@pmate/cli 0.35.12 → 0.35.13

package/README.md

@@ -270,7 +270,7 @@ Meili's Host may pass `--actor-profile-id` with `PMATE_LOG_DELEGATE_TOKEN` in th
 
 Packaged installers are automatically uploaded to Aliyun OSS (`parrot-static`), using the same credentials as Android APK releases. The completion output and build report include public download URLs, SHA-256 checksums, and a `release.json` URL. Configure `oss.public.region` and `aliyun.ak/sk` in your PMate configuration. Conflicting published versions require an app version bump. `--dir` produces local unpacked output only; `--dry-run` does not upload.
 
-`pmate app build <ns:app> --target electron --config <file>` builds the configured web app, embeds its static output in an Electron ASAR, and produces a macOS DMG and ZIP. It does not require registry login. The first build downloads pinned Electron and electron-builder versions. Current targets: macOS `arm64` and `x64`, built on macOS.
+`pmate app build <ns:app> --target electron --config <file>` builds the configured web app, embeds its static output in an Electron ASAR, and produces a macOS DMG and ZIP. Packaged releases require a CLI login with admin permission in the app namespace; `--dir` and `--dry-run` stay local. The first build downloads pinned Electron and electron-builder versions. Current targets: macOS and Windows, `arm64` and `x64`; macOS packages require a macOS build host.
 
 ```sh
 pmate app build pmate:hello --target electron --config apps/hello/desktop.config.json --platform mac --arch arm64 --out-dir release/desktop
@@ -294,12 +294,22 @@ Config (paths relative to the config file, `web.dist` relative to `web.cwd`):
 
 Use `--dry-run` to inspect the plan, `--dir` for an unpacked `.app`, or `--signed` to require a configured macOS signing identity. Default builds are ad-hoc signed for local use; they are not notarized distribution releases. Signed builds use electron-builder's standard signing/notarization environment variables; verify notarization separately before distributing.
 
-The shell serves the bundled renderer under its existing exact HTTPS origin, preserving authentication callbacks and API CORS. Other origins remain normal network requests. Static resources are hashed and checked at launch; missing assets return 404. The renderer is sandboxed with Node disabled and no privileged preload bridge. Sign-in, chat and inference still require internet. Updates require a new package. Each build prints its artifact directory and a resource/signing report; no build uploads or auto-updates occur.
+The shell serves the bundled renderer under its existing exact HTTPS origin, preserving authentication callbacks and API CORS. Other origins remain normal network requests. Static resources are hashed and checked at launch; missing assets return 404. The renderer is sandboxed with Node disabled and no privileged preload bridge. Sign-in, chat and inference still require internet. The native application menu includes **检查更新…**. It queries apps-api, compares stable versions, and opens the official installer download after confirmation. Installation remains manual. Each build prints its artifact directory and a resource/signing report; packaged releases upload installers and register the version; `--dir` stays local.
 
 ### 日志统计默认口径
 
 请求次数与日均可使用 `pmate logs aggregate pmate:issues-api --metric count --topic application --field event=http.access --interval day --timezone Asia/Shanghai --from <ISO> --to <ISO> --json`。计数由数据库完成，返回 `count`、`durationDays`、`averagePerDay`，时间桶包含零值；不返回 UV 或延迟百分位。JSON 模式失败以非零状态退出并返回固定 `error.code`，区分权限、保留期、查询预算和上游故障，避免泄露上游原始错误。
 
+### Desktop version registry
+
+Desktop clients need a stable way to discover releases without knowing their versioned OSS path. Apps-api owns this index; installer metadata and checksums remain in OSS `release.json`.
+
+`GET https://apps-api.pmate.chat/versions/pmate:hello?platform=mac&arch=arm64` is public and returns `{ success: true, data: { app, version, platform, arch, manifestUrl, publishedAt, publishedBy, id } }`. A missing release returns 404; it does not mean the installed client is current. Supported targets are `mac|win` and `arm64|x64`. Only stable `major.minor.patch` versions are published.
+
+After installers and their immutable manifest upload successfully, the build calls `POST /versions/:appRef` with `{ version, platform, arch, manifestUrl }` using the existing CLI session. Apps-api requires namespace admin permission and validates the official manifest identity and installer metadata. Older releases never supersede a higher version for the same target. `PMATE_APPS_API_BASE_URL` selects the publisher API; distributed clients query the production API.
+
+A registration failure fails the release command, while preserving already uploaded installers. Once API access is repaired, retry the same POST with the manifest URL in the build report; do not rebuild different bytes under that version. Manual registration of an already published release is idempotent. Native checks have a timeout, reject mismatched targets and external download hosts, and never clear user data or restart the app.
+
 ### Android release signing
 
 `pmate service apk release <service> --env prod --variant release` resolves signing credentials from that service's server-side environment (host variables and local signing environment variables are not used). Configure `ANDROID_KEYSTORE_BASE64`, `ANDROID_KEYSTORE_PASSWORD`, `ANDROID_KEY_ALIAS`, and `ANDROID_KEY_PASSWORD` as Service Secrets, plus `ANDROID_SIGNING_CERT_SHA256` as the expected certificate fingerprint. Android SDK `apksigner` must be installed. The CLI signs the Gradle release APK and verifies its certificate before uploading; missing credentials, invalid signatures, or fingerprint mismatches stop publication. Keystore files use restricted temporary storage and are removed after signing. Existing apps must retain their compatible signing key. Debug builds keep their existing Gradle signing behavior.

package/dist/index.js

@@ -17543,12 +17543,15 @@ var import_node_os9 = require("os");
 var import_node_path24 = __toESM(require("path"));
 
 // src/desktopRelease.ts
+init_sessionStore();
 var import_node_crypto4 = require("crypto");
 var import_node_fs18 = require("fs");
 var import_node_path23 = __toESM(require("path"));
 async function uploadDesktopArtifacts(directory, app, version, platform, arch) {
   const segments = [...app.split(":"), version, platform, arch];
   if (app.split(":").length !== 2 || segments.some((s) => !/^[\w.-]+$/.test(s) || s === "." || s === "..")) throw new Error("Invalid desktop release identity");
+  if (!["mac", "win"].includes(platform) || !["arm64", "x64"].includes(arch) || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version)) throw new Error("Desktop publication requires a stable version and supported target");
+  const { token } = readRequiredSession({ preferredApp: DEFAULT_APP_ID });
   const bucket = "parrot-static";
   const prefix = `desktop/${segments.join("/")}/`;
   const url = (key) => `https://parrot-static.pmate.chat/${key.split("/").map(encodeURIComponent).join("/")}`;
@@ -17564,6 +17567,16 @@ async function uploadDesktopArtifacts(directory, app, version, platform, arch) {
   if (existing !== null && JSON.stringify(existing) !== JSON.stringify(release)) throw new Error("Desktop release already exists with different artifacts; bump the app version");
   for (const artifact of artifacts) await AliyunService.uploadFile(import_node_path23.default.join(directory, artifact.name), bucket, artifact.objectKey);
   await AliyunService.uploadJsonObject(bucket, manifestKey, release);
+  const base = (process.env.PMATE_APPS_API_BASE_URL || "https://apps-api.pmate.chat").replace(/\/+$/, "");
+  const response = await fetch(`${base}/versions/${encodeURIComponent(app)}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ version, platform, arch, manifestUrl: url(manifestKey) }),
+    signal: AbortSignal.timeout(3e4),
+    redirect: "error"
+  });
+  const result = await response.json();
+  if (!response.ok || result.success !== true) throw new Error(`Installers uploaded but version registration failed: ${result.message || response.status}. Retry this release before announcing it.`);
   return { bucket, manifestUrl: url(manifestKey), downloads: artifacts };
 }
 

package/dist/templates/electron/main.cjs

@@ -1,3 +1,4 @@
+const { createUpdateChecker } = require('./updates.cjs')
 const { app, BrowserWindow, session, shell, Menu, desktopCapturer, ipcMain, Notification, dialog } = require('electron')
 const path = require('node:path')
 const { installNotificationSettings } = require('./notification-settings.cjs')
@@ -60,9 +61,10 @@ else {
       return false
     })
     installNotificationSettings({ ipcMain, shell, origin: config.origin, getWindow: () => mainWindow })
+    const checkForUpdates = createUpdateChecker({ app, dialog, shell, appId: config.app })
     Menu.setApplicationMenu(Menu.buildFromTemplate([
       { role: 'appMenu' }, { role: 'editMenu' }, { role: 'viewMenu' }, { role: 'windowMenu' },
-      { label: config.productName, submenu: [{ label: 'Back to app', click: () => { if (!mainWindow) createWindow(); else void mainWindow.loadURL(config.origin) } }] },
+      { label: config.productName, submenu: [{ label: '检查更新…', click: checkForUpdates }, { type: 'separator' }, { label: 'Back to app', click: () => { if (!mainWindow) createWindow(); else void mainWindow.loadURL(config.origin) } }] },
     ]))
     desktopNotifications = createDesktopNotifications({ ipcMain, Notification, origin: config.origin, appId: config.app, getWindow: () => mainWindow, showWindow: () => {
       if (!mainWindow) createWindow()

package/dist/templates/electron/updates.cjs

@@ -0,0 +1,51 @@
+const API = 'https://apps-api.pmate.chat'
+const CDN = 'https://parrot-static.pmate.chat'
+const stable = value => typeof value === 'string' && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value)
+function compareVersions(a, b) {
+  if (!stable(a) || !stable(b)) throw new Error('Invalid stable version')
+  const left = a.split('.').map(BigInt), right = b.split('.').map(BigInt)
+  for (let i = 0; i < 3; i++) if (left[i] !== right[i]) return left[i] > right[i] ? 1 : -1
+  return 0
+}
+async function findUpdate({ appId, currentVersion, platform, arch, fetchImpl = fetch }) {
+  const target = platform === 'darwin' ? 'mac' : platform === 'win32' ? 'win' : null
+  if (!target || !['arm64', 'x64'].includes(arch)) throw new Error('Unsupported update target')
+  const read = async url => {
+    const response = await fetchImpl(url, { signal: AbortSignal.timeout(15000), redirect: 'error', cache: 'no-store' })
+    if (!response.ok) throw new Error(`Update request failed (${response.status})`)
+    return response.json()
+  }
+  const envelope = await read(`${API}/versions/${encodeURIComponent(appId)}?platform=${target}&arch=${arch}`)
+  const release = envelope.data
+  if (envelope.success !== true || !release || release.app !== appId || release.platform !== target || release.arch !== arch || !stable(release.version)) throw new Error('Invalid version response')
+  if (compareVersions(release.version, currentVersion) <= 0) return null
+  const prefix = `${CDN}/desktop/${appId.split(':').map(encodeURIComponent).join('/')}/${release.version}/${target}/${arch}/`
+  if (release.manifestUrl !== prefix + 'release.json') throw new Error('Untrusted release manifest')
+  const manifest = await read(release.manifestUrl)
+  if (manifest.schemaVersion !== 1 || manifest.app !== appId || manifest.version !== release.version || manifest.platform !== target || manifest.arch !== arch || !Array.isArray(manifest.artifacts)) throw new Error('Release manifest mismatch')
+  const extension = target === 'mac' ? '.dmg' : '.exe'
+  const installer = manifest.artifacts.find(item => typeof item.name === 'string' && item.name.toLowerCase().endsWith(extension))
+  if (!installer || /[/\\]/.test(installer.name) || installer.downloadUrl !== prefix + encodeURIComponent(installer.name) || !/^[a-f0-9]{64}$/.test(installer.sha256) || !Number.isSafeInteger(installer.size) || installer.size <= 0) throw new Error('Invalid update installer')
+  return { version: release.version, ...installer }
+}
+function createUpdateChecker({ app, dialog, shell, appId, platform = process.platform, arch = process.arch, fetchImpl = fetch }) {
+  let checking = false
+  return async function checkForUpdates() {
+    if (checking) return
+    checking = true
+    try {
+      const currentVersion = app.getVersion()
+      const update = await findUpdate({ appId, currentVersion, platform, arch, fetchImpl })
+      if (!update) {
+        await dialog.showMessageBox({ type: 'info', title: '检查更新', message: '已是最新版本', detail: `当前版本：${currentVersion}`, buttons: ['确定'] })
+        return
+      }
+      const result = await dialog.showMessageBox({ type: 'info', title: '发现新版本', message: `${app.getName()} ${update.version}`, detail: `当前版本：${currentVersion}\n新版：${update.version}\n下载后打开安装包完成升级。`, buttons: ['下载新版', '稍后'], defaultId: 0, cancelId: 1 })
+      if (result.response === 0) await shell.openExternal(update.downloadUrl)
+    } catch (error) {
+      console.error('Desktop update check failed:', error)
+      await dialog.showMessageBox({ type: 'error', title: '检查更新失败', message: '无法检查更新，请稍后重试。', buttons: ['确定'] })
+    } finally { checking = false }
+  }
+}
+module.exports = { compareVersions, findUpdate, createUpdateChecker }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.35.12",
+  "version": "0.35.13",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {