@h-ai/cli 1.0.0-beta.18 → 1.0.0-beta.19

package/README.en.md

@@ -155,6 +155,8 @@ Database connections are validated against the selected backend’s public schem
 
 `pnpm build` compiles sources. Each image has its own Dockerfile in `images/`, selected through `hai.json.build.images`, alongside the project deployment settings in `deploy`. `--images` selects build outputs; `--services` selects deployed services. Automatic engine detection prefers reachable Podman, then Docker. Downloads, installation and production dependency packaging share package and SQLite driver caches to avoid downloading them again.
 
+Build images only from a trusted context that other parties cannot replace during the build. The CLI maintains dependency inputs and a `.managed.json` manifest under each context’s `images/dependencies/`. Cache ancestor directories must not be symbolic links or Windows junctions, and cache files must not be links or have multiple hard links. Updates publish exclusive temporary files atomically; unchanged content keeps its timestamp, and stale tracked files are removed only within the cache tree. If a cache path error occurs, use its reason and diagnostic code to check links or permissions before rebuilding. Tracking manifests are limited to 16MiB; oversized or invalid JSON receives a diagnostic without echoing file contents.
+
 The default container supports CPU workloads or remote AI services without downloading extra GPU runtimes. To use the deployment host's GPU, customize the image and container runtime settings.
 
 After filtering caller `HAI_/PUBLIC_/VITE_` values, CLI injects only internally generated `HAI_BUILD_ID/HAI_BUILD_COMMIT`; Docker passes the image batch identity to compilation. Feedback reads each browser/server artifact's own `appVersion/buildId/commit`, with its own manifest version and a shared ID within one SSR build. Missing owning Git commits are explicitly `unknown`. The three-field `build-metadata.json` matches inlined code and supports comparison with actual API/ZIP evidence.
@@ -172,6 +174,8 @@ pnpm run deploy --env prod --build --bundle-only
 
 For automation, run `hai build --target image --json`. On success stdout contains one JSON result with `artifactDir` for deployment and `manifest` with the source commit, dirty state, image platforms and SHA-256 checksums. Progress and errors go to stderr.
 
+`manifest.source.dirty` covers nonignored Git changes in the project, selected image contexts and Dockerfiles, including sibling packages when the context is the repository root. Inputs outside the owning repository or an incomplete check produce `null`, which does not mean clean. This field does not attest the content of build inputs.
+
 The default deployment name comes from `package.json.name` at the project root (the nearest `hai.json` or lockfile directory), rejecting missing or invalid names, with an explicit environment appended. A fullstack `hai-delivery` project scanned at `packages/hai-delivery-serv` with `--env test` generates `/opt/hai/apps/hai-delivery-test` and `bundle-hai-delivery-test-<deploymentId>-<version>.tar.gz`. Remote directories, bundles, the Compose project, API/Web/middleware containers, data volumes, server credential state and incremental baselines share this name. Actual project names ending in `-serv` are preserved.
 
 Artifact formats 4 and 5 record primaryService (serv/web); hasWeb describes the complete browser topology. Format 5 also records a non-root webBasePath. Only serv + web generates a same-origin API proxy. Rebuild artifacts using formats 1–3. Back up the existing deployment and verify project identity, volumes and managed credentials before establishing a new full deployment baseline. Tools do not migrate data across projects. Full deployments still remove obsolete service containers under the same Compose project; editing deploy-target.json.directory alone does not migrate resources.

package/README.ja.md

@@ -155,6 +155,8 @@ DB 接続は保存前に選択したバックエンドの公開 Schema で検証
 
 `pnpm build` はソースのコンパイルです。イメージごとの Dockerfile を `images/` に置き、`hai.json` の `build.images` で指定し、同じファイルの `deploy` に配置設定を保存します。`--images` はビルド対象、`--services` は更新サービスを選びます。自動選択は接続可能な Podman、次に Docker です。依存の取得・インストール・本番依存の収集で、パッケージと SQLite ドライバーのキャッシュを共有し、再ダウンロードを避けます。
 
+イメージは、ビルド中に他の主体が置き換えない信頼済みcontextから作成してください。CLIは各contextの`images/dependencies/`に依存キャッシュと`.managed.json`を管理します。祖先ディレクトリにシンボリックリンクやWindows junctionを使わず、キャッシュファイルのリンクや複数ハードリンクも拒否します。排他的な一時ファイルから原子的に置き換え、内容が同じなら更新日時を維持し、古い追跡ファイルの削除はキャッシュ内に限定します。エラーの理由と診断コードに従ってリンクやアクセス権を確認してから再構築してください。 追跡マニフェストの上限は16MiBです。超過や無効なJSONは元の内容を表示せず、診断を返します。
+
 標準コンテナーは CPU 実行またはリモート AI サービスへの接続向けで、追加の GPU ランタイムをダウンロードしません。デプロイ先の GPU を使う場合は、イメージとコンテナーの実行設定を個別に調整してください。
 
 CLI は呼び出し元の `HAI_/PUBLIC_/VITE_` を除外し、内部で生成した `HAI_BUILD_ID/HAI_BUILD_COMMIT` のみを注入します。Docker は同じイメージバッチの識別情報をコンパイルに渡します。フィードバックはブラウザーとサーバー各自の `appVersion/buildId/commit` を使用し、バージョンは各 manifest、同じ SSR ビルドの ID は共通です。所属する Git コミットがなければ `unknown` を記録します。三項目の `build-metadata.json` とコード内の値を一致させ、API/ZIP の実際の証拠と照合します。
@@ -172,6 +174,8 @@ pnpm run deploy --env prod --build --bundle-only
 
 自動化では `hai build --target image --json` を使います。成功時は今回の JSON 結果だけを標準出力に書き込みます。`artifactDir` はデプロイ入力に使用でき、`manifest` にはソースコミット、未コミットの変更の有無、イメージのプラットフォームと SHA-256 が含まれます。進捗とエラーは標準エラーに書き込みます。
 
+`manifest.source.dirty` はプロジェクト、選択したイメージの context と Dockerfile の無視されていない Git 変更を確認し、context がリポジトリルートの場合は兄弟パッケージも含みます。所属リポジトリ外の入力や確認失敗は `null` で、変更なしを意味しません。この値はビルド入力内容の証明ではありません。
+
 既定の配置名はプロジェクトルート（最も近い `hai.json` またはロックファイルのディレクトリ）の `package.json.name` を使い、未指定または無効な名前はエラーになります。明示した環境名を末尾に追加します。fullstack の `hai-delivery` で `packages/hai-delivery-serv` を走査しても、`--env test` は `/opt/hai/apps/hai-delivery-test` と `bundle-hai-delivery-test-<配置ID>-<版>.tar.gz` を生成します。接続先ディレクトリ、配布物、Compose プロジェクト、API/Web/ミドルウェアのコンテナー、ボリューム、サーバー認証状態のファイル名、増分基準で同じ名前を使います。実際のプロジェクト名に含まれる `-serv` は削除しません。
 
 成果物形式4・5はprimaryService（serv/web）と、工程全体のブラウザー構成を示すhasWebを記録します。形式5には非ルートのwebBasePathも含まれます。同一オリジンAPIプロキシはserv + webの場合だけ生成します。形式1～3は再構築が必要です。既存デプロイをバックアップし、プロジェクト名・ボリューム・管理対象の認証情報を確認してから、新しい完全デプロイの基準を作成してください。プロジェクト間のデータ移行は自動化しません。完全デプロイでは同じComposeプロジェクトの旧サービスコンテナーを削除するため、deploy-target.json.directoryの変更だけでは移行できません。

package/README.md

@@ -155,6 +155,8 @@ Nginx 通过动态上游跟随应用和存储容器的 DNS 地址变化。共用
 
 `pnpm build` 只编译源码。镜像使用 `images/` 中独立 Dockerfile，由项目根 `hai.json` 的 `build.images` 指定文件，部署参数放在同文件的 `deploy`；`--images` 决定构建哪些镜像，`--services` 决定更新哪些服务。容器引擎 auto 优先 Podman，再尝试 Docker。下载、安装和整理生产依赖共用包缓存与 SQLite 驱动缓存，避免重复下载。
 
+镜像构建只应使用可信且构建期间不会被其他主体替换的 context。CLI 在各 context 的 `images/dependencies/` 生成依赖缓存及 `.managed.json` 跟踪清单；缓存祖先目录不得是符号链接或 Windows junction，缓存文件不得是链接或多硬链接文件。更新通过独占临时文件原子替换，内容未变时保留时间戳；旧清单清理仅限该缓存树。若报缓存路径错误，按提示的原因和诊断码检查该路径，处理链接或访问权限后再重建。跟踪清单最多 16MiB，超限或 JSON 损坏时会给出诊断，且不会回显原文件内容。
+
 默认容器用于 CPU 运行或连接远程 AI 服务，不额外下载 GPU 运行库。需要使用部署机器上的 GPU 时，自行定制镜像和容器运行参数。
 
 CLI 在过滤调用者的 `HAI_/PUBLIC_/VITE_` 后，只注入内部生成的 `HAI_BUILD_ID/HAI_BUILD_COMMIT`，Docker 将同一镜像批次标识传入实际编译。生成应用的反馈分别读取前后端自己的 `appVersion/buildId/commit`，版本来自各自 manifest，同次 SSR 共用构建 ID；无所属 Git 提交时明确 `unknown`。三字段 `build-metadata.json` 与代码内联值一致，用于与 API/ZIP 实际证据核对。
@@ -172,6 +174,8 @@ pnpm run deploy --env prod --build --bundle-only
 
 自动化使用 `hai build --target image --json`。成功时 stdout 只包含本次构建的 JSON，其中 `artifactDir` 可直接传给部署；`manifest` 包含来源提交、是否有未提交改动、镜像平台和 SHA-256。进度及失败信息写到 stderr。
 
+`manifest.source.dirty` 覆盖工程、所选镜像 context 与 Dockerfile 的未忽略 Git 改动，仓库根 context 包含兄弟包；输入跨所属仓库或检查失败时为 `null`，不能解释为干净。该字段不是构建输入的内容证明。
+
 默认部署名取工程根（最近的 `hai.json` 或锁文件所在目录）的 `package.json.name`，缺失时报错，再附加显式环境后缀。例如 fullstack 工程 `hai-delivery` 扫描 `packages/hai-delivery-serv`，`--env test` 生成 `/opt/hai/apps/hai-delivery-test` 和 `bundle-hai-delivery-test-<部署ID>-<版本>.tar.gz`。远端目录、交付包、Compose 项目、API/Web/中间件容器、数据卷、服务器凭据状态及增量基线统一使用该名称；不会按字符串删除真实项目名中的 `-serv`。
 
 制品格式4和5都记录 primaryService（serv/web），hasWeb 表示完整工程是否包含浏览器端；格式5另记录非根目录webBasePath。只有 serv + web 才生成同源 API 代理。格式1至3制品须重新构建。旧部署先备份并核对项目名、数据卷和受管凭据，再切换到新的完整部署基线；工具不自动跨项目迁移数据。完整部署仍会按 Compose 规则清理同项目的旧服务容器，不能仅修改 deploy-target.json.directory 完成迁移。

package/dist/{chunk-6YZBC5MO.js → chunk-2ZL5ORQ2.js}

@@ -105,7 +105,6 @@ var en_US_default = {
   cli_build_desktop_missing: "No desktop directories in the build section of hai.json. Generate a desktop frontend or add an existing Tauri project.",
   cli_build_images_missing: "hai.json build.images must contain serv, web, or both, with unique names and valid Dockerfiles.",
   cli_build_runtime_missing: "Install and start Podman or Docker. auto prefers a reachable Podman engine.",
-  cli_build_mirror_invalid: "SQLite mirror must use HTTP(S) without credentials, query or fragment.",
   cli_build_ready: "Build ready ({runtime}): {path}. Reuse these images across deployment environments.",
   cli_deploy_bundle_provider: "Offline packaging, integrated image builds and selected-serv deployment require a docker-ssh Compose destination.",
   cli_deploy_bundle_target: "Generating a bundle without connecting to a server. Saved connections populate deploy-target.json; review it before deploying.",
@@ -173,7 +172,6 @@ var en_US_default = {
   cli_help_platform: "Native platform: windows / linux / macos / android / ios",
   cli_help_arch: "Tauri architecture: x64 or arm64",
   cli_help_buildDebug: "Build a native debug package. Defaults to release.",
-  cli_help_sqliteMirror: "Trusted SQLite prebuilt binary mirror URL",
   cli_help_noHttpProxy: "Disable this build proxy (same as --proxy-mode none)",
   cli_help_deploy: "Deploy an application or create an offline bundle",
   cli_help_environment: "Deployment environment, such as test/prod; its environment file must exist",
@@ -184,7 +182,6 @@ var en_US_default = {
   cli_help_services: "Update selected services, such as serv, web, or serv,web; defaults to all services in the artifact",
   cli_help_deployBuild: "Build selected application images before packaging/deployment; supports --bundle-only",
   cli_help_deployNetwork: "Container network for --build; defaults to the engine setting",
-  cli_help_deploySqliteMirror: "SQLite prebuilt mirror for --build",
   cli_help_deployNoProxy: "Disable this build proxy (same as --proxy-mode none)",
   cli_help_deployRuntime: "Local engine for image builds and middleware exports: auto, podman or docker",
   cli_help_bundleOnly: "Create an offline tar and Windows/Linux/macOS deployment scripts without connecting",
@@ -450,7 +447,13 @@ var en_US_default = {
   cli_download_engine_proxy_configured: "Image pull preflight: Docker reports proxy settings; the actual pull still runs in the engine.",
   cli_download_engine_proxy_local: "Image pull preflight: local Podman can inherit the process proxy; the build container is checked separately.",
   cli_download_engine_proxy_hint: "Image pull preflight: build arguments cannot configure the remote {runtime} engine proxy. Configure Docker Desktop proxies or the Podman Machine/API service. The build container proxy is checked separately.",
-  cli_download_template_required: "This Dockerfile does not support the selected source. Update HAI_NODE_IMAGE, HAI_NGINX_IMAGE, and HAI_NPM_REGISTRY from the current template: {path}"
+  cli_download_template_required: "This Dockerfile does not support the selected source. Update HAI_NODE_IMAGE, HAI_NGINX_IMAGE, and HAI_NPM_REGISTRY from the current template: {path}",
+  cli_build_dependency_context_unsafe: "Cannot safely update dependency build cache: {path}. Reason: {reason}; diagnostic: {diagnostic}. Check this path before retrying.",
+  cli_build_dependency_reason_invalid: "The path contains a link or has an unsupported file type or size",
+  cli_build_dependency_reason_changed: "The file or directory changed during validation",
+  cli_build_dependency_reason_read: "Cannot read the cache; check access permissions and file locks",
+  cli_build_dependency_reason_write: "Cannot write or publish the cache; check access permissions, disk space and file locks",
+  cli_build_dependency_reason_tracking: "The cache tracking manifest is not valid JSON"
 };
 
 // messages/ja-JP.json
@@ -552,7 +555,6 @@ var ja_JP_default = {
   cli_build_desktop_missing: "hai.json \u306E build \u30BB\u30AF\u30B7\u30E7\u30F3\u306Bdesktop\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u3042\u308A\u307E\u305B\u3093\u3002desktop\u30D5\u30ED\u30F3\u30C8\u30A8\u30F3\u30C9\u3092\u751F\u6210\u3059\u308B\u304B\u3001\u65E2\u5B58\u306ETauri\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u3092\u8FFD\u52A0\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   cli_build_images_missing: "hai.json \u306E build.images \u306B\u306F\u3001\u4E00\u610F\u306A\u540D\u524D\u3068\u6709\u52B9\u306A Dockerfile \u3092\u6301\u3064 serv\u3001web\u3001\u307E\u305F\u306F\u4E21\u65B9\u304C\u5FC5\u8981\u3067\u3059\u3002",
   cli_build_runtime_missing: "Podman\u307E\u305F\u306FDocker\u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3057\u3066\u8D77\u52D5\u3057\u3066\u304F\u3060\u3055\u3044\u3002auto\u306F\u63A5\u7D9A\u53EF\u80FD\u306APodman\u3092\u512A\u5148\u3057\u307E\u3059\u3002",
-  cli_build_mirror_invalid: "SQLite\u30DF\u30E9\u30FC\u306B\u306F\u3001\u8A8D\u8A3C\u60C5\u5831\u3001\u30AF\u30A8\u30EA\u3001\u30D5\u30E9\u30B0\u30E1\u30F3\u30C8\u3092\u542B\u307E\u306A\u3044HTTP(S)\u306EURL\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   cli_build_ready: "\u30D3\u30EB\u30C9\u306E\u6E96\u5099\u304C\u5B8C\u4E86\u3057\u307E\u3057\u305F\uFF08{runtime}\uFF09: {path}\u3002\u3053\u308C\u3089\u306E\u30A4\u30E1\u30FC\u30B8\u306F\u30C7\u30D7\u30ED\u30A4\u74B0\u5883\u9593\u3067\u518D\u5229\u7528\u3067\u304D\u307E\u3059\u3002",
   cli_deploy_bundle_provider: "\u30AA\u30D5\u30E9\u30A4\u30F3\u30D1\u30C3\u30B1\u30FC\u30B8\u5316\u3001\u7D44\u307F\u8FBC\u307F\u306E\u30A4\u30E1\u30FC\u30B8\u30D3\u30EB\u30C9\u3001\u30B5\u30FC\u30D3\u30B9\u3092\u9078\u629E\u3057\u305F\u30C7\u30D7\u30ED\u30A4\u306B\u306F docker-ssh Compose \u306E\u30C7\u30D7\u30ED\u30A4\u5148\u304C\u5FC5\u8981\u3067\u3059\u3002",
   cli_deploy_bundle_target: "\u30B5\u30FC\u30D0\u30FC\u306B\u63A5\u7D9A\u305B\u305A\u30D0\u30F3\u30C9\u30EB\u3092\u751F\u6210\u3057\u307E\u3059\u3002\u4FDD\u5B58\u6E08\u307F\u63A5\u7D9A\u306F deploy-target.json \u306B\u53CD\u6620\u3055\u308C\u307E\u3059\u3002\u30C7\u30D7\u30ED\u30A4\u524D\u306B\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
@@ -620,7 +622,6 @@ var ja_JP_default = {
   cli_help_platform: "\u30CD\u30A4\u30C6\u30A3\u30D6: windows / linux / macos / android / ios",
   cli_help_arch: "Tauri \u306E\u30A2\u30FC\u30AD\u30C6\u30AF\u30C1\u30E3\uFF1Ax64\u3001arm64",
   cli_help_buildDebug: "\u30CD\u30A4\u30C6\u30A3\u30D6\u306E\u30C7\u30D0\u30C3\u30B0\u7248\u3092\u751F\u6210\u3057\u307E\u3059\u3002\u65E2\u5B9A\u306F\u30EA\u30EA\u30FC\u30B9\u7248\u3067\u3059\u3002",
-  cli_help_sqliteMirror: "\u4FE1\u983C\u3067\u304D\u308B SQLite \u30D7\u30EC\u30D3\u30EB\u30C9\u30D0\u30A4\u30CA\u30EA\u30FC\u306E\u30DF\u30E9\u30FC URL",
   cli_help_noHttpProxy: "\u4ECA\u56DE\u306E\u30D3\u30EB\u30C9\u306E\u30D7\u30ED\u30AD\u30B7\u3092\u7121\u52B9\u5316\uFF08--proxy-mode none \u3068\u540C\u3058\uFF09",
   cli_help_deploy: "\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u3092\u30C7\u30D7\u30ED\u30A4\u3001\u307E\u305F\u306F\u30AA\u30D5\u30E9\u30A4\u30F3\u30D0\u30F3\u30C9\u30EB\u3092\u4F5C\u6210",
   cli_help_environment: "\u30C7\u30D7\u30ED\u30A4\u74B0\u5883\uFF08test/prod \u306A\u3069\uFF09\u3002\u5BFE\u5FDC\u3059\u308B\u74B0\u5883\u30D5\u30A1\u30A4\u30EB\u304C\u5FC5\u8981\u3067\u3059",
@@ -631,7 +632,6 @@ var ja_JP_default = {
   cli_help_services: "serv\u3001web\u3001serv,web \u306A\u3069\u3001\u66F4\u65B0\u3059\u308B\u30B5\u30FC\u30D3\u30B9\u3092\u6307\u5B9A\u3057\u307E\u3059\u3002\u7701\u7565\u6642\u306F\u6210\u679C\u7269\u5185\u306E\u5168\u30B5\u30FC\u30D3\u30B9\u3092\u66F4\u65B0\u3057\u307E\u3059\u3002",
   cli_help_deployBuild: "\u30D1\u30C3\u30B1\u30FC\u30B8\u5316\u3084\u30C7\u30D7\u30ED\u30A4\u306E\u524D\u306B\u9078\u629E\u3057\u305F\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u30A4\u30E1\u30FC\u30B8\u3092\u30D3\u30EB\u30C9\u3002--bundle-only \u3068\u4F75\u7528\u53EF\u80FD",
   cli_help_deployNetwork: "--build \u306E\u30B3\u30F3\u30C6\u30CA\u30FC\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u3002\u65E2\u5B9A\u3067\u306F\u30A8\u30F3\u30B8\u30F3\u8A2D\u5B9A\u3092\u4F7F\u7528",
-  cli_help_deploySqliteMirror: "--build \u7528\u306E SQLite \u30D7\u30EC\u30D3\u30EB\u30C9\u30DF\u30E9\u30FC",
   cli_help_deployNoProxy: "\u4ECA\u56DE\u306E\u30D3\u30EB\u30C9\u306E\u30D7\u30ED\u30AD\u30B7\u3092\u7121\u52B9\u5316\uFF08--proxy-mode none \u3068\u540C\u3058\uFF09",
   cli_help_deployRuntime: "\u30A4\u30E1\u30FC\u30B8\u30D3\u30EB\u30C9\u3068\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u306E\u30A8\u30AF\u30B9\u30DD\u30FC\u30C8\u7528\u30ED\u30FC\u30AB\u30EB\u30A8\u30F3\u30B8\u30F3\uFF1Aauto\u3001podman\u3001docker",
   cli_help_bundleOnly: "\u63A5\u7D9A\u305B\u305A\u306B\u30AA\u30D5\u30E9\u30A4\u30F3 tar \u3068 Windows/Linux/macOS \u7528\u30C7\u30D7\u30ED\u30A4\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u4F5C\u6210",
@@ -897,7 +897,13 @@ var ja_JP_default = {
   cli_download_engine_proxy_configured: "\u30A4\u30E1\u30FC\u30B8\u53D6\u5F97\u306E\u4E8B\u524D\u78BA\u8A8D\uFF1ADocker \u306E\u30D7\u30ED\u30AD\u30B7\u8A2D\u5B9A\u3092\u78BA\u8A8D\u3057\u307E\u3057\u305F\u3002\u5B9F\u969B\u306E\u53D6\u5F97\u306F\u30A8\u30F3\u30B8\u30F3\u3067\u5B9F\u884C\u3055\u308C\u307E\u3059\u3002",
   cli_download_engine_proxy_local: "\u30A4\u30E1\u30FC\u30B8\u53D6\u5F97\u306E\u4E8B\u524D\u78BA\u8A8D\uFF1A\u30ED\u30FC\u30AB\u30EB Podman \u306F\u30D7\u30ED\u30BB\u30B9\u306E\u30D7\u30ED\u30AD\u30B7\u3092\u7D99\u627F\u3067\u304D\u307E\u3059\u3002\u30D3\u30EB\u30C9\u30B3\u30F3\u30C6\u30CA\u306F\u5225\u9014\u78BA\u8A8D\u3057\u307E\u3059\u3002",
   cli_download_engine_proxy_hint: "\u30A4\u30E1\u30FC\u30B8\u53D6\u5F97\u306E\u4E8B\u524D\u78BA\u8A8D\uFF1A\u30D3\u30EB\u30C9\u5F15\u6570\u3067\u306F\u30EA\u30E2\u30FC\u30C8 {runtime} \u30A8\u30F3\u30B8\u30F3\u306E\u30D7\u30ED\u30AD\u30B7\u3092\u8A2D\u5B9A\u3067\u304D\u307E\u305B\u3093\u3002Docker Desktop \u307E\u305F\u306F Podman Machine/API \u30B5\u30FC\u30D3\u30B9\u3067\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30D3\u30EB\u30C9\u30B3\u30F3\u30C6\u30CA\u306E\u30D7\u30ED\u30AD\u30B7\u306F\u5225\u9014\u78BA\u8A8D\u3057\u307E\u3059\u3002",
-  cli_download_template_required: "Dockerfile \u304C\u9078\u629E\u3057\u305F\u53D6\u5F97\u5143\u306B\u5BFE\u5FDC\u3057\u3066\u3044\u307E\u305B\u3093\u3002\u73FE\u884C\u30C6\u30F3\u30D7\u30EC\u30FC\u30C8\u306E HAI_NODE_IMAGE\u3001HAI_NGINX_IMAGE\u3001HAI_NPM_REGISTRY \u3092\u53CD\u6620\u3057\u3066\u304F\u3060\u3055\u3044\uFF1A{path}"
+  cli_download_template_required: "Dockerfile \u304C\u9078\u629E\u3057\u305F\u53D6\u5F97\u5143\u306B\u5BFE\u5FDC\u3057\u3066\u3044\u307E\u305B\u3093\u3002\u73FE\u884C\u30C6\u30F3\u30D7\u30EC\u30FC\u30C8\u306E HAI_NODE_IMAGE\u3001HAI_NGINX_IMAGE\u3001HAI_NPM_REGISTRY \u3092\u53CD\u6620\u3057\u3066\u304F\u3060\u3055\u3044\uFF1A{path}",
+  cli_build_dependency_context_unsafe: "\u4F9D\u5B58\u30D3\u30EB\u30C9\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u5B89\u5168\u306B\u66F4\u65B0\u3067\u304D\u307E\u305B\u3093: {path}\u3002\u7406\u7531: {reason}\u3001\u8A3A\u65AD\u30B3\u30FC\u30C9: {diagnostic}\u3002\u30D1\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  cli_build_dependency_reason_invalid: "\u30D1\u30B9\u306B\u30EA\u30F3\u30AF\u304C\u542B\u307E\u308C\u308B\u304B\u3001\u30D5\u30A1\u30A4\u30EB\u306E\u7A2E\u985E\u307E\u305F\u306F\u30B5\u30A4\u30BA\u304C\u8981\u4EF6\u3092\u6E80\u305F\u3057\u3066\u3044\u307E\u305B\u3093",
+  cli_build_dependency_reason_changed: "\u691C\u8A3C\u4E2D\u306B\u30D5\u30A1\u30A4\u30EB\u307E\u305F\u306F\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u304C\u5909\u66F4\u3055\u308C\u307E\u3057\u305F",
+  cli_build_dependency_reason_read: "\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u8AAD\u307F\u53D6\u308C\u307E\u305B\u3093\u3002\u30A2\u30AF\u30BB\u30B9\u6A29\u3068\u30D5\u30A1\u30A4\u30EB\u306E\u4F7F\u7528\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044",
+  cli_build_dependency_reason_write: "\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u66F8\u304D\u8FBC\u307F\u307E\u305F\u306F\u516C\u958B\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u30A2\u30AF\u30BB\u30B9\u6A29\u3001\u7A7A\u304D\u5BB9\u91CF\u3068\u30D5\u30A1\u30A4\u30EB\u306E\u4F7F\u7528\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044",
+  cli_build_dependency_reason_tracking: "\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u8FFD\u8DE1\u30DE\u30CB\u30D5\u30A7\u30B9\u30C8\u304C\u6709\u52B9\u306AJSON\u3067\u306F\u3042\u308A\u307E\u305B\u3093"
 };
 
 // messages/zh-CN.json
@@ -999,7 +1005,6 @@ var zh_CN_default = {
   cli_build_desktop_missing: "hai.json \u7684 build \u5206\u533A \u672A\u914D\u7F6E desktop \u76EE\u5F55\u3002\u8BF7\u751F\u6210 desktop \u524D\u7AEF\u6216\u6DFB\u52A0\u5DF2\u6709\u7684 Tauri \u5DE5\u7A0B\u3002",
   cli_build_images_missing: "hai.json \u7684 build.images \u5FC5\u987B\u5305\u542B serv\u3001web \u6216\u4E24\u8005\uFF0C\u540D\u79F0\u552F\u4E00\u4E14 Dockerfile \u6709\u6548\u3002",
   cli_build_runtime_missing: "\u8BF7\u5B89\u88C5\u5E76\u542F\u52A8 Podman \u6216 Docker\u3002auto \u4F18\u5148\u9009\u62E9\u53EF\u7528\u7684 Podman\u3002",
-  cli_build_mirror_invalid: "SQLite \u955C\u50CF\u5730\u5740\u5FC5\u987B\u4E3A HTTP(S)\uFF0C\u4E0D\u80FD\u5305\u542B\u51ED\u636E\u3001\u67E5\u8BE2\u6216\u7247\u6BB5\u3002",
   cli_build_ready: "\u6784\u5EFA\u5B8C\u6210\uFF08{runtime}\uFF09\uFF1A{path}\u3002\u6B64\u955C\u50CF\u53EF\u7528\u4E8E\u4E0D\u540C\u90E8\u7F72\u73AF\u5883\u3002",
   cli_deploy_bundle_provider: "\u79BB\u7EBF\u6253\u5305\u3001\u4E00\u4F53\u5316\u955C\u50CF\u6784\u5EFA\u548C\u6309\u670D\u52A1\u5C40\u90E8\u90E8\u7F72\u9700\u8981 docker-ssh Compose \u76EE\u6807\u3002",
   cli_deploy_bundle_target: "\u4EC5\u751F\u6210\u90E8\u7F72\u5305\uFF0C\u4E0D\u8FDE\u63A5\u670D\u52A1\u5668\u3002\u5DF2\u4FDD\u5B58\u7684\u8FDE\u63A5\u4F1A\u5199\u5165 deploy-target.json\uFF0C\u90E8\u7F72\u524D\u8BF7\u6838\u5BF9\u3002",
@@ -1067,7 +1072,6 @@ var zh_CN_default = {
   cli_help_platform: "\u539F\u751F\u5E73\u53F0\uFF1Awindows / linux / macos / android / ios",
   cli_help_arch: "Tauri \u76EE\u6807\u67B6\u6784\uFF1Ax64 / arm64",
   cli_help_buildDebug: "\u6784\u5EFA\u539F\u751F\u8C03\u8BD5\u5305\uFF0C\u7701\u7565\u65F6\u6784\u5EFA\u53D1\u5E03\u5305",
-  cli_help_sqliteMirror: "SQLite \u9884\u7F16\u8BD1\u4E8C\u8FDB\u5236\u955C\u50CF\u6839\u5730\u5740",
   cli_help_noHttpProxy: "\u7981\u7528\u672C\u6B21\u6784\u5EFA\u4EE3\u7406\uFF08\u7B49\u4EF7 --proxy-mode none\uFF09",
   cli_help_deploy: "\u90E8\u7F72\u5E94\u7528\u6216\u751F\u6210\u79BB\u7EBF\u4EA4\u4ED8\u5305",
   cli_help_environment: "\u90E8\u7F72\u73AF\u5883\uFF08test / prod \u7B49\uFF0C\u5FC5\u987B\u5B58\u5728\u5BF9\u5E94\u73AF\u5883\u6587\u4EF6\uFF09",
@@ -1078,7 +1082,6 @@ var zh_CN_default = {
   cli_help_services: "\u53EA\u66F4\u65B0\u6307\u5B9A\u670D\u52A1\uFF0C\u4F8B\u5982 serv\u3001web \u6216 serv,web\uFF1B\u7701\u7565\u65F6\u90E8\u7F72\u5236\u54C1\u4E2D\u7684\u5168\u90E8\u670D\u52A1",
   cli_help_deployBuild: "\u5148\u6784\u5EFA\u6240\u9009\u5E94\u7528\u955C\u50CF\uFF0C\u518D\u6253\u5305\u90E8\u7F72\uFF1B\u53EF\u4E0E --bundle-only \u4E00\u8D77\u4F7F\u7528",
   cli_help_deployNetwork: "\u4E00\u4F53\u5316\u6784\u5EFA\u4F7F\u7528\u7684\u5BB9\u5668\u7F51\u7EDC\uFF08\u9ED8\u8BA4\u5F15\u64CE\u8BBE\u7F6E\uFF09",
-  cli_help_deploySqliteMirror: "\u4E00\u4F53\u5316\u6784\u5EFA\u4F7F\u7528\u7684 SQLite \u9884\u7F16\u8BD1\u5305\u955C\u50CF\u5730\u5740",
   cli_help_deployNoProxy: "\u7981\u7528\u672C\u6B21\u6784\u5EFA\u4EE3\u7406\uFF08\u7B49\u4EF7 --proxy-mode none\uFF09",
   cli_help_deployRuntime: "\u672C\u5730\u955C\u50CF\u6784\u5EFA\u548C\u4E2D\u95F4\u4EF6\u5BFC\u51FA\u5F15\u64CE\uFF1Aauto / podman / docker",
   cli_help_bundleOnly: "\u53EA\u751F\u6210\u79BB\u7EBF tar \u4E0E Windows/Linux/macOS \u90E8\u7F72\u811A\u672C\uFF1B\u4E0D\u8FDE\u63A5\u670D\u52A1\u5668",
@@ -1344,11 +1347,22 @@ var zh_CN_default = {
   cli_download_engine_proxy_configured: "\u955C\u50CF\u62C9\u53D6\u9884\u68C0\uFF1ADocker \u5F15\u64CE\u5DF2\u62A5\u544A\u4EE3\u7406\u914D\u7F6E\uFF1B\u5B9E\u9645\u62C9\u53D6\u7ED3\u679C\u4ECD\u4EE5\u5F15\u64CE\u6267\u884C\u4E3A\u51C6\u3002",
   cli_download_engine_proxy_local: "\u955C\u50CF\u62C9\u53D6\u9884\u68C0\uFF1A\u672C\u5730 Podman \u5B50\u8FDB\u7A0B\u53EF\u7EE7\u627F\u8FDB\u7A0B\u4EE3\u7406\uFF1B\u6784\u5EFA\u5BB9\u5668\u4EE3\u7406\u5355\u72EC\u68C0\u67E5\u3002",
   cli_download_engine_proxy_hint: "\u955C\u50CF\u62C9\u53D6\u9884\u68C0\uFF1A{runtime} \u7684\u8FDC\u7A0B\u5F15\u64CE\u4EE3\u7406\u65E0\u6CD5\u7531\u6784\u5EFA\u53C2\u6570\u8BBE\u7F6E\u3002\u8BF7\u5728 Docker Desktop \u4EE3\u7406\u8BBE\u7F6E\u6216 Podman Machine/API \u670D\u52A1\u4E2D\u914D\u7F6E\uFF1B\u6784\u5EFA\u5BB9\u5668\u4EE3\u7406\u5C06\u5355\u72EC\u68C0\u67E5\u3002",
-  cli_download_template_required: "Dockerfile \u5C1A\u672A\u652F\u6301\u6240\u9009\u4E0B\u8F7D\u6E90\uFF0C\u8BF7\u540C\u6B65\u65B0\u7248\u6A21\u677F\u4E2D\u7684 HAI_NODE_IMAGE\u3001HAI_NGINX_IMAGE \u548C HAI_NPM_REGISTRY \u53C2\u6570\uFF1A{path}"
+  cli_download_template_required: "Dockerfile \u5C1A\u672A\u652F\u6301\u6240\u9009\u4E0B\u8F7D\u6E90\uFF0C\u8BF7\u540C\u6B65\u65B0\u7248\u6A21\u677F\u4E2D\u7684 HAI_NODE_IMAGE\u3001HAI_NGINX_IMAGE \u548C HAI_NPM_REGISTRY \u53C2\u6570\uFF1A{path}",
+  cli_build_dependency_context_unsafe: "\u4F9D\u8D56\u6784\u5EFA\u7F13\u5B58\u65E0\u6CD5\u5B89\u5168\u66F4\u65B0\uFF1A{path}\u3002\u539F\u56E0\uFF1A{reason}\uFF1B\u8BCA\u65AD\u7801\uFF1A{diagnostic}\u3002\u8BF7\u68C0\u67E5\u8BE5\u8DEF\u5F84\u540E\u91CD\u8BD5\u3002",
+  cli_build_dependency_reason_invalid: "\u8DEF\u5F84\u5305\u542B\u94FE\u63A5\uFF0C\u6216\u6587\u4EF6\u7C7B\u578B\u3001\u5927\u5C0F\u4E0D\u7B26\u5408\u8981\u6C42",
+  cli_build_dependency_reason_changed: "\u6587\u4EF6\u6216\u76EE\u5F55\u5728\u68C0\u67E5\u8FC7\u7A0B\u4E2D\u53D1\u751F\u53D8\u5316",
+  cli_build_dependency_reason_read: "\u65E0\u6CD5\u8BFB\u53D6\u7F13\u5B58\uFF0C\u8BF7\u68C0\u67E5\u8BBF\u95EE\u6743\u9650\u548C\u6587\u4EF6\u5360\u7528",
+  cli_build_dependency_reason_write: "\u65E0\u6CD5\u5199\u5165\u6216\u53D1\u5E03\u7F13\u5B58\uFF0C\u8BF7\u68C0\u67E5\u8BBF\u95EE\u6743\u9650\u3001\u78C1\u76D8\u7A7A\u95F4\u548C\u6587\u4EF6\u5360\u7528",
+  cli_build_dependency_reason_tracking: "\u7F13\u5B58\u8DDF\u8E2A\u6E05\u5355\u4E0D\u662F\u6709\u6548\u7684JSON"
 };
 
 // src/cli-i18n.ts
-var environmentLocale = [process.env.HAI_CORE_DEFAULTLOCALE, process.env.LC_ALL, process.env.LC_MESSAGES, process.env.LANG].find((value) => value?.trim())?.trim();
+var environmentLocale = [
+  process.env.HAI_CORE_DEFAULTLOCALE,
+  process.env.LC_ALL,
+  process.env.LC_MESSAGES,
+  process.env.LANG
+].find((value) => value?.trim())?.trim();
 var language = environmentLocale?.split(/[_.-]/)[0]?.toLowerCase();
 if (language === "en" || language === "c" || language === "posix")
   core.i18n.setGlobalLocale("en-US");
@@ -1381,15 +1395,42 @@ var MODULE_SKILL_MAP = {
   "capacitor": "hai-capacitor"
 };
 var SKILL_EXCLUSIONS_BY_APP_TYPE = {
-  "admin": ["hai-serv", "hai-api-contract", "hai-api-client", "hai-capacitor"],
-  "website": ["hai-serv", "hai-api-contract", "hai-api-client", "hai-capacitor"],
-  "h5": ["hai-serv", "hai-api-contract", "hai-api-client", "hai-capacitor"],
-  "api": ["hai-ui", "hai-ui-design", "hai-ui-review", "hai-kit", "hai-capacitor"],
-  "mobile-app": ["hai-core", "hai-kit", "hai-serv", "hai-api-contract"],
+  "admin": [
+    "hai-serv",
+    "hai-api-contract",
+    "hai-api-client",
+    "hai-capacitor"
+  ],
+  "website": [
+    "hai-serv",
+    "hai-api-contract",
+    "hai-api-client",
+    "hai-capacitor"
+  ],
+  "h5": [
+    "hai-serv",
+    "hai-api-contract",
+    "hai-api-client",
+    "hai-capacitor"
+  ],
+  "api": [
+    "hai-ui",
+    "hai-ui-design",
+    "hai-ui-review",
+    "hai-kit",
+    "hai-capacitor"
+  ],
+  "mobile-app": [
+    "hai-core",
+    "hai-kit",
+    "hai-serv",
+    "hai-api-contract"
+  ],
   "fullstack": ["hai-kit"]
 };
 var WORKFLOW_SKILLS = [
   "hai-build",
+  "hai-change-plan",
   "hai-spec-review",
   "hai-spec-implement",
   "hai-app-create",
@@ -1458,8 +1499,16 @@ async function detectBridgeContext(projectPath) {
   }
   const projectName = metadata.name;
   for (const [appType, directory, suffixes] of [
-    ["fullstack", "packages", ["contract", "serv", "shared"]],
-    ["api", "apps", ["contract", "service"]]
+    [
+      "fullstack",
+      "packages",
+      ["contract", "serv", "shared"]
+    ],
+    [
+      "api",
+      "apps",
+      ["contract", "serv"]
+    ]
   ]) {
     const manifests = await Promise.all(suffixes.map((suffix) => fse.pathExists(
       path.join(projectPath, directory, `${projectName}-${suffix}`, "package.json")
@@ -1584,7 +1633,9 @@ async function copyBridgeFiles(templatesDir, projectPath, overwrite = true, appT
 async function resolveBridgeSource(templatesDir, source, appType, allowTemplate = false) {
   const profile = appType && BRIDGE_PROFILE_REGEX.test(appType) ? appType : "generic";
   const candidates = [
-    ...allowTemplate ? [path.join(templatesDir, "bridges", profile, `${source}.hbs`)] : [],
+    ...allowTemplate ? [
+      path.join(templatesDir, "bridges", profile, `${source}.hbs`)
+    ] : [],
     path.join(templatesDir, "bridges", profile, source),
     path.join(templatesDir, "bridges", "generic", source),
     path.join(templatesDir, source)
@@ -1629,7 +1680,9 @@ function resolveSkillNamesForPackages(packageNames) {
   }
   if (skillNames.includes("hai-ui"))
     skillNames.push("hai-ui-design", "hai-ui-review");
-  return [...new Set(skillNames)];
+  return [
+    ...new Set(skillNames)
+  ];
 }
 async function generateProjectAiSupport(projectPath, skillNames, options = {}) {
   const templatesDir = getSkillTemplatesDir();
@@ -1643,7 +1696,14 @@ async function generateProjectAiSupport(projectPath, skillNames, options = {}) {
   const detected = await detectBridgeContext(projectPath);
   const appType = options.appType ?? detected.appType;
   const projectName = options.projectName ?? detected.projectName;
-  const requestedSkillNames = appType ? [...resolveCompatibleSkillNames(await listTemplateSkillNames(templatesDir), appType), ...WORKFLOW_SKILLS, ...skillNames] : [...WORKFLOW_SKILLS, ...skillNames];
+  const requestedSkillNames = appType ? [
+    ...resolveCompatibleSkillNames(await listTemplateSkillNames(templatesDir), appType),
+    ...WORKFLOW_SKILLS,
+    ...skillNames
+  ] : [
+    ...WORKFLOW_SKILLS,
+    ...skillNames
+  ];
   const selectedSkillNames = resolveCompatibleSkillNames(requestedSkillNames, appType);
   const copiedFiles = [];
   copiedFiles.push(...await copySkills(templatesDir, selectedSkillNames, projectPath, SKILL_TARGET_DIRS, overwriteSkills));
@@ -1652,5 +1712,5 @@ async function generateProjectAiSupport(projectPath, skillNames, options = {}) {
 }
 
 export { cliM, generateModuleSkillFile, generateProjectAiSupport, generateSkillFiles, resolveCompatibleSkillNames, resolveSkillNamesForPackages };
-//# sourceMappingURL=chunk-6YZBC5MO.js.map
-//# sourceMappingURL=chunk-6YZBC5MO.js.map
+//# sourceMappingURL=chunk-2ZL5ORQ2.js.map
+//# sourceMappingURL=chunk-2ZL5ORQ2.js.map