@oj-module/cli 0.2.67 → 0.2.68

package/shell-dist/index.html

@@ -5,8 +5,8 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<link rel="icon" href="/favicon.ico" />
 		<title>React Antd Admin · Shell</title>
-		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-amDdx1bR3PQtIt4AbHBZJg=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
-		<script type="importmap" nonce="amDdx1bR3PQtIt4AbHBZJg==">{
+		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-36CAd5UpXCtQqxASbhUFfw=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
+		<script type="importmap" nonce="36CAd5UpXCtQqxASbhUFfw==">{
   "imports": {
     "react": "/assets/react.1ew63mwts0.js",
     "react/jsx-runtime": "/assets/jsx-runtime.h40xu4o5b0.js",
@@ -16,7 +16,7 @@
     "react-router": "/assets/react-router.2h9rebcv50.js",
     "react-router/dom": "/assets/react-router-dom.3c6zld8h40.js",
     "@tanstack/react-query": "/assets/react-query.3rln45ow00.js",
-    "@oj-module/runtime": "/assets/runtime.2dgstpjsu0.js",
+    "@oj-module/runtime": "/assets/runtime.1xzahckt10.js",
     "@oj-module/runtime/contract": "/assets/contract.3h327o3mj0.js",
     "@oj-module/runtime/contract/errors": "/assets/contract-errors.2o17vz9u50.js",
     "@plane/kit": "/assets/kit.37kr8ui390.js",
@@ -79,7 +79,7 @@
 			.boot-skeleton:after{content:"";width:18px;height:18px;margin-left:8px;border:2px solid #d9d9d9;border-top-color:#1677ff;border-radius:50%;animation:bs-spin .8s linear infinite}
 			@keyframes bs-spin{to{transform:rotate(360deg)}}
 		</style>
-		<script nonce="amDdx1bR3PQtIt4AbHBZJg==" data-ojm-preload="/assets/cssinjs.atgmhan7m0.js,/assets/pro-components.2kyot1vcl0.js,/assets/runtime.2dgstpjsu0.js,/assets/react-query.3rln45ow00.js,/assets/antd.uw1coq15l0.js,/assets/react.1ew63mwts0.js,/assets/react-dom-client.ick0v05ob0.js,/assets/react-i18next.auhvjhqv00.js,/assets/react-router.2h9rebcv50.js,/assets/jsx-runtime.h40xu4o5b0.js,/assets/react-dom.2so9uxg3f0.js,/assets/clsx.jotilrt2e0.js,/assets/antd-es-locale-zh_CN.1gjjsvxbf0.js,/assets/dayjs.pa60l6wjo0.js,/assets/ojm-dayjs-locale-zh-cn.3vr3beiyp0.js,/assets/use-sync-external-store-shim.1nz1pi9bb0.js,/assets/icons.159wjwals0.js,/assets/dayjs-plugin-quarterOfYear.2oqo1lcx80.js,/assets/dayjs-plugin-customParseFormat.13xhghv1d0.js,/assets/dayjs-plugin-advancedFormat.3vsyd2eis0.js,/assets/dayjs-plugin-isoWeek.1fn1tw82p0.js,/assets/dayjs-plugin-localeData.2rwbjp9nk0.js,/assets/dayjs-plugin-weekday.2d56a4tml0.js,/assets/dayjs-plugin-weekOfYear.gvn9iph080.js,/assets/dayjs-plugin-relativeTime.2pqs3et4y0.js,/assets/dnd-kit-core.1xyreig6r0.js,/assets/dnd-kit-utilities.1umw4xphb0.js,/assets/dnd-kit-sortable.s94qciuft0.js,/assets/ky.1cgch7gu60.js,/assets/zustand.3gjgzlnqo0.js,/assets/zustand-middleware.1xaxjueme0.js,/assets/react-error-boundary.2dncdfj3b0.js,/assets/antd-locale-en_US.561tozx860.js,/assets/antd-locale-zh_CN.1cmpmgzh70.js,/assets/i18next.33zqofapj0.js,/assets/tailwind-merge.125ehiqjw0.js,/assets/nprogress.2nz76n9ny0.js,/assets/nprogress-css.1cq2pzkre0.js,/assets/react-jss.1ei6dr9e00.js,/assets/ahooks.2l850ymmh0.js,/assets/spin-delay.yjeyj6iwp0.js,/assets/simplebar-react.2g739uvai0.js,/assets/keepalive-for-react.xenu5vam70.js,/assets/zustand-shallow.6cz0yyv9x0.js,/assets/contract-errors.2o17vz9u50.js,/assets/antd-img-crop.196rkty480.js,/assets/icons-es-components-Context.365qmflwg0.js,/assets/dayjs-plugin-weekYear.2u78l3ex10.js,/assets/zustand-vanilla.1mo3ka3g30.js,/assets/zustand-react.9fsl9brxy0.js,/assets/zustand-vanilla-shallow.3424monv50.js,/assets/zustand-react-shallow.pybayv1hx0.js,/assets/ojm-antd-es-modal.bf3tgdh8v0.js,/assets/ojm-antd-es-upload.13gx45e0g0.js,/assets/ojm-antd-es-button.2uriphio50.js,/assets/ojm-antd-es-slider.xyvptuhid0.js" data-ojm-entry="/assets/index.6alqyx6ae0.js">(function(){var cs=document.currentScript;try{var ua=(navigator.userAgent||"").toLowerCase(),p=location.pathname;while(p.length>1&&p.charAt(p.length-1)==="/")p=p.slice(0,-1);if(ua.indexOf("wxwork")>=0&&p.slice(-6)==="/login"&&!new URLSearchParams(location.search).get("wecom_ticket")){var a=(typeof window.__OJ_API_BASE__==="string"&&window.__OJ_API_BASE__.trim())||"/api";while(a.length>1&&a.charAt(a.length-1)==="/")a=a.slice(0,-1);var q=new URLSearchParams(location.search),w=new URLSearchParams(),k=["corp","agent"];for(var i=0;i<k.length;i++){var v=(q.get(k[i])||"").trim();if(v)w.set(k[i],v)}var qs=w.toString();location.replace(a+"/auth/wecom/login"+(qs?"?"+qs:""));return}}catch(e){}var pl=cs.getAttribute("data-ojm-preload");if(pl){var ps=pl.split(",");for(var i=0;i<ps.length;i++){var l=document.createElement("link");l.rel="modulepreload";l.href=ps[i];document.head.appendChild(l);}}var s=document.createElement("script");s.type="module";s.src=cs.getAttribute("data-ojm-entry");document.head.appendChild(s);})();</script>
+		<script nonce="36CAd5UpXCtQqxASbhUFfw==" data-ojm-preload="/assets/cssinjs.atgmhan7m0.js,/assets/pro-components.2kyot1vcl0.js,/assets/runtime.1xzahckt10.js,/assets/react-query.3rln45ow00.js,/assets/antd.uw1coq15l0.js,/assets/react.1ew63mwts0.js,/assets/react-dom-client.ick0v05ob0.js,/assets/react-i18next.auhvjhqv00.js,/assets/react-router.2h9rebcv50.js,/assets/jsx-runtime.h40xu4o5b0.js,/assets/react-dom.2so9uxg3f0.js,/assets/clsx.jotilrt2e0.js,/assets/antd-es-locale-zh_CN.1gjjsvxbf0.js,/assets/dayjs.pa60l6wjo0.js,/assets/ojm-dayjs-locale-zh-cn.3vr3beiyp0.js,/assets/use-sync-external-store-shim.1nz1pi9bb0.js,/assets/icons.159wjwals0.js,/assets/dayjs-plugin-quarterOfYear.2oqo1lcx80.js,/assets/dayjs-plugin-customParseFormat.13xhghv1d0.js,/assets/dayjs-plugin-advancedFormat.3vsyd2eis0.js,/assets/dayjs-plugin-isoWeek.1fn1tw82p0.js,/assets/dayjs-plugin-localeData.2rwbjp9nk0.js,/assets/dayjs-plugin-weekday.2d56a4tml0.js,/assets/dayjs-plugin-weekOfYear.gvn9iph080.js,/assets/dayjs-plugin-relativeTime.2pqs3et4y0.js,/assets/dnd-kit-core.1xyreig6r0.js,/assets/dnd-kit-utilities.1umw4xphb0.js,/assets/dnd-kit-sortable.s94qciuft0.js,/assets/ky.1cgch7gu60.js,/assets/zustand.3gjgzlnqo0.js,/assets/zustand-middleware.1xaxjueme0.js,/assets/react-error-boundary.2dncdfj3b0.js,/assets/antd-locale-en_US.561tozx860.js,/assets/antd-locale-zh_CN.1cmpmgzh70.js,/assets/i18next.33zqofapj0.js,/assets/tailwind-merge.125ehiqjw0.js,/assets/nprogress.2nz76n9ny0.js,/assets/nprogress-css.1cq2pzkre0.js,/assets/react-jss.1ei6dr9e00.js,/assets/ahooks.2l850ymmh0.js,/assets/spin-delay.yjeyj6iwp0.js,/assets/simplebar-react.2g739uvai0.js,/assets/keepalive-for-react.xenu5vam70.js,/assets/zustand-shallow.6cz0yyv9x0.js,/assets/contract-errors.2o17vz9u50.js,/assets/antd-img-crop.196rkty480.js,/assets/icons-es-components-Context.365qmflwg0.js,/assets/dayjs-plugin-weekYear.2u78l3ex10.js,/assets/zustand-vanilla.1mo3ka3g30.js,/assets/zustand-react.9fsl9brxy0.js,/assets/zustand-vanilla-shallow.3424monv50.js,/assets/zustand-react-shallow.pybayv1hx0.js,/assets/ojm-antd-es-modal.bf3tgdh8v0.js,/assets/ojm-antd-es-upload.13gx45e0g0.js,/assets/ojm-antd-es-button.2uriphio50.js,/assets/ojm-antd-es-slider.xyvptuhid0.js" data-ojm-entry="/assets/index.6alqyx6ae0.js">(function(){var cs=document.currentScript;try{var ua=(navigator.userAgent||"").toLowerCase(),p=location.pathname;while(p.length>1&&p.charAt(p.length-1)==="/")p=p.slice(0,-1);if(ua.indexOf("wxwork")>=0&&p.slice(-6)==="/login"&&!new URLSearchParams(location.search).get("wecom_ticket")){var a=(typeof window.__OJ_API_BASE__==="string"&&window.__OJ_API_BASE__.trim())||"/api";while(a.length>1&&a.charAt(a.length-1)==="/")a=a.slice(0,-1);var q=new URLSearchParams(location.search),w=new URLSearchParams(),k=["corp","agent"];for(var i=0;i<k.length;i++){var v=(q.get(k[i])||"").trim();if(v)w.set(k[i],v)}var qs=w.toString();location.replace(a+"/auth/wecom/login"+(qs?"?"+qs:""));return}}catch(e){}var pl=cs.getAttribute("data-ojm-preload");if(pl){var ps=pl.split(",");for(var i=0;i<ps.length;i++){var l=document.createElement("link");l.rel="modulepreload";l.href=ps[i];document.head.appendChild(l);}}var s=document.createElement("script");s.type="module";s.src=cs.getAttribute("data-ojm-entry");document.head.appendChild(s);})();</script>
 	</head>
 	<body>
 		<div id="root"><div class="boot-skeleton">加载中…</div></div>

package/shell-dist/versions.json

@@ -7,9 +7,9 @@
   "react-router": "7.18.2",
   "react-router/dom": "7.18.2",
   "@tanstack/react-query": "5.102.8",
-  "@oj-module/runtime": "0.2.67",
-  "@oj-module/runtime/contract": "0.2.67",
-  "@oj-module/runtime/contract/errors": "0.2.67",
+  "@oj-module/runtime": "0.2.68",
+  "@oj-module/runtime/contract": "0.2.68",
+  "@oj-module/runtime/contract/errors": "0.2.68",
   "@plane/kit": "0.1.20",
   "@plane/editor": "0.1.20",
   "antd": "6.6.1",

package/src/__tests__/cli.test.ts

@@ -21,6 +21,12 @@ let exitSpy: ReturnType<typeof vi.fn>;
 // 提升式 mock：vitest 测试体内注册的 vi.mock 拦不到 cli.ts 的 dynamic import，须 hoisted 顶层注册
 const buildBundleMock = vi.hoisted(() => vi.fn(async () => [{ file: "x.tgz" }]));
 vi.mock("../bundle", () => ({ buildBundle: buildBundleMock }));
+// 脚手架完整性门禁（scaffold-guard）：门禁失败必须先于一切产物写入
+const guardMock = vi.hoisted(() => vi.fn());
+vi.mock("../scaffold-guard", () => ({ assertDefaultModulesUntouched: guardMock }));
+const buildBackendMock = vi.hoisted(() => vi.fn(async () => {}));
+const buildModulesMock = vi.hoisted(() => vi.fn(async () => []));
+vi.mock("../build", () => ({ buildBackend: buildBackendMock, buildModules: buildModulesMock }));
 const vendorCommandMock = vi.hoisted(() => vi.fn(async () => {}));
 vi.mock("../vendor", () => ({ vendorCommand: vendorCommandMock }));
 // REG-CS3 v2：sign 的 --registry-id 曾只被 signCommand 要求、却没在 CLI 上接线，命令成死路
@@ -39,6 +45,9 @@ afterEach(() => {
 	buildBundleMock.mockClear();
 	vendorCommandMock.mockClear();
 	signCommandMock.mockClear();
+	guardMock.mockClear();
+	buildBackendMock.mockClear();
+	buildModulesMock.mockClear();
 });
 
 interface RunResult { out: string, unknown: string[], exitCode: number | undefined }
@@ -215,6 +224,28 @@ describe("参数映射", () => {
 	});
 });
 
+describe("脚手架完整性门禁", () => {
+	it("门禁失败 → 普通 build 不执行（零产物）、exit 1", async () => {
+		guardMock.mockImplementation(() => {
+			throw new Error("[ojm] 框架默认模块与上游模板不一致，已拒绝构建");
+		});
+		const r = await run(["build"], "zh-CN", tmp);
+		expect(guardMock).toHaveBeenCalledWith(tmp);
+		expect(buildBackendMock).not.toHaveBeenCalled();
+		expect(buildModulesMock).not.toHaveBeenCalled();
+		expect(r.exitCode).toBe(1);
+	});
+
+	it("门禁失败 → --bundle 同样不进 buildBundle", async () => {
+		guardMock.mockImplementation(() => {
+			throw new Error("[ojm] 框架默认模块与上游模板不一致，已拒绝构建");
+		});
+		const r = await run(["build", "--bundle", "demo"], "zh-CN", tmp);
+		expect(buildBundleMock).not.toHaveBeenCalled();
+		expect(r.exitCode).toBe(1);
+	});
+});
+
 describe("help 词形", () => {
 	it("ojm help build → build --help", () => {
 		expect(rewriteHelpArgv(["help", "build"])).toEqual(["build", "--help"]);

package/src/__tests__/new-scaffold.test.ts

@@ -56,4 +56,17 @@ describe("ojm new --api 骨架可路由（BDD）", () => {
 			expect(doc[key], `solution.yaml 缺 ${key}（market verify 必填）`).toBeDefined();
 		expect((doc.archive as Record<string, unknown>).file).toBe("crm-0.1.0.tgz");
 	});
+
+	it("给定 createSolution(api: true)，api 段声明 ping 匿名（安装预检 anonymous_residual 防线，20261106 市场线实测）", async () => {
+		const root = projectRoot();
+		const result = createSolution(root, "crm", { api: true, layout: "none" });
+		const { parse: yamlParse } = await import("yaml");
+		const doc = yamlParse(fs.readFileSync(path.join(result.dir, "solution.yaml"), "utf8")) as Record<string, unknown>;
+
+		// Then：ping 匿名可达必须在契约里声明（fixture.ts 同形状）；漏声明 = 真包装不进（preflight 拒）
+		const api = doc.api as Record<string, unknown>;
+		expect(api.module).toBe("crm");
+		expect(api.prefix).toBe("/api/crm");
+		expect(api.anonymous).toEqual(["crm/ping"]);
+	});
 });

package/src/build/module-def.ts

@@ -157,6 +157,7 @@ export const getModules = () => [];
 export const getModule = () => undefined;
 export const getRoutes = () => [];
 export const getHostRoutes = () => [];
+export const resolveRoutePath = _fn;
 // 模块生效 web 路由前缀段取值口（R1.3：写进 modules.json 的 routePrefix，未声明回落 name）
 export const getModuleRoutePrefix = _fn;
 export const getRegisteredStore = () => undefined;

package/src/builtin.ts

@@ -81,11 +81,12 @@ export function deriveBuiltinModules(include: Iterable<string>): Set<string> {
 /**
  * init 接线：生成/回填 `src/.ojm-builtin.json`（copyIfAbsent 语义）。
  * 已存在 → 原样不动（用户手改权）；派生集为空 → 不写。
+ * `overwrite`（ojm init --yes 恢复语义）：已存在也重写为上游名单。
  * @returns "created" | "skipped" | "none"
  */
-export function writeBuiltinList(projectRoot: string, include: Iterable<string>): "created" | "skipped" | "none" {
+export function writeBuiltinList(projectRoot: string, include: Iterable<string>, opts: { overwrite?: boolean } = {}): "created" | "skipped" | "none" {
 	const target = builtinListPath(projectRoot);
-	if (fs.existsSync(target))
+	if (fs.existsSync(target) && !opts.overwrite)
 		return "skipped";
 	const modules = [...deriveBuiltinModules(include)].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 	if (modules.length === 0)

package/src/cli.ts

@@ -130,6 +130,10 @@ function makeAction(def: HelpEntry, projectRoot: string, lang: Lang, exit: (code
 			};
 		case "build":
 			return async (opts: { bundle?: unknown, out?: string } = {}) => {
+				// 脚手架完整性门禁（内置模块自治契约）：普通与 --bundle 汇合前执行，
+				// 失败零产物——默认模块上游自治，本地修改不允许进包
+				const { assertDefaultModulesUntouched } = await import("./scaffold-guard");
+				assertDefaultModulesUntouched(projectRoot);
 				// mri 可选值：裸 --bundle 得到 ""，--bundle name / --bundle=name 得到字符串
 				const bundle = opts.bundle !== undefined;
 				const bundleName = typeof opts.bundle === "string" && opts.bundle !== "" ? opts.bundle : undefined;

package/src/init.ts

@@ -7,6 +7,8 @@
  *
  * 幂等补缺：对既有工程重跑只补缺失文件（bin/oj 已在则跳过下载，但先过 §7 能力闸门），
  * config.yaml 与用户文件永不覆盖——「重新 init 覆盖脚手架」是审阅记录二明令禁止的行为。
+ * 唯一例外是 `--yes`：默认方案的显式恢复入口，仅覆盖/清理上游自治的保护根
+ * （src/app、src/oj-market，见 scaffold-guard.ts），自定义模块与工程配置仍不动。
  */
 
 import { execFileSync } from "node:child_process";
@@ -14,18 +16,23 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
-import { fileURLToPath } from "node:url";
-import yaml from "yaml";
 import { ALIAS_PATHS_FILE, syncAliasPaths } from "./alias-paths";
 import { BUILTIN_LIST_FILE, writeBuiltinList } from "./builtin";
 import { resolveCertDir, resolveConfigPath } from "./layout";
 import { probeOjCaps } from "./oj-caps";
 import { mintDevCert } from "./oj-cert";
+import {
+	isProtectedRel,
+	readInitInclude,
+	removeExtraProtectedFiles,
+	cliRoot as resolveCliRoot,
+	templatesRoot,
+} from "./scaffold-guard";
 import { isSupportedOjVersion, MIN_OJ_VERSION, resolveOjBin, syncOjDevkit, vendorCommand } from "./vendor";
 import { readHostVersions } from "./versions";
 
 export interface InitOptions {
-	/** 跳过非空目录确认（自动化/测试用） */
+	/** 跳过非空目录确认（自动化/测试用）；对既有工程同时恢复上游自治的保护根 */
 	yes?: boolean
 	/** 注入桩 oj 安装器（测试）；默认 vendorCommand 经 npm 包 @oj-bin/oj 联网安装 */
 	ojInstaller?: (binDir: string) => Promise<void>
@@ -109,26 +116,34 @@ export async function initProject(destDir: string, opts: InitOptions = {}): Prom
 	}
 
 	const report: InitReport = { created: [], skipped: [], warnings: [] };
-	const cliRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
+	const cliRoot = resolveCliRoot();
 
 	// 0) 已有 bin/oj 先过能力闸门（评审 BLOCKING #8）：早前「bin/oj 存在即跳过」
 	//    会让从旧工程带来的 0.1.84 静默过关，等 `ojm build` 才死在 --module-root 不认。
 	assertExistingOjUsable(destDir, report);
 
-	// 1) 模板（占位符替换 + 幂等跳过）
-	const templatesDir = path.join(cliRoot, "templates");
+	// 1) 模板（占位符替换 + 幂等跳过；--yes 时保护根内改为覆盖恢复）
+	const templatesDir = templatesRoot();
 	const jwtSecret = crypto.randomBytes(32).toString("hex");
 	const projectName = path.basename(destDir);
 	const include = readInitInclude(templatesDir);
 	copyTemplates(templatesDir, destDir, {
 		__JWT_SECRET__: jwtSecret,
 		__PROJECT_NAME__: projectName,
-	}, report, include, templatesDir);
+	}, report, include, templatesDir, false, !!opts.yes);
 	pruneUnincludedApiPaths(destDir, include, report);
 
+	// 1a') --yes 恢复的清理面：删除保护根内模板没有的文件（留着会让 build 门禁
+	//      永久失败——extra 漂移不因 init 补缺而消失，必须显式清掉）
+	if (opts.yes) {
+		for (const rel of removeExtraProtectedFiles(destDir))
+			report.created.push(`恢复：删除多出文件 ${rel}`);
+	}
+
 	// 1a) src/.ojm-builtin.json：脚手架自带模块身份（名单派生自上面的白名单，单一真源）。
-	//     copyIfAbsent：旧工程重跑 init 时缺失才补写，已存在不覆盖用户手改。
-	const builtinStatus = writeBuiltinList(destDir, include);
+	//     copyIfAbsent：旧工程重跑 init 时缺失才补写，已存在不覆盖用户手改；
+	//     --yes 恢复语义下重写为上游名单。
+	const builtinStatus = writeBuiltinList(destDir, include, { overwrite: !!opts.yes });
 	if (builtinStatus === "created")
 		report.created.push(`src/${BUILTIN_LIST_FILE}`);
 	else if (builtinStatus === "skipped")
@@ -317,6 +332,9 @@ async function sealJwtSecret(destDir: string, report: InitReport, seal: Sealer =
  * created/skipped（demo 模块/模板自运行产物/元数据的大头在清单外）。清单外的
  * 目录仅在「有收录子孙」时才穿行（如 `api/`、`web/src/`、`web/src/demo/`——
  * 只收录了后者底下的 entry/locales/pages），穿行时未收录的子项继续被挡下。
+ *
+ * `restore`（--yes）：上游自治保护根（scaffold-guard.PROTECTED_ROOTS）内的
+ * 已存在文件改为覆盖写入——这是默认方案的显式恢复入口，其余文件仍不覆盖。
  */
 function copyTemplates(
 	srcDir: string,
@@ -326,6 +344,7 @@ function copyTemplates(
 	include: Set<string>,
 	rootDir: string,
 	underIncluded = false,
+	restore = false,
 ): void {
 	for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {
 		const src = path.join(srcDir, entry.name);
@@ -343,24 +362,36 @@ function copyTemplates(
 			if (!dirHasFiles(src))
 				continue;
 			fs.mkdirSync(dest, { recursive: true });
-			copyTemplates(src, dest, placeholders, report, include, rootDir, underIncluded || listed);
+			copyTemplates(src, dest, placeholders, report, include, rootDir, underIncluded || listed, restore);
 			continue;
 		}
+		// 恢复判定用 srcRel（模板相对 == 工程相对，已归一正斜杠）；destRel 是相对
+		// 当前递归层 destDir 的短路径，只配做报告标签，做不了保护根判定
 		const destRel = path.relative(destDir, dest);
 		if (fs.existsSync(dest)) {
+			if (restore && isProtectedRel(srcRel)) {
+				writeTemplateFile(src, dest, placeholders);
+				report.created.push(`恢复（--yes 覆盖）${srcRel}`);
+				continue;
+			}
 			report.skipped.push(destRel);
 			continue;
 		}
-		let content = fs.readFileSync(src, "utf-8");
-		for (const [token, value] of Object.entries(placeholders))
-			content = content.replaceAll(token, value);
-		content = stripRegion(content, "demo-only");
-		fs.mkdirSync(path.dirname(dest), { recursive: true });
-		fs.writeFileSync(dest, content);
+		writeTemplateFile(src, dest, placeholders);
 		report.created.push(destRel);
 	}
 }
 
+/** 读模板 → 占位符替换 → 剥 demo-only 区间 → 落盘（创建与 --yes 恢复共用一条变换链） */
+function writeTemplateFile(src: string, dest: string, placeholders: Record<string, string>): void {
+	let content = fs.readFileSync(src, "utf-8");
+	for (const [token, value] of Object.entries(placeholders))
+		content = content.replaceAll(token, value);
+	content = stripRegion(content, "demo-only");
+	fs.mkdirSync(path.dirname(dest), { recursive: true });
+	fs.writeFileSync(dest, content);
+}
+
 /** srcRel 是否为白名单里某条收录路径的祖先目录——决定清单外目录要不要穿行 */
 function hasIncludedDescendant(include: Set<string>, srcRel: string): boolean {
 	const prefix = `${srcRel}/`;
@@ -382,31 +413,6 @@ function dirHasFiles(dir: string): boolean {
 	return false;
 }
 
-/**
- * 读取模板根 `init.include.yaml` 的 `include` 白名单，归一为相对模板根的路径集合。
- * 清单随模板一起发布，缺失即安装包损坏——直接 fail-fast，不留「静默少拷」的
- * 退化路径。条目指向不存在的路径同样 fail-fast：拼错一个目录名不会当场报错，
- * 只会在用户工程里留下难以追溯的缺文件（旧 exclude 清单没有这类校验面）。
- */
-function readInitInclude(templatesDir: string): Set<string> {
-	const yamlPath = path.join(templatesDir, "init.include.yaml");
-	if (!fs.existsSync(yamlPath))
-		throw new Error(`模板缺少 init.include.yaml：${yamlPath}（安装包损坏？）`);
-	const doc = yaml.parse(fs.readFileSync(yamlPath, "utf-8")) as { include?: string[] } | null;
-	const out = new Set<string>();
-	for (const raw of doc?.include ?? []) {
-		// 跨平台：include 清单用正斜杠书写，但 path.normalize 在 Windows 会把
-		// 正斜杠折成反斜杠，导致与 srcRel（path.relative 在 Windows 同样出反斜杠）
-		// 的对比永远落空、整棵 src 子树被 skip。这里只把反斜杠归正、剥 ./ 前缀，
-		// 不引入平台分隔符（修复：Windows 下 init 不拷贝 src 树）。
-		const p = raw.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
-		out.add(p);
-		if (!fs.existsSync(path.join(templatesDir, p)))
-			throw new Error(`init.include.yaml 收录了不存在的路径：${p}（拼写错误或模板缺文件？）`);
-	}
-	return out;
-}
-
 /**
  * 从脚手架产出的 openapi.json 里删掉未进白名单的 api 模块端点。
  *

package/src/market/publish.ts

@@ -17,6 +17,7 @@ import process from "node:process";
 
 import { buildBundle } from "../bundle";
 import { createDeterministicTgz } from "../deterministic-tar";
+import { assertDefaultModulesUntouched } from "../scaffold-guard";
 import { signCommand } from "../sign";
 import { resolveCdnLayout } from "./cdn-layout";
 import { buildFixturePackage, parseFixtureSpec } from "./fixture";
@@ -126,6 +127,8 @@ async function buildFixture(args: { fixture?: string, staging: string, cdnDir: s
 
 /** `--real`：走既有 ojm build --bundle，产物搬到 CDN 目录（一次只发一份：多方案工程请显式指定） */
 async function buildRealPackage(solutionRoot: string, staging: string, cdnDir: string): Promise<{ name: string, version: string, tgzPath: string, sha256: string, preExisted: boolean }> {
+	// 与 ojm build 同一道完整性门禁：发布链路同样不许携带被改过的默认模块
+	assertDefaultModulesUntouched(solutionRoot);
 	const builtList = await buildBundle(solutionRoot, { out: staging });
 	if (builtList.length !== 1) {
 		throw new Error(

package/src/new.ts

@@ -140,6 +140,8 @@ function solutionYaml(name: string, withApi: boolean | undefined): string {
 			"api:",
 			`  module: ${name}`,
 			`  prefix: /api/${name}`,
+			// ping 匿名可达必须在契约声明（fixture.ts 同形状）；漏声明安装预检 anonymous_residual 拒装
+			`  anonymous: ["${name}/ping"]`,
 			"",
 		].join("\n")
 		: "";

package/src/scaffold-guard.ts

@@ -0,0 +1,227 @@
+/**
+ * 脚手架完整性门禁——内置模块自治契约。
+ *
+ * 契约（下游反馈 2026-11-06）：`src/app` 内置模块与 `src/oj-market` 属上游自治，
+ * 下游不得本地修改；`ojm build` 前逐文件与**当前 cli 包内 templates** 比对
+ * （上游模板即基线，不另立可被下游手改的哈希 lock）。CLI 升级后工程里的旧版
+ * 默认模块与新模板必不一致 → fail-fast，必须先 `ojm init --yes` 同步再构建
+ * （「必须先同步上游」策略，用户已确认）。
+ *
+ * 语义边界：
+ *   - 保护集 = init.include.yaml 白名单中保护根前缀条目展开的模板文件清单；
+ *     demo-only 文件本就不在白名单，不参与比较，无误报；
+ *   - 三类漂移均拦：modified（内容不一致，CRLF 归一防 autocrlf 误报）、
+ *     missing（白名单文件缺失）、extra（保护根内模板没有的文件）；
+ *   - 门禁开关 = `src/.ojm-builtin.json` 存在（新脚手架 init 必写；缺失 =
+ *     旧工程/框架仓，退化现状不拦——与 builtin.ts 同哲学）；
+ *   - **不是安全边界**：删开关文件即退回旧行为；错误信息如实告知处置路径；
+ *   - 仅约束打包链路（ojm build / build --bundle / market publish --real）；
+ *     dev 不拦，允许本地试验。
+ *
+ * 消费方：`cli.ts` build action（分支前，失败零产物）、`market/publish.ts`、
+ * `init.ts`（--yes 恢复复用保护根/白名单/清理面）。
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import yaml from "yaml";
+import { builtinListPath } from "./builtin";
+
+/** 上游自治的保护根（相对工程根，正斜杠）。init --yes 恢复范围与此严格一致。 */
+export const PROTECTED_ROOTS = ["src/app", "src/oj-market"] as const;
+
+/** rel 是否落在保护根内（接受平台分隔符输入，归一后比较） */
+export function isProtectedRel(rel: string): boolean {
+	const p = rel.split(path.sep).join("/");
+	return PROTECTED_ROOTS.some(root => p === root || p.startsWith(`${root}/`));
+}
+
+/** cli 包根（src 运行态与 dist 发布态各上跳一层即包根） */
+export function cliRoot(): string {
+	return path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
+}
+
+export function templatesRoot(): string {
+	return path.join(cliRoot(), "templates");
+}
+
+/**
+ * 读取模板根 `init.include.yaml` 的 `include` 白名单，归一为相对模板根的路径集合。
+ * 清单随模板一起发布，缺失即安装包损坏——直接 fail-fast，不留「静默少拷」的
+ * 退化路径。条目指向不存在的路径同样 fail-fast：拼错一个目录名不会当场报错，
+ * 只会在用户工程里留下难以追溯的缺文件（旧 exclude 清单没有这类校验面）。
+ */
+export function readInitInclude(templatesDir: string): Set<string> {
+	const yamlPath = path.join(templatesDir, "init.include.yaml");
+	if (!fs.existsSync(yamlPath))
+		throw new Error(`模板缺少 init.include.yaml：${yamlPath}（安装包损坏？）`);
+	const doc = yaml.parse(fs.readFileSync(yamlPath, "utf-8")) as { include?: string[] } | null;
+	const out = new Set<string>();
+	for (const raw of doc?.include ?? []) {
+		// 跨平台：include 清单用正斜杠书写，但 path.normalize 在 Windows 会把
+		// 正斜杠折成反斜杠，导致与 srcRel（path.relative 在 Windows 同样出反斜杠）
+		// 的对比永远落空、整棵 src 子树被 skip。这里只把反斜杠归正、剥 ./ 前缀，
+		// 不引入平台分隔符（修复：Windows 下 init 不拷贝 src 树）。
+		const p = raw.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
+		out.add(p);
+		if (!fs.existsSync(path.join(templatesDir, p)))
+			throw new Error(`init.include.yaml 收录了不存在的路径：${p}（拼写错误或模板缺文件？）`);
+	}
+	return out;
+}
+
+export interface ScaffoldDrift {
+	modified: string[]
+	missing: string[]
+	extra: string[]
+}
+
+/** 门禁开关：工程声明了内置模块概念（`src/.ojm-builtin.json` 存在） */
+export function guardEnabled(projectRoot: string): boolean {
+	return fs.existsSync(builtinListPath(projectRoot));
+}
+
+/** 白名单中保护根条目展开成模板文件相对路径清单（正斜杠、去重、排序） */
+export function protectedTemplateFiles(templatesDir: string, include: Set<string>): string[] {
+	const files = new Set<string>();
+	const walk = (abs: string): void => {
+		for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
+			const p = path.join(abs, entry.name);
+			if (entry.isDirectory())
+				walk(p);
+			else
+				files.add(path.relative(templatesDir, p).split(path.sep).join("/"));
+		}
+	};
+	for (const rel of include) {
+		if (!isProtectedRel(rel))
+			continue;
+		const abs = path.join(templatesDir, rel);
+		if (fs.statSync(abs).isDirectory())
+			walk(abs);
+		else
+			files.add(rel);
+	}
+	return [...files].sort();
+}
+
+const normalizeText = (s: string): string => s.replaceAll("\r\n", "\n");
+
+function walkProjectFiles(projectRoot: string, root: string, visit: (rel: string, abs: string) => void): void {
+	const absRoot = path.join(projectRoot, root);
+	if (!fs.existsSync(absRoot))
+		return;
+	const walk = (abs: string): void => {
+		for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
+			const p = path.join(abs, entry.name);
+			if (entry.isDirectory())
+				walk(p);
+			else
+				visit(path.relative(projectRoot, p).split(path.sep).join("/"), p);
+		}
+	};
+	walk(absRoot);
+}
+
+/**
+ * 收集工程默认模块相对当前 cli 模板的漂移。
+ * 门禁未启用（无 `.ojm-builtin.json`）→ null；已启用 → 三类清单（可为空）。
+ */
+export function collectDefaultModuleDrift(projectRoot: string): ScaffoldDrift | null {
+	if (!guardEnabled(projectRoot))
+		return null;
+	const templatesDir = templatesRoot();
+	const expected = protectedTemplateFiles(templatesDir, readInitInclude(templatesDir));
+	const expectedSet = new Set(expected);
+	const drift: ScaffoldDrift = { modified: [], missing: [], extra: [] };
+	for (const rel of expected) {
+		const projectFile = path.join(projectRoot, rel);
+		if (!fs.existsSync(projectFile)) {
+			drift.missing.push(rel);
+			continue;
+		}
+		if (normalizeText(fs.readFileSync(projectFile, "utf-8")) !== normalizeText(fs.readFileSync(path.join(templatesDir, rel), "utf-8")))
+			drift.modified.push(rel);
+	}
+	for (const root of PROTECTED_ROOTS) {
+		walkProjectFiles(projectRoot, root, (rel) => {
+			if (!expectedSet.has(rel))
+				drift.extra.push(rel);
+		});
+	}
+	drift.extra.sort();
+	return drift;
+}
+
+/**
+ * 门禁入口：有漂移即抛（错误信息点名文件 + 上游自治说明 + `ojm init --yes` 处置）。
+ * 调用方保证在任何产物写入之前调用（失败零产物）。
+ */
+export function assertDefaultModulesUntouched(projectRoot: string): void {
+	const drift = collectDefaultModuleDrift(projectRoot);
+	if (!drift)
+		return;
+	const sections: string[] = [];
+	const section = (label: string, items: string[]): void => {
+		if (items.length > 0)
+			sections.push(`${label}（${items.length} 个文件）：\n${items.map(f => `  - ${f}`).join("\n")}`);
+	};
+	section("内容被修改", drift.modified);
+	section("缺失", drift.missing);
+	section("多出（模板没有）", drift.extra);
+	if (sections.length === 0)
+		return;
+	throw new Error([
+		"[ojm] 框架默认模块与上游模板不一致，已拒绝构建（未写入任何产物）。",
+		"",
+		...sections,
+		"",
+		"框架默认模块（src/app 内置模块、src/oj-market）由上游自治：本地修改会在下次同步时丢失，",
+		"功能需求请向上游仓库提交 issue，不要在下游直接改这些目录。",
+		"处置：",
+		"  - 确认放弃本地修改并恢复上游版本：ojm init --yes",
+		"    （仅覆盖/清理 src/app 与 src/oj-market，会丢弃其中的本地改动，执行前请备份；",
+		"     下游自定义模块与工程配置不受影响）。",
+	].join("\n"));
+}
+
+/**
+ * `ojm init --yes` 恢复的清理面：删除保护根内模板没有的文件（含遗留空目录）。
+ * 返回删除清单（正斜杠相对路径），供 init report 展示。
+ */
+export function removeExtraProtectedFiles(projectRoot: string): string[] {
+	const templatesDir = templatesRoot();
+	const expected = new Set(protectedTemplateFiles(templatesDir, readInitInclude(templatesDir)));
+	const removed: string[] = [];
+	for (const root of PROTECTED_ROOTS) {
+		walkProjectFiles(projectRoot, root, (rel, abs) => {
+			if (!expected.has(rel)) {
+				fs.rmSync(abs);
+				removed.push(rel);
+			}
+		});
+		const absRoot = path.join(projectRoot, root);
+		if (fs.existsSync(absRoot))
+			pruneEmptyDirs(absRoot);
+	}
+	return removed.sort();
+}
+
+/** 递归删除空目录（自底向上）；根自身保留，返回其是否为空 */
+function pruneEmptyDirs(dir: string): boolean {
+	let empty = true;
+	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+		const p = path.join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (pruneEmptyDirs(p))
+				fs.rmdirSync(p);
+			else
+				empty = false;
+		}
+		else {
+			empty = false;
+		}
+	}
+	return empty;
+}

package/src/usage.ts

@@ -77,11 +77,11 @@ export const HELP_GROUPS: HelpGroup[] = [
 				zh: "前后端一体化工程脚手架（幂等补缺）",
 				en: "Full-stack project scaffolding (idempotent, fills gaps only)",
 				options: [
-					{ raw: "--yes", zh: "非交互：缺省回答一律 yes", en: "Non-interactive: default all answers to yes" },
+					{ raw: "--yes", zh: "非交互：跳过非空确认，并把框架自带模块（src/app、src/oj-market）恢复为当前版本（丢弃其中的本地修改）", en: "Non-interactive: skip the non-empty check and restore built-in modules (src/app, src/oj-market) to upstream (local edits there are discarded)" },
 				],
 				detail: {
-					zh: "ojm init [dir] [--yes]\n  前后端一体化工程脚手架（幂等补缺：重跑只补缺失文件，永不覆盖已有文件）",
-					en: "ojm init [dir] [--yes]\n  Full-stack project scaffolding (idempotent: re-runs only fill missing files, never overwrite existing ones)",
+					zh: "ojm init [dir] [--yes]\n  前后端一体化工程脚手架（重跑只补缺失文件；已有文件永不覆盖）\n  --yes 恢复模式：覆盖 src/app 与 src/oj-market 为当前 CLI 携带的上游版本，\n  并删除这些目录内多出的文件（会丢弃其中的本地修改，先备份；\n  下游自定义模块与工程配置不受影响）。CLI 升级后构建前需先跑一次。",
+					en: "ojm init [dir] [--yes]\n  Full-stack project scaffolding (re-runs only fill missing files; existing files are never overwritten)\n  --yes restore mode: overwrites src/app & src/oj-market with the upstream version\n  carried by this CLI and removes extra files there (local edits in those two\n  directories are discarded — back up first; your own modules and project config\n  are untouched). Run once after a CLI upgrade before building.",
 				},
 			},
 			{
@@ -135,8 +135,8 @@ export const HELP_GROUPS: HelpGroup[] = [
 					{ raw: "--out <dir>", zh: "--bundle 输出目录（缺省 dist/）", en: "Output directory for --bundle (default dist/)" },
 				],
 				detail: {
-					zh: "ojm build [--bundle [name]] [--out <dir>]\n  构建后端（oj build）与模块产物（含全站合并）\n  --bundle 产出 dist/<name>-<version>.tgz + sha256（市场安装器的上游产物）",
-					en: "ojm build [--bundle [name]] [--out <dir>]\n  Builds the backend (oj build) and module artifacts (including the site-wide merge)\n  --bundle produces dist/<name>-<version>.tgz + sha256 (upstream artifact for the marketplace installer)",
+					zh: "ojm build [--bundle [name]] [--out <dir>]\n  构建后端（oj build）与模块产物（含全站合并）\n  --bundle 产出 dist/<name>-<version>.tgz + sha256（市场安装器的上游产物）\n  构建前校验框架自带模块（src/app、src/oj-market）未被本地修改——\n  与上游模板不一致即拒绝构建（内置模块自治契约，见 src/README.md）",
+					en: "ojm build [--bundle [name]] [--out <dir>]\n  Builds the backend (oj build) and module artifacts (including the site-wide merge)\n  --bundle produces dist/<name>-<version>.tgz + sha256 (upstream artifact for the marketplace installer)\n  Before building, verifies the built-in modules (src/app, src/oj-market) are unmodified —\n  any drift from the upstream templates rejects the build (built-in module autonomy, see src/README.md)",
 				},
 			},
 			{

package/templates/init.include.yaml

@@ -37,6 +37,8 @@ include:
   - types
   - web.config.ts
   - openapi.json
+  # src 下的模块分区说明（内置模块自治契约的人话版，动手前必读）
+  - src/README.md
   - src/styles.css
   # 后端 typecheck 工程（package.json 的 typecheck:api 指向它）；只收后端、排除 web
   - src/tsconfig.json