openyida 2026.9.24-beta.0 → 2026.9.24

package/README.md

@@ -74,17 +74,10 @@ openyida login
 
 OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the user auth store when available. If the user auth store is not writable, OpenYida explicitly falls back to the current project cache and reports that narrower persistence scope.
 
-In a sandbox, headless shell, or CI dashboard where the loopback callback cannot complete, use the device authorization flow. Open the displayed verification URL on any device and enter the user code. `--env-hint` optionally pins the intended environment profile at authorization time:
-
-```bash
-openyida login --device
-openyida login --device --env-hint pre
-```
-
 When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and auth profile. For example:
 
 ```bash
-openyida login https://<your-yida-entry-url>/
+openyida login https://yida-group.alibaba-inc.com/
 openyida login --alibaba
 ```
 
@@ -390,7 +383,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
 | `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |

package/bin/yida.js

@@ -193,7 +193,6 @@ function printLoginResult(result) {
 
   if (!result) {
     console.log(JSON.stringify({
-      type: 'login_result',
       ok: false,
       status: 'login_failed',
       can_auto_use: false,
@@ -206,7 +205,6 @@ function printLoginResult(result) {
     ? !!result.ok
     : (result.can_auto_use !== false && !!result.access_token);
   const summary = {
-    type: 'login_result',
     ok: tokenUsable,
     status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
     auth_mode: 'token',
@@ -281,7 +279,6 @@ function getFirstPositionalArg(cliArgs, startIndex = 0) {
     '--login-url',
     '--profile',
     '--user-id',
-    '--env-hint',
   ]);
   for (let index = startIndex; index < cliArgs.length; index++) {
     const arg = cliArgs[index];
@@ -389,7 +386,6 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--client-id',
     '--profile',
     '--user-id',
-    '--env-hint',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -541,23 +537,13 @@ function printLoginHelp() {
 }
 
 function buildTokenLoginOptions(loginArgs) {
-  const device = loginArgs.includes('--device');
   return {
     clientId: getArgValue(loginArgs, '--client-id'),
     corpId: getArgValue(loginArgs, '--corp-id'),
     userId: getArgValue(loginArgs, '--user-id'),
     authProfile: getArgValue(loginArgs, '--profile'),
     quiet: process.env.YIDA_QUIET === '1' || loginArgs.includes('--quiet'),
-    noBrowser: device || loginArgs.includes('--no-browser'),
-    device,
-    envHint: getArgValue(loginArgs, '--env-hint'),
-    // Machine-readable progress events for agent runtimes (sandbox browsers,
-    // CI dashboards). Emits one JSON line per state transition.
-    onDeviceState: (state) => {
-      if (device) {
-        process.stdout.write(JSON.stringify({ type: 'device_login_state', ...state }) + '\n');
-      }
-    },
+    noBrowser: loginArgs.includes('--no-browser'),
   };
 }
 

package/lib/app/application-entry-urls.js

@@ -28,4 +28,30 @@ function buildApplicationEntryUrls({ appType, baseUrl, systemLink }) {
   return { appUrl: workbenchUrl, workbenchUrl, adminUrl: `${origin}/${appType}/admin${suffix}` };
 }
 
-module.exports = { buildApplicationEntryUrls };
+function readRenderNav(config) {
+  const value = config && Object.prototype.hasOwnProperty.call(config, 'renderNav')
+    ? config.renderNav : config?.isRenderNav;
+  if (value === false || value === 'false') {return false;}
+  if (value === true || value === 'true') {return true;}
+  return null;
+}
+
+function buildDisplayPageEntryUrls({ appType, formUuid, baseUrl, config, formType = config?.formType }) {
+  if (formType !== 'display' || !/^FORM[-_][A-Za-z0-9_-]+$/.test(formUuid || '')) {return {};}
+  if (config?.formType && config.formType !== 'display') {return {};}
+  if ((config?.appType && config.appType !== appType) || (config?.formUuid && config.formUuid !== formUuid)) {return {};}
+  const appUrls = buildApplicationEntryUrls({ appType, baseUrl });
+  if (!appUrls.workbenchUrl) {return {};}
+  const origin = new URL(appUrls.workbenchUrl).origin;
+  const renderNav = readRenderNav(config);
+  const workbenchUrl = `${origin}/${appType}/workbench/${formUuid}`;
+  const standaloneUrl = renderNav === false ? `${origin}/${appType}/custom/${formUuid}` : null;
+  return {
+    url: standaloneUrl || workbenchUrl,
+    workbenchUrl,
+    standaloneUrl,
+    navigationVerification: { renderNav, verified: renderNav !== null },
+  };
+}
+
+module.exports = { buildApplicationEntryUrls, buildDisplayPageEntryUrls, readRenderNav };

package/lib/app/create-page.js

@@ -20,6 +20,7 @@ const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff
 const { throwCommandError } = require('../core/command-errors');
 const { buildApiPath } = require('./create-form/api-path');
 const { fetchFormSchemaInfo } = require('./get-form-config');
+const { readRenderNav, buildDisplayPageEntryUrls } = require('./application-entry-urls');
 
 function parseArgs(args) {
   const openOption = parseOpenOption(args);
@@ -138,14 +139,6 @@ function buildPageInfoPostData(formUuid, pageName, isRenderNav, csrfToken, curre
   return querystring.stringify(payload);
 }
 
-function readRenderNav(config) {
-  const value = config && Object.prototype.hasOwnProperty.call(config, 'renderNav')
-    ? config.renderNav : config?.isRenderNav;
-  if (value === false || value === 'false') {return false;}
-  if (value === true || value === 'true') {return true;}
-  return null;
-}
-
 async function configureNavigationVisibility(authRef, appType, pageId, pageName, isRenderNav) {
   const verification = { requestedRenderNav: isRenderNav, renderNav: null, verified: false, attempts: 0 };
   let currentConfig = null;
@@ -268,7 +261,10 @@ async function run(args) {
       navigationVerification = await configureNavigationVisibility(authRef, appType, pageId, pageName, false);
       if (navigationVerification.verified) {
         chalkSuccess(t('create_page.dashboard_config_ok'));
-        pageUrl = `${authRef.baseUrl}/${appType}/custom/${pageId}?isRenderNav=false`;
+        pageUrl = buildDisplayPageEntryUrls({
+          appType, formUuid: pageId, baseUrl: authRef.baseUrl,
+          config: { formType: 'display', renderNav: navigationVerification.renderNav },
+        }).standaloneUrl;
       } else {
         dashboardConfigWarning = navigationVerification.error;
         warn(t('create_page.dashboard_config_failed', dashboardConfigWarning));

package/lib/app/get-form-config.js

@@ -21,6 +21,7 @@ const {
 const { t } = require('../core/i18n');
 const { banner, step, label, info, success, error, result } = require('../core/chalk');
 const { throwCommandError } = require('../core/command-errors');
+const { buildDisplayPageEntryUrls } = require('./application-entry-urls');
 
 // 常用配置字段白名单（人读摘要），--json 会输出完整对象
 const SUMMARY_FIELDS = [
@@ -121,6 +122,9 @@ async function run(args) {
   }
 
   const cfg = resp.content || resp.result || resp.data || {};
+  const entryUrls = buildDisplayPageEntryUrls({
+    appType: parsed.appType, formUuid: parsed.formUuid, baseUrl: authRef.baseUrl, config: cfg,
+  });
   success(t('get_form_config.read_ok'));
 
   if (parsed.json) {
@@ -129,6 +133,7 @@ async function run(args) {
       appType: parsed.appType,
       formUuid: parsed.formUuid,
       config: cfg,
+      ...entryUrls,
     }, null, 2));
     return;
   }
@@ -138,6 +143,7 @@ async function run(args) {
     appType: parsed.appType,
     formUuid: parsed.formUuid,
     title: extractTitle(cfg.title),
+    ...entryUrls,
   };
   SUMMARY_FIELDS.forEach((key) => {
     if (cfg[key] !== undefined) {

package/lib/app/publish.js

@@ -37,6 +37,8 @@ const { buildPageFile, shouldBuildPageSource } = require('./page-compat');
 const { warnLargePageSource } = require('./page-size-guard');
 const { assertPageTemplateCustomized } = require('./page-template-guard');
 const { fetchFormPageList } = require('./form-navigation');
+const { fetchFormSchemaInfo } = require('./get-form-config');
+const { buildDisplayPageEntryUrls } = require('./application-entry-urls');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { assertNoEmojiInValue } = require('../core/no-emoji-guard');
 const { loadPageSource } = require('./services/page-source-loader');
@@ -834,7 +836,22 @@ async function runMain(argv) {
 
   baseUrl = authRef.baseUrl || baseUrl;
 
-  const pageUrl = `${baseUrl}/${appType}/workbench/${savedFormUuid}`;
+  let pageConfig = null;
+  let navigationWarning = null;
+  try {
+    const configResponse = await fetchFormSchemaInfo(authRef, appType, savedFormUuid);
+    if (!configResponse || configResponse.success === false || configResponse.__needLogin || configResponse.__csrfExpired) {
+      throw new Error(configResponse?.errorMsg || t('common.request_failed'));
+    }
+    pageConfig = configResponse.content || configResponse.result || configResponse.data || {};
+  } catch (configError) {
+    navigationWarning = configError.message || t('common.request_failed');
+  }
+  const entryUrls = buildDisplayPageEntryUrls({
+    appType, formUuid: savedFormUuid, baseUrl: authRef.baseUrl || baseUrl,
+    config: pageConfig, formType: 'display',
+  });
+  const pageUrl = entryUrls.url || `${baseUrl}/${appType}/workbench/${savedFormUuid}`;
   const publishMode = isCanvas ? 'canvas' : 'native';
   let healthCheckResult = null;
   let navOrderResult = null;
@@ -911,6 +928,8 @@ async function runMain(argv) {
       formUuid: savedFormUuid,
       version,
       url: pageUrl,
+      ...entryUrls,
+      navigationWarning,
       publishMode,
       storageMode,
       bundleId,

package/lib/auth/token-auth.js

@@ -83,27 +83,11 @@ function resolveDingtalkLoginOrigin(options = {}) {
   return DINGTALK_LOGIN_ORIGIN;
 }
 
-function requestJson(method, url, body, headers = {}, options = {}) {
+function requestJson(method, url, body, headers = {}) {
   return new Promise((resolve, reject) => {
     const parsedUrl = new URL(url);
     const data = body === undefined || body === null ? null : Buffer.from(JSON.stringify(body));
     const transport = parsedUrl.protocol === 'https:' ? https : http;
-    const socketTimeoutMs = positiveNumber(options.timeoutMs, 0);
-    let timeoutId = null;
-    let settled = false;
-    const finish = (callback, value) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      if (timeoutId) {
-        clearTimeout(timeoutId);
-      }
-      callback(value);
-    };
-    const resolveOnce = value => finish(resolve, value);
-    const rejectOnce = error => finish(reject, error);
-
     const request = transport.request({
       method,
       protocol: parsedUrl.protocol,
@@ -121,7 +105,6 @@ function requestJson(method, url, body, headers = {}, options = {}) {
     }, (response) => {
       const chunks = [];
       response.on('data', (chunk) => chunks.push(chunk));
-      response.on('error', rejectOnce);
       response.on('end', () => {
         const text = Buffer.concat(chunks).toString('utf8');
         let payload = null;
@@ -142,26 +125,14 @@ function requestJson(method, url, body, headers = {}, options = {}) {
           error.payload = payload;
           error.headers = response.headers;
           error.location = location;
-          rejectOnce(error);
+          reject(error);
           return;
         }
-        resolveOnce(payload || {});
+        resolve(payload || {});
       });
     });
 
-    if (socketTimeoutMs > 0) {
-      // Node's socket timeout is reset by network activity, so it cannot enforce
-      // the caller's wall-clock budget. Use an independent timer that also
-      // covers response bodies which trickle data without ever completing.
-      timeoutId = setTimeout(() => {
-        const error = new Error('request timed out');
-        error.code = 'request_timeout';
-        rejectOnce(error);
-        request.destroy(error);
-      }, socketTimeoutMs);
-    }
-
-    request.on('error', rejectOnce);
+    request.on('error', reject);
     if (data) {
       request.write(data);
     }
@@ -169,11 +140,6 @@ function requestJson(method, url, body, headers = {}, options = {}) {
   });
 }
 
-function positiveNumber(value, fallback) {
-  const parsed = Number(value);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-
 function sanitizeRawTokenResponse(response) {
   if (!response || typeof response !== 'object') {
     return response;
@@ -336,43 +302,25 @@ async function tokenLogin(options = {}) {
   const baseUrl = resolveTokenBaseUrl(options);
   const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
-  const scope = options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid';
-
-  let response;
-  if (options.device) {
-    // Device Authorization Grant (RFC 8628): sandbox / headless login.
-    const { runDeviceCodeFlow } = require('./oauth-device');
-    response = await runDeviceCodeFlow({
-      authBaseUrl,
-      clientId,
-      scope,
-      envHint: options.envHint,
-      quiet: options.quiet,
-      onState: options.onDeviceState,
-      timeoutMs: options.timeoutMs || env.OPENYIDA_OAUTH_TIMEOUT_MS,
-    });
-    requireOkResponse(response);
-  } else {
-    const callback = await runDingtalkLoopback({
-      clientId,
-      loginOrigin: resolveDingtalkLoginOrigin(options),
-      scope,
-      prompt: options.prompt,
-      port: options.port,
-      quiet: options.quiet,
-      noBrowser: options.noBrowser,
-      timeoutMs: options.timeoutMs,
-    });
+  const callback = await runDingtalkLoopback({
+    clientId,
+    loginOrigin: resolveDingtalkLoginOrigin(options),
+    scope: options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid',
+    prompt: options.prompt,
+    port: options.port,
+    quiet: options.quiet,
+    noBrowser: options.noBrowser,
+    timeoutMs: options.timeoutMs,
+  });
 
-    response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
-      code: callback.code,
-      authCode: callback.authCode,
-      redirectUri: callback.redirectUri,
-      state: callback.state,
-      clientId,
-    });
-    requireOkResponse(response);
-  }
+  const response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
+    code: callback.code,
+    authCode: callback.authCode,
+    redirectUri: callback.redirectUri,
+    state: callback.state,
+    clientId,
+  });
+  requireOkResponse(response);
 
   const normalized = normalizeTokenResponse(response, baseUrl, clientId);
   if (!normalized.access_token) {
@@ -676,5 +624,4 @@ module.exports = {
   resolveTokenBaseUrl,
   isRefreshAuthRequired,
   createTokenRefreshFailedError,
-  getTokenPayload,
 };

package/lib/core/agent-capabilities.js

@@ -499,6 +499,7 @@ function buildApplicationEntryPolicy(builderPath, env = process.env) {
     delivery_unit: 'single_application_entry_group',
     resource_delivery: 'summary_only',
     internal_artifact_delivery: 'never',
+    frontend_delivery: 'Infer standalone for a scoped service frontend, persist page navigation hiding and return the verified publish/get-form-config standaloneUrl. No extra flag or navigation URL parameter. Missing verification is incomplete delivery; never silently omit the frontend or replace it with workbench/admin.',
     entries: {
       workbench: 'when_workspace_in_scope',
       custom: 'when_entry_mode_standalone_and_is_render_nav_false_readback',

package/lib/core/command-manifest.js

@@ -1035,7 +1035,7 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]', 'help.cmd_login', {
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', {
         requiresLogin: false,
         output: 'json',
       }),
@@ -1311,7 +1311,10 @@ const COMMAND_GROUPS = [
           'openyida create-form create APP_XXX "访客登记" .cache/openyida/visitor/fields.json --layout section --theme comfortable --label-align left --icon name-card --locale zh_CN --no-open',
           'openyida commands build create-form.create --app-type APP_XXX --form-title "访客登记" --fields-json-file .cache/openyida/visitor/fields.json --layout section --theme comfortable --label-align left --locale zh_CN --no-open --json',
         ],
-        notes: ['Divider accepts the 23 visible platform styles (none is excluded) through field JSON dividerType, not a CLI flag. Omission falls back to bold-with-thin; invalid supplied styles fail. Choose per business page and keep same-level sections consistent; see summary.core_workflows.full_app_build.divider_style_contract.'],
+        notes: [
+          'Divider accepts the 23 visible platform styles (none is excluded) through field JSON dividerType, not a CLI flag. Omission falls back to bold-with-thin; invalid supplied styles fail. Choose per business page and keep same-level sections consistent; see summary.core_workflows.full_app_build.divider_style_contract.',
+          'Divider colorType defaults to theme. If default bindings are unsuitable for the current theme, use custom with backgroundColor, secondaryColor and titleColor designed together; explicit user color values are not required. These are field JSON properties, not CLI flags. Dark-content and composite-title guidance is advisory, not a new validation or upload/save gate.',
+        ],
       }),
       command('create-form.icons', ['create-form', 'icons'], 'create-form icons [--json]', 'help.cmd_list_form_icons', {
         requiresLogin: false,
@@ -1437,7 +1440,7 @@ const COMMAND_GROUPS = [
           { name: 'noOpen', type: 'boolean', source: 'option', builder_options: ['--no-open'] },
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
         ],
-        notes: ['Canvas publishing runs the same theme and form-open-container structure checks as compile before login or remote writes. --force does not bypass Canvas compilation checks. --health-check verifies saved content; inspect the actual page for runtime behavior. Fixed brand overrides are preserved with structured warnings by default. --strict-theme blocks them; --allow-fixed-brand conflicts with --strict-theme and --fix-theme. --fix-theme requires the migrated controls to be inside a mounted CanvasThemeProvider and compiles before writing. Unproven dynamic render paths require manual migration. No stdin prompts.'],
+        notes: ['Canvas publishing runs the same theme and form-open-container structure checks as compile before login or remote writes. --force does not bypass Canvas compilation checks. --health-check verifies saved content; inspect the actual page for runtime behavior. Fixed brand overrides are preserved with structured warnings by default. --strict-theme blocks them; --allow-fixed-brand conflicts with --strict-theme and --fix-theme. --fix-theme requires the migrated controls to be inside a mounted CanvasThemeProvider and compiles before writing. Unproven dynamic render paths require manual migration. No stdin prompts.', 'Publishing reads persisted page navigation by default without a new flag. With renderNav=false, url and standaloneUrl use the clean /custom/<formUuid> route, with no navigation query parameters; workbenchUrl remains available. Unknown or visible navigation returns standaloneUrl=null; inspect navigationVerification and navigationWarning. A navigation read failure does not undo publication or prove standalone readiness. Configure scoped service frontend pages persistently before publishing; get-form-config can recover the verified URL without republishing.'],
       }),
       command('update-form-config', ['update-form-config'], 'update-form-config <appType> <formUuid> <true|false|keep> "<title>" [--locale zh_CN|en_US|ja_JP]', 'help.cmd_update_form_config', {
         args: [
@@ -1456,7 +1459,7 @@ const COMMAND_GROUPS = [
           { name: 'formUuid', type: 'string', source: 'positional', position: 1, required: true },
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
         ],
-        notes: ['Navigation readback uses renderNav first, falling back to isRenderNav only when renderNav is absent. true/false booleans and strings are recognized; missing or invalid values remain unknown. --json includes the raw configuration; the default summary preserves both navigation fields when present.'],
+        notes: ['Navigation readback uses renderNav first, falling back to isRenderNav only when renderNav is absent. true/false booleans and strings are recognized; missing or invalid values remain unknown. --json includes the raw configuration; the default summary preserves both navigation fields when present. For a confirmed display page, both outputs include url, workbenchUrl, standaloneUrl and navigationVerification. Only persisted renderNav=false returns a clean custom standaloneUrl; visible or unknown navigation returns standaloneUrl=null. Route construction does not verify publication or viewer permissions.'],
       }),
     ],
   },
@@ -1829,6 +1832,29 @@ function summarizeLocalizedCommands(commands) {
           fallback: DEFAULT_DIVIDER_TYPE,
           selection: 'Choose by each page business task and visual weight; keep same-level sections consistent within a page. Prefer suitable variation across different business pages. If the scene is unclear or suitable candidates tie, shuffle compatible candidates and rotate across pages, preferring unused styles until exhausted. Record one choice per page in design.md and dividerType before compilation; retries reuse it. Preserve existing supported styles for local edits.',
           invalid_input: 'INVALID_DIVIDER_TYPE diagnostics; create rejects with CREATE_FORM_INVALID_DIVIDER_TYPE. Never silently replace a supplied unsupported style.',
+          color_guidance: {
+            reference: 'yida-skills/skills/yida-design/references/native-form-styles.md#分割线弱背景',
+            mode: 'agent_design_guidance_only',
+            default_mode: 'theme',
+            custom_mode: 'custom',
+            inputs: ['colorType', 'backgroundColor', 'secondaryColor', 'titleColor'],
+            input_location: 'Field JSON for create/batch; changes for update; props in field-props operations for patch. Not CLI flags.',
+            schema_paths: ['Divider.props.colorType', 'Divider.props.backgroundColor', 'Divider.props.secondaryColor', 'Divider.props.titleColor'],
+            default_bindings: {
+              primary: 'var(--color-brand1-6)',
+              secondary: 'var(--color-brand1-2)',
+              text: 'var(--color-text1-4, #171a1d)',
+            },
+            custom_when: 'The user requests colors, or default bindings do not suit the current theme, visual weight or readability. Design all three colors together; do not require user-specified values for each color. Reuse colors across peer sections.',
+            dark_content: 'Distinguish dark content from dark navigation with light content. Treat brand1-2 as a weak brand surface, not permanently near-white. Root secondary overrides may lose to inline component bindings. For local repairs, prefer component colors when global changes would affect other consumers.',
+            composite_titles: 'Consider outer decoration, the actual title surface and the title separately. In inner-ellipse-title the inner ellipse carries the text. Preserve existing supported shapes; do not dim the whole component to fix its background.',
+            solid_title_surfaces: 'For dark-bar and light-left-title/light-center-title/light-house-title/light-hexagon-title, distinguish the primary-colored title block from the secondary strip. Prefer white or near-white on sufficiently dark primary surfaces; if a bright saturated fill weakens white text, deepen the component backgroundColor while preserving its hue. Do not force white onto pale surfaces. Set titleColor explicitly in custom mode instead of retaining its dark default; do not change global body text to fix a local title.',
+            label_coordination: 'Design the divider title, first field label and input as a group. Share font family; use modest title weight/size emphasis, readable neutral labels, coordinated alignment and spacing. Preserve centered decorative headings without centering field labels. Keep the section gap larger than the title-to-first-field gap, and label-to-input spacing compact. Do not dim labels to create hierarchy or repeat excessive saturated decoration. The label role pod-form-label-color is separate from divider titleColor; record choices in existing design.md without new flags or blocking checks.',
+            picker_icons: '--color-fill1-6 is a weak foreground for picker icons; choose a readable auxiliary foreground against the actual input surface, for example the current theme color-text1-3.',
+            lifecycle: 'Record the choice in existing design.md. Revisit custom colors when changing themes; they do not automatically follow theme switching. Do not claim visual verification from a successful command or when preview is unavailable.',
+            new_cli_flags: false,
+            adds_validation_or_blocking: false,
+          },
         },
         page_skill_policy: 'Use YidaCodeCanvas by default for new primary custom pages. Choose yida-custom-page only when the current target has been identified as existing .oyd.jsx/.oyb.jsx/renderJsx/platform Jsx component maintenance; do not switch to yida-custom-page merely because a page needs data, forms, uploads, this.utils.yida.*, or dataSourceMap-like capabilities.',
         form_entry_policy: {
@@ -1904,6 +1930,8 @@ function summarizeLocalizedCommands(commands) {
           custom: {
             include: 'when_entry_mode_standalone_and_is_render_nav_false_readback',
             url: '{base_url}/{appType}/custom/{formUuid}',
+            default_policy: 'A scoped service frontend is a standalone display page even when entryMode was omitted. Plan derives it from role=service and sceneKey; Fast follows the same business intent. Persist page navigation hiding and read it back, without a new flag or navigation URL query. Preserve explicit user choices and backend navigation. Missing verification is incomplete frontend delivery, not permission to silently omit it.',
+            url_source: 'publish.standaloneUrl or post-publish get-form-config.standaloneUrl; require navigationVerification.renderNav=false and verified=true',
           },
           admin: {
             include: 'default_for_complete_application',

package/lib/core/locales/en.js

@@ -382,8 +382,8 @@ Examples:
     save_permission_usage: 'Usage: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>]',
     save_permission_example: "Example: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ Execution failed: {0}',
-    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--device] [--env-hint <name>] [--check-only] [--json] [--client-id <clientId>]',
-    login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --device                # Use device authorization in a headless environment\n  openyida login --device --env-hint pre # Pin device authorization to an environment profile\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
+    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
     login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
     auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
     auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
@@ -655,18 +655,6 @@ Examples:
     oauth_success_message: 'Sign-in is complete. Return to the previous window to continue.',
     oauth_closing: 'Closing this window automatically…',
     oauth_manual_close: 'This window could not close automatically. Close it manually, then return to the previous window to continue.',
-    device_title: 'Device code login:',
-    device_open: 'Open',
-    device_enter_code: 'Enter code:',
-    device_or_direct: 'Or open directly:',
-    device_completed: 'Device authorization completed.',
-    device_timeout: 'device authorization timed out; device code may still be pending',
-    device_missing_params: 'device code flow requires authBaseUrl and clientId',
-    device_poll_missing_params: 'device token polling requires authBaseUrl, clientId and deviceCode',
-    device_invalid_code_response: 'auth service did not return a usable device code',
-    device_code_expired: 'device code expired; run login --device again',
-    device_access_denied: 'authorization was denied on the verification page',
-    device_2xx_no_token: 'auth service returned 2xx without accessToken',
     oauth_failure_title: 'Sign-in not completed',
     oauth_invalid_state: 'The sign-in request could not be verified. Return to the terminal and try again.',
     oauth_missing_code: 'No authorization information was received. Return to the terminal and try again.',

package/lib/core/locales/zh.js

@@ -382,8 +382,8 @@ openyida - 宜搭命令行工具
     save_permission_usage: '用法: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>]',
     save_permission_example: "示例: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ 执行失败: {0}',
-    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--device] [--env-hint <name>] [--check-only] [--json] [--client-id <clientId>]',
-    login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --device                # 在无浏览器或沙箱环境使用设备授权登录\n  openyida login --device --env-hint pre # 将设备授权限定到指定环境 profile\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
+    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
     login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；env token 模式下只读取 OPENYIDA_* token。',
     first_run_title: '  🤖 OpenYida - AI 问答模式已开启！                         ',
     first_run_welcome: '  {0}欢迎首次使用 OpenYida！{1} 以下是快速上手指南：',
@@ -626,18 +626,6 @@ openyida - 宜搭命令行工具
     oauth_success_message: '登录已完成，请返回刚才的窗口继续操作。',
     oauth_closing: '正在自动关闭此窗口…',
     oauth_manual_close: '此窗口未能自动关闭，请手动关闭后返回刚才的窗口继续操作。',
-    device_title: '设备码登录：',
-    device_open: '打开',
-    device_enter_code: '输入验证码：',
-    device_or_direct: '或直接打开：',
-    device_completed: '设备授权完成。',
-    device_timeout: '设备授权超时；设备码可能仍在等待验证',
-    device_missing_params: '设备码流程需要 authBaseUrl 和 clientId',
-    device_poll_missing_params: '设备令牌轮询需要 authBaseUrl、clientId 和 deviceCode',
-    device_invalid_code_response: '认证服务未返回可用的设备码',
-    device_code_expired: '设备码已过期；请重新执行 login --device',
-    device_access_denied: '授权已在验证页面被拒绝',
-    device_2xx_no_token: '认证服务返回 2xx 但未包含 accessToken',
     oauth_failure_title: '登录未完成',
     oauth_invalid_state: '登录验证信息无效，请返回终端重新发起登录。',
     oauth_missing_code: '未收到登录授权信息，请返回终端重新发起登录。',

package/lib/design-plan/entry-navigation.js

@@ -16,6 +16,15 @@ const assert = (condition, message, details) => {
 };
 
 // Resource names are planning references. Runtime IDs and permissions are resolved after creation.
+function resolvePageEntryMode(page, plan, { sceneKey, customNavigation }) {
+  const supplied = page.pageSpecHandoff || {};
+  const entries = plan.execution?.entryRecommendation?.entries;
+  const servicePage = Array.isArray(entries) && entries.some(entry =>
+    entry?.role === 'service' && filled(entry.sceneKey) && entry.sceneKey === sceneKey);
+  return supplied.entryMode || page.entryMode ||
+    (servicePage || customNavigation || supplied.navigation ? 'standalone' : 'platform-shell');
+}
+
 function buildEntryNavigation(plan, resources, pages) {
   const recommendation = plan.execution?.entryRecommendation;
   if (recommendation === undefined) {return null;}
@@ -94,4 +103,4 @@ function buildEntryNavigation(plan, resources, pages) {
   return { recommendation: JSON.parse(JSON.stringify(recommendation)), platformOrder: [...new Set(platformOrder)] };
 }
 
-module.exports = { buildEntryNavigation, ENTRY_MODES, ENTRY_MODE_SUMMARIES };
+module.exports = { buildEntryNavigation, resolvePageEntryMode, ENTRY_MODES, ENTRY_MODE_SUMMARIES };

package/lib/design-plan/materialize.js

@@ -9,7 +9,7 @@ const { normalizePlan, assertThemeProfile } = require('./normalize');
 const { readJson, writeFiles } = require('./files');
 const { prepareUpdates } = require('./artifact-updates');
 const { validateAuthoring } = require('./validate');
-const { buildEntryNavigation, ENTRY_MODE_SUMMARIES } = require('./entry-navigation');
+const { buildEntryNavigation, resolvePageEntryMode, ENTRY_MODE_SUMMARIES } = require('./entry-navigation');
 const { buildPageNavigationPolicy } = require('./navigation-policy');
 const { buildAssetTasks } = require('../asset/asset-plan');
 const { mergeParts } = require('./parallel');
@@ -216,7 +216,7 @@ function pageHandoff(page, plan) {
     detail: 'detail-profile', landing: 'official-homepage', screen: 'data-screen',
   };
   const customNavigation = navigationConfig(plan).navigationType === 'custom';
-  const entryMode = supplied.entryMode || page.entryMode || (customNavigation || supplied.navigation ? 'standalone' : 'platform-shell');
+  const entryMode = resolvePageEntryMode(page, plan, { sceneKey: page.sceneKey || scene, customNavigation });
   requireFact(!customNavigation || entryMode === 'standalone', `自定义导航的页面 ${page.name} 必须使用 standalone 入口`);
   if (supplied.navigation !== undefined) {
     const nav = supplied.navigation;
@@ -277,7 +277,9 @@ function pageNavigationRows(page, plan) {
   const handoff = page.pageSpecHandoff || {};
   const applicationCustom = navigationConfig(plan).navigationType === 'custom';
   const menu = handoff.navigation;
-  const entryMode = handoff.entryMode || page.entryMode || (applicationCustom || menu ? 'standalone' : 'platform-shell');
+  const entryMode = resolvePageEntryMode(page, plan, {
+    sceneKey: page.sceneKey || sceneForPage(page), customNavigation: applicationCustom,
+  });
   const variants = { top: '顶部', side: '侧边', mixed: '顶部与侧边', dock: '底部' };
   return [
     ['访问方式', entryMode === 'standalone' ? '独立页面入口' : '应用工作区入口'],
@@ -613,7 +615,7 @@ function renderProjectApplications(plan, tokens, color, chapter) {
     '--color-brand1-6': '主色与主要品牌操作', '--color-brand1-1': '品牌悬停',
     '--color-brand1-9': '品牌按下', '--color-brand1-10': '品牌禁用',
     '--pod-page-bg-color': '页面画布', '--pod-card-bg-color': '内容容器',
-    '--color-fill1-5': '独立浮层', '--color-fill1-10': 'Tooltip背景', '--color-text1-5': 'Tooltip前景',
+    '--color-fill1-5': '独立浮层', '--color-fill1-6': '弱图标与辅助操作', '--color-fill1-10': 'Tooltip背景', '--color-text1-5': 'Tooltip前景',
   };
   return [
     '## 5. 项目应用与调整规则', '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.9.24-beta.0",
+  "version": "2026.9.24",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/yida-skills/skills/yida-app/references/entry-navigation.md

@@ -123,6 +123,8 @@ Fast（直接搭建）与 Plan（先确认方案）使用同一份入口规划
 
 ## 规划字段速查（Fast / Plan）
 
+前台用途已经确定时，自定义承载页面默认采用独立入口。`role=service` 与页面 `sceneKey` 对应后，Plan 自动推导遗漏的 `entryMode=standalone`，Fast 执行同样规则；不靠页面名称猜测，不新增 CLI 参数。显式的导航要求优先，冲突需核对。取得页面 ID 后持久化隐藏页面导航并回读，发布后交付 `publish` 或 `get-form-config` 返回的 `standaloneUrl`，不追加导航 URL 参数。前台入口属于交付范围时不能因字段漏写或只拿到工作台地址而静默省略；未确认成功须明确列为未完成。
+
 需求文件中的 `entryRecommendation` 在 Plan 初始化后保存在 `execution.entryRecommendation`；Fast 在 PRD 中使用同一结构。旧计划没有此字段时仍可使用；首次完整生成时应明确入口规划。保留已有 `source/reason/taskRefs` 等需求依据。
 
 | 字段 | 含义和要求 |

package/yida-skills/skills/yida-app/workflow/step-6-main-page.md

@@ -16,7 +16,7 @@
 3. 创建页面前核对 PRD/resource context 与 auth snapshot 的 `corpId`。
 4. `corpId` 不一致 → 先确认重新登录到目标组织，或确认在当前组织继续。
 5. 创建 display 页面后记录真实主页面 `formUuid`。
-6. PRD 的应用工作区采用自定义导航，或该页已确定 `entryMode=standalone` / 页面隐藏导航时，取得真实 `formUuid` 后立即执行 `openyida update-form-config <appType> <formUuid> false "<页面标题>"` 并 `get-form-config --json` 回读 `renderNav=false`；已有页面按同样规则处理，`create-page --hide-nav` 已配置成功时直接回读即可。该任务与 Step 7 的源码开发并行，不等待代码或发布完成。
+6. 已确定面向前台用户的自定义页面（如 `entryRecommendation.entries[].role=service`），默认作为独立页面交付，即使遗漏 `entryMode` 也按业务用途补齐为 `standalone`，不要求用户再选择开关。PRD 的应用工作区采用自定义导航，或该页已确定 `entryMode=standalone` / 页面隐藏导航时，取得真实 `formUuid` 后立即执行 `openyida update-form-config <appType> <formUuid> false "<页面标题>"` 并 `get-form-config --json` 回读 `renderNav=false`；已有页面按同样规则处理，配置已正确则不重复写入。该任务与 Step 7 的源码开发并行，不等待代码或发布完成。使用持久化配置，不在自定义页 URL 中追加 `isRenderNav=false`。用户明确要求保留平台导航、普通后台内容页和无关页面局部修改沿用其已有边界。
 7. 将页面导航配置结果交给 Step 8 做发布后核对。其余自定义页面同样在各自创建/复用成功后配置，不只处理主页面。
 
 同一 sceneKey 的前台业务视图共用一个自定义页面；将全部视图交给 Step 7 实现。