openyida 2026.9.16-2 → 2026.9.17

package/README.md

@@ -491,7 +491,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm` | Safely update action query defaults |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
-| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]` | Test an action |
+| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]` | Test an action |
 | `openyida connector list-connections <id>` | List auth connections |
 | `openyida connector create-connection <id> <name> [--interactive]` | Create an auth connection |
 | `openyida connector smart-create --curl "..."` | Generate a redacted action draft from cURL (no remote create) |
@@ -543,7 +543,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 #### Connector Safety and Real E2E
 
-`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures.
+`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures. With `--ignore-defaults`, the test starts from empty parameter sets: saved default values from the action definition (including sensitive placeholder values such as documented `***` samples) are ignored for the run, and a warning is printed when a non-empty systemToken default exists. Declared systemToken actions still require `--system-token-app`, target-trust checks still apply, and explicitly provided systemToken values are still rejected.
 
 `connector update-action --connector-id <id> --action <operationId> --query-json '{"currentPage":"1"}' --confirm` is the narrow safe path for editing existing query defaults. It requires a complete connector/action preflight, changes only declared query defaults mirrored in `inputs` and `parameters`, submits the complete action collection once, and verifies an unchanged connector fingerprint, action count, non-target actions, and stable IDs. Missing/empty/unknown parameters, duplicate IDs, incomplete readback, and unknown write outcomes fail closed without automatic retry. `add-action` no longer overwrites an existing action ID; use `update-action` for query-only edits.
 

package/lib/connector/connector-test.js

@@ -5,6 +5,7 @@
 'use strict';
 
 const { t } = require('../core/i18n');
+const { warn } = require('../core/chalk');
 const { redactSensitive, redactString, safeJsonStringify } = require('../core/redact');
 const {
   getAuthRef,
@@ -18,6 +19,7 @@ const {
   assertNoExplicitSystemToken,
   assertTrustedYidaSystemTokenTarget,
   collectSystemTokenLocations,
+  hasNonEmptySystemToken,
   resolveYidaSystemToken,
 } = require('./yida-system-token');
 
@@ -48,6 +50,7 @@ function parseArgs(args) {
       case '--body-json': options.bodyJson = args[++i]; break;
       case '--account-id': options.accountId = args[++i]; break;
       case '--system-token-app': options.systemTokenApp = args[++i]; break;
+      case '--ignore-defaults': options.ignoreDefaults = true; break;
       case '--json': options.json = true; break;
     }
   }
@@ -141,7 +144,9 @@ function mergeLocation(params, location, value) {
 }
 
 function buildTestParams(operation, options = {}) {
-  const params = buildDefaults(operation);
+  const params = options.ignoreDefaults
+    ? { path: {}, query: {}, header: {}, body: {} }
+    : buildDefaults(operation);
   const flat = parseJsonObject(options.params, '--params');
   if (flat) {
     const schemaLocations = collectSchemaLocations(operation);
@@ -220,10 +225,19 @@ async function run(args) {
   const systemTokenLocations = collectSystemTokenLocations(operation);
   const isYidaSystemTokenAction = systemTokenLocations.length > 0;
   if (options.systemTokenApp || isYidaSystemTokenAction) {
-    assertNoExplicitSystemToken(operation, {
-      connectorId: options.connectorId,
-      actionId: options.actionId,
-    });
+    if (options.ignoreDefaults) {
+      // Saved defaults are ignored for this run, so their values (including
+      // sensitive placeholders) never reach the request; warn instead of
+      // failing closed on definition-level defaults.
+      if (hasNonEmptySystemToken(operation)) {
+        warn(t('connector_test.ignore_defaults_system_token_warning'));
+      }
+    } else {
+      assertNoExplicitSystemToken(operation, {
+        connectorId: options.connectorId,
+        actionId: options.actionId,
+      });
+    }
     assertTrustedYidaSystemTokenTarget(detail, operation);
   }
   const requiresAuth = connectorRequiresAuth(detail.securitySchemes);

package/lib/connector/contract.js

@@ -190,7 +190,9 @@ function buildConnectorTestPayload(params) {
     payload.connection = connection;
   }
   if (method !== 'get' && method !== 'delete') {
-    payload.body = params.body || {};
+    payload.body = typeof params.body === 'string'
+      ? params.body
+      : JSON.stringify(params.body || {});
   }
   return payload;
 }

package/lib/core/command-manifest.js

@@ -1389,7 +1389,7 @@ const COMMAND_GROUPS = [
       command('connector.update-action', ['connector', 'update-action'], 'connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm', 'help.cmd_connector_update_action'),
       command('connector.list-actions', ['connector', 'list-actions'], 'connector list-actions <id>', 'help.cmd_connector_list_actions'),
       command('connector.delete-action', ['connector', 'delete-action'], 'connector delete-action <id> <operation-id>', 'help.cmd_connector_delete_action'),
-      command('connector.test', ['connector', 'test'], 'connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]', 'help.cmd_connector_test'),
+      command('connector.test', ['connector', 'test'], 'connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]', 'help.cmd_connector_test'),
       command('connector.list-connections', ['connector', 'list-connections'], 'connector list-connections <id>', 'help.cmd_connector_list_connections'),
       command('connector.create-connection', ['connector', 'create-connection'], 'connector create-connection <id> <name> [--interactive]', 'help.cmd_connector_create_connection'),
       command('connector.smart-create', ['connector', 'smart-create'], 'connector smart-create --curl "..."', 'help.cmd_connector_smart'),

package/lib/core/locales/en.js

@@ -1990,7 +1990,8 @@ Object.assign(module.exports.create_process || (module.exports.create_process =
   login_required: 'No valid Yida login session was found. Run openyida login first.',
 });
 module.exports.connector_test = {
-  usage: 'Usage: openyida connector test --connector-id <id> --action <actionId> [--params <json>] [--path-json <json>] [--query-json <json>] [--header-json <json>] [--body-json <json>] [--account-id <id>] [--system-token-app <appType>] [--json]',
+  usage: 'Usage: openyida connector test --connector-id <id> --action <actionId> [--params <json>] [--path-json <json>] [--query-json <json>] [--header-json <json>] [--body-json <json>] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults] [--json]',
+  ignore_defaults_system_token_warning: 'Saved default parameter values are ignored via --ignore-defaults (they contain a non-empty systemToken and are not used in this run); clean up the action defaults in the designer before production use.',
   invalid_json: '{0} is not valid JSON: {1}',
   json_object_required: '{0} must be a JSON object',
   unknown_flat_param: 'Parameter {0} is not in the action schema; use the matching structured JSON option',

package/lib/core/locales/zh.js

@@ -1944,7 +1944,8 @@ Object.assign(module.exports.create_process || (module.exports.create_process =
   login_required: '未获取到有效宜搭登录态，请先执行 openyida login。',
 });
 module.exports.connector_test = {
-  usage: '用法: openyida connector test --connector-id <id> --action <actionId> [--params <json>] [--path-json <json>] [--query-json <json>] [--header-json <json>] [--body-json <json>] [--account-id <id>] [--system-token-app <appType>] [--json]',
+  usage: '用法: openyida connector test --connector-id <id> --action <actionId> [--params <json>] [--path-json <json>] [--query-json <json>] [--header-json <json>] [--body-json <json>] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults] [--json]',
+  ignore_defaults_system_token_warning: '已按 --ignore-defaults 忽略动作保存的默认参数值（其中包含非空 systemToken，本次请求不会使用）；生产使用前请先在设计器清理默认值。',
   invalid_json: '{0} 不是合法 JSON: {1}',
   json_object_required: '{0} 必须是 JSON 对象',
   unknown_flat_param: '参数 {0} 不在动作 Schema 中；请改用对应的结构化 JSON 参数',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.9.16-2",
+  "version": "2026.9.17",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",