openyida 2026.9.15 → 2026.9.16-2

package/README.md

@@ -396,11 +396,12 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
+| `openyida design-plan catalog [--json]` | List available planning themes and page patterns |
 | `openyida design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]` | Initialize a plan draft from confirmed requirements |
 | `openyida design-plan preview <build-plan.json> --part-file <module.json> [--json]` | Update plan drafts by module |
 | `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--check] [--json]` | Generate and validate design-plan artifacts from build-plan.json |
-| `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch a design plan by field path and invalidate prior confirmation |
-| `openyida update-app <appType> [--name "..."] [--theme-file <css>] [--nav-theme light\|dark\|white\|gray] [--logo-source appIcon\|customImage] [--layout side\|top\|l_shape] [--hide-app-nav\|--show-app-nav]` | Update app info |
+| `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch a design plan; asset progress preserves existing approval |
+| `openyida update-app <appType> [--name "..."] [--desc "..."] [--icon <name>] [--icon-color <color>] [--colour <key>] [--theme-color <color>] [--theme-file <css>] [--nav-theme light\|dark\|white\|gray] [--logo-source appIcon\|customImage] [--layout side\|top\|l_shape] [--hide-app-nav\|--show-app-nav]` | Update app info |
 | `openyida app-online <appType> [--to-ding-app-center] [--show-app-center]` | Enable a Yida app |
 | `openyida app-offline <appType> [--to-ding-app-center] [--show-app-center]` | Disable a Yida app |
 | `openyida nav-group <list\|create\|rename\|delete\|move\|order\|auto-order\|hide\|show> <appType> ...` | Manage app sidebar navigation groups |
@@ -649,10 +650,14 @@ npx clawhub@latest install nicky1108/yida-app
 ```bash
 git clone https://github.com/openyida/openyida.git
 cd openyida
-npm install
+nvm install
+nvm use
+npm ci --ignore-scripts
 npm run check:ci
 ```
 
+Use the Node.js version in `.nvmrc` to match CI validation. If you do not use nvm, install that version directly.
+
 Useful checks:
 
 | Command | Purpose |

package/bin/yida.js

@@ -697,7 +697,10 @@ async function main() {
         console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs)), null, 2));
       } else if (subCommand === 'profile') {
         const profileSubCommand = authArgs[0];
-        if (profileSubCommand === 'switch') {
+        if (profileSubCommand === 'list') {
+          const { listAuthProfiles } = require('../lib/auth/profile');
+          console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs.slice(1))), null, 2));
+        } else if (profileSubCommand === 'switch') {
           const target = getFirstPositionalArg(authArgs, 1);
           const { switchAuthProfile } = require('../lib/auth/profile');
           console.log(JSON.stringify(switchAuthProfile(target, buildTokenLoginOptions(authArgs)), null, 2));

package/lib/app/app-list.js

@@ -6,13 +6,16 @@
  * 输出字段：
  *   appName    - 应用名称（zh_CN）
  *   appType    - 应用唯一标识
- *   systemLink - 应用访问地址
+ *   systemLink - 平台返回的应用访问地址
+ *   appUrl / workbenchUrl - 应用工作台地址
+ *   adminUrl   - 开发者管理后台地址（不表示已验证访问权限）
  */
 
 'use strict';
 
 const { createAuthRef, createYidaClient } = require('../core/yida-client');
 const { t } = require('../core/i18n');
+const { buildApplicationEntryUrls } = require('./application-entry-urls');
 const { throwCommandError, throwUsage } = require('../core/command-errors');
 
 const API_PATH = '/query/app/getAppList.json';
@@ -76,11 +79,12 @@ function parseArgs(args = []) {
 /**
  * 将应用原始数据提取为输出字段
  */
-function formatApp(app) {
+function formatApp(app, baseUrl) {
   return {
     appName: (app.appName && app.appName.zh_CN) || '',
     appType: app.appType || '',
     systemLink: app.systemLink || '',
+    ...buildApplicationEntryUrls({ appType: app.appType, systemLink: app.systemLink, baseUrl }),
   };
 }
 
@@ -141,7 +145,7 @@ async function run(args) {
   const totalCount = Number.isFinite(Number(content.totalCount)) ? Number(content.totalCount) : apps.length;
   const totalPages = Math.max(1, Math.ceil(totalCount / options.pageSize));
   const scopeLabel = t(`app_list.scope_${options.type}`);
-  const formattedApps = apps.map(formatApp);
+  const formattedApps = apps.map(app => formatApp(app, authRef.baseUrl));
 
   // stdout 输出 JSON，方便 AI 工具解析
   console.log(JSON.stringify(formattedApps, null, 2));

package/lib/app/application-entry-urls.js

@@ -0,0 +1,31 @@
+'use strict';
+
+// URLs derived by the CLI from a successful app result and its authenticated
+// base URL. Constructing a route does not verify the recipient's access rights.
+function buildApplicationEntryUrls({ appType, baseUrl, systemLink }) {
+  if (typeof appType !== 'string' || !/^APP_[A-Za-z0-9_-]+$/.test(appType)) { return {}; }
+  let origin;
+  const params = new URLSearchParams();
+  try {
+    const base = new URL(baseUrl);
+    if (!['https:', 'http:'].includes(base.protocol) || base.username || base.password) { return {}; }
+    origin = base.origin;
+  } catch { return {}; }
+  try {
+    if (systemLink) {
+      const app = new URL(systemLink, origin);
+      if (['https:', 'http:'].includes(app.protocol) && !app.username && !app.password && (app.pathname === `/${appType}` || app.pathname.startsWith(`/${appType}/`))) {
+        origin = app.origin;
+        for (const key of ['corpid', 'locale']) {
+          if (app.searchParams.has(key)) { params.set(key, app.searchParams.get(key)); }
+        }
+      }
+    }
+  } catch { /* Ignore malformed optional links; retain the authenticated base. */ }
+  const query = params.toString();
+  const suffix = query ? `?${query}` : '';
+  const workbenchUrl = `${origin}/${appType}/workbench${suffix}`;
+  return { appUrl: workbenchUrl, workbenchUrl, adminUrl: `${origin}/${appType}/admin${suffix}` };
+}
+
+module.exports = { buildApplicationEntryUrls };

package/lib/app/canvas-compile.js

@@ -50,6 +50,10 @@ const {
 } = require('./form-detail-link-guard');
 const { t } = require('../core/i18n');
 const { assertInlineCssStructure } = require('./inline-css-guard');
+const { assertCanvasThemeStructure } = require('./canvas-theme-guard');
+const { assertCanvasIconExports } = require('./canvas-icon-guard');
+const { assertCanvasNavigationStructure } = require('./canvas-navigation-guard');
+const { assertCanvasNavigationPaths } = require('./canvas-path-guard');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -966,7 +970,11 @@ function compileCanvasLocal(source, options = {}) {
   assertNoSelfReferentialDependencyBindings(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
+  assertCanvasIconExports(source, options);
+  assertCanvasNavigationStructure(source, options);
+  assertCanvasNavigationPaths(source, options);
   assertInlineCssStructure(source, options);
+  assertCanvasThemeStructure(source, options);
 
   const importedModules = extractImportedModules(source);