@open-dy/vibecoding-cli 0.0.1-beta.5 → 0.0.1

package/README.md

@@ -32,6 +32,10 @@ Schema 统一使用 `custom-card-schema.json`。`config/card-routing.json` 的 `
 
 服务包仅包含 `dist`、生成的 `Dockerfile`、`package.json`、`run.sh` 以及可选的 `sql`、`scripts`。生成 Dockerfile 时按原脚本规则为每条 `COPY package.json` 追加存在的目录，项目源文件不改写。构建/zip 失败保留退出码，临时目录在失败时也会清理。
 
+`verify` 的静态阶段在构建通过后，保留主工程 `server.zip` 的文件数预检（阈值 `1000`，超限失败）。标准 CLI 模板使用打包共用的清单；自定义 `scripts/pack.sh` 使用其 `REQUIRED_SERVER_INCLUDES` / `OPTIONAL_SERVER_INCLUDES`。脚本缺失或清单无法解析时，warning 并保守统计整个 `server/`；缺少目录或必需文件时明确报告未覆盖范围。检查范围不扩大到封闭域服务，不生成 ZIP，也不验证压缩包大小。静态检查不等待 dev 的安装成功日志；自动启动预览后仍等待安装与端口就绪。
+
+浏览器验收优先使用 `agent-browser-real`，不可用时使用 `agent-browser`。浏览器命令只在验收阶段查找；CDP / 浏览器基础设施失败会报告 `infra_browser` 和 `runtime_status=unverified`，继续以非零退出码结束，页面与业务错误仍按实际错误判定。
+
 CLI 支持用 `ARTIFACTS_DIR` 指定专用产物目录；为避免误删，拒绝项目、用户主目录、临时目录根及其上级目录。模板的 `pack.sh` 不加载 `.env.dev` 或 `.bashrc`，未传入该变量时默认写入 `/tmp/microapp_artifacts`。
 
 Taro 构建统一由 CLI 编排，兴趣卡只在业务域规则上扩展：
@@ -46,4 +50,4 @@ CLI 对外命令和校验入口的 JSDoc 使用 `@desc`、`@params`、`@return`
 
 ## 准出测试
 
-在仓库根目录运行 `node packages/scripts/run-release-contracts.mjs`，或在本包目录运行 `pnpm test:release`。该命令构建并验证 SDK、CLI 和隔离消费者；终端进度、JUnit 报告与 push CI 配置见 [packages/TESTING.md](../TESTING.md)。
+在仓库根目录运行 `node packages/release/verification/run-release-contracts.mjs`，或在本包目录运行 `pnpm test:release`。该命令构建并验证 SDK、CLI 和隔离消费者；终端进度、JUnit 报告与 push CI 配置见 [packages/TESTING.md](../TESTING.md)。

package/assets/schemas/custom-card-schema.json

@@ -31,7 +31,7 @@
     },
     "CardBackgroundUrl": {
       "type": "string",
-      "description": "必须调用图片生成工具获取真实的图片 URL，自动生成符合预期的背景图片。此图片将作为 Feed 流场景的全屏背景底图，画面内容必须延伸至画面边缘，完全铺满整个画布。严禁出现手机设备外框、样机模型、任何形式的边框，严禁将内容仅集中在中间而导致四周留白或黑边。图片宽高比严格为`9:16`竖图。必须完整保留原始 URL 及全部 query 参数，禁止截断、改写或丢弃任何参数（如 x-expires）。",
+      "description": "必须调用图片生成工具获取真实的图片 URL，自动生成符合预期的背景图片。此图片将作为 Feed 流场景的全屏背景底图，画面内容必须延伸至画面边缘，完全铺满整个画布。严禁出现手机设备外框、样机模型、任何形式的边框，严禁将内容仅集中在中间而导致四周留白或黑边。图片宽高比严格为`9:16`竖图。",
       "pattern": "^https://"
     },
     "Button": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-dy/vibecoding-cli",
-  "version": "0.0.1-beta.5",
+  "version": "0.0.1",
   "description": "Command orchestration, validation and packaging for Douyin vibecoding Taro and OpenCard projects.",
   "type": "module",
   "bin": {
@@ -24,26 +24,27 @@
     "bin",
     "src",
     "assets",
-    "README.md"
+    "README.md",
+    "release-provenance.json"
   ],
   "scripts": {
     "ci:check": "pnpm run build && pnpm run test",
     "build": "node ./scripts/check-package-files.mjs",
-    "test": "node ../scripts/run-package-tests.mjs cli",
+    "test": "node ../testing/run-package-tests.mjs cli",
     "pack:local": "pnpm pack --pack-destination ./artifacts",
     "pack:ppe": "node ./scripts/pack-ppe.mjs",
-    "test:release": "node ../scripts/run-release-contracts.mjs",
-    "publish:bnpm:ppe": "node ../scripts/ppe-release/cli.mjs vibecoding-cli",
-    "publish:bnpm:ppe:dry-run": "node ../scripts/ppe-release/cli.mjs vibecoding-cli --dry-run",
-    "publish:npm:beta": "node ../scripts/npm-beta-release/cli.ts vibecoding-cli",
-    "publish:npm:beta:dry-run": "node ../scripts/npm-beta-release/cli.ts vibecoding-cli --dry-run"
+    "test:release": "node ../release/verification/run-release-contracts.mjs",
+    "publish:bnpm:ppe": "node ../release/ppe-release/cli.mjs vibecoding-cli",
+    "publish:bnpm:ppe:dry-run": "node ../release/ppe-release/cli.mjs vibecoding-cli --dry-run",
+    "publish:npm:beta": "node ../release/npm-beta-release/cli.ts vibecoding-cli",
+    "publish:npm:beta:dry-run": "node ../release/npm-beta-release/cli.ts vibecoding-cli --dry-run"
   },
   "dependencies": {
     "ajv": "^8.18.0"
   },
   "peerDependencies": {
-    "@open-dy/vibecoding-sdk-taro": "0.0.1-beta.4",
-    "@open-dy/vibecoding-sdk-opencard": "0.0.1-beta.4"
+    "@open-dy/vibecoding-sdk-taro": "0.0.1",
+    "@open-dy/vibecoding-sdk-opencard": "0.0.1"
   },
   "peerDependenciesMeta": {
     "@open-dy/vibecoding-sdk-taro": {
@@ -59,7 +60,7 @@
   "license": "UNLICENSED",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
-    "tag": "beta",
+    "tag": "latest",
     "access": "public"
   }
 }

package/release-provenance.json

@@ -0,0 +1,15 @@
+{
+  "schema": 1,
+  "producer": "vibecoding-cli",
+  "packageName": "@open-dy/vibecoding-cli",
+  "version": "0.0.1",
+  "source": {
+    "digest": "sha256-ba8401764d5a9fc23bda57f557862542fda9f4187adf2fcdd6625d458d623936",
+    "files": 83
+  },
+  "payload": "sha256-30e2e1be2593d5913151c6b0c2d488e3cc07ce685341a3446c6caa93df95e801",
+  "toolchain": {
+    "node": "v22.22.3",
+    "packageManager": null
+  }
+}

package/src/commands/pack.mjs

@@ -17,6 +17,7 @@ import { CliError } from '../core/errors.mjs'
 import { resolveProjectContext } from '../core/context.mjs'
 import { buildOpenCard, buildPackInputs } from './build.mjs'
 import { readCardRouting } from '../build/opencard-environment.mjs'
+import { REQUIRED_SERVER_INCLUDES, OPTIONAL_SERVER_INCLUDES } from '../validators/server-artifact.mjs'
 
 const DEFAULT_ARTIFACTS = '/tmp/microapp_artifacts'
 
@@ -72,13 +73,12 @@ async function zipDirectory(directory, output, { removeExisting = true } = {}) {
 
 function createServerStage(server, stage) {
   if (!isDirectory(server)) throw new CliError(`Server pack input is missing: ${server}`)
-  const required = ['dist', 'Dockerfile', 'package.json', 'run.sh']
-  for (const name of required) {
+  for (const name of REQUIRED_SERVER_INCLUDES) {
     if (!existsSync(path.join(server, name))) {
       throw new CliError(`Server pack input is missing: ${path.join(server, name)}`)
     }
   }
-  for (const name of ['dist', 'package.json', 'run.sh', 'sql', 'scripts']) {
+  for (const name of [...REQUIRED_SERVER_INCLUDES, ...OPTIONAL_SERVER_INCLUDES].filter(name => name !== 'Dockerfile')) {
     const source = path.join(server, name)
     if (existsSync(source)) cpSync(source, path.join(stage, name), { recursive: true })
   }

package/src/commands/verify.mjs

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { accessSync, constants, existsSync, readFileSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { CliError } from '../core/errors.mjs'
@@ -12,6 +12,7 @@ import { readCardRouting } from '../build/opencard-environment.mjs'
 import { runBuild } from './build.mjs'
 import { runDatabaseInit } from './db.mjs'
 import { runLint } from './lint.mjs'
+import { validateServerArtifactFileCount } from '../validators/server-artifact.mjs'
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 const devLauncher = fileURLToPath(new URL('../../bin/vibecoding', import.meta.url))
@@ -42,6 +43,11 @@ async function runStatic(context) {
     )
   }
   await runTasks(tasks, { label: 'static verification' })
+  if (context.target === 'taro') {
+    validateServerArtifactFileCount(context.serverRoot ?? path.join(context.root, 'server'), {
+      packScriptPath: path.join(context.root, 'scripts/pack.sh'),
+    })
+  }
 }
 
 export function startDevDetached(context, spawnProcess = spawn) {
@@ -522,6 +528,23 @@ export function isIgnorableOpenCardConsoleFinding(value, options) {
     /Failed to load resource: the server responded with a status of 404/i.test(text)
 }
 
+export function resolveAgentBrowserCommand(env = process.env) {
+  for (const name of ['agent-browser-real', 'agent-browser']) {
+    for (const directory of (env.PATH || '').split(path.delimiter)) {
+      const executable = path.resolve(directory || '.', name)
+      try {
+        accessSync(executable, constants.X_OK)
+        if (statSync(executable).isFile()) return executable
+      } catch {}
+    }
+  }
+  return 'agent-browser'
+}
+
+export function isBrowserInfrastructureError(error) {
+  return /All CDP discovery methods failed|(?:CDP|DevTools|WebSocket).*(?:fail|refus|timeout|timed out|closed|unavailable)|Protocol error.*(?:Browser|Page|Target)\.|(?:failed|unable) to (?:launch|start) (?:the )?(?:browser|chrome|chromium)|spawn .*agent-browser.*ENOENT/i.test(textOf(error?.message || error))
+}
+
 async function browserCheck(root, url, label) {
   if (packageUses(root, '@open-dy/threejs')) {
     console.log(`[vibecoding:verify] ${label}: skipping browser runtime check for @open-dy/threejs`)
@@ -529,7 +552,19 @@ async function browserCheck(root, url, label) {
   }
   parseHttpUrl(url, label)
   const session = process.env.AGENT_BROWSER_SESSION || `vibecoding-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
-  const call = (args, allowFailure = false) => runCaptured('agent-browser', ['--session', session, ...args], { allowFailure })
+  const command = resolveAgentBrowserCommand()
+  const call = async (args, allowFailure = false) => {
+    try {
+      return await runCaptured(command, ['--session', session, ...args], {
+        allowFailure, timeoutMs: args[0] === 'close' ? 5000 : 120_000, label: `agent-browser ${args[0]}`,
+      })
+    } catch (error) {
+      if (isBrowserInfrastructureError(error)) {
+        throw new CliError(`infra_browser: Browser infrastructure unavailable; runtime_status=unverified for ${url}. ${error.message}`)
+      }
+      throw error
+    }
+  }
   try {
     await call(['network', 'requests'], true)
     await call(['open', url])
@@ -565,7 +600,9 @@ async function browserCheck(root, url, label) {
       throw new CliError(`${label} runtime check found ${findings.length} issue(s):\n${findings.map((item) => `- ${flatten(item)}`).join('\n')}`)
     }
   } finally {
-    await call(['close'], true)
+    await call(['close'], true).catch((error) => {
+      console.log(`[vibecoding:verify] browser cleanup failed: ${error.message}`)
+    })
   }
 }
 
@@ -586,7 +623,6 @@ export async function runVerify(context, options = {}) {
   options = { timeoutSeconds: 90, ...options, full }
   const frontendUrl = resolveFrontendUrl(context, options)
   parseHttpUrl(frontendUrl, 'frontend')
-  if (full) await waitForDevInstall(context, options.timeoutSeconds)
   if (full || options.staticOnly) await runStatic(context)
   if (options.staticOnly) return
 

package/src/core/runner.mjs

@@ -45,6 +45,8 @@ export function runCaptured(command, args = [], options = {}) {
       env: { ...process.env, ...options.env },
       stdio: ['ignore', 'pipe', 'pipe'],
       shell: false,
+      signal: options.timeoutMs > 0 ? AbortSignal.timeout(options.timeoutMs) : undefined,
+      killSignal: 'SIGKILL',
     })
     let stdout = ''
     let stderr = ''
@@ -52,7 +54,15 @@ export function runCaptured(command, args = [], options = {}) {
     child.stderr.setEncoding('utf8')
     child.stdout.on('data', (chunk) => { stdout += chunk })
     child.stderr.on('data', (chunk) => { stderr += chunk })
-    child.on('error', (error) => reject(new CliError(error.message)))
+    child.on('error', (error) => {
+      if (error.code === 'ABORT_ERR') {
+        child.stdout.destroy()
+        child.stderr.destroy()
+        reject(new CliError(`${options.label ?? path.basename(command)} timed out after ${options.timeoutMs}ms\n${stderr || stdout}`))
+      } else {
+        reject(new CliError(error.message))
+      }
+    })
     child.on('exit', (code) => {
       if (code === 0 || options.allowFailure) {
         resolve({ code: code ?? 1, stdout, stderr })

package/src/validators/server-artifact.mjs

@@ -0,0 +1,69 @@
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs'
+import path from 'node:path'
+import { CliError } from '../core/errors.mjs'
+
+// Shared with pack: count only paths copied into each server archive.
+export const REQUIRED_SERVER_INCLUDES = ['dist', 'Dockerfile', 'package.json', 'run.sh']
+export const OPTIONAL_SERVER_INCLUDES = ['sql', 'scripts']
+const MAX_FILE_COUNT = 1000
+const CLI_PACK_WRAPPER = [
+  'set -Eeuo pipefail',
+  'ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"',
+  'cd "$ROOT"',
+  `CLI_ROOT="$(node -p 'require("node:path").dirname(require.resolve("@open-dy/vibecoding-cli/package.json"))')"`,
+  'exec node "$CLI_ROOT/src/scripts/pack.mjs" "$ROOT"',
+].join('\n')
+
+function readPackIncludes(packScriptPath) {
+  const script = readFileSync(packScriptPath, 'utf8')
+  const normalized = script.split(/\r?\n/).map(line => line.trim())
+    .filter(line => line && !line.startsWith('#')).join('\n')
+  if (normalized === CLI_PACK_WRAPPER) {
+    return { required: REQUIRED_SERVER_INCLUDES, optional: OPTIONAL_SERVER_INCLUDES }
+  }
+  const parse = name => {
+    const match = script.match(new RegExp(`^\\s*${name}=\\(([^)]*)\\)`, 'm'))
+    if (!match) throw new Error(`scripts/pack.sh does not define ${name}`)
+    return (match[1].match(/(?:"[^"]*"|'[^']*'|\S)+/g) || [])
+      .map(item => item.replace(/^['"]|['"]$/g, ''))
+  }
+  return { required: parse('REQUIRED_SERVER_INCLUDES'), optional: parse('OPTIONAL_SERVER_INCLUDES') }
+}
+
+function countFiles(target) {
+  if (!lstatSync(target).isDirectory()) return 1
+  return readdirSync(target).reduce((total, name) => total + countFiles(path.join(target, name)), 0)
+}
+
+export function validateServerArtifactFileCount(serverRoot, { packScriptPath } = {}) {
+  if (!existsSync(serverRoot)) {
+    console.warn(`[verify] static:server-artifact-file-count skipped missing server directory: ${serverRoot}.`)
+    return { skipped: true }
+  }
+  let includes = { required: REQUIRED_SERVER_INCLUDES, optional: OPTIONAL_SERVER_INCLUDES }
+  let countSource = 'the CLI server archive includes'
+  if (packScriptPath) {
+    try {
+      includes = readPackIncludes(packScriptPath)
+      countSource = `${packScriptPath} server.zip includes: ${[...includes.required, ...includes.optional].join(', ')}`
+    } catch (error) {
+      includes = null
+      countSource = 'the entire server directory'
+      console.warn(`[verify] static:server-artifact-file-count could not parse ${packScriptPath}; conservatively counting ${serverRoot}: ${error.message}.`)
+    }
+  }
+  const missing = includes?.required.filter(name => !existsSync(path.join(serverRoot, name))) ?? []
+  const count = includes
+    ? [...includes.required, ...includes.optional]
+      .filter(name => existsSync(path.join(serverRoot, name)))
+      .reduce((total, name) => total + countFiles(path.join(serverRoot, name)), 0)
+    : countFiles(serverRoot)
+  if (count > MAX_FILE_COUNT) {
+    throw new CliError(`Packed server artifact ${serverRoot} would contain ${count} files, exceeding the limit ${MAX_FILE_COUNT}. This count follows ${countSource}. Reduce files included by pack before submission.`)
+  }
+  if (missing.length) {
+    console.warn(`[verify] static:server-artifact-file-count skipped missing required paths in ${serverRoot}: ${missing.join(', ')}.`)
+  }
+  console.log(`[verify] static:server-artifact-file-count → ${missing.length ? 'PARTIAL' : 'OK'} (${count}/${MAX_FILE_COUNT}, ${serverRoot}).`)
+  return { skipped: false, count, missing }
+}