@stackonward/cli 1.7.0 → 1.8.0

package/dist/resources/templates/go-backend/docs/standards-provenance.json

@@ -1,13 +1,13 @@
 {
   "source_repository": "https://onedev.yhy.gd.cn/platform/onex",
   "source_commit": "4fd93f675a6579773d16ab8272395cab8c761670",
-  "hash_scope": "Source SHA identifies the inspected working-tree file. Target SHA identifies the distributed template before variable materialization.",
+  "hash_scope": "Source SHA identifies the inspected working-tree file. Target SHA identifies the distributed template before variable materialization. Target paths and references use the project-owned AGENTS.md and .codex/docs layout; original upstream source paths and source hashes remain unchanged.",
   "documents": [
     {
       "source": "backend/CLAUDE.md",
-      "target": "CLAUDE.md",
+      "target": "AGENTS.md",
       "source_sha256": "d263504fd2f396d2aa74034e8d40a0ec992a5351ae75bdcbada39c5b20698136",
-      "target_template_sha256": "5fc018eb21177f745d3dd29d72a8ca326b54b38415a2d1fb1ad4b1463359b5df",
+      "target_template_sha256": "b342242164bd03ad28cbd775f5786e4e597ca0531aabd74e713c0377fd2fa1b9",
       "source_lines": 1103,
       "target_lines": 1139,
       "source_heading_count": 89,
@@ -215,9 +215,9 @@
     },
     {
       "source": "backend/.claude/docs/api-design.md",
-      "target": ".claude/docs/api-design.md",
+      "target": ".codex/docs/api-design.md",
       "source_sha256": "9ce2e7b828723587f3673ebe637b5b868853e952934df2ec6a7ee77febe0afb3",
-      "target_template_sha256": "890a859eefbf8af0d4a24fb5fe07156b9c3fc535b28f30caeba28f14c1e92128",
+      "target_template_sha256": "bc9cee68ac932c8156421a7aee4ae5056365fa92a2efdc67b187eead48cede86",
       "source_lines": 432,
       "target_lines": 486,
       "source_heading_count": 9,
@@ -557,9 +557,9 @@
     },
     {
       "source": ".claude/docs/architecture-template.md",
-      "target": ".claude/docs/architecture-template.md",
+      "target": ".codex/docs/architecture-template.md",
       "source_sha256": "b74c529abec5ff160bd61942f98f172bbe70170490eaa6aba32d32ce70ec4c45",
-      "target_template_sha256": "9e34637a0e3f44339f6bb73507a2ccd1b3a7471ab1c1b9dab2233a2fe685b5be",
+      "target_template_sha256": "ac8caafbd4dd1f4b75818368583dd90c24dfa0586f0858d70d91a16fd6a425b8",
       "source_lines": 449,
       "target_lines": 449,
       "source_heading_count": 63,
@@ -580,9 +580,9 @@
     },
     {
       "source": "backend/.claude/docs/check-list.md",
-      "target": ".claude/docs/check-list.md",
+      "target": ".codex/docs/check-list.md",
       "source_sha256": "abe272bec01bca44fca1e67050f7dd2d25c1213ab79c66c501cb4e47b695ec29",
-      "target_template_sha256": "36be967ce253042ee4e220d94035497eebd5a9d68da2fe9d32e1f159e198b32f",
+      "target_template_sha256": "c3975fc04e638464b40de48819ffa535b174f69a43082e84ebb98c4a7c8d9e76",
       "source_lines": 155,
       "target_lines": 155,
       "source_heading_count": 19,
@@ -614,9 +614,9 @@
     },
     {
       "source": "backend/.claude/docs/database.md",
-      "target": ".claude/docs/database.md",
+      "target": ".codex/docs/database.md",
       "source_sha256": "ce1327c9f0868566b3960795e22c46774b9ffdd39505492a1277c9f7343eff67",
-      "target_template_sha256": "1a55b063ed60813189fdf05a0e6a8e87b5213ff8bf8ac2c994865577d17e5451",
+      "target_template_sha256": "bbdd7c697beef2bd550846f54c27c11d7bd66ef9daee00a0674d6042b7be4993",
       "source_lines": 369,
       "target_lines": 369,
       "source_heading_count": 14,
@@ -681,7 +681,7 @@
     },
     {
       "source": "backend/.claude/docs/e2e-standards.md",
-      "target": ".claude/docs/e2e-standards.md",
+      "target": ".codex/docs/e2e-standards.md",
       "source_sha256": "719aecf2f91587956b175708ed43a98e5ea4ed965ca0fde8bb74855eecd7f260",
       "target_template_sha256": "719aecf2f91587956b175708ed43a98e5ea4ed965ca0fde8bb74855eecd7f260",
       "source_lines": 161,
@@ -692,9 +692,9 @@
     },
     {
       "source": "backend/.claude/docs/error-handling.md",
-      "target": ".claude/docs/error-handling.md",
+      "target": ".codex/docs/error-handling.md",
       "source_sha256": "a7f3200a4385bdf5952b77915e645edf0f5b5b2278f43c5658326e0f016d9c4e",
-      "target_template_sha256": "ecd80de34c1e6abdee5f33646a673e91cceff5d32ad367c6c3a21b05542733e7",
+      "target_template_sha256": "fb20722499d1e7c329cfa22b937c4cd8fbebc55c1de59549ba615edeb2c397eb",
       "source_lines": 258,
       "target_lines": 558,
       "source_heading_count": 7,
@@ -1155,7 +1155,7 @@
     },
     {
       "source": "backend/.claude/docs/event-runtime-boundary.md",
-      "target": ".claude/docs/event-runtime-boundary.md",
+      "target": ".codex/docs/event-runtime-boundary.md",
       "source_sha256": "18130708d01b173bc2e7526f2ab530ba886910234db4260e9dd375d141efaeeb",
       "target_template_sha256": "18130708d01b173bc2e7526f2ab530ba886910234db4260e9dd375d141efaeeb",
       "source_lines": 124,
@@ -1166,7 +1166,7 @@
     },
     {
       "source": "backend/.claude/docs/identifier-contract.md",
-      "target": ".claude/docs/identifier-contract.md",
+      "target": ".codex/docs/identifier-contract.md",
       "source_sha256": "27cb70840f24e42b9d4b85e713b67635ce6e101c716687ab613379d1343ea890",
       "target_template_sha256": "27cb70840f24e42b9d4b85e713b67635ce6e101c716687ab613379d1343ea890",
       "source_lines": 195,
@@ -1177,9 +1177,9 @@
     },
     {
       "source": "backend/.claude/docs/index.md",
-      "target": ".claude/docs/index.md",
+      "target": ".codex/docs/index.md",
       "source_sha256": "bb43af098ff5b871488df6e60c34a15ef476786fef406a4ee27103de23c3b62f",
-      "target_template_sha256": "77a9f4fda66ce3abb78da381694f86f63e683f25ec53c649b3cd5d666ff96c60",
+      "target_template_sha256": "6879062dd16f506f6014f0f8f3b6962e1a9765bb52f562ade0d67cb49736545c",
       "source_lines": 17,
       "target_lines": 22,
       "source_heading_count": 1,
@@ -1211,9 +1211,9 @@
     },
     {
       "source": "backend/.claude/docs/logging.md",
-      "target": ".claude/docs/logging.md",
+      "target": ".codex/docs/logging.md",
       "source_sha256": "7f2cf9e546c249e848b461b941565aa66d39627420b2df761009d4426e6267d3",
-      "target_template_sha256": "5f9914c114065b2c414eb2ce2db205e3987c7f765db71d4bd6a58ee3517b68fb",
+      "target_template_sha256": "0a69dd766fc803a8cb5dbb39ffcdd2af1f7612a769b08ddd06babe76673aa71f",
       "source_lines": 276,
       "target_lines": 314,
       "source_heading_count": 12,
@@ -1355,9 +1355,9 @@
     },
     {
       "source": "backend/.claude/docs/mediagen-provider-onboarding-sop.md",
-      "target": ".claude/docs/mediagen-provider-onboarding-sop.md",
+      "target": ".codex/docs/mediagen-provider-onboarding-sop.md",
       "source_sha256": "e063b530b72d0cb42de3dd76d07b020e28f1b4b3bfcc72e2105099c7366ca6c4",
-      "target_template_sha256": "deb40a911cadc8fdd46c8bc25a022ebe42eb60acbf70323309f98100f59f8266",
+      "target_template_sha256": "16ce86e7681fbd12c217299faa42969241282fb9e5eb3bfe1105b97a9facea43",
       "source_lines": 915,
       "target_lines": 917,
       "source_heading_count": 60,
@@ -1378,9 +1378,9 @@
     },
     {
       "source": "backend/.claude/docs/mediagen-provider-quick-reference.md",
-      "target": ".claude/docs/mediagen-provider-quick-reference.md",
+      "target": ".codex/docs/mediagen-provider-quick-reference.md",
       "source_sha256": "3c661d4fa59468601d5041ec9990cfe4dade3c8fddac50431b85c8417c45376a",
-      "target_template_sha256": "ee82dfed1cb2df6d8094425c7e665ada721adcc462207d177c8e3ac763fe1f95",
+      "target_template_sha256": "9a9f18c167cb511e4beb44cd124211a47826a46fb3335baf1fab15341b0265d0",
       "source_lines": 193,
       "target_lines": 195,
       "source_heading_count": 13,
@@ -1401,9 +1401,9 @@
     },
     {
       "source": "backend/.claude/docs/module-standards.md",
-      "target": ".claude/docs/module-standards.md",
+      "target": ".codex/docs/module-standards.md",
       "source_sha256": "7a9b6651f493b34fcea0d136f4c43b5d0d9fd840bfafbd5d3955246baac649b6",
-      "target_template_sha256": "70b3dbcfd5f619d2cc8c28d29cb5b4f11a393f8f573dd51d7b42494004660811",
+      "target_template_sha256": "a0573ece7b5b8555e501d043405e97f56ceca4b2cfa393b7e60f816f609c5f06",
       "source_lines": 307,
       "target_lines": 309,
       "source_heading_count": 13,
@@ -1479,7 +1479,7 @@
     },
     {
       "source": "backend/.claude/docs/openapi-contract.md",
-      "target": ".claude/docs/openapi-contract.md",
+      "target": ".codex/docs/openapi-contract.md",
       "source_sha256": "047b32cb13001115d9431566f94839a8bf00c689624c59de3a7a5aa484ba9d90",
       "target_template_sha256": "047b32cb13001115d9431566f94839a8bf00c689624c59de3a7a5aa484ba9d90",
       "source_lines": 141,
@@ -1490,7 +1490,7 @@
     },
     {
       "source": "backend/.claude/docs/payment-gateway-onboarding.md",
-      "target": ".claude/docs/payment-gateway-onboarding.md",
+      "target": ".codex/docs/payment-gateway-onboarding.md",
       "source_sha256": "ed9457cb90e310c0316864a7926629928fc3462aaf36a42c418f6ea20a27a509",
       "target_template_sha256": "6bd8cf4fd81c276840ba5c41441919262c79b1446883bf3539350cbf0018a94b",
       "source_lines": 281,
@@ -1513,7 +1513,7 @@
     },
     {
       "source": "backend/.claude/docs/platform-boundary.md",
-      "target": ".claude/docs/platform-boundary.md",
+      "target": ".codex/docs/platform-boundary.md",
       "source_sha256": "73fe23acc1ba5b5e9e257345051e9880e7ebe7cd934f04457e7d8c31f2e0e5bd",
       "target_template_sha256": "73fe23acc1ba5b5e9e257345051e9880e7ebe7cd934f04457e7d8c31f2e0e5bd",
       "source_lines": 191,
@@ -1524,7 +1524,7 @@
     },
     {
       "source": ".claude/docs/quality-gates.md",
-      "target": ".claude/docs/quality-gates.md",
+      "target": ".codex/docs/quality-gates.md",
       "source_sha256": "b01d02a15f30bf1bdefc05d4070966bf30b4259a6b2f8d2031d119ef9a706cd3",
       "target_template_sha256": "b10ceb82a6880b258f3a105a9f93091910e999a7c55ac3c310e0fc423bbb2ae3",
       "source_lines": 110,

package/dist/resources/templates/go-backend/internal/common/middleware/cors.go

@@ -14,6 +14,7 @@ var localDevelopmentAllowedHeaders = strings.Join([]string{
 	"Content-Type",
 	"Accept",
 	"Authorization",
+	"If-Match",
 	"Checkout-Client-Nonce",
 	"Checkout-Presentation-Accept",
 	types.HeaderRequestID,

package/dist/resources/templates/go-backend/internal/common/middleware/middleware_test.go

@@ -589,6 +589,7 @@ func TestCORS_ExposeCheckoutClientHeaders(t *testing.T) {
 	assert.True(t, strings.Contains(allowHeaders, types.HeaderDeviceID))
 	assert.True(t, strings.Contains(allowHeaders, "Checkout-Client-Nonce"))
 	assert.True(t, strings.Contains(allowHeaders, "Checkout-Presentation-Accept"))
+	assert.True(t, strings.Contains(allowHeaders, "If-Match"))
 	assert.True(t, strings.Contains(allowHeaders, types.HeaderIdempotencyKey))
 	for _, header := range strings.Split(allowHeaders, ", ") {
 		assert.NotEqual(t, "Idempotency-Key", header)

package/dist/resources/templates/go-backend/internal/core/httpclient/safe_post.go

@@ -0,0 +1,28 @@
+package httpclient
+
+import (
+	"fmt"
+	"net/http"
+)
+
+// NewSafePostClient 复用下载 owner 的公网解析与连接钉住规则，但禁止重定向和自动重试。
+func NewSafePostClient(options SafeDownloadClientOptions) *http.Client {
+	transport := &safePostTransport{download: &safeDownloadTransport{options: options}}
+	return &http.Client{Timeout: transport.download.timeout(), Transport: transport, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+}
+
+type safePostTransport struct{ download *safeDownloadTransport }
+
+func (t *safePostTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req == nil || req.URL == nil || req.Method != http.MethodPost || req.URL.Scheme != "https" {
+		return nil, fmt.Errorf("safe outbound request requires HTTPS POST")
+	}
+	pinned, err := t.download.validateAndPin(req.Context(), req.URL.String())
+	if err != nil {
+		return nil, err
+	}
+	request := req.Clone(req.Context())
+	request.URL = cloneURL(pinned.URL)
+	request.Host = ""
+	return t.download.doPinnedRequest(request, pinned)
+}

package/dist/resources/templates/go-backend/internal/core/httpclient/safe_post_test.go

@@ -0,0 +1,56 @@
+package httpclient
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSafePostPinsValidatedAddressAndNeverFollowsRedirect(t *testing.T) {
+	calls := 0
+	client := NewSafePostClient(SafeDownloadClientOptions{LookupIP: func(context.Context, string) ([]net.IP, error) { return []net.IP{net.ParseIP("93.184.216.34")}, nil }, sendPinnedRequest: func(req *http.Request, pinned pinnedDownloadURL) (*http.Response, error) {
+		calls++
+		require.Equal(t, "93.184.216.34", pinned.IP.String())
+		require.Equal(t, "push.example.com", req.URL.Host)
+		body, err := io.ReadAll(req.Body)
+		require.NoError(t, err)
+		require.Equal(t, "ciphertext", string(body))
+		return &http.Response{StatusCode: 307, Header: http.Header{"Location": []string{"https://127.0.0.1/private"}}, Body: io.NopCloser(strings.NewReader("")), Request: req}, nil
+	}})
+	req, err := http.NewRequest(http.MethodPost, "https://push.example.com/path", strings.NewReader("ciphertext"))
+	require.NoError(t, err)
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, 307, resp.StatusCode)
+	require.Equal(t, 1, calls)
+}
+
+func TestSafePostRejectsPrivateAndMixedDNSBeforeNetwork(t *testing.T) {
+	for _, ips := range [][]net.IP{{net.ParseIP("127.0.0.1")}, {net.ParseIP("93.184.216.34"), net.ParseIP("10.0.0.1")}, {net.ParseIP("::ffff:127.0.0.1")}} {
+		client := NewSafePostClient(SafeDownloadClientOptions{LookupIP: func(context.Context, string) ([]net.IP, error) { return ips, nil }, sendPinnedRequest: func(*http.Request, pinnedDownloadURL) (*http.Response, error) {
+			t.Fatal("unsafe address reached network")
+			return nil, nil
+		}})
+		req, err := http.NewRequest(http.MethodPost, "https://push.example.com/path", strings.NewReader("ciphertext"))
+		require.NoError(t, err)
+		_, err = client.Do(req)
+		require.True(t, IsSafeDownloadValidationError(err))
+	}
+}
+
+func TestSafePostRejectsUnencryptedRequestsBeforeDNS(t *testing.T) {
+	client := NewSafePostClient(SafeDownloadClientOptions{LookupIP: func(context.Context, string) ([]net.IP, error) {
+		t.Fatal("unencrypted request reached DNS")
+		return nil, nil
+	}})
+	req, err := http.NewRequest(http.MethodPost, "http://push.example.com/path", strings.NewReader("ciphertext"))
+	require.NoError(t, err)
+	_, err = client.Do(req)
+	require.ErrorContains(t, err, "requires HTTPS POST")
+}