@lark-apaas/miaoda-cli 0.1.39-alpha.fc0f733 → 0.1.39-beta.179a78f

package/README.md

@@ -54,19 +54,13 @@ miaoda file ls --output json
 
 ## 全栈应用的 MCP UI 检查
 
-`miaoda app sync` 为 `nestjs-react-fullstack` 应用同步 `scripts/lint.js`，在
-`tsconfig.node.json` 中追加 `server/mcp/ui` 排除项，并保留现有配置及继承的排除路径。
-根 `eslint.config.js` / `.mjs` / `.cjs` 会增量追加 UI 全局忽略，直接 ESLint 调用和编辑器检查均生效。
-迁移不执行配置文件；无法静态识别的自定义导出保留并提示手动补齐。
-已知模板版本的 `type:check`、`eslint` 命令会迁移到独立检查入口；自定义命令保留并提示。
-
-- `npm run type:check`：检查服务端、客户端及 MCP UI。
-- `npm run type:check:mcp-ui` / `npm run eslint:mcp-ui`：单独检查 MCP UI。
-- `npm run lint -- --files <files...>`：按改动文件选择检查范围。
-
-同步不会生成 MCP UI 目录。开发 MCP UI 时，由 Agent 按 MCP 指南创建
-`server/mcp/ui/tsconfig.json` 和根目录 `eslint.mcp-ui.config.cjs`。
-没有 UI 源码时跳过独立检查；存在 UI 源码但缺少配置时明确报错。
+创建 MCP UI 时，Agent 在 `server/mcp/ui` 中同时生成 `tsconfig.json` 和 `eslint.config.cjs`，修改 UI 或其 shared 依赖后主动运行独立检查。模板和 CLI 不生成 UI 配置，也不将 UI 检查接入主工程 lint/type:check。
+
+主工程保留原 client/server 检查。Agent 从工程根执行 `npx --no-install tsc --noEmit --project server/mcp/ui/tsconfig.json`，再执行 `npx --no-install eslint --config server/mcp/ui/eslint.config.cjs "server/mcp/ui/**/*.{ts,tsx,js,jsx}" --max-warnings 0`；必须检查退出码并修复错误。无需辅助脚本或新增 npm 命令。
+
+CLI 不注入 MCP UI 检查命令；主工程保留原有 client/server 检查，UI 由 Agent 按独立配置执行标准 tsc/eslint。
+
+存量 sync 不改写 ESLint 源码；UI 全局排除项由平台 ESLint 预设提供。TS 仅向已有显式 `exclude` 数组追加目录，保留注释和原项；依赖继承且未显式声明 `exclude` 的自定义配置保持不变并提示人工调整。自定义检查命令保留。lint.js 和 build.sh 仍由平台脚本模板维护，不依赖预设包中的脚本执行入口。
 
 ## 打包可本地访问的静态产物
 

package/dist/api/deploy/api.js

@@ -50,9 +50,11 @@ async function getErrorLog(req) {
  * GET /v1/pipeline/app/:appID/instance/:instanceID/detail — 轮询发布状态
  *
  * 走 lark.apaas.devops_platform PSM；URL 前缀不同但共用同一管理端 gateway。
+ * 显式带 withTransformApprovalData=true 取审批展示视图（job 上挂 approval）；IDL 默认 false，
+ * 不带时拿不到审批链接与拒绝原因。该参数只改返回投影，无副作用。
  */
 async function queryPipelineInstance(req) {
-    const url = `/v1/pipeline/app/${encodeURIComponent(req.appID)}/instance/${encodeURIComponent(req.instanceID)}/detail`;
+    const url = `/v1/pipeline/app/${encodeURIComponent(req.appID)}/instance/${encodeURIComponent(req.instanceID)}/detail?withTransformApprovalData=true`;
     return (0, http_1.getInnerApi)(url, {
         errPrefix: 'Failed to query pipeline',
         defaultErrCode: DEFAULT_ERR_CODE,

package/dist/api/deploy/approval.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TERMINAL_NODE_STATUSES = void 0;
+exports.approvalStatusText = approvalStatusText;
+exports.findApproval = findApproval;
+exports.approvalURL = approvalURL;
+const types_1 = require("./types");
+/** 流水线终态；REJECTED 为卡点审批被拒 */
+exports.TERMINAL_NODE_STATUSES = [
+    types_1.NodeStatus.SUCCESS,
+    types_1.NodeStatus.FAILED,
+    types_1.NodeStatus.CANCELED,
+    types_1.NodeStatus.REJECTED,
+];
+const APPROVAL_STATUS_TEXT = {
+    [types_1.ApprovalStatus.UNSPECIFIED]: 'unknown',
+    [types_1.ApprovalStatus.PENDING]: 'pending',
+    [types_1.ApprovalStatus.APPROVED]: 'approved',
+    [types_1.ApprovalStatus.REJECTED]: 'rejected',
+    [types_1.ApprovalStatus.CANCELED]: 'canceled',
+    [types_1.ApprovalStatus.FAILED]: 'failed',
+};
+/** 仍需用户知道点什么的卡点：在等谁、为什么被拒、平台没把审批发出去；已通过 / 已撤回不再展示 */
+const SURFACED_APPROVAL_STATUSES = [
+    types_1.ApprovalStatus.PENDING,
+    types_1.ApprovalStatus.REJECTED,
+    types_1.ApprovalStatus.FAILED,
+];
+/** 卡点审批状态数字 → 可读字符串；未知值为 unknown(n) */
+function approvalStatusText(v) {
+    return APPROVAL_STATUS_TEXT[Number(v)] ?? `unknown(${String(v)})`;
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function* jobsOf(stages) {
+    if (!Array.isArray(stages))
+        return;
+    for (const stage of stages) {
+        if (!isRecord(stage) || !Array.isArray(stage.jobs))
+            continue;
+        for (const group of stage.jobs) {
+            if (!Array.isArray(group))
+                continue;
+            for (const job of group)
+                if (isRecord(job))
+                    yield job;
+        }
+    }
+}
+/**
+ * 从 CliQueryPipelineInstance 的 PipelineInstance（请求带 withTransformApprovalData=true，返回审批展示视图）中摘出需要输出的卡点：
+ * 第一个 status 为 PENDING / REJECTED / FAILED 的 Job.approval。一次发布可以被拦多次
+ * （build / db_check / deploy），已通过的卡点可能排在前面，不能取它；流水线串行，需要输出的至多一个。
+ * 与妙搭发布面板 findApprovalJob 同一口径。
+ *
+ * 原样透传，status 转为可读字符串，原始数字保留在 status_code（与 detail 各层 status 的约定一致）。
+ * 是否在审批中由顶层 status（PENDING）表达，这里只负责摘出审批链接、拒绝原因等上下文。
+ */
+function findApproval(instance) {
+    for (const job of jobsOf(instance.stages)) {
+        const approval = job.approval;
+        if (!isRecord(approval) || !SURFACED_APPROVAL_STATUSES.includes(approval.status))
+            continue;
+        return {
+            ...approval,
+            status: approvalStatusText(approval.status),
+            status_code: approval.status,
+        };
+    }
+    return undefined;
+}
+/** 取审批链接；缺失或不是非空字符串时返回 undefined。是否可信由调用方（Skill）判断。 */
+function approvalURL(approval) {
+    const url = approval?.approvalURL;
+    return typeof url === 'string' && url !== '' ? url : undefined;
+}

package/dist/api/deploy/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NodeStatus = exports.nodeStatusFromText = exports.nodeStatusText = exports.errorJobSchema = exports.deployGetSchema = exports.deployHistorySchema = exports.batchSavePluginInstances = exports.TosActionType = exports.LocalReleaseStatus = exports.applyTosDiff = exports.getModernLastPublishedVersion = exports.getModernReleaseStatus = exports.createModernRelease = exports.callbackStatic = exports.updateLocalRelease = exports.createLocalRelease = exports.preRelease = exports.queryPipelineInstance = exports.getErrorLog = exports.listPipelineInstances = exports.createRelease = void 0;
+exports.TERMINAL_NODE_STATUSES = exports.approvalStatusText = exports.approvalURL = exports.findApproval = exports.ApprovalStatus = exports.NodeStatus = exports.nodeStatusFromText = exports.nodeStatusText = exports.errorJobSchema = exports.deployGetSchema = exports.deployHistorySchema = exports.batchSavePluginInstances = exports.TosActionType = exports.LocalReleaseStatus = exports.applyTosDiff = exports.getModernLastPublishedVersion = exports.getModernReleaseStatus = exports.createModernRelease = exports.callbackStatic = exports.updateLocalRelease = exports.createLocalRelease = exports.preRelease = exports.queryPipelineInstance = exports.getErrorLog = exports.listPipelineInstances = exports.createRelease = void 0;
 var api_1 = require("./api");
 Object.defineProperty(exports, "createRelease", { enumerable: true, get: function () { return api_1.createRelease; } });
 Object.defineProperty(exports, "listPipelineInstances", { enumerable: true, get: function () { return api_1.listPipelineInstances; } });
@@ -28,3 +28,9 @@ Object.defineProperty(exports, "nodeStatusText", { enumerable: true, get: functi
 Object.defineProperty(exports, "nodeStatusFromText", { enumerable: true, get: function () { return schemas_1.nodeStatusFromText; } });
 var types_1 = require("./types");
 Object.defineProperty(exports, "NodeStatus", { enumerable: true, get: function () { return types_1.NodeStatus; } });
+Object.defineProperty(exports, "ApprovalStatus", { enumerable: true, get: function () { return types_1.ApprovalStatus; } });
+var approval_1 = require("./approval");
+Object.defineProperty(exports, "findApproval", { enumerable: true, get: function () { return approval_1.findApproval; } });
+Object.defineProperty(exports, "approvalURL", { enumerable: true, get: function () { return approval_1.approvalURL; } });
+Object.defineProperty(exports, "approvalStatusText", { enumerable: true, get: function () { return approval_1.approvalStatusText; } });
+Object.defineProperty(exports, "TERMINAL_NODE_STATUSES", { enumerable: true, get: function () { return approval_1.TERMINAL_NODE_STATUSES; } });

package/dist/api/deploy/schemas.js

@@ -13,6 +13,9 @@ const NODE_STATUS_TEXT = {
     [types_1.NodeStatus.FAILED]: 'failed',
     [types_1.NodeStatus.CANCELED]: 'canceled',
     [types_1.NodeStatus.HOLD_ON]: 'hold_on',
+    [types_1.NodeStatus.SKIPPED]: 'skipped',
+    [types_1.NodeStatus.PENDING]: 'pending',
+    [types_1.NodeStatus.REJECTED]: 'rejected',
 };
 function nodeStatusText(v) {
     if (typeof v === 'string')

package/dist/api/deploy/types.js

@@ -8,7 +8,7 @@
 // 发布单的唯一标识是 pipelineTaskID，对外即 deploy-id；error-log 等接口直接用它做
 // URL 路径段（instanceID）。曾经的 Release/releaseID 概念已全面废弃。
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NodeStatus = void 0;
+exports.ApprovalStatus = exports.NodeStatus = void 0;
 /** Pipeline 节点状态（devops_platform） */
 var NodeStatus;
 (function (NodeStatus) {
@@ -18,5 +18,23 @@ var NodeStatus;
     NodeStatus[NodeStatus["SUCCESS"] = 3] = "SUCCESS";
     NodeStatus[NodeStatus["FAILED"] = 4] = "FAILED";
     NodeStatus[NodeStatus["CANCELED"] = 5] = "CANCELED";
+    /** 已废弃：服务端不再产出，保留仅为兼容历史数据 */
     NodeStatus[NodeStatus["HOLD_ON"] = 6] = "HOLD_ON";
+    /** 流水线内部中间态 */
+    NodeStatus[NodeStatus["SKIPPED"] = 7] = "SKIPPED";
+    NodeStatus[NodeStatus["PENDING"] = 8] = "PENDING";
+    /** 卡点审批被拒（人工拒绝 / 超时自动拒绝） */
+    NodeStatus[NodeStatus["REJECTED"] = 9] = "REJECTED";
 })(NodeStatus || (exports.NodeStatus = NodeStatus = {}));
+// ── 发布审批（卡点）信息 ────────────
+/** 卡点审批状态（devops_platform ApprovalStatus） */
+var ApprovalStatus;
+(function (ApprovalStatus) {
+    ApprovalStatus[ApprovalStatus["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    ApprovalStatus[ApprovalStatus["PENDING"] = 1] = "PENDING";
+    ApprovalStatus[ApprovalStatus["APPROVED"] = 2] = "APPROVED";
+    ApprovalStatus[ApprovalStatus["REJECTED"] = 3] = "REJECTED";
+    ApprovalStatus[ApprovalStatus["CANCELED"] = 4] = "CANCELED";
+    /** 卡点异常：发起审批失败等平台侧错误 */
+    ApprovalStatus[ApprovalStatus["FAILED"] = 5] = "FAILED";
+})(ApprovalStatus || (exports.ApprovalStatus = ApprovalStatus = {}));

package/dist/cli/commands/deploy/index.js

@@ -4,6 +4,18 @@ exports.registerDeployCommands = registerDeployCommands;
 const commander_1 = require("commander");
 const shared_1 = require("../../../cli/commands/shared");
 const index_1 = require("../../../cli/handlers/deploy/index");
+/** deploy history --status 可选值（pipeline 节点状态）；hold_on 已被服务端废弃，仅为兼容保留 */
+const HISTORY_STATUS_CHOICES = [
+    'todo',
+    'running',
+    'success',
+    'failed',
+    'canceled',
+    'rejected',
+    'pending',
+    'skipped',
+    'hold_on',
+];
 const COMMON_TIME_HELP = `
 时间格式：
   - 相对时间：30m（30 分钟前）、1h、2d、1w
@@ -21,8 +33,9 @@ function registerDeployCommands(program) {
         .description('触发发布；支持 --wait 阻塞到终态。子命令：get / history / error-log')
         .addOption((0, shared_1.appIdOption)().hideHelp())
         .addOption((0, shared_1.branchOption)().hideHelp())
-        .option('--wait', '阻塞直到流水线终态', false)
+        .option('--wait', '阻塞直到流水线终态或进入人工审批', false)
         .option('--timeout <sec>', '--wait 最长等待秒数（默认 300）', parseTimeout, 300)
+        .option('--apply-reason <text>', '发布申请理由，写入审批单（单行，最多 1000 字符；是否必填由服务端按应用类型判定）')
         .addHelpText('after', `
 不要用异步模式或后台模式调用 deploy（例如 &、nohup、后台 task、detached run，或任何会让命令提前返回的包装方式），否则调用可能提前结束，Agent 会误判发布已完成。
 部署前置检查（Agent 必须执行）
@@ -31,20 +44,29 @@ function registerDeployCommands(program) {
     - 是本次任务的产物 → 先 commit + push 再 deploy
     - 不能确定意图 → 用 AskUser 跟用户确认（不要默默继续）
 
+发布理由与审批
+  需要审批的应用发布时须带 --apply-reason（是否必填由服务端判定，缺失时服务端会报错）。
+  理由为单行文本，最多 1000 字符，不能包含控制字符、零宽字符与双向控制字符。
+  发布进入人工审批（status=pending）后 --wait 会立即返回，退出码为 0，不会轮询到超时。
+
 JSON 输出
   不带 --wait：{"data": {"pipelineTaskID": "..."}}（pipelineTaskID 即 deploy-id）
-  带 --wait：data 额外包含 detail（pipeline 终态）
+  带 --wait：data 额外包含 detail（pipeline 当前状态）；
+    有卡点信息时还包含 approval（如 status、approvalURL、被拒时的 message）。
   detail/status 字段为可读字符串；对应 *_code 字段保留 BAM 原始数字枚举。
 
 状态确认（Agent 必须执行）
-  优先使用 --wait，但无论是否传 --wait，只要 deploy 调用后没有明确的 success / failed / canceled 终态，
+  优先使用 --wait。status 为 pending 时停止轮询，告诉用户正在等待审批负责人处理；
+  用户确认审批处理完后，查询同一个 deploy-id，不要重新发起发布。
+  其余情况下，只要 deploy 调用后没有明确的 success / failed / rejected / canceled 终态或 pending，
   都必须每 2s 轮询一次当前发布状态：拿到 pipelineTaskID 就执行 \`miaoda deploy get <pipelineTaskID> --json\`；
   如果没有拿到 deploy-id 或输出为空，先执行 \`miaoda deploy history --limit 1 --json\` 找到对应发布记录并取得 ID，
-  再用这个 ID 每 2s 执行一次 \`miaoda deploy get <ID> --json\`，直到 status 进入终态。
+  再用这个 ID 每 2s 执行一次 \`miaoda deploy get <ID> --json\`，直到 status 进入终态或 pending。
 
 示例
   $ miaoda deploy
   $ miaoda deploy --wait --timeout 600
+  $ miaoda deploy --wait --apply-reason "修复登录页报错"
   $ miaoda deploy get 12345
   $ miaoda deploy history --status failed
 `);
@@ -55,6 +77,7 @@ JSON 输出
             branch: rawOpts.branch,
             wait: rawOpts.wait,
             timeout: rawOpts.timeout,
+            applyReason: rawOpts.applyReason,
         });
     }));
     registerDeployGet(deployCmd);
@@ -72,6 +95,7 @@ JSON 输出
   {"data": {"ID": ..., "status": ..., "creator": "...", "createdAt": ..., "updatedAt": ..., ...}, "next_cursor": null, "has_more": false}
   ID 即 deploy-id（== pipelineTaskID）
   data.status 为可读字符串；data.status_code 为 BAM 原始数字枚举。
+  status 为 pending / rejected / failed 且存在审批单时，额外包含 approval（如 status、approvalURL、被拒时的 message）。
 
 示例
   $ miaoda deploy get 12345
@@ -90,8 +114,8 @@ function registerDeployHistory(parent) {
         .description('查询发布历史（按时间倒序，分页）')
         .addOption((0, shared_1.appIdOption)().hideHelp())
         .addOption(new commander_1.Option('--status <status>', '状态过滤（pipeline 节点状态，大小写不敏感）')
-        .choices(['todo', 'running', 'success', 'failed', 'canceled', 'hold_on'])
-        .argParser((0, shared_1.caseInsensitiveChoice)(['todo', 'running', 'success', 'failed', 'canceled', 'hold_on'])))
+        .choices(HISTORY_STATUS_CHOICES)
+        .argParser((0, shared_1.caseInsensitiveChoice)(HISTORY_STATUS_CHOICES)))
         .option('--since <time>', '起始时间')
         .option('--until <time>', '截止时间')
         .option('--limit <n>', '返回条数上限（1~100）', parseLimit, 50)

package/dist/cli/handlers/deploy/deploy.js

@@ -34,20 +34,28 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleDeploy = handleDeploy;
+exports.writeApprovalNotice = writeApprovalNotice;
 const api = __importStar(require("../../../api/index"));
 const output_1 = require("../../../utils/output");
 const index_1 = require("../../../api/deploy/index");
 const polling_1 = require("./polling");
 const format_1 = require("./format");
+const helpers_1 = require("./helpers");
 /** miaoda deploy [--branch ...] [--wait] [--timeout 300] */
 async function handleDeploy(opts) {
     const appID = opts.appId;
-    const resp = await api.deploy.createRelease({ appID, branch: opts.branch });
+    if (opts.applyReason !== undefined)
+        (0, helpers_1.validateApplyReason)(opts.applyReason);
+    const resp = await api.deploy.createRelease({
+        appID,
+        branch: opts.branch,
+        ...(opts.applyReason !== undefined && { applyReason: opts.applyReason }),
+    });
     const pipelineTaskID = resp.pipelineTaskID ?? '';
     if (!opts.wait) {
         if (!(0, output_1.isJsonMode)()) {
             process.stdout.write(`✓ Deployment triggered. (deploy-id: ${pipelineTaskID})\n`);
-            process.stdout.write(`  hint: No terminal status yet. Poll every 2s with \`miaoda deploy get ${pipelineTaskID} --json\`; if no deploy-id is visible, first get it from \`miaoda deploy history --limit 1 --json\`.\n`);
+            process.stdout.write(`  hint: No terminal status yet. Poll every 2s with \`miaoda deploy get ${pipelineTaskID} --json\`; if no deploy-id is visible, first get it from \`miaoda deploy history --limit 1 --json\`. Stop polling when status is pending (awaiting approval) and hand it to the user.\n`);
         }
         (0, output_1.emit)({
             data: { pipelineTaskID },
@@ -64,7 +72,8 @@ async function handleDeploy(opts) {
         pipelineTaskID,
         timeoutSec: opts.timeout ?? 300,
     });
-    if (!(0, output_1.isJsonMode)()) {
+    const approval = (0, index_1.findApproval)(detail);
+    if (!(0, output_1.isJsonMode)() && !writeApprovalNotice(detail.status, approval, pipelineTaskID)) {
         if (detail.status === index_1.NodeStatus.SUCCESS) {
             process.stdout.write('✓ 发布成功\n');
         }
@@ -77,8 +86,52 @@ async function handleDeploy(opts) {
         }
     }
     (0, output_1.emit)({
-        data: { pipelineTaskID, detail: (0, format_1.formatPipelineInstance)(detail) },
+        data: { pipelineTaskID, ...(approval && { approval }), detail: (0, format_1.formatPipelineInstance)(detail) },
         next_cursor: null,
         has_more: false,
     });
 }
+/** 控制字符与不可见的 Unicode 格式字符替换成空格，防止服务端字段改写终端输出 */
+function toDisplay(text) {
+    return text.replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, ' ').trim();
+}
+function writeReason(approval) {
+    const message = approval?.message;
+    if (typeof message === 'string' && message !== '') {
+        process.stdout.write(`  原因：${toDisplay(message)}\n`);
+    }
+}
+/** 卡点异常：平台没把审批发出去，没有任何一方做过裁决，不是代码问题 */
+function writeApprovalGateFailed(approval) {
+    process.stdout.write('✗ 发布卡点异常：审批未能发起，不是代码问题，请稍后重试或联系平台\n');
+    writeReason(approval);
+}
+function writeRejected(approval) {
+    process.stdout.write('✗ 发布审批未通过，本次未上线\n');
+    writeReason(approval);
+}
+/**
+ * 审批相关状态的 pretty 提示：审批中 / 审批被拒 / 卡点异常。
+ * 不属于这三类时不输出并返回 false，由调用方按普通状态处理。
+ */
+function writeApprovalNotice(status, approval, pipelineTaskID) {
+    if (status === index_1.NodeStatus.PENDING) {
+        writeApprovalHint(approval, pipelineTaskID);
+    }
+    else if (status === index_1.NodeStatus.REJECTED) {
+        writeRejected(approval);
+    }
+    else if (status === index_1.NodeStatus.FAILED && approval?.status === 'failed') {
+        writeApprovalGateFailed(approval);
+    }
+    else {
+        return false;
+    }
+    return true;
+}
+function writeApprovalHint(approval, pipelineTaskID) {
+    const url = (0, index_1.approvalURL)(approval);
+    process.stdout.write('⏸ 发布已进入人工审批，等待审批负责人处理\n');
+    process.stdout.write(url ? `  审批链接：${toDisplay(url)}\n` : '  服务端未返回审批链接\n');
+    process.stdout.write(`  hint: 审批处理完成后运行 \`miaoda deploy get ${pipelineTaskID}\` 查询本次发布结果，不要重新发起发布\n`);
+}

package/dist/cli/handlers/deploy/format.js

@@ -29,6 +29,7 @@ function formatPipelineInstance(detail) {
             jobs: stage.jobs.map((group) => group.map((job) => ({
                 ...job,
                 ...formatStatusMetadata(job.status),
+                ...formatJobApproval(job),
                 steps: job.steps?.map((step) => ({
                     ...step,
                     ...formatStatusMetadata(step.status),
@@ -37,3 +38,15 @@ function formatPipelineInstance(detail) {
         })),
     };
 }
+/** Job 上的卡点信息同样翻译 status，与 data.approval 的表示保持一致 */
+function formatJobApproval(job) {
+    if (!job.approval)
+        return {};
+    return {
+        approval: {
+            ...job.approval,
+            status: (0, index_1.approvalStatusText)(job.approval.status),
+            status_code: job.approval.status,
+        },
+    };
+}

package/dist/cli/handlers/deploy/get.js

@@ -41,16 +41,28 @@ const error_1 = require("../../../utils/error");
 const index_1 = require("../../../api/deploy/index");
 const helpers_1 = require("./helpers");
 const format_1 = require("./format");
+const polling_1 = require("./polling");
+const deploy_1 = require("./deploy");
 /**
  * 单页拉取上限：BAM listPipelineInstances 限制 1~500，取 500 让 deploy get
  * 在最近 500 条记录里按 ID 命中。
  */
 const DEPLOY_GET_LOOKUP_LIMIT = 500;
+/**
+ * 可能挂着审批单的状态：审批中、审批被拒，以及卡点异常（平台没能发起审批，顶层表现为 FAILED）。
+ * 只有这些状态才额外查详情取审批单，其余状态保持单次列表请求。
+ */
+const APPROVAL_LOOKUP_STATUSES = [
+    index_1.NodeStatus.PENDING,
+    index_1.NodeStatus.REJECTED,
+    index_1.NodeStatus.FAILED,
+];
 /**
  * miaoda deploy get <deploy-id>
  *
  * BAM 没有 by-ID 的查询接口，复用 listPipelineInstances 在最近窗口里按 ID 筛一条。
  * 命中失败时抛 DEPLOY_NOT_FOUND，提示用户用 history 查窗口。
+ * status 为 pending / rejected / failed 时额外查详情，有审批单则输出 approval（审批链接、拒绝原因等）。
  */
 async function handleDeployGet(opts) {
     if (!opts.deployId)
@@ -67,5 +79,33 @@ async function handleDeployGet(opts) {
             next_actions: ['运行 `miaoda deploy history` 确认 deploy-id 是否在最近窗口内'],
         });
     }
-    (0, output_1.emit)({ data: (0, format_1.formatSimpleInstance)(instance), next_cursor: null, has_more: false }, index_1.deployGetSchema);
+    const approval = APPROVAL_LOOKUP_STATUSES.includes(instance.status)
+        ? await lookupApproval(appID, opts.deployId, instance.status)
+        : undefined;
+    (0, output_1.emit)({
+        data: { ...(0, format_1.formatSimpleInstance)(instance), ...(approval && { approval }) },
+        next_cursor: null,
+        has_more: false,
+    }, index_1.deployGetSchema);
+    if (!(0, output_1.isJsonMode)())
+        (0, deploy_1.writeApprovalNotice)(instance.status, approval, opts.deployId);
+}
+/**
+ * 列表项不含审批信息：按同一个 ID 查详情接口（审批展示视图）取审批单。
+ *
+ * pending / rejected 时详情失败直接抛错：丢掉审批链接 / 拒绝原因却无人察觉，比报错更糟。
+ * failed 时降级为只输出列表数据并在 stderr 提示：普通构建失败远多于卡点异常，不能因为详情接口
+ * 出错就让调用方连 status 都拿不到，卡住失败排查。
+ */
+async function lookupApproval(appID, deployId, status) {
+    try {
+        return (0, index_1.findApproval)((0, polling_1.normalizePipelineInstance)(await api.deploy.queryPipelineInstance({ appID, instanceID: deployId })));
+    }
+    catch (err) {
+        if (status !== index_1.NodeStatus.FAILED)
+            throw err;
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`warning: 查询审批单失败，输出不含 approval：${reason}\n`);
+        return undefined;
+    }
 }

package/dist/cli/handlers/deploy/helpers.js

@@ -3,18 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseStatusFlag = parseStatusFlag;
 exports.validateLimit = validateLimit;
 exports.parseDeployId = parseDeployId;
+exports.validateApplyReason = validateApplyReason;
 const args_1 = require("../../../utils/args");
 const index_1 = require("../../../api/deploy/index");
 /**
  * 把 CLI --status 字符串映射成 BAM NodeStatus 数字；非法值抛 ARGS_INVALID。
  *
  * 历史接口（CliListPipelineInstances）返回 SimpleInstance，状态语义是 pipeline 节点状态，
- * 取值 todo / running / success / failed / canceled / hold_on。
+ * 取值 todo / running / success / failed / canceled / rejected / pending / skipped / hold_on（已废弃）。
  */
 function parseStatusFlag(text) {
     const value = (0, index_1.nodeStatusFromText)(text);
     if (value === undefined) {
-        (0, args_1.failArgs)(`--status 无效：'${text}'。可选值：todo | running | success | failed | canceled | hold_on`);
+        (0, args_1.failArgs)(`--status 无效：'${text}'。可选值：todo | running | success | failed | canceled | rejected | pending | skipped | hold_on`);
     }
     return value;
 }
@@ -39,3 +40,29 @@ function parseDeployId(text) {
     }
     return n;
 }
+/** 发布理由上限，按 Unicode code point 计，对齐 lark-cli `apps +release-create` */
+const MAX_APPLY_REASON_CODE_POINTS = 1000;
+/** C0 / C1 控制字符（含换行、制表符） */
+const CONTROL_CHARS = /\p{Cc}/u;
+/**
+ * 不可见格式字符（零宽、BOM、双向控制、词连接符等）与行/段分隔符：肉眼不可见，却会改变审批单里的展示。
+ * 与 deploy 输出服务端文本时的过滤口径一致。
+ */
+const INVISIBLE_CHARS = /[\p{Cf}\u2028\u2029]/u;
+/**
+ * 校验 --apply-reason 的格式；通过后调用方原样透传，不 trim。
+ * 是否必填由服务端按应用类型判定，这里不管。
+ */
+function validateApplyReason(value) {
+    if (value.trim() === '')
+        (0, args_1.failArgs)('--apply-reason 不能为空');
+    if (CONTROL_CHARS.test(value)) {
+        (0, args_1.failArgs)('--apply-reason 不能包含换行、制表符等控制字符，需为单行文本');
+    }
+    if (INVISIBLE_CHARS.test(value)) {
+        (0, args_1.failArgs)('--apply-reason 不能包含零宽字符、双向控制字符或行/段分隔符');
+    }
+    if (Array.from(value).length > MAX_APPLY_REASON_CODE_POINTS) {
+        (0, args_1.failArgs)(`--apply-reason 最多 ${String(MAX_APPLY_REASON_CODE_POINTS)} 个字符`);
+    }
+}

package/dist/cli/handlers/deploy/polling.js

@@ -38,6 +38,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_POLL_INTERVAL_MS = void 0;
 exports.waitForPipeline = waitForPipeline;
+exports.normalizePipelineInstance = normalizePipelineInstance;
 const ora_1 = __importDefault(require("ora"));
 const api = __importStar(require("../../../api/index"));
 const error_1 = require("../../../utils/error");
@@ -45,16 +46,11 @@ const output_1 = require("../../../utils/output");
 const index_1 = require("../../../api/deploy/index");
 /** 默认轮询间隔（毫秒） */
 exports.DEFAULT_POLL_INTERVAL_MS = 2_000;
-const TERMINAL_STATUSES = [
-    index_1.NodeStatus.SUCCESS,
-    index_1.NodeStatus.FAILED,
-    index_1.NodeStatus.CANCELED,
-];
 function defaultSleep(ms) {
     return new Promise((res) => setTimeout(res, ms));
 }
 /**
- * 轮询 pipeline 状态直到终态或超时。
+ * 轮询 pipeline 状态直到终态、进入人工审批或超时。
  *
  * - JSON 模式：轮询期间静默；终态后由 caller 输出最终信封。
  * - Pretty 非 TTY：同 JSON。
@@ -85,7 +81,11 @@ async function waitForPipeline(opts) {
             const detail = normalizePipelineInstance(resp);
             if (spinner)
                 advanceProgress(detail, printedStages, spinner);
-            if (TERMINAL_STATUSES.includes(detail.status)) {
+            if (index_1.TERMINAL_NODE_STATUSES.includes(detail.status)) {
+                return detail;
+            }
+            // 等待人工审批（顶层 PENDING）：可能持续数小时，立即交还给调用方，不再轮询到超时
+            if (detail.status === index_1.NodeStatus.PENDING) {
                 return detail;
             }
             if (now() - start >= timeoutMs) {
@@ -113,7 +113,7 @@ function advanceProgress(detail, printed, spinner) {
     for (const stage of stages) {
         if (printed.has(stage.id))
             continue;
-        if (!TERMINAL_STATUSES.includes(stage.status))
+        if (!index_1.TERMINAL_NODE_STATUSES.includes(stage.status))
             continue;
         spinner.stopAndPersist({
             symbol: stageSymbol(stage),
@@ -153,7 +153,11 @@ function isPipelineInstance(value) {
     return typeof item.status === 'number';
 }
 function stageSymbol(stage) {
-    return stage.status === index_1.NodeStatus.SUCCESS ? '✓' : stage.status === index_1.NodeStatus.FAILED ? '✗' : '•';
+    if (stage.status === index_1.NodeStatus.SUCCESS)
+        return '✓';
+    if (stage.status === index_1.NodeStatus.FAILED || stage.status === index_1.NodeStatus.REJECTED)
+        return '✗';
+    return '•';
 }
 function formatStageBody(stage) {
     const cost = stage.costTime >= 0 ? `(${(stage.costTime / 1000).toFixed(1)}s)` : '';

package/dist/config/sync-configs/nestjs-react-fullstack.js

@@ -159,43 +159,12 @@ exports.SYNC_CONFIG = {
             to: `npx -y ${fullstack_cli_pin_1.FULLSTACK_CLI_PIN_SPEC} sync --disable-gen-openapi`,
             ifStartsWith: 'npx -y @lark-apaas/fullstack-cli sync',
         },
-        { type: 'eslint-ignore', to: 'eslint.config.js', pattern: 'server/mcp/ui/**' },
-        { type: 'eslint-ignore', to: 'eslint.config.mjs', pattern: 'server/mcp/ui/**' },
-        { type: 'eslint-ignore', to: 'eslint.config.cjs', pattern: 'server/mcp/ui/**' },
-        // MCP UI 使用独立浏览器配置；仅迁移已知模板命令，不生成 UI 目录或配置。
+        // MCP UI 使用独立浏览器配置；只补服务端排除项，不生成 UI 目录和配置。
         {
             type: 'typescript-exclude',
             to: 'tsconfig.node.json',
             path: 'server/mcp/ui',
         },
-        {
-            type: 'add-script',
-            name: 'type:check:mcp-ui',
-            command: 'node ./scripts/lint.js --typecheck-mcp-ui',
-            overwrite: false,
-        },
-        {
-            type: 'add-script',
-            name: 'eslint:mcp-ui',
-            command: 'node ./scripts/lint.js --eslint-mcp-ui',
-            overwrite: false,
-        },
-        {
-            type: 'patch-script',
-            name: 'type:check',
-            to: 'node ./scripts/lint.js --typecheck',
-            ifEquals: [
-                'concurrently -n "server,client" -c "blue,green" "npm run type:check:server" "npm run type:check:client"',
-                'concurrently "npm run type:check:server" "npm run type:check:client"',
-                'concurrently "npm run type:check:client" "npm run type:check:server"',
-            ],
-        },
-        {
-            type: 'patch-script',
-            name: 'eslint',
-            to: 'eslint . --quiet --ignore-pattern "server/mcp/ui/**"',
-            ifEquals: ['eslint . --quiet', 'eslint .'],
-        },
         // ===== miaoda-cli 本地开发新增规则（fullstack-cli sync 不会执行） =====
         // M1. scripts.dev:local —— 本地用户绕过沙箱判定直接跑本地链路（npm run dev:local）。
         //     dev.sh 在 MIAODA_DEP_CACHE_DIR 非空时跑 dev.js（沙箱保活）、否则 exec dev-local.js；显式 dev:local

package/dist/utils/sync-rule.js

@@ -44,7 +44,6 @@ const file_ops_1 = require("./file-ops");
 const merge_json_1 = require("./merge-json");
 const logger_1 = require("./logger");
 const typescript_exclude_1 = require("./typescript-exclude");
-const eslint_ignore_1 = require("./eslint-ignore");
 /**
  * 顺序执行 SyncRule[]，逐条 apply。一条 rule 报错不影响后续 rule（catch + 记录），最终
  * 在 handler 层决定是否整体 fail。
@@ -108,19 +107,6 @@ function applyOne(rule, opts) {
         case 'patch-script': {
             return applyPatchScript(rule, targetDir, logPrefix);
         }
-        case 'eslint-ignore': {
-            const result = (0, eslint_ignore_1.addEslintGlobalIgnore)(node_path_1.default.join(targetDir, rule.to), rule.pattern);
-            if (result.warning)
-                (0, logger_1.log)(logPrefix, `  ⚠ ${result.warning}`);
-            if (result.changed)
-                (0, logger_1.log)(logPrefix, `  ✓ ${rule.to} (global ignore ${rule.pattern})`);
-            return {
-                rule,
-                action: result.changed ? 'patched' : result.warning ? 'skipped' : 'noop',
-                path: rule.to,
-                detail: result.warning,
-            };
-        }
         case 'typescript-exclude': {
             const changed = (0, typescript_exclude_1.excludeTypeScriptPath)(node_path_1.default.join(targetDir, rule.to), rule.path);
             (0, logger_1.log)(logPrefix, `  ${changed ? '✓' : '○'} ${rule.to} (exclude ${rule.path})`);
@@ -235,10 +221,7 @@ function applyPatchScript(rule, targetDir, logPrefix) {
         (0, logger_1.log)(logPrefix, `  ○ scripts.${rule.name} (already patched)`);
         return { rule, action: 'noop', path: 'package.json' };
     }
-    const matches = rule.ifEquals
-        ? rule.ifEquals.includes(current)
-        : rule.ifStartsWith !== undefined && current.startsWith(rule.ifStartsWith);
-    if (!matches) {
+    if (!current.startsWith(rule.ifStartsWith)) {
         (0, logger_1.log)(logPrefix, `  ⚠ scripts.${rule.name} customized, skip patch`);
         return { rule, action: 'skipped', path: 'package.json' };
     }

package/dist/utils/typescript-exclude.js

@@ -5,58 +5,32 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.excludeTypeScriptPath = excludeTypeScriptPath;
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const typescript_1 = __importDefault(require("typescript"));
 const jsonc_parser_1 = require("jsonc-parser");
 const error_1 = require("./error");
-/** 追加排除项，保留 JSONC 注释和继承的排除路径；不创建缺失的配置。 */
+/** Only append to explicit template excludes; never rewrite inherited user configuration. */
 function excludeTypeScriptPath(filename, excludedPath) {
     if (!node_fs_1.default.existsSync(filename))
         return false;
     const source = node_fs_1.default.readFileSync(filename, 'utf8');
     const errors = [];
     const raw = (0, jsonc_parser_1.parse)(source, errors, { allowTrailingComma: true });
-    if (errors.length || !raw || typeof raw !== 'object' || Array.isArray(raw)) {
-        throw new error_1.AppError('INVALID_CONFIG', `Invalid TypeScript configuration: ${filename}`);
-    }
-    const parsed = typescript_1.default.getParsedCommandLineOfConfigFile(filename, {}, {
-        ...typescript_1.default.sys,
-        onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
-            throw new error_1.AppError('INVALID_CONFIG', typescript_1.default.flattenDiagnosticMessageText(diagnostic.messageText, '\n'));
-        },
-    });
-    // 初始化中的空工程允许迁移，其他错误不能被静默忽略。
-    const diagnostics = parsed?.errors.filter((d) => d.code !== 18003 && d.code !== 18002) ?? [];
-    if (!parsed || diagnostics.length) {
-        throw new error_1.AppError('INVALID_CONFIG', `Cannot migrate ${filename}: ${diagnostics.map((d) => typescript_1.default.flattenDiagnosticMessageText(d.messageText, '\n')).join('; ')}`);
-    }
-    const effective = parsed.raw;
-    const excludes = effective.exclude ?? [
-        'node_modules',
-        'bower_components',
-        'jspm_packages',
-        ...[parsed.options.outDir, parsed.options.declarationDir]
-            .filter((p) => Boolean(p))
-            .map((p) => node_path_1.default.relative(node_path_1.default.dirname(filename), p).split(node_path_1.default.sep).join('/')),
-    ];
-    if (!Array.isArray(excludes) || excludes.some((p) => typeof p !== 'string')) {
+    if (errors.length || !raw || typeof raw !== 'object')
         throw new error_1.AppError('INVALID_CONFIG', `Invalid exclude array: ${filename}`);
+    if (raw.exclude === undefined) {
+        console.warn(`Cannot safely update inherited excludes in ${filename}; add ${excludedPath} to the effective TypeScript exclude configuration.`);
+        return false;
     }
-    const paths = excludes;
-    if (paths.includes(excludedPath))
+    if (!Array.isArray(raw.exclude) || raw.exclude.some((p) => typeof p !== 'string'))
+        throw new error_1.AppError('INVALID_CONFIG', `Invalid exclude array: ${filename}`);
+    if (raw.exclude.includes(excludedPath))
         return false;
-    const ownExclude = raw.exclude;
-    const formattingOptions = {
-        insertSpaces: true,
-        tabSize: 2,
-        eol: source.includes('\r\n') ? '\r\n' : '\n',
-    };
-    const edits = Array.isArray(ownExclude)
-        ? (0, jsonc_parser_1.modify)(source, ['exclude', ownExclude.length], excludedPath, {
-            formattingOptions,
-            isArrayInsertion: true,
-        })
-        : (0, jsonc_parser_1.modify)(source, ['exclude'], [...paths, excludedPath], { formattingOptions });
-    node_fs_1.default.writeFileSync(filename, (0, jsonc_parser_1.applyEdits)(source, edits));
+    node_fs_1.default.writeFileSync(filename, (0, jsonc_parser_1.applyEdits)(source, (0, jsonc_parser_1.modify)(source, ['exclude', raw.exclude.length], excludedPath, {
+        isArrayInsertion: true,
+        formattingOptions: {
+            insertSpaces: true,
+            tabSize: 2,
+            eol: source.includes('\r\n') ? '\r\n' : '\n',
+        },
+    })));
     return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/miaoda-cli",
-  "version": "0.1.39-alpha.fc0f733",
+  "version": "0.1.39-beta.179a78f",
   "description": "Miaoda 平台命令行工具，面向 Agent 调用",
   "type": "commonjs",
   "bin": {
@@ -33,8 +33,7 @@
     "jsonc-parser": "^3.3.1",
     "ora": "^5.4.1",
     "picocolors": "^1.1.1",
-    "which": "^7.0.0",
-    "typescript": "^5.8.3"
+    "which": "^7.0.0"
   },
   "devDependencies": {
     "@types/cross-spawn": "^6.0.6",
@@ -52,6 +51,7 @@
     "prettier": "^3.8.3",
     "tsc-alias": "^1.8.11",
     "tsx": "^4.19.4",
+    "typescript": "^5.8.3",
     "vitest": "^4.1.4",
     "xml2js": "^0.6.2"
   },

package/upgrade/templates/nestjs-react-fullstack/templates/scripts/lint.js

@@ -18,31 +18,19 @@ function runCommand(command, args) {
       shell: false,
     });
 
-    child.on('close', (code) => resolve(code ?? 1));
+    child.on('close', (code) => resolve(code || 0));
     child.on('error', () => resolve(1));
   });
 }
 
-// 串行依次执行每个任务，全部跑完后再聚合退出码：
-// 降低并发资源占用、让各任务输出按顺序清晰可读，同时保留“一次暴露所有 lint 问题”的行为。
-async function runTasksSerially(taskSpecs) {
-  let exitCode = 0;
-  for (const [command, args] of taskSpecs) {
-    const code = await runCommand(command, args);
-    if (code !== 0) {
-      exitCode = 1;
-    }
-  }
-  return exitCode;
-}
-
 function normalizeProjectFile(filePath) {
   const absolutePath = path.isAbsolute(filePath)
     ? filePath
     : path.resolve(cwd, filePath);
 
   if (!fs.existsSync(absolutePath)) {
-    console.log(`[lint] Deleted file: ${filePath}; checking affected projects`);
+    console.warn(`[lint] Skip missing file: ${filePath}`);
+    return null;
   }
 
   const relativePath = path.relative(cwd, absolutePath);
@@ -106,92 +94,17 @@ function canRunStylelint() {
   return STYLELINT_CONFIG_FILES.some(file => fs.existsSync(path.join(cwd, file)));
 }
 
-const UI_DIR = 'server/mcp/ui';
-const UI_TYPECHECK = 'node ./scripts/lint.js --typecheck';
-
-function isUiFile(file) {
-  return file.startsWith(`${UI_DIR}/`);
-}
-
-function uiSourceFiles() {
-  const files = [];
-  function visit(relative) {
-    const absolute = path.join(cwd, relative);
-    if (!fs.existsSync(absolute)) return;
-    if (fs.lstatSync(absolute).isSymbolicLink()) {
-      throw new Error(`MCP UI 检查不支持符号链接: ${relative}`);
-    }
-    for (const entry of fs.readdirSync(absolute, { withFileTypes: true })) {
-      if (['node_modules', 'dist', '.git'].includes(entry.name)) continue;
-      const file = `${relative}/${entry.name}`;
-      if (entry.isSymbolicLink()) throw new Error(`MCP UI 检查不支持符号链接: ${file}`);
-      if (entry.isDirectory()) visit(file);
-      else if (isEslintTarget(file) && !/\.d\.(?:ts|mts|cts)$/.test(file)) files.push(file);
-    }
-  }
-  visit(UI_DIR);
-  return files.sort();
-}
-
-function uiTasks({ types = true, eslint = true } = {}) {
-  const sources = uiSourceFiles();
-  if (!sources.length) return [];
-  const tasks = [];
-  if (types) {
-    const config = `${UI_DIR}/tsconfig.json`;
-    if (!fs.existsSync(path.join(cwd, config))) {
-      throw new Error(`MCP UI 缺少 ${config}，请按 mcp-guide 补齐独立浏览器 TypeScript 配置。`);
-    }
-    const ts = require('typescript');
-    const parsed = ts.getParsedCommandLineOfConfigFile(path.join(cwd, config), {}, {
-      ...ts.sys,
-      onUnRecoverableConfigFileDiagnostic: d => { throw new Error(ts.flattenDiagnosticMessageText(d.messageText, '\n')); },
-    });
-    if (!parsed || parsed.errors.length) throw new Error(`MCP UI TypeScript 配置无效: ${config}`);
-    const included = new Set(parsed.fileNames.map(file => path.resolve(file)));
-    const missing = sources.filter(file => !included.has(path.resolve(cwd, file)));
-    if (missing.length) throw new Error(`MCP UI TypeScript 配置未覆盖源码: ${missing.join(', ')}；请检查 include/exclude，JS 源码需开启 allowJs。`);
-    tasks.push([getBinName('npx'), ['--no-install', 'tsc', '--noEmit', '-p', config]]);
-  }
-  if (eslint) {
-    const config = ['eslint.mcp-ui.config.js', 'eslint.mcp-ui.config.cjs', 'eslint.mcp-ui.config.mjs']
-      .find(file => fs.existsSync(path.join(cwd, file)));
-    if (!config) throw new Error('MCP UI 缺少独立 ESLint 配置，请按 mcp-guide 创建 eslint.mcp-ui.config.cjs。');
-    tasks.push([getBinName('npx'), ['--no-install', 'eslint', '--config', config, '--quiet', '--max-warnings', '0', ...sources]]);
-  }
-  return tasks;
-}
-
-function packageScripts() {
-  return JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8')).scripts || {};
-}
-
-async function runTypeCheck() {
-  const scripts = packageScripts();
-  const tasks = ['type:check:server', 'type:check:client'].map(name => {
-    if (!scripts[name]) throw new Error(`缺少 scripts.${name}，请保留应用原有类型检查命令。`);
-    return [getBinName('npm'), ['run', name]];
-  });
-  tasks.push(...uiTasks({ eslint: false }));
-  process.exit(await runTasksSerially(tasks));
-}
-
 async function runDefaultLint() {
-  const taskSpecs = [
-    [getBinName('npm'), ['run', 'eslint']],
-    [getBinName('npm'), ['run', 'type:check']],
-  ];
-
-  // Customized type:check remains untouched; ensure full lint still checks UI.
-  taskSpecs.push(...uiTasks({ types: packageScripts()['type:check'] !== UI_TYPECHECK }));
+  const commands = ['npm run eslint', 'npm run type:check'];
 
   if (canRunStylelint()) {
-    taskSpecs.push([getBinName('npm'), ['run', 'stylelint']]);
+    commands.push('npm run stylelint');
   } else {
     console.warn('[lint] Skip stylelint: missing scripts.stylelint or stylelint config');
   }
 
-  process.exit(await runTasksSerially(taskSpecs));
+  const code = await runCommand(getBinName('npx'), ['concurrently', ...commands]);
+  process.exit(code);
 }
 
 async function runSelectiveLint(inputFiles) {
@@ -204,20 +117,15 @@ async function runSelectiveLint(inputFiles) {
     process.exit(0);
   }
 
-  const eslintFiles = normalizedFiles.filter(file => fs.existsSync(path.join(cwd, file)) && isEslintTarget(file) && !isUiFile(file) && !file.startsWith('eslint.mcp-ui.config.'));
-  const stylelintFiles = normalizedFiles.filter(file => fs.existsSync(path.join(cwd, file)) && isStylelintTarget(file));
+  const eslintFiles = normalizedFiles.filter(isEslintTarget);
+  const stylelintFiles = normalizedFiles.filter(isStylelintTarget);
   const typeCheckFiles = normalizedFiles.filter(isTypeCheckTarget);
 
   const clientTypeFiles = [];
   const serverTypeFiles = [];
-  const rootConfigChanged = normalizedFiles.some(file => /^tsconfig(?:\.[^/]*)?\.json$/.test(file));
-  if (rootConfigChanged) { clientTypeFiles.push('config'); serverTypeFiles.push('config'); }
-  let checkUi = rootConfigChanged || normalizedFiles.some(file => isUiFile(file) || file.startsWith('shared/') || file.startsWith('eslint.mcp-ui.config.'));
 
   for (const filePath of typeCheckFiles) {
-    if (isUiFile(filePath)) {
-      checkUi = true;
-    } else if (filePath.startsWith('client/')) {
+    if (filePath.startsWith('client/')) {
       clientTypeFiles.push(filePath);
     } else if (filePath.startsWith('server/')) {
       serverTypeFiles.push(filePath);
@@ -227,46 +135,36 @@ async function runSelectiveLint(inputFiles) {
     }
   }
 
-  const taskSpecs = [];
+  const tasks = [];
 
   if (eslintFiles.length > 0) {
-    taskSpecs.push([getBinName('npx'), ['eslint', '--quiet', ...eslintFiles]]);
+    tasks.push(runCommand(getBinName('npx'), ['eslint', '--quiet', ...eslintFiles]));
   }
 
   if (stylelintFiles.length > 0 && !canRunStylelint()) {
     console.warn('[lint] Skip stylelint: missing scripts.stylelint or stylelint config');
   } else if (stylelintFiles.length > 0) {
-    taskSpecs.push([getBinName('npx'), ['stylelint', '--quiet', ...stylelintFiles]]);
+    tasks.push(runCommand(getBinName('npx'), ['stylelint', '--quiet', ...stylelintFiles]));
   }
 
   if (clientTypeFiles.length > 0) {
-    taskSpecs.push([getBinName('npm'), ['run', 'type:check:client']]);
+    tasks.push(runCommand(getBinName('npm'), ['run', 'type:check:client']));
   }
 
   if (serverTypeFiles.length > 0) {
-    taskSpecs.push([getBinName('npm'), ['run', 'type:check:server']]);
+    tasks.push(runCommand(getBinName('npm'), ['run', 'type:check:server']));
   }
 
-  if (checkUi) taskSpecs.push(...uiTasks());
-
-  if (taskSpecs.length === 0) {
+  if (tasks.length === 0) {
     console.log('[lint] No supported files matched for lint');
     process.exit(0);
   }
 
-  process.exit(await runTasksSerially(taskSpecs));
+  const results = await Promise.all(tasks);
+  process.exit(results.some(code => code !== 0) ? 1 : 0);
 }
 
 async function main() {
-  const args = process.argv.slice(2);
-  const modes = ['--typecheck', '--typecheck-mcp-ui', '--eslint-mcp-ui'];
-  if (args.length && !(args[0] === '--files' && args.length > 1) && !(args.length === 1 && modes.includes(args[0]))) {
-    throw new Error('用法: lint.js [--files <paths...> | --typecheck | --typecheck-mcp-ui | --eslint-mcp-ui]');
-  }
-  if (args[0] === '--files' && args.slice(1).some(arg => arg.startsWith('--'))) throw new Error('--files 不可与其他检查模式混用');
-  if (args.includes('--typecheck')) return runTypeCheck();
-  if (args.includes('--typecheck-mcp-ui')) return process.exit(await runTasksSerially(uiTasks({ eslint: false })));
-  if (args.includes('--eslint-mcp-ui')) return process.exit(await runTasksSerially(uiTasks({ types: false })));
   const files = parseFilesArg(process.argv.slice(2));
   if (files === null) {
     await runDefaultLint();

package/upgrade/templates/nestjs-react-fullstack/templates/scripts/prune-smart.js

@@ -6,6 +6,13 @@ const fs = require('fs');
 const path = require('path');
 
 const ROOT_DIR = path.resolve(__dirname, '..');
+
+// 加载提交的 .env，供读取构建期配置（如 MIAODA_RUNTIME_ENTRIES）。dotenv 不一定安装 → 静默降级。
+try {
+  require('dotenv').config({ path: path.join(ROOT_DIR, '.env') });
+} catch {
+  // dotenv 未安装：跳过；MIAODA_RUNTIME_ENTRIES 仍可来自真实环境变量
+}
 const DIST_DIR = path.join(ROOT_DIR, 'dist');
 const DIST_SERVER_DIR = path.join(DIST_DIR, 'server');
 const ROOT_PACKAGE_JSON = path.join(ROOT_DIR, 'package.json');
@@ -16,6 +23,36 @@ const OUT_PACKAGE_JSON = path.join(DIST_DIR, 'package.json');
 // Server 入口文件
 const SERVER_ENTRY = path.join(DIST_SERVER_DIR, 'main.js');
 
+// nest sourceRoot（源码根，默认 server）：把 .env 里声明的源码路径映射到构建产物位置
+let SOURCE_ROOT = 'server';
+try {
+  const nestCli = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, 'nest-cli.json'), 'utf8'));
+  if (nestCli.sourceRoot) SOURCE_ROOT = nestCli.sourceRoot;
+} catch {
+  // 读不到 nest-cli.json 则用默认 server
+}
+const SRC_TO_OUT_EXT = { '.mts': '.mjs', '.cts': '.cjs', '.ts': '.js' };
+
+// 额外 trace 入口：经 new Function/动态 import 加载、nft 无法从 main.js 静态发现的 ESM runtime。
+// 应用在提交的 .env 里用 MIAODA_RUNTIME_ENTRIES 声明【源码路径】（相对项目根，逗号分隔），例如：
+//   MIAODA_RUNTIME_ENTRIES=server/modules/ethics/runtime/review-run.mjs,server/modules/ethics/runtime/parse-core.mjs
+// 脚本按 nest sourceRoot 自动映射到 dist/server 下的构建产物（并重写 .mts→.mjs / .ts→.js）。
+const RUNTIME_ENTRIES = (process.env.MIAODA_RUNTIME_ENTRIES || '')
+  .split(',')
+  .map((s) => s.trim())
+  .filter(Boolean)
+  .map((srcRel) => {
+    const fromSrc = path.relative(SOURCE_ROOT, srcRel); // 去掉 sourceRoot 前缀
+    const ext = path.extname(fromSrc);
+    const outRel = SRC_TO_OUT_EXT[ext] ? fromSrc.slice(0, -ext.length) + SRC_TO_OUT_EXT[ext] : fromSrc;
+    return path.join(DIST_SERVER_DIR, outRel);
+  })
+  .filter((p) => {
+    if (fs.existsSync(p)) return true;
+    console.warn(`⚠️  MIAODA_RUNTIME_ENTRIES 入口在构建产物中不存在，已忽略: ${path.relative(ROOT_DIR, p)}`);
+    return false;
+  });
+
 // Node.js 内置模块列表
 const BUILTIN_MODULES = new Set([
   'assert', 'buffer', 'child_process', 'cluster', 'crypto', 'dgram', 'dns',
@@ -145,12 +182,15 @@ async function smartPrune() {
   }
 
   console.log(`📂 分析入口文件: ${path.relative(ROOT_DIR, SERVER_ENTRY)}`);
+  if (RUNTIME_ENTRIES.length) {
+    console.log(`📎 额外 trace 入口 (${RUNTIME_ENTRIES.length}): ${RUNTIME_ENTRIES.map((p) => path.relative(DIST_SERVER_DIR, p)).join(', ')}`);
+  }
 
   // 2. 使用 @vercel/nft 追踪依赖
   console.log('🔎 追踪实际依赖...');
   const analyzeStart = Date.now();
 
-  const { fileList } = await nodeFileTrace([SERVER_ENTRY], {
+  const { fileList } = await nodeFileTrace([SERVER_ENTRY, ...RUNTIME_ENTRIES], {
     base: ROOT_DIR,
     processCwd: ROOT_DIR,
     ts: false, // 禁用 TS 解析

package/dist/utils/eslint-ignore.js

@@ -1,169 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addEslintGlobalIgnore = addEslintGlobalIgnore;
-const node_fs_1 = __importDefault(require("node:fs"));
-const typescript_1 = __importDefault(require("typescript"));
-const error_1 = require("./error");
-/** 只解析源码，不加载用户配置；用局部插入保留自定义规则和注释。 */
-function addEslintGlobalIgnore(filename, pattern) {
-    if (!node_fs_1.default.existsSync(filename))
-        return { changed: false };
-    const source = node_fs_1.default.readFileSync(filename, 'utf8');
-    const file = typescript_1.default.createSourceFile(filename, source, typescript_1.default.ScriptTarget.Latest, true, typescript_1.default.ScriptKind.JS);
-    const diagnostics = file
-        .parseDiagnostics;
-    if (diagnostics.length)
-        throw new error_1.AppError('INVALID_CONFIG', `Invalid ESLint configuration: ${filename}`);
-    const variables = new Map();
-    const declarations = new Map();
-    const aliasReferences = new Set();
-    const resolvedAliases = new Set();
-    const exportTargets = new Set();
-    const helpers = new Set();
-    const namespaces = new Set();
-    const exports = [];
-    const moduleName = (node) => {
-        if (!typescript_1.default.isCallExpression(node) ||
-            !typescript_1.default.isIdentifier(node.expression) ||
-            node.expression.text !== 'require')
-            return;
-        const arg = node.arguments.at(0);
-        return arg && typescript_1.default.isStringLiteral(arg) ? arg.text : undefined;
-    };
-    for (const statement of file.statements) {
-        if (typescript_1.default.isImportDeclaration(statement) && typescript_1.default.isStringLiteral(statement.moduleSpecifier)) {
-            const module = statement.moduleSpecifier.text;
-            const clause = statement.importClause;
-            if (module === 'typescript-eslint' && clause?.name)
-                namespaces.add(clause.name.text);
-            const bindings = clause?.namedBindings;
-            if (bindings && typescript_1.default.isNamespaceImport(bindings) && module === 'typescript-eslint')
-                namespaces.add(bindings.name.text);
-            if (bindings && typescript_1.default.isNamedImports(bindings)) {
-                for (const element of bindings.elements) {
-                    const name = element.propertyName?.text ?? element.name.text;
-                    if ((module === 'eslint/config' && name === 'defineConfig') ||
-                        (module === 'typescript-eslint' && name === 'config'))
-                        helpers.add(element.name.text);
-                }
-            }
-        }
-        if (typescript_1.default.isVariableStatement(statement) && statement.declarationList.flags & typescript_1.default.NodeFlags.Const) {
-            for (const declaration of statement.declarationList.declarations) {
-                if (!declaration.initializer)
-                    continue;
-                const module = moduleName(declaration.initializer);
-                if (typescript_1.default.isIdentifier(declaration.name)) {
-                    variables.set(declaration.name.text, declaration.initializer);
-                    declarations.set(declaration.name.text, declaration.name);
-                    if (module === 'typescript-eslint')
-                        namespaces.add(declaration.name.text);
-                }
-                else if (typescript_1.default.isObjectBindingPattern(declaration.name)) {
-                    for (const element of declaration.name.elements) {
-                        const name = element.propertyName ?? element.name;
-                        if (!typescript_1.default.isIdentifier(name) || !typescript_1.default.isIdentifier(element.name))
-                            continue;
-                        if ((module === 'eslint/config' && name.text === 'defineConfig') ||
-                            (module === 'typescript-eslint' && name.text === 'config'))
-                            helpers.add(element.name.text);
-                    }
-                }
-            }
-        }
-        if (typescript_1.default.isExportAssignment(statement) && !statement.isExportEquals)
-            exports.push(statement.expression);
-        if (typescript_1.default.isExpressionStatement(statement) && typescript_1.default.isBinaryExpression(statement.expression)) {
-            const { left, right, operatorToken } = statement.expression;
-            if (operatorToken.kind === typescript_1.default.SyntaxKind.EqualsToken &&
-                typescript_1.default.isPropertyAccessExpression(left) &&
-                typescript_1.default.isIdentifier(left.expression) &&
-                left.expression.text === 'module' &&
-                left.name.text === 'exports') {
-                exports.push(right);
-                exportTargets.add(left);
-            }
-        }
-    }
-    function unwrap(node, seen = new Set()) {
-        if (typescript_1.default.isParenthesizedExpression(node))
-            return unwrap(node.expression, seen);
-        if (typescript_1.default.isIdentifier(node) && !seen.has(node.text)) {
-            const value = variables.get(node.text);
-            if (value) {
-                resolvedAliases.add(node.text);
-                aliasReferences.add(node);
-                seen.add(node.text);
-                return unwrap(value, seen);
-            }
-        }
-        return node;
-    }
-    const root = exports.length === 1 ? unwrap(exports[0]) : undefined;
-    // const 只固定变量绑定，不能保证数组不被 pop/push 或传给其他函数修改。
-    // 有额外引用时保留原配置，避免改变初始化数组影响用户后续操作。
-    function checkReferences(node) {
-        if (typescript_1.default.isIdentifier(node) &&
-            resolvedAliases.has(node.text) &&
-            declarations.get(node.text) !== node &&
-            !aliasReferences.has(node))
-            return true;
-        // module["exports"]、(module).exports、module 别名也可能修改导出数组。
-        if (typescript_1.default.isIdentifier(node) &&
-            node.text === 'module' &&
-            !(typescript_1.default.isPropertyAccessExpression(node.parent) &&
-                node.parent.expression === node &&
-                exportTargets.has(node.parent)))
-            return true;
-        return typescript_1.default.forEachChild(node, (child) => checkReferences(child) || undefined) ?? false;
-    }
-    const unsafeReference = checkReferences(file);
-    const isHelper = (node) => {
-        const callee = node.expression;
-        return typescript_1.default.isIdentifier(callee)
-            ? helpers.has(callee.text)
-            : typescript_1.default.isPropertyAccessExpression(callee) &&
-                typescript_1.default.isIdentifier(callee.expression) &&
-                namespaces.has(callee.expression.text) &&
-                callee.name.text === 'config';
-    };
-    const entries = root && typescript_1.default.isArrayLiteralExpression(root)
-        ? root.elements
-        : root && typescript_1.default.isCallExpression(root) && isHelper(root)
-            ? root.arguments
-            : undefined;
-    if (!entries || unsafeReference) {
-        return {
-            changed: false,
-            warning: `Cannot safely migrate ${filename}; add ${JSON.stringify(pattern)} to its global ignores manually.`,
-        };
-    }
-    // 只认真正的全局 ignores；带 files/rules 的局部忽略不能阻止服务端配置匹配 UI。
-    // 仅检查最后一个配置，确保此前的否定规则或动态配置无法撤销新增忽略。
-    const last = entries.at(-1);
-    if (last && typescript_1.default.isObjectLiteralExpression(last)) {
-        const props = last.properties;
-        const nameOf = (p) => p.name && (typescript_1.default.isIdentifier(p.name) || typescript_1.default.isStringLiteral(p.name)) ? p.name.text : undefined;
-        if (new Set(props.map(nameOf)).size === props.length &&
-            props.every((p) => typescript_1.default.isPropertyAssignment(p) && ['ignores', 'name'].includes(nameOf(p) ?? ''))) {
-            const ignores = props.find((p) => nameOf(p) === 'ignores');
-            if (ignores &&
-                typescript_1.default.isPropertyAssignment(ignores) &&
-                typescript_1.default.isArrayLiteralExpression(ignores.initializer)) {
-                const patterns = ignores.initializer.elements;
-                if (patterns.length &&
-                    patterns.every(typescript_1.default.isStringLiteral) &&
-                    patterns[patterns.length - 1].text === pattern)
-                    return { changed: false };
-            }
-        }
-    }
-    const eol = source.includes('\r\n') ? '\r\n' : '\n';
-    const position = last ? last.end : entries.pos;
-    const addition = `${last ? ',' : ''}${eol}  { ignores: [${JSON.stringify(pattern)}] }`;
-    node_fs_1.default.writeFileSync(filename, source.slice(0, position) + addition + source.slice(position));
-    return { changed: true };
-}