openyida 2026.9.16 → 2026.9.18

package/README.md

@@ -491,7 +491,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm` | Safely update action query defaults |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
-| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]` | Test an action |
+| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]` | Test an action |
 | `openyida connector list-connections <id>` | List auth connections |
 | `openyida connector create-connection <id> <name> [--interactive]` | Create an auth connection |
 | `openyida connector smart-create --curl "..."` | Generate a redacted action draft from cURL (no remote create) |
@@ -543,7 +543,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 #### Connector Safety and Real E2E
 
-`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures.
+`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures. With `--ignore-defaults`, the test starts from empty parameter sets: saved default values from the action definition (including sensitive placeholder values such as documented `***` samples) are ignored for the run, and a warning is printed when a non-empty systemToken default exists. Declared systemToken actions still require `--system-token-app`, target-trust checks still apply, and explicitly provided systemToken values are still rejected.
 
 `connector update-action --connector-id <id> --action <operationId> --query-json '{"currentPage":"1"}' --confirm` is the narrow safe path for editing existing query defaults. It requires a complete connector/action preflight, changes only declared query defaults mirrored in `inputs` and `parameters`, submits the complete action collection once, and verifies an unchanged connector fingerprint, action count, non-target actions, and stable IDs. Missing/empty/unknown parameters, duplicate IDs, incomplete readback, and unknown write outcomes fail closed without automatic retry. `add-action` no longer overwrites an existing action ID; use `update-action` for query-only edits.
 

package/bin/yida.js

@@ -697,7 +697,10 @@ async function main() {
         console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs)), null, 2));
       } else if (subCommand === 'profile') {
         const profileSubCommand = authArgs[0];
-        if (profileSubCommand === 'switch') {
+        if (profileSubCommand === 'list') {
+          const { listAuthProfiles } = require('../lib/auth/profile');
+          console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs.slice(1))), null, 2));
+        } else if (profileSubCommand === 'switch') {
           const target = getFirstPositionalArg(authArgs, 1);
           const { switchAuthProfile } = require('../lib/auth/profile');
           console.log(JSON.stringify(switchAuthProfile(target, buildTokenLoginOptions(authArgs)), null, 2));

package/lib/app/app-list.js

@@ -6,13 +6,16 @@
  * 输出字段：
  *   appName    - 应用名称（zh_CN）
  *   appType    - 应用唯一标识
- *   systemLink - 应用访问地址
+ *   systemLink - 平台返回的应用访问地址
+ *   appUrl / workbenchUrl - 应用工作台地址
+ *   adminUrl   - 开发者管理后台地址（不表示已验证访问权限）
  */
 
 'use strict';
 
 const { createAuthRef, createYidaClient } = require('../core/yida-client');
 const { t } = require('../core/i18n');
+const { buildApplicationEntryUrls } = require('./application-entry-urls');
 const { throwCommandError, throwUsage } = require('../core/command-errors');
 
 const API_PATH = '/query/app/getAppList.json';
@@ -76,11 +79,12 @@ function parseArgs(args = []) {
 /**
  * 将应用原始数据提取为输出字段
  */
-function formatApp(app) {
+function formatApp(app, baseUrl) {
   return {
     appName: (app.appName && app.appName.zh_CN) || '',
     appType: app.appType || '',
     systemLink: app.systemLink || '',
+    ...buildApplicationEntryUrls({ appType: app.appType, systemLink: app.systemLink, baseUrl }),
   };
 }
 
@@ -141,7 +145,7 @@ async function run(args) {
   const totalCount = Number.isFinite(Number(content.totalCount)) ? Number(content.totalCount) : apps.length;
   const totalPages = Math.max(1, Math.ceil(totalCount / options.pageSize));
   const scopeLabel = t(`app_list.scope_${options.type}`);
-  const formattedApps = apps.map(formatApp);
+  const formattedApps = apps.map(app => formatApp(app, authRef.baseUrl));
 
   // stdout 输出 JSON，方便 AI 工具解析
   console.log(JSON.stringify(formattedApps, null, 2));

package/lib/app/application-entry-urls.js

@@ -0,0 +1,31 @@
+'use strict';
+
+// URLs derived by the CLI from a successful app result and its authenticated
+// base URL. Constructing a route does not verify the recipient's access rights.
+function buildApplicationEntryUrls({ appType, baseUrl, systemLink }) {
+  if (typeof appType !== 'string' || !/^APP_[A-Za-z0-9_-]+$/.test(appType)) { return {}; }
+  let origin;
+  const params = new URLSearchParams();
+  try {
+    const base = new URL(baseUrl);
+    if (!['https:', 'http:'].includes(base.protocol) || base.username || base.password) { return {}; }
+    origin = base.origin;
+  } catch { return {}; }
+  try {
+    if (systemLink) {
+      const app = new URL(systemLink, origin);
+      if (['https:', 'http:'].includes(app.protocol) && !app.username && !app.password && (app.pathname === `/${appType}` || app.pathname.startsWith(`/${appType}/`))) {
+        origin = app.origin;
+        for (const key of ['corpid', 'locale']) {
+          if (app.searchParams.has(key)) { params.set(key, app.searchParams.get(key)); }
+        }
+      }
+    }
+  } catch { /* Ignore malformed optional links; retain the authenticated base. */ }
+  const query = params.toString();
+  const suffix = query ? `?${query}` : '';
+  const workbenchUrl = `${origin}/${appType}/workbench${suffix}`;
+  return { appUrl: workbenchUrl, workbenchUrl, adminUrl: `${origin}/${appType}/admin${suffix}` };
+}
+
+module.exports = { buildApplicationEntryUrls };

package/lib/app/canvas-compile.js

@@ -51,6 +51,9 @@ const {
 const { t } = require('../core/i18n');
 const { assertInlineCssStructure } = require('./inline-css-guard');
 const { assertCanvasThemeStructure } = require('./canvas-theme-guard');
+const { assertCanvasIconExports } = require('./canvas-icon-guard');
+const { assertCanvasNavigationStructure } = require('./canvas-navigation-guard');
+const { assertCanvasNavigationPaths } = require('./canvas-path-guard');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -967,6 +970,9 @@ function compileCanvasLocal(source, options = {}) {
   assertNoSelfReferentialDependencyBindings(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
+  assertCanvasIconExports(source, options);
+  assertCanvasNavigationStructure(source, options);
+  assertCanvasNavigationPaths(source, options);
   assertInlineCssStructure(source, options);
   assertCanvasThemeStructure(source, options);