spec .cache/openyida/integration/desired-spec.json
 openyida create-report APP_XXX "Sales Dashboard" .cache/openyida/reports/charts.json
 openyida append-chart APP_XXX REPORT_XXX .cache/openyida/reports/chart.json
 ```
@@ -477,6 +480,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida integration create <appType> ... [--spec file.json]` | Create integration automation flow |
+| `openyida integration update <appType> <formUuid> <processCode> --spec <desired-spec.json> [--publish]` | Probe integration update capability (currently blocked without full readback) |
 | `openyida integration list <appType> [--form-uuid <uuid>] [--status y\|n] [--json]` | List integration automation flows |
 | `openyida integration enable <appType> <formUuid> <processCode>` | Enable integration automation flow |
 | `openyida integration disable <appType> <formUuid> <processCode>` | Disable integration automation flow |
@@ -537,7 +541,7 @@ Form field definitions can include `alias` or `componentAlias` to populate Yida
 
 #### Workflow, Reports, and Integrations
 
-`openyida integration create` supports form events (`insert`, `update`, `delete`, `comment`) and approval events (`processFinish`, `activityTask`; aliases: `approval`, `approvalNode`). Approval events require `--approval-actions agree,disagree,terminated`; `activityTask` also requires `--approval-node-ids <nodeId,...>`.
+`openyida integration create` supports form events (`insert`, `update`, `delete`, `comment`) and approval events (`processFinish`, `activityTask`; aliases: `approval`, `approvalNode`). Approval events require `--approval-actions agree,disagree,terminated`; `activityTask` also requires `--approval-node-ids <nodeId,...>`. Passing `--process-code` selects a full graph replacement and now requires explicit `--replace`; it is not a safe update. `integration update` currently performs capability detection only: because full platform `processJson` + `viewJson` readback is unproven, it writes a redacted local probe artifact and returns `PLATFORM_PROBE_REQUIRED` before authentication, spec reading, or remote writes. It does not edit a flow.
 
 ## Agent Skills
 

package/bin/yida.js

@@ -1173,6 +1173,9 @@ async function main() {
       if (subCommand === 'create') {
         const { run: runIntegration } = require('../lib/integration/integration-create');
         await runIntegration(subArgs);
+      } else if (subCommand === 'update') {
+        const { run: runIntegrationUpdate } = require('../lib/integration/integration-update');
+        await runIntegrationUpdate(subArgs);
       } else if (subCommand === 'list') {
         const { runList } = require('../lib/integration/integration-list');
         await runList(subArgs);

package/lib/app/canvas-compile.js

@@ -29,6 +29,7 @@
  */
 
 const Babel = require('@babel/standalone');
+const globals = require('globals');
 const {
   assertNoEmojiInArtifactName,
   assertNoEmojiInText,
@@ -46,6 +47,7 @@ const {
   findFormDetailLinkIssues,
   formatFormDetailLinkMessage,
 } = require('./form-detail-link-guard');
+const { t } = require('../core/i18n');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -132,6 +134,15 @@ const BARE_DEPENDENCY_GLOBALS = Object.freeze({
   },
 });
 
+// 以标准 ECMAScript + Browser 环境定义为完整白名单；Canvas 装配器额外
+// 注入 iframeWindow / parentWindow。Node 专属全局不属于页面运行时，不能放行。
+const CANVAS_RUNTIME_GLOBAL_IDENTIFIERS = new Set([
+  ...Object.keys(globals.builtin),
+  ...Object.keys(globals.browser),
+  'iframeWindow',
+  'parentWindow',
+]);
+
 const LUCIDE_REACT_PACKAGE = 'lucide-react';
 const LUCIDE_DYNAMIC_ICON_ALIAS = 'DynamicIcon';
 const LUCIDE_MODULE_ALIAS = 'LucideReact';
@@ -267,6 +278,159 @@ function assertNoBareDependencyGlobals(source, options = {}) {
   });
 }
 
+function findUnboundIdentifierIssues(source, options = {}) {
+  const issuesByName = new Map();
+  const allowedIdentifiers = new Set(CANVAS_RUNTIME_GLOBAL_IDENTIFIERS);
+  (options.implicitIdentifiers || []).forEach((name) => allowedIdentifiers.add(name));
+
+  const guardPlugin = () => ({
+    name: 'yida-canvas-unbound-identifier-guard',
+    visitor: {
+      ReferencedIdentifier(path) {
+        const name = path.node.name;
+        if (allowedIdentifiers.has(name) || path.scope.hasBinding(name) || issuesByName.has(name)) {
+          return;
+        }
+        issuesByName.set(name, {
+          name,
+          line: path.node.loc && path.node.loc.start ? path.node.loc.start.line : 0,
+          column: path.node.loc && path.node.loc.start ? path.node.loc.start.column : 0,
+        });
+      },
+    },
+  });
+
+  Babel.transform(source, {
+    filename: 'canvas.tsx',
+    presets: [
+      ['typescript', { allExtensions: true, isTSX: true, allowDeclareFields: true }],
+      ['react', { runtime: 'classic' }],
+    ],
+    plugins: [guardPlugin],
+    sourceType: 'module',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+
+  return Array.from(issuesByName.values());
+}
+
+function formatUnboundIdentifierMessage(issues) {
+  const summary = issues
+    .map(issue => `${issue.name} (${issue.line}:${issue.column + 1})`)
+    .join(', ');
+  return t('publish.canvas_unbound_identifiers', summary);
+}
+
+function assertNoUnboundIdentifiers(source, options = {}) {
+  const issues = findUnboundIdentifierIssues(source, options);
+  if (issues.length === 0) {
+    return;
+  }
+  throw new CliError(formatUnboundIdentifierMessage(issues), {
+    code: 'OPENYIDA_CANVAS_UNBOUND_IDENTIFIER',
+    details: {
+      stage: 'canvas_compile',
+      sourcePath: options.sourcePath || '',
+      issues,
+    },
+  });
+}
+
+function findUnavailableCanvasInstanceApiIssues(source) {
+  const issues = [];
+  const seen = new Set();
+
+  function addIssue(path, api) {
+    if (seen.has(api)) {
+      return;
+    }
+    seen.add(api);
+    issues.push({
+      api,
+      line: path.node.loc && path.node.loc.start ? path.node.loc.start.line : 0,
+      column: path.node.loc && path.node.loc.start ? path.node.loc.start.column : 0,
+    });
+  }
+
+  const guardPlugin = ({ types: types }) => ({
+    name: 'yida-canvas-instance-api-guard',
+    visitor: {
+      MemberExpression(path) {
+        const object = path.node.object;
+        const property = path.node.property;
+        const propertyName = path.node.computed && types.isStringLiteral(property)
+          ? property.value
+          : (types.isIdentifier(property) ? property.name : '');
+
+        if (types.isMemberExpression(object)) {
+          const owner = object.object;
+          const ownerProperty = object.property;
+          const ownerPropertyName = object.computed && types.isStringLiteral(ownerProperty)
+            ? ownerProperty.value
+            : (types.isIdentifier(ownerProperty) ? ownerProperty.name : '');
+          if (
+            types.isIdentifier(owner, { name: 'props' }) &&
+            ownerPropertyName === 'utils' &&
+            propertyName === 'getDataList'
+          ) {
+            addIssue(path, 'props.utils.getDataList');
+            return;
+          }
+          if (
+            types.isThisExpression(owner) &&
+            ownerPropertyName === 'utils' &&
+            propertyName === 'yida'
+          ) {
+            addIssue(path, 'this.utils.yida');
+            return;
+          }
+        }
+        if (!types.isThisExpression(object)) {
+          return;
+        }
+        if (propertyName === 'dataSourceMap') {
+          addIssue(path, 'this.dataSourceMap');
+        } else if (propertyName === '$') {
+          addIssue(path, 'this.$');
+        }
+      },
+    },
+  });
+
+  Babel.transform(source, {
+    filename: 'canvas.tsx',
+    presets: [
+      ['typescript', { allExtensions: true, isTSX: true, allowDeclareFields: true }],
+      ['react', { runtime: 'classic' }],
+    ],
+    plugins: [guardPlugin],
+    sourceType: 'module',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+
+  return issues;
+}
+
+function assertNoUnavailableCanvasInstanceApis(source, options = {}) {
+  const issues = findUnavailableCanvasInstanceApiIssues(source);
+  if (issues.length === 0) {
+    return;
+  }
+  const summary = issues.map(issue => issue.api).join(', ');
+  throw new CliError(t('publish.canvas_instance_api_unavailable', summary), {
+    code: 'OPENYIDA_CANVAS_INSTANCE_API_UNAVAILABLE',
+    details: {
+      stage: 'canvas_compile',
+      sourcePath: options.sourcePath || '',
+      issues,
+    },
+  });
+}
+
 /**
  * 从源码里正则抽取裸包名（过滤相对/绝对路径），去重排序。
  * 对齐画布运行时的依赖抽取行为。
@@ -617,6 +781,7 @@ function compileCanvasLocal(source, options = {}) {
       },
     });
   }
+  assertNoUnavailableCanvasInstanceApis(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
 
@@ -643,6 +808,10 @@ function compileCanvasLocal(source, options = {}) {
   // 'react' 进入依赖清单（运行时据此注入 React UMD）。
   const usesJsxRuntime = /\bReact\.createElement\b|\bReact\.Fragment\b/.test(intermediate);
   const hasReactBinding = /\b(var|let|const)\s+React\b/.test(intermediate) || /\bimport\s+React\b/.test(intermediate);
+  assertNoUnboundIdentifiers(source, {
+    sourcePath: options.sourcePath,
+    implicitIdentifiers: usesJsxRuntime ? ['React'] : [],
+  });
   if (usesJsxRuntime && !hasReactBinding) {
     intermediate = "import React from 'react';\n" + intermediate;
     if (!importedModules.includes('react')) {

package/lib/app/create-form/api-path.js

@@ -10,14 +10,23 @@
  * @param {object} [options]       可选项
  * @param {string} [options.prefix]        额外的路径前缀（会以 / 拼接）
  * @param {string} [options.namespace]     命名空间，默认 dingtalk
+ * @param {'formdesign'|'formnav'} [options.queryModule] 查询模块，默认 formdesign
  * @param {boolean} [options.addTimestamp] 是否追加 _stamp 时间戳查询参数
  * @returns {string} 拼接完成的 API 请求路径
  */
 function buildApiPath(appType, apiName, options = {}) {
-  const { prefix = '', namespace = 'dingtalk', addTimestamp = false } = options;
+  const {
+    prefix = '',
+    namespace = 'dingtalk',
+    queryModule = 'formdesign',
+    addTimestamp = false,
+  } = options;
+  if (queryModule !== 'formdesign' && queryModule !== 'formnav') {
+    throw new Error(`Unsupported query module: ${queryModule}`);
+  }
   const prefixPath = prefix ? `/${prefix}` : '';
   const timestamp = addTimestamp ? `?_stamp=${Date.now()}` : '';
-  return `/${namespace}/web/${appType}${prefixPath}/query/formdesign/${apiName}.json${timestamp}`;
+  return `/${namespace}/web/${appType}${prefixPath}/query/${queryModule}/${apiName}.json${timestamp}`;
 }
 
 module.exports = {