@realsee/vr-cli 0.1.5 → 0.2.0

package/templates/base/package-lock.json

@@ -23,6 +23,7 @@
         "@types/react": ">=18.3.12",
         "@types/react-dom": ">=18.3.1",
         "@vitejs/plugin-react": ">=4.3.1",
+        "adm-zip": "0.6.0",
         "concurrently": ">=10.0.5",
         "eslint": ">=10.9.1",
         "eslint-plugin-react-hooks": ">=7.1.1",
@@ -6427,6 +6428,16 @@
         "url": "https://github.com/sponsors/colinhacks"
       }
     },
+    "node_modules/adm-zip": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
     "node_modules/zod-validation-error": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/zod-validation-error/-/zod-validation-error-4.0.2.tgz",

package/templates/base/package.json

@@ -6,7 +6,8 @@
   "packageManager": "npm@11.19.0",
   "scripts": {
     "setup": "node scripts/setup.mjs",
-    "test:setup": "node --test scripts/setup-config.test.mjs",
+    "setup:complete": "node scripts/setup.mjs --complete",
+    "test:setup": "node --test scripts/setup-config.test.mjs scripts/project-identity.test.mjs scripts/pairing.test.mjs",
     "dev": "npm run check:env && concurrently --kill-others-on-fail --names bff,web \"npm:dev:bff\" \"npm:dev:web\"",
     "dev:bff": "node --env-file-if-exists=.env.development --watch server/index.ts",
     "dev:web": "vite",
@@ -22,6 +23,7 @@
     "deps:relock": "npm install --package-lock-only",
     "deps:install": "npm ci",
     "build": "npm run check && vite build",
+    "package:vibe-release": "node scripts/package-vibe-release.mjs",
     "start": "node --env-file-if-exists=.env.development server/index.ts --serve-frontend",
     "preview": "npm run start"
   },
@@ -41,6 +43,7 @@
     "@types/react": ">=18.3.12",
     "@types/react-dom": ">=18.3.1",
     "@vitejs/plugin-react": ">=4.3.1",
+    "adm-zip": "0.6.0",
     "concurrently": ">=10.0.5",
     "eslint": ">=10.9.1",
     "eslint-plugin-react-hooks": ">=7.1.1",

package/templates/base/scripts/package-vibe-release.mjs

@@ -0,0 +1,569 @@
+#!/usr/bin/env node
+
+import { spawn } from 'node:child_process'
+import {
+  lstat,
+  mkdir,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  stat,
+} from 'node:fs/promises'
+import path from 'node:path'
+
+const PROJECT_ROOT = path.resolve(import.meta.dirname, '..')
+const FORMAT = 'node-vite-bff-v1'
+const NODE_PIN = '22.23.2'
+const NPM_PIN = '11.19.0'
+const ZIP_PACKAGE = 'adm-zip'
+const ZIP_VERSION = '0.6.0'
+const MAX_FILES = 20_000
+const MAX_UNCOMPRESSED_BYTES = 1024 * 1024 * 1024
+const MAX_ZIP_BYTES = 200 * 1024 * 1024
+const NPM_COMMAND = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+const REQUIRED_FILES = [
+  'deploy.json',
+  'package.json',
+  'package-lock.json',
+  '.npmrc',
+  '.node-version',
+  '.nvmrc',
+  'index.html',
+  'vite.config.ts',
+  'tsconfig.json',
+  'tsconfig.server.json',
+  'eslint.config.mjs',
+  'prettier.config.mjs',
+  'scripts/package-vibe-release.mjs',
+  'server/index.ts',
+  'server/app.ts',
+  'server/config.ts',
+]
+const REQUIRED_DIRECTORIES = ['src', 'server']
+const EXCLUDED_DIRECTORIES = new Set([
+  '.git',
+  'release',
+  'node_modules',
+  'dist',
+  '.realsee',
+  '.kiro',
+  '.agent',
+  '.agents',
+  '.claude',
+  '.cursor',
+  '.vscode',
+  '.idea',
+  '__MACOSX',
+])
+const FORBIDDEN_CONTAINER_FILES = new Set([
+  'Dockerfile',
+  'compose.yaml',
+  'compose.yml',
+  'docker-compose.yaml',
+  'docker-compose.yml',
+])
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+async function readJson(relativePath) {
+  try {
+    const value = JSON.parse(
+      await readFile(path.join(PROJECT_ROOT, relativePath), 'utf8'),
+    )
+    if (!isRecord(value)) throw new Error('必须是 JSON 对象')
+    return value
+  } catch (error) {
+    throw new Error(
+      `${relativePath} 解析失败：${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    )
+  }
+}
+
+async function requireFile(relativePath) {
+  try {
+    const value = await stat(path.join(PROJECT_ROOT, relativePath))
+    if (!value.isFile()) throw new Error('不是普通文件')
+  } catch (error) {
+    throw new Error(
+      `统一发布包缺少文件 ${relativePath}：${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    )
+  }
+}
+
+async function requireDirectory(relativePath) {
+  try {
+    const absolutePath = path.join(PROJECT_ROOT, relativePath)
+    const value = await stat(absolutePath)
+    if (!value.isDirectory()) throw new Error('不是目录')
+    if ((await readdir(absolutePath)).length === 0) throw new Error('目录为空')
+  } catch (error) {
+    throw new Error(
+      `统一发布包缺少目录 ${relativePath}/：${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    )
+  }
+}
+
+function validateNpmrc(source) {
+  const expected = new Map([
+    ['engine-strict', 'true'],
+    ['package-lock', 'true'],
+    ['save-prefix', '>='],
+  ])
+  const actual = new Map()
+  for (const raw of source.split(/\r?\n/)) {
+    const line = raw.trim()
+    if (!line || line.startsWith('#') || line.startsWith(';')) continue
+    const separator = line.indexOf('=')
+    if (separator <= 0) throw new Error('.npmrc 只允许 key=value 配置')
+    const key = line.slice(0, separator).trim().toLowerCase()
+    const value = line.slice(separator + 1).trim()
+    if (!expected.has(key)) throw new Error(`.npmrc 不允许配置 ${key}`)
+    if (actual.has(key)) throw new Error(`.npmrc 重复配置 ${key}`)
+    if (/(_auth|token|password|registry|userconfig|cafile)|\$\{/i.test(line)) {
+      throw new Error('.npmrc 不允许注册表、凭据、路径或环境变量插值')
+    }
+    actual.set(key, value)
+  }
+  for (const [key, value] of expected) {
+    if (actual.get(key) !== value) {
+      throw new Error(`.npmrc 必须包含 ${key}=${value}`)
+    }
+  }
+  if (actual.size !== expected.size) {
+    throw new Error('.npmrc 包含统一构建规则之外的配置')
+  }
+}
+
+function validateManifest(manifest) {
+  const allowedFields = new Set([
+    'packageFormat',
+    'name',
+    'requiredEnv',
+    'resources',
+    'domain',
+    'healthCheck',
+  ])
+  if (manifest.packageFormat !== FORMAT) {
+    throw new Error(`deploy.json.packageFormat 必须是 ${FORMAT}`)
+  }
+  for (const field of Object.keys(manifest)) {
+    if (!allowedFields.has(field)) {
+      throw new Error(`deploy.json 不支持字段：${field}`)
+    }
+  }
+  if (
+    !Array.isArray(manifest.requiredEnv) ||
+    manifest.requiredEnv.length > 20
+  ) {
+    throw new Error('deploy.json.requiredEnv 必须是最多 20 项的数组')
+  }
+  const names = new Set()
+  for (const raw of manifest.requiredEnv) {
+    const name = String(raw ?? '').trim()
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+      throw new Error(`deploy.json.requiredEnv 名称不合法：${name || '(空)'}`)
+    }
+    if (names.has(name)) {
+      throw new Error(`deploy.json.requiredEnv 包含重复项：${name}`)
+    }
+    names.add(name)
+  }
+  if (manifest.healthCheck !== undefined) {
+    if (!isRecord(manifest.healthCheck)) {
+      throw new Error('deploy.json.healthCheck 必须是对象')
+    }
+    const allowedHealthFields = new Set([
+      'enabled',
+      'path',
+      'timeoutMs',
+      'retries',
+    ])
+    for (const field of Object.keys(manifest.healthCheck)) {
+      if (!allowedHealthFields.has(field)) {
+        throw new Error(`deploy.json.healthCheck 不支持字段：${field}`)
+      }
+    }
+    if (
+      manifest.healthCheck.enabled !== undefined &&
+      manifest.healthCheck.enabled !== true
+    ) {
+      throw new Error('node-vite-bff-v1 健康检查必须启用')
+    }
+    if (
+      manifest.healthCheck.path !== undefined &&
+      manifest.healthCheck.path !== '/api/health'
+    ) {
+      throw new Error('node-vite-bff-v1 健康检查路径固定为 /api/health')
+    }
+    if (manifest.healthCheck.timeoutMs !== undefined) {
+      const timeoutMs = Number(manifest.healthCheck.timeoutMs)
+      if (
+        !Number.isFinite(timeoutMs) ||
+        timeoutMs < 500 ||
+        timeoutMs > 30_000
+      ) {
+        throw new Error(
+          'deploy.json.healthCheck.timeoutMs 必须在 500-30000 之间',
+        )
+      }
+    }
+    if (manifest.healthCheck.retries !== undefined) {
+      const retries = Number(manifest.healthCheck.retries)
+      if (!Number.isInteger(retries) || retries < 1 || retries > 60) {
+        throw new Error(
+          'deploy.json.healthCheck.retries 必须是 1-60 之间的整数',
+        )
+      }
+    }
+  }
+}
+
+async function validateSource() {
+  await Promise.all(
+    REQUIRED_FILES.map((relativePath) => requireFile(relativePath)),
+  )
+  await Promise.all(
+    REQUIRED_DIRECTORIES.map((relativePath) => requireDirectory(relativePath)),
+  )
+
+  const manifest = await readJson('deploy.json')
+  validateManifest(manifest)
+  const packageJson = await readJson('package.json')
+  if (packageJson.type !== 'module') {
+    throw new Error('package.json.type 必须是 module')
+  }
+  if (packageJson.packageManager !== `npm@${NPM_PIN}`) {
+    throw new Error(`package.json.packageManager 必须是 npm@${NPM_PIN}`)
+  }
+  if (
+    packageJson.engines?.node !== '>=22.18.0' ||
+    packageJson.engines?.npm !== `>=${NPM_PIN}`
+  ) {
+    throw new Error(
+      `package.json.engines 必须声明 node >=22.18.0、npm >=${NPM_PIN}`,
+    )
+  }
+  if (packageJson.scripts?.build !== 'npm run check && vite build') {
+    throw new Error(
+      'package.json build 脚本必须是：npm run check && vite build',
+    )
+  }
+  if (
+    packageJson.scripts?.start !==
+    'node --env-file-if-exists=.env.development server/index.ts --serve-frontend'
+  ) {
+    throw new Error(
+      'package.json start 脚本必须运行 server/index.ts --serve-frontend',
+    )
+  }
+  if (
+    packageJson.scripts?.['package:vibe-release'] !==
+    'node scripts/package-vibe-release.mjs'
+  ) {
+    throw new Error(
+      'package.json 必须提供 package:vibe-release -> node scripts/package-vibe-release.mjs',
+    )
+  }
+  if (packageJson.devDependencies?.[ZIP_PACKAGE] !== ZIP_VERSION) {
+    throw new Error(
+      `package.json.devDependencies.${ZIP_PACKAGE} 必须精确固定为 ${ZIP_VERSION}`,
+    )
+  }
+  for (const dependency of ['fastify', '@fastify/static']) {
+    if (typeof packageJson.dependencies?.[dependency] !== 'string') {
+      throw new Error(`package.json.dependencies 缺少 ${dependency}`)
+    }
+  }
+  for (const dependency of ['vite', 'typescript']) {
+    if (typeof packageJson.devDependencies?.[dependency] !== 'string') {
+      throw new Error(`package.json.devDependencies 缺少 ${dependency}`)
+    }
+  }
+
+  const lockfile = await readJson('package-lock.json')
+  if (lockfile.lockfileVersion !== 3 || !isRecord(lockfile.packages?.[''])) {
+    throw new Error(
+      'package-lock.json 必须使用 lockfileVersion 3 并包含根包记录',
+    )
+  }
+  if (lockfile.packages[''].devDependencies?.[ZIP_PACKAGE] !== ZIP_VERSION) {
+    throw new Error(
+      `package-lock.json 根包必须锁定 ${ZIP_PACKAGE}@${ZIP_VERSION}`,
+    )
+  }
+  if (
+    lockfile.packages[`node_modules/${ZIP_PACKAGE}`]?.version !== ZIP_VERSION
+  ) {
+    throw new Error(`package-lock.json 必须解析 ${ZIP_PACKAGE}@${ZIP_VERSION}`)
+  }
+
+  for (const relativePath of ['.node-version', '.nvmrc']) {
+    const value = (
+      await readFile(path.join(PROJECT_ROOT, relativePath), 'utf8')
+    ).trim()
+    if (value !== NODE_PIN) {
+      throw new Error(`${relativePath} 必须固定为 ${NODE_PIN}`)
+    }
+  }
+  validateNpmrc(await readFile(path.join(PROJECT_ROOT, '.npmrc'), 'utf8'))
+  return { manifest, packageJson }
+}
+
+async function validateBuiltOutput() {
+  await requireFile('dist/index.html')
+  await requireDirectory('dist/assets')
+}
+
+function secretLikeFile(name) {
+  const lower = name.toLowerCase()
+  return (
+    lower.startsWith('.env') ||
+    [
+      '.pypirc',
+      '.netrc',
+      'id_rsa',
+      'id_dsa',
+      'id_ecdsa',
+      'id_ed25519',
+    ].includes(lower) ||
+    /\.(pem|key|p12|pfx|jks|keystore)$/.test(lower) ||
+    /(service[-_]?account|credentials?|secrets?).*\.json$/.test(lower)
+  )
+}
+
+function excludedFile(name) {
+  const lower = name.toLowerCase()
+  return (
+    name === '.DS_Store' ||
+    name.startsWith('.tmp-') ||
+    lower.endsWith('.log') ||
+    lower.startsWith('npm-debug.log') ||
+    lower.startsWith('yarn-debug.log') ||
+    lower.startsWith('yarn-error.log') ||
+    secretLikeFile(name)
+  )
+}
+
+async function collectArchiveFiles(current = PROJECT_ROOT) {
+  const files = []
+  for (const entry of await readdir(current, { withFileTypes: true })) {
+    const absolutePath = path.join(current, entry.name)
+    const relativePath = path
+      .relative(PROJECT_ROOT, absolutePath)
+      .split(path.sep)
+      .join('/')
+    const information = await lstat(absolutePath)
+    if (information.isSymbolicLink()) {
+      throw new Error(`统一发布包不允许符号链接：${relativePath}`)
+    }
+    if (information.isDirectory()) {
+      if (
+        EXCLUDED_DIRECTORIES.has(entry.name) ||
+        entry.name.startsWith('.tmp-')
+      ) {
+        continue
+      }
+      files.push(...(await collectArchiveFiles(absolutePath)))
+      continue
+    }
+    if (!information.isFile()) {
+      throw new Error(`统一发布包包含不支持的文件类型：${relativePath}`)
+    }
+    if (FORBIDDEN_CONTAINER_FILES.has(relativePath)) {
+      throw new Error(`node-vite-bff-v1 不接受 ${relativePath}`)
+    }
+    if (excludedFile(entry.name)) continue
+    files.push({
+      absolutePath,
+      relativePath,
+      size: information.size,
+    })
+  }
+  return files
+}
+
+function run(command, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: PROJECT_ROOT,
+      stdio: 'inherit',
+      shell: false,
+    })
+    child.once('error', reject)
+    child.once('exit', (code, signal) => {
+      if (code === 0) resolve()
+      else {
+        reject(
+          new Error(
+            `${command} ${args.join(' ')} 失败（code=${code ?? 'null'}, signal=${signal ?? 'none'}）`,
+          ),
+        )
+      }
+    })
+  })
+}
+
+function capture(command, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: PROJECT_ROOT,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: false,
+    })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk
+    })
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk
+    })
+    child.once('error', reject)
+    child.once('exit', (code) => {
+      if (code === 0) resolve(stdout.trim())
+      else reject(new Error(stderr.trim() || `${command} 执行失败`))
+    })
+  })
+}
+
+async function checkToolchain() {
+  const [major, minor] = process.versions.node.split('.').map(Number)
+  if (major < 22 || (major === 22 && minor < 18)) {
+    throw new Error('统一构建需要 Node.js >=22.18.0')
+  }
+  const npmVersion = await capture(NPM_COMMAND, ['--version'])
+  if (npmVersion !== NPM_PIN) {
+    throw new Error(`统一构建需要 npm ${NPM_PIN}，当前为 ${npmVersion}`)
+  }
+  if (process.version !== `v${NODE_PIN}`) {
+    console.warn(
+      `提示：当前 Node ${process.version}；项目与平台镜像固定使用 v${NODE_PIN}。`,
+    )
+  }
+}
+
+function validateArchiveEntries(entries) {
+  const names = new Set()
+  for (const entry of entries) {
+    if (entry.isDirectory) continue
+    const name = entry.entryName
+    if (
+      !name ||
+      name.startsWith('/') ||
+      name.includes('\\') ||
+      name.split('/').includes('..')
+    ) {
+      throw new Error(`ZIP 包含非法路径：${name || '(空)'}`)
+    }
+    if (names.has(name)) throw new Error(`ZIP 包含重复路径：${name}`)
+    names.add(name)
+    const segments = name.split('/')
+    if (segments.some((segment) => EXCLUDED_DIRECTORIES.has(segment))) {
+      throw new Error(`ZIP 包含应排除目录：${name}`)
+    }
+    if (segments.some((segment) => segment.startsWith('.tmp-'))) {
+      throw new Error(`ZIP 包含临时产物：${name}`)
+    }
+    if (secretLikeFile(path.posix.basename(name))) {
+      throw new Error(`ZIP 包含疑似秘密文件：${name}`)
+    }
+  }
+  for (const required of REQUIRED_FILES) {
+    if (!names.has(required)) throw new Error(`ZIP 缺少文件：${required}`)
+  }
+  if (names.size > MAX_FILES) {
+    throw new Error(`ZIP 文件数超过限制（${MAX_FILES}）`)
+  }
+}
+
+async function writeArchive(files, temporaryPath) {
+  if (files.length > MAX_FILES) {
+    throw new Error(`项目文件数超过限制（${MAX_FILES}）`)
+  }
+  const totalBytes = files.reduce((sum, file) => sum + file.size, 0)
+  if (totalBytes > MAX_UNCOMPRESSED_BYTES) {
+    throw new Error('项目源码超过解压限制（1024MB）')
+  }
+  const imported = await import(ZIP_PACKAGE)
+  const AdmZip = imported.default
+  const archive = new AdmZip()
+  for (const file of files) {
+    archive.addFile(file.relativePath, await readFile(file.absolutePath))
+  }
+  await new Promise((resolve, reject) => {
+    archive.writeZip(temporaryPath, (error) => {
+      if (error) reject(error)
+      else resolve()
+    })
+  })
+  const archiveSize = (await stat(temporaryPath)).size
+  if (archiveSize > MAX_ZIP_BYTES) {
+    throw new Error('ZIP 超过上传限制（200MB）')
+  }
+  const inspection = new AdmZip(temporaryPath)
+  validateArchiveEntries(inspection.getEntries())
+  return archiveSize
+}
+
+function outputName(packageName) {
+  const safeName = packageName
+    .replace(/^@/, '')
+    .replaceAll('/', '-')
+    .replace(/[^a-zA-Z0-9._-]+/g, '-')
+  if (!safeName) throw new Error('package.json.name 无法生成发布包文件名')
+  return `${safeName}-${FORMAT}.zip`
+}
+
+async function main() {
+  await checkToolchain()
+  const { manifest, packageJson } = await validateSource()
+  await collectArchiveFiles()
+
+  console.log('执行干净依赖安装：npm ci')
+  await run(NPM_COMMAND, ['ci', '--no-audit', '--no-fund'])
+  console.log('执行生产检查与构建：npm run build')
+  await run(NPM_COMMAND, ['run', 'build'])
+  await validateBuiltOutput()
+
+  const files = await collectArchiveFiles()
+  const outputDirectory = path.join(PROJECT_ROOT, 'release')
+  const outputPath = path.join(outputDirectory, outputName(packageJson.name))
+  const temporaryPath = path.join(
+    outputDirectory,
+    `.tmp-${process.pid}-${Date.now()}.zip`,
+  )
+  await mkdir(outputDirectory, { recursive: true })
+  try {
+    const archiveSize = await writeArchive(files, temporaryPath)
+    await rename(temporaryPath, outputPath)
+    console.log(
+      `打包完成：${outputPath} (${(archiveSize / 1024 / 1024).toFixed(1)}MB)`,
+    )
+    console.log(
+      `格式：${FORMAT} · Node ${NODE_PIN} · npm ${NPM_PIN} · 健康检查 /api/health`,
+    )
+    console.log(
+      '已排除：node_modules、dist、release、.git、.env*、密钥/凭据、日志和编辑器/Agent 配置。',
+    )
+    console.log(
+      `运行前请配置：${manifest.requiredEnv.length ? manifest.requiredEnv.join(', ') : '(无额外变量)'}`,
+    )
+  } finally {
+    await rm(temporaryPath, { force: true })
+  }
+}
+
+main().catch((error) => {
+  console.error(
+    `打包失败：${error instanceof Error ? error.message : String(error)}`,
+  )
+  process.exitCode = 1
+})