@open-dy/vibecoding-cli 0.1.0 → 0.1.1-beta.0

package/README.md

@@ -24,6 +24,12 @@ Turbo 构建应通过 CLI 包装命令执行，例如 `vibecoding turbo --target
 
 `vibecoding validate feed-card --target taro` 与 `verify` 的 Feed 卡片检查共享同一实现。它保留原模板脚本的校验：OpenCard 与 Feed 文件的存在关系、JSON 语法、`TemplateType=5` / `TemplateStyleType=6`、`APP_ID` / `OPEN_CARD_ID`、全部 Schema 错误，以及通过后尽力更新 `__timestamp`。失败时不改写 Feed 文件。
 
+兴趣卡的 Feed 缓存同步由 CLI 内部适配器负责：当 OpenCard 的 `build:raw.inputs` 声明
+`.cache-inputs/feed-card.json` 时，启动 Turbo 前先将 `../feed/feed-card.json` 原样复制到该缓存文件；
+源文件缺失时清空缓存副本，同步失败则停止构建。原始 Feed 配置不被改写，其他 target 或未声明该输入的工程不执行同步。
+新模板仅调用 `vibecoding turbo --target opencard run build:raw`，需要与包含此能力的 CLI 版本一起交付。
+历史工程保留原有 `node scripts/sync-feed-card-input.mjs && …` 前缀也兼容，无需重装模板或覆盖业务配置。
+
 Schema 统一使用 `custom-card-schema.json`。`config/card-routing.json` 的 `cardData.serviceDomain`（`open` / `closed`）是卡片服务域的唯一来源；构建时会据此注入 OpenCard 常量。优先保留项目 `scripts/schemas/`、`feed/` 中的本地 Schema 约束，没有时使用 CLI 内置 Schema。内外场构建后的项目 Schema 仍受支持。
 
 两套模板的 `node scripts/check-routes.js` 与 `node scripts/validate-feed-card.js` 均保留为兼容入口，规则统一来自 CLI 的 CJS validator 导出；CLI 命令本身使用对应的 ESM 外层。程序化调用 `validateFeedCard(context, { touchTimestamp: false })` 可禁用时间戳更新。Ajv 由 CLI 自带；OpenCard Lynx CSS 检查复用 `@open-dy/vibecoding-sdk-opencard/eslint/lint-lynx-css`。
@@ -32,7 +38,7 @@ Schema 统一使用 `custom-card-schema.json`。`config/card-routing.json` 的 `
 
 服务包仅包含 `dist`、生成的 `Dockerfile`、`package.json`、`run.sh` 以及可选的 `sql`、`scripts`。生成 Dockerfile 时按原脚本规则为每条 `COPY package.json` 追加存在的目录，项目源文件不改写。构建/zip 失败保留退出码，临时目录在失败时也会清理。
 
-`verify` 的静态阶段在构建通过后，保留主工程 `server.zip` 的文件数预检（阈值 `1000`，超限失败）。标准 CLI 模板使用打包共用的清单；自定义 `scripts/pack.sh` 使用其 `REQUIRED_SERVER_INCLUDES` / `OPTIONAL_SERVER_INCLUDES`。脚本缺失或清单无法解析时，warning 并保守统计整个 `server/`；缺少目录或必需文件时明确报告未覆盖范围。检查范围不扩大到封闭域服务，不生成 ZIP，也不验证压缩包大小。静态检查不等待 dev 的安装成功日志；自动启动预览后仍等待安装与端口就绪。
+`verify` 的静态阶段在构建通过后，校验主工程 `server.zip` 的文件数（阈值 `1000`，超限失败），不生成 ZIP 或计算压缩包大小。标准 CLI 模板与打包共享黑名单：任意层级过滤依赖、缓存、测试目录、环境文件和私钥，保留其余业务资源。自定义 `scripts/pack.sh` 支持 `REQUIRED_SERVER_PATHS` / `SERVER_PACK_EXCLUDES` / `SERVER_PACK_EXCLUDE_GLOBS`，兼容旧的 `REQUIRED_SERVER_INCLUDES` / `OPTIONAL_SERVER_INCLUDES`；脚本缺失或无法解析、服务目录或必需文件缺失均失败。`pack` 对普通和封闭域服务应用同一规则，并重写各自的 `.dockerignore`，使 ZIP 与镜像包含相同资源。静态检查不等待 dev 的安装成功日志；自动启动预览后仍等待安装与端口就绪。
 
 浏览器验收优先使用 `agent-browser-real`，不可用时使用 `agent-browser`。浏览器命令只在验收阶段查找；CDP / 浏览器基础设施失败会报告 `infra_browser` 和 `runtime_status=unverified`，继续以非零退出码结束，页面与业务错误仍按实际错误判定。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-dy/vibecoding-cli",
-  "version": "0.1.0",
+  "version": "0.1.1-beta.0",
   "description": "Command orchestration, validation and packaging for Douyin vibecoding Taro and OpenCard projects.",
   "type": "module",
   "bin": {
@@ -43,8 +43,8 @@
     "ajv": "^8.18.0"
   },
   "peerDependencies": {
-    "@open-dy/vibecoding-sdk-taro": "0.1.0",
-    "@open-dy/vibecoding-sdk-opencard": "0.1.0"
+    "@open-dy/vibecoding-sdk-taro": "0.1.0-beta.0",
+    "@open-dy/vibecoding-sdk-opencard": "0.1.0-beta.0"
   },
   "peerDependenciesMeta": {
     "@open-dy/vibecoding-sdk-taro": {
@@ -60,7 +60,7 @@
   "license": "UNLICENSED",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
-    "tag": "latest",
+    "tag": "beta",
     "access": "public"
   }
 }

package/release-provenance.json

@@ -2,12 +2,12 @@
   "schema": 1,
   "producer": "vibecoding-cli",
   "packageName": "@open-dy/vibecoding-cli",
-  "version": "0.1.0",
+  "version": "0.1.1-beta.0",
   "source": {
-    "digest": "sha256-07a273825a0a8e9dc91058343a3e733044e46875e3315aeabdc1611d73e27e66",
-    "files": 83
+    "digest": "sha256-f70df961e49cdb9152f6141d4168736b82dd8095aa24ce90a40ce67b526039ab",
+    "files": 85
   },
-  "payload": "sha256-788bb423cd6ed9ae6df0b3b25cd20eca43a28470e78eb13bef0fafc391e29c52",
+  "payload": "sha256-46821af7c87fc1f326c66d28ee378600f64cf1ee8fd1108a6303cc7ae64e9a90",
   "toolchain": {
     "node": "v22.22.3",
     "packageManager": null

package/src/adapters/interest-card/opencard/prepare-turbo-inputs.mjs

@@ -0,0 +1,21 @@
+import { copyFile, mkdir, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+
+/**
+ * Prepare the Feed snapshot explicitly declared by interest-card templates.
+ * Keep the legacy source, destination and missing-file behavior: only the cache
+ * copy is written, never the project's Feed configuration.
+ */
+export async function prepareFeedCardInput(projectRoot, config) {
+  if (!config.tasks?.['build:raw']?.inputs?.includes('.cache-inputs/feed-card.json')) return
+  const source = path.resolve(projectRoot, '../feed/feed-card.json')
+  const directory = path.join(projectRoot, '.cache-inputs')
+  const destination = path.join(directory, 'feed-card.json')
+  await mkdir(directory, { recursive: true })
+  if (existsSync(source)) {
+    await copyFile(source, destination)
+  } else {
+    await writeFile(destination, '', 'utf8')
+  }
+}

package/src/build/turbo-inputs.mjs

@@ -0,0 +1,8 @@
+import { prepareFeedCardInput } from '../adapters/interest-card/opencard/prepare-turbo-inputs.mjs'
+
+/** Prepare target-specific inputs before Turbo computes any task/cache hashes. */
+export async function prepareTurboInputs(context, config) {
+  if (context.target === 'opencard') {
+    await prepareFeedCardInput(context.root, config)
+  }
+}

package/src/commands/pack.mjs

@@ -17,7 +17,7 @@ import { CliError } from '../core/errors.mjs'
 import { resolveProjectContext } from '../core/context.mjs'
 import { buildOpenCard, buildPackInputs } from './build.mjs'
 import { readCardRouting } from '../build/opencard-environment.mjs'
-import { REQUIRED_SERVER_INCLUDES, OPTIONAL_SERVER_INCLUDES } from '../validators/server-artifact.mjs'
+import { REQUIRED_SERVER_INCLUDES, isServerPackExcluded, serverDockerignore } from '../validators/server-artifact.mjs'
 
 const DEFAULT_ARTIFACTS = '/tmp/microapp_artifacts'
 
@@ -65,33 +65,23 @@ function resolveArtifactsDirectory(root, requested) {
   return absolute
 }
 
-async function zipDirectory(directory, output, { removeExisting = true } = {}) {
+async function zipDirectory(directory, output) {
   if (!isDirectory(directory)) throw new CliError(`Pack input is missing: ${directory}`)
-  if (removeExisting) rmSync(output, { force: true })
+  rmSync(output, { force: true })
   await runPackProcess('zip', ['-rq', output, '.'], { cwd: directory })
 }
 
 function createServerStage(server, stage) {
-  if (!isDirectory(server)) throw new CliError(`Server pack input is missing: ${server}`)
   for (const name of REQUIRED_SERVER_INCLUDES) {
     if (!existsSync(path.join(server, name))) {
       throw new CliError(`Server pack input is missing: ${path.join(server, name)}`)
     }
   }
-  for (const name of [...REQUIRED_SERVER_INCLUDES, ...OPTIONAL_SERVER_INCLUDES].filter(name => name !== 'Dockerfile')) {
-    const source = path.join(server, name)
-    if (existsSync(source)) cpSync(source, path.join(stage, name), { recursive: true })
-  }
-  let dockerfile = readFileSync(path.join(server, 'Dockerfile'), 'utf8')
-  const additions = []
-  if (isDirectory(path.join(server, 'scripts'))) additions.push('COPY ./scripts ./scripts')
-  if (isDirectory(path.join(server, 'sql'))) additions.push('COPY ./sql ./sql')
-  // Match awk's per-line insertion, including multiple COPY instructions and
-  // its final newline. Files named sql/scripts are copied but are not folders.
-  dockerfile = dockerfile.split('\n').filter((_, index, lines) => index < lines.length - 1 || lines[index] !== '')
-    .flatMap(line => /^COPY package\.json/.test(line) ? [line, ...additions] : [line])
-    .map(line => `${line}\n`).join('')
-  writeFileSync(path.join(stage, 'Dockerfile'), dockerfile)
+  writeFileSync(path.join(server, '.dockerignore'), serverDockerignore())
+  cpSync(server, stage, {
+    recursive: true,
+    filter: source => source === server || !isServerPackExcluded(path.basename(source)),
+  })
   return stage
 }
 
@@ -101,10 +91,14 @@ export async function packOpenCardArtifact(context, artifacts) {
 }
 
 async function packServer(server, artifacts, closed = false) {
+  if (!isDirectory(server)) throw new CliError(`Server pack input is missing: ${server}`)
+  const archive = path.join(artifacts, closed ? 'closed-domain-server.zip' : 'server.zip')
+  // Match pack.sh: discard a hook's archive before checking required inputs.
+  rmSync(archive, { force: true })
   const stage = mkdtempSync(path.join(os.tmpdir(), 'vibecoding-server-pack-'))
   try {
     createServerStage(server, stage)
-    await zipDirectory(stage, path.join(artifacts, closed ? 'closed-domain-server.zip' : 'server.zip'), { removeExisting: false })
+    await zipDirectory(stage, archive)
     cpSync(path.join(stage, 'Dockerfile'), path.join(artifacts, closed ? 'closed-domain-Dockerfile' : 'Dockerfile'))
     cpSync(path.join(server, 'run.sh'), path.join(artifacts, closed ? 'closed-domain-run.sh' : 'run.sh'))
   } finally {

package/src/commands/turbo.mjs

@@ -1,6 +1,7 @@
 import path from 'node:path'
 import { openCardBuildEnvironment } from '../build/opencard-environment.mjs'
-import { prepareTurboConfig } from '../build/turbo-config.mjs'
+import { resolveTurboConfig, writeTurboConfig } from '../build/turbo-config.mjs'
+import { prepareTurboInputs } from '../build/turbo-inputs.mjs'
 import { UsageError } from '../core/errors.mjs'
 import { resolveProjectBinary, runProcess } from '../core/runner.mjs'
 
@@ -25,7 +26,9 @@ export async function runTurbo(context, { args = [] } = {}) {
     throw new UsageError('--root-turbo-json is managed by vibecoding turbo and cannot be overridden')
   }
 
-  const config = prepareTurboConfig({ projectRoot: context.root, target: context.target })
+  const resolvedConfig = resolveTurboConfig({ projectRoot: context.root, target: context.target })
+  await prepareTurboInputs(context, resolvedConfig)
+  const config = writeTurboConfig(context.root, resolvedConfig)
   const turboArgs = ['--root-turbo-json', path.relative(context.root, config), ...args]
   const environment = openCardBuildEnvironment(context)
   return runProcess(resolveProjectBinary(context.root, 'turbo'), turboArgs, {

package/src/validators/server-artifact.mjs

@@ -2,9 +2,33 @@ import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs'
 import path from 'node:path'
 import { CliError } from '../core/errors.mjs'
 
-// Shared with pack: count only paths copied into each server archive.
+// Shared with pack: select the same files for validation, ZIPs and Docker contexts.
 export const REQUIRED_SERVER_INCLUDES = ['dist', 'Dockerfile', 'package.json', 'run.sh']
-export const OPTIONAL_SERVER_INCLUDES = ['sql', 'scripts']
+export const SERVER_PACK_EXCLUDES = [
+  'node_modules', '.git', '.github', '.vscode', '.idea', '.turbo', '.cache',
+  'coverage', '.nyc_output', 'test', 'tests', '__tests__', '.aws', '.ssh',
+  '.dockerignore', '.DS_Store',
+]
+export const SERVER_PACK_EXCLUDE_GLOBS = [
+  '.env', '.env.*', '.npmrc', 'id_rsa*', 'id_ed25519*', '*.pem', '*.key',
+  '*.p12', '*.pfx', '*.tsbuildinfo', '*.log',
+]
+const DEFAULT_POLICY = {
+  required: REQUIRED_SERVER_INCLUDES,
+  excludes: SERVER_PACK_EXCLUDES,
+  excludeGlobs: SERVER_PACK_EXCLUDE_GLOBS,
+}
+
+export function isServerPackExcluded(name, policy = DEFAULT_POLICY) {
+  return policy.excludes.includes(name) || policy.excludeGlobs.some(glob => {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')
+    return new RegExp(`^${escaped}$`).test(name)
+  })
+}
+
+export function serverDockerignore() {
+  return [...SERVER_PACK_EXCLUDES, ...SERVER_PACK_EXCLUDE_GLOBS].join('\n') + '\n'
+}
 const MAX_FILE_COUNT = 1000
 const CLI_PACK_WRAPPER = [
   'set -Eeuo pipefail',
@@ -19,7 +43,7 @@ function readPackIncludes(packScriptPath) {
   const normalized = script.split(/\r?\n/).map(line => line.trim())
     .filter(line => line && !line.startsWith('#')).join('\n')
   if (normalized === CLI_PACK_WRAPPER) {
-    return { required: REQUIRED_SERVER_INCLUDES, optional: OPTIONAL_SERVER_INCLUDES }
+    return DEFAULT_POLICY
   }
   const parse = name => {
     const match = script.match(new RegExp(`^\\s*${name}=\\(([^)]*)\\)`, 'm'))
@@ -27,43 +51,39 @@ function readPackIncludes(packScriptPath) {
     return (match[1].match(/(?:"[^"]*"|'[^']*'|\S)+/g) || [])
       .map(item => item.replace(/^['"]|['"]$/g, ''))
   }
+  if (/^\s*SERVER_PACK_EXCLUDES=/m.test(script)) {
+    return { required: parse('REQUIRED_SERVER_PATHS'), excludes: parse('SERVER_PACK_EXCLUDES'), excludeGlobs: parse('SERVER_PACK_EXCLUDE_GLOBS') }
+  }
   return { required: parse('REQUIRED_SERVER_INCLUDES'), optional: parse('OPTIONAL_SERVER_INCLUDES') }
 }
 
-function countFiles(target) {
+function countFiles(target, policy) {
   if (!lstatSync(target).isDirectory()) return 1
-  return readdirSync(target).reduce((total, name) => total + countFiles(path.join(target, name)), 0)
+  return readdirSync(target).reduce((total, name) => total +
+    (policy.excludes && isServerPackExcluded(name, policy) ? 0 : countFiles(path.join(target, name), policy)), 0)
 }
 
 export function validateServerArtifactFileCount(serverRoot, { packScriptPath } = {}) {
-  if (!existsSync(serverRoot)) {
-    console.warn(`[verify] static:server-artifact-file-count skipped missing server directory: ${serverRoot}.`)
-    return { skipped: true }
-  }
-  let includes = { required: REQUIRED_SERVER_INCLUDES, optional: OPTIONAL_SERVER_INCLUDES }
-  let countSource = 'the CLI server archive includes'
+  if (!existsSync(serverRoot)) throw new CliError(`Server directory is missing: ${serverRoot}`)
+  let policy = DEFAULT_POLICY
   if (packScriptPath) {
     try {
-      includes = readPackIncludes(packScriptPath)
-      countSource = `${packScriptPath} server.zip includes: ${[...includes.required, ...includes.optional].join(', ')}`
+      policy = readPackIncludes(packScriptPath)
     } catch (error) {
-      includes = null
-      countSource = 'the entire server directory'
-      console.warn(`[verify] static:server-artifact-file-count could not parse ${packScriptPath}; conservatively counting ${serverRoot}: ${error.message}.`)
+      throw new CliError(`Could not read server pack policy from ${packScriptPath}: ${error.message}`)
     }
   }
-  const missing = includes?.required.filter(name => !existsSync(path.join(serverRoot, name))) ?? []
-  const count = includes
-    ? [...includes.required, ...includes.optional]
-      .filter(name => existsSync(path.join(serverRoot, name)))
-      .reduce((total, name) => total + countFiles(path.join(serverRoot, name)), 0)
-    : countFiles(serverRoot)
-  if (count > MAX_FILE_COUNT) {
-    throw new CliError(`Packed server artifact ${serverRoot} would contain ${count} files, exceeding the limit ${MAX_FILE_COUNT}. This count follows ${countSource}. Reduce files included by pack before submission.`)
+  for (const name of policy.required) {
+    if (!existsSync(path.join(serverRoot, name))) throw new CliError(`Server pack input is missing: ${path.join(serverRoot, name)}`)
+    if (policy.excludes && isServerPackExcluded(name, policy)) throw new CliError(`Server pack exclude policy matches required path: ${name}`)
   }
-  if (missing.length) {
-    console.warn(`[verify] static:server-artifact-file-count skipped missing required paths in ${serverRoot}: ${missing.join(', ')}.`)
+  const paths = policy.excludes
+    ? readdirSync(serverRoot).filter(name => !isServerPackExcluded(name, policy))
+    : [...policy.required, ...policy.optional].filter(name => existsSync(path.join(serverRoot, name)))
+  const count = paths.reduce((total, name) => total + countFiles(path.join(serverRoot, name), policy), 0)
+  if (count > MAX_FILE_COUNT) {
+    throw new CliError(`Packed server artifact ${serverRoot} would contain ${count} files, exceeding the limit ${MAX_FILE_COUNT}. This count follows the server pack policy. Reduce files included by pack before submission.`)
   }
-  console.log(`[verify] static:server-artifact-file-count → ${missing.length ? 'PARTIAL' : 'OK'} (${count}/${MAX_FILE_COUNT}, ${serverRoot}).`)
-  return { skipped: false, count, missing }
+  console.log(`[verify] static:server-artifact-file-count → OK (${count}/${MAX_FILE_COUNT}, ${serverRoot}).`)
+  return { skipped: false, count, missing: [] }
 }