@ranger1/dx 0.1.43 → 0.1.45

package/@opencode/commands/doctor.md

@@ -6,186 +6,229 @@ agent: build
 
 ---
 
-## Step 0: 强制安装 dx CLI
+## Step 0: Bootstrap（dx + 模板 + pnpm）
 
-**无论当前是否安装，必须执行：**
+目标：
+
+- dx 安装/升级到最新
+- 刷新 `~/.opencode/commands/*`（确保 `opencode_attach.py` 可用）
 
 ```bash
-pnpm add -g @ranger1/dx@latest  && dx initial
-```
+set -euo pipefail
 
----
+# 必要前提：node + corepack（用于 pnpm）
+if ! command -v node >/dev/null 2>&1; then
+  echo "ERROR: node NOT_FOUND (need Node.js >= 20)"
+  echo "macOS: brew install node"
+  echo "Debian/Ubuntu: curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs"
+  exit 1
+fi
 
-## Step 1: 并行检测
+if ! command -v pnpm >/dev/null 2>&1; then
+  corepack enable >/dev/null 2>&1 || true
+  corepack prepare pnpm@latest --activate
+fi
 
-**同时执行以下 5 个 Bash 调用（真正并行）：**
+# 安装/升级 dx 到最新（幂等）
+pnpm add -g @ranger1/dx@latest
 
-```bash
-# 批次 1: CLI 版本检测
-echo "=== CLI_VERSIONS ===";
-echo "opencode:" && (which opencode && opencode --version 2>/dev/null || echo "NOT_FOUND");
-echo "dx:" && (which dx && dx --version 2>/dev/null || echo "NOT_FOUND");
-echo "rg:" && (which rg && rg --version 2>/dev/null | head -n 1 || echo "NOT_FOUND");
-echo "agent-browser:" && (which agent-browser && agent-browser --version 2>/dev/null || echo "NOT_FOUND");
-```
+# 备份后刷新模板（避免覆盖导致不可回退）
+ts="$(date +%Y%m%d%H%M%S)"
+if [ -d "$HOME/.opencode/commands" ]; then
+  cp -a "$HOME/.opencode/commands" "$HOME/.opencode/commands.bak.${ts}" 2>/dev/null || true
+fi
+if [ -d "$HOME/.opencode/agents" ]; then
+  cp -a "$HOME/.opencode/agents" "$HOME/.opencode/agents.bak.${ts}" 2>/dev/null || true
+fi
 
-```bash
-# 批次 2: 项目文件检测
-echo "=== PROJECT_FILES ===";
-echo "AGENTS.md:" && (test -f AGENTS.md && echo "FOUND" || echo "NOT_FOUND");
+dx initial
 ```
 
-```bash
-# 批次 3: OpenCode 插件检测
-# 注意:插件名可能带版本号(如 @1.3.0),使用模糊匹配
-echo "=== OPENCODE_PLUGINS ===";
-echo "oh-my-opencode:" && (opencode plugin list 2>/dev/null | grep -q 'oh-my-opencode' && echo "INSTALLED" || echo "NOT_INSTALLED");
-echo "opencode-openai-codex-auth:" && (opencode plugin list 2>/dev/null | grep -q 'opencode-openai-codex-auth' && echo "INSTALLED" || echo "NOT_INSTALLED");
-```
+---
 
-```bash
-# 批次 4: attach 配置（统一）
-echo "=== OPENCODE_ATTACH ===";
-echo "attach:" && (python3 ~/.opencode/commands/opencode_attach.py --dry-run >/dev/null 2>&1 && echo "READY" || echo "NOT_READY");
-```
+## Step 1: 快速检测（单次 Bash）
 
-```bash
-# 批次 5: Python 检测（python3 + python 软链接）
-echo "=== PYTHON ===";
-echo "python3:" && (which python3 && python3 --version 2>/dev/null || echo "NOT_FOUND");
-echo "python:" && (which python && python --version 2>/dev/null || echo "NOT_FOUND");
-```
-
----
+目标：一次 Bash 输出完整状态表，减少 tool 调用与 token。
 
-## Step 2: 输出报告
+```bash
+set -euo pipefail
+
+os="$(uname -s 2>/dev/null || echo unknown)"
+pm="none"
+if command -v brew >/dev/null 2>&1; then pm="brew"; fi
+if command -v apt-get >/dev/null 2>&1; then pm="apt"; fi
+
+ver() {
+  # usage: ver <bin> <cmd>
+  b="$1"; shift
+  if command -v "$b" >/dev/null 2>&1; then
+    ("$@" 2>/dev/null | head -n 1) || true
+  else
+    echo "NOT_FOUND"
+  fi
+}
+
+has_agents="NOT_FOUND"; [ -f AGENTS.md ] && has_agents="FOUND"
+
+dx_v="$(ver dx dx --version)"
+opencode_v="$(ver opencode opencode --version)"
+rg_v="$(ver rg rg --version)"
+agent_browser_v="$(ver agent-browser agent-browser --version)"
+py3_v="$(ver python3 python3 --version)"
+py_v="$(ver python python --version)"
+
+attach_status="NOT_READY"
+if command -v python3 >/dev/null 2>&1 && [ -f "$HOME/.opencode/commands/opencode_attach.py" ]; then
+  python3 "$HOME/.opencode/commands/opencode_attach.py" --dry-run >/dev/null 2>&1 && attach_status="READY" || true
+fi
 
-汇总结果，输出表格：
+# 插件以“配置是否就绪”为准（真正安装由 opencode 启动时自动完成）
+cfg_opencode="$HOME/.config/opencode/opencode.json"
+plug_oh="NOT_CONFIGURED"
+plug_codex="NOT_CONFIGURED"
+plug_antigravity="NOT_CONFIGURED"
+if [ -f "$cfg_opencode" ]; then
+  grep -q 'oh-my-opencode' "$cfg_opencode" && plug_oh="CONFIGURED" || true
+  grep -q 'opencode-openai-codex-auth' "$cfg_opencode" && plug_codex="CONFIGURED" || true
+  grep -q 'opencode-antigravity-auth' "$cfg_opencode" && plug_antigravity="CONFIGURED" || true
+fi
 
-```
-工具                                  | 状态     | 版本
-opencode                              | <状态>   | <版本>
-dx                                    | <状态>   | <版本>
-rg                                    | <状态>   | <版本>
-python3                               | <状态>   | <版本>
-python(软链接)                         | <状态>   | <版本>
-AGENTS.md                             | <状态>   | -
-oh-my-opencode 插件                   | <状态>   | -
-opencode-openai-codex-auth 插件       | <状态>   | -
-agent-browser                         | <状态>   | <版本>
-attach（全局配置写入）                 | <状态>   | -
+echo "OS: ${os} | PM: ${pm}"
+echo
+printf '%-34s | %-12s | %s\n' "tool" "status" "version"
+printf '%-34s | %-12s | %s\n' "opencode" "$( [ "$opencode_v" = NOT_FOUND ] && echo MISSING || echo OK )" "$opencode_v"
+printf '%-34s | %-12s | %s\n' "dx" "$( [ "$dx_v" = NOT_FOUND ] && echo MISSING || echo OK )" "$dx_v"
+printf '%-34s | %-12s | %s\n' "rg" "$( [ "$rg_v" = NOT_FOUND ] && echo MISSING || echo OK )" "$rg_v"
+printf '%-34s | %-12s | %s\n' "agent-browser" "$( [ "$agent_browser_v" = NOT_FOUND ] && echo MISSING || echo OK )" "$agent_browser_v"
+printf '%-34s | %-12s | %s\n' "python3" "$( [ "$py3_v" = NOT_FOUND ] && echo MISSING || echo OK )" "$py3_v"
+printf '%-34s | %-12s | %s\n' "python (softlink)" "$( [ "$py_v" = NOT_FOUND ] && echo MISSING || echo OK )" "$py_v"
+printf '%-34s | %-12s | %s\n' "AGENTS.md" "$has_agents" "-"
+printf '%-34s | %-12s | %s\n' "attach (global config)" "$attach_status" "-"
+printf '%-34s | %-12s | %s\n' "plugin: oh-my-opencode" "$plug_oh" "-"
+printf '%-34s | %-12s | %s\n' "plugin: opencode-openai-codex-auth" "$plug_codex" "-"
+printf '%-34s | %-12s | %s\n' "plugin: opencode-antigravity-auth" "$plug_antigravity" "-"
+
+missing=0
+for x in "$opencode_v" "$dx_v" "$rg_v" "$agent_browser_v" "$py3_v"; do
+  [ "$x" = NOT_FOUND ] && missing=1
+done
+[ "$attach_status" != READY ] && missing=1
+for x in "$plug_oh" "$plug_codex" "$plug_antigravity"; do
+  [ "$x" != CONFIGURED ] && missing=1
+done
+
+echo
+if [ "$missing" = 0 ]; then
+  echo "OK: all dependencies ready"
+else
+  echo "NEED_FIX: missing or not-ready items detected"
+fi
 ```
 
 ---
 
-## Step 3: 统一处理缺失项
-
-**如检测到任何缺失项，统一询问一次：**
-
-`AskUserQuestion`: 检测到以下缺失项，是否自动安装/配置所有？
-
-确认后按顺序处理（需要直接执行对应安装/配置命令，不要只输出提示）：
+## Step 2: 只问一次（缺失/升级）
 
-### 3.1 opencode CLI 未安装
+如果出现 `NEED_FIX`，只问一次：是否一键安装 + 升级到最新版本（包含插件配置 attach）。
 
-执行安装：
+`AskUserQuestion`: 检测到缺失/未就绪项，是否一键修复并升级到最新版本？
 
-```bash
-# brew 优先
-brew install opencode || npm install -g opencode
-```
+选项：
 
-### 3.2 AGENTS.md 未找到
+- 一键修复（Recommended）
+- 跳过（只输出检测表）
 
-提示用户：
-
-- AGENTS.md 文件不存在，OpenCode 需要此文件作为项目指令入口
-- 建议创建或检查文件路径
+---
 
-### 3.3 rg（ripgrep）未安装
+## Step 3: 一键修复（安装 + 升级到最新）
 
-执行安装（幂等：已安装会跳过；缺少包管理器会报错并提示手动安装）：
+确认后直接执行以下脚本（幂等；尽量走包管理器升级；插件用 attach 配置确保可自动安装/更新）：
 
 ```bash
-set -e
+set -euo pipefail
 
-if command -v rg >/dev/null 2>&1; then
-  rg --version 2>/dev/null | head -n 1 || true
-  exit 0
-fi
+os="$(uname -s 2>/dev/null || echo unknown)"
+has_brew=0; command -v brew >/dev/null 2>&1 && has_brew=1
+has_apt=0; command -v apt-get >/dev/null 2>&1 && has_apt=1
 
-if command -v brew >/dev/null 2>&1; then
-  brew install ripgrep
-elif command -v apt-get >/dev/null 2>&1; then
-  sudo apt-get update
-  sudo apt-get install -y ripgrep
-else
-  echo "ripgrep (rg) NOT_FOUND, and no supported package manager (brew/apt-get) detected"
-  echo "Please install ripgrep manually: https://github.com/BurntSushi/ripgrep#installation"
-  exit 1
+need_sudo=0
+if [ "$has_apt" = 1 ] && command -v sudo >/dev/null 2>&1; then
+  need_sudo=1
 fi
 
-rg --version 2>/dev/null | head -n 1 || true
-```
-
-### 3.6 agent-browser 未安装
-
-执行安装：
-
-```bash
-npm install -g agent-browser && agent-browser install
-```
-
-### 3.6.1 python3 未安装
-
-执行安装：
+if ! command -v pnpm >/dev/null 2>&1; then
+  corepack enable >/dev/null 2>&1 || true
+  corepack prepare pnpm@latest --activate
+fi
 
-```bash
-# macOS (Homebrew)
-brew install python
-```
+# dx（始终升级到最新）
+pnpm add -g @ranger1/dx@latest
 
-### 3.6.2 python 命令缺失（需要软链接到 python3）
+if ! command -v dx >/dev/null 2>&1; then
+  echo "WARN: dx still NOT_FOUND (check PATH for pnpm global bin: pnpm bin -g)"
+fi
 
-如果 `python` 不存在但 `python3` 存在，执行：
+# OpenCode 模板（确保 opencode_attach.py 存在）
+if [ ! -f "$HOME/.opencode/commands/opencode_attach.py" ]; then
+  dx initial
+fi
 
-```bash
-set -e
+# opencode CLI
+if [ "$os" = "Darwin" ] && [ "$has_brew" = 1 ]; then
+  brew update >/dev/null
+  brew tap anomalyco/tap >/dev/null 2>&1 || true
+  brew install anomalyco/tap/opencode >/dev/null 2>&1 || brew upgrade opencode >/dev/null 2>&1 || true
+else
+  # 官方支持 npm/bun/pnpm；这里统一用 pnpm
+  pnpm add -g opencode-ai@latest
+fi
 
-if command -v python >/dev/null 2>&1; then
-  python --version
-  exit 0
+if ! command -v opencode >/dev/null 2>&1; then
+  echo "WARN: opencode still NOT_FOUND (check PATH for pnpm global bin: pnpm bin -g)"
 fi
 
-PY3="$(command -v python3 2>/dev/null || true)"
-if [ -z "$PY3" ]; then
-  echo "python3 NOT_FOUND"
-  exit 1
+# ripgrep
+if [ "$has_brew" = 1 ]; then
+  brew install ripgrep >/dev/null 2>&1 || brew upgrade ripgrep >/dev/null 2>&1 || true
+elif [ "$has_apt" = 1 ] && [ "$need_sudo" = 1 ]; then
+  sudo apt-get update -y >/dev/null
+  sudo apt-get install -y ripgrep
+else
+  echo "WARN: no brew/apt-get; skip ripgrep auto-install"
 fi
 
-PY_DIR="$(dirname "$PY3")"
-if [ -w "$PY_DIR" ]; then
-  ln -sf "$PY3" "$PY_DIR/python"
-  echo "linked: $PY_DIR/python -> $PY3"
+# python3 (+ python 软链接尽量走系统包)
+if [ "$has_brew" = 1 ]; then
+  brew install python >/dev/null 2>&1 || brew upgrade python >/dev/null 2>&1 || true
+elif [ "$has_apt" = 1 ] && [ "$need_sudo" = 1 ]; then
+  sudo apt-get update -y >/dev/null
+  sudo apt-get install -y python3 python3-venv python3-pip python-is-python3
 else
-  ln -sf "$PY3" "$HOME/.local/bin/python"
-  echo "linked: $HOME/.local/bin/python -> $PY3"
-  echo "NOTE: ensure $HOME/.local/bin is in PATH"
+  echo "WARN: no brew/apt-get; skip python auto-install"
 fi
 
-python --version
-```
+# agent-browser（安装/升级 + 安装 Chromium）
+if [ "$os" = "Darwin" ] && [ "$has_brew" = 1 ]; then
+  brew install agent-browser >/dev/null 2>&1 || brew upgrade agent-browser >/dev/null 2>&1 || true
+else
+  pnpm add -g agent-browser@latest
+fi
 
-### 3.9 自动 attach（推荐）
+if command -v agent-browser >/dev/null 2>&1; then
+  agent-browser install >/dev/null 2>&1 || agent-browser install --with-deps
+fi
 
-执行 attach（会自动覆盖/新建对应节点，其它不动，并生成备份文件）：
+# attach（写入 ~/.config/opencode/*.json；自动备份 .bak.*）
+if command -v python3 >/dev/null 2>&1 && [ -f "$HOME/.opencode/commands/opencode_attach.py" ]; then
+  python3 "$HOME/.opencode/commands/opencode_attach.py"
+else
+  echo "ERROR: python3/opencode_attach.py NOT_READY"
+  exit 1
+fi
 
-```bash
-python3 ~/.opencode/commands/opencode_attach.py
+echo "DONE"
 ```
 
-
-
 ---
 
 ## 输出格式
@@ -203,4 +246,4 @@ python3 ~/.opencode/commands/opencode_attach.py
 ```
 
 **修复完成后：**
-输出最终状态表格，确认所有项目均为 ✅
+重复执行 Step 1，输出最终状态表格，确认所有项目均为 OK/READY/CONFIGURED。

package/lib/logger.js

@@ -5,6 +5,44 @@ function resolveProjectRoot() {
   return process.env.DX_PROJECT_ROOT || process.cwd()
 }
 
+export function sanitizeForLog(input) {
+  let text = input == null ? '' : String(input)
+
+  // CLI token args (vercel)
+  text = text.replace(/--token=("[^"]*"|'[^']*'|[^\s]+)/gi, '--token=***')
+  text = text.replace(/--token\s+("[^"]*"|'[^']*'|[^\s]+)/gi, '--token ***')
+
+  // Env style secrets
+  text = text.replace(/\bVERCEL_TOKEN=([^\s]+)/g, 'VERCEL_TOKEN=***')
+  text = text.replace(/\bTELEGRAM_BOT_TOKEN=([^\s]+)/g, 'TELEGRAM_BOT_TOKEN=***')
+  text = text.replace(
+    /\bTELEGRAM_BOT_WEBHOOK_SECRET=([^\s]+)/g,
+    'TELEGRAM_BOT_WEBHOOK_SECRET=***',
+  )
+
+  // Authorization bearer
+  text = text.replace(
+    /Authorization:\s*Bearer\s+([^\s]+)/gi,
+    'Authorization: Bearer ***',
+  )
+
+  // JSON-ish token fields
+  text = text.replace(/"token"\s*:\s*"[^"]*"/gi, '"token":"***"')
+  text = text.replace(
+    /("secret_token"\s*:\s*")([^"]*)(")/gi,
+    '$1***$3',
+  )
+  text = text.replace(/\bsecret_token=([^\s&]+)/gi, 'secret_token=***')
+
+  // Telegram bot token in URLs
+  text = text.replace(
+    /api\.telegram\.org\/bot([^/\s]+)(\/|$)/gi,
+    'api.telegram.org/bot***$2',
+  )
+
+  return text
+}
+
 // 处理输出管道被关闭导致的 EPIPE 错误，避免进程在清理阶段崩溃
 try {
   const handleBrokenPipe = err => {
@@ -48,34 +86,39 @@ export class Logger {
 
   // 基础日志方法
   info(message, prefix = '🚀') {
-    const output = `${prefix} ${message}`
+    const safeMessage = sanitizeForLog(message)
+    const output = `${prefix} ${safeMessage}`
     console.log(output)
-    this.writeLog('info', message)
+    this.writeLog('info', safeMessage)
   }
 
   success(message) {
-    const output = `✅ ${message}`
+    const safeMessage = sanitizeForLog(message)
+    const output = `✅ ${safeMessage}`
     console.log(output)
-    this.writeLog('success', message)
+    this.writeLog('success', safeMessage)
   }
 
   warn(message) {
-    const output = `⚠️  ${message}`
+    const safeMessage = sanitizeForLog(message)
+    const output = `⚠️  ${safeMessage}`
     console.log(output)
-    this.writeLog('warn', message)
+    this.writeLog('warn', safeMessage)
   }
 
   error(message) {
-    const output = `❌ ${message}`
+    const safeMessage = sanitizeForLog(message)
+    const output = `❌ ${safeMessage}`
     console.log(output)
-    this.writeLog('error', message)
+    this.writeLog('error', safeMessage)
   }
 
   debug(message) {
     if (this.logLevel === 'debug') {
-      const output = `🐛 ${message}`
+      const safeMessage = sanitizeForLog(message)
+      const output = `🐛 ${safeMessage}`
       console.log(output)
-      this.writeLog('debug', message)
+      this.writeLog('debug', safeMessage)
     }
   }
 
@@ -84,17 +127,20 @@ export class Logger {
     const prefix = stepNumber ? `步骤 ${stepNumber}:` : '执行:'
     const separator = '=================================='
 
+    const safeMessage = sanitizeForLog(message)
+
     console.log(`\n${separator}`)
-    console.log(`🚀 ${prefix} ${message}`)
+    console.log(`🚀 ${prefix} ${safeMessage}`)
     console.log(separator)
 
-    this.writeLog('step', `${prefix} ${message}`)
+    this.writeLog('step', `${prefix} ${safeMessage}`)
   }
 
   // 进度显示
   progress(message) {
-    process.stdout.write(`⌛ ${message}...`)
-    this.writeLog('progress', `开始: ${message}`)
+    const safeMessage = sanitizeForLog(message)
+    process.stdout.write(`⌛ ${safeMessage}...`)
+    this.writeLog('progress', `开始: ${safeMessage}`)
   }
 
   progressDone() {
@@ -104,8 +150,9 @@ export class Logger {
 
   // 命令执行日志
   command(command) {
-    console.log(`💻 执行: ${command}`)
-    this.writeLog('command', command)
+    const safeCommand = sanitizeForLog(command)
+    console.log(`💻 执行: ${safeCommand}`)
+    this.writeLog('command', safeCommand)
   }
 
   // 分隔符
@@ -118,15 +165,16 @@ export class Logger {
     if (data.length === 0) return
 
     if (headers.length > 0) {
-      console.log(`\n${headers.join('\t')}`)
-      console.log('-'.repeat(headers.join('\t').length))
+      const safeHeaders = headers.map(h => sanitizeForLog(h))
+      console.log(`\n${safeHeaders.join('\t')}`)
+      console.log('-'.repeat(safeHeaders.join('\t').length))
     }
 
     data.forEach(row => {
       if (Array.isArray(row)) {
-        console.log(row.join('\t'))
+        console.log(row.map(cell => sanitizeForLog(cell)).join('\t'))
       } else {
-        console.log(row)
+        console.log(sanitizeForLog(row))
       }
     })
     console.log()
@@ -136,7 +184,9 @@ export class Logger {
   ports(portInfo) {
     console.log('\n📡 服务端口信息:')
     portInfo.forEach(({ service, port, url }) => {
-      console.log(`  ${service}: http://localhost:${port} ${url ? `(${url})` : ''}`)
+      const safeService = sanitizeForLog(service)
+      const safeUrl = url ? sanitizeForLog(url) : ''
+      console.log(`  ${safeService}: http://localhost:${port} ${safeUrl ? `(${safeUrl})` : ''}`)
     })
     console.log()
   }
@@ -146,8 +196,9 @@ export class Logger {
     if (!this.enableFile) return
 
     try {
+      const safeMessage = sanitizeForLog(message)
       const timestamp = this.formatTimestamp()
-      const logLine = `[${timestamp}] [${level.toUpperCase()}] ${message}\n`
+      const logLine = `[${timestamp}] [${level.toUpperCase()}] ${safeMessage}\n`
 
       const logFile = join(this.logDir, `ai-cli-${new Date().toISOString().split('T')[0]}.log`)
       writeFileSync(logFile, logLine, { flag: 'a', encoding: 'utf8' })

package/lib/telegram-webhook.js

@@ -22,7 +22,9 @@ export async function handleTelegramBotDeploy(environment, projectId, orgId, tok
 
   if (missingVars.length > 0) {
     logger.error('缺少以下 Telegram Bot 环境变量:')
-    missingVars.forEach(v => logger.error(`  - ${v}`))
+    missingVars.forEach(v => {
+      logger.error(`  - ${v}`)
+    })
     logger.warn('跳过 Webhook 配置，请手动设置')
     return
   }
@@ -67,8 +69,15 @@ export async function handleTelegramBotDeploy(environment, projectId, orgId, tok
     }
     else {
       logger.error(`Telegram Webhook 设置失败: ${result.description}`)
-      logger.info('请手动执行以下命令:')
-      logger.info(curlCmd)
+      logger.info('请手动执行以下命令（不要把明文 token/secret 写进日志）:')
+      const manualPayload = JSON.stringify({
+        url: webhookUrl,
+        secret_token: '<YOUR_WEBHOOK_SECRET>',
+        drop_pending_updates: false,
+      })
+      logger.info(
+        `curl -X POST "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/setWebhook" -H "Content-Type: application/json" -d '${manualPayload}' --silent`,
+      )
     }
   }
   catch (error) {
@@ -82,15 +91,18 @@ export async function handleTelegramBotDeploy(environment, projectId, orgId, tok
  */
 async function getLatestDeploymentUrl(projectId, orgId, token, environment) {
   try {
-    const cmd = [
-      'vercel',
-      'ls',
-      `--token=${token}`,
-      orgId ? `--scope=${orgId}` : '',
-      '--json',
-    ].filter(Boolean).join(' ')
-
-    const output = execSync(cmd, { encoding: 'utf8' })
+    const cmd = ['vercel', 'ls', orgId ? `--scope=${orgId}` : '', '--json']
+      .filter(Boolean)
+      .join(' ')
+
+    const output = execSync(cmd, {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        // 不通过 CLI args 传递 token，避免出现在错误信息/日志中
+        VERCEL_TOKEN: token,
+      },
+    })
     const deployments = JSON.parse(output)
 
     // 根据环境筛选部署

package/lib/vercel-deploy.js

@@ -1,11 +1,105 @@
-import { execSync } from 'node:child_process'
+import { execSync, spawn } from 'node:child_process'
 import { join } from 'node:path'
 import { envManager } from './env.js'
-import { execManager } from './exec.js'
 import { logger } from './logger.js'
 
 const ALLOWED_ENVIRONMENTS = ['development', 'staging', 'production']
 
+function collectErrorText(err) {
+  const parts = []
+  if (err?.message) parts.push(String(err.message))
+  if (err?.stderr) parts.push(String(err.stderr))
+  if (err?.stdout) parts.push(String(err.stdout))
+  return parts.join('\n')
+}
+
+function isMissingFilesError(err) {
+  const text = collectErrorText(err)
+  return (
+    text.includes('missing_files') ||
+    text.includes('Missing files') ||
+    text.includes('code":"missing_files"')
+  )
+}
+
+async function runVercel(args, options = {}) {
+  const { env, cwd } = options
+  const MAX_CAPTURE = 20000
+
+  return new Promise((resolve, reject) => {
+    const child = spawn('vercel', args, {
+      cwd: cwd || process.cwd(),
+      env: env || process.env,
+      stdio: ['inherit', 'pipe', 'pipe'],
+    })
+
+    let stdout = ''
+    let stderr = ''
+
+    const append = (current, chunk) => {
+      const next = current + chunk
+      return next.length > MAX_CAPTURE ? next.slice(-MAX_CAPTURE) : next
+    }
+
+    child.stdout.on('data', data => {
+      process.stdout.write(data)
+      stdout = append(stdout, data.toString('utf8'))
+    })
+
+    child.stderr.on('data', data => {
+      process.stderr.write(data)
+      stderr = append(stderr, data.toString('utf8'))
+    })
+
+    child.on('error', error => {
+      error.stdout = stdout
+      error.stderr = stderr
+      reject(error)
+    })
+
+    child.on('close', code => {
+      if (code === 0) return resolve({ code, stdout, stderr })
+      const error = new Error(`vercel ${args[0] || ''} 失败 (exit ${code})`)
+      error.code = code
+      error.stdout = stdout
+      error.stderr = stderr
+      reject(error)
+    })
+  })
+}
+
+export async function deployPrebuiltWithFallback(options) {
+  const {
+    baseArgs,
+    env,
+    cwd,
+    run = runVercel,
+    cleanupArchiveParts = () => {
+      try {
+        execSync('rm -f .vercel/source.tgz.part*', { stdio: 'ignore' })
+      } catch {
+        // ignore
+      }
+    },
+    onMissingFiles = () => {
+      logger.warn('检测到 missing_files，自动使用 --archive=tgz 重试一次')
+    },
+  } = options || {}
+
+  try {
+    await run(baseArgs, { env, cwd })
+    return { usedArchive: false }
+  } catch (e) {
+    if (!isMissingFilesError(e)) throw e
+    onMissingFiles(e)
+    cleanupArchiveParts()
+    const archiveArgs = baseArgs.slice()
+    archiveArgs.splice(2, 0, '--archive=tgz')
+    await run(archiveArgs, { env, cwd })
+    return { usedArchive: true }
+  }
+}
+
 export async function deployToVercel(target, options = {}) {
   const { environment = 'staging' } = options
 
@@ -63,7 +157,9 @@ export async function deployToVercel(target, options = {}) {
   // 如果有缺失变量，统一报错并退出
   if (missingVars.length > 0) {
     logger.error('缺少以下 Vercel 环境变量:')
-    missingVars.forEach(v => logger.error(`  - ${v}`))
+    missingVars.forEach(v => {
+      logger.error(`  - ${v}`)
+    })
     logger.info('')
     logger.info('请在 .env.<env>.local 中配置这些变量，例如:')
     logger.info('  VERCEL_TOKEN=<your-vercel-token>')
@@ -120,6 +216,9 @@ export async function deployToVercel(target, options = {}) {
       envVars.VERCEL_ORG_ID = orgId
     }
 
+    // 不通过 CLI args 传递 token，避免出现在错误信息/日志中
+    envVars.VERCEL_TOKEN = token
+
     // 绕过 Vercel Git author 权限检查：临时修改最新 commit 的 author
     const authorEmail = process.env.VERCEL_GIT_COMMIT_AUTHOR_EMAIL
     let originalAuthor = null
@@ -138,52 +237,37 @@ export async function deployToVercel(target, options = {}) {
     try {
       // 第一步：本地构建
       logger.step(`本地构建 ${t} (${environment})`)
-      const buildCmd = [
-        'vercel build',
-        `--local-config="${configPath}"`,
-        '--yes',
-        `--token=${token}`,
-      ]
+      const buildArgs = ['build', '--local-config', configPath, '--yes']
 
       // staging 和 production 环境需要 --prod 标志，确保构建产物与部署环境匹配
       if (environment === 'staging' || environment === 'production') {
-        buildCmd.push('--prod')
+        buildArgs.push('--prod')
       }
 
       if (orgId) {
-        buildCmd.push(`--scope=${orgId}`)
+        buildArgs.push('--scope', orgId)
       }
 
-      execSync(buildCmd.join(' '), {
-        stdio: 'inherit',
-        cwd: process.cwd(),
-        env: envVars,
-      })
+      await runVercel(buildArgs, { env: envVars, cwd: process.cwd() })
       logger.success(`${t} 本地构建成功`)
 
       // 第二步：上传预构建产物
       logger.step(`部署 ${t} 到 Vercel (${environment})`)
-      const deployCmd = [
-        'vercel deploy',
-        '--prebuilt',
-        `--local-config="${configPath}"`,
-        '--yes',
-        `--token=${token}`,
-      ]
+      const baseDeployArgs = ['deploy', '--prebuilt', '--local-config', configPath, '--yes']
 
       // staging 和 production 环境都添加 --prod 标志以绑定固定域名
       if (environment === 'staging' || environment === 'production') {
-        deployCmd.push('--prod')
+        baseDeployArgs.push('--prod')
       }
 
       if (orgId) {
-        deployCmd.push(`--scope=${orgId}`)
+        baseDeployArgs.push('--scope', orgId)
       }
 
-      execSync(deployCmd.join(' '), {
-        stdio: 'inherit',
-        cwd: process.cwd(),
+      await deployPrebuiltWithFallback({
+        baseArgs: baseDeployArgs,
         env: envVars,
+        cwd: process.cwd(),
       })
       logger.success(`${t} 部署成功`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ranger1/dx",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "type": "module",
   "license": "MIT",
   "repository": {