openyida 2026.9.22-beta.4 → 2026.9.23-beta.1

package/README.md

@@ -74,6 +74,13 @@ openyida login
 
 OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the user auth store when available. If the user auth store is not writable, OpenYida explicitly falls back to the current project cache and reports that narrower persistence scope.
 
+In a sandbox, headless shell, or CI dashboard where the loopback callback cannot complete, use the device authorization flow. Open the displayed verification URL on any device and enter the user code. `--env-hint` optionally pins the intended environment profile at authorization time:
+
+```bash
+openyida login --device
+openyida login --device --env-hint pre
+```
+
 When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and auth profile. For example:
 
 ```bash
@@ -183,7 +190,7 @@ openyida get-schema APP_XXX FORM_XXX --compact --resolve-fields "Customer Name,S
 openyida get-schema APP_XXX --all --output-dir .cache/schemas
 ```
 
-Form definitions support 19 business field types plus verified presentation/layout components. Prefer `Divider` for section titles and `ColumnContainer` (mapped to `ColumnsLayout` + `Column`) for multi-column layout; use `GroupContainer` / `PageSection` only when an actual grouping container is needed.
+Native forms use a component tree: business fields capture data, tabs switch content, action groups trigger business actions, images establish visual focus, status areas provide feedback, and `Divider` plus `ColumnContainer` organize hierarchy and columns. `create-form` field definitions create 19 business field types plus `Divider` and `ColumnContainer` (mapped to `ColumnsLayout` + `Column`), while updates retain other existing components.
 
 ### Custom Page Development
 
@@ -383,9 +390,9 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
-| `openyida auth <status\|login\|sync-dws\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
+| `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |
 | `openyida env [--json\|setup\|list\|show\|switch\|add\|remove] [options]` | Detect AI tool environment & token login state |
 
@@ -393,14 +400,17 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
+| `openyida app-entry get <appType> [--json]` | Read frontend and management runtime entries |
+| `openyida app-entry set <appType> [--frontend <url>] [--management <url>] [--clear-frontend] [--clear-management] [--json]` | Register application entries with partial update and readback |
 | `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
+| `openyida design-plan catalog [--json]` | List available planning themes and page patterns |
 | `openyida design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]` | Initialize a plan draft from confirmed requirements |
 | `openyida design-plan preview <build-plan.json> --part-file <module.json> [--json]` | Update plan drafts by module |
-| `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--check] [--json]` | Generate and validate design-plan artifacts from build-plan.json |
-| `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch a design plan by field path and invalidate prior confirmation |
-| `openyida update-app <appType> [--name "..."] [--theme-file <css>] [--nav-theme light\|dark\|white\|gray] [--logo-source appIcon\|customImage] [--layout side\|top\|l_shape] [--hide-app-nav\|--show-app-nav]` | Update app info |
+| `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--rebase-parts] [--check] [--json]` | Generate or update plan documents and theme with consistency checks |
+| `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch plan fields and optionally sync documents and theme |
+| `openyida update-app <appType> [--name "..."] [--desc "..."] [--icon <name>] [--icon-color <color>] [--colour <key>] [--theme-color <color>] [--theme-file <css>] [--nav-theme light\|dark\|white\|gray] [--logo-source appIcon\|customImage] [--layout side\|top\|l_shape] [--hide-app-nav\|--show-app-nav]` | Update app info |
 | `openyida app-online <appType> [--to-ding-app-center] [--show-app-center]` | Enable a Yida app |
 | `openyida app-offline <appType> [--to-ding-app-center] [--show-app-center]` | Disable a Yida app |
 | `openyida nav-group <list\|create\|rename\|delete\|move\|order\|auto-order\|hide\|show> <appType> ...` | Manage app sidebar navigation groups |
@@ -414,7 +424,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida create-form batch <appType> <plan.json> [--concurrency 1..4] [--check] [--json]` | Create forms concurrently by dependency |
-| `openyida create-form create <appType> "<formTitle>" <fieldsJsonFile> [--icon auto\|<iconName>] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a form page |
+| `openyida create-form create <appType> "<formTitle>" <fieldsJsonFile> [--layout single\|double\|card\|section] [--theme default\|compact\|comfortable] [--label-align top\|left\|right] [--icon auto\|<iconName>] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a form page |
 | `openyida create-form icons [--json]` | List available form navigation icons |
 | `openyida create-form validate-fields <fieldsJsonOrFile> [--json]` | Validate form field JSON locally |
 | `openyida create-form update <appType> <formUuid> (<changesJsonOrFile> \| --data-file <changesJsonOrFile>) [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Update a form page |
@@ -429,12 +439,13 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida aggregate-table <list\|create-empty\|inspect\|preview\|save\|publish\|status> <appType> ...` | Manage aggregate tables (virtualView) |
 | `openyida get-schema <appType> <formUuid\|--all> [--summary-json\|--field-map-json\|--analysis-json]` | Get one form Schema or all form Schemas |
 | `openyida check-prd-completeness <prd.md> --app-type <appType> [--build-manifest <file>] [--json]` | Check PRD page/resource count risk |
+| `openyida check-design <design.md> [--prd <prd.md>] [--base-dir <dir>] [--json]` | Validate design documents, theme tokens and PRD handoff |
 | `openyida er <appType> [--format mermaid\|json] [--output file] [--include-system] [--include-pages]` | Export app entity relationship diagram |
 | `openyida create-page <appType> "<name>" [--mode dashboard] [--hide-nav] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a custom display page |
 | `openyida build-page <sourceFile> [--output file\|--write]` | Build Yida-compatible page source |
-| `openyida check-page <src> [--compat]` | Check custom page standards |
-| `openyida compile <src> [--canvas] [--json]` | Compile custom page locally |
-| `openyida publish <src> <appType> <formUuid> [--health-check] [--force] [--canvas] [--auto-nav-order] [--open\|--no-open]` | Compile and publish custom page |
+| `openyida check-page <src> [--compat] [--json]` | Check custom page standards |
+| `openyida compile <src> [--canvas] [--compat] [--skip-lint] [--json]` | Compile custom page locally |
+| `openyida publish <src> <appType> <formUuid> [--health-check] [--force] [--canvas] [--compat] [--skip-lint] [--auto-nav-order] [--open\|--no-open] [--json]` | Compile and publish custom page |
 | `openyida update-form-config <appType> <formUuid> <true\|false\|keep> "<title>" [--locale zh_CN\|en_US\|ja_JP]` | Update form configuration |
 | `openyida get-form-config <appType> <formUuid> [--json]` | Query form configuration |
 
@@ -457,7 +468,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida configure-process <appType> <formUuid> <definition> [processCode] [--replace]` | Configure and publish process rules; Supports append/forward via JSON nodes[].actions.normalActions/appendActions |
-| `openyida create-process <appType> ... [--replace]` | Create process form (all-in-one); Supports append/forward via JSON nodes[].actions.normalActions/appendActions |
+| `openyida create-process <appType> <formTitle> <fieldsJsonFile> <processDefinitionFile> [--replace] \| create-process <appType> --formUuid <formUuid> <processDefinitionFile> [--replace]` | Create process form (all-in-one); Supports append/forward via JSON nodes[].actions.normalActions/appendActions |
 | `openyida ai-form-setting <get\|fields\|models\|enable\|disable\|save> <appType> ...` | Manage process form AI approval prompts |
 | `openyida process preview <appType> ...` | Preview process instance (visual flowchart) |
 
@@ -490,7 +501,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm` | Safely update action query defaults |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
-| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]` | Test an action |
+| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>] [--ignore-defaults]` | Test an action |
 | `openyida connector list-connections <id>` | List auth connections |
 | `openyida connector create-connection <id> <name> [--interactive]` | Create an auth connection |
 | `openyida connector smart-create --curl "..."` | Generate a redacted action draft from cURL (no remote create) |
@@ -521,7 +532,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida a2a <serve\|agent-card> [options]` | Start local read-only A2A adapter or print Agent Card |
 | `openyida bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open\|--no-open]` | Start OpenYida local web bridge service |
 | `openyida copy [--force]` | Copy project working directory |
-| `openyida sample [--list] [<skill> <name>] [--output <file>] [--var KEY=VALUE ...] [--design-file <design.md>]` | Output code samples/templates |
+| `openyida sample [--list] [<skill> <name>] [--output <file-or-directory>] [--var KEY=VALUE ...] [--design-file <design.md>] [--style-id <themeId\|free-creative>]` | Output code samples/templates |
 | `openyida doctor [--fix]` | Environment diagnostics & auto-fix |
 | `openyida db-seq-fix [--fix]` | Detect and repair PostgreSQL sequence drift |
 | `openyida formula evaluate <formula\|file> [--schema file]` | Static-check Yida formula syntax and field refs |
@@ -542,7 +553,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 #### Connector Safety and Real E2E
 
-`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures.
+`connector test` keeps the legacy flat `--params` option, but dispatches each key only to the location proven by the action schema. Unknown or ambiguous keys fail closed. Authenticated connectors require `--account-id`, and that account must belong to the selected connector. The test response follows the frontend canonical contract `{statusLine,responseHeaders,content}`; unknown envelopes and non-2xx status lines are failures. With `--ignore-defaults`, the test starts from empty parameter sets: saved default values from the action definition (including sensitive placeholder values such as documented `***` samples) are ignored for the run, and a warning is printed when a non-empty systemToken default exists. Declared systemToken actions still require `--system-token-app`, target-trust checks still apply, and explicitly provided systemToken values are still rejected.
 
 `connector update-action --connector-id <id> --action <operationId> --query-json '{"currentPage":"1"}' --confirm` is the narrow safe path for editing existing query defaults. It requires a complete connector/action preflight, changes only declared query defaults mirrored in `inputs` and `parameters`, submits the complete action collection once, and verifies an unchanged connector fingerprint, action count, non-target actions, and stable IDs. Missing/empty/unknown parameters, duplicate IDs, incomplete readback, and unknown write outcomes fail closed without automatic retry. `add-action` no longer overwrites an existing action ID; use `update-action` for query-only edits.
 
@@ -649,10 +660,14 @@ npx clawhub@latest install nicky1108/yida-app
 ```bash
 git clone https://github.com/openyida/openyida.git
 cd openyida
-npm install
+nvm install
+nvm use
+npm ci --ignore-scripts
 npm run check:ci
 ```
 
+Use the Node.js version in `.nvmrc` to match CI validation. If you do not use nvm, install that version directly.
+
 Useful checks:
 
 | Command | Purpose |

package/bin/yida.js

@@ -279,6 +279,7 @@ function getFirstPositionalArg(cliArgs, startIndex = 0) {
     '--login-url',
     '--profile',
     '--user-id',
+    '--env-hint',
   ]);
   for (let index = startIndex; index < cliArgs.length; index++) {
     const arg = cliArgs[index];
@@ -386,6 +387,7 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--client-id',
     '--profile',
     '--user-id',
+    '--env-hint',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -526,6 +528,7 @@ function printManifestCommandHelp(commandName) {
   printCommandUsage(...entries.flatMap((entry) => [
     entry.usage,
     entry.description,
+    ...(entry.notes || []),
     ...(entry.examples || []),
   ]));
   return true;
@@ -536,13 +539,23 @@ function printLoginHelp() {
 }
 
 function buildTokenLoginOptions(loginArgs) {
+  const device = loginArgs.includes('--device');
   return {
     clientId: getArgValue(loginArgs, '--client-id'),
     corpId: getArgValue(loginArgs, '--corp-id'),
     userId: getArgValue(loginArgs, '--user-id'),
     authProfile: getArgValue(loginArgs, '--profile'),
     quiet: process.env.YIDA_QUIET === '1' || loginArgs.includes('--quiet'),
-    noBrowser: loginArgs.includes('--no-browser'),
+    noBrowser: device || loginArgs.includes('--no-browser'),
+    device,
+    envHint: getArgValue(loginArgs, '--env-hint'),
+    // Machine-readable progress events for agent runtimes (sandbox browsers,
+    // CI dashboards). Emits one JSON line per state transition.
+    onDeviceState: (state) => {
+      if (device) {
+        process.stdout.write(JSON.stringify({ type: 'device_login_state', ...state }) + '\n');
+      }
+    },
   };
 }
 
@@ -690,8 +703,6 @@ async function main() {
       const { tokenLogin, tokenLogout, tokenRefresh } = require('../lib/auth/token-auth');
       if (!subCommand || subCommand === '--help' || subCommand === '-h') {
         printAuthHelp();
-      } else if (subCommand === 'sync-dws') {
-        await require('../lib/auth/dws-sync').run(authArgs, buildTokenLoginOptions(authArgs));
       } else if (subCommand === 'status') {
         console.log(JSON.stringify(getAuthStatus(buildTokenLoginOptions(authArgs)), null, 2));
       } else if (subCommand === 'profiles') {
@@ -699,7 +710,10 @@ async function main() {
         console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs)), null, 2));
       } else if (subCommand === 'profile') {
         const profileSubCommand = authArgs[0];
-        if (profileSubCommand === 'switch') {
+        if (profileSubCommand === 'list') {
+          const { listAuthProfiles } = require('../lib/auth/profile');
+          console.log(JSON.stringify(listAuthProfiles(buildTokenLoginOptions(authArgs.slice(1))), null, 2));
+        } else if (profileSubCommand === 'switch') {
           const target = getFirstPositionalArg(authArgs, 1);
           const { switchAuthProfile } = require('../lib/auth/profile');
           console.log(JSON.stringify(switchAuthProfile(target, buildTokenLoginOptions(authArgs)), null, 2));
@@ -731,6 +745,12 @@ async function main() {
       break;
     }
 
+    case 'app-entry': {
+      const { run } = require('../lib/app/app-entry');
+      await run(args);
+      break;
+    }
+
     case 'app-list': {
       const { run } = require('../lib/app/app-list');
       await run(args);
@@ -797,6 +817,12 @@ async function main() {
       break;
     }
 
+    case 'check-design': {
+      const { run } = require('../lib/design/check-design');
+      await run(args);
+      break;
+    }
+
     case 'er': {
       const { run } = require('../lib/app/er');
       await run(args);
@@ -1008,9 +1034,6 @@ async function main() {
     }
 
     case 'create-process': {
-      if (args.length < 2) {
-        throwCliUsage(t('cli.create_process_usage'), t('cli.create_process_example'));
-      }
       const { run: runCreateProcess } = require('../lib/process/create-process');
       await runCreateProcess(args);
       break;

package/lib/app/app-entry.js

@@ -0,0 +1,118 @@
+'use strict';
+
+const { createAuthRef, createYidaClient, unwrapYidaResponse } = require('../core/yida-client');
+const { t } = require('../core/i18n');
+const { throwUsage } = require('../core/command-errors');
+
+/** Keep complete runtime URLs; the server verifies tenant and resource ownership. */
+function normalizeUrl(value, appType) {
+  const input = String(value || '').trim();
+  if (!input) { throw new Error(t('app_entry.invalid_url')); }
+  // eslint-disable-next-line no-control-regex -- reject control characters in persisted URLs
+  if (input.length > 2048 || /[\\\s\x00-\x1f\x7f]/.test(input)) {
+    throw new Error(t('app_entry.invalid_url'));
+  }
+  const match = /^https?:\/\/[^/?#]+(\/[^?#]*)(?:\?([^#]*))?(?:#(.*))?$/i.exec(input);
+  if (!match) { throw new Error(t('app_entry.invalid_url')); }
+  const url = new URL(input);
+  const route = match[1];
+  const prefix = `/${appType}/`;
+  const parts = route.startsWith(prefix) ? route.slice(prefix.length).split('/') : [];
+  const short = /^\/(?:s\/[A-Za-z0-9_-]+|o\/[A-Za-z0-9_-]+(?:\/FORM-[A-Za-z0-9_-]+)?)$/.test(route);
+  const runtime = ['custom', 'workbench', 'submission', 'manage'].includes(parts[0]) &&
+    ((parts.length === 1 && parts[0] === 'workbench') ||
+      (parts.length === 2 && /^[A-Za-z0-9_-]+$/.test(parts[1])));
+  if (url.username || url.password || url.pathname !== route || (!short && !runtime)) {
+    throw new Error(t('app_entry.invalid_url'));
+  }
+  if (match[2] !== undefined) {
+    const seen = new Set();
+    for (const parameter of match[2].split('&')) {
+      const pair = /^(corpid|locale|viewUuid|processCode|hideLeftNav|noShowTopBottom)=([A-Za-z0-9_-]+)$/.exec(parameter);
+      if (!pair || seen.has(pair[1]) ||
+        (['hideLeftNav', 'noShowTopBottom'].includes(pair[1]) && !/^(true|false|y|n|0|1)$/.test(pair[2]))) {
+        throw new Error(t('app_entry.invalid_url'));
+      }
+      seen.add(pair[1]);
+    }
+  }
+  if (match[3] !== undefined && !/^[A-Za-z0-9_/-]+$/.test(match[3])) {
+    throw new Error(t('app_entry.invalid_url'));
+  }
+  return input;
+}
+
+/** Reject duplicate or ambiguous flags; omissions never clear stored entries. */
+function parseArgs(args) {
+  const [action, appType, ...flags] = args;
+  if (!['get', 'set'].includes(action) || !/^[A-Za-z0-9_-]+$/.test(appType || '')) {
+    throwUsage(t('app_entry.usage'));
+  }
+  const values = {};
+  for (let index = 0; index < flags.length; index++) {
+    const flag = flags[index];
+    if (flag === '--json') {
+      continue;
+    }
+    const match = /^--(clear-)?(frontend|management)$/.exec(flag);
+    if (action !== 'set' || !match || Object.prototype.hasOwnProperty.call(values, match[2])) {
+      throwUsage(t('app_entry.usage'));
+    }
+    const value = match[1] ? null : flags[++index];
+    if (value !== null && (!value || value.startsWith('--'))) {
+      throwUsage(t('app_entry.usage'));
+    }
+    values[match[2]] = value;
+  }
+  if (action === 'set' && !Object.keys(values).length) {
+    throwUsage(t('app_entry.usage'));
+  }
+  return { action, appType, values };
+}
+
+/** Read the revision used for a conditional partial write. */
+async function readEntries(client, appType) {
+  const result = unwrapYidaResponse(await client.get(`/${appType}/query/app/getAccessEntries.json`));
+  if (!result || typeof result.revision !== 'string' || !result.revision ||
+      !result.accessEntries || typeof result.accessEntries !== 'object' || Array.isArray(result.accessEntries)) {
+    throw new Error(t('app_entry.invalid_response'));
+  }
+  return result;
+}
+
+/** Persist only supplied entries and verify them through a separate read. */
+async function run(args = []) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(t('app_entry.usage'));
+    return;
+  }
+  const { action, appType, values } = parseArgs(args);
+  const authRef = createAuthRef();
+  const client = createYidaClient({ authRef });
+  const patch = {};
+  for (const [key, value] of Object.entries(values)) {
+    patch[key] = value === null ? null : { url: normalizeUrl(value, appType) };
+  }
+  let result = await readEntries(client, appType);
+  if (action === 'set') {
+    unwrapYidaResponse(await client.postForm(`/${appType}/query/app/saveAccessEntries.json`, {
+      accessEntries: JSON.stringify(patch), revision: result.revision,
+    }));
+    result = await readEntries(client, appType);
+    for (const [key, entry] of Object.entries(patch)) {
+      if ((result.accessEntries[key]?.url || '') !== (entry?.url || '')) {
+        throw new Error(t('app_entry.readback_failed'));
+      }
+    }
+  }
+  const urls = {};
+  for (const key of ['frontend', 'management']) {
+    if (result.accessEntries[key]?.url) {
+      urls[key] = normalizeUrl(result.accessEntries[key].url, appType);
+    }
+  }
+  console.log(JSON.stringify({ appType, ...result, urls }, null, 2));
+  return result;
+}
+
+module.exports = { run, parseArgs, normalizeUrl };

package/lib/app/app-list.js

@@ -6,13 +6,16 @@
  * 输出字段：
  *   appName    - 应用名称（zh_CN）
  *   appType    - 应用唯一标识
- *   systemLink - 应用访问地址
+ *   systemLink - 平台返回的应用访问地址
+ *   appUrl / workbenchUrl - 应用工作台地址
+ *   adminUrl   - 开发者管理后台地址（不表示已验证访问权限）
  */
 
 'use strict';
 
 const { createAuthRef, createYidaClient } = require('../core/yida-client');
 const { t } = require('../core/i18n');
+const { buildApplicationEntryUrls } = require('./application-entry-urls');
 const { throwCommandError, throwUsage } = require('../core/command-errors');
 
 const API_PATH = '/query/app/getAppList.json';
@@ -76,11 +79,13 @@ function parseArgs(args = []) {
 /**
  * 将应用原始数据提取为输出字段
  */
-function formatApp(app) {
+function formatApp(app, baseUrl) {
   return {
     appName: (app.appName && app.appName.zh_CN) || '',
     appType: app.appType || '',
     systemLink: app.systemLink || '',
+    ...(app.accessEntries ? { accessEntries: app.accessEntries } : {}),
+    ...buildApplicationEntryUrls({ appType: app.appType, systemLink: app.systemLink, baseUrl }),
   };
 }
 
@@ -141,7 +146,7 @@ async function run(args) {
   const totalCount = Number.isFinite(Number(content.totalCount)) ? Number(content.totalCount) : apps.length;
   const totalPages = Math.max(1, Math.ceil(totalCount / options.pageSize));
   const scopeLabel = t(`app_list.scope_${options.type}`);
-  const formattedApps = apps.map(formatApp);
+  const formattedApps = apps.map(app => formatApp(app, authRef.baseUrl));
 
   // stdout 输出 JSON，方便 AI 工具解析
   console.log(JSON.stringify(formattedApps, null, 2));

package/lib/app/application-entry-urls.js

@@ -0,0 +1,31 @@
+'use strict';
+
+// URLs derived by the CLI from a successful app result and its authenticated
+// base URL. Constructing a route does not verify the recipient's access rights.
+function buildApplicationEntryUrls({ appType, baseUrl, systemLink }) {
+  if (typeof appType !== 'string' || !/^APP_[A-Za-z0-9_-]+$/.test(appType)) { return {}; }
+  let origin;
+  const params = new URLSearchParams();
+  try {
+    const base = new URL(baseUrl);
+    if (!['https:', 'http:'].includes(base.protocol) || base.username || base.password) { return {}; }
+    origin = base.origin;
+  } catch { return {}; }
+  try {
+    if (systemLink) {
+      const app = new URL(systemLink, origin);
+      if (['https:', 'http:'].includes(app.protocol) && !app.username && !app.password && (app.pathname === `/${appType}` || app.pathname.startsWith(`/${appType}/`))) {
+        origin = app.origin;
+        for (const key of ['corpid', 'locale']) {
+          if (app.searchParams.has(key)) { params.set(key, app.searchParams.get(key)); }
+        }
+      }
+    }
+  } catch { /* Ignore malformed optional links; retain the authenticated base. */ }
+  const query = params.toString();
+  const suffix = query ? `?${query}` : '';
+  const workbenchUrl = `${origin}/${appType}/workbench${suffix}`;
+  return { appUrl: workbenchUrl, workbenchUrl, adminUrl: `${origin}/${appType}/admin${suffix}` };
+}
+
+module.exports = { buildApplicationEntryUrls };

package/lib/app/application-style.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+const { DESIGN_SKILL_ROOT, loadThemeIndex } = require('../design-plan/themes');
+const START = '/* OPENYIDA APPLICATION STYLE RECIPES START';
+const END = '/* OPENYIDA APPLICATION STYLE RECIPES END */';
+const CREATIVE_TOKENS = [
+  '--pod-page-bg-color', '--pod-card-bg-color', '--color-text1-4',
+  '--form-element-medium-corner', '--form-element-medium-height',
+  '--pod-page-footer-bg-color', '--pod-sticky-footer-box-shadow',
+  '--oyd-content-width', '--oyd-content-padding', '--oyd-field-gap',
+  '--oyd-heading-font', '--oyd-heading-size', '--oyd-rule-style',
+  '--pod-shell-theme-bg-color', '--pod-nav-item-text-color', '--pod-nav-item-text-hover-color',
+  '--pod-nav-item-text-selected-color', '--pod-nav-menu-bg-hover-color', '--pod-nav-menu-bg-selected-color',
+];
+
+function validateCreativeDirection(direction, tokens) {
+  const missing = ['businessRationale', 'composition', 'typography', 'material', 'formLayout']
+    .filter(key => typeof direction?.[key] !== 'string' || !direction[key].trim());
+  missing.push(...CREATIVE_TOKENS.filter(key => typeof tokens?.[key] !== 'string' || !tokens[key].trim()));
+  if (missing.length) {
+    throw new CliError(t('design_document.invalid', 'creativeDirection', missing.join(', ')), {
+      code: 'APPLICATION_STYLE_CREATIVE_INCOMPLETE', details: { missing },
+    });
+  }
+}
+
+function applyApplicationStyle(css, metadata, tokens) {
+  const style = metadata.applicationStyle;
+  if (style && (style.recipe !== 'application-style-v1' || !['template', 'creative'].includes(style.mode))) {
+    throw new CliError(t('design_document.invalid', 'applicationStyle', 'APPLICATION_STYLE_INVALID'), { code: 'APPLICATION_STYLE_INVALID' });
+  }
+  if (style?.mode === 'creative') {validateCreativeDirection(metadata.creativeDirection, tokens);}
+  const first = css.indexOf(START);
+  const last = css.indexOf(END);
+  if (first >= 0 && last < first) {
+    throw new CliError(t('design_document.invalid', 'app_theme.css', 'APPLICATION_STYLE_CSS_INVALID'), { code: 'APPLICATION_STYLE_CSS_INVALID' });
+  }
+  const recipe = style
+    ? fs.readFileSync(path.join(DESIGN_SKILL_ROOT, 'references/theme/application-style-recipes.css'), 'utf8').trim()
+    : '';
+  // Only the managed recipe block is replaced. User-authored rules stay intact.
+  if (first >= 0) {return css.slice(0, first) + recipe + css.slice(last + END.length);}
+  return recipe ? `${css.trimEnd()}\n\n${recipe}\n` : css;
+}
+
+function exportApplicationStyle(id, outputDirectory) {
+  const theme = loadThemeIndex().themes.find(item => item.themeId === id);
+  if (!theme) {throw new CliError(t('design_document.invalid', id || '--style-id', 'APPLICATION_STYLE_UNKNOWN'), { code: 'APPLICATION_STYLE_UNKNOWN' });}
+  const directory = path.resolve(outputDirectory);
+  const assets = [['design.md', theme.templatePath], ['app_theme.css', theme.cssTemplatePath], ['form-layout.json', theme.formLayoutPath]];
+  const outputs = assets.map(([name, relative]) => {
+    const source = path.resolve(DESIGN_SKILL_ROOT, relative);
+    const target = path.join(directory, name);
+    const root = path.resolve(DESIGN_SKILL_ROOT, 'templates/design-themes') + path.sep;
+    if (!source.startsWith(root) || fs.existsSync(target)) {
+      throw new CliError(t('design_document.invalid', target, 'APPLICATION_STYLE_OUTPUT_CONFLICT'), { code: 'APPLICATION_STYLE_OUTPUT_CONFLICT' });
+    }
+    return { source, target, content: fs.readFileSync(source, 'utf8') };
+  });
+  fs.mkdirSync(directory, { recursive: true });
+  for (const item of outputs) {fs.writeFileSync(item.target, item.content, { flag: 'wx' });}
+  return { success: true, mode: theme.mode, themeId: id, authoringRequired: true, outputs: outputs.map(item => item.target) };
+}
+
+module.exports = { applyApplicationStyle, validateCreativeDirection, CREATIVE_TOKENS, exportApplicationStyle };

package/lib/app/canvas-compile.js

@@ -49,7 +49,12 @@ const {
   formatFormDetailLinkMessage,
 } = require('./form-detail-link-guard');
 const { t } = require('../core/i18n');
+const { assertFormDataResponse } = require('./form-data-response-guard');
 const { assertInlineCssStructure } = require('./inline-css-guard');
+const { assertCanvasThemeStructure } = require('./canvas-theme-guard');
+const { assertCanvasIconExports } = require('./canvas-icon-guard');
+const { assertCanvasNavigationStructure } = require('./canvas-navigation-guard');
+const { assertCanvasNavigationPaths } = require('./canvas-path-guard');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -936,37 +941,42 @@ function compileCanvasLocal(source, options = {}) {
       },
     });
   }
-  const directFormOpenIssues = findDirectFormOpenIssues(source);
-  if (directFormOpenIssues.length > 0) {
-    const firstIssue = directFormOpenIssues[0];
-    throw new CliError(formatDirectFormOpenMessage(), {
-      code: 'OPENYIDA_CANVAS_FORM_OPEN_CONTAINER_REQUIRED',
+  const formDetailLinkIssues = findFormDetailLinkIssues(source);
+  if (formDetailLinkIssues.length > 0) {
+    const firstIssue = formDetailLinkIssues[0];
+    throw new CliError(formatFormDetailLinkMessage(firstIssue), {
+      code: 'OPENYIDA_CANVAS_FORM_DETAIL_LINK_INVALID',
       details: {
         stage: 'canvas_compile',
         sourcePath: options.sourcePath || '',
         line: firstIssue.line,
-        callee: firstIssue.callee,
+        issueType: firstIssue.type,
       },
     });
   }
-  const formDetailLinkIssues = findFormDetailLinkIssues(source);
-  if (formDetailLinkIssues.length > 0) {
-    const firstIssue = formDetailLinkIssues[0];
-    throw new CliError(formatFormDetailLinkMessage(firstIssue), {
-      code: 'OPENYIDA_CANVAS_FORM_DETAIL_LINK_INVALID',
+  const directFormOpenIssues = findDirectFormOpenIssues(source);
+  if (directFormOpenIssues.length > 0) {
+    const firstIssue = directFormOpenIssues[0];
+    throw new CliError(formatDirectFormOpenMessage(), {
+      code: 'OPENYIDA_CANVAS_FORM_OPEN_CONTAINER_REQUIRED',
       details: {
         stage: 'canvas_compile',
         sourcePath: options.sourcePath || '',
         line: firstIssue.line,
-        issueType: firstIssue.type,
+        callee: firstIssue.callee,
       },
     });
   }
+  assertFormDataResponse(source, options);
   assertNoUnavailableCanvasInstanceApis(source, options);
   assertNoSelfReferentialDependencyBindings(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
+  assertCanvasIconExports(source, options);
+  assertCanvasNavigationStructure(source, options);
+  assertCanvasNavigationPaths(source, options);
   assertInlineCssStructure(source, options);
+  assertCanvasThemeStructure(source, options);
 
   const importedModules = extractImportedModules(source);