@lark-apaas/miaoda-cli 0.1.7-alpha.eb0aa5c → 0.1.7-beta.8880029

package/dist/api/deploy/schemas.js

@@ -19,6 +19,9 @@ function nodeStatusText(v) {
         return v;
     if (typeof v !== 'number')
         return undefined;
+    // `number` 不在 `NodeStatus` 枚举键集时,TS Partial<Record<NodeStatus,_>> 推断
+    // 出来类型不友好(eslint 报 unsafe-return);cast 到 Record<number,string|undefined>
+    // 等价安全访问。
     return NODE_STATUS_TEXT[v];
 }
 /** NodeStatus 文本（CLI flag 字符串）→ 枚举数值 */

package/dist/cli/commands/app/index.js

@@ -121,7 +121,7 @@ function registerAppInit(parent) {
         .command('init')
         .description('初始化应用代码：抓 template 渲染、同步 upgrade/templates、装 .agent/steering/ skills、写 .spark/meta.json。.spark/meta.json 已存在则直接退出')
         .option('--template <stack>', `技术栈短名（${index_1.SUPPORTED_STACKS.join(' / ')}）`)
-        .option('--conf <json>', 'init 配置 JSON。支持 {"version": "<template 版本>"} / {"steeringVersion": "<steering 版本>"}，均默认 latest')
+        .option('--conf <json>', 'init 配置 JSON。支持 {"version": "<template 版本>"}，默认 latest')
         .option('--skip-install', '跳过依赖安装', false)
         .addOption((0, shared_1.appIdOption)())
         .addHelpText('after', `
@@ -161,7 +161,6 @@ JSON 输出
   $ miaoda app init --template vite-react
   $ miaoda app init --template nestjs-react-fullstack --app-id app_xxx
   $ miaoda app init --template vite-react --conf '{"version": "0.1.0"}'
-  $ miaoda app init --template vite-react --conf '{"steeringVersion": "0.1.0"}'
   $ miaoda app init --template vite-react --skip-install
   $ MIAODA_DEP_CACHE_DIR=/tmp/dep-cache miaoda app init --template vite-react
 `);
@@ -193,11 +192,7 @@ function parseInitConf(raw) {
     if (version !== undefined && typeof version !== 'string') {
         throw new error_1.AppError('ARGS_INVALID', '--conf.version 必须是字符串');
     }
-    const steeringVersion = parsed.steeringVersion;
-    if (steeringVersion !== undefined && typeof steeringVersion !== 'string') {
-        throw new error_1.AppError('ARGS_INVALID', '--conf.steeringVersion 必须是字符串');
-    }
-    return { version, steeringVersion };
+    return { version };
 }
 function isPlainObject(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);

package/dist/cli/commands/skills/index.js

@@ -22,8 +22,8 @@ function registerSkillsSync(parent) {
     const cmd = parent
         .command('sync')
         .description('同步 coding-steering（latest 或指定版本）到 user app')
-        .argument('[version]', 'coding-steering 包版本或 dist-tag，缺省 latest')
         .option('--dir <path>', '项目目录，默认当前目录', '.')
+        .option('--version <ver>', 'coding-steering 包版本或 dist-tag，缺省 latest')
         .option('--local', '走本地 dev / agent 输出形态：拷到 .agents/skills 平铺 + 创建 .claude/skills 软链。' +
         '不传时退回老形态：拷到 .agent/skills/steering/<stack>/skills/（跟沙箱端 update-skills.sh 对齐）', false)
         .addHelpText('after', `
@@ -46,15 +46,15 @@ JSON 输出
             "claudeSkillsLink": "created|updated|noop|conflict"  // 仅 --local 时}}
 
 示例
-  $ miaoda skills sync
-  $ miaoda skills sync --local           # 本地 dev / agent 用
-  $ miaoda skills sync 0.2.0
+  $ miaoda skills sync                              # 拉 @latest
+  $ miaoda skills sync --local                      # 本地 dev / agent 用
+  $ miaoda skills sync --version 0.2.0              # 显式指定版本
   $ miaoda skills sync --dir ./my-app
 `);
-    cmd.action((0, shared_1.withHelp)(cmd, async (version, rawOpts) => {
+    cmd.action((0, shared_1.withHelp)(cmd, async (rawOpts) => {
         await (0, index_1.handleSkillsSync)({
             dir: rawOpts.dir,
-            version,
+            version: rawOpts.version,
             local: rawOpts.local,
         });
     }));

package/dist/cli/handlers/app/init.js

@@ -64,14 +64,20 @@ async function handleAppInit(opts) {
     const upgradedPackages = (0, sync_1.upgradePlatformDeps)(targetDir, 'init');
     // skills 同步软失败：拉不到 coding-steering 包不该阻断 writeSparkMeta /
     // activateGitHooks（之前会让 .spark/meta.json 没写，下次 init 半渲染状态又得重跑全套）。
+    // 按 stack 分流 outputLayout:
+    //   - nestjs-react-fullstack:本地主战场,用 flat 布局
+    //     (.agents/skills + .claude/skills 软链),不再创建 .agent/ 老目录
+    //   - 其他 stack:仍走默认 nested (.agent/skills/steering/<stack>/skills/),
+    //     跟沙箱端 update-skills.sh 老链路对齐,避免破坏
+    const outputLayout = stack === 'nestjs-react-fullstack' ? 'flat' : 'nested';
     let steeringResult;
     let steeringError;
     try {
         steeringResult = (0, coding_steering_1.syncCodingSteering)({
             stack,
             targetDir,
-            version: opts.conf?.steeringVersion,
             logPrefix: 'init',
+            outputLayout,
         });
     }
     catch (err) {
@@ -91,7 +97,6 @@ async function handleAppInit(opts) {
         version: tplResult.version,
         archType: tplResult.archType,
         app_id: opts.appId,
-        steeringVersion: steeringResult.version,
     });
     const syncedSummary = syncRunResult.stackFound
         ? syncRunResult.rulesApplied.length > 0

package/dist/cli/handlers/app/sync.js

@@ -7,6 +7,7 @@ exports.handleAppUpgrade = void 0;
 exports.handleAppSync = handleAppSync;
 exports.runStackSync = runStackSync;
 exports.summarizeSyncResults = summarizeSyncResults;
+exports.listManagedDeps = listManagedDeps;
 exports.upgradePlatformDeps = upgradePlatformDeps;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -15,6 +16,7 @@ const sync_configs_1 = require("../../../config/sync-configs");
 const sync_rule_1 = require("../../../utils/sync-rule");
 const platform_sync_1 = require("../../../utils/platform-sync");
 const githooks_1 = require("../../../utils/githooks");
+const install_1 = require("../../../services/app/init/install");
 const spark_meta_1 = require("../../../utils/spark-meta");
 const error_1 = require("../../../utils/error");
 const output_1 = require("../../../utils/output");
@@ -81,11 +83,32 @@ async function handleAppSync(opts) {
     const upgradedPackages = upgradePlatformDeps(targetDir, 'sync');
     // 3. activate git hooks（template 自带 .githooks/pre-commit，core.hooksPath 一次性设置）
     const hookActivation = (0, githooks_1.activateGitHooks)(targetDir);
-    // 4. npm install —— 跟 init 一样软失败，install 挂了不该阻断 emit / sync 总结输出
-    (0, logger_1.log)('sync', 'Running npm install --ignore-scripts...');
+    // 4. npm install —— 跟 init 一样软失败,install 挂了不该阻断 emit / sync 总结输出。
+    // 把 user app 装着的**所有**管控包显式作为位置参数传给 npm install,强制 npm 重新
+    // resolve lockfile entry。原因:
+    //   - 即便 package.json spec 已经是 "latest"(没有 from→to 变化),user app 老 lockfile
+    //     可能锁着具体老版本 (如 fullstack-vite-preset@1.0.9),纯 `npm install` 会按 lockfile
+    //     拉老版,绕过 spec "latest" 的解析意图
+    //   - 显式 `npm install foo@latest bar@latest` 让 npm 重新解析,lockfile 跟着更新到当前 latest
+    //   - 没装的管控包不动 (sync 的职责是对齐,不是塞依赖)
+    // --ignore-scripts 绕开 action-plugin postinstall 在缺平台 env 时的 ENOENT。
+    // --registry 跟 init 钉同一份 npmmirror,避免 user 全局 ~/.npmrc 把 sync 拉到另一个源
+    // (详见 services/app/init/install.ts 上的注释)。MIAODA_NPM_REGISTRY env 兜底。
+    const installArgs = [
+        'install',
+        '--no-audit',
+        '--no-fund',
+        '--ignore-scripts',
+        '--registry',
+        (0, install_1.resolveNpmInstallRegistry)(),
+    ];
+    for (const name of listManagedDeps(targetDir)) {
+        installArgs.push(`${name}@${MANAGED_PLATFORM_PACKAGES[name]}`);
+    }
+    (0, logger_1.log)('sync', `Running npm ${installArgs.join(' ')}...`);
     let installError;
     try {
-        (0, node_child_process_1.execFileSync)('npm', ['install', '--no-audit', '--no-fund', '--ignore-scripts'], {
+        (0, node_child_process_1.execFileSync)('npm', installArgs, {
             cwd: targetDir,
             stdio: (0, output_1.isJsonMode)() ? ['ignore', 'ignore', 'inherit'] : 'inherit',
         });
@@ -180,6 +203,29 @@ function readPackageJson(pkgJsonPath) {
         return null;
     return JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
 }
+/**
+ * 列出 user app 装着的 @lark-apaas/* 管控包 (在 MANAGED_PLATFORM_PACKAGES 白名单内的)。
+ * sync handler 用来给 `npm install` 显式列管控包名 + @latest,强制 npm 重新 resolve
+ * lockfile entry —— 即便 package.json spec 已经是 "latest" 没 from→to 变化,
+ * 老 lockfile 锁的具体老版本(如 fullstack-vite-preset@1.0.9)也会被刷掉。
+ */
+function listManagedDeps(targetDir) {
+    const pkg = readPackageJson(node_path_1.default.join(targetDir, 'package.json'));
+    if (!pkg)
+        return [];
+    const names = new Set();
+    for (const section of ['dependencies', 'devDependencies']) {
+        const deps = pkg[section];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const name of Object.keys(deps)) {
+            if (Object.prototype.hasOwnProperty.call(MANAGED_PLATFORM_PACKAGES, name)) {
+                names.add(name);
+            }
+        }
+    }
+    return [...names];
+}
 /**
  * 把 user app package.json 里已装的 @lark-apaas/* 平台包改写成 MANAGED_PLATFORM_PACKAGES
  * 表里的目标 spec（缺省 `"latest"`）。由 `miaoda app sync` 和 `miaoda app init`（template

package/dist/cli/handlers/plugin/plugin-local.js

@@ -76,7 +76,7 @@ function parsePluginName(input) {
     if (!match) {
         throw new error_1.AppError('INVALID_PLUGIN_NAME', `Invalid plugin name format: ${input}. Expected: @scope/name or @scope/name@version`, { next_actions: ['示例：@demo/example-plugin 或 @demo/example-plugin@1.2.3'] });
     }
-    return { name: match[1], version: match[2] ?? 'latest' };
+    return { name: match[1], version: match[2] || 'latest' };
 }
 // ── package.json actionPlugins CRUD ──
 function readPackageJson() {

package/dist/cli/handlers/skills/sync.js

@@ -10,10 +10,13 @@ const spark_meta_1 = require("../../../utils/spark-meta");
 const error_1 = require("../../../utils/error");
 const output_1 = require("../../../utils/output");
 /**
- * miaoda skills sync [version] [--dir <path>]
+ * miaoda skills sync [--dir <path>] [--version <ver>]
  *
- * 从 .spark/meta.json 读 stack（+ 默认 steeringVersion），把 coding-steering 包内对应 stack
- * 的 skills + tech.md 同步到 <dir>/.agent/steering/。需要先跑过 `miaoda app init`。
+ * 从 .spark/meta.json 读 stack，把 coding-steering 包内对应 stack 的 skills + tech.md
+ * 同步到 <dir>/.agent/steering/。需要先跑过 `miaoda app init`。
+ *
+ * 版本来源：CLI `--version` flag 或默认 `latest`。**不读 meta.json**——steering 版本
+ * 不在 meta 里钉，每次 sync 都跟随 `--version` 显式传或退回 @latest。
  */
 async function handleSkillsSync(opts) {
     await Promise.resolve();
@@ -22,23 +25,17 @@ async function handleSkillsSync(opts) {
     if (meta.stack === undefined || meta.stack === '') {
         throw new error_1.AppError('SKILLS_META_INCOMPLETE', '.spark/meta.json missing stack — run `miaoda app init` first');
     }
-    const version = opts.version ?? meta.steeringVersion;
-    const versionSource = opts.version
-        ? 'cli-arg'
-        : meta.steeringVersion
-            ? 'meta.json'
-            : 'default-latest';
     const result = (0, coding_steering_1.syncCodingSteering)({
         stack: meta.stack,
         targetDir,
-        version,
+        version: opts.version,
         outputLayout: opts.local === true ? 'flat' : 'nested',
     });
     (0, output_1.emit)({
         data: {
             stack: meta.stack,
             version: result.version,
-            versionSource,
+            versionSource: opts.version !== undefined ? 'cli-arg' : 'default-latest',
             syncedSkills: result.syncedSkills,
             techSynced: result.techSynced,
             ...(result.claudeSkillsLink !== undefined

package/dist/services/app/init/install.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.installDependencies = installDependencies;
+exports.resolveNpmInstallRegistry = resolveNpmInstallRegistry;
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -111,12 +112,20 @@ function extractZip(zipPath, targetDir, stdio) {
  *   - 字节内网 DNS 会把 npmmirror 域名透明指向公司镜像，外网就是公网阿里源；同一行配置
  *     在两套环境都拉得到 @lark-apaas/* 私包（内网经公司镜像，外网经阿里同步过去的副本）。
  *   - 留 `MIAODA_NPM_REGISTRY` env 应急覆盖。
+ *
+ * `miaoda app sync` 也用同款规则,通过 resolveNpmInstallRegistry() 共享。
  */
 const NPM_INSTALL_REGISTRY_DEFAULT = 'https://registry.npmmirror.com/';
+/**
+ * 解析 miaoda 内部 npm install 命令使用的 registry。init / sync 共用。
+ * 优先级:`MIAODA_NPM_REGISTRY` env > `NPM_INSTALL_REGISTRY_DEFAULT`。
+ */
+function resolveNpmInstallRegistry() {
+    return process.env.MIAODA_NPM_REGISTRY ?? NPM_INSTALL_REGISTRY_DEFAULT;
+}
 function runNpmInstall(targetDir, stdio) {
     (0, logger_1.log)('init', `npm install in ${targetDir}...`);
-    const registry = process.env.MIAODA_NPM_REGISTRY ?? NPM_INSTALL_REGISTRY_DEFAULT;
-    (0, node_child_process_1.execFileSync)('npm', ['install', '--no-audit', '--no-fund', '--registry', registry], {
+    (0, node_child_process_1.execFileSync)('npm', ['install', '--no-audit', '--no-fund', '--registry', resolveNpmInstallRegistry()], {
         cwd: targetDir,
         stdio,
     });

package/dist/utils/githooks.js

@@ -8,6 +8,21 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 const logger_1 = require("../utils/logger");
+const GIT_LEAKED_ENV_KEYS = new Set([
+    'GIT_DIR',
+    'GIT_WORK_TREE',
+    'GIT_INDEX_FILE',
+    'GIT_COMMON_DIR',
+    'GIT_PREFIX',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_CONFIG',
+    'GIT_CONFIG_PARAMETERS',
+    'GIT_CONFIG_COUNT',
+]);
+function envWithoutGitLeaks() {
+    return Object.fromEntries(Object.entries(process.env).filter(([key]) => !GIT_LEAKED_ENV_KEYS.has(key)));
+}
 /**
  * 把 `.githooks/` 注册为本仓库的 git hooks 目录，让 pre-commit 等 hook 立即生效。
  *
@@ -33,8 +48,10 @@ function activateGitHooks(targetDir) {
     if ((currentMode & 0o111) !== 0o111) {
         node_fs_1.default.chmodSync(hookFile, 0o755);
     }
+    const env = envWithoutGitLeaks();
     const probe = (0, node_child_process_1.spawnSync)('git', ['config', '--get', 'core.hooksPath'], {
         cwd: targetDir,
+        env,
         stdio: ['ignore', 'pipe', 'ignore'],
     });
     const currentHooksPath = probe.stdout.toString().trim();
@@ -43,6 +60,7 @@ function activateGitHooks(targetDir) {
     }
     const res = (0, node_child_process_1.spawnSync)('git', ['config', 'core.hooksPath', '.githooks'], {
         cwd: targetDir,
+        env,
         stdio: ['ignore', 'ignore', 'pipe'],
     });
     if (res.status !== 0) {

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@lark-apaas/miaoda-cli",
-  "version": "0.1.7-alpha.eb0aa5c",
+  "version": "0.1.7-beta.8880029",
   "description": "Miaoda 平台命令行工具，面向 Agent 调用",
   "type": "commonjs",
   "bin": {
     "miaoda": "bin/miaoda.js"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
   },
   "files": [
     "LICENSE",

package/upgrade/templates/design-stack/templates/scripts/dev-local.js

@@ -47,9 +47,10 @@ if (hasLarkCli) {
   warn('lark-cli 未安装，跳过 env pull；请确保 .env.local 已就绪');
 }
 
+// skills sync —— --local 切 flat layout;不传 --version,handler 默认 coding-steering@latest。
 console.log('[dev-local] (2/4) miaoda skills sync...');
 try {
-  execSync('npx -y @lark-apaas/miaoda-cli@latest skills sync', { stdio: 'inherit' });
+  execSync('npx -y @lark-apaas/miaoda-cli@latest skills sync --local', { stdio: 'inherit' });
 } catch {
   console.log('  (skills sync 失败，继续启动)');
 }

package/upgrade/templates/design-stack/templates/scripts/dev.sh

@@ -19,7 +19,6 @@ fi
 
 # 本地启动前先跑一次 miaoda app sync：同步 platform-controlled 内容 + 升 @lark-apaas/* 到
 # latest + 迁移老 npm scripts。沙箱不走这里（SANDBOX_ID 分支已经 exec return）。
-# 走 npx 不依赖用户全局装 miaoda；跟 latest dist-tag。
 npx -y @lark-apaas/miaoda-cli@latest app sync || echo "[dev] miaoda app sync 失败，按现状继续" >&2
 
 exec node "$SCRIPT_DIR/dev-local.js" "$@"

package/upgrade/templates/nestjs-react-fullstack/templates/scripts/dev-local.js

@@ -55,10 +55,12 @@ if (hasLarkCli) {
   warn('lark-cli 未安装，跳过 env pull；请确保 .env.local 已就绪');
 }
 
-// 2. skills sync
+// 2. skills sync —— --local 切到 flat layout (.agents/skills + .claude/skills 软链),
+// 跟沙箱 nested layout 区分。不传 --version,handler 默认拉 coding-steering@latest,
+// 保证每次本地 npm run dev 都把 skills 升到最新。
 console.log('[dev-local] (2/4) miaoda skills sync...');
 try {
-  execSync('npx -y @lark-apaas/miaoda-cli@latest skills sync', { stdio: 'inherit' });
+  execSync('npx -y @lark-apaas/miaoda-cli@latest skills sync --local', { stdio: 'inherit' });
 } catch {
   console.log('  (skills sync 失败，继续启动)');
 }

package/upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.sh

@@ -19,7 +19,6 @@ fi
 
 # 本地启动前先跑一次 miaoda app sync：同步 platform-controlled 内容 + 升 @lark-apaas/* 到
 # latest + 迁移老 npm scripts。沙箱不走这里（SANDBOX_ID 分支已经 exec return）。
-# 走 npx 不依赖用户全局装 miaoda；跟 latest dist-tag。
 npx -y @lark-apaas/miaoda-cli@latest app sync || echo "[dev] miaoda app sync 失败，按现状继续" >&2
 
 exec node "$SCRIPT_DIR/dev-local.js" "$@"