openyida 2026.9.24-beta.0 → 2026.9.30

package/README.md

@@ -74,17 +74,10 @@ openyida login
 
 OpenYida login defaults to OAuth token mode. It opens the DingTalk OAuth authorization page, receives the local loopback callback, exchanges `code` / `authCode` with the Yida server, and stores `access_token` / `refresh_token` in the user auth store when available. If the user auth store is not writable, OpenYida explicitly falls back to the current project cache and reports that narrower persistence scope.
 
-In a sandbox, headless shell, or CI dashboard where the loopback callback cannot complete, use the device authorization flow. Open the displayed verification URL on any device and enter the user code. `--env-hint` optionally pins the intended environment profile at authorization time:
-
-```bash
-openyida login --device
-openyida login --device --env-hint pre
-```
-
 When the user names a target Yida entry URL, pass it to the login command so OpenYida can select the matching environment and auth profile. For example:
 
 ```bash
-openyida login https://<your-yida-entry-url>/
+openyida login https://yida-group.alibaba-inc.com/
 openyida login --alibaba
 ```
 
@@ -390,7 +383,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]` | Login with OAuth token mode |
+| `openyida login [target-url] [--env <name>\|--intl\|--overseas\|--global\|--yidaapps\|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]` | Login with OAuth token mode |
 | `openyida logout` | Logout / unbind current project auth |
 | `openyida auth <status\|login\|refresh\|logout\|profiles\|profile switch>` | Token login state and profile management |
 | `openyida org <list\|switch> [--json] [--corp-id <corpId>]` | Organization management (list / switch existing profiles first) |

package/bin/yida.js

@@ -193,7 +193,6 @@ function printLoginResult(result) {
 
   if (!result) {
     console.log(JSON.stringify({
-      type: 'login_result',
       ok: false,
       status: 'login_failed',
       can_auto_use: false,
@@ -206,7 +205,6 @@ function printLoginResult(result) {
     ? !!result.ok
     : (result.can_auto_use !== false && !!result.access_token);
   const summary = {
-    type: 'login_result',
     ok: tokenUsable,
     status: result.status || (tokenUsable ? 'ok' : 'token_not_issued'),
     auth_mode: 'token',
@@ -281,7 +279,6 @@ function getFirstPositionalArg(cliArgs, startIndex = 0) {
     '--login-url',
     '--profile',
     '--user-id',
-    '--env-hint',
   ]);
   for (let index = startIndex; index < cliArgs.length; index++) {
     const arg = cliArgs[index];
@@ -389,7 +386,6 @@ function applyLoginEnvironmentFlags(cliArgs, options = {}) {
     '--client-id',
     '--profile',
     '--user-id',
-    '--env-hint',
   ]);
   const targetUrlFlags = new Set([
     '--endpoint',
@@ -541,23 +537,13 @@ function printLoginHelp() {
 }
 
 function buildTokenLoginOptions(loginArgs) {
-  const device = loginArgs.includes('--device');
   return {
     clientId: getArgValue(loginArgs, '--client-id'),
     corpId: getArgValue(loginArgs, '--corp-id'),
     userId: getArgValue(loginArgs, '--user-id'),
     authProfile: getArgValue(loginArgs, '--profile'),
     quiet: process.env.YIDA_QUIET === '1' || loginArgs.includes('--quiet'),
-    noBrowser: device || loginArgs.includes('--no-browser'),
-    device,
-    envHint: getArgValue(loginArgs, '--env-hint'),
-    // Machine-readable progress events for agent runtimes (sandbox browsers,
-    // CI dashboards). Emits one JSON line per state transition.
-    onDeviceState: (state) => {
-      if (device) {
-        process.stdout.write(JSON.stringify({ type: 'device_login_state', ...state }) + '\n');
-      }
-    },
+    noBrowser: loginArgs.includes('--no-browser'),
   };
 }
 

package/lib/app/application-entry-urls.js

@@ -28,4 +28,30 @@ function buildApplicationEntryUrls({ appType, baseUrl, systemLink }) {
   return { appUrl: workbenchUrl, workbenchUrl, adminUrl: `${origin}/${appType}/admin${suffix}` };
 }
 
-module.exports = { buildApplicationEntryUrls };
+function readRenderNav(config) {
+  const value = config && Object.prototype.hasOwnProperty.call(config, 'renderNav')
+    ? config.renderNav : config?.isRenderNav;
+  if (value === false || value === 'false') {return false;}
+  if (value === true || value === 'true') {return true;}
+  return null;
+}
+
+function buildDisplayPageEntryUrls({ appType, formUuid, baseUrl, config, formType = config?.formType }) {
+  if (formType !== 'display' || !/^FORM[-_][A-Za-z0-9_-]+$/.test(formUuid || '')) {return {};}
+  if (config?.formType && config.formType !== 'display') {return {};}
+  if ((config?.appType && config.appType !== appType) || (config?.formUuid && config.formUuid !== formUuid)) {return {};}
+  const appUrls = buildApplicationEntryUrls({ appType, baseUrl });
+  if (!appUrls.workbenchUrl) {return {};}
+  const origin = new URL(appUrls.workbenchUrl).origin;
+  const renderNav = readRenderNav(config);
+  const workbenchUrl = `${origin}/${appType}/workbench/${formUuid}`;
+  const standaloneUrl = renderNav === false ? `${origin}/${appType}/custom/${formUuid}` : null;
+  return {
+    url: standaloneUrl || workbenchUrl,
+    workbenchUrl,
+    standaloneUrl,
+    navigationVerification: { renderNav, verified: renderNav !== null },
+  };
+}
+
+module.exports = { buildApplicationEntryUrls, buildDisplayPageEntryUrls, readRenderNav };

package/lib/app/create-page.js

@@ -20,6 +20,7 @@ const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff
 const { throwCommandError } = require('../core/command-errors');
 const { buildApiPath } = require('./create-form/api-path');
 const { fetchFormSchemaInfo } = require('./get-form-config');
+const { readRenderNav, buildDisplayPageEntryUrls } = require('./application-entry-urls');
 
 function parseArgs(args) {
   const openOption = parseOpenOption(args);
@@ -138,14 +139,6 @@ function buildPageInfoPostData(formUuid, pageName, isRenderNav, csrfToken, curre
   return querystring.stringify(payload);
 }
 
-function readRenderNav(config) {
-  const value = config && Object.prototype.hasOwnProperty.call(config, 'renderNav')
-    ? config.renderNav : config?.isRenderNav;
-  if (value === false || value === 'false') {return false;}
-  if (value === true || value === 'true') {return true;}
-  return null;
-}
-
 async function configureNavigationVisibility(authRef, appType, pageId, pageName, isRenderNav) {
   const verification = { requestedRenderNav: isRenderNav, renderNav: null, verified: false, attempts: 0 };
   let currentConfig = null;
@@ -268,7 +261,10 @@ async function run(args) {
       navigationVerification = await configureNavigationVisibility(authRef, appType, pageId, pageName, false);
       if (navigationVerification.verified) {
         chalkSuccess(t('create_page.dashboard_config_ok'));
-        pageUrl = `${authRef.baseUrl}/${appType}/custom/${pageId}?isRenderNav=false`;
+        pageUrl = buildDisplayPageEntryUrls({
+          appType, formUuid: pageId, baseUrl: authRef.baseUrl,
+          config: { formType: 'display', renderNav: navigationVerification.renderNav },
+        }).standaloneUrl;
       } else {
         dashboardConfigWarning = navigationVerification.error;
         warn(t('create_page.dashboard_config_failed', dashboardConfigWarning));

package/lib/app/get-form-config.js

@@ -21,6 +21,7 @@ const {
 const { t } = require('../core/i18n');
 const { banner, step, label, info, success, error, result } = require('../core/chalk');
 const { throwCommandError } = require('../core/command-errors');
+const { buildDisplayPageEntryUrls } = require('./application-entry-urls');
 
 // 常用配置字段白名单（人读摘要），--json 会输出完整对象
 const SUMMARY_FIELDS = [
@@ -121,6 +122,9 @@ async function run(args) {
   }
 
   const cfg = resp.content || resp.result || resp.data || {};
+  const entryUrls = buildDisplayPageEntryUrls({
+    appType: parsed.appType, formUuid: parsed.formUuid, baseUrl: authRef.baseUrl, config: cfg,
+  });
   success(t('get_form_config.read_ok'));
 
   if (parsed.json) {
@@ -129,6 +133,7 @@ async function run(args) {
       appType: parsed.appType,
       formUuid: parsed.formUuid,
       config: cfg,
+      ...entryUrls,
     }, null, 2));
     return;
   }
@@ -138,6 +143,7 @@ async function run(args) {
     appType: parsed.appType,
     formUuid: parsed.formUuid,
     title: extractTitle(cfg.title),
+    ...entryUrls,
   };
   SUMMARY_FIELDS.forEach((key) => {
     if (cfg[key] !== undefined) {

package/lib/app/publish.js

@@ -37,6 +37,8 @@ const { buildPageFile, shouldBuildPageSource } = require('./page-compat');
 const { warnLargePageSource } = require('./page-size-guard');
 const { assertPageTemplateCustomized } = require('./page-template-guard');
 const { fetchFormPageList } = require('./form-navigation');
+const { fetchFormSchemaInfo } = require('./get-form-config');
+const { buildDisplayPageEntryUrls } = require('./application-entry-urls');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { assertNoEmojiInValue } = require('../core/no-emoji-guard');
 const { loadPageSource } = require('./services/page-source-loader');
@@ -834,7 +836,22 @@ async function runMain(argv) {
 
   baseUrl = authRef.baseUrl || baseUrl;
 
-  const pageUrl = `${baseUrl}/${appType}/workbench/${savedFormUuid}`;
+  let pageConfig = null;
+  let navigationWarning = null;
+  try {
+    const configResponse = await fetchFormSchemaInfo(authRef, appType, savedFormUuid);
+    if (!configResponse || configResponse.success === false || configResponse.__needLogin || configResponse.__csrfExpired) {
+      throw new Error(configResponse?.errorMsg || t('common.request_failed'));
+    }
+    pageConfig = configResponse.content || configResponse.result || configResponse.data || {};
+  } catch (configError) {
+    navigationWarning = configError.message || t('common.request_failed');
+  }
+  const entryUrls = buildDisplayPageEntryUrls({
+    appType, formUuid: savedFormUuid, baseUrl: authRef.baseUrl || baseUrl,
+    config: pageConfig, formType: 'display',
+  });
+  const pageUrl = entryUrls.url || `${baseUrl}/${appType}/workbench/${savedFormUuid}`;
   const publishMode = isCanvas ? 'canvas' : 'native';
   let healthCheckResult = null;
   let navOrderResult = null;
@@ -911,6 +928,8 @@ async function runMain(argv) {
       formUuid: savedFormUuid,
       version,
       url: pageUrl,
+      ...entryUrls,
+      navigationWarning,
       publishMode,
       storageMode,
       bundleId,

package/lib/auth/token-auth.js

@@ -83,27 +83,11 @@ function resolveDingtalkLoginOrigin(options = {}) {
   return DINGTALK_LOGIN_ORIGIN;
 }
 
-function requestJson(method, url, body, headers = {}, options = {}) {
+function requestJson(method, url, body, headers = {}) {
   return new Promise((resolve, reject) => {
     const parsedUrl = new URL(url);
     const data = body === undefined || body === null ? null : Buffer.from(JSON.stringify(body));
     const transport = parsedUrl.protocol === 'https:' ? https : http;
-    const socketTimeoutMs = positiveNumber(options.timeoutMs, 0);
-    let timeoutId = null;
-    let settled = false;
-    const finish = (callback, value) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      if (timeoutId) {
-        clearTimeout(timeoutId);
-      }
-      callback(value);
-    };
-    const resolveOnce = value => finish(resolve, value);
-    const rejectOnce = error => finish(reject, error);
-
     const request = transport.request({
       method,
       protocol: parsedUrl.protocol,
@@ -121,7 +105,6 @@ function requestJson(method, url, body, headers = {}, options = {}) {
     }, (response) => {
       const chunks = [];
       response.on('data', (chunk) => chunks.push(chunk));
-      response.on('error', rejectOnce);
       response.on('end', () => {
         const text = Buffer.concat(chunks).toString('utf8');
         let payload = null;
@@ -142,26 +125,14 @@ function requestJson(method, url, body, headers = {}, options = {}) {
           error.payload = payload;
           error.headers = response.headers;
           error.location = location;
-          rejectOnce(error);
+          reject(error);
           return;
         }
-        resolveOnce(payload || {});
+        resolve(payload || {});
       });
     });
 
-    if (socketTimeoutMs > 0) {
-      // Node's socket timeout is reset by network activity, so it cannot enforce
-      // the caller's wall-clock budget. Use an independent timer that also
-      // covers response bodies which trickle data without ever completing.
-      timeoutId = setTimeout(() => {
-        const error = new Error('request timed out');
-        error.code = 'request_timeout';
-        rejectOnce(error);
-        request.destroy(error);
-      }, socketTimeoutMs);
-    }
-
-    request.on('error', rejectOnce);
+    request.on('error', reject);
     if (data) {
       request.write(data);
     }
@@ -169,11 +140,6 @@ function requestJson(method, url, body, headers = {}, options = {}) {
   });
 }
 
-function positiveNumber(value, fallback) {
-  const parsed = Number(value);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-
 function sanitizeRawTokenResponse(response) {
   if (!response || typeof response !== 'object') {
     return response;
@@ -336,43 +302,25 @@ async function tokenLogin(options = {}) {
   const baseUrl = resolveTokenBaseUrl(options);
   const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
   const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
-  const scope = options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid';
-
-  let response;
-  if (options.device) {
-    // Device Authorization Grant (RFC 8628): sandbox / headless login.
-    const { runDeviceCodeFlow } = require('./oauth-device');
-    response = await runDeviceCodeFlow({
-      authBaseUrl,
-      clientId,
-      scope,
-      envHint: options.envHint,
-      quiet: options.quiet,
-      onState: options.onDeviceState,
-      timeoutMs: options.timeoutMs || env.OPENYIDA_OAUTH_TIMEOUT_MS,
-    });
-    requireOkResponse(response);
-  } else {
-    const callback = await runDingtalkLoopback({
-      clientId,
-      loginOrigin: resolveDingtalkLoginOrigin(options),
-      scope,
-      prompt: options.prompt,
-      port: options.port,
-      quiet: options.quiet,
-      noBrowser: options.noBrowser,
-      timeoutMs: options.timeoutMs,
-    });
+  const callback = await runDingtalkLoopback({
+    clientId,
+    loginOrigin: resolveDingtalkLoginOrigin(options),
+    scope: options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid',
+    prompt: options.prompt,
+    port: options.port,
+    quiet: options.quiet,
+    noBrowser: options.noBrowser,
+    timeoutMs: options.timeoutMs,
+  });
 
-    response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
-      code: callback.code,
-      authCode: callback.authCode,
-      redirectUri: callback.redirectUri,
-      state: callback.state,
-      clientId,
-    });
-    requireOkResponse(response);
-  }
+  const response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
+    code: callback.code,
+    authCode: callback.authCode,
+    redirectUri: callback.redirectUri,
+    state: callback.state,
+    clientId,
+  });
+  requireOkResponse(response);
 
   const normalized = normalizeTokenResponse(response, baseUrl, clientId);
   if (!normalized.access_token) {
@@ -676,5 +624,4 @@ module.exports = {
   resolveTokenBaseUrl,
   isRefreshAuthRequired,
   createTokenRefreshFailedError,
-  getTokenPayload,
 };

package/lib/core/agent-capabilities.js

@@ -499,6 +499,7 @@ function buildApplicationEntryPolicy(builderPath, env = process.env) {
     delivery_unit: 'single_application_entry_group',
     resource_delivery: 'summary_only',
     internal_artifact_delivery: 'never',
+    frontend_delivery: 'Infer standalone for a scoped service frontend, persist page navigation hiding and return the verified publish/get-form-config standaloneUrl. No extra flag or navigation URL parameter. Missing verification is incomplete delivery; never silently omit the frontend or replace it with workbench/admin.',
     entries: {
       workbench: 'when_workspace_in_scope',
       custom: 'when_entry_mode_standalone_and_is_render_nav_false_readback',

package/lib/core/command-manifest.js

@@ -1035,7 +1035,7 @@ const COMMAND_GROUPS = [
     id: 'auth',
     titleKey: 'help.group_auth',
     commands: [
-      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser] [--device] [--env-hint <name>]', 'help.cmd_login', {
+      command('login', ['login'], 'login [target-url] [--env <name>|--intl|--overseas|--global|--yidaapps|--alibaba] [--client-id <clientId>] [--endpoint <url>] [--no-browser]', 'help.cmd_login', {
         requiresLogin: false,
         output: 'json',
       }),
@@ -1311,7 +1311,10 @@ const COMMAND_GROUPS = [
           'openyida create-form create APP_XXX "访客登记" .cache/openyida/visitor/fields.json --layout section --theme comfortable --label-align left --icon name-card --locale zh_CN --no-open',
           'openyida commands build create-form.create --app-type APP_XXX --form-title "访客登记" --fields-json-file .cache/openyida/visitor/fields.json --layout section --theme comfortable --label-align left --locale zh_CN --no-open --json',
         ],
-        notes: ['Divider accepts the 23 visible platform styles (none is excluded) through field JSON dividerType, not a CLI flag. Omission falls back to bold-with-thin; invalid supplied styles fail. Choose per business page and keep same-level sections consistent; see summary.core_workflows.full_app_build.divider_style_contract.'],
+        notes: [
+          'Divider accepts the 23 visible platform styles (none is excluded) through field JSON dividerType, not a CLI flag. Omission falls back to bold-with-thin; invalid supplied styles fail. Choose per business page and keep same-level sections consistent; see summary.core_workflows.full_app_build.divider_style_contract.',
+          'Divider colorType defaults to theme. If default bindings are unsuitable for the current theme, use custom with backgroundColor, secondaryColor and titleColor designed together; explicit user color values are not required. These are field JSON properties, not CLI flags. Dark-content and composite-title guidance is advisory, not a new validation or upload/save gate.',
+        ],
       }),
       command('create-form.icons', ['create-form', 'icons'], 'create-form icons [--json]', 'help.cmd_list_form_icons', {
         requiresLogin: false,
@@ -1437,7 +1440,7 @@ const COMMAND_GROUPS = [
           { name: 'noOpen', type: 'boolean', source: 'option', builder_options: ['--no-open'] },
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
         ],
-        notes: ['Canvas publishing runs the same theme and form-open-container structure checks as compile before login or remote writes. --force does not bypass Canvas compilation checks. --health-check verifies saved content; inspect the actual page for runtime behavior. Fixed brand overrides are preserved with structured warnings by default. --strict-theme blocks them; --allow-fixed-brand conflicts with --strict-theme and --fix-theme. --fix-theme requires the migrated controls to be inside a mounted CanvasThemeProvider and compiles before writing. Unproven dynamic render paths require manual migration. No stdin prompts.'],
+        notes: ['Canvas publishing runs the same theme and form-open-container structure checks as compile before login or remote writes. --force does not bypass Canvas compilation checks. --health-check verifies saved content; inspect the actual page for runtime behavior. Fixed brand overrides are preserved with structured warnings by default. --strict-theme blocks them; --allow-fixed-brand conflicts with --strict-theme and --fix-theme. --fix-theme requires the migrated controls to be inside a mounted CanvasThemeProvider and compiles before writing. Unproven dynamic render paths require manual migration. No stdin prompts.', 'Publishing reads persisted page navigation by default without a new flag. With renderNav=false, url and standaloneUrl use the clean /custom/<formUuid> route, with no navigation query parameters; workbenchUrl remains available. Unknown or visible navigation returns standaloneUrl=null; inspect navigationVerification and navigationWarning. A navigation read failure does not undo publication or prove standalone readiness. Configure scoped service frontend pages persistently before publishing; get-form-config can recover the verified URL without republishing.'],
       }),
       command('update-form-config', ['update-form-config'], 'update-form-config <appType> <formUuid> <true|false|keep> "<title>" [--locale zh_CN|en_US|ja_JP]', 'help.cmd_update_form_config', {
         args: [
@@ -1456,7 +1459,7 @@ const COMMAND_GROUPS = [
           { name: 'formUuid', type: 'string', source: 'positional', position: 1, required: true },
           { name: 'json', type: 'boolean', source: 'option', builder_options: ['--json'] },
         ],
-        notes: ['Navigation readback uses renderNav first, falling back to isRenderNav only when renderNav is absent. true/false booleans and strings are recognized; missing or invalid values remain unknown. --json includes the raw configuration; the default summary preserves both navigation fields when present.'],
+        notes: ['Navigation readback uses renderNav first, falling back to isRenderNav only when renderNav is absent. true/false booleans and strings are recognized; missing or invalid values remain unknown. --json includes the raw configuration; the default summary preserves both navigation fields when present. For a confirmed display page, both outputs include url, workbenchUrl, standaloneUrl and navigationVerification. Only persisted renderNav=false returns a clean custom standaloneUrl; visible or unknown navigation returns standaloneUrl=null. Route construction does not verify publication or viewer permissions.'],
       }),
     ],
   },
@@ -1829,6 +1832,29 @@ function summarizeLocalizedCommands(commands) {
           fallback: DEFAULT_DIVIDER_TYPE,
           selection: 'Choose by each page business task and visual weight; keep same-level sections consistent within a page. Prefer suitable variation across different business pages. If the scene is unclear or suitable candidates tie, shuffle compatible candidates and rotate across pages, preferring unused styles until exhausted. Record one choice per page in design.md and dividerType before compilation; retries reuse it. Preserve existing supported styles for local edits.',
           invalid_input: 'INVALID_DIVIDER_TYPE diagnostics; create rejects with CREATE_FORM_INVALID_DIVIDER_TYPE. Never silently replace a supplied unsupported style.',
+          color_guidance: {
+            reference: 'yida-skills/skills/yida-design/references/native-form-styles.md#分割线弱背景',
+            mode: 'agent_design_guidance_only',
+            default_mode: 'theme',
+            custom_mode: 'custom',
+            inputs: ['colorType', 'backgroundColor', 'secondaryColor', 'titleColor'],
+            input_location: 'Field JSON for create/batch; changes for update; props in field-props operations for patch. Not CLI flags.',
+            schema_paths: ['Divider.props.colorType', 'Divider.props.backgroundColor', 'Divider.props.secondaryColor', 'Divider.props.titleColor'],
+            default_bindings: {
+              primary: 'var(--color-brand1-6)',
+              secondary: 'var(--color-brand1-2)',
+              text: 'var(--color-text1-4, #171a1d)',
+            },
+            custom_when: 'The user requests colors, or default bindings do not suit the current theme, visual weight or readability. Design all three colors together; do not require user-specified values for each color. Reuse colors across peer sections.',
+            dark_content: 'Distinguish dark content from dark navigation with light content. Treat brand1-2 as a weak brand surface, not permanently near-white. Root secondary overrides may lose to inline component bindings. For local repairs, prefer component colors when global changes would affect other consumers.',
+            composite_titles: 'Consider outer decoration, the actual title surface and the title separately. In inner-ellipse-title the inner ellipse carries the text. Preserve existing supported shapes; do not dim the whole component to fix its background.',
+            solid_title_surfaces: 'For dark-bar and light-left-title/light-center-title/light-house-title/light-hexagon-title, distinguish the primary-colored title block from the secondary strip. Prefer white or near-white on sufficiently dark primary surfaces; if a bright saturated fill weakens white text, deepen the component backgroundColor while preserving its hue. Do not force white onto pale surfaces. Set titleColor explicitly in custom mode instead of retaining its dark default; do not change global body text to fix a local title.',
+            label_coordination: 'Design the divider title, first field label and input as a group. Share font family; use modest title weight/size emphasis, readable neutral labels, coordinated alignment and spacing. Preserve centered decorative headings without centering field labels. Keep the section gap larger than the title-to-first-field gap, and label-to-input spacing compact. Do not dim labels to create hierarchy or repeat excessive saturated decoration. The label role pod-form-label-color is separate from divider titleColor; record choices in existing design.md without new flags or blocking checks.',
+            picker_icons: '--color-fill1-6 is a weak foreground for picker icons; choose a readable auxiliary foreground against the actual input surface, for example the current theme color-text1-3.',
+            lifecycle: 'Record the choice in existing design.md. Revisit custom colors when changing themes; they do not automatically follow theme switching. Do not claim visual verification from a successful command or when preview is unavailable.',
+            new_cli_flags: false,
+            adds_validation_or_blocking: false,
+          },
         },
         page_skill_policy: 'Use YidaCodeCanvas by default for new primary custom pages. Choose yida-custom-page only when the current target has been identified as existing .oyd.jsx/.oyb.jsx/renderJsx/platform Jsx component maintenance; do not switch to yida-custom-page merely because a page needs data, forms, uploads, this.utils.yida.*, or dataSourceMap-like capabilities.',
         form_entry_policy: {
@@ -1904,6 +1930,8 @@ function summarizeLocalizedCommands(commands) {
           custom: {
             include: 'when_entry_mode_standalone_and_is_render_nav_false_readback',
             url: '{base_url}/{appType}/custom/{formUuid}',
+            default_policy: 'A scoped service frontend is a standalone display page even when entryMode was omitted. Plan derives it from role=service and sceneKey; Fast follows the same business intent. Persist page navigation hiding and read it back, without a new flag or navigation URL query. Preserve explicit user choices and backend navigation. Missing verification is incomplete frontend delivery, not permission to silently omit it.',
+            url_source: 'publish.standaloneUrl or post-publish get-form-config.standaloneUrl; require navigationVerification.renderNav=false and verified=true',
           },
           admin: {
             include: 'default_for_complete_application',

package/lib/core/locales/en.js

@@ -382,8 +382,8 @@ Examples:
     save_permission_usage: 'Usage: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>]',
     save_permission_example: "Example: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ Execution failed: {0}',
-    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--device] [--env-hint <name>] [--check-only] [--json] [--client-id <clientId>]',
-    login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --device                # Use device authorization in a headless environment\n  openyida login --device --env-hint pre # Pin device authorization to an environment profile\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
+    login_usage: 'Usage: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_example: 'Examples:\n  openyida login                         # Automatically open the browser via OAuth loopback login\n  openyida login --no-browser            # Let the caller handle the authorization URL\n  openyida login --check-only --json     # Check token auth status only\n  openyida login --intl                  # Login against the international environment\n  OPENYIDA_NO_BROWSER=1 openyida login   # Suppress auto-opening the browser with an environment variable\n  openyida auth login                    # Login alias',
     login_unsupported_option: 'Removed legacy login option is no longer supported: {0}. Use token/OAuth login; env token mode reads only OPENYIDA_* tokens.',
     auth_usage: 'Usage: openyida auth <status|login|refresh|logout|profiles|profile switch>',
     auth_example: 'Examples:\n  openyida auth status                         # View login status\n  openyida auth profiles                       # List existing login profiles\n  openyida auth profile switch <auth_profile>  # Switch current project to an existing profile\n  openyida auth login                          # Add a profile when the target does not exist\n  openyida auth refresh                        # Refresh login session\n  openyida auth logout                         # Unbind current project auth\n  openyida auth logout --profile <auth_profile> # Delete a shared profile explicitly',
@@ -655,18 +655,6 @@ Examples:
     oauth_success_message: 'Sign-in is complete. Return to the previous window to continue.',
     oauth_closing: 'Closing this window automatically…',
     oauth_manual_close: 'This window could not close automatically. Close it manually, then return to the previous window to continue.',
-    device_title: 'Device code login:',
-    device_open: 'Open',
-    device_enter_code: 'Enter code:',
-    device_or_direct: 'Or open directly:',
-    device_completed: 'Device authorization completed.',
-    device_timeout: 'device authorization timed out; device code may still be pending',
-    device_missing_params: 'device code flow requires authBaseUrl and clientId',
-    device_poll_missing_params: 'device token polling requires authBaseUrl, clientId and deviceCode',
-    device_invalid_code_response: 'auth service did not return a usable device code',
-    device_code_expired: 'device code expired; run login --device again',
-    device_access_denied: 'authorization was denied on the verification page',
-    device_2xx_no_token: 'auth service returned 2xx without accessToken',
     oauth_failure_title: 'Sign-in not completed',
     oauth_invalid_state: 'The sign-in request could not be verified. Return to the terminal and try again.',
     oauth_missing_code: 'No authorization information was received. Return to the terminal and try again.',

package/lib/core/locales/zh.js

@@ -382,8 +382,8 @@ openyida - 宜搭命令行工具
     save_permission_usage: '用法: openyida save-permission <appType> <formUuid> [--package-uuid <packageUuid>] [--data-permission <json>] [--action-permission <json>]',
     save_permission_example: "示例: openyida save-permission APP_XXX FORM-XXX --data-permission '{\"role\":\"DEFAULT\",\"dataRange\":\"SELF\"}'",
     exec_failed: '\n❌ 执行失败: {0}',
-    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--device] [--env-hint <name>] [--check-only] [--json] [--client-id <clientId>]',
-    login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --device                # 在无浏览器或沙箱环境使用设备授权登录\n  openyida login --device --env-hint pre # 将设备授权限定到指定环境 profile\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
+    login_usage: '用法: openyida login [entryUrl|--public|--alibaba|--intl] [--no-browser] [--check-only] [--json] [--client-id <clientId>]',
+    login_example: '示例:\n  openyida login                         # 通过 OAuth loopback 自动打开浏览器登录\n  openyida login --no-browser            # 不自动打开浏览器，由调用方接管授权链接\n  openyida login --check-only --json     # 只检查 token 登录态\n  openyida login --intl                  # 使用国际站环境登录\n  OPENYIDA_NO_BROWSER=1 openyida login   # 通过环境变量抑制自动打开浏览器\n  openyida auth login                    # 登录入口别名',
     login_unsupported_option: '已删除的旧登录参数不再支持: {0}。请使用 token/OAuth 登录；env token 模式下只读取 OPENYIDA_* token。',
     first_run_title: '  🤖 OpenYida - AI 问答模式已开启！                         ',
     first_run_welcome: '  {0}欢迎首次使用 OpenYida！{1} 以下是快速上手指南：',
@@ -626,18 +626,6 @@ openyida - 宜搭命令行工具
     oauth_success_message: '登录已完成，请返回刚才的窗口继续操作。',
     oauth_closing: '正在自动关闭此窗口…',
     oauth_manual_close: '此窗口未能自动关闭，请手动关闭后返回刚才的窗口继续操作。',
-    device_title: '设备码登录：',
-    device_open: '打开',
-    device_enter_code: '输入验证码：',
-    device_or_direct: '或直接打开：',
-    device_completed: '设备授权完成。',
-    device_timeout: '设备授权超时；设备码可能仍在等待验证',
-    device_missing_params: '设备码流程需要 authBaseUrl 和 clientId',
-    device_poll_missing_params: '设备令牌轮询需要 authBaseUrl、clientId 和 deviceCode',
-    device_invalid_code_response: '认证服务未返回可用的设备码',
-    device_code_expired: '设备码已过期；请重新执行 login --device',
-    device_access_denied: '授权已在验证页面被拒绝',
-    device_2xx_no_token: '认证服务返回 2xx 但未包含 accessToken',
     oauth_failure_title: '登录未完成',
     oauth_invalid_state: '登录验证信息无效，请返回终端重新发起登录。',
     oauth_missing_code: '未收到登录授权信息，请返回终端重新发起登录。',

package/lib/design-plan/entry-navigation.js

@@ -16,6 +16,15 @@ const assert = (condition, message, details) => {
 };
 
 // Resource names are planning references. Runtime IDs and permissions are resolved after creation.
+function resolvePageEntryMode(page, plan, { sceneKey, customNavigation }) {
+  const supplied = page.pageSpecHandoff || {};
+  const entries = plan.execution?.entryRecommendation?.entries;
+  const servicePage = Array.isArray(entries) && entries.some(entry =>
+    entry?.role === 'service' && filled(entry.sceneKey) && entry.sceneKey === sceneKey);
+  return supplied.entryMode || page.entryMode ||
+    (servicePage || customNavigation || supplied.navigation ? 'standalone' : 'platform-shell');
+}
+
 function buildEntryNavigation(plan, resources, pages) {
   const recommendation = plan.execution?.entryRecommendation;
   if (recommendation === undefined) {return null;}
@@ -94,4 +103,4 @@ function buildEntryNavigation(plan, resources, pages) {
   return { recommendation: JSON.parse(JSON.stringify(recommendation)), platformOrder: [...new Set(platformOrder)] };
 }
 
-module.exports = { buildEntryNavigation, ENTRY_MODES, ENTRY_MODE_SUMMARIES };
+module.exports = { buildEntryNavigation, resolvePageEntryMode, ENTRY_MODES, ENTRY_MODE_SUMMARIES };

package/lib/design-plan/init.js

@@ -233,7 +233,8 @@ function initialize(inputPath, options = {}) {
     '# 计划编写上下文', '', `需求事实：${input}`, `计划目录：${outputDir}`, '',
     `读取本上下文、编写契约和 business.json；按 authoring.pendingFields 补齐事实，保留 base 与已有需求。business facts 填写 overview、dataModels、businessFlows、pages 和可选 execution；视觉填写 visual.json。复核业务覆盖后设置片段 ready=true，再执行：${materializeCommand}。使用成功结果中的 HTML 路径展示“当前方案”，revision 仅放在内部确认字段，不写入用户可见标题、摘要或问题。视觉片段按每页实际任务补齐焦点、布局、主操作、响应式与验收；已完成的选择直接复用。`, '',
     '## 本轮编写重点', '设计功能范围、数据与规则、页面组织、关键交互和业务验收。页面 blocks 按优先顺序填写 {name,purpose}；CLI 派生默认内容优先级与内容层次，保留明确填写的独立设计。通用状态和验收检查由 CLI 补齐，interactionStates 与 acceptanceCriteria 填写项目差异。', '',
-    '首页按使用者的主要任务选择：集中办事可用门户式工作台（workbench），单项任务可直达原生业务页；只有已确认的指标分析或投屏监控任务才规划 dashboard/screen。工作台按需求组织待办、操作队列、业务列表和常用入口，辅助统计不改变页面主任务。不得从后台身份、系统名称或暗色风格自动增加驾驶舱。完整规则见 yida-requirement-analysis/references/experience-groups.md 的“首页按任务选择”。', '',
+    '首页按使用者的主要任务选择：集中办事可用门户式工作台（workbench），单项任务可直达原生业务页；只有已确认的指标分析或投屏监控任务才规划 dashboard/screen。工作台是围绕应用核心业务，把全局概况、业务管理、分析判断、异常处理和常用快捷入口组织在一起的综合工作空间；包含分析区块不自动改变整页主任务。不得从后台身份、系统名称或暗色风格自动增加驾驶舱。完整规则见 yida-requirement-analysis/references/experience-groups.md 的“首页按任务选择”。', '',
+    '工作台按角色与业务关系规划，参考 8-10 个有独立价值的区块；采用适合信息特点的表现形式，数据和洞察有依据，操作与快捷入口可用，不套固定列表组合。', '',
     '无论是否分前后台，每个业务入口都要确定默认页面、菜单及分组顺序、打开后的首屏任务。menu 数组记录展示顺序，defaultMenuKey 记录默认任务；按角色需求决定，不按资源创建先后排列。平台导航通过排序命令落实，自定义导航通过页面菜单落实，frontend-only 也必须完成入口排序与首页验收。', '',
     '入口方案沿用 execution.entryRecommendation：unified 表示不分前后台，service-management 表示分前后台，frontend-only 表示只有访问前台，backend-only 表示只有访问后台。向用户说明谁使用、看到什么、能做什么；只有前台且提交后需要处理时，在 reason 和业务流程中说明承接方式；逐入口补齐 role、menu 和 defaultMenuKey，前台关联独立页面 sceneKey。任何身份的入口含 local 菜单时，entry.sceneKey 必须关联承载页面，menu.resource 等于页面 name，viewKey 非空。管理端可直接落到原生业务视图，不强制创建首页。所有叶子菜单按资源、视图和操作记录 access 权限依赖，平台导航排序从管理菜单派生。详见 yida-app/references/entry-navigation.md。', '',
     theme.mode === 'creative'

package/lib/design-plan/materialize.js

@@ -9,7 +9,7 @@ const { normalizePlan, assertThemeProfile } = require('./normalize');
 const { readJson, writeFiles } = require('./files');
 const { prepareUpdates } = require('./artifact-updates');
 const { validateAuthoring } = require('./validate');
-const { buildEntryNavigation, ENTRY_MODE_SUMMARIES } = require('./entry-navigation');
+const { buildEntryNavigation, resolvePageEntryMode, ENTRY_MODE_SUMMARIES } = require('./entry-navigation');
 const { buildPageNavigationPolicy } = require('./navigation-policy');
 const { buildAssetTasks } = require('../asset/asset-plan');
 const { mergeParts } = require('./parallel');
@@ -216,7 +216,7 @@ function pageHandoff(page, plan) {
     detail: 'detail-profile', landing: 'official-homepage', screen: 'data-screen',
   };
   const customNavigation = navigationConfig(plan).navigationType === 'custom';
-  const entryMode = supplied.entryMode || page.entryMode || (customNavigation || supplied.navigation ? 'standalone' : 'platform-shell');
+  const entryMode = resolvePageEntryMode(page, plan, { sceneKey: page.sceneKey || scene, customNavigation });
   requireFact(!customNavigation || entryMode === 'standalone', `自定义导航的页面 ${page.name} 必须使用 standalone 入口`);
   if (supplied.navigation !== undefined) {
     const nav = supplied.navigation;
@@ -277,7 +277,9 @@ function pageNavigationRows(page, plan) {
   const handoff = page.pageSpecHandoff || {};
   const applicationCustom = navigationConfig(plan).navigationType === 'custom';
   const menu = handoff.navigation;
-  const entryMode = handoff.entryMode || page.entryMode || (applicationCustom || menu ? 'standalone' : 'platform-shell');
+  const entryMode = resolvePageEntryMode(page, plan, {
+    sceneKey: page.sceneKey || sceneForPage(page), customNavigation: applicationCustom,
+  });
   const variants = { top: '顶部', side: '侧边', mixed: '顶部与侧边', dock: '底部' };
   return [
     ['访问方式', entryMode === 'standalone' ? '独立页面入口' : '应用工作区入口'],
@@ -613,7 +615,7 @@ function renderProjectApplications(plan, tokens, color, chapter) {
     '--color-brand1-6': '主色与主要品牌操作', '--color-brand1-1': '品牌悬停',
     '--color-brand1-9': '品牌按下', '--color-brand1-10': '品牌禁用',
     '--pod-page-bg-color': '页面画布', '--pod-card-bg-color': '内容容器',
-    '--color-fill1-5': '独立浮层', '--color-fill1-10': 'Tooltip背景', '--color-text1-5': 'Tooltip前景',
+    '--color-fill1-5': '独立浮层', '--color-fill1-6': '弱图标与辅助操作', '--color-fill1-10': 'Tooltip背景', '--color-text1-5': 'Tooltip前景',
   };
   return [
     '## 5. 项目应用与调整规则', '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.9.24-beta.0",
+  "version": "2026.9.30",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/yida-skills/skills/yida-app/SKILL.md

@@ -108,7 +108,7 @@ Plan 规划阶段的工作流入口只读取 `workflow/step-1-resource-context.m
 - 需要收集或存储数据：先创建或复用核心普通表单，再生成页面；纯展示或静态内容可跳过表单创建。
 - 需要审批、申请、审核、工单流转：先创建或复用流程表单，再生成页面。
 - 需要标准统计：优先创建原生报表；明确高级图表或大屏时，再选择 `yida-rechart` / `yida-chart`。
-- 按页面主任务选技能：经营分析、指标判断或投屏监控页面加载 `yida-dashboard`；待办、操作队列、业务列表和门户式工作台由 `yida-canvas-custom-page` 实现，不能仅凭“工作台”或“看板”名称加载经营看板技能。页面读取任何表单业务数据时继续加载 `yida-canvas-data-binding`。
+- 按页面主任务选技能：经营分析、指标判断或投屏监控页面加载 `yida-dashboard`；综合工作台由 `yida-canvas-custom-page` 实现，按 PRD 组织内容；其中的分析、洞察及快捷操作按实际需要实现，不能仅凭“工作台”或“看板”名称加载经营看板技能。页面读取任何表单业务数据时继续加载 `yida-canvas-data-binding`。
 - PRD 明确包含报表或集成自动化时，它们属于 Step 4 主流程资源，不得推迟到 final 后置建议；自动化动作必须按通知、数据新增/更新、审批完成、定时或手动触发分别建模，不得统一退化成新增通知。
 
 ## 页面数据契约