@open-dy/vibecoding-cli 0.1.1 → 0.1.2-beta.0

package/README.md

@@ -32,13 +32,15 @@ Turbo 构建应通过 CLI 包装命令执行，例如 `vibecoding turbo --target
 
 Schema 统一使用 `custom-card-schema.json`。`config/card-routing.json` 的 `cardData.serviceDomain`（`open` / `closed`）是卡片服务域的唯一来源；构建时会据此注入 OpenCard 常量。优先保留项目 `scripts/schemas/`、`feed/` 中的本地 Schema 约束，没有时使用 CLI 内置 Schema。内外场构建后的项目 Schema 仍受支持。
 
+CLI 内置 Schema 与通用小程序模板支持可选 `BgMusicUrl`；填写时必须为 HTTPS 字符串，校验会保留完整 URL。兴趣卡模板的本地 Schema 继续要求必填，不会被 CLI 兜底规则放宽。
+
 两套模板的 `node scripts/check-routes.js` 与 `node scripts/validate-feed-card.js` 均保留为兼容入口，规则统一来自 CLI 的 CJS validator 导出；CLI 命令本身使用对应的 ESM 外层。程序化调用 `validateFeedCard(context, { touchTimestamp: false })` 可禁用时间戳更新。Ajv 由 CLI 自带；OpenCard Lynx CSS 检查复用 `@open-dy/vibecoding-sdk-opencard/eslint/lint-lynx-css`。
 
 `pack --target taro` 默认先清理 `/tmp/microapp_artifacts`，由 CLI 编排 TT 生产构建、server 生产构建以及存在的封闭域服务和 OpenCard 构建，再生成归档。包含 `microapp.zip`、`server.zip`、`Dockerfile`、`run.sh`；存在封闭域服务时追加 `closed-domain-server.zip`、`closed-domain-Dockerfile`、`closed-domain-run.sh`，存在路由配置时复制 `card-routing.json`，存在 OpenCard 时生成 `opencard.zip`。两个 server 每次均构建，不受卡片域开关影响。旧项目若自行提供 `build:pack`，CLI 仍会传递 `ARTIFACTS_DIR` 兼容其产物；两套当前模板均不依赖该分支。
 
 服务包仅包含 `dist`、生成的 `Dockerfile`、`package.json`、`run.sh` 以及可选的 `sql`、`scripts`。生成 Dockerfile 时按原脚本规则为每条 `COPY package.json` 追加存在的目录，项目源文件不改写。构建/zip 失败保留退出码，临时目录在失败时也会清理。
 
-`verify` 的静态阶段在构建通过后，保留主工程 `server.zip` 的文件数预检（阈值 `1000`，超限失败）。标准 CLI 模板使用打包共用的清单；自定义 `scripts/pack.sh` 使用其 `REQUIRED_SERVER_INCLUDES` / `OPTIONAL_SERVER_INCLUDES`。脚本缺失或清单无法解析时，warning 并保守统计整个 `server/`；缺少目录或必需文件时明确报告未覆盖范围。检查范围不扩大到封闭域服务，不生成 ZIP，也不验证压缩包大小。静态检查不等待 dev 的安装成功日志；自动启动预览后仍等待安装与端口就绪。
+`verify` 的静态阶段在构建通过后，校验主工程 `server.zip` 的文件数（阈值 `1000`，超限失败），不生成 ZIP 或计算压缩包大小。标准 CLI 模板与打包共享黑名单：任意层级过滤依赖、缓存、测试目录、环境文件和私钥，保留其余业务资源。自定义 `scripts/pack.sh` 支持 `REQUIRED_SERVER_PATHS` / `SERVER_PACK_EXCLUDES` / `SERVER_PACK_EXCLUDE_GLOBS`，兼容旧的 `REQUIRED_SERVER_INCLUDES` / `OPTIONAL_SERVER_INCLUDES`；脚本缺失或无法解析、服务目录或必需文件缺失均失败。`pack` 对普通和封闭域服务应用同一规则，并重写各自的 `.dockerignore`，使 ZIP 与镜像包含相同资源。静态检查不等待 dev 的安装成功日志；自动启动预览后仍等待安装与端口就绪。
 
 浏览器验收优先使用 `agent-browser-real`，不可用时使用 `agent-browser`。浏览器命令只在验收阶段查找；CDP / 浏览器基础设施失败会报告 `infra_browser` 和 `runtime_status=unverified`，继续以非零退出码结束，页面与业务错误仍按实际错误判定。
 

package/assets/schemas/custom-card-schema.json

@@ -58,6 +58,11 @@
       "type": "string",
       "description": "主色调。取脚本输出的 baseColor.hex 写入。仅当用户明确指定主色调时才自行覆盖。颜色格式为十六进制，例如：#051328"
     },
+    "BgMusicUrl": {
+      "type": "string",
+      "description": "背景音乐 HTTPS URL，由宿主播放。必须使用真实地址，完整保留 query 参数；填写时不得使用空字符串、占位符或本地路径。",
+      "pattern": "^https://"
+    },
     "ContentInfoList": {
       "type": "array",
       "minItems": 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-dy/vibecoding-cli",
-  "version": "0.1.1",
+  "version": "0.1.2-beta.0",
   "description": "Command orchestration, validation and packaging for Douyin vibecoding Taro and OpenCard projects.",
   "type": "module",
   "bin": {
@@ -43,8 +43,8 @@
     "ajv": "^8.18.0"
   },
   "peerDependencies": {
-    "@open-dy/vibecoding-sdk-taro": "0.1.1",
-    "@open-dy/vibecoding-sdk-opencard": "0.1.1"
+    "@open-dy/vibecoding-sdk-taro": "0.1.0-beta.0",
+    "@open-dy/vibecoding-sdk-opencard": "0.1.2-beta.0"
   },
   "peerDependenciesMeta": {
     "@open-dy/vibecoding-sdk-taro": {
@@ -60,7 +60,7 @@
   "license": "UNLICENSED",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
-    "tag": "latest",
+    "tag": "beta",
     "access": "public"
   }
 }

package/release-provenance.json

@@ -2,14 +2,14 @@
   "schema": 1,
   "producer": "vibecoding-cli",
   "packageName": "@open-dy/vibecoding-cli",
-  "version": "0.1.1",
+  "version": "0.1.2-beta.0",
   "source": {
-    "digest": "sha256-77d7b0ea1db52eb5a77054124658253f9fd7ad00337333b458128404d0553c84",
+    "digest": "sha256-9edd66d93aac634a22044fed8f9604c4ecc19427961ec47e0277d7271c1eeb5e",
     "files": 85
   },
-  "payload": "sha256-2d69be237f533820ad35349d4403ccd8307ffb897211a3cbef4a522d72840247",
+  "payload": "sha256-e2191ec6f36d8e7e22d5f257216a6da9268634869ff7fe1562faab1499c446f5",
   "toolchain": {
-    "node": "v22.22.3",
+    "node": "v22.18.0",
     "packageManager": null
   }
 }

package/src/commands/pack.mjs

@@ -17,7 +17,7 @@ import { CliError } from '../core/errors.mjs'
 import { resolveProjectContext } from '../core/context.mjs'
 import { buildOpenCard, buildPackInputs } from './build.mjs'
 import { readCardRouting } from '../build/opencard-environment.mjs'
-import { REQUIRED_SERVER_INCLUDES, OPTIONAL_SERVER_INCLUDES } from '../validators/server-artifact.mjs'
+import { REQUIRED_SERVER_INCLUDES, isServerPackExcluded, serverDockerignore } from '../validators/server-artifact.mjs'
 
 const DEFAULT_ARTIFACTS = '/tmp/microapp_artifacts'
 
@@ -65,33 +65,23 @@ function resolveArtifactsDirectory(root, requested) {
   return absolute
 }
 
-async function zipDirectory(directory, output, { removeExisting = true } = {}) {
+async function zipDirectory(directory, output) {
   if (!isDirectory(directory)) throw new CliError(`Pack input is missing: ${directory}`)
-  if (removeExisting) rmSync(output, { force: true })
+  rmSync(output, { force: true })
   await runPackProcess('zip', ['-rq', output, '.'], { cwd: directory })
 }
 
 function createServerStage(server, stage) {
-  if (!isDirectory(server)) throw new CliError(`Server pack input is missing: ${server}`)
   for (const name of REQUIRED_SERVER_INCLUDES) {
     if (!existsSync(path.join(server, name))) {
       throw new CliError(`Server pack input is missing: ${path.join(server, name)}`)
     }
   }
-  for (const name of [...REQUIRED_SERVER_INCLUDES, ...OPTIONAL_SERVER_INCLUDES].filter(name => name !== 'Dockerfile')) {
-    const source = path.join(server, name)
-    if (existsSync(source)) cpSync(source, path.join(stage, name), { recursive: true })
-  }
-  let dockerfile = readFileSync(path.join(server, 'Dockerfile'), 'utf8')
-  const additions = []
-  if (isDirectory(path.join(server, 'scripts'))) additions.push('COPY ./scripts ./scripts')
-  if (isDirectory(path.join(server, 'sql'))) additions.push('COPY ./sql ./sql')
-  // Match awk's per-line insertion, including multiple COPY instructions and
-  // its final newline. Files named sql/scripts are copied but are not folders.
-  dockerfile = dockerfile.split('\n').filter((_, index, lines) => index < lines.length - 1 || lines[index] !== '')
-    .flatMap(line => /^COPY package\.json/.test(line) ? [line, ...additions] : [line])
-    .map(line => `${line}\n`).join('')
-  writeFileSync(path.join(stage, 'Dockerfile'), dockerfile)
+  writeFileSync(path.join(server, '.dockerignore'), serverDockerignore())
+  cpSync(server, stage, {
+    recursive: true,
+    filter: source => source === server || !isServerPackExcluded(path.basename(source)),
+  })
   return stage
 }
 
@@ -101,10 +91,14 @@ export async function packOpenCardArtifact(context, artifacts) {
 }
 
 async function packServer(server, artifacts, closed = false) {
+  if (!isDirectory(server)) throw new CliError(`Server pack input is missing: ${server}`)
+  const archive = path.join(artifacts, closed ? 'closed-domain-server.zip' : 'server.zip')
+  // Match pack.sh: discard a hook's archive before checking required inputs.
+  rmSync(archive, { force: true })
   const stage = mkdtempSync(path.join(os.tmpdir(), 'vibecoding-server-pack-'))
   try {
     createServerStage(server, stage)
-    await zipDirectory(stage, path.join(artifacts, closed ? 'closed-domain-server.zip' : 'server.zip'), { removeExisting: false })
+    await zipDirectory(stage, archive)
     cpSync(path.join(stage, 'Dockerfile'), path.join(artifacts, closed ? 'closed-domain-Dockerfile' : 'Dockerfile'))
     cpSync(path.join(server, 'run.sh'), path.join(artifacts, closed ? 'closed-domain-run.sh' : 'run.sh'))
   } finally {

package/src/validators/server-artifact.mjs

@@ -2,9 +2,33 @@ import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs'
 import path from 'node:path'
 import { CliError } from '../core/errors.mjs'
 
-// Shared with pack: count only paths copied into each server archive.
+// Shared with pack: select the same files for validation, ZIPs and Docker contexts.
 export const REQUIRED_SERVER_INCLUDES = ['dist', 'Dockerfile', 'package.json', 'run.sh']
-export const OPTIONAL_SERVER_INCLUDES = ['sql', 'scripts']
+export const SERVER_PACK_EXCLUDES = [
+  'node_modules', '.git', '.github', '.vscode', '.idea', '.turbo', '.cache',
+  'coverage', '.nyc_output', 'test', 'tests', '__tests__', '.aws', '.ssh',
+  '.dockerignore', '.DS_Store',
+]
+export const SERVER_PACK_EXCLUDE_GLOBS = [
+  '.env', '.env.*', '.npmrc', 'id_rsa*', 'id_ed25519*', '*.pem', '*.key',
+  '*.p12', '*.pfx', '*.tsbuildinfo', '*.log',
+]
+const DEFAULT_POLICY = {
+  required: REQUIRED_SERVER_INCLUDES,
+  excludes: SERVER_PACK_EXCLUDES,
+  excludeGlobs: SERVER_PACK_EXCLUDE_GLOBS,
+}
+
+export function isServerPackExcluded(name, policy = DEFAULT_POLICY) {
+  return policy.excludes.includes(name) || policy.excludeGlobs.some(glob => {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')
+    return new RegExp(`^${escaped}$`).test(name)
+  })
+}
+
+export function serverDockerignore() {
+  return [...SERVER_PACK_EXCLUDES, ...SERVER_PACK_EXCLUDE_GLOBS].join('\n') + '\n'
+}
 const MAX_FILE_COUNT = 1000
 const CLI_PACK_WRAPPER = [
   'set -Eeuo pipefail',
@@ -19,7 +43,7 @@ function readPackIncludes(packScriptPath) {
   const normalized = script.split(/\r?\n/).map(line => line.trim())
     .filter(line => line && !line.startsWith('#')).join('\n')
   if (normalized === CLI_PACK_WRAPPER) {
-    return { required: REQUIRED_SERVER_INCLUDES, optional: OPTIONAL_SERVER_INCLUDES }
+    return DEFAULT_POLICY
   }
   const parse = name => {
     const match = script.match(new RegExp(`^\\s*${name}=\\(([^)]*)\\)`, 'm'))
@@ -27,43 +51,39 @@ function readPackIncludes(packScriptPath) {
     return (match[1].match(/(?:"[^"]*"|'[^']*'|\S)+/g) || [])
       .map(item => item.replace(/^['"]|['"]$/g, ''))
   }
+  if (/^\s*SERVER_PACK_EXCLUDES=/m.test(script)) {
+    return { required: parse('REQUIRED_SERVER_PATHS'), excludes: parse('SERVER_PACK_EXCLUDES'), excludeGlobs: parse('SERVER_PACK_EXCLUDE_GLOBS') }
+  }
   return { required: parse('REQUIRED_SERVER_INCLUDES'), optional: parse('OPTIONAL_SERVER_INCLUDES') }
 }
 
-function countFiles(target) {
+function countFiles(target, policy) {
   if (!lstatSync(target).isDirectory()) return 1
-  return readdirSync(target).reduce((total, name) => total + countFiles(path.join(target, name)), 0)
+  return readdirSync(target).reduce((total, name) => total +
+    (policy.excludes && isServerPackExcluded(name, policy) ? 0 : countFiles(path.join(target, name), policy)), 0)
 }
 
 export function validateServerArtifactFileCount(serverRoot, { packScriptPath } = {}) {
-  if (!existsSync(serverRoot)) {
-    console.warn(`[verify] static:server-artifact-file-count skipped missing server directory: ${serverRoot}.`)
-    return { skipped: true }
-  }
-  let includes = { required: REQUIRED_SERVER_INCLUDES, optional: OPTIONAL_SERVER_INCLUDES }
-  let countSource = 'the CLI server archive includes'
+  if (!existsSync(serverRoot)) throw new CliError(`Server directory is missing: ${serverRoot}`)
+  let policy = DEFAULT_POLICY
   if (packScriptPath) {
     try {
-      includes = readPackIncludes(packScriptPath)
-      countSource = `${packScriptPath} server.zip includes: ${[...includes.required, ...includes.optional].join(', ')}`
+      policy = readPackIncludes(packScriptPath)
     } catch (error) {
-      includes = null
-      countSource = 'the entire server directory'
-      console.warn(`[verify] static:server-artifact-file-count could not parse ${packScriptPath}; conservatively counting ${serverRoot}: ${error.message}.`)
+      throw new CliError(`Could not read server pack policy from ${packScriptPath}: ${error.message}`)
     }
   }
-  const missing = includes?.required.filter(name => !existsSync(path.join(serverRoot, name))) ?? []
-  const count = includes
-    ? [...includes.required, ...includes.optional]
-      .filter(name => existsSync(path.join(serverRoot, name)))
-      .reduce((total, name) => total + countFiles(path.join(serverRoot, name)), 0)
-    : countFiles(serverRoot)
-  if (count > MAX_FILE_COUNT) {
-    throw new CliError(`Packed server artifact ${serverRoot} would contain ${count} files, exceeding the limit ${MAX_FILE_COUNT}. This count follows ${countSource}. Reduce files included by pack before submission.`)
+  for (const name of policy.required) {
+    if (!existsSync(path.join(serverRoot, name))) throw new CliError(`Server pack input is missing: ${path.join(serverRoot, name)}`)
+    if (policy.excludes && isServerPackExcluded(name, policy)) throw new CliError(`Server pack exclude policy matches required path: ${name}`)
   }
-  if (missing.length) {
-    console.warn(`[verify] static:server-artifact-file-count skipped missing required paths in ${serverRoot}: ${missing.join(', ')}.`)
+  const paths = policy.excludes
+    ? readdirSync(serverRoot).filter(name => !isServerPackExcluded(name, policy))
+    : [...policy.required, ...policy.optional].filter(name => existsSync(path.join(serverRoot, name)))
+  const count = paths.reduce((total, name) => total + countFiles(path.join(serverRoot, name), policy), 0)
+  if (count > MAX_FILE_COUNT) {
+    throw new CliError(`Packed server artifact ${serverRoot} would contain ${count} files, exceeding the limit ${MAX_FILE_COUNT}. This count follows the server pack policy. Reduce files included by pack before submission.`)
   }
-  console.log(`[verify] static:server-artifact-file-count → ${missing.length ? 'PARTIAL' : 'OK'} (${count}/${MAX_FILE_COUNT}, ${serverRoot}).`)
-  return { skipped: false, count, missing }
+  console.log(`[verify] static:server-artifact-file-count → OK (${count}/${MAX_FILE_COUNT}, ${serverRoot}).`)
+  return { skipped: false, count, missing: [] }
 }