@coralai/sps-cli 0.65.87 → 0.65.91

package/dist/providers/storage/syncRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncRunner.d.ts","sourceRoot":"","sources":["../../../src/providers/storage/syncRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EAAiB,KAAK,SAAS,EAAe,MAAM,kBAAkB,CAAC;AAG9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,gDAAgD;IAChD,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAQD,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAyEpF;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,CAgB9F"}

package/dist/providers/storage/syncRunner.js

@@ -0,0 +1,119 @@
+/**
+ * @module        providers/storage/syncRunner
+ * @description   对账循环:发现项目 → 新鲜度过滤 → 逐项目同步 → 汇总。
+ *
+ * @layer         providers
+ *
+ * 🔴 **它是对账循环,不是事件驱动**(照抄 coral 的判断,它是对的):
+ *    文件事件会漏(worker 在别的用户下写 / 容器里写 / 进程崩在一半),
+ *    而漏掉的表现是"桶里少了一个文件",**没有任何报错**。对账每轮都会自愈。
+ *
+ * 🔴 **跑在 daemon,不在 console 的请求路径。**
+ *    sidecar 是独立进程,而 console 是**共享事件循环** —— 同一段代码换了宿主就会开始
+ *    阻塞 `/api/health` 探针与 SSE 心跳。
+ *    > 判据:**同步在移交件里是对的 —— 它本来跑在 CLI 里;换了宿主之后才变错。**
+ *
+ * 🔴 **每一类"没做"都要有自己的计数**,别合并成一个"跳过":
+ *    超期跳过 / 范围内一个路径都不存在 / 权限读不到 / 超大 / 被下限拒 —— 五种原因,五个数。
+ *    合并的代价今天实测过:coral 那个 `0` 同时表示"从没改过"和"目录不存在",吃掉了 36 个项目。
+ */
+import { MinioBackend } from './MinioBackend.js';
+import { discoverProjects, scopeLastModified } from './scanWorkspace.js';
+import { activeStorageConfig } from './storageConfig.js';
+import { syncProject } from './syncProject.js';
+import { readSyncScope, scopeForProduct } from './syncScope.js';
+/** 默认缩略图实现:惰性加载 sharp(它带原生二进制,不该为启动而拉进内存)。 */
+async function defaultMakeThumb(input) {
+    const sharp = (await import('sharp')).default;
+    return sharp(input).resize(320, 320, { fit: 'inside', withoutEnlargement: true }).webp({ quality: 78 }).toBuffer();
+}
+export async function runSyncPass(opts) {
+    const log = opts.log ?? ((l) => console.log(l));
+    const cfg = activeStorageConfig();
+    // 🔴 未配置/关着 ⇒ **整条路径不存在**。不是错误,也不该打日志刷屏。
+    if (!cfg && !opts.storage)
+        return null;
+    const deps = {
+        storage: opts.storage ?? new MinioBackend(cfg),
+        makeThumb: opts.makeThumb ?? defaultMakeThumb,
+        maxBytes: opts.maxBytes,
+    };
+    const started = opts.now ?? Date.now();
+    const scope = readSyncScope();
+    let projects = await discoverProjects(opts.root);
+    if (opts.onlyProject)
+        projects = projects.filter((p) => p.rel === opts.onlyProject);
+    const sum = {
+        projects: 0, scanned: 0, uploaded: 0, thumbs: 0, skipped: 0, failed: 0,
+        unreadable: 0, missing: 0, skippedDot: 0, oversized: 0, rejected: 0, skippedOld: 0, skippedEmptyScope: 0,
+        defaultScope: 0, perProject: [],
+    };
+    for (const p of projects) {
+        const resolved = scopeForProduct(p.product, scope);
+        if (opts.sinceDays > 0 && !opts.onlyProject) {
+            const last = await scopeLastModified(p.abs, resolved.include);
+            if (last === null) {
+                sum.skippedEmptyScope++; // ← 不是"很旧",是范围内什么都没有
+                continue;
+            }
+            if (last < started - opts.sinceDays * 86_400_000) {
+                sum.skippedOld++;
+                continue;
+            }
+        }
+        if (resolved.usedDefault)
+            sum.defaultScope++;
+        try {
+            const s = await syncProject(deps, p, resolved.include, resolved.usedDefault);
+            sum.perProject.push(s);
+        }
+        catch (e) {
+            // 单个项目炸掉不拖垮整轮 —— 但要出现在汇总里
+            sum.perProject.push({
+                project: p.rel, scanned: 0, uploaded: 0, thumbs: 0, skipped: 0, failed: 1,
+                unreadable: 0, missing: 0, skippedDot: 0, oversized: 0, rejected: [], usedDefaultScope: resolved.usedDefault,
+                errors: [e instanceof Error ? e.message : String(e)],
+            });
+        }
+    }
+    for (const s of sum.perProject) {
+        sum.projects++;
+        sum.scanned += s.scanned;
+        sum.uploaded += s.uploaded;
+        sum.thumbs += s.thumbs;
+        sum.skipped += s.skipped;
+        sum.failed += s.failed;
+        sum.unreadable += s.unreadable;
+        sum.missing += s.missing;
+        sum.skippedDot += s.skippedDot;
+        sum.oversized += s.oversized;
+        sum.rejected += s.rejected.length;
+    }
+    log(formatSummary(sum, started, opts));
+    // 只印有动静的项目;**失败必须每轮都印**(它不会自己消失)
+    for (const s of sum.perProject) {
+        if (s.uploaded || s.thumbs || s.failed || s.unreadable || s.oversized || s.rejected.length) {
+            log(`  ${s.project}: +${s.uploaded} 缩略图${s.thumbs} 失败${s.failed}${s.rejected.length ? ` 拒${s.rejected.length}` : ''}`);
+            for (const e of s.errors)
+                log(`    ! ${e}`);
+        }
+    }
+    return sum;
+}
+/** 汇总行。每一类"没做"都占一格 —— 一个悄悄缩小了范围的同步器,和一个坏掉的同步器,日志上一模一样。 */
+export function formatSummary(sum, started, opts) {
+    const ms = (opts.now ?? Date.now()) - started;
+    return (`[sps-sync] 项目 ${sum.projects} · 扫 ${sum.scanned} · 上传 ${sum.uploaded} · 缩略图 ${sum.thumbs} · ` +
+        `已在桶 ${sum.skipped} · 失败 ${sum.failed} · ${ms}ms` +
+        // 基线是 0 ⇒ 非 0 即变化,所以是告警不是趋势
+        (sum.unreadable ? ` · 🔴 因权限读不到而跳过 ${sum.unreadable} 个文件(基线应为 0 —— 立刻查是防线生效还是误伤)` : '') +
+        (sum.rejected ? ` · 🔴 被安全下限拒 ${sum.rejected} 个文件(**只跳过它们**,其余照传)` : '') +
+        (sum.oversized ? ` · 🔴 超单文件上限 ${sum.oversized} 个(未同步)` : '') +
+        (sum.skippedOld ? ` · 因超过 ${opts.sinceDays} 天没动而跳过 ${sum.skippedOld} 个项目` : '') +
+        // 🔴 只报**事实**,不猜原因:实测 195 个项目里有 48 个范围内确实什么都没有
+        //    (coralplatform 的 21 个里 14 个只有 AGENTS.md)—— 那是正常状态,不是"声明写错"。
+        //    一个每轮都在猜错原因的告警,会把人训练成忽略它。
+        (sum.skippedEmptyScope ? ` · 范围内无文件而跳过 ${sum.skippedEmptyScope} 个项目` : '') +
+        (sum.defaultScope ? ` · ⚠️ ${sum.defaultScope} 个项目没有产品声明,用了窄兜底(只 assets/)` : ''));
+}
+//# sourceMappingURL=syncRunner.js.map

package/dist/providers/storage/syncRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncRunner.js","sourceRoot":"","sources":["../../../src/providers/storage/syncRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAiC,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAsChE,8CAA8C;AAC9C,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AACrH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,yCAAyC;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,IAAI,GAAa;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,YAAY,CAAC,GAA8B,CAAC;QACzE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gBAAgB;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,IAAI,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,WAAW;QAAE,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC;IAEpF,MAAM,GAAG,GAAgB;QACvB,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACtE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACxG,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,qBAAqB;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;gBACjD,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW;YAAE,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC7E,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAClB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;gBACzE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,WAAW;gBAC5G,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,EAAE,CAAC;QACf,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;QACzB,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC3B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QACvB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;QACzB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QACvB,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC;QAC/B,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;QACzB,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC;QAC/B,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;QAC7B,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACvC,iCAAiC;IACjC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3F,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,IAAqB;IACpF,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC;IAC9C,OAAO,CACL,iBAAiB,GAAG,CAAC,QAAQ,QAAQ,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,KAAK;QAC9F,OAAO,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,MAAM,MAAM,EAAE,IAAI;QACjD,4BAA4B;QAC5B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,UAAU,8BAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,QAAQ,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,SAAS,WAAW,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,+CAA+C;QAC/C,iEAAiE;QACjE,8BAA8B;QAC9B,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,iBAAiB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,YAAY,6BAA6B,CAAC,CAAC,CAAC,EAAE,CAAC,CACjF,CAAC;AACJ,CAAC"}

package/dist/providers/storage/syncScope.d.ts

@@ -0,0 +1,25 @@
+export interface ProductScope {
+    /**
+     * 相对项目根的路径。以 `/` 结尾 = 整个目录(递归);否则 = 单个文件。
+     * **不支持通配** —— 通配会把 `package.json` / `tsconfig.json` 这类顺带带上,
+     * 而"带上了什么"没人会去 diff(coral 选具名白名单的理由,实测有效)。
+     */
+    include: string[];
+}
+export interface SyncScope {
+    /** 产品名 → 声明。键就是工作区布局里的产品段。 */
+    products: Record<string, ProductScope>;
+}
+/** 没有声明时的兜底。**窄**,而且用它这件事要被报出来。 */
+export declare const DEFAULT_INCLUDE: readonly ["assets/"];
+export declare function syncScopeFile(): string;
+export declare function readSyncScope(): SyncScope | null;
+export declare function writeSyncScope(scope: SyncScope): void;
+export interface ResolvedScope {
+    include: string[];
+    /** 🔴 是否用了兜底。调用方**必须**把它报进日志 —— 否则"范围悄悄变窄"看不出来。 */
+    usedDefault: boolean;
+}
+/** 取某产品的同步范围。找不到声明 → 兜底 + `usedDefault: true`。 */
+export declare function scopeForProduct(product: string, scope: SyncScope | null): ResolvedScope;
+//# sourceMappingURL=syncScope.d.ts.map

package/dist/providers/storage/syncScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncScope.d.ts","sourceRoot":"","sources":["../../../src/providers/storage/syncScope.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACxC;AAED,mCAAmC;AACnC,eAAO,MAAM,eAAe,sBAAuB,CAAC;AAEpD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,SAAS,GAAG,IAAI,CAgBhD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAErD;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mDAAmD;IACnD,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,GAAG,aAAa,CAIvF"}

package/dist/providers/storage/syncScope.js

@@ -0,0 +1,68 @@
+/**
+ * @module        providers/storage/syncScope
+ * @description   "同步**什么**"的声明(`~/.coral/sync-scope.json`)。**按产品**,由平台写入,sps 只执行。
+ *
+ * @layer         providers
+ *
+ * 🔴 **为什么不是 `template.json`(计划里原本这么写,落地时改了):**
+ *    `scaffold.ts:178` —— **`template.json` 不进项目**。所以对一个已存在的工作区,
+ *    sps **无从查到它是哪个模板铺的**,更取不到模板里的声明。
+ *    ⇒ 按模板声明这条路只对"将来新建的项目"成立,而同步要覆盖**存量 141 个**。
+ *    (这一格是写代码时才发现的,不是设计时想到的 —— 已回写进实施计划文档。)
+ *
+ * 🔴 **为什么按「产品」而不是按「项目」:** 差异本来就在产品级 ——
+ *    `assets/` 是通用的,而 `docs/PRD.md` / `docs/build-manifest.json` / `<产品>.json`
+ *    是产品词表。而 sps **已经知道产品**:它是工作区布局的第二段
+ *    (`<WORKSPACES_ROOT>/t<租户>/<产品>/<项目>`,见 `assetLocator.ts:52`)。
+ *
+ * 🔴 **这不违反 §2.1 第①条(配置里放"去哪儿",不放"同步什么")。**
+ *    那一条禁的是**sps 把产品知识写死在自己代码里**(coral sidecar 的
+ *    `scan.ts:38` 用「目录下含 assets/」猜产品语义,静默漏掉 36 个设计师阶段项目)。
+ *    这里的内容**由平台通过 API 写入**,sps 一个产品名都不硬编码 —— 是**数据**不是**代码**。
+ *
+ * ⚠️ **没有声明时只同步 `assets/`,而且必须每轮报出来。**
+ *    同步怕少发,所以窄缺省是有代价的;代价的解法不是放宽缺省(那会把 node_modules 推上去),
+ *    而是**让"我用的是缺省"这件事出现在日志里**。
+ *    > 判据:一个悄悄缩小了范围的同步器,和一个坏掉的同步器,日志上一模一样。
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { hardenSecretFile, writeSecretFile } from '../../infra/secretFile.js';
+import { coralRoot } from '../../shared/runtimePaths.js';
+/** 没有声明时的兜底。**窄**,而且用它这件事要被报出来。 */
+export const DEFAULT_INCLUDE = ['assets/'];
+export function syncScopeFile() {
+    return join(coralRoot(), 'sync-scope.json');
+}
+export function readSyncScope() {
+    const p = syncScopeFile();
+    if (!existsSync(p))
+        return null;
+    hardenSecretFile(p);
+    try {
+        const raw = JSON.parse(readFileSync(p, 'utf-8'));
+        if (!raw.products || typeof raw.products !== 'object')
+            return null;
+        const products = {};
+        for (const [k, v] of Object.entries(raw.products)) {
+            const inc = v?.include;
+            if (Array.isArray(inc) && inc.every((x) => typeof x === 'string'))
+                products[k] = { include: inc };
+        }
+        return { products };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSyncScope(scope) {
+    writeSecretFile(syncScopeFile(), `${JSON.stringify(scope, null, 2)}\n`);
+}
+/** 取某产品的同步范围。找不到声明 → 兜底 + `usedDefault: true`。 */
+export function scopeForProduct(product, scope) {
+    const declared = scope?.products[product]?.include;
+    if (declared && declared.length > 0)
+        return { include: [...declared], usedDefault: false };
+    return { include: [...DEFAULT_INCLUDE], usedDefault: true };
+}
+//# sourceMappingURL=syncScope.js.map

package/dist/providers/storage/syncScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncScope.js","sourceRoot":"","sources":["../../../src/providers/storage/syncScope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAgBzD,mCAAmC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,CAAU,CAAC;AAEpD,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAuB,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,GAAG,GAAI,CAA8B,EAAE,OAAO,CAAC;YACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,eAAe,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAQD,kDAAkD;AAClD,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,KAAuB;IACtE,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IACnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC3F,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC"}

package/dist/providers/storage/syncable.d.ts

@@ -0,0 +1,47 @@
+export type SyncRejection = {
+    code: 'ABSOLUTE';
+    rel: string;
+} | {
+    code: 'DOT_SEGMENT';
+    rel: string;
+} | {
+    code: 'PARENT_SEGMENT';
+    rel: string;
+} | {
+    code: 'EMPTY_SEGMENT';
+    rel: string;
+} | {
+    code: 'ESCAPES_PROJECT';
+    rel: string;
+};
+/**
+ * 纯字符串这一半(**不含**软链检查 —— 那半必须走 `isRealUnderRoot`)。
+ *
+ * 单独抽出来不是为了复用,是为了让**两半都必须被调用**这件事在类型上看得见:
+ * 只调这一半的实现会"看起来对",而它恰恰漏掉了唯一挡得住 agent 自造软链的那道。
+ */
+export declare function syncableShape(rel: string): SyncRejection | null;
+/**
+ * 完整判据 = 形状 + **realpath 围栏**。
+ *
+ * @param rel      相对项目根的路径(声明枚举出来的)
+ * @param absPath  它在盘上的绝对路径
+ * @param projectDir 项目根
+ */
+export declare function syncable(rel: string, absPath: string, projectDir: string): Promise<SyncRejection | null>;
+/**
+ * 对一整批做下限判定。
+ *
+ * 🔴 **返回全部拒绝项,不是第一个** —— coral 的取舍 3:清单会过期,配套的是
+ * **拒绝时把名字报出去**,而不是"尽量列全"。列不全没关系,漏的会被看见。
+ *
+ * 🔴 **调用方必须"枚举完再推第一个字节"**:围栏若写在上传循环里,
+ * 状态码确实会回错,但**排在拒绝项前面的文件已经进桶了** ——
+ * 「整体失败」是关于**副作用**的断言,不是关于返回码的(coral 实测,用
+ * `assert(uploaded.length === 0)` 才照出来)。
+ */
+export declare function screenAll(files: {
+    rel: string;
+    abs: string;
+}[], projectDir: string): Promise<SyncRejection[]>;
+//# sourceMappingURL=syncable.d.ts.map

package/dist/providers/storage/syncable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncable.d.ts","sourceRoot":"","sources":["../../../src/providers/storage/syncable.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAU/D;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAM/B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,EACrC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAO1B"}

package/dist/providers/storage/syncable.js

@@ -0,0 +1,84 @@
+/**
+ * @module        providers/storage/syncable
+ * @description   **同步**这条路的安全下限。设计见 `object-storage-and-workspace-sync.md` §2.1 第五条。
+ *
+ * @layer         providers
+ *
+ * 🔴🔴 **它与发布的下限方向相反,别互相抄。**
+ * ```
+ * 发布 publishable()  怕**多发** —— 树里会长出什么由 agent 决定,黑名单追不上 ⇒ **后缀白名单**
+ * 同步 syncable()     怕**少发** —— 用户会放 .blend / .psd / .aseprite ⇒ **不能用后缀白名单**
+ * ```
+ * 抄错方向的表现是:**用户的源文件不见了,而且不报错**。
+ * (「照搬一份现成的安全规则」恰恰是最容易顺手抄整份的时候。)
+ *
+ * 🔴 **声明决定"要什么",本模块决定"绝不给什么"** —— 后者不是产品知识,是主体安全,
+ * 且**不可被声明或配置放宽**。它防的是一件具体的事:项目树里有带活 token 的
+ * `.claude/settings.local.json`(实测:coral 那侧 `publishable('src/main.js')` 放行,
+ * 而 `readFile` 实际拿到 `ANTHROPIC_AUTH_TOKEN=sk-live-…`,落点还是公开可取的前缀)。
+ *
+ * 🔴 **真正拦住凭据的是"任一路径段以 `.` 开头"这一条**,不是别的:
+ * `settings.local.json` 本身后缀无害,是 `.claude/` 这个点开头段拦住的。
+ * ⇒ 将来谁"为了支持 `.well-known/` 放宽点开头",会在不知情的情况下把底线整个打开。
+ * > 判据:**守卫要标注它靠哪一条在生效** —— 否则放宽的人以为自己在动一条无关的规则。
+ */
+import { isRealUnderRoot } from '../../core/pathFence.js';
+/**
+ * 纯字符串这一半(**不含**软链检查 —— 那半必须走 `isRealUnderRoot`)。
+ *
+ * 单独抽出来不是为了复用,是为了让**两半都必须被调用**这件事在类型上看得见:
+ * 只调这一半的实现会"看起来对",而它恰恰漏掉了唯一挡得住 agent 自造软链的那道。
+ */
+export function syncableShape(rel) {
+    if (!rel)
+        return { code: 'EMPTY_SEGMENT', rel };
+    if (rel.startsWith('/'))
+        return { code: 'ABSOLUTE', rel };
+    for (const seg of rel.split('/')) {
+        if (!seg)
+            return { code: 'EMPTY_SEGMENT', rel };
+        if (seg === '..')
+            return { code: 'PARENT_SEGMENT', rel };
+        // ← 承重的是这条:`.claude/`、`.git/`、`.sps/` 全靠它
+        if (seg.startsWith('.'))
+            return { code: 'DOT_SEGMENT', rel };
+    }
+    return null;
+}
+/**
+ * 完整判据 = 形状 + **realpath 围栏**。
+ *
+ * @param rel      相对项目根的路径(声明枚举出来的)
+ * @param absPath  它在盘上的绝对路径
+ * @param projectDir 项目根
+ */
+export async function syncable(rel, absPath, projectDir) {
+    const shape = syncableShape(rel);
+    if (shape)
+        return shape;
+    // 软链:声明可以指到一个含软链的目录,软链再指向 ~/.coral。字符串判据一条都挡不住。
+    if (!(await isRealUnderRoot(absPath, projectDir)))
+        return { code: 'ESCAPES_PROJECT', rel };
+    return null;
+}
+/**
+ * 对一整批做下限判定。
+ *
+ * 🔴 **返回全部拒绝项,不是第一个** —— coral 的取舍 3:清单会过期,配套的是
+ * **拒绝时把名字报出去**,而不是"尽量列全"。列不全没关系,漏的会被看见。
+ *
+ * 🔴 **调用方必须"枚举完再推第一个字节"**:围栏若写在上传循环里,
+ * 状态码确实会回错,但**排在拒绝项前面的文件已经进桶了** ——
+ * 「整体失败」是关于**副作用**的断言,不是关于返回码的(coral 实测,用
+ * `assert(uploaded.length === 0)` 才照出来)。
+ */
+export async function screenAll(files, projectDir) {
+    const out = [];
+    for (const f of files) {
+        const r = await syncable(f.rel, f.abs, projectDir);
+        if (r)
+            out.push(r);
+    }
+    return out;
+}
+//# sourceMappingURL=syncable.js.map

package/dist/providers/storage/syncable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncable.js","sourceRoot":"","sources":["../../../src/providers/storage/syncable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAS1D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;IAChD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;QACzD,0CAA0C;QAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,OAAe,EACf,UAAkB;IAElB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,gDAAgD;IAChD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAqC,EACrC,UAAkB;IAElB,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coralai/sps-cli",
-  "version": "0.65.87",
+  "version": "0.65.91",
   "description": "SPS CLI — AI-driven development pipeline orchestrator",
   "type": "module",
   "main": "dist/main.js",
@@ -19,7 +19,8 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:e2e": "playwright test",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run check && npm run build",
+    "check": "npm run typecheck && npm run typecheck:test && npm run check:api-docs"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -98,5 +99,8 @@
       "types": "./dist/chat-protocol/index.d.ts",
       "import": "./dist/chat-protocol/index.js"
     }
+  },
+  "optionalDependencies": {
+    "minio": "^8.0.7"
   }
 }