@alipay/alipay-aipay 1.5.6 → 1.5.7

package/skill/references/normal/scripts/alipay_cli_env.sh

@@ -43,7 +43,11 @@ fi
 
 MISSING=()
 command -v node >/dev/null 2>&1 || MISSING+=("node")
-command -v jq >/dev/null 2>&1 || MISSING+=("jq")
+if ! command -v jq >/dev/null 2>&1 \
+  || ! jq --version >/dev/null 2>&1 \
+  || ! jq -n -e --arg value ok '$value == "ok"' >/dev/null 2>&1; then
+  MISSING+=("jq")
+fi
 if ! command -v alipay-cli >/dev/null 2>&1 || ! alipay-cli version >/dev/null 2>&1; then
   MISSING+=("alipay-cli")
 fi

package/skill/references/normal/scripts/common.sh

@@ -5,6 +5,27 @@
 # 调用前置: 无
 #=============================================================================
 
+case "${HOME:-}" in
+  /*)
+    user_bin="$HOME/.local/bin"
+    if [ "$HOME" != "/" ] && [ -x "$user_bin/jq" ]; then
+      case ":${PATH:-}:" in
+        *":$user_bin:"*) ;;
+        *) PATH="${PATH:+$PATH:}$user_bin"; export PATH ;;
+      esac
+      if ! command -v jq >/dev/null 2>&1 \
+        || ! jq --version >/dev/null 2>&1 \
+        || ! jq -n -e --arg value ok '$value == "ok"' >/dev/null 2>&1; then
+        if "$user_bin/jq" --version >/dev/null 2>&1 \
+          && "$user_bin/jq" -n -e --arg value ok '$value == "ok"' >/dev/null 2>&1; then
+          jq() { "$HOME/.local/bin/jq" "$@"; }
+        fi
+      fi
+    fi
+    unset user_bin
+    ;;
+esac
+
 require_command() {
   if ! command -v "$1" >/dev/null 2>&1; then
     echo "❌ 缺少依赖命令: $1"

package/skill/references/normal/scripts/integration_message_runner.mjs

@@ -475,6 +475,10 @@ function projectSnapshotFingerprint(projectPath) {
       // Missing optional project facts do not enter the snapshot.
     }
   }
+  for (const entry of safeReaddir(canonicalPath)) {
+    if (!entry.isFile() || entry.isSymbolicLink() || !/\.(?:csproj|sln)$/iu.test(entry.name)) continue;
+    tracked.add(path.join(canonicalPath, entry.name));
+  }
   const hash = crypto.createHash('sha256');
   hash.update(`project=${canonicalPath}\n`);
   for (const file of [...tracked].sort((left, right) => left.localeCompare(right))) {
@@ -657,6 +661,170 @@ function normalizeLanguage(input) {
   throw new Error('服务端语言非法，仅支持 Java、Python、Node.js、C#、PHP');
 }
 
+const existingProjectFrameworkFallback = '沿用现有项目结构';
+const defaultFrameworks = Object.freeze({
+  Java: 'Spring Boot',
+  PHP: 'Laravel',
+  Python: 'FastAPI',
+  'C#': 'ASP.NET Core',
+  'Node.js': 'Express'
+});
+const frameworkSources = new Set([
+  'EXPLICIT',
+  'DEFAULT_NEW_PROJECT',
+  'PROJECT_INFERRED',
+  'PROJECT_STRUCTURE_FALLBACK'
+]);
+
+function readProjectMarker(projectPath, relativePath) {
+  const file = path.join(projectPath, relativePath);
+  try {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 2 * 1024 * 1024) return '';
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function readProjectJson(projectPath, relativePath) {
+  const content = readProjectMarker(projectPath, relativePath);
+  if (!content) return null;
+  try {
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function dependencyNames(manifest) {
+  const names = new Set();
+  for (const key of ['dependencies', 'devDependencies', 'peerDependencies', 'require', 'require-dev']) {
+    const dependencies = manifest?.[key];
+    if (!dependencies || typeof dependencies !== 'object' || Array.isArray(dependencies)) continue;
+    for (const name of Object.keys(dependencies)) names.add(name.toLowerCase());
+  }
+  return names;
+}
+
+function firstMatchingFramework(names, rules) {
+  for (const [framework, matches] of rules) {
+    if (matches.some((name) => names.has(name) || [...names].some((item) => item.startsWith(`${name}/`)))) {
+      return framework;
+    }
+  }
+  return '';
+}
+
+function inferFramework(projectPath, language) {
+  if (language === 'Node.js') {
+    return firstMatchingFramework(dependencyNames(readProjectJson(projectPath, 'package.json')), [
+      ['NestJS', ['@nestjs/core']],
+      ['Next.js', ['next']],
+      ['Express', ['express']],
+      ['Fastify', ['fastify']],
+      ['Koa', ['koa']],
+      ['Hono', ['hono']]
+    ]);
+  }
+  if (language === 'PHP') {
+    return firstMatchingFramework(dependencyNames(readProjectJson(projectPath, 'composer.json')), [
+      ['Laravel', ['laravel/framework']],
+      ['Symfony', ['symfony/framework-bundle', 'symfony/http-kernel']]
+    ]);
+  }
+  if (language === 'Java') {
+    const content = [
+      readProjectMarker(projectPath, 'pom.xml'),
+      readProjectMarker(projectPath, 'build.gradle'),
+      readProjectMarker(projectPath, 'build.gradle.kts')
+    ].join('\n').toLowerCase();
+    if (/spring-boot|org\.springframework\.boot/u.test(content)) return 'Spring Boot';
+    if (/io\.quarkus|quarkus-/u.test(content)) return 'Quarkus';
+    if (/io\.micronaut|micronaut-/u.test(content)) return 'Micronaut';
+    return '';
+  }
+  if (language === 'Python') {
+    const content = [
+      readProjectMarker(projectPath, 'pyproject.toml'),
+      readProjectMarker(projectPath, 'requirements.txt'),
+      readProjectMarker(projectPath, 'Pipfile')
+    ].join('\n').toLowerCase();
+    if (/(^|[^a-z])django([^a-z]|$)/u.test(content)) return 'Django';
+    if (/(^|[^a-z])fastapi([^a-z]|$)/u.test(content)) return 'FastAPI';
+    if (/(^|[^a-z])flask([^a-z]|$)/u.test(content)) return 'Flask';
+    return '';
+  }
+  if (language === 'C#') {
+    const content = safeReaddir(projectPath)
+      .filter((entry) => entry.isFile() && !entry.isSymbolicLink() && entry.name.toLowerCase().endsWith('.csproj'))
+      .map((entry) => readProjectMarker(projectPath, entry.name))
+      .join('\n').toLowerCase();
+    if (/microsoft\.net\.sdk\.web|microsoft\.aspnetcore/u.test(content)) return 'ASP.NET Core';
+    return '';
+  }
+  return '';
+}
+
+function sanitizeFramework(value) {
+  const framework = value.trim();
+  if (!framework || framework.length > 120 || /[\u0000-\u001f\u007f|`]/u.test(framework) || /https?:\/\//iu.test(framework)) {
+    throw new Error('framework 必须是安全的单行框架名称');
+  }
+  return framework;
+}
+
+function deriveFramework(projectPath, projectSelection, language) {
+  if (projectSelection === 'NEW_PROJECT' || projectSelection === 'PREPARED_NEW_PROJECT') {
+    return { framework: defaultFrameworks[language], frameworkSource: 'DEFAULT_NEW_PROJECT' };
+  }
+  const inferred = inferFramework(projectPath, language);
+  return {
+    framework: inferred || existingProjectFrameworkFallback,
+    frameworkSource: inferred ? 'PROJECT_INFERRED' : 'PROJECT_STRUCTURE_FALLBACK'
+  };
+}
+
+function resolveFramework(args, projectPath, projectSelection, language) {
+  const suppliedFramework = typeof args.framework === 'string' && args.framework.length > 0
+    ? sanitizeFramework(args.framework)
+    : '';
+  const suppliedSource = typeof args['framework-source'] === 'string' ? args['framework-source'] : '';
+  if (suppliedSource && !frameworkSources.has(suppliedSource)) throw new Error('framework-source 非法');
+
+  if (!suppliedSource) {
+    return suppliedFramework
+      ? { framework: suppliedFramework, frameworkSource: 'EXPLICIT' }
+      : deriveFramework(projectPath, projectSelection, language);
+  }
+  if (!suppliedFramework) throw new Error('framework-source 必须与 framework 同时提供');
+  if (suppliedSource === 'EXPLICIT') {
+    return { framework: suppliedFramework, frameworkSource: suppliedSource };
+  }
+
+  const derived = deriveFramework(projectPath, projectSelection, language);
+  if (derived.framework !== suppliedFramework || derived.frameworkSource !== suppliedSource) {
+    throw new Error('framework 与当前项目推导事实不一致');
+  }
+  return derived;
+}
+
+function runFrameworkResolve(args) {
+  const language = normalizeLanguage(required(args, 'language'));
+  const projectSelection = required(args, 'project-selection');
+  if (!['NEW_PROJECT', 'PREPARED_NEW_PROJECT', 'CURRENT_PROJECT', 'OTHER_PROJECT'].includes(projectSelection)) {
+    throw new Error('project-selection 非法');
+  }
+  let projectPath = '';
+  if (projectSelection === 'CURRENT_PROJECT' || projectSelection === 'OTHER_PROJECT') {
+    projectPath = fs.realpathSync(required(args, 'project-path'));
+    if (!isReadableDirectory(projectPath)) throw new Error('现有项目路径不可访问');
+  }
+  const resolved = resolveFramework(args, projectPath, projectSelection, language);
+  return JSON.stringify({ language, ...resolved });
+}
+
 function startConfirmationFacts(args) {
   const productType = required(args, 'product-type');
   const mapping = productVariants[productType];
@@ -665,7 +833,7 @@ function startConfirmationFacts(args) {
   const projectPath = required(args, 'project-path');
   const projectSelection = required(args, 'project-selection');
   const language = normalizeLanguage(required(args, 'language'));
-  const framework = required(args, 'framework');
+  const { framework, frameworkSource } = resolveFramework(args, projectPath, projectSelection, language);
   const productName = args['product-name'] || mapping.productName;
   if (productName !== mapping.productName) throw new Error('product-name 与 product-type 不匹配');
   if (!path.isAbsolute(projectPath)) throw new Error('project-path 必须是绝对路径');
@@ -697,6 +865,7 @@ function startConfirmationFacts(args) {
     projectSelection,
     language,
     framework,
+    frameworkSource,
     route,
     projectFingerprint: projectSnapshotFingerprint(projectPath)
   };
@@ -712,6 +881,7 @@ function confirmationReceipt(facts) {
     project_selection: facts.projectSelection,
     language: facts.language,
     framework: facts.framework,
+    framework_source: facts.frameworkSource,
     project_fingerprint: facts.projectFingerprint,
     route: {
       project_origin: facts.route.projectOrigin,
@@ -743,14 +913,15 @@ export function createStartConfirmation(args) {
 
 export function validateStartConfirmationReceipt(receipt) {
   const saved = decodeReceipt(receipt, receiptKinds.startConfirmation);
-  const facts = startConfirmationFacts({
+  const args = {
     'product-type': saved.product_type,
     'product-name': saved.product_name,
     'project-path': saved.project_path,
     'project-selection': saved.project_selection,
-    language: saved.language,
-    framework: saved.framework
-  });
+    language: saved.language
+  };
+  if (saved.framework_source === 'EXPLICIT') args.framework = saved.framework;
+  const facts = startConfirmationFacts(args);
   const currentReceipt = confirmationReceipt(facts);
   if (currentReceipt === receipt) return { valid: true, receipt, productType: saved.product_type };
   return {
@@ -973,6 +1144,10 @@ export async function runIntegrationMessageCli(argv = process.argv) {
     process.stderr.write(`${internalPrefix}PROJECT_CONFIRM_RECEIPT=${result.receipt}\n`);
     return;
   }
+  if (command === 'framework-resolve') {
+    console.log(runFrameworkResolve(args));
+    return;
+  }
   if (command === 'checklist-scope-receipt') {
     process.stderr.write(`${internalPrefix}CHECKLIST_SCOPE_RECEIPT=${createChecklistScopeReceipt(required(args, 'project-path'))}\n`);
     return;
@@ -1030,7 +1205,7 @@ export async function runIntegrationMessageCli(argv = process.argv) {
     console.log(await runChecklistResult(args));
     return;
   }
-  throw new Error('用法: integration_message_runner.mjs <resolve-project|locate-projects|start-confirm|checklist-scope-receipt|a2m-execution-guard|a2m-execution-result|context-required|product-clarify|product-unsupported|windows-sandbox-setup|local-acceptance-notice|a2m-test-start|sandbox-android-client|service-not-ready|safety-closeout|windows-sandbox-summary|checklist-result> ...');
+  throw new Error('用法: integration_message_runner.mjs <resolve-project|locate-projects|framework-resolve|start-confirm|checklist-scope-receipt|a2m-execution-guard|a2m-execution-result|context-required|product-clarify|product-unsupported|windows-sandbox-setup|local-acceptance-notice|a2m-test-start|sandbox-android-client|service-not-ready|safety-closeout|windows-sandbox-summary|checklist-result> ...');
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/skill/references/normal/scripts/managed_jq.mjs

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+
+import { execFile } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import https from 'node:https';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+
+const execFileAsync = promisify(execFile);
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const manifestPath = path.resolve(scriptDir, '../json/managed-jq-assets.json');
+const internalPrefix = 'ALIPAY_AIPAY_INTERNAL:JQ_PREPARE=';
+
+function readManifest() {
+  const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (
+    parsed?.schemaVersion !== 1 ||
+    !/^\d+\.\d+\.\d+$/u.test(parsed.version || '') ||
+    !Number.isInteger(parsed.downloadTimeoutMs) || parsed.downloadTimeoutMs <= 0 ||
+    !Number.isInteger(parsed.idleTimeoutMs) || parsed.idleTimeoutMs <= 0 ||
+    !Number.isInteger(parsed.maxBytes) || parsed.maxBytes <= 0 ||
+    !Number.isInteger(parsed.maxRedirects) || parsed.maxRedirects < 0 ||
+    !parsed.assets || typeof parsed.assets !== 'object' || Array.isArray(parsed.assets)
+  ) {
+    throw new Error('managed jq 资产清单非法');
+  }
+  return Object.freeze(parsed);
+}
+
+export const managedJqManifest = readManifest();
+
+export function managedJqPath(homeDir = process.env.HOME || os.homedir()) {
+  if (!path.isAbsolute(homeDir) || path.resolve(homeDir) === path.parse(homeDir).root) {
+    throw new Error('jq 用户安装目录必须位于绝对 Home 路径下');
+  }
+  return path.join(path.resolve(homeDir), '.local', 'bin', 'jq');
+}
+
+export function resolveManagedJqAsset(platform = process.platform, arch = process.arch) {
+  const asset = managedJqManifest.assets[`${platform}-${arch}`];
+  return asset ? Object.freeze({ ...asset, version: managedJqManifest.version }) : null;
+}
+
+export async function checkManagedJqAtPath(jqPath, expectedVersion = managedJqManifest.version) {
+  try {
+    const { stdout } = await execFileAsync(jqPath, ['--version'], {
+      encoding: 'utf8',
+      timeout: 5000,
+      windowsHide: true
+    });
+    const version = String(stdout).trim().replace(/^jq-/u, '');
+    if (version !== expectedVersion) return { installed: false };
+    const { stdout: smokeOutput } = await execFileAsync(
+      jqPath,
+      ['-n', '-c', '--arg', 'value', 'ok', '{value:$value}'],
+      { encoding: 'utf8', timeout: 5000, windowsHide: true }
+    );
+    if (String(smokeOutput).trim() !== '{"value":"ok"}') return { installed: false };
+    return { installed: true, version, path: jqPath };
+  } catch {
+    return { installed: false };
+  }
+}
+
+function assertAllowedDownloadUrl(value) {
+  const url = new URL(value);
+  const githubHost = url.hostname === 'github.com' || url.hostname.endsWith('.githubusercontent.com');
+  if (url.protocol !== 'https:' || !githubHost || url.username || url.password) {
+    throw new Error('jq 下载地址未通过 GitHub HTTPS 白名单校验');
+  }
+  return url;
+}
+
+function downloadBuffer(
+  urlValue,
+  deadline = Date.now() + managedJqManifest.downloadTimeoutMs,
+  redirectCount = 0
+) {
+  return new Promise((resolve, reject) => {
+    let url;
+    try {
+      url = assertAllowedDownloadUrl(urlValue);
+    } catch (error) {
+      reject(error);
+      return;
+    }
+
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      reject(new Error(`jq 下载超过 ${managedJqManifest.downloadTimeoutMs / 1000} 秒`));
+      return;
+    }
+
+    let settled = false;
+    const request = https.get(url, { headers: { 'User-Agent': 'alipay-aipay-jq-installer' } });
+    const totalTimer = setTimeout(() => {
+      request.destroy(new Error(`jq 下载超过 ${managedJqManifest.downloadTimeoutMs / 1000} 秒`));
+    }, remaining);
+
+    function fail(error) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(totalTimer);
+      reject(error);
+    }
+
+    request.setTimeout(Math.min(managedJqManifest.idleTimeoutMs, remaining), () => {
+      request.destroy(new Error(`jq 下载连续 ${managedJqManifest.idleTimeoutMs / 1000} 秒无响应`));
+    });
+
+    request.on('response', (response) => {
+      const status = response.statusCode || 0;
+      const location = response.headers.location;
+      if (status >= 300 && status < 400 && location) {
+        response.resume();
+        clearTimeout(totalTimer);
+        settled = true;
+        if (redirectCount >= managedJqManifest.maxRedirects) {
+          reject(new Error('jq 下载重定向次数过多'));
+          return;
+        }
+        downloadBuffer(new URL(location, url).toString(), deadline, redirectCount + 1).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) {
+        response.resume();
+        fail(new Error(`jq 下载返回 HTTP ${status || 'UNKNOWN'}`));
+        return;
+      }
+
+      const declaredLength = Number(response.headers['content-length'] || 0);
+      if (declaredLength > managedJqManifest.maxBytes) {
+        response.resume();
+        fail(new Error('jq 下载文件超过大小上限'));
+        return;
+      }
+
+      const chunks = [];
+      let size = 0;
+      response.on('data', (chunk) => {
+        size += chunk.length;
+        if (size > managedJqManifest.maxBytes) {
+          response.destroy(new Error('jq 下载文件超过大小上限'));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.on('end', () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(totalTimer);
+        resolve(Buffer.concat(chunks));
+      });
+      response.on('error', fail);
+    });
+    request.on('error', fail);
+  });
+}
+
+export async function installManagedJqAsset(asset, targetPath, downloader = downloadBuffer) {
+  const targetDir = path.dirname(targetPath);
+  const tempPath = path.join(targetDir, `.jq-${process.pid}-${randomBytes(6).toString('hex')}.tmp`);
+  await fsp.mkdir(targetDir, { recursive: true, mode: 0o700 });
+  try {
+    const body = await downloader(asset.url);
+    const digest = createHash('sha256').update(body).digest('hex');
+    if (digest !== asset.sha256) throw new Error('jq 下载文件 SHA-256 校验失败');
+    await fsp.writeFile(tempPath, body, { flag: 'wx', mode: 0o700 });
+    await fsp.chmod(tempPath, 0o755);
+    const check = await checkManagedJqAtPath(tempPath, asset.version);
+    if (!check.installed) throw new Error('jq 用户级文件版本或 JSON 功能验证失败');
+    await fsp.rename(tempPath, targetPath);
+    return { ...check, path: targetPath };
+  } finally {
+    await fsp.rm(tempPath, { force: true }).catch(() => undefined);
+  }
+}
+
+export async function prepareManagedJq(options = {}) {
+  const platform = options.platform || process.platform;
+  const arch = options.arch || process.arch;
+  const asset = resolveManagedJqAsset(platform, arch);
+  if (!asset) return { status: 'UNSUPPORTED', platform, arch };
+  const targetPath = managedJqPath(options.homeDir);
+  const existing = await checkManagedJqAtPath(targetPath, asset.version);
+  if (existing.installed) return { status: 'READY', source: 'EXISTING', ...existing };
+  const installed = await installManagedJqAsset(asset, targetPath, options.downloader);
+  return { status: 'READY', source: 'INSTALLED', ...installed };
+}
+
+export async function runManagedJqCli(argv = process.argv) {
+  if (argv.length !== 3 || argv[2] !== 'prepare') throw new Error('用法: managed_jq.mjs prepare');
+  try {
+    const result = await prepareManagedJq();
+    process.stderr.write(`${internalPrefix}${result.status}\n`);
+    return result.status === 'READY' ? 0 : 2;
+  } catch {
+    process.stderr.write(`${internalPrefix}FAILED\n`);
+    return 1;
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runManagedJqCli().then((code) => {
+    process.exitCode = code;
+  }).catch((error) => {
+    process.stderr.write(`${internalPrefix}FAILED\n`);
+    process.exitCode = 1;
+  });
+}

package/skill/references/normal/scripts/platform_compat.mjs

@@ -32,7 +32,10 @@ export function checkCliEnvironment(options = {}) {
   const missing = [];
 
   if (!currentNodeAvailable(env)) missing.push('node');
-  if (requireJq && !commandRuns('jq', ['--version'], { env })) missing.push('jq');
+  if (requireJq && (
+    !commandRuns('jq', ['--version'], { env }) ||
+    !commandRuns('jq', ['-n', '-e', '--arg', 'value', 'ok', '$value == "ok"'], { env })
+  )) missing.push('jq');
   if (requireAlipayCli && !commandRuns('alipay-cli', ['version'], { env })) missing.push('alipay-cli');
 
   return missing;

package/skill/references/normal/scripts/runtime.mjs

@@ -165,6 +165,12 @@ async function dispatch(domain, args) {
     return;
   }
   if (domain === 'env') {
+    if (args[0] === 'prepare-jq') {
+      if (args.length !== 1) throw new Error('用法: runtime.mjs env prepare-jq');
+      const { runManagedJqCli } = await import('./managed_jq.mjs');
+      process.exitCode = await runManagedJqCli(cliArgv(['prepare']));
+      return;
+    }
     const { isWindowsPlatform } = await import('./platform_compat.mjs');
     if (!isWindowsPlatform()) {
       return runShell(path.join(scriptDir, 'alipay_cli_env.sh'), path.dirname(scriptDir), args);

package/skill/references/onboarding/flow.md

@@ -175,7 +175,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-execute-read
 ```
 
 - 唯一 `CLI_ENV:READY`：直接进入 Step 3，不读取完整安装文档。
-- `CLI_ENV:NEEDS_SETUP`：此时才读取 `../normal/alipay-cli-env.md`，按其现有安装、PATH、联网权限和验证规则补齐缺失项，再重跑同一检查；未取得 `READY` 不得进入 Step 3。
+- `CLI_ENV:NEEDS_SETUP`：此时才读取 `../normal/alipay-cli-env.md`。若唯一 `CLI_ENV_MISSING` 包含 `jq`，先以所需网络和 `~/.local/bin` 写权限执行一次 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" env prepare-jq`；唯一 `ALIPAY_AIPAY_INTERNAL:JQ_PREPARE=READY` 后原样重跑 `env check`。`FAILED|UNSUPPORTED`，或 `READY` 后复检仍缺 jq 时，由 Agent 按环境文档执行当前系统首选包管理器兜底并再次复检；macOS 必须从清华镜像开始，明确失败后才依次选择阿里云、中科大和直连，不并发、不回到 `prepare-jq` 循环。其他缺失项按现有安装、PATH、联网权限和验证规则补齐后重跑同一检查；不得重复执行 `prepare-jq` 或新增业务确认点，未取得 `CLI_ENV:READY` 不得进入 Step 3。
 - 其他输出、非 0 或 marker 冲突：停在本步骤核对脚本，不得猜测环境已就绪。
 
 若组合动作本身不可用，原子 fallback 固定为先执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" flow onboarding execute --product-type "$PRODUCT_TYPE"`，再执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" env check --product-type "$PRODUCT_TYPE"`；fallback 不得重复 stage 或重复环境检查。

package/skill/references/runtime-entry.md

@@ -52,7 +52,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" render <messageId> --va
 
 三种入口均只在无法从已有产品名称或业务描述可靠确定唯一产品时执行 flow 登记的 `product-clarify` runner；不得推定或手写澄清。产品明确但 MCC 尚无检索输入时使用 `mcc-clarify`；已有经营描述后先按 Onboarding flow 读取一次当前 `modules/mcc-reference.md` 做 Agent 语义候选，再统一调用 `mcc-resolve-plan` 由 runner 复核、合并和渲染；用户直接提供当前表内完整 MCC 编码时可跳过 Agent 泛化并由 runner 精确校验。不得拆回 `mcc-search + mcc-candidates`、先旧检索失败后临时猜测，或为方案展示再拼 renderer 输入。
 
-代码开发或完整接入缺项目位置/技术栈时，执行 `integration.context.required` 或 `integration.project_path.required` 标准消息。先区分新建与复用；`PROJECT_INPUT` 保留原话，明确新建项目/网站/商城/应用等产物时必须 `resolve-project --intent new`，不得因当前目录有项目改为复用。未知现有项目先轻量定位，所有路径再由 `resolve-project` 解析；补齐前不初始化、装依赖或改文件。
+代码开发或完整接入缺项目位置/服务端语言时，执行 `integration.context.required` 或 `integration.project_path.required` 标准消息；框架缺失不触发补问。先区分新建与复用；`PROJECT_INPUT` 保留原话，明确新建项目/网站/商城/应用等产物时必须 `resolve-project --intent new`，不得因当前目录有项目改为复用。未知现有项目先轻量定位，所有路径再由 `resolve-project` 解析。路径和服务端语言明确后使用 `integration-message framework-resolve`：新项目按语言采用固定默认框架，现有项目优先从依赖推导，无法推导时沿用现有结构，用户明确框架始终优先；补齐前不初始化、装依赖或改文件。
 
 每轮代码开发只渲染一次非阻塞 `integration.start.confirm`，两种意图复用同一次检查器事实并覆盖 Integration 步骤 1 至步骤8：代码开发校验；`full_process` 在方案展示前已完成步骤 1，方案送达且 receipt 有效后进入步骤 3。Onboarding 只保留一次非阻塞方案展示；方案送达且 MCC 唯一事实有效后，正常路径执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-execute-ready --product-type "$PRODUCT_TYPE"`，该组合动作只串行加载 `flow onboarding execute` 并执行既有 `env check`，不跨用户输入、授权页或任何写操作；执行后不得再重复单独加载 execute phase 或重复环境检查。服务修改仍保留绑定当前摘要的阻塞确认。签约材料完整后直接提交，服务创建摘要后直接创建，新建应用公钥校验成功后直接提审。