openyida 2026.9.4 → 2026.9.7

package/README.md

@@ -168,8 +168,9 @@ For a user-facing list of supported features and matching CLI commands, see [Ope
 ```bash
 openyida create-app --name "CRM" --desc "Customer management"
 openyida sample yida-design app-theme --output .cache/openyida/crm/app-theme.css
+openyida create-app --name "CRM" --desc "Customer management" --theme-file .cache/openyida/crm/app-theme.css --nav-theme light --logo-source appIcon --layout l_shape
+openyida app-list --type managed --page 1 --size 16
 openyida update-app APP_XXX --theme-file .cache/openyida/crm/app-theme.css --nav-theme light --logo-source appIcon --layout l_shape
-openyida app-list --size 20
 openyida corp-efficiency
 openyida create-form create APP_XXX "Customer" .cache/openyida/forms/customer-fields.json
 openyida create-form update APP_XXX FORM_XXX .cache/openyida/forms/customer-changes.json
@@ -388,7 +389,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida app-list [--size N]` | List my Yida apps |
+| `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
 | `openyida design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]` | Initialize a plan draft from confirmed requirements |
@@ -484,9 +485,9 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm` | Safely update action query defaults |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
-| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>]` | Test an action |
+| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]` | Test an action |
 | `openyida connector list-connections <id>` | List auth connections |
-| `openyida connector create-connection <id> <name>` | Create an auth connection |
+| `openyida connector create-connection <id> <name> [--interactive]` | Create an auth connection |
 | `openyida connector smart-create --curl "..."` | Generate a redacted action draft from cURL (no remote create) |
 | `openyida connector parse-api [options]` | Parse API information |
 | `openyida connector gen-template [output]` | Generate API document template |
@@ -495,7 +496,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida integration create <appType> ... [--spec file.json]` | Create integration automation flow |
+| `openyida integration create <appType> ... [--spec file.json] [--connector-system-token-app <appType>]` | Create integration automation flow |
 | `openyida integration update <appType> <formUuid> <processCode> --spec <desired-spec.json> [--publish]` | Probe integration update capability (currently blocked without full readback) |
 | `openyida integration list <appType> [--flow-types 1,2,3,5,6] [--form-uuid <uuid>] [--status y\|n] [--json]` | List integration automation flows |
 | `openyida integration enable <appType> <formUuid> <processCode>` | Enable integration automation flow |
@@ -568,7 +569,7 @@ The CLI package ships the core UI languages `zh` and `en` by default. Other CLI
 
 #### Forms and Pages
 
-Form field definitions can include `alias` or `componentAlias` to populate Yida designer component aliases, stored as `pages[0].componentAlias.items`. Yida runtime resolves these aliases in page JS, so `this.$('phone')` can be used instead of `this.$('textField_xxx')`; OpenYida form rules, validations, and `openyida data ... --resolve-aliases` JSON inputs also accept aliases as field references. For server-side DingTalk OpenAPI calls, use `GET /v2.0/yida/forms/component/alias/{appType}/{formUuid}` to read the `{ fieldId, alias }` mapping, then translate aliases before sending form data/search JSON. That endpoint requires `systemToken`, `userId`, an access token, and the Yida form data read permission; grant that permission in DingTalk developer console API permissions and publish the DingTalk app. Yida app code and app secret are available under app settings > deployment/maintenance.
+Form field definitions can include `alias` or `componentAlias` to populate Yida designer component aliases, stored as `pages[0].componentAlias.items`. Yida runtime resolves these aliases in page JS, so `this.$('phone')` can be used instead of `this.$('textField_xxx')`; OpenYida form rules, validations, and `openyida data ... --resolve-aliases` JSON inputs also accept aliases as field references. For server-side DingTalk OpenAPI calls, use `GET /v2.0/yida/forms/component/alias/{appType}/{formUuid}` to read the `{ fieldId, alias }` mapping, then translate aliases before sending form data/search JSON. That endpoint requires `systemToken`, `userId`, an access token, and the Yida form data read permission. Use `connector test --system-token-app <appType>` for a transient test or `integration create --connector-system-token-app <appType>` for a server-side automation; OpenYida resolves `systemToken` internally and never prints it or stores it in page source and Action defaults.
 
 `openyida publish` preserves existing custom page data sources by default. Before saving the new compiled JSX Schema, it reads the current page Schema and merges the Page-level `dataSource` with the built-in `urlParams` and `timestamp` sources, so manually configured data sources are not deleted during republish.
 

package/bin/yida.js

@@ -1119,7 +1119,7 @@ async function main() {
   delete-action <connector-id> <operation-id>  删除执行动作
   test --connector-id <id> --action <actionId> [结构化 JSON 参数] 测试执行动作
   list-connections <connector-id>              列出鉴权账号
-  create-connection <connector-id> <name>      创建鉴权账号
+  create-connection <connector-id> <name> [--interactive] 创建鉴权账号；钉钉凭据可在本机隐藏输入
   smart-create --curl "curl命令"               生成脱敏连接器动作草稿（不创建远端资源）
   parse-api [选项]                             解析接口信息
   gen-template [输出路径]                       生成接口文档模板

package/lib/app/app-list.js

@@ -1,7 +1,7 @@
 /**
  * app-list.js - 查询我的应用列表
  *
- * 用法：openyida app-list [--page <页码>] [--size <每页数量>]
+ * 用法：openyida app-list [--type managed|created] [--page <页码>] [--size <每页数量>]
  *
  * 输出字段：
  *   appName    - 应用名称（zh_CN）
@@ -12,61 +12,65 @@
 'use strict';
 
 const { createAuthRef, createYidaClient } = require('../core/yida-client');
-const { throwCommandError } = require('../core/command-errors');
+const { t } = require('../core/i18n');
+const { throwCommandError, throwUsage } = require('../core/command-errors');
 
 const API_PATH = '/query/app/getAppList.json';
+const DEFAULT_PAGE_SIZE = 16;
+const DEFAULT_PAGE_INDEX = 1;
+const DEFAULT_TYPE = 'managed';
+const APP_TYPES = Object.freeze({
+  managed: true,
+  created: false,
+});
 
 /**
  * 拉取单页应用列表
  */
-function fetchAppListPage(auth, pageIndex, pageSize) {
+function fetchAppListPage(auth, pageIndex, pageSize, isAdmin) {
   return createYidaClient({ authRef: auth }).get(API_PATH, (ref) => ({
     _api: 'nattyFetch',
     _mock: 'false',
     pageIndex,
     pageSize,
     creator: ref.userId,
+    isAdmin,
     _stamp: Date.now(),
   }));
 }
 
-/**
- * 拉取全量应用列表（自动翻页）
- */
-async function fetchAllApps(auth, pageSize) {
-  const firstResult = await fetchAppListPage(auth, 1, pageSize);
-
-  // 如果首次请求就提示需要登录，直接返回原始结果让外层自动刷新 token 后重试。
-  if (firstResult.__needLogin) {
-    return firstResult;
+function parsePositiveInteger(value, optionName) {
+  if (!/^\d+$/.test(String(value || '')) || Number(value) < 1) {
+    throwUsage(t('app_list.invalid_positive_integer', optionName, value || ''));
   }
+  return Number(value);
+}
 
-  if (!firstResult.success) {
-    throw new Error(firstResult.errorMsg || '查询应用列表失败');
-  }
-
-  const { data: firstPageData, totalCount } = firstResult.content;
-  const allApps = [...firstPageData];
-
-  const totalPages = Math.ceil(totalCount / pageSize);
-  const remainingFetches = [];
-
-  for (let pageIndex = 2; pageIndex <= totalPages; pageIndex++) {
-    remainingFetches.push(fetchAppListPage(auth, pageIndex, pageSize));
-  }
+function parseArgs(args = []) {
+  const options = {
+    type: DEFAULT_TYPE,
+    pageIndex: DEFAULT_PAGE_INDEX,
+    pageSize: DEFAULT_PAGE_SIZE,
+  };
 
-  const remainingResults = await Promise.all(remainingFetches);
-  for (const result of remainingResults) {
-    // 如果后续翻页也出现登录态问题，同样返回标记对象
-    if (result.__needLogin) {
-      return result;
-    }
-    if (result.success && result.content && result.content.data) {
-      allApps.push(...result.content.data);
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === '--type') {
+      const type = args[++index];
+      if (!Object.prototype.hasOwnProperty.call(APP_TYPES, type)) {
+        throwUsage(t('app_list.invalid_type', type || '', Object.keys(APP_TYPES).join(', ')));
+      }
+      options.type = type;
+    } else if (arg === '--page') {
+      options.pageIndex = parsePositiveInteger(args[++index], '--page');
+    } else if (arg === '--size') {
+      options.pageSize = parsePositiveInteger(args[++index], '--size');
+    } else {
+      throwUsage(t('app_list.invalid_argument', arg));
     }
   }
 
-  return allApps;
+  return options;
 }
 
 /**
@@ -86,11 +90,13 @@ function hasHelpFlag(args) {
 
 function printUsage() {
   process.stderr.write([
-    'Usage: openyida app-list [--size N]',
+    t('app_list.usage'),
     '',
-    'Options:',
-    '  --size N     Page size used when fetching apps, default: 20',
-    '  --help, -h   Show this help',
+    t('app_list.options'),
+    t('app_list.option_type'),
+    t('app_list.option_page'),
+    t('app_list.option_size'),
+    t('app_list.option_help'),
     '',
   ].join('\n'));
 }
@@ -105,41 +111,60 @@ async function run(args) {
     return;
   }
 
-  const pageSizeIndex = args.indexOf('--size');
-  const pageSize = pageSizeIndex !== -1 && args[pageSizeIndex + 1]
-    ? parseInt(args[pageSizeIndex + 1], 10)
-    : 20;
+  const options = parseArgs(args);
 
   const authRef = createAuthRef();
 
-  let apps;
+  let result;
   try {
-    apps = await fetchAllApps(authRef, pageSize);
+    result = await fetchAppListPage(
+      authRef,
+      options.pageIndex,
+      options.pageSize,
+      APP_TYPES[options.type]
+    );
   } catch (err) {
-    throwCommandError(`查询应用列表失败：${err.message}`);
+    throwCommandError(t('app_list.query_failed', err.message));
   }
 
   // 如果重试后仍然返回登录失效标记，说明登录态确实不可用
-  if (apps && apps.__needLogin) {
-    throwCommandError('登录态已失效，请重新登录', { code: 'CLI_AUTH_REQUIRED' });
+  if (result && result.__needLogin) {
+    throwCommandError(t('app_list.auth_required'), { code: 'CLI_AUTH_REQUIRED' });
   }
 
-  if (!apps || apps.length === 0) {
-    console.log('暂无应用');
-    return;
+  if (!result || !result.success) {
+    throwCommandError(t('app_list.query_failed', (result && result.errorMsg) || t('app_list.unknown_error')));
   }
 
+  const content = result.content || {};
+  const apps = Array.isArray(content.data) ? content.data : [];
+  const totalCount = Number.isFinite(Number(content.totalCount)) ? Number(content.totalCount) : apps.length;
+  const totalPages = Math.max(1, Math.ceil(totalCount / options.pageSize));
+  const scopeLabel = t(`app_list.scope_${options.type}`);
   const formattedApps = apps.map(formatApp);
 
   // stdout 输出 JSON，方便 AI 工具解析
   console.log(JSON.stringify(formattedApps, null, 2));
 
   // stderr 输出人类可读摘要
-  const { c, success: chalkSuccess, listItem } = require('../core/chalk');
-  chalkSuccess(`共找到 ${c.cyan}${formattedApps.length}${c.reset} 个应用`);
+  const { c, success: chalkSuccess, hint, listItem } = require('../core/chalk');
+  chalkSuccess(t(
+    'app_list.found',
+    scopeLabel,
+    options.pageIndex,
+    totalPages,
+    formattedApps.length,
+    totalCount
+  ));
   for (const app of formattedApps) {
     listItem(`${c.bold}${app.appName}${c.reset}  ${c.dim}[${app.appType}]${c.reset}  ${c.cyan}${app.systemLink}${c.reset}`);
   }
+  if (options.pageIndex < totalPages) {
+    hint(t(
+      'app_list.next_page',
+      `openyida app-list --type ${options.type} --page ${options.pageIndex + 1} --size ${options.pageSize}`
+    ));
+  }
 }
 
-module.exports = { run };
+module.exports = { parseArgs, run };

package/lib/app/canvas-compile.js

@@ -75,6 +75,7 @@ const MODULE_ALIAS_MAP = {
 
 const MANUAL_DEPENDENCY_GLOBALS = Object.freeze({
   React: 'react',
+  ReactDOM: 'react-dom',
   antd: 'antd',
   icons: '@ant-design/icons',
   ahooks: 'ahooks',
@@ -88,6 +89,12 @@ const MANUAL_DEPENDENCY_GLOBALS = Object.freeze({
   YidaMarkdown: 'yida-plugin-markdown',
 });
 
+const DEPENDENCY_RUNTIME_ALIASES = Object.freeze(Object.assign(
+  {},
+  Object.fromEntries(Object.entries(MODULE_ALIAS_MAP).map(([packageName, alias]) => [alias, packageName])),
+  { LucideReact: 'lucide-react' }
+));
+
 const BARE_DEPENDENCY_GLOBALS = Object.freeze({
   antd: {
     packageName: 'antd',
@@ -209,6 +216,141 @@ function assertNoManualDependencyGlobals(source, options = {}) {
   );
 }
 
+function findSelfReferentialDependencyBindingIssues(source) {
+  const issues = [];
+  const dependencyNames = new Set(Object.keys(MANUAL_DEPENDENCY_GLOBALS));
+
+  const guardPlugin = () => ({
+    name: 'yida-self-referential-dependency-binding-guard',
+    visitor: {
+      VariableDeclarator(path) {
+        if (!path.get('id').isIdentifier() || !path.node.init) {
+          return;
+        }
+        const name = path.node.id.name;
+        if (!dependencyNames.has(name)) {
+          return;
+        }
+        const binding = path.scope.getBinding(name);
+        let selfReference = null;
+        const initPath = path.get('init');
+        if (
+          initPath.isIdentifier({ name })
+          && initPath.scope.getBinding(name) === binding
+        ) {
+          selfReference = initPath.node;
+        }
+        initPath.traverse({
+          ReferencedIdentifier(referencePath) {
+            if (
+              !selfReference
+              && referencePath.node.name === name
+              && referencePath.scope.getBinding(name) === binding
+            ) {
+              selfReference = referencePath.node;
+            }
+          },
+        });
+        if (selfReference) {
+          issues.push({
+            name,
+            packageName: MANUAL_DEPENDENCY_GLOBALS[name],
+            line: selfReference.loc && selfReference.loc.start ? selfReference.loc.start.line : 0,
+            column: selfReference.loc && selfReference.loc.start ? selfReference.loc.start.column : 0,
+          });
+        }
+      },
+    },
+  });
+
+  Babel.transform(source, {
+    filename: 'canvas.tsx',
+    presets: [
+      ['typescript', { allExtensions: true, isTSX: true, allowDeclareFields: true }],
+      ['react', { runtime: 'classic' }],
+    ],
+    plugins: [guardPlugin],
+    sourceType: 'module',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+  return issues;
+}
+
+function assertNoSelfReferentialDependencyBindings(source, options = {}) {
+  const issues = findSelfReferentialDependencyBindingIssues(source);
+  if (issues.length === 0) {
+    return;
+  }
+  const firstIssue = issues[0];
+  throw new CliError(
+    `Code Canvas 依赖绑定 ${firstIssue.name} 不能引用自身。请从 "${firstIssue.packageName}" 使用标准 import 引入。`,
+    {
+      code: 'OPENYIDA_CANVAS_SELF_REFERENTIAL_DEPENDENCY_BINDING',
+      details: {
+        stage: 'canvas_compile',
+        sourcePath: options.sourcePath || '',
+        line: firstIssue.line,
+        column: firstIssue.column,
+        globalName: firstIssue.name,
+        packageName: firstIssue.packageName,
+      },
+    }
+  );
+}
+
+function findDependencyManifestIssues(runtimeCode, importedModules) {
+  const importedBaseNames = new Set((importedModules || []).map(packageBaseName));
+  const observedAliases = new Set();
+  const guardPlugin = ({ types: types }) => ({
+    name: 'yida-runtime-dependency-manifest-guard',
+    visitor: {
+      MemberExpression(path) {
+        const node = path.node;
+        if (!types.isIdentifier(node.object, { name: 'window' })) {
+          return;
+        }
+        const alias = node.computed && types.isStringLiteral(node.property)
+          ? node.property.value
+          : (!node.computed && types.isIdentifier(node.property) ? node.property.name : '');
+        if (DEPENDENCY_RUNTIME_ALIASES[alias]) {
+          observedAliases.add(alias);
+        }
+      },
+    },
+  });
+  Babel.transform(runtimeCode, {
+    filename: 'canvas-runtime.js',
+    plugins: [guardPlugin],
+    sourceType: 'script',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+  return Array.from(observedAliases)
+    .filter(alias => !importedBaseNames.has(packageBaseName(DEPENDENCY_RUNTIME_ALIASES[alias])))
+    .map(alias => ({ alias, packageName: DEPENDENCY_RUNTIME_ALIASES[alias] }));
+}
+
+function assertDependencyManifestConsistent(runtimeCode, importedModules, options = {}) {
+  const issues = findDependencyManifestIssues(runtimeCode, importedModules);
+  if (issues.length === 0) {
+    return;
+  }
+  throw new CliError(
+    `Code Canvas 运行时代码依赖 ${issues[0].alias}，但 importedModules 缺少 "${issues[0].packageName}"。`,
+    {
+      code: 'OPENYIDA_CANVAS_DEPENDENCY_MANIFEST_MISMATCH',
+      details: {
+        stage: 'canvas_compile',
+        sourcePath: options.sourcePath || '',
+        issues,
+      },
+    }
+  );
+}
+
 function findBareDependencyGlobalIssues(source) {
   const issues = [];
   const names = new Set(Object.keys(BARE_DEPENDENCY_GLOBALS));
@@ -790,6 +932,7 @@ function compileCanvasLocal(source, options = {}) {
     });
   }
   assertNoUnavailableCanvasInstanceApis(source, options);
+  assertNoSelfReferentialDependencyBindings(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
   assertInlineCssStructure(source, options);
@@ -847,6 +990,7 @@ function compileCanvasLocal(source, options = {}) {
     code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
   });
   assertCanvasRuntimeParseable(runtimeCode, options);
+  assertDependencyManifestConsistent(runtimeCode, importedModules, options);
   return {
     runtimeCode,
     importedModules: JSON.stringify(importedModules),
@@ -913,5 +1057,8 @@ module.exports = {
   shouldAllowUnsupportedBareImports,
   assertCanvasRuntimeParseable,
   findBareDependencyGlobalIssues,
+  findSelfReferentialDependencyBindingIssues,
+  findDependencyManifestIssues,
+  assertDependencyManifestConsistent,
   MODULE_ALIAS_MAP,
 };

package/lib/app/page-linter.js

@@ -877,6 +877,30 @@ function lintYidaSource(sourceCode, filePath) {
   const lines = sourceCode.split('\n');
   const disableMap = buildLineDisableMap(lines);
 
+  lines.forEach((line, index) => {
+    const lineNumber = index + 1;
+    const uncommented = stripCommentsOnly(line);
+    if (/\b(?:App\.)?getSystemToken(?:\.json)?\b/i.test(uncommented)
+      || /\bsystemToken\b\s*[:=]/i.test(uncommented)) {
+      pushIssue(
+        errors,
+        lineNumber,
+        'system-token-frontend-forbidden',
+        t('publish.lint_system_token_frontend_forbidden'),
+        disableMap
+      );
+    }
+    if (/(?:\bconnectorId\b|['"]connectorId['"])\s*:\s*(?:(['"])\d+\1|\d+\b)/.test(uncommented)) {
+      pushIssue(
+        errors,
+        lineNumber,
+        'connector-runtime-name-required',
+        t('publish.lint_connector_runtime_name_required'),
+        disableMap
+      );
+    }
+  });
+
   findEmojiInArtifactName(filePath, {
     artifact: filePath || 'Yida page source',
     maxIssues: 20,

package/lib/app/publish.js

@@ -747,7 +747,20 @@ async function runMain(argv) {
     ['URL', pageUrl],
   ]);
   console.log(JSON.stringify(withBrowserHandoff(
-    { success: true, appType, formUuid: savedFormUuid, version, url: pageUrl, publishMode, healthCheck: healthCheckResult, navOrder: navOrderResult, navOrderWarning },
+    {
+      success: true,
+      appType,
+      formUuid: savedFormUuid,
+      version,
+      url: pageUrl,
+      publishMode,
+      publishReadbackVerified: !!(healthCheckResult && healthCheckResult.ok === true),
+      runtimeSmokeVerified: false,
+      runtimeSmokeStatus: 'not_checked',
+      healthCheck: healthCheckResult,
+      navOrder: navOrderResult,
+      navOrderWarning,
+    },
     pageUrl,
     { stage: 'publish_page_success', title: savedFormUuid },
     browserOpenMode