openyida 2026.9.16 → 2026.9.18-1

package/README.md

@@ -399,8 +399,8 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida design-plan catalog [--json]` | List available planning themes and page patterns |
 | `openyida design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]` | Initialize a plan draft from confirmed requirements |
 | `openyida design-plan preview <build-plan.json> --part-file <module.json> [--json]` | Update plan drafts by module |
-| `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--check] [--json]` | Generate and validate design-plan artifacts from build-plan.json |
-| `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch a design plan; asset progress preserves existing approval |
+| `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--check] [--json]` | Generate or update plan documents and theme with consistency checks |
+| `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch plan fields and optionally sync documents and theme |
 | `openyida update-app <appType> [--name "..."] [--desc "..."] [--icon <name>] [--icon-color <color>] [--colour <key>] [--theme-color <color>] [--theme-file <css>] [--nav-theme light\|dark\|white\|gray] [--logo-source appIcon\|customImage] [--layout side\|top\|l_shape] [--hide-app-nav\|--show-app-nav]` | Update app info |
 | `openyida app-online <appType> [--to-ding-app-center] [--show-app-center]` | Enable a Yida app |
 | `openyida app-offline <appType> [--to-ding-app-center] [--show-app-center]` | Disable a Yida app |
@@ -430,12 +430,13 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida aggregate-table <list\|create-empty\|inspect\|preview\|save\|publish\|status> <appType> ...` | Manage aggregate tables (virtualView) |
 | `openyida get-schema <appType> <formUuid\|--all> [--summary-json\|--field-map-json\|--analysis-json]` | Get one form Schema or all form Schemas |
 | `openyida check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]` | Check PRD page/resource count risk |
+| `openyida check-design <design.md> [--prd <prd.md>] [--base-dir <dir>] [--json]` | Validate design documents, theme tokens and PRD handoff |
 | `openyida er <appType> [--format mermaid\|json] [--output file] [--include-system] [--include-pages]` | Export app entity relationship diagram |
 | `openyida create-page <appType> "<name>" [--mode dashboard] [--hide-nav] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a custom display page |
 | `openyida build-page <sourceFile> [--output file\|--write]` | Build Yida-compatible page source |
-| `openyida check-page <src> [--compat]` | Check custom page standards |
-| `openyida compile <src> [--canvas] [--json]` | Compile custom page locally |
-| `openyida publish <src> <appType> <formUuid> [--health-check] [--force] [--canvas] [--auto-nav-order] [--open\|--no-open]` | Compile and publish custom page |
+| `openyida check-page <src> [--compat] [--json]` | Check custom page standards |
+| `openyida compile <src> [--canvas] [--compat] [--skip-lint] [--json]` | Compile custom page locally |
+| `openyida publish <src> <appType> <formUuid> [--health-check] [--force] [--canvas] [--compat] [--skip-lint] [--auto-nav-order] [--open\|--no-open] [--json]` | Compile and publish custom page |
 | `openyida update-form-config <appType> <formUuid> <true\|false\|keep> "<title>" [--locale zh_CN\|en_US\|ja_JP]` | Update form configuration |
 | `openyida get-form-config <appType> <formUuid> [--json]` | Query form configuration |
 
@@ -458,7 +459,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida configure-process <appType> <formUuid> <definition> [processCode] [--replace]` | Configure and publish process rules; Supports append/forward via JSON nodes[].actions.normalActions/appendActions |
-| `openyida create-process <appType> ... [--replace]` | Create process form (all-in-one); Supports append/forward via JSON nodes[].actions.normalActions/appendActions |
+| `openyida create-process <appType> <formTitle> <fieldsJsonFile> <processDefinitionFile> [--replace] \| create-process <appType> --formUuid <formUuid> <processDefinitionFile> [--replace]` | Create process form (all-in-one); Supports append/forward via JSON nodes[].actions.normalActions/appendActions |
 | `openyida ai-form-setting <get\|fields\|models\|enable\|disable\|save> <appType> ...` | Manage process form AI approval prompts |
 | `openyida process preview <appType> ...` | Preview process instance (visual flowchart) |
 
@@ -491,7 +492,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm` | Safely update action query defaults |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
-| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]` | Test an action |
+| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]` | Test an action |
 | `openyida connector list-connections <id>` | List auth connections |
 | `openyida connector create-connection <id> <name> [--interactive]` | Create an auth connection |
 | `openyida connector smart-create --curl "..."` | Generate a redacted action draft from cURL (no remote create) |
@@ -543,7 +544,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 #### Connector Safety and Real E2E
 
-`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures.
+`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures. With `--ignore-defaults`, the test starts from empty parameter sets: saved default values from the action definition (including sensitive placeholder values such as documented `***` samples) are ignored for the run, and a warning is printed when a non-empty systemToken default exists. Declared systemToken actions still require `--system-token-app`, target-trust checks still apply, and explicitly provided systemToken values are still rejected.
 
 `connector update-action --connector-id <id> --action <operationId> --query-json '{"currentPage":"1"}' --confirm` is the narrow safe path for editing existing query defaults. It requires a complete connector/action preflight, changes only declared query defaults mirrored in `inputs` and `parameters`, submits the complete action collection once, and verifies an unchanged connector fingerprint, action count, non-target actions, and stable IDs. Missing/empty/unknown parameters, duplicate IDs, incomplete readback, and unknown write outcomes fail closed without automatic retry. `add-action` no longer overwrites an existing action ID; use `update-action` for query-only edits.
 

package/bin/yida.js

@@ -526,6 +526,7 @@ function printManifestCommandHelp(commandName) {
   printCommandUsage(...entries.flatMap((entry) => [
     entry.usage,
     entry.description,
+    ...(entry.notes || []),
     ...(entry.examples || []),
   ]));
   return true;
@@ -697,7 +698,10 @@ async function main() {
         console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs)), null, 2));
       } else if (subCommand === 'profile') {
         const profileSubCommand = authArgs[0];
-        if (profileSubCommand === 'switch') {
+        if (profileSubCommand === 'list') {
+          const { listAuthProfiles } = require('../lib/auth/profile');
+          console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs.slice(1))), null, 2));
+        } else if (profileSubCommand === 'switch') {
           const target = getFirstPositionalArg(authArgs, 1);
           const { switchAuthProfile } = require('../lib/auth/profile');
           console.log(JSON.stringify(switchAuthProfile(target, buildTokenLoginOptions(authArgs)), null, 2));
@@ -795,6 +799,12 @@ async function main() {
       break;
     }
 
+    case 'check-design': {
+      const { run } = require('../lib/design/check-design');
+      await run(args);
+      break;
+    }
+
     case 'er': {
       const { run } = require('../lib/app/er');
       await run(args);
@@ -1006,9 +1016,6 @@ async function main() {
     }
 
     case 'create-process': {
-      if (args.length < 2) {
-        throwCliUsage(t('cli.create_process_usage'), t('cli.create_process_example'));
-      }
       const { run: runCreateProcess } = require('../lib/process/create-process');
       await runCreateProcess(args);
       break;

package/lib/app/app-list.js

@@ -6,13 +6,16 @@
  * 输出字段：
  *   appName    - 应用名称（zh_CN）
  *   appType    - 应用唯一标识
- *   systemLink - 应用访问地址
+ *   systemLink - 平台返回的应用访问地址
+ *   appUrl / workbenchUrl - 应用工作台地址
+ *   adminUrl   - 开发者管理后台地址（不表示已验证访问权限）
  */
 
 'use strict';
 
 const { createAuthRef, createYidaClient } = require('../core/yida-client');
 const { t } = require('../core/i18n');
+const { buildApplicationEntryUrls } = require('./application-entry-urls');
 const { throwCommandError, throwUsage } = require('../core/command-errors');
 
 const API_PATH = '/query/app/getAppList.json';
@@ -76,11 +79,12 @@ function parseArgs(args = []) {
 /**
  * 将应用原始数据提取为输出字段
  */
-function formatApp(app) {
+function formatApp(app, baseUrl) {
   return {
     appName: (app.appName && app.appName.zh_CN) || '',
     appType: app.appType || '',
     systemLink: app.systemLink || '',
+    ...buildApplicationEntryUrls({ appType: app.appType, systemLink: app.systemLink, baseUrl }),
   };
 }
 
@@ -141,7 +145,7 @@ async function run(args) {
   const totalCount = Number.isFinite(Number(content.totalCount)) ? Number(content.totalCount) : apps.length;
   const totalPages = Math.max(1, Math.ceil(totalCount / options.pageSize));
   const scopeLabel = t(`app_list.scope_${options.type}`);
-  const formattedApps = apps.map(formatApp);
+  const formattedApps = apps.map(app => formatApp(app, authRef.baseUrl));
 
   // stdout 输出 JSON，方便 AI 工具解析
   console.log(JSON.stringify(formattedApps, null, 2));

package/lib/app/application-entry-urls.js

@@ -0,0 +1,31 @@
+'use strict';
+
+// URLs derived by the CLI from a successful app result and its authenticated
+// base URL. Constructing a route does not verify the recipient's access rights.
+function buildApplicationEntryUrls({ appType, baseUrl, systemLink }) {
+  if (typeof appType !== 'string' || !/^APP_[A-Za-z0-9_-]+$/.test(appType)) { return {}; }
+  let origin;
+  const params = new URLSearchParams();
+  try {
+    const base = new URL(baseUrl);
+    if (!['https:', 'http:'].includes(base.protocol) || base.username || base.password) { return {}; }
+    origin = base.origin;
+  } catch { return {}; }
+  try {
+    if (systemLink) {
+      const app = new URL(systemLink, origin);
+      if (['https:', 'http:'].includes(app.protocol) && !app.username && !app.password && (app.pathname === `/${appType}` || app.pathname.startsWith(`/${appType}/`))) {
+        origin = app.origin;
+        for (const key of ['corpid', 'locale']) {
+          if (app.searchParams.has(key)) { params.set(key, app.searchParams.get(key)); }
+        }
+      }
+    }
+  } catch { /* Ignore malformed optional links; retain the authenticated base. */ }
+  const query = params.toString();
+  const suffix = query ? `?${query}` : '';
+  const workbenchUrl = `${origin}/${appType}/workbench${suffix}`;
+  return { appUrl: workbenchUrl, workbenchUrl, adminUrl: `${origin}/${appType}/admin${suffix}` };
+}
+
+module.exports = { buildApplicationEntryUrls };

package/lib/app/canvas-compile.js

@@ -51,6 +51,9 @@ const {
 const { t } = require('../core/i18n');
 const { assertInlineCssStructure } = require('./inline-css-guard');
 const { assertCanvasThemeStructure } = require('./canvas-theme-guard');
+const { assertCanvasIconExports } = require('./canvas-icon-guard');
+const { assertCanvasNavigationStructure } = require('./canvas-navigation-guard');
+const { assertCanvasNavigationPaths } = require('./canvas-path-guard');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -937,29 +940,29 @@ function compileCanvasLocal(source, options = {}) {
       },
     });
   }
-  const directFormOpenIssues = findDirectFormOpenIssues(source);
-  if (directFormOpenIssues.length > 0) {
-    const firstIssue = directFormOpenIssues[0];
-    throw new CliError(formatDirectFormOpenMessage(), {
-      code: 'OPENYIDA_CANVAS_FORM_OPEN_CONTAINER_REQUIRED',
+  const formDetailLinkIssues = findFormDetailLinkIssues(source);
+  if (formDetailLinkIssues.length > 0) {
+    const firstIssue = formDetailLinkIssues[0];
+    throw new CliError(formatFormDetailLinkMessage(firstIssue), {
+      code: 'OPENYIDA_CANVAS_FORM_DETAIL_LINK_INVALID',
       details: {
         stage: 'canvas_compile',
         sourcePath: options.sourcePath || '',
         line: firstIssue.line,
-        callee: firstIssue.callee,
+        issueType: firstIssue.type,
       },
     });
   }
-  const formDetailLinkIssues = findFormDetailLinkIssues(source);
-  if (formDetailLinkIssues.length > 0) {
-    const firstIssue = formDetailLinkIssues[0];
-    throw new CliError(formatFormDetailLinkMessage(firstIssue), {
-      code: 'OPENYIDA_CANVAS_FORM_DETAIL_LINK_INVALID',
+  const directFormOpenIssues = findDirectFormOpenIssues(source);
+  if (directFormOpenIssues.length > 0) {
+    const firstIssue = directFormOpenIssues[0];
+    throw new CliError(formatDirectFormOpenMessage(), {
+      code: 'OPENYIDA_CANVAS_FORM_OPEN_CONTAINER_REQUIRED',
       details: {
         stage: 'canvas_compile',
         sourcePath: options.sourcePath || '',
         line: firstIssue.line,
-        issueType: firstIssue.type,
+        callee: firstIssue.callee,
       },
     });
   }
@@ -967,6 +970,9 @@ function compileCanvasLocal(source, options = {}) {
   assertNoSelfReferentialDependencyBindings(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
+  assertCanvasIconExports(source, options);
+  assertCanvasNavigationStructure(source, options);
+  assertCanvasNavigationPaths(source, options);
   assertInlineCssStructure(source, options);
   assertCanvasThemeStructure(source, options);