@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/website/src/routes/+page.svelte.hbs

@@ -1,32 +1,51 @@
 {{!-- 官网首页 --}}
-<script lang="ts">
+<script lang='ts'>
   /**
    * 官网首页
    */
+  import { resolve } from '$app/paths'
+  import { page } from '$app/state'
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
 {{/if}}
+  import { Badge } from '@h-ai/ui'
 </script>
 
 <svelte:head>
 {{#if hasI18n}}
-  <title>{m.app_title()}</title>
+  <title>{page.data.appConfig.name}</title>
 {{else}}
-  <title>官网</title>
+  <title>{page.data.appConfig.name}</title>
 {{/if}}
 </svelte:head>
 
-<section class="hero min-h-[60vh] bg-base-200">
-  <div class="hero-content text-center">
-    <div class="max-w-md">
+<section class='hero min-h-[60vh] bg-gradient-to-b from-base-200 to-base-100'>
+  <div class='hero-content text-center'>
+    <div class='max-w-xl'>
+      <div class='flex justify-center'>
+        <Badge variant='primary'>
+          <span class='icon-[tabler--sparkles] size-4'></span>
 {{#if hasI18n}}
-      <h1 class="text-5xl font-bold">{m.page_home_title()}</h1>
-      <p class="py-6">{m.page_home_subtitle()}</p>
-      <a href="/about" class="btn btn-primary">{m.page_home_cta()}</a>
+          {page.data.appConfig.name}
 {{else}}
-      <h1 class="text-5xl font-bold">欢迎</h1>
-      <p class="py-6">基于 hai Agent Framework 构建</p>
-      <a href="/about" class="btn btn-primary">了解更多</a>
+          由 hai 驱动
+{{/if}}
+        </Badge>
+      </div>
+{{#if hasI18n}}
+      <h1 class='mt-5 text-5xl font-black tracking-tight'>{m.page_home_title()}</h1>
+      <p class='py-6 text-base-content/60'>{m.page_home_subtitle()}</p>
+      <a href={resolve('/about', {})} class='btn btn-primary'>
+        <span class='icon-[tabler--arrow-right] size-5'></span>
+        {m.page_home_cta()}
+      </a>
+{{else}}
+      <h1 class='mt-5 text-5xl font-black tracking-tight'>欢迎</h1>
+      <p class='py-6 text-base-content/60'>基于 hai Agent Framework 构建</p>
+      <a href={resolve('/about', {})} class='btn btn-primary'>
+        <span class='icon-[tabler--arrow-right] size-5'></span>
+        了解更多
+      </a>
 {{/if}}
     </div>
   </div>

package/templates/apps/website/src/routes/about/+page.svelte.hbs

@@ -1,11 +1,12 @@
 {{!-- 关于页面 --}}
-<script lang="ts">
+<script lang='ts'>
   /**
    * 关于页面
    */
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
 {{/if}}
+  import { Card, PageHeader } from '@h-ai/ui'
 </script>
 
 <svelte:head>
@@ -16,12 +17,16 @@
 {{/if}}
 </svelte:head>
 
-<section class="py-16 px-4 max-w-4xl mx-auto">
+<section class='py-16 px-4 max-w-4xl mx-auto'>
 {{#if hasI18n}}
-  <h1 class="text-3xl font-bold mb-8">{m.page_about_title()}</h1>
-  <p class="text-lg text-gray-600">{m.page_about_desc()}</p>
+  <PageHeader title={m.page_about_title()} />
+  <Card shadow='sm' class='bg-base-100'>
+    <p class='text-lg text-base-content/70'>{m.page_about_desc()}</p>
+  </Card>
 {{else}}
-  <h1 class="text-3xl font-bold mb-8">关于我们</h1>
-  <p class="text-lg text-gray-600">了解我们的团队与使命。</p>
+  <PageHeader title='关于我们' />
+  <Card shadow='sm' class='bg-base-100'>
+    <p class='text-lg text-base-content/70'>了解我们的团队与使命。</p>
+  </Card>
 {{/if}}
 </section>

package/templates/apps/website/src/routes/api/health/+server.ts

@@ -4,6 +4,9 @@
 import type { RequestHandler } from './$types'
 import { kit } from '@h-ai/kit'
 
+// 仅供SSR运行期检查；静态产物不发布健康API或固定时间戳。
+export const prerender = false
+
 export const GET: RequestHandler = async ({ locals }) => {
   return kit.response.ok({
     status: 'ok',

package/templates/apps/website/src/routes/contact/+page.svelte.hbs

@@ -1,11 +1,25 @@
 {{!-- 联系页面 --}}
-<script lang="ts">
+<script lang='ts'>
   /**
    * 联系我们页面
    */
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
 {{/if}}
+  import { Button, Card, FormField, FormLayout, Input, notifyWarning, PageHeader, Textarea } from '@h-ai/ui'
+
+  let name = $state('')
+  let email = $state('')
+  let message = $state('')
+
+  function handleSubmit(event: SubmitEvent) {
+    event.preventDefault()
+{{#if hasI18n}}
+    notifyWarning(m.page_contact_unavailable())
+{{else}}
+    notifyWarning('在线留言尚未开通，请使用其他联系方式。您的输入已保留。')
+{{/if}}
+  }
 </script>
 
 <svelte:head>
@@ -16,44 +30,40 @@
 {{/if}}
 </svelte:head>
 
-<section class="py-16 px-4 max-w-2xl mx-auto">
+<section class='py-16 px-4 max-w-2xl mx-auto'>
 {{#if hasI18n}}
-  <h1 class="text-3xl font-bold mb-8">{m.page_contact_title()}</h1>
-  <p class="text-lg text-gray-600 mb-8">{m.page_contact_desc()}</p>
+  <PageHeader title={m.page_contact_title()} description={m.page_contact_desc()} />
 {{else}}
-  <h1 class="text-3xl font-bold mb-8">联系我们</h1>
-  <p class="text-lg text-gray-600 mb-8">有任何疑问？欢迎联系我们。</p>
+  <PageHeader title='联系我们' description='有任何疑问？欢迎联系我们。' />
 {{/if}}
 
-  <form class="space-y-4">
-    <div class="form-control">
-{{#if hasI18n}}
-      <label class="label" for="name"><span class="label-text">{m.page_contact_name()}</span></label>
-{{else}}
-      <label class="label" for="name"><span class="label-text">姓名</span></label>
-{{/if}}
-      <input id="name" type="text" class="input input-bordered w-full" />
-    </div>
-    <div class="form-control">
-{{#if hasI18n}}
-      <label class="label" for="email"><span class="label-text">{m.page_contact_email()}</span></label>
-{{else}}
-      <label class="label" for="email"><span class="label-text">邮箱</span></label>
-{{/if}}
-      <input id="email" type="email" class="input input-bordered w-full" />
-    </div>
-    <div class="form-control">
-{{#if hasI18n}}
-      <label class="label" for="message"><span class="label-text">{m.page_contact_message()}</span></label>
-{{else}}
-      <label class="label" for="message"><span class="label-text">留言</span></label>
-{{/if}}
-      <textarea id="message" class="textarea textarea-bordered w-full" rows="4"></textarea>
-    </div>
+  <Card shadow='sm' class='bg-base-100'>
+    <form onsubmit={handleSubmit}>
+      <FormLayout columns={2} labelPosition='top'>
 {{#if hasI18n}}
-    <button type="submit" class="btn btn-primary w-full">{m.page_contact_submit()}</button>
+        <FormField for='name' label={m.page_contact_name()} required>
+          <Input id='name' type='text' bind:value={name} required />
+        </FormField>
+        <FormField for='email' label={m.page_contact_email()} required>
+          <Input id='email' type='email' bind:value={email} required />
+        </FormField>
+        <FormField for='message' label={m.page_contact_message()} required>
+          <Textarea id='message' rows={4} bind:value={message} required />
+        </FormField>
+        <Button type='submit' variant='primary' class='w-full'>{m.page_contact_submit()}</Button>
 {{else}}
-    <button type="submit" class="btn btn-primary w-full">发送</button>
+        <FormField for='name' label='姓名' required>
+          <Input id='name' type='text' bind:value={name} required />
+        </FormField>
+        <FormField for='email' label='邮箱' required>
+          <Input id='email' type='email' bind:value={email} required />
+        </FormField>
+        <FormField for='message' label='留言' required>
+          <Textarea id='message' rows={4} bind:value={message} required />
+        </FormField>
+        <Button type='submit' variant='primary' class='w-full'>发送</Button>
 {{/if}}
-  </form>
+      </FormLayout>
+    </form>
+  </Card>
 </section>

package/templates/apps/website/src/routes/services/+page.svelte.hbs

@@ -1,10 +1,25 @@
 {{!-- 服务页面 --}}
-<script lang="ts">
+<script lang='ts'>
   /**
    * 服务页面
    */
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
+{{/if}}
+  import { Card, PageHeader } from '@h-ai/ui'
+
+{{#if hasI18n}}
+  const services = $derived([
+    { id: 'consulting', title: m.page_services_item1(), desc: m.page_services_desc(), icon: 'icon-[tabler--message-circle]' },
+    { id: 'development', title: m.page_services_item2(), desc: m.page_services_desc(), icon: 'icon-[tabler--code]' },
+    { id: 'operations', title: m.page_services_item3(), desc: m.page_services_desc(), icon: 'icon-[tabler--server-cog]' },
+  ])
+{{else}}
+  const services = [
+    { id: 'consulting', title: '咨询服务', desc: '提供专业的技术咨询与解决方案。', icon: 'icon-[tabler--message-circle]' },
+    { id: 'development', title: '定制开发', desc: '根据需求定制开发高质量应用。', icon: 'icon-[tabler--code]' },
+    { id: 'operations', title: '运维支持', desc: '提供全方位的系统运维与技术支持。', icon: 'icon-[tabler--server-cog]' },
+  ]
 {{/if}}
 </script>
 
@@ -16,48 +31,20 @@
 {{/if}}
 </svelte:head>
 
-<section class="py-16 px-4 max-w-4xl mx-auto">
+<section class='mx-auto w-full max-w-[120rem] px-4 py-16 sm:px-6 lg:px-8'>
 {{#if hasI18n}}
-  <h1 class="text-3xl font-bold mb-8">{m.page_services_title()}</h1>
-  <p class="text-lg text-gray-600 mb-12">{m.page_services_desc()}</p>
+  <PageHeader title={m.page_services_title()} description={m.page_services_desc()} />
 {{else}}
-  <h1 class="text-3xl font-bold mb-8">我们的服务</h1>
-  <p class="text-lg text-gray-600 mb-12">我们提供以下专业服务。</p>
+  <PageHeader title='我们的服务' description='我们提供以下专业服务。' />
 {{/if}}
 
-  <div class="grid grid-cols-1 md:grid-cols-3 gap-8">
-    <div class="card bg-base-100 shadow">
-      <div class="card-body">
-{{#if hasI18n}}
-        <h2 class="card-title">{m.page_services_item1()}</h2>
-        <p>{m.page_services_desc()}</p>
-{{else}}
-        <h2 class="card-title">咨询服务</h2>
-        <p>提供专业的技术咨询与解决方案。</p>
-{{/if}}
-      </div>
-    </div>
-    <div class="card bg-base-100 shadow">
-      <div class="card-body">
-{{#if hasI18n}}
-        <h2 class="card-title">{m.page_services_item2()}</h2>
-        <p>{m.page_services_desc()}</p>
-{{else}}
-        <h2 class="card-title">定制开发</h2>
-        <p>根据需求定制开发高质量应用。</p>
-{{/if}}
-      </div>
-    </div>
-    <div class="card bg-base-100 shadow">
-      <div class="card-body">
-{{#if hasI18n}}
-        <h2 class="card-title">{m.page_services_item1()}</h2>
-        <p>{m.page_services_desc()}</p>
-{{else}}
-        <h2 class="card-title">运维支持</h2>
-        <p>提供全方位的系统运维与技术支持。</p>
-{{/if}}
-      </div>
-    </div>
+  <div class='grid grid-cols-1 md:grid-cols-3 gap-6'>
+    {#each services as service (service.id)}
+      <Card shadow='sm' class='bg-base-100'>
+        <span class='{service.icon} size-8 text-primary'></span>
+        <h2 class='mt-3 text-lg font-semibold'>{service.title}</h2>
+        <p class='mt-1 text-sm text-base-content/60'>{service.desc}</p>
+      </Card>
+    {/each}
   </div>
 </section>

package/templates/base/.dockerignore.hbs

@@ -0,0 +1,27 @@
+**/.git
+**/node_modules
+**/.pnpm-store
+**/.cache
+**/.svelte-kit
+**/.turbo
+**/build
+**/dist
+**/coverage
+**/playwright-report
+**/test-results
+**/src-tauri/target
+**/hash-core/target
+tmp
+**/*.tar
+.github
+.agents
+.claude
+.codex
+.opencode
+android
+ios
+**/data
+*.log
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai

package/templates/base/.gitignore.hbs

@@ -0,0 +1,41 @@
+# 构建产物目录
+node_modules
+{{#unless isSvelteOnlyApp}}
+.svelte-kit
+{{/unless}}
+build
+dist
+.turbo
+android
+ios
+**/src/lib/paraglide
+**/src-tauri/gen/
+**/src-tauri/target/
+**/hash-core/target/
+
+# 日志测试目录
+*.log
+test-results/
+playwright-report/
+
+
+# 系统文件
+.DS_Store
+
+# 本地数据目录
+**/data/
+
+# 构建与部署产物（镜像 / Compose tar / 私有运行配置）
+.hai/
+*.tar
+
+# 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
+.env.local
+.env.*.local
+
+# 构建器生成的安装输入快照
+**/images/dependencies/
+
+# 项目本地缓存
+**/.pnpm-store/
+**/.cache/

package/templates/base/.npmrc.hbs

@@ -0,0 +1 @@
+# 注册表与认证可配置在此；pnpm 专属设置统一位于 pnpm-workspace.yaml。

package/templates/base/e2e/app.spec.ts.hbs

@@ -0,0 +1,213 @@
+{{#if features.iam}}
+import { randomUUID } from 'node:crypto'
+{{/if}}
+import { mkdir } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { expect, test } from '@playwright/test'
+
+{{#if_eq appType 'admin'}}
+test('high contrast appearance is selectable and survives reload', async ({ page }) => {
+  await page.goto('./')
+  const header = page.locator('header').first()
+  await header.getByRole('button', { name: /选择主题|Select theme|テーマを選択/, exact: true }).click()
+  await header.getByRole('button', { name: /高对比|High contrast|ハイコントラスト/, exact: true }).click()
+  await expect(page.locator('html')).toHaveAttribute('data-theme', 'high-contrast')
+  await page.reload()
+  await expect(page.locator('html')).toHaveAttribute('data-theme', 'high-contrast')
+  await expect.poll(() => page.evaluate(() => getComputedStyle(document.documentElement).colorScheme)).toBe('dark')
+  await header.getByRole('button', { name: /选择主题|Select theme|テーマを選択/, exact: true }).press('Enter')
+  await header.getByRole('button', { name: /简洁商务|Formal|ビジネス（角丸なし）/, exact: true }).press('Enter')
+  await expect(page.locator('html')).toHaveAttribute('data-theme', 'formal')
+  await page.reload()
+  await expect(page.locator('html')).toHaveAttribute('data-theme', 'formal')
+  expect(await header.locator('button').first().evaluate(element => getComputedStyle(element).borderTopLeftRadius)).toBe('0px')
+})
+{{/if_eq}}
+
+{{#if_eq appType 'h5'}}
+test.use({ viewport: { width: 390, height: 844 } })
+{{/if_eq}}
+{{#if isCapacitorApp}}
+test.use({ viewport: { width: 390, height: 844 } })
+{{/if}}
+
+/** 首页从真实浏览器页面发起，覆盖基础渲染链路。 */
+test('home page renders from browser', async ({ page }) => {
+{{#if_eq appType 'h5'}}
+  await page.setViewportSize({ width: 390, height: 844 })
+{{/if_eq}}
+  const pageErrors: string[] = []
+  page.on('pageerror', error => pageErrors.push(error.message))
+  await page.goto('./')
+  await expect(page).toHaveTitle(process.env.HAI_CORE_NAME ?? '{{projectName}}')
+  await expect(pageErrors).toEqual([])
+  await expect(page.locator('main, section').first()).toBeVisible()
+  await expect(page.locator('header').first()).toBeVisible()
+  await expect(page.locator('footer').first()).toBeAttached()
+  // 大屏使用可用空间，窄屏由组件内部滚动，不能撑宽整个页面。
+  for (const width of [390, 1440, 1920, 2560, 3840]) {
+    await page.setViewportSize({ width, height: 960 })
+    const availableWidth = await page.evaluate(() => document.documentElement.clientWidth)
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    const shell = page.locator('.hai-mobile-shell')
+    if (await shell.count())
+      expect((await shell.boundingBox())!.width).toBeGreaterThan(availableWidth - 2)
+  }
+  await page.setViewportSize({ width: 390, height: 844 })
+{{#if_eq appType 'h5'}}
+  // 在手机宽度验证导航真正切换路由，避免样式失效但首页渲染测试仍通过。
+  const nav = page.locator('nav')
+  await nav.getByRole('button', { name: /发现|Discover/i, exact: true }).click()
+  await expect(page).toHaveURL(/\/discover$/)
+  await page.reload()
+  await expect(page).toHaveURL(/\/discover$/)
+  await expect(page.getByRole('heading', { name: /发现|Discover/i })).toBeVisible()
+  await nav.getByRole('button', { name: /首页|Home/i, exact: true }).click()
+  await expect(page).toHaveURL(/\/$/)
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+{{/if_eq}}
+{{#if_eq appType 'website'}}
+  await page.goto('./about')
+  await page.reload()
+  await expect(page).toHaveURL(/\/about$/)
+  await expect(page.locator('header')).toBeVisible()
+  await expect(page.locator('footer')).toBeVisible()
+{{/if_eq}}
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  await page.evaluate(() => document.fonts.ready)
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-home.png'), fullPage: true, animations: 'disabled' })
+})
+{{#if features.iam}}
+
+/** 实际注册和密码登录；截图只保存空白表单。 */
+test('configured IAM registration and password login', async ({ page, context }) => {
+  test.setTimeout(90_000)
+{{#if_eq appType 'h5'}}
+  await page.setViewportSize({ width: 390, height: 844 })
+{{/if_eq}}
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  const username = `scaf${randomUUID().replaceAll('-', '').slice(0, 12)}`
+  const password = 'ScaffoldPassword123'
+  const authUrl = '{{#if isCapacitorApp}}./{{else}}./auth/login{{/if}}'
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await expect(page.locator('header').first()).toBeVisible()
+  await expect(page.locator('footer')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /立即注册|Register now/i }).click()
+{{#unless isCapacitorApp}}
+  await expect(page).toHaveURL(/\/auth\/register(?:\?|$)/)
+{{/unless}}
+  const registerForm = page.locator('.register-form')
+  await expect(registerForm.locator('#register-username')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  if (process.env.IAM_NOTIFICATION_URL) {
+    // 协议弹窗留在认证页，关闭后继续填写注册表单。
+    await registerForm.getByRole('button', { name: /用户协议|Terms of Service/i, exact: true }).click()
+    await expect(page.getByRole('dialog')).toBeVisible()
+    await expect(page.getByRole('dialog').getByRole('heading', { name: 'Configured registration agreement' })).toBeVisible()
+    await expect(page.locator('iframe')).toHaveCount(0)
+    await page.screenshot({ path: path.join(evidence, '{{projectName}}-agreement.png'), fullPage: true })
+    await page.keyboard.press('Escape')
+    await expect(page.getByRole('dialog')).not.toBeVisible()
+  }
+  await registerForm.locator('#register-username').fill(username)
+  await registerForm.locator('#register-email').fill(`${username}@example.com`)
+  await registerForm.locator('#register-password').fill(password)
+  await registerForm.locator('#register-confirm-password').fill(password)
+  await registerForm.locator('button[type="submit"]').click()
+  await expect(page.locator('.register-form')).not.toBeVisible()
+{{#unless isCapacitorApp}}
+  // 通过页面 fetch 复用 Cookie 与已安装的传输加密，避免 HTTP 辅助客户端绕过浏览器协议。
+  const me = await page.evaluate(async url => (await fetch(url)).status, new URL('./api/auth/me', test.info().project.use.baseURL).href)
+  expect(me).toBe(200)
+  await context.clearCookies()
+{{/unless}}
+  await page.reload()
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+
+  if (!process.env.IAM_NOTIFICATION_URL)
+    return
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  const email = `${username}@example.com`
+  await page.locator('#login-username').fill(email)
+  await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
+  await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
+  async function received(template: string) {
+    const response = await page.request.get(`${process.env.IAM_NOTIFICATION_URL}/messages?to=${encodeURIComponent(email)}`)
+    const messages = await response.json() as { template: string, vars: Record<string, string> }[]
+    return messages.findLast(item => item.template === template)?.vars
+  }
+  const otp = await received('otp_email')
+  expect(Boolean(otp?.code)).toBe(true)
+  await page.locator('#login-code').fill(otp?.code ?? '')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.locator('input[type="email"]').fill(email)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
+  const reset = await received('password_reset')
+  expect(Boolean(reset?.token)).toBe(true)
+  await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  const resetUrl = `{{#if isCapacitorApp}}/{{else}}/auth/reset-password{{/if}}?token=${encodeURIComponent(reset?.token ?? '')}`
+{{#if_eq appType 'h5'}}
+  // 延迟客户端脚本，确定性覆盖 SSR 页面已显示、事件绑定尚未完成的窗口。
+  let resumeClient = () => {}
+  const clientBoot = new Promise<void>((resolve) => {
+    resumeClient = resolve
+  })
+  await page.route('**/*.js', async (route) => {
+    await clientBoot
+    await route.continue()
+  })
+  try {
+    await page.goto(resetUrl, { waitUntil: 'commit' })
+    await expect(page.locator('input[type="password"]').nth(0)).toBeDisabled()
+  }
+  finally {
+    resumeClient()
+    // 等待正在恢复的路由完成，避免提前移除拦截导致 continue 被重复处理。
+    await page.unrouteAll({ behavior: 'wait' })
+  }
+{{else}}
+  await page.goto(resetUrl)
+{{/if_eq}}
+  await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
+  await page.locator('input[type="password"]').nth(0).fill('ScaffoldReset456')
+  await page.locator('input[type="password"]').nth(1).fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /^(登录|Sign in|Login)$/i }).click()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(new URL(page.url()).searchParams.has('token')).toBe(false)
+  await page.reload()
+{{#if isCapacitorApp}}
+  // Web 预览采用内存 TokenStore，刷新后应回到登录，而不是已消费令牌的重置页面。
+  await expect(page.locator('#login-username')).toBeVisible()
+{{else}}
+  expect(await page.evaluate(async url => (await fetch(url)).status, new URL('./api/auth/me', test.info().project.use.baseURL).href)).toBe(200)
+{{/if}}
+})
+{{/if}}

package/templates/base/e2e/helpers.ts

@@ -40,7 +40,7 @@ export async function registerAndLogin(
 ) {
   const user = uniqueUser(prefix)
   await registerViaApi(request, user)
-  await page.goto('/login')
+  await page.goto('./login')
   await page.fill('[name="username"]', user.username)
   await page.fill('[name="password"]', user.password)
   await page.click('button[type="submit"]')

package/templates/base/eslint-rules.js

@@ -0,0 +1,45 @@
+/**
+ * 应用共享质量门禁。依赖 Antfu 已注册的 TypeScript / ESLint comments 插件。
+ * 必要第三方 workaround 使用单行 eslint-disable-next-line <规则> -- 具体原因，
+ * 不关闭整个文件的检查。秘密泄漏、输入/权限校验仍需结合业务审查。
+ */
+export const haiQualityConfig = {
+  files: ['**/*.{js,mjs,cjs,ts,tsx,svelte}'],
+  linterOptions: {
+    reportUnusedDisableDirectives: 'error',
+  },
+  rules: {
+    'no-console': ['error', {}],
+    'ts/no-explicit-any': 'error',
+    'ts/ban-ts-comment': ['error', {
+      'ts-ignore': true,
+      'ts-nocheck': true,
+      'ts-check': false,
+      'ts-expect-error': 'allow-with-description',
+      'minimumDescriptionLength': 10,
+    }],
+    'eslint-comments/no-unlimited-disable': 'error',
+    'eslint-comments/require-description': 'error',
+    // 只禁内部源码/构建目录，公开的 /client、/adapter 等 exports 子路径可用。
+    'no-restricted-imports': ['error', {
+      patterns: [{
+        group: ['@h-ai/*/src', '@h-ai/*/src/**', '@h-ai/*/dist', '@h-ai/*/dist/**'],
+        message: 'Use the public exports of hai packages instead of their src/dist internals.',
+      }],
+    }],
+    'no-restricted-syntax': ['error', {
+      selector: ':matches(TSAsExpression, TSTypeAssertion)[expression.typeAnnotation.type="TSUnknownKeyword"]',
+      message: 'Use the real upstream type or narrow unknown. Explain necessary third-party workarounds with a scoped lint exception.',
+    }, {
+      selector: 'ImportExpression[source.value=/^@h-ai\\/[^/]+\\/(src|dist)(\\/|$)/]',
+      message: 'Use the public exports of hai packages instead of their src/dist internals.',
+    }, {
+      // 仅识别明确的静态敏感键；变量键、别名及业务敏感程度仍需审查。
+      selector: 'CallExpression[callee.property.name="setItem"][callee.object.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
+      message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
+    }, {
+      selector: 'CallExpression[callee.property.name="setItem"][callee.object.property.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
+      message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
+    }],
+  },
+}