@h-ai/cli 0.1.0-alpha.51 → 0.1.0-alpha.53

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "0.1.0-alpha.51",
+  "version": "0.1.0-alpha.53",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -34,7 +34,7 @@
     "ora": "^9.1.0",
     "prompts": "^2.4.2",
     "yaml": "^2.7.0",
-    "@h-ai/core": "0.1.0-alpha.51"
+    "@h-ai/core": "0.1.0-alpha.53"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",

package/templates/apps/api/Dockerfile.hbs

@@ -3,13 +3,16 @@ FROM node:22-bookworm-slim AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
 COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm build
-RUN pnpm --filter {{api.servicePackageName}} --prod deploy /prod/app
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{api.servicePackageName}} --prod deploy /prod/app
 
 FROM node:22-bookworm-slim AS runtime-base
 
@@ -29,6 +32,6 @@ CMD ["node", "dist/index.js"]
 
 FROM runtime-base AS runtime-with-data
 
-COPY --from=embedded-data --chown=node:node . /app/data
+COPY --from=embedded-data --chown=node:node / /app/data/
 
 FROM runtime-base AS runtime

package/templates/apps/api/apps/{{projectName}}-service/data/.gitkeep.hbs

@@ -0,0 +1 @@
+

package/templates/apps/fullstack/.dockerignore.hbs

@@ -1,4 +1,5 @@
 .git
+Dockerfile
 .github
 .agents
 .claude
@@ -8,6 +9,7 @@
 **/build
 **/dist
 **/node_modules
+node_modules
 playwright-report
 test-results
 **/data

package/templates/apps/fullstack/Dockerfile.hbs

@@ -1,17 +1,21 @@
 # syntax=docker/dockerfile:1.7
 FROM node:22-bookworm-slim AS build
 
-ARG PUBLIC_API_BASE
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
-ENV PUBLIC_API_BASE=$PUBLIC_API_BASE
+ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
 COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm build
-RUN pnpm --filter {{fullstack.servPackageName}} --prod deploy /prod/service
+
+FROM build AS service-build
+
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{fullstack.servPackageName}} --prod deploy /prod/service
 
 FROM node:22-bookworm-slim AS service
 
@@ -20,7 +24,7 @@ ENV HOST=0.0.0.0
 ENV PORT=3000
 WORKDIR /app
 
-COPY --from=build --chown=node:node /prod/service ./
+COPY --from=service-build --chown=node:node /prod/service ./
 RUN mkdir -p /app/data && chown node:node /app/data
 
 USER node
@@ -29,43 +33,26 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 CMD ["node", "dist/index.js"]
 
+FROM service AS runtime-with-data
+
+COPY --from=embedded-data --chown=node:node / /app/data/
+
+FROM service AS runtime
+
 {{#if fullstack.frontends.web}}
 FROM nginxinc/nginx-unprivileged:1.29-alpine AS web
 
+ENV PUBLIC_API_BASE=
+ENV NGINX_ENVSUBST_FILTER=PUBLIC_API_BASE_BASE64
+ENV NGINX_ENVSUBST_OUTPUT_DIR=/tmp/hai-runtime-config
+
+RUN mkdir -p /tmp/hai-runtime-config
 COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --chmod=755 docker/19-runtime-config.envsh /docker-entrypoint.d/19-runtime-config.envsh
+COPY docker/runtime-config.js.template /etc/nginx/templates/runtime-config.js.template
 COPY --from=build /workspace/apps/{{projectName}}-web/dist /usr/share/nginx/html
 
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
-
-FROM node:22-bookworm-slim AS runtime-base
-
-ENV NODE_ENV=production
-ENV HAI_WEB_PORT=8080
-ENV HAI_SERV_PORT=3000
-WORKDIR /app
-
-COPY --from=build --chown=node:node /prod/service ./service
-COPY --from=build --chown=node:node /workspace/apps/{{projectName}}-web/dist ./web
-COPY --chown=node:node docker/fullstack-server.mjs ./fullstack-server.mjs
-RUN mkdir -p /app/service/data && chown node:node /app/service/data
-
-USER node
-EXPOSE 8080
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-  CMD node -e "fetch('http://127.0.0.1:'+process.env.HAI_WEB_PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
-CMD ["node", "fullstack-server.mjs"]
-
-FROM runtime-base AS runtime-with-data
-
-COPY --from=embedded-data --chown=node:node . /app/service/data
-
-FROM runtime-base AS runtime
-{{else}}
-FROM service AS runtime-with-data
-
-COPY --from=embedded-data --chown=node:node . /app/data
-
-FROM service AS runtime
+  CMD wget -Y off -q -O /dev/null http://127.0.0.1:8080/health || exit 1
 {{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/index.html.hbs

@@ -6,10 +6,11 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>{{projectName}} Web</title>
+    <script src="/runtime-config.js"></script>
   </head>
   <body>
     <div id="app"></div>
     <script type="module" src="/src/main.ts"></script>
   </body>
 </html>
-{{/if}}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/public/runtime-config.js.hbs

@@ -0,0 +1 @@
+globalThis.__HAI_PUBLIC_CONFIG__ = {}

package/templates/apps/fullstack/apps/{{projectName}}-web/tests/api.test.ts.hbs

@@ -24,5 +24,32 @@ describe('fetchAppInfo', () => {
 
     expect(info.name).toBe('{{fullstack.servPackageName}}')
   })
+
+  it('uses API origin injected at container startup', async () => {
+    Object.assign(globalThis, {
+      __HAI_PUBLIC_CONFIG__: { apiBase: 'https://api.example.com' },
+    })
+    let requestedUrl = ''
+    const fetchFn: typeof fetch = async (input) => {
+      requestedUrl = input instanceof Request ? input.url : String(input)
+      return new Response(JSON.stringify({
+        success: true,
+        data: {
+          name: '{{fullstack.servPackageName}}',
+          version: '0.1.0',
+          startedAt: '2026-01-01T00:00:00.000Z',
+          frontends: ['web'],
+        },
+      }), { headers: { 'content-type': 'application/json' } })
+    }
+
+    try {
+      await fetchAppInfo({ fetchFn })
+      expect(requestedUrl).toContain('https://api.example.com/api/v1')
+    }
+    finally {
+      Reflect.deleteProperty(globalThis, '__HAI_PUBLIC_CONFIG__')
+    }
+  })
 })
 {{/if}}

package/templates/apps/fullstack/docker/19-runtime-config.envsh.hbs

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# 使用 Base64 跨越 shell、envsubst 与 JavaScript 字符串边界，避免 URL 字符改变脚本语义。
+PUBLIC_API_BASE_BASE64="$(printf '%s' "${PUBLIC_API_BASE:-}" | base64 | tr -d '\n')"
+export PUBLIC_API_BASE_BASE64

package/templates/apps/fullstack/docker/nginx.conf.hbs

@@ -9,6 +9,12 @@ server {
     try_files $uri $uri/ /index.html;
   }
 
+  location = /runtime-config.js {
+    alias /tmp/hai-runtime-config/runtime-config.js;
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+  }
+
   location = /health {
     access_log off;
     add_header Content-Type text/plain;

package/templates/apps/fullstack/docker/runtime-config.js.template.hbs

@@ -0,0 +1,3 @@
+globalThis.__HAI_PUBLIC_CONFIG__ = {
+  apiBase: new TextDecoder().decode(Uint8Array.from(atob('${PUBLIC_API_BASE_BASE64}'), value => value.charCodeAt(0))),
+}

package/templates/apps/fullstack/package.json.hbs

@@ -12,12 +12,10 @@
     "compile": "pnpm typecheck && pnpm build",
     "build": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present build",
     "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
-    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest .",
-    "docker:build:service": "docker build --target service -t {{projectName}}-serv:latest ."{{#if fullstack.frontends.web}},
+    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest ."{{#if fullstack.frontends.web}},
     "docker:build:web": "docker build --target web -t {{projectName}}-web:latest ."{{/if}},
     "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest .",
-    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest .",
-    "podman:build:service": "podman build --format docker --jobs=1 --target service -t {{projectName}}-serv:latest ."{{#if fullstack.frontends.web}},
+    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest ."{{#if fullstack.frontends.web}},
     "podman:build:web": "podman build --format docker --jobs=1 --target web -t {{projectName}}-web:latest ."{{/if}},
     "package": "pnpm build{{#if fullstack.frontends.web}} && pnpm --filter {{projectName}}-web package{{/if}}{{#if fullstack.frontends.app}} && pnpm --filter {{projectName}}-app package{{/if}}{{#if fullstack.frontends.desktop}} && pnpm --filter {{projectName}}-desktop package{{/if}}",
     "deploy": "pnpm package",

package/templates/apps/fullstack/packages/{{projectName}}-serv/README.md.hbs

@@ -18,7 +18,8 @@
 
 ## 容器运行
 
-- 根目录 `pnpm docker:build` / `pnpm podman:build` 生成 Web + Service 同源镜像；`pnpm docker:build:service` / `pnpm podman:build:service` 只生成本服务镜像。
-- 合并镜像的配置挂载点为 `/app/service/config`，数据目录为 `/app/service/data`；service-only 镜像对应 `/app/config` 与 `/app/data`。
+- 根目录 `pnpm docker:build` / `pnpm podman:build` 直接生成本服务镜像；Web 使用独立的 `docker:build:web` / `podman:build:web` 镜像。
+- 服务镜像直接由 `@h-ai/serv` 对外监听，配置挂载点为 `/app/config`，数据目录为 `/app/data`，不包含额外转发进程。
+- Web 镜像不烘焙 API 地址；启动时使用 `-e PUBLIC_API_BASE=https://api.example.com` 注入，同一镜像可部署到不同环境。未设置时 Web 默认请求自身 origin。
 - YAML 配置使用 `${ENV_NAME:default}` 接收运行时环境变量；不要把密钥写入镜像。
 - 将 SQLite/本地存储放入本目录 `data/` 后运行 `pnpm docker:build:data` / `pnpm podman:build:data`，可生成带初始数据的镜像，持续写入仍应使用 volume。

package/templates/apps/fullstack/packages/{{projectName}}-serv/data/.gitkeep.hbs

@@ -0,0 +1 @@
+

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/api-client.ts.hbs

@@ -38,10 +38,18 @@ export async function fetchAppInfo(options: FetchAppInfoOptions = {}): Promise<A
 }
 
 function resolveDefaultApiOrigin(): string {
-  return import.meta.env.PUBLIC_API_BASE
+  return resolveRuntimeApiOrigin()
+    || import.meta.env.PUBLIC_API_BASE
     || (typeof globalThis.location === 'undefined' ? DEFAULT_API_ORIGIN : globalThis.location.origin)
 }
 
+function resolveRuntimeApiOrigin(): string | undefined {
+  const runtimeConfig = (globalThis as typeof globalThis & {
+    __HAI_PUBLIC_CONFIG__?: { apiBase?: string }
+  }).__HAI_PUBLIC_CONFIG__
+  return runtimeConfig?.apiBase
+}
+
 function normalizeApiBaseUrl(value: string): string {
   const trimmed = trimTrailingSlash(value)
   return trimmed.endsWith('/api/v1')

package/templates/base/.gitignore.hbs

@@ -13,4 +13,5 @@ ios
 .DS_Store
 test-results/
 playwright-report/
-data/
+data/*
+!**/data/.gitkeep

package/templates/base/Dockerfile.hbs

@@ -4,11 +4,14 @@ FROM node:22-bookworm-slim AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
 COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm build
 
 FROM nginxinc/nginx-unprivileged:1.29-alpine AS runtime
@@ -24,13 +27,16 @@ FROM node:22-bookworm-slim AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
 COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm build
-RUN pnpm --filter {{projectName}} --prod deploy /prod/app
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{projectName}} --prod deploy /prod/app
 
 FROM node:22-bookworm-slim AS runtime-base
 
@@ -50,7 +56,7 @@ CMD ["node", "build"]
 
 FROM runtime-base AS runtime-with-data
 
-COPY --from=embedded-data --chown=node:node . /app/data
+COPY --from=embedded-data --chown=node:node / /app/data/
 
 FROM runtime-base AS runtime
 {{/if}}

package/templates/base/package.json.hbs

@@ -1,6 +1,6 @@
 {
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.51",
+  "version": "0.1.0-alpha.53",
   "private": true,
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
   "keywords": ["hai", {{#unless isSvelteOnlyApp}}"sveltekit", {{/unless}}"svelte5", "{{appType}}"],

package/templates/skills/hai-ai/SKILL.md

@@ -337,6 +337,10 @@ if (!playable.success)
 - 平台不支持的输入方式（如 OpenAI/MiMo 的持续音频输入）会抛 `AUDIO_UNSUPPORTED_INPUT`，不伪装成实时。
 - 浏览器/移动端经 `@h-ai/serv` 统一语音 WebSocket 入口访问；客户端用已登录 HTTP 请求获取短期一次性 ticket，`@h-ai/ai/client` 通过 `audio.getTicket` 建连，不把 IAM access token 放入 URL。浏览器客户端区分正常结束、取消（`AUDIO_CANCELLED`）与 `end` 前异常断连（`AUDIO_CONNECTION_FAILED`）；服务端 error 帧保留领域错误码，`synthesize` 不返回未完成的部分音频。
 
+### 本地 CPU 模型服务
+
+hai-framework 源码仓库提供 `pnpm model <name> --device cpu` 与 `pnpm model:run <name>`，默认优先使用 Podman，可构建/启动 `faster-whisper-large-v3`、`indextts-2.5`、`qwen3-4b`。三套权重均优先从清单锁定的 ModelScope revision 下载并复用容器 volume，Hugging Face 只作回退。Whisper/IndexTTS 仍配置为 `audio.models[].baseUrl`，Qwen3-4B 仍配置为 OpenAI-compatible `llm.models[].baseUrl`；部署位置不进入 Provider 名称。离线部署使用准备权重后的 bundled 镜像。
+
 ## 文生图（Image）
 
 `ai.image` 只暴露稳定的提示词、模型别名、像素尺寸、可选参考图和图片字节；OpenAI、Google、Qwen、Seedream 与 Pollinations 的请求结构、鉴权、响应解析和临时 URL 下载均封装在内部 Provider。

package/templates/skills/hai-app-create/SKILL.md

@@ -358,7 +358,9 @@ core.init() → reldb.init() → cache.init() → iam.init() → createBusinessT
 
 - 保持脚手架根目录 `Dockerfile`、`.dockerignore` 与 `package.json` 中 `docker:build*` / `podman:build*` 命令同步。
 - Podman 多阶段构建保持 `--format docker --jobs=1`；前者保留 `HEALTHCHECK`，后者避免部分 Podman 5.8/Buildah 组合在并行 stage 构建时触发内部 semaphore panic。
-- SvelteKit 服务使用 Node adapter；纯 Vite 前端使用带 SPA fallback 的静态镜像；fullstack 默认支持 Web + Service 同源镜像。
+- 先复制 lockfile 与 workspace 配置执行 `pnpm fetch`，再复制源码并离线安装、构建；避免源码变化重复下载依赖，同时兼容新增 workspace。
+- SvelteKit 服务使用 Node adapter；纯 Vite 前端使用带 SPA fallback 的静态镜像；fullstack 的 Service 与 Web 分别交付，Service 直接监听且不增加转发进程。
+- Web 的 `PUBLIC_*` 部署配置在容器启动时生成静态运行时配置，不作为 build arg 烘焙，确保同一镜像可跨环境部署。
 - 配置文件随镜像提供，并允许只读挂载覆盖；密钥只通过环境变量或 `--env-file` 注入。
 - 普通构建不携带 `data/`；只有用户明确运行 `docker:build:data` / `podman:build:data` 时才通过 named build context 嵌入 SQLite/本地存储初始快照。
 - 数据库和本地存储的持续写入必须落到 volume，不能依赖镜像可写层。

package/templates/apps/fullstack/docker/fullstack-server.mjs.hbs

@@ -1,194 +0,0 @@
-{{! @skipIfEmpty }}
-{{#if fullstack.frontends.web}}
-import { spawn } from 'node:child_process'
-import { createReadStream } from 'node:fs'
-import { readFile, stat } from 'node:fs/promises'
-import { createServer, request as createProxyRequest } from 'node:http'
-import { extname, relative, resolve, sep } from 'node:path'
-import process from 'node:process'
-
-const serviceRoot = '/app/service'
-const webRoot = '/app/web'
-const publicPort = readPort('HAI_WEB_PORT', 8080)
-const servicePort = readPort('HAI_SERV_PORT', 3000)
-const indexHtml = await readFile(resolve(webRoot, 'index.html'), 'utf8')
-const indexWithRuntimeApi = injectRuntimeApiOrigin(indexHtml)
-let shuttingDown = false
-
-// 服务进程只监听容器回环地址，所有外部流量统一经过同源 Web 入口。
-const service = spawn(process.execPath, ['dist/index.js'], {
-  cwd: serviceRoot,
-  env: {
-    ...process.env,
-    HOST: '127.0.0.1',
-    PORT: String(servicePort),
-  },
-  stdio: 'inherit',
-})
-
-const server = createServer(async (request, response) => {
-  const requestUrl = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`)
-
-  if (isServicePath(requestUrl.pathname)) {
-    proxyToService(request, response)
-    return
-  }
-
-  if (request.method !== 'GET' && request.method !== 'HEAD') {
-    response.writeHead(405, { Allow: 'GET, HEAD' })
-    response.end()
-    return
-  }
-
-  await serveWebAsset(requestUrl.pathname, request.method === 'HEAD', response)
-})
-
-server.listen(publicPort, '0.0.0.0', () => {
-  process.stdout.write(`Fullstack container listening on 0.0.0.0:${publicPort}\n`)
-})
-
-service.once('error', (error) => {
-  process.stderr.write(`Service process failed to start: ${error.message}\n`)
-  void shutdown('service-error')
-})
-
-service.once('exit', (code, signal) => {
-  if (shuttingDown)
-    return
-  process.stderr.write(`Service process exited unexpectedly (code=${String(code)}, signal=${String(signal)})\n`)
-  process.exitCode = code ?? 1
-  server.close()
-})
-
-for (const signal of ['SIGINT', 'SIGTERM']) {
-  process.once(signal, () => {
-    void shutdown(signal)
-  })
-}
-
-function readPort(name, fallback) {
-  const raw = process.env[name]
-  if (raw === undefined || raw === '')
-    return fallback
-  const value = Number(raw)
-  if (!Number.isInteger(value) || value < 1 || value > 65535)
-    throw new Error(`${name} must be an integer between 1 and 65535`)
-  return value
-}
-
-function isServicePath(pathname) {
-  return pathname === '/health'
-    || pathname === '/ready'
-    || pathname === '/openapi.json'
-    || pathname.startsWith('/api/')
-    || pathname.startsWith('/docs')
-    || pathname.startsWith('/_hai/')
-}
-
-function proxyToService(request, response) {
-  const proxyRequest = createProxyRequest({
-    host: '127.0.0.1',
-    port: servicePort,
-    method: request.method,
-    path: request.url,
-    headers: {
-      ...request.headers,
-      host: `127.0.0.1:${servicePort}`,
-      'x-forwarded-host': request.headers.host ?? '',
-      'x-forwarded-proto': request.headers['x-forwarded-proto'] ?? 'http',
-    },
-  }, (proxyResponse) => {
-    response.writeHead(proxyResponse.statusCode ?? 502, proxyResponse.headers)
-    proxyResponse.pipe(response)
-  })
-
-  proxyRequest.once('error', (error) => {
-    if (response.headersSent) {
-      response.destroy(error)
-      return
-    }
-    response.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
-    response.end('Service unavailable')
-  })
-  request.pipe(proxyRequest)
-}
-
-async function serveWebAsset(pathname, headOnly, response) {
-  let decodedPath
-  try {
-    decodedPath = decodeURIComponent(pathname)
-  }
-  catch {
-    response.writeHead(400)
-    response.end()
-    return
-  }
-
-  const candidate = resolve(webRoot, `.${decodedPath}`)
-  const relativePath = relative(webRoot, candidate)
-  if (relativePath.startsWith(`..${sep}`) || relativePath === '..') {
-    response.writeHead(403)
-    response.end()
-    return
-  }
-
-  try {
-    const file = await stat(candidate)
-    if (file.isFile()) {
-      response.writeHead(200, {
-        'content-length': file.size,
-        'content-type': contentType(candidate),
-        'x-content-type-options': 'nosniff',
-      })
-      if (headOnly)
-        response.end()
-      else
-        createReadStream(candidate).pipe(response)
-      return
-    }
-  }
-  catch {
-    // SPA 路由没有对应静态文件时回退到 index.html。
-  }
-
-  const body = Buffer.from(indexWithRuntimeApi)
-  response.writeHead(200, {
-    'content-length': body.length,
-    'content-type': 'text/html; charset=utf-8',
-    'x-content-type-options': 'nosniff',
-  })
-  response.end(headOnly ? undefined : body)
-}
-
-function injectRuntimeApiOrigin(html) {
-  const script = `<script>(()=>{const p=new URLSearchParams(location.search);if(!p.has('apiBase')){p.set('apiBase',location.origin);history.replaceState(null,'',location.pathname+'?'+p+location.hash)}})()</script>`
-  return html.includes('<head>') ? html.replace('<head>', `<head>${script}`) : `${script}${html}`
-}
-
-function contentType(file) {
-  return {
-    '.css': 'text/css; charset=utf-8',
-    '.html': 'text/html; charset=utf-8',
-    '.ico': 'image/x-icon',
-    '.js': 'text/javascript; charset=utf-8',
-    '.json': 'application/json; charset=utf-8',
-    '.map': 'application/json; charset=utf-8',
-    '.png': 'image/png',
-    '.svg': 'image/svg+xml',
-    '.webp': 'image/webp',
-    '.woff': 'font/woff',
-    '.woff2': 'font/woff2',
-  }[extname(file).toLowerCase()] ?? 'application/octet-stream'
-}
-
-async function shutdown(signal) {
-  if (shuttingDown)
-    return
-  shuttingDown = true
-  process.stdout.write(`Stopping fullstack container (${signal})\n`)
-  server.close()
-  service.kill('SIGTERM')
-  const forceExit = setTimeout(() => service.kill('SIGKILL'), 10_000)
-  forceExit.unref()
-}
-{{/if}}