@h-ai/cli 1.0.0-beta.5 → 1.0.0-beta.6

package/dist/src-NXCCU6GO.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, canKeepMiddleware, createDeploymentPlan, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, importDeploymentSecrets, loadDeploymentConfig, loadDeploymentEnvironment, mergeEnvironmentLayers, normalizeProjectName, parseMiddlewareField, readDeploymentArtifact, resolveDownloadProxy, resolveImageReference, saveDeploymentEnvironment, saveMiddlewareEnvironment, validateMiddlewareField } from './chunk-4XVCGFBA.js';
+import './chunk-ZSDEVXZ7.js';
+//# sourceMappingURL=src-NXCCU6GO.js.map
+//# sourceMappingURL=src-NXCCU6GO.js.map

package/dist/src-NXCCU6GO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"src-NXCCU6GO.js"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -30,7 +30,7 @@
     "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "dependencies": {
-    "@h-ai/core": "1.0.0-beta.5",
+    "@h-ai/core": "1.0.0-beta.6",
     "cac": "^7.0.1",
     "chalk": "^6.0.1",
     "fast-wrap-ansi": "^0.2.2",
@@ -41,15 +41,15 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@h-ai/api-client": "1.0.0-beta.5",
-    "@h-ai/cache": "1.0.0-beta.5",
-    "@h-ai/crypto": "1.0.0-beta.5",
-    "@h-ai/deploy": "1.0.0-beta.5",
-    "@h-ai/feedback": "1.0.0-beta.5",
-    "@h-ai/iam": "1.0.0-beta.5",
-    "@h-ai/reach": "1.0.0-beta.5",
-    "@h-ai/reldb": "1.0.0-beta.5",
-    "@h-ai/storage": "1.0.0-beta.5",
+    "@h-ai/api-client": "1.0.0-beta.6",
+    "@h-ai/cache": "1.0.0-beta.6",
+    "@h-ai/crypto": "1.0.0-beta.6",
+    "@h-ai/deploy": "1.0.0-beta.6",
+    "@h-ai/feedback": "1.0.0-beta.6",
+    "@h-ai/iam": "1.0.0-beta.6",
+    "@h-ai/reach": "1.0.0-beta.6",
+    "@h-ai/reldb": "1.0.0-beta.6",
+    "@h-ai/storage": "1.0.0-beta.6",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",

package/templates/README.md

@@ -29,6 +29,10 @@
 
 ### 配置与构建
 
+构建阶段的 pnpm fetch/install 固定追加式日志，避免 PowerShell 中动态进度刷新错位；CLI 同时规范 Windows 转发输出的换行并保留警告与错误。
+
+Dockerfile 用全局 `HAI_NODE_IMAGE` / `HAI_NGINX_IMAGE` 接收镜像源，用构建阶段 `HAI_NPM_REGISTRY` 同时控制 Corepack 和 pnpm 下载。代理仅使用预定义构建参数，首个下载步骤检查容器内可达性；运行阶段不保存代理。CLI 的 `--image-source` / `--npm-source` 和 `--proxy-mode` 以 `hai.json.build.sources` / `build.proxy` 保存项目默认，具体契约见[下载源与代理](skills/hai-build/reference.md#下载源与代理)。
+
 模板通过 `projectName`、`appType`、`features`、`hasUi`、`hasI18n`、`versions` 以及 `api`/`fullstack` 上下文渲染，完整字段见 [cli-types.ts](../src/cli-types.ts)。模块 YAML 使用 `moduleConfig` helper，与 [配置生成器](../src/commands/cli-config-templates.ts) 共用字段和默认值。
 
 部署默认启用，`--no-deploy` 可关闭；SDK 是开发依赖。每个镜像使用 `images/` 中独立 Dockerfile，Web 资源放 `images/web/`。`hai.json` 的 `build.images` 选择文件，`deploy` 保存项目级部署参数；依赖输入由构建器生成到 `images/dependencies/`。所有根 `.gitignore` 均忽略 `**/images/dependencies/`、运行数据和私有环境文件。

package/templates/apps/api/apps/{{projectName}}-serv/README.md.hbs

@@ -27,7 +27,7 @@ pnpm --filter {{api.servPackageName}} test
 
 ### 关键目录
 
-{{#if features.crypto}}启用 transport 时，`serverKeyRing` 与客户端 `keyStore` 都必须显式提供。CLI 在本服务 `.env.dev/.env.test/.env.prod` 中分别生成独立 ring，提交环境文件后克隆用户可共享，变量为 `HAI_CRYPTO_TRANSPORT_SERVERKEYRING`；运行时不生成密钥。部署直接复用所选环境文件的 ring，或由 Secret Manager 向所有节点分发相同受管 ring，配合共享数据库 registry。公钥/版本参与协商，私钥不进入普通 YAML、PUBLIC_/VITE_、日志或公开响应。轮换先分发新旧版本再切 activeKeyId，过渡期后撤销旧 ID；无需会话粘性。
+{{#if features.crypto}}启用 transport 时，`serverKeyRing` 与客户端 `keyStore` 都必须显式提供。CLI 在本服务 `.env.dev.local/.env.test.local/.env.prod.local` 中分别生成独立 ring，私有文件不提交 Git，克隆后通过受保护配置或 Secret Manager 分发，变量为 `HAI_CRYPTO_TRANSPORT_SERVERKEYRING`；运行时不生成密钥。部署直接复用所选环境文件的 ring，或由 Secret Manager 向所有节点分发相同受管 ring，配合共享数据库 registry。公钥/版本参与协商，私钥不进入普通 YAML、PUBLIC_/VITE_、日志或公开响应。轮换先分发新旧版本再切 activeKeyId，过渡期后撤销旧 ID；无需会话粘性。
 {{#unless features.db}}本模板未选择 db，registry 仅在 development/test 显式使用内存；production/staging 会拒绝启动 transport。选择 db 并配置共享数据库后再部署，或显式关闭 transport。
 {{/unless}}{{/if}}
 

package/templates/apps/api/apps/{{projectName}}-serv/package.json.hbs

@@ -28,11 +28,11 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rimraf dist .turbo",
-    "dev": "pnpm build && node --env-file=.env --env-file=.env.dev --env-file-if-exists=.env.local dist/index.js",
-    "start": "node --env-file=.env --env-file=.env.prod --env-file-if-exists=.env.local dist/index.js",
-    "dev:test": "pnpm build && node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local dist/index.js",
+    "dev": "pnpm build && node ../../scripts/run-node.mjs dev . dist/index.js",
+    "start": "node ../../scripts/run-node.mjs prod . dist/index.js",
+    "dev:test": "pnpm build && node ../../scripts/run-node.mjs test . dist/index.js",
     "dev:prod": "pnpm build && pnpm start",
-    "start:test": "node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local dist/index.js",
+    "start:test": "node ../../scripts/run-node.mjs test . dist/index.js",
     "start:prod": "pnpm start"
   },
   "dependencies": {

package/templates/apps/api/apps/{{projectName}}-serv/src/lib/server/init.ts.hbs

@@ -13,7 +13,7 @@ import { core } from '@h-ai/core'
 import { crypto } from '@h-ai/crypto'
 {{/if}}
 {{#if features.feedback}}
-import { feedback } from '@h-ai/feedback'
+import { feedback, FeedbackConfigSchema } from '@h-ai/feedback'
 {{/if}}
 {{#if features.iam}}
 import { iam, IamConfigSchema } from '@h-ai/iam'
@@ -91,7 +91,46 @@ async function closeFeedback() {
 {{/if}}
 
 const runtime = core.module.createRuntime([
-  { name: 'configuration', start: () => { core.init({ configDir: './config' }) }, close: () => {} },
+  { name: 'configuration', start: () => {
+    core.init({
+      configDir: './config',
+      configSchemas: {
+        serv: ServConfigSchema,
+{{#if features.ai}}
+        ai: AIConfigSchema,
+{{/if}}
+{{#if features.audit}}
+        audit: AuditInitConfigSchema,
+{{/if}}
+{{#if features.cache}}
+        cache: CacheConfigSchema,
+{{/if}}
+{{#if features.feedback}}
+        feedback: FeedbackConfigSchema,
+{{/if}}
+{{#if features.iam}}
+        iam: IamConfigSchema,
+{{/if}}
+{{#if features.reach}}
+        reach: ReachConfigSchema,
+{{/if}}
+{{#if features.db}}
+        db: ReldbConfigSchema,
+{{/if}}
+{{#if features.audit}}
+{{#if features.scheduler}}
+        scheduler: SchedulerConfigSchema,
+{{/if}}
+{{/if}}
+{{#if features.storage}}
+        storage: StorageConfigSchema,
+{{/if}}
+{{#if features.vecdb}}
+        vecdb: VecdbConfigSchema,
+{{/if}}
+      },
+    })
+  }, close: () => {} },
   { name: 'serv-config', start: () => core.config.validate('serv', ServConfigSchema), close: () => {} },
 {{#if features.db}}
   { name: 'reldb', start: async () => {

package/templates/apps/api/images/serv.Dockerfile.hbs

@@ -1,4 +1,5 @@
-FROM node:24.22.1-bookworm-slim AS build
+ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
+FROM ${HAI_NODE_IMAGE} AS build
 ARG SQLITE_PREBUILD_MIRROR=
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
@@ -8,11 +9,15 @@ ENV CI=true
 ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
 COPY . .
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
@@ -21,7 +26,7 @@ RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{api.servPackageName}} --prod /prod/app
 RUN rm -f /prod/app/README* && find /prod/app/dist -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
-FROM node:24.22.1-bookworm-slim AS runtime-base
+FROM ${HAI_NODE_IMAGE} AS runtime-base
 
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0
@@ -34,5 +39,5 @@ RUN mkdir -p /app/data && chown node:node /app/data
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config' }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
+  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config', configSchemas: { serv: ServConfigSchema } }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
 CMD ["node", "dist/index.js"]

package/templates/apps/fullstack/docs/security-configuration.md.hbs

@@ -128,7 +128,7 @@ security:
 
 ## 独立初始凭据和安全邀请
 
-CLI 创建完成时会提示四个用户名、职责及密码变量位置；不在终端打印明文密码。新项目已在 `.env.dev/.env.test/.env.prod` 中为 admin、audit_admin、config_admin、business_operator 分别生成独立随机密码，各环境也不同。服务首次启动才创建缺失账号；缺少对应初始密码时跳过该账号，已有账号不覆盖。Admin Console 仓库示例由部署者在私有环境/进程中提供下表四个变量，不能把模板随机密码当成示例的固定通用密码。同名进程变量或 `.env.local` 可覆盖；修改这些初始变量不会重设已有账号的密码。需要首次强改时，在首次创建这些账号前开启上一节的 `requireInitialChange`。
+CLI 创建完成时会提示四个用户名、职责及密码变量位置；不在终端打印明文密码。新项目已在 `.env.dev.local/.env.test.local/.env.prod.local` 中为 admin、audit_admin、config_admin、business_operator 分别生成独立随机密码，各环境也不同。服务首次启动才创建缺失账号；缺少对应初始密码时跳过该账号，已有账号不覆盖。Admin Console 仓库示例由部署者在私有环境/进程中提供下表四个变量，不能把模板随机密码当成示例的固定通用密码。同名进程变量或 `.env.local` 可覆盖；修改这些初始变量不会重设已有账号的密码。需要首次强改时，在首次创建这些账号前开启上一节的 `requireInitialChange`。
 
 日常创建业务账号希望改为一次性邀请，先配置真实发送通道，再设置：
 

package/templates/apps/fullstack/images/serv.Dockerfile.hbs

@@ -1,4 +1,5 @@
-FROM node:24.22.1-bookworm-slim AS build
+ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
+FROM ${HAI_NODE_IMAGE} AS build
 ARG SQLITE_PREBUILD_MIRROR=
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
@@ -8,11 +9,15 @@ ENV CI=true
 ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
 COPY tsconfig.base.json ./
 COPY scripts/ ./scripts/
 COPY packages/{{projectName}}-contract/ ./packages/{{projectName}}-contract/
@@ -25,7 +30,7 @@ RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
 RUN rm -f /prod/service/README* && find /prod/service/dist -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
-FROM node:24.22.1-bookworm-slim AS service
+FROM ${HAI_NODE_IMAGE} AS service
 
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0
@@ -38,5 +43,5 @@ RUN mkdir -p /app/data && chown node:node /app/data
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config' }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
+  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config', configSchemas: { serv: ServConfigSchema } }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
 CMD ["node", "dist/index.js"]

package/templates/apps/fullstack/images/web.Dockerfile.hbs

@@ -1,5 +1,7 @@
+ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
+ARG HAI_NGINX_IMAGE=nginxinc/nginx-unprivileged:1.29.8-alpine
 {{#if fullstack.frontends.web}}
-FROM node:24.22.1-bookworm-slim AS build
+FROM ${HAI_NODE_IMAGE} AS build
 ARG SQLITE_PREBUILD_MIRROR=
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
@@ -8,11 +10,15 @@ ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
 COPY tsconfig.base.json ./
 COPY scripts/ ./scripts/
 COPY packages/{{projectName}}-contract/ ./packages/{{projectName}}-contract/
@@ -23,7 +29,7 @@ ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
 RUN pnpm --filter {{fullstack.sharedPackageName}} paraglide:compile && HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" PUBLIC_BASE_PATH="$PUBLIC_BASE_PATH" pnpm --filter {{projectName}}-web... --if-present build
 
-FROM nginxinc/nginx-unprivileged:1.29.8-alpine AS web
+FROM ${HAI_NGINX_IMAGE} AS web
 
 ENV PUBLIC_API_BASE=
 ENV NGINX_ENVSUBST_FILTER=PUBLIC_API_BASE_BASE64

package/templates/apps/fullstack/packages/{{projectName}}-serv/README.md.hbs

@@ -20,7 +20,7 @@
 - `config/_serv.yml`：服务端运行时设置（CORS 来源等）。
 - `config/_db.yml` / `_cache.yml` / `_iam.yml` / `_storage.yml` / `_audit.yml` / `_reach.yml`：管理及开发通知配置，初始化前使用模块公开 Schema 验证。Reach 默认控制台 Provider，生产按注释替换为 SMTP/短信/API。
 - `config/_ai.yml` / `_vecdb.yml` / `_payment.yml` / `_scheduler.yml`：保留未启用模块的完整注释示例；配置文件存在不代表模块已接入。先在本 workspace 安装对应依赖，再在 `src/server/runtime.ts` 按公开 Schema 校验、初始化并反序关闭，接入实际业务后按需取消注释。整份注释先去掉一层外层注释，可选字段继续按需开启。
-- `src/index.ts`：进程入口，先 `core.init({ configDir: './config' })`，再初始化 reldb → cache → crypto → storage → reach（有配置时）→ audit → iam → scheduler（有任务时）；启动失败及退出反序释放。
+- `src/index.ts`：进程入口，通过 `src/server/runtime.ts` 先向 Core 注册各模块公开 Schema 并加载配置，再初始化 reldb → cache → crypto → storage → reach（有配置时）→ audit → iam → scheduler（有任务时）；YAML 未声明的合法可选字段同样支持细项环境变量，启动失败及退出反序释放。
 - 选择 AI 时自动安装 reldb/vecdb/AI，并在 reldb/cache 之后初始化 vecdb、在其余依赖之后初始化 AI；关闭时先释放 AI，最后释放 vecdb/关系库，关闭失败会返回错误并保留重试义务。生产环境必须使用共享后端，根 `.env.prod` 默认连接 Compose `db/cache/storage/vecdb`，凭据和真实 Reach Provider JSON 私有注入。
 - `src/app-server.ts`：服务装配入口，挂载健康检查、OpenAPI、docs 与 procedures；应用名称 / 版本与 CORS 来源均取自上述配置。
 - `src/server/procedures/app-procedures.ts`：app 领域 procedures，对应 contract 中的 `app.info` / `app.echo` 路由。
@@ -29,7 +29,7 @@
 - `src/server/admin-service.ts`：角色分配、头像上传和审计编排，全部底层操作复用 hai 模块。初始使用 admin、audit_admin、config_admin、business_operator 和 user 五种角色，四类职责及基础成员权限由 security-roles.ts 配置；锁内重新鉴权，默认禁止管理员自删、自禁用、自降级，并补偿用户更新失败后的角色变更。业务规则可按需求替换，保留的不变量需验证并发与失败路径。
 - `tests/app-server.test.ts`：真实加密 HTTP 测试，覆盖 Cookie/受信原生刷新、RBAC、旧会话权限、并发管理操作、补偿、头像安全、偏好、审计及会话失效。
 
-CLI 已在根目录 `.env.dev/.env.test/.env.prod` 为每个环境的 admin、audit_admin、config_admin、business_operator 分别生成独立随机强密码，对应 `HAI_ADMIN_DEFAULT_PASSWORD`、`HAI_AUDIT_ADMIN_PASSWORD`、`HAI_CONFIG_ADMIN_PASSWORD`、`HAI_BUSINESS_OPERATOR_PASSWORD`。已有账号不改密或重新分配职责；未配置密码的独立职责账号不创建；`dev`/`start` 自动读取，首次登录使用用户名 `admin` 和该密码。仅在没有用户时创建管理员，不重设已有用户密码。密码不符合 `_iam.yml` 策略时，启动日志显示具体原因及错误码。环境文件随项目提交供克隆后共享；私有文件或进程变量可覆盖，`.env.example` 不含真实密码。所有业务 JSON 请求和响应强制加密；健康检查和随机路径的只读头像图片可直接访问。头像支持 PNG/JPEG/WebP，最大 512 KiB，校验内容特征和大小后由服务端生成 key，不能指定任意文件路径。
+CLI 已在根目录 `.env.dev.local/.env.test.local/.env.prod.local` 为每个环境的 admin、audit_admin、config_admin、business_operator 分别生成独立随机强密码，对应 `HAI_ADMIN_DEFAULT_PASSWORD`、`HAI_AUDIT_ADMIN_PASSWORD`、`HAI_CONFIG_ADMIN_PASSWORD`、`HAI_BUSINESS_OPERATOR_PASSWORD`。已有账号不改密或重新分配职责；未配置密码的独立职责账号不创建；`dev`/`start` 自动读取，首次登录使用用户名 `admin` 和该密码。仅在没有用户时创建管理员，不重设已有用户密码。密码不符合 `_iam.yml` 策略时，启动日志显示具体原因及错误码。这些私有文件不提交 Git，克隆后通过受保护配置分发对应环境秘密；私有文件或进程变量可覆盖，`.env.example` 不含真实密码。所有业务 JSON 请求和响应强制加密；健康检查和随机路径的只读头像图片可直接访问。头像支持 PNG/JPEG/WebP，最大 512 KiB，校验内容特征和大小后由服务端生成 key，不能指定任意文件路径。
 
 默认 SQLite + 本地 storage + memory cache 仅适合本地开发与显式测试，管理写入仅支持单写实例：进程内保护无过期时间，共享 cache 锁定期续租，丢失锁或释放失败会记录错误。多实例读取可使用共享数据库、Redis cache 和 S3 storage，但管理写请求必须统一路由到同一写实例；仅更换 Redis 不提供任意多写副本的最后管理员原子保证。传输在所有节点共享受管版本化密钥环与 registry，不依赖会话粘性；重启加载原 ring，轮换先分发新旧版本再切 activeKeyId。Web 使用 HttpOnly refresh Cookie + 内存 access token；仅同时满足客户端标识、body 通道头与受信原生 Origin 的 App/Desktop 请求返回 refresh token body。
 
@@ -37,9 +37,9 @@ CLI 已在根目录 `.env.dev/.env.test/.env.prod` 为每个环境的 admin、au
 
 ### 开发
 
-所有配置字段以模块 Schema 为准；未使用字段和替代 Provider 用注释保留。叶子环境变量只覆盖已有 YAML 路径，先取消相应键的注释，或用 `HAI_DB` / `HAI_CACHE` 等整体对象覆盖；`connectTimeout` 对应 `HAI_CACHE_CONNECTTIMEOUT`。凭据示例在根 `.env.example`，初始管理员密码和传输密钥环按环境生成到 `.env.dev/.env.test/.env.prod`；其他私有值或覆盖值保存在忽略的 `.env.local` 或部署环境。`.gitignore` 的 `**/data/` 忽略所有运行数据及 `.gitkeep`；运行时会创建目录。`crypto.init()` 无配置参数，datapipe 为纯函数，不提供虚构配置。
+所有配置字段以模块 Schema 为准；未使用字段和替代 Provider 用注释保留。宿主显式提供模块 Schema 后，合法可选路径可直接用细项配置；同源 `HAI_DB` / `HAI_CACHE` JSON 为基础，细项继续覆盖；`connectTimeout` 对应 `HAI_CACHE_CONNECTTIMEOUT`。凭据示例在根 `.env.example`，初始管理员密码和传输密钥环按环境生成到 `.env.dev.local/.env.test.local/.env.prod.local`；其他私有值或覆盖值保存在忽略的 `.env.local` 或部署环境。`.gitignore` 的 `**/data/` 忽略所有运行数据及 `.gitkeep`；运行时会创建目录。`crypto.init()` 无配置参数，datapipe 为纯函数，不提供虚构配置。
 
-CLI 同时在根 `.env.dev/.env.test/.env.prod` 分别生成独立的 `HAI_CRYPTO_TRANSPORT_SERVERKEYRING`，结构为 `{activeKeyId,keys:{id:{publicKey,privateKey}}}`，运行时不隐式生成。同一环境所有节点从环境文件加载相同 ring，也可由 Secret Manager 统一覆盖，客户端 registry 复用共享 reldb。私钥不进入普通 YAML、PUBLIC_/VITE_、日志或公开响应。轮换先分发含新旧版本的 ring，再切 activeKeyId 并滚动重建；过渡期后删除旧 ID，旧客户端 destroy 后重协商。没有 sticky session 依赖。
+CLI 同时在根 `.env.dev.local/.env.test.local/.env.prod.local` 分别生成独立的 `HAI_CRYPTO_TRANSPORT_SERVERKEYRING`，结构为 `{activeKeyId,keys:{id:{publicKey,privateKey}}}`，运行时不隐式生成。同一环境所有节点从环境文件加载相同 ring，也可由 Secret Manager 统一覆盖，客户端 registry 复用共享 reldb。私钥不进入普通 YAML、PUBLIC_/VITE_、日志或公开响应。轮换先分发含新旧版本的 ring，再切 activeKeyId 并滚动重建；过渡期后删除旧 ID，旧客户端 destroy 后重协商。没有 sticky session 依赖。
 
 自动生成的 `.env` 包含已启用模块的环境参数；YAML 显式引用相同变量并保留本地回退。使用 `start:test` / `start:prod` 加载对应环境覆盖。
 

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -27,11 +27,11 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rimraf dist .turbo",
-    "dev": "pnpm build && node --env-file=../../.env --env-file=../../.env.dev --env-file-if-exists=../../.env.local dist/index.js",
-    "start": "node --env-file=../../.env --env-file=../../.env.prod --env-file-if-exists=../../.env.local dist/index.js",
-    "dev:test": "pnpm build && node --env-file=../../.env --env-file=../../.env.test --env-file-if-exists=../../.env.local dist/index.js",
+    "dev": "pnpm build && node ../../scripts/run-node.mjs dev ../.. dist/index.js",
+    "start": "node ../../scripts/run-node.mjs prod ../.. dist/index.js",
+    "dev:test": "pnpm build && node ../../scripts/run-node.mjs test ../.. dist/index.js",
     "dev:prod": "pnpm build && pnpm start",
-    "start:test": "node --env-file=../../.env --env-file=../../.env.test --env-file-if-exists=../../.env.local dist/index.js",
+    "start:test": "node ../../scripts/run-node.mjs test ../.. dist/index.js",
     "start:prod": "pnpm start"
   },
   "dependencies": {

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/index.ts.hbs

@@ -7,8 +7,7 @@ import { createServerApp } from './app-server.js'
 import { closeModules, initializeModules } from './server/runtime.js'
 
 async function startServer(): Promise<void> {
-  // 加载配置后按依赖顺序初始化；日志设置沿用 _core.yml。
-  core.init({ configDir: './config' })
+  // 运行时先注册模块 Schema 并加载配置，再按依赖顺序初始化；日志设置沿用 _core.yml。
   await initializeModules()
   try {
     // HOST/PORT 环境变量优先于 config/_serv.yml。

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/runtime.ts.hbs

@@ -10,12 +10,12 @@ import { cache, CacheConfigSchema } from '@h-ai/cache'
 import { core, HaiConfigError } from '@h-ai/core'
 import { crypto } from '@h-ai/crypto'
 {{#if features.feedback}}
-import { feedback } from '@h-ai/feedback'
+import { feedback, FeedbackConfigSchema } from '@h-ai/feedback'
 {{/if}}
 import { iam, IamConfigSchema } from '@h-ai/iam'
 import { reach, ReachConfigSchema } from '@h-ai/reach'
 import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
-import { scheduler } from '@h-ai/scheduler'
+import { scheduler, SchedulerConfigSchema } from '@h-ai/scheduler'
 import { ServConfigSchema } from '@h-ai/serv'
 import { storage, StorageConfigSchema } from '@h-ai/storage'
 {{#if features.vecdb}}
@@ -79,6 +79,30 @@ async function closeFeedback() {
 
 {{/if}}
 const runtime = core.module.createRuntime([
+  { name: 'configuration', start: () => {
+    core.init({
+      configDir: './config',
+      configSchemas: {
+{{#if features.ai}}
+        ai: AIConfigSchema,
+{{/if}}
+        audit: AuditInitConfigSchema,
+        cache: CacheConfigSchema,
+        db: ReldbConfigSchema,
+{{#if features.feedback}}
+        feedback: FeedbackConfigSchema,
+{{/if}}
+        iam: IamConfigSchema,
+        reach: ReachConfigSchema,
+        scheduler: SchedulerConfigSchema,
+        serv: ServConfigSchema,
+        storage: StorageConfigSchema,
+{{#if features.vecdb}}
+        vecdb: VecdbConfigSchema,
+{{/if}}
+      },
+    })
+  }, close: () => {} },
   { name: 'serv-config', start: () => core.config.validate('serv', ServConfigSchema), close: () => {} },
   { name: 'reldb', start: async () => {
     const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/app-server.test.ts.hbs

@@ -45,7 +45,6 @@ beforeAll(async () => {
   vi.stubEnv('HAI_DB_DATABASE', '":memory:"')
   vi.stubEnv('HAI_STORAGE_ROOT', storageRoot)
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', TEST_PASSWORD)
-  core.init({ configDir: './config' })
   await initializeModules()
   const key = crypto.asymmetric.generateKeyPair()
   if (!key.success)

package/templates/base/images/web.Dockerfile.hbs

@@ -1,5 +1,7 @@
+ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
+ARG HAI_NGINX_IMAGE=nginxinc/nginx-unprivileged:1.29.8-alpine
 {{#if isSvelteOnlyApp}}
-FROM node:24.22.1-bookworm-slim AS build
+FROM ${HAI_NODE_IMAGE} AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -7,18 +9,22 @@ ENV CI=true
 ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
 COPY . .
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" PUBLIC_BASE_PATH="$PUBLIC_BASE_PATH" pnpm compile
 
-FROM nginxinc/nginx-unprivileged:1.29.8-alpine AS runtime
+FROM ${HAI_NGINX_IMAGE} AS runtime
 
 COPY --chmod=755 images/web/19-runtime-config.sh /docker-entrypoint.d/19-hai-runtime-config.sh
 COPY images/web/nginx.conf /etc/nginx/conf.d/default.conf
@@ -29,7 +35,7 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
 {{else}}
-FROM node:24.22.1-bookworm-slim AS build
+FROM ${HAI_NODE_IMAGE} AS build
 ARG SQLITE_PREBUILD_MIRROR=
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
@@ -39,11 +45,15 @@ ENV CI=true
 ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
 COPY . .
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
@@ -53,7 +63,7 @@ RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{projectName}} --prod /prod/app
 RUN rm -f /prod/app/README* && find /prod/app/build -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
-FROM node:24.22.1-bookworm-slim AS runtime-base
+FROM ${HAI_NODE_IMAGE} AS runtime-base
 
 ARG PUBLIC_BASE_PATH=
 ENV PUBLIC_BASE_PATH=$PUBLIC_BASE_PATH

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.23.4 || ^24.22.1 || ^26.12.1" },
   "name": "{{projectName}}",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
@@ -29,8 +29,8 @@
     "deploy": "hai deploy",
 {{/if}}
 {{#unless isSvelteOnlyApp}}
-    "start": "node --env-file=.env --env-file=.env.prod --env-file-if-exists=.env.local build/index.js",
-    "start:test": "node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local build/index.js",
+    "start": "node scripts/run-node.mjs prod . build/index.js",
+    "start:test": "node scripts/run-node.mjs test . build/index.js",
     "start:prod": "pnpm start",
 {{/unless}}
     "preview": "vite preview",

package/templates/base/src/lib/server/init.ts.hbs

@@ -13,7 +13,7 @@ import { core } from '@h-ai/core'
 import { crypto } from '@h-ai/crypto'
 {{/if}}
 {{#if features.feedback}}
-import { feedback } from '@h-ai/feedback'
+import { feedback, FeedbackConfigSchema } from '@h-ai/feedback'
 {{/if}}
 {{#if features.iam}}
 import { iam, IamConfigSchema } from '@h-ai/iam'
@@ -90,7 +90,45 @@ async function closeFeedback() {
 {{/if}}
 
 const runtime = core.module.createRuntime([
-  { name: 'configuration', start: () => { core.init({ configDir: './config' }) }, close: () => {} },
+  { name: 'configuration', start: () => {
+    core.init({
+      configDir: './config',
+      configSchemas: {
+{{#if features.ai}}
+        ai: AIConfigSchema,
+{{/if}}
+{{#if features.audit}}
+        audit: AuditInitConfigSchema,
+{{/if}}
+{{#if features.cache}}
+        cache: CacheConfigSchema,
+{{/if}}
+{{#if features.feedback}}
+        feedback: FeedbackConfigSchema,
+{{/if}}
+{{#if features.iam}}
+        iam: IamConfigSchema,
+{{/if}}
+{{#if features.reach}}
+        reach: ReachConfigSchema,
+{{/if}}
+{{#if features.db}}
+        db: ReldbConfigSchema,
+{{/if}}
+{{#if features.audit}}
+{{#if features.scheduler}}
+        scheduler: SchedulerConfigSchema,
+{{/if}}
+{{/if}}
+{{#if features.storage}}
+        storage: StorageConfigSchema,
+{{/if}}
+{{#if features.vecdb}}
+        vecdb: VecdbConfigSchema,
+{{/if}}
+      },
+    })
+  }, close: () => {} },
 {{#if features.db}}
   { name: 'reldb', start: async () => {
     const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))

package/templates/shared/run-node.mjs

@@ -0,0 +1,45 @@
+/** 所有模板共用环境来源规则启动 Node，让 NODE_OPTIONS 在子进程启动前生效。 */
+import { spawn } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { resolve } from 'node:path'
+import process from 'node:process'
+import { pathToFileURL } from 'node:url'
+
+const [mode, environmentDirectory, entry, ...arguments_] = process.argv.slice(2)
+if (!mode || !environmentDirectory || !entry)
+  throw new Error('Usage: node run-node.mjs <mode> <env-directory> <entry> [arguments]')
+
+// 从实际应用解析公开 Core 入口，脚本可以放在 workspace 根目录。
+const require = createRequire(resolve('package.json'))
+const { core } = await import(pathToFileURL(require.resolve('@h-ai/core')).href)
+const loaded = core.config.loadEnvFiles({ mode, envDir: resolve(environmentDirectory) })
+if (!loaded.success)
+  throw new Error(loaded.error.message)
+
+const child = spawn(process.execPath, [resolve(entry), ...arguments_], {
+  cwd: process.cwd(),
+  env: { ...process.env, ...loaded.data },
+  stdio: 'inherit',
+  windowsHide: true,
+})
+function interrupt() {
+  child.kill('SIGINT')
+}
+function terminate() {
+  child.kill('SIGTERM')
+}
+process.on('SIGINT', interrupt)
+process.on('SIGTERM', terminate)
+try {
+  const result = await new Promise((resolve, reject) => {
+    child.once('error', reject)
+    child.once('close', (code, signal) => resolve({ code, signal }))
+  })
+  process.exitCode = result.code ?? (result.signal === 'SIGINT' ? 130 : 143)
+}
+finally {
+  process.off('SIGINT', interrupt)
+  process.off('SIGTERM', terminate)
+  if (child.exitCode === null && child.signalCode === null)
+    child.kill('SIGTERM')
+}

package/templates/skills/hai-ai/guide.md

@@ -427,7 +427,7 @@ await saveImage(image.data.images[0].data, image.data.images[0].mimeType)
 ```
 
 - `Pollinations` 提供可免费起步的开发额度，但仍需 API key；不要把“免费额度”描述为匿名或无限调用。
-- 应用应通过 `core.init({ configDir: './config' })` 加载 `_core.yml` / `_ai.yml`，再以 `core.config.validate('ai', AIConfigSchema)` 校验并传给 `ai.init`；不要在启动代码中重复拼装模型、端点和超时，也不要传入 `logging` 覆盖 `_core.yml`。
+- 应用应通过 `core.init({ configDir: './config', configSchemas: { ai: AIConfigSchema } })` 加载 `_core.yml` / `_ai.yml`，并登记其他所用模块的公开 Schema，再以 `core.config.validate('ai', AIConfigSchema)` 校验并传给 `ai.init`；不要在启动代码中重复拼装模型、端点和超时，也不要传入 `logging` 覆盖 `_core.yml`。
 - Pollinations 的 HTTP 402 表示账户余额或该 API Key 的预算耗尽；401 是密钥无效，403 是权限或模型访问被拒。诊断日志记录厂商、模型、状态、上游错误码和请求 ID，不记录密钥、提示词或图片内容。
 - Qwen 等返回的临时图片 URL 会在 Provider 内立即下载，公共结果不泄漏易过期 URL。
 - 参考图统一使用 `{ data: Uint8Array, mimeType: 'image/...' }`；不要把厂商 URL、multipart 或 Base64 结构泄漏到业务层。