@wangnanshan/dsh-nanshan-publish-manager 1.0.1 → 1.0.2

package/README.md

@@ -84,8 +84,8 @@ DSH 组件就是一个 npm 包：
 1. **版本与标签** —— 目标版本（写回 `package.json`）、npm tag、`public` / `restricted`。
 2. **发布目标与选项** —— registry（默认读取你的 `~/.npmrc`）、可选构建脚本（`npm run <script>`）、自动运行发布预检查、先演练、自动写入版本号、发布备注。
 3. **发布预检查** —— 运行发布预检查；有阻断项时正式发布按钮不可用。
-4. **确认与执行** —— 选择发布验证方式，勾选确认，先「仅演练」（`npm publish --dry-run`，临时写入的目标版本会在演练后还原）或「正式发布」（带最终确认弹窗）。
-5. **发布记录** —— 每次演练 / 发布 / 失败都会写入本机记录，包含版本、tag、access、验证方式、耗时、预检查摘要和命令输出。
+4. **确认与执行** —— 选择发布验证方式，勾选确认，先「仅演练」（`npm publish --dry-run`，临时写入的目标版本会在演练后还原）或「正式发布」（带最终确认弹窗）；本机会话方式还可以在弹窗里选「在终端发布」。
+5. **发布记录** —— 每次演练 / 发布 / 失败都会写入本机记录，包含版本、tag、access、验证方式、耗时、预检查摘要和命令输出；终端发布会在记录里标记「终端」。
 
 ## 发布验证方式
 
@@ -101,14 +101,27 @@ npm 已在 **2025-12-09 永久撤销全部经典 Token**，本插件不再提供
 
 Granular Access Token 可以在 npm 网站 Settings → Tokens 或 `npm token create` 创建；写令牌最长 90 天，无人值守发布建议开启 Bypass 2FA。
 
-页面内的 OTP 只支持 TOTP（身份验证器 6 位数字）。如果账号使用安全密钥 / 网页型 2FA，npm 需要在交互式终端里打开浏览器授权；这种情况下请在终端执行 `npm publish`，或创建一个开启 Bypass 2FA 的 Granular Access Token 后使用「细粒度令牌」方式。
+页面内的 OTP 只支持 TOTP（身份验证器 6 位数字）。如果账号使用安全密钥 / 网页型 2FA，npm 需要在交互式终端里打开浏览器授权；这种情况下可以直接在确认弹窗点「在终端发布」，或创建一个开启 Bypass 2FA 的 Granular Access Token 后使用「细粒度令牌」方式。
 
 npm 凭据**不经过插件的存储层**：本机会话使用你自己的 `~/.npmrc`；Granular Token 的临时 npmrc 在发布后删除；OTP 只作用于一次子进程。三者都不会写入发布记录。
+
+### 在系统终端发布
+
+在「本机登录会话」方式下，最终确认弹窗提供「在终端发布」：
+
+- macOS 打开 Terminal.app；
+- Windows 打开 `cmd.exe`；
+- Linux 尝试 `x-terminal-emulator`、`gnome-terminal`、`konsole`、`xfce4-terminal`、`xterm`。
+
+插件会生成一个临时脚本并自动执行实际发布命令（配置了构建脚本时先执行构建）。你在系统终端里完成 OTP 或浏览器/安全密钥验证；插件等待最多 15 分钟，读取退出码后把结果写入发布记录，记录带「终端」标记。终端输出保留在系统终端窗口，不写入插件记录，避免 OTP 进入日志。
+
+如果终端没有自动出现，或等待超时，插件会弹出居中的错误弹窗；终端窗口里的完整输出仍然保留，可据此排查。
+
 ### OTP 的时机
 
 OTP 不是插件强制每次都要填写的字段：
 
-- **本机会话**：当 npm 对你的账号或这个包要求发布 2FA 时，每一次发布尝试都会发起挑战。填写后才随请求发送；不填时若 npm 挑战，会返回 EOTP，弹窗会重新打开并清空旧码。验证码一次性、约 30 秒有效，不能复用。
+- **本机会话**：当 npm 对你的账号或这个包要求发布 2FA 时，每一次发布尝试都会发起挑战。填写后才随请求发送；不填时若 npm 挑战，会返回 EOTP，并弹出居中的错误弹窗、清空旧码；关闭弹窗后重新点「正式发布」即可重试。验证码一次性、约 30 秒有效，不能复用。
 - **填写时机**：OTP 只在点击「正式发布」后的确认弹窗里填写。UI 已经运行过发布预检查时，服务端不会在点击后再次执行整套 npm 预检查，因此验证码会在确认后的极短时间内使用，避免被前置预检查拖到过期。
 - **Granular Access Token**：令牌开启 **Bypass 2FA** 时不需要 OTP；未开启时 npm 仍会挑战，建议改用本机会话 + OTP 或换一个开启 Bypass 2FA 的令牌。
 - **OIDC 可信发布**：由 CI 的 ID Token 换发短期令牌，不需要 OTP。
@@ -125,6 +138,7 @@ OTP 不是插件强制每次都要填写的字段：
 | 本机会话 + OTP | 同上，OTP 通过 `npm_config_otp` 环境变量传递，日志注 `# auth: local session + OTP (npm_config_otp)` |
 | 细粒度令牌 | 同上，令牌通过一次性 npmrc（`npm_config_userconfig`）传递，日志注 `# auth: granular access token (temporary npmrc)` |
 | OIDC | 同上，npm 自动完成 OIDC 交换，日志注 `# auth: OIDC trusted publishing` |
+| 在系统终端发布 | 同上，在系统终端里交互完成 OTP / 网页 2FA，日志注 `# auth: local session (system terminal)` |
 | 仅演练 | 追加 `--dry-run`，不注认证信息 |
 
 预发布版本（如 `1.0.0-beta.1`）选择 `latest` 时会给出警告，建议改用 `beta` / `next`；目标版本低于已发布最新版时，npm 会拒绝把 `latest` 指回旧版本，插件会把该错误翻译成明确的提示。
@@ -135,7 +149,7 @@ OTP 不是插件强制每次都要填写的字段：
 
 1. 确认验证码来自**当前登录账号**（`npm whoami` 显示 `wangnanshan`）绑定的身份验证器，并且是刚生成的；旧码不能复用。
 2. 确认系统时间自动同步。TOTP 依赖本机时钟；当前机器与 npm registry 的偏差约 0.6 秒，属于正常范围。
-3. 如果账号的 2FA 方式是**安全密钥 / 网页认证**而不是身份验证器 TOTP，页面内输入 6 位码不会成功。请在终端执行 `npm publish` 让 npm 打开浏览器授权，或使用下面的令牌方案。
+3. 如果账号的 2FA 方式是**安全密钥 / 网页认证**而不是身份验证器 TOTP，页面内输入 6 位码不会成功。请在确认弹窗点「在终端发布」，让 npm 在系统终端里打开浏览器授权；或使用下面的令牌方案。
 4. 使用 **Granular Access Token** 时，必须在创建令牌时勾选 **Bypass 2FA**（`npm token create --bypass-2fa`）；只粘贴一个未开启 Bypass 2FA 的令牌仍会返回 EOTP。
 5. 如果配置了构建脚本，构建会先于发布执行；构建较慢时验证码可能过期，建议使用开启 Bypass 2FA 的令牌。
 
@@ -209,6 +223,7 @@ HTTP 接口（仅本机、同源写入）：
 - 正式发布需要先 `npm login`（2 小时会话，默认网页授权）；未登录时只能演练。
 - Granular Access Token 若未开启 Bypass 2FA，发布时仍会被要求 OTP；此时请改用本机会话 + OTP。
 - 发布使用本机 npm 配置，不支持在页面里输入 token；OTP 只用于单次发布，不落盘。
-- 需要 macOS / Linux 的 npm 启动方式；Windows 的 `npm.cmd` 尚未适配。
+- 系统终端发布支持 macOS Terminal、Windows `cmd.exe` 和 Linux 常见终端；Windows 的 `npm.cmd` 已做启动适配，但当前环境主要在 macOS 验证。
+- 终端发布最多等待 15 分钟；关闭终端或未完成验证会超时，不会写入成功记录；终端输出不写入插件记录。
 - 页面直接执行 `npm publish`，请在发布前用「仅演练」确认打包内容。
 - `npm publish` 会执行组件 `package.json` 中的 publish 生命周期脚本；请只发布你信任的组件。

package/client.js

@@ -29,6 +29,8 @@ window.__ModuleLoader__.load({
         'action.dryRun': '仅演练',
         'action.dryRunning': '演练中…',
         'action.publish': '正式发布',
+        'action.publishTerminal': '在终端发布',
+        'action.terminalWaiting': '等待终端…',
         'action.publishing': '发布中…',
         'action.cancel': '再想想',
         'action.confirmPublish': '确认发布',
@@ -140,7 +142,7 @@ window.__ModuleLoader__.load({
         'auth.sessionHint': '会话仅 2 小时有效；过期后请在终端运行 npm login（默认网页授权）再发布。页面 OTP 仅支持身份验证器 TOTP；安全密钥型 2FA 请在终端发布，或使用开启 Bypass 2FA 的令牌。',
         'auth.tokenUser': '令牌对应账号：{name}',
         'auth.tokenUnverified': '令牌已填写；发布预检查可验证账号（发布结果为准）',
-        'auth.tokenHint': '只用于本次发布，不保存、不写日志。',
+        'auth.tokenHint': '只用于本次发布，不保存、不写日志；未开启 Bypass 2FA 时仍需 2FA，页面不会弹出浏览器。',
         'auth.tokenPlaceholder': '粘贴 npm_... 令牌',
         'auth.needToken': '请填写 Granular Access Token',
         'auth.oidcReady': 'OIDC 已就绪（{provider}）',
@@ -174,7 +176,7 @@ window.__ModuleLoader__.load({
         'authInfo.token.step5': '点击「正式发布」；插件写入权限 0600 的临时 npmrc，发布后立即删除。',
         'authInfo.token.key1': '是什么：npm 当前的细粒度访问令牌，替代已撤销的经典 Token。',
         'authInfo.token.key2': '权限：Read and write，仅限选中的包/作用域。',
-        'authInfo.token.key3': 'Bypass 2FA：开启后不需要 OTP；未开启仍可能返回 EOTP。',
+        'authInfo.token.key3': 'Bypass 2FA：开启后不需要 OTP；未开启时 npm 会要求 2FA，插件不会弹出浏览器，请改用 Bypass 令牌或本机会话 + OTP。',
         'authInfo.token.key4': '存储：不保存、不写日志；临时 npmrc 发布后删除。',
         'authInfo.token.key5': '安全：泄露后立即在 npm 网站撤销。',
         'authInfo.oidc.title': 'OIDC 可信发布',
@@ -222,12 +224,15 @@ window.__ModuleLoader__.load({
         'field.accessToken': '访问令牌',
         'check.token-format.label': 'Granular Token 已填写',
         'check.token-format.hint': '切到「细粒度令牌」后粘贴有效的 Granular Access Token；建议开启 Bypass 2FA。',
+        'check.token-bypass.label': 'Bypass 2FA 状态',
+        'check.token-bypass.hint': 'Bypass 2FA 是服务端令牌属性，令牌字符串本身不包含它；请确认创建时已勾选，否则发布时仍会被要求 2FA。',
         'check.oidc-env.label': 'OIDC 发布环境',
         'check.oidc-env.hint': 'OIDC 仅在 GitHub Actions（id-token: write）或 GitLab CI（NPM_ID_TOKEN）中可用。',
         'checkDetail.tokenUnverified': '令牌已提供，但 whoami 未通过；发布时以 registry 结果为准',
         'checkDetail.oidcAtPublish': 'OIDC 将在发布时自动交换令牌',
         'checkDetail.tokenEmpty': '未填写令牌',
         'checkDetail.tokenFilled': '已填写',
+        'checkDetail.cannotDetect': '无法从令牌本身判断；请确认创建时已开启 Bypass 2FA',
         'checkDetail.oidcGithub': 'GitHub Actions 环境',
         'checkDetail.oidcGitlab': 'GitLab CI 环境',
         'checkDetail.oidcUnavailable': '未检测到 OIDC 环境',
@@ -237,11 +242,19 @@ window.__ModuleLoader__.load({
         'modal.dryFirstHint': '本次设置启用了「发布前先演练」，你还没有在本次会话里演练；确认后仍会直接正式发布。',
         'modal.publishOk': '确认发布',
         'modal.otpHint': '请填写刚生成的验证码；一次性、约 30 秒有效。',
+        'modal.terminalHint': '也可以打开系统终端完成发布：npm 会在终端里询问 OTP 或打开浏览器完成 2FA，插件会等待结果并写入记录。',
         'modal.buildBeforeOtp': '当前配置了构建脚本：发布前会先执行构建，耗时较长时验证码可能过期；建议使用开启 Bypass 2FA 的 Granular Token。',
         'toast.settingsSaved': '发布设置已保存',
         'toast.checkDone': '预检查完成',
         'toast.publishOk': '发布成功，记录已写入',
         'toast.publishFail': '发布没有完成',
+        'error.publishTitle': '发布失败',
+        'error.dryTitle': '演练失败',
+        'error.terminalTitle': '终端发布失败',
+        'error.terminalHint': '如果终端已打开，请查看完整输出；若未打开，请检查系统终端设置后重试。',
+        'error.checkTitle': '发布预检查失败',
+        'error.saveTitle': '保存设置失败',
+        'error.publishHint': '完整命令输出见发布板块下方的结果区域。',
         'toast.dryOk': '演练完成，包内容可以发布',
         'toast.dryFail': '演练失败，请查看输出',
         'toast.added': '已添加组件目录',
@@ -253,6 +266,7 @@ window.__ModuleLoader__.load({
         'record.showLog': '查看输出（{n}）',
         'record.hideLog': '收起输出',
         'record.otp': '含 OTP',
+        'record.terminal': '终端',
         'stage.build': '构建阶段',
         'stage.checks': '预检查阶段',
         'stage.publish': '发布阶段',
@@ -340,6 +354,8 @@ window.__ModuleLoader__.load({
         'action.dryRun': 'Dry run',
         'action.dryRunning': 'Dry running…',
         'action.publish': 'Publish',
+        'action.publishTerminal': 'Publish in terminal',
+        'action.terminalWaiting': 'Waiting for terminal…',
         'action.publishing': 'Publishing…',
         'action.cancel': 'Not yet',
         'action.confirmPublish': 'Publish now',
@@ -451,7 +467,7 @@ window.__ModuleLoader__.load({
         'auth.sessionHint': 'Sessions last two hours; when expired, run npm login (web authorization by default) in a terminal. Page OTP supports authenticator TOTP only; security-key 2FA must publish from a terminal or use a token with Bypass 2FA.',
         'auth.tokenUser': 'Token account: {name}',
         'auth.tokenUnverified': 'Token provided; the publish pre-check can verify the account (the publish result is authoritative)',
-        'auth.tokenHint': 'Used only for this publish; never saved or logged.',
+        'auth.tokenHint': 'Used only for this publish; never saved or logged. Without Bypass 2FA, npm still requires 2FA and this page does not open a browser.',
         'auth.tokenPlaceholder': 'Paste an npm_... token',
         'auth.needToken': 'Enter a granular access token',
         'auth.oidcReady': 'OIDC ready ({provider})',
@@ -485,7 +501,7 @@ window.__ModuleLoader__.load({
         'authInfo.token.step5': 'Click Publish; the plugin writes a temporary npmrc with mode 0600 and deletes it right after the publish.',
         'authInfo.token.key1': 'What it is: npm’s current fine-grained token, replacing revoked classic tokens.',
         'authInfo.token.key2': 'Permissions: Read and write, limited to the selected package/scope.',
-        'authInfo.token.key3': 'Bypass 2FA: no OTP is required once enabled; without it the registry may still return EOTP.',
+        'authInfo.token.key3': 'Bypass 2FA: no OTP once enabled; without it npm requires 2FA, and this plugin does not open a browser—use a Bypass token or the local session + OTP.',
         'authInfo.token.key4': 'Storage: never saved or logged; the temporary npmrc is removed after publishing.',
         'authInfo.token.key5': 'Security: revoke it on npmjs.com immediately if it leaks.',
         'authInfo.oidc.title': 'OIDC trusted publishing',
@@ -533,12 +549,15 @@ window.__ModuleLoader__.load({
         'field.accessToken': 'Access token',
         'check.token-format.label': 'Granular token provided',
         'check.token-format.hint': 'Select “Granular token” and paste a valid token; enabling Bypass 2FA is recommended.',
+        'check.token-bypass.label': 'Bypass 2FA status',
+        'check.token-bypass.hint': 'Bypass 2FA is server-side token metadata, not part of the token string; confirm it was enabled when the token was created, or npm will still require 2FA at publish.',
         'check.oidc-env.label': 'OIDC publish environment',
         'check.oidc-env.hint': 'OIDC works only in GitHub Actions (id-token: write) or GitLab CI (NPM_ID_TOKEN).',
         'checkDetail.tokenUnverified': 'Token provided, but whoami failed; the registry result at publish time is authoritative',
         'checkDetail.oidcAtPublish': 'OIDC exchanges its token automatically at publish time',
         'checkDetail.tokenEmpty': 'No token entered',
         'checkDetail.tokenFilled': 'Entered',
+        'checkDetail.cannotDetect': 'Cannot be determined from the token itself; confirm Bypass 2FA was enabled at creation',
         'checkDetail.oidcGithub': 'GitHub Actions environment',
         'checkDetail.oidcGitlab': 'GitLab CI environment',
         'checkDetail.oidcUnavailable': 'No OIDC environment detected',
@@ -548,11 +567,19 @@ window.__ModuleLoader__.load({
         'modal.dryFirstHint': '“Dry run first” is enabled but no dry run has happened in this session; confirming publishes directly.',
         'modal.publishOk': 'Publish',
         'modal.otpHint': 'Enter a freshly generated code; single-use and valid for about 30 seconds.',
+        'modal.terminalHint': 'You can also publish in the system terminal: npm handles OTP or web 2FA there, and the plugin waits and records the result.',
         'modal.buildBeforeOtp': 'A build script is configured: the build runs before publishing and may outlast the OTP; a Granular Access Token with Bypass 2FA is recommended.',
         'toast.settingsSaved': 'Release settings saved',
         'toast.checkDone': 'Pre-check finished',
         'toast.publishOk': 'Published; the record was saved',
         'toast.publishFail': 'The publish did not complete',
+        'error.publishTitle': 'Publish failed',
+        'error.dryTitle': 'Dry run failed',
+        'error.terminalTitle': 'Terminal publish failed',
+        'error.terminalHint': 'If the terminal opened, read its full output; otherwise check your system terminal setup and retry.',
+        'error.checkTitle': 'Publish pre-check failed',
+        'error.saveTitle': 'Could not save settings',
+        'error.publishHint': 'The full command output is shown below in the publish result area.',
         'toast.dryOk': 'Dry run finished; the package can be published',
         'toast.dryFail': 'The dry run failed; see the output',
         'toast.added': 'Component directory added',
@@ -564,6 +591,7 @@ window.__ModuleLoader__.load({
         'record.showLog': 'Show output ({n})',
         'record.hideLog': 'Hide output',
         'record.otp': 'OTP sent',
+        'record.terminal': 'Terminal',
         'stage.build': 'Build stage',
         'stage.checks': 'Pre-check stage',
         'stage.publish': 'Publish stage',
@@ -819,6 +847,9 @@ window.__ModuleLoader__.load({
 .np-result{margin-top:4px;border:1px solid var(--np-line);border-radius:10px;background:var(--np-sheet2);overflow:hidden}
 .np-result__head{display:flex;align-items:center;gap:8px;flex-wrap:wrap;padding:9px 11px;border-bottom:1px solid var(--np-line);font-size:12.5px;font-weight:500}
 .np-result__head .np-count{margin-left:auto}
+.np-result__close{appearance:none;flex:none;display:grid;place-items:center;width:22px;height:22px;padding:0;border:1px solid color-mix(in srgb,var(--np-bad) 28%,var(--np-line));border-radius:6px;background:color-mix(in srgb,var(--np-bad) 7%,transparent);color:var(--np-bad);cursor:pointer}
+.np-result__close:hover{background:color-mix(in srgb,var(--np-bad) 14%,transparent);border-color:color-mix(in srgb,var(--np-bad) 50%,var(--np-line));color:var(--np-bad)}
+.np-result__close:focus-visible{outline:2px solid var(--np-bad);outline-offset:2px}
 .np-result__cmd{padding:7px 11px;border-bottom:1px solid var(--np-line);font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11.5px;line-height:1.55;color:var(--np-ink-soft);word-break:break-all}
 .np-log{margin:0;padding:10px 12px;max-height:260px;overflow:auto;white-space:pre-wrap;word-break:break-word;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11.5px;line-height:1.55;color:var(--np-ink-soft)}
 .np-railcard{position:relative;padding:16px;background:var(--np-sheet);border:1px solid var(--np-line);border-radius:12px;box-shadow:var(--np-shadow)}
@@ -849,6 +880,10 @@ window.__ModuleLoader__.load({
 .np-dialog__warn{padding:8px 10px;border:1px solid color-mix(in srgb,var(--np-bad) 30%,var(--np-line));border-radius:8px;background:color-mix(in srgb,var(--np-bad) 6%,transparent);color:var(--np-bad)!important}
 .np-dialog__actions{display:flex;justify-content:flex-end;gap:8px;margin-top:16px}
 .np-dialog.np-dialog--info{width:min(560px,100%)}
+.np-dialog.np-dialog--error{width:min(540px,100%)}
+.np-dialog--error .np-info__head h2{margin:0;flex:1;min-width:0}
+.np-error__message{max-height:320px;overflow:auto;padding:10px 12px;border:1px solid color-mix(in srgb,var(--np-bad) 30%,var(--np-line));border-radius:8px;background:color-mix(in srgb,var(--np-bad) 5%,transparent);color:var(--np-ink);font-size:12.5px;line-height:1.65;white-space:pre-wrap;word-break:break-word;user-select:text}
+.np-dialog--error .np-error__detail{margin:8px 0 0;font-size:11.5px;line-height:1.55;color:var(--np-ink-soft);word-break:break-word}
 .np-dialog--info .np-info__head h2{margin:0;flex:1;min-width:0}
 .np-dialog--info .np-info__intro{margin:8px 0 4px}
 .np-info__head{display:flex;align-items:flex-start;justify-content:space-between;gap:10px}
@@ -1012,6 +1047,7 @@ window.__ModuleLoader__.load({
       if (detail === 'OIDC_AT_PUBLISH') return t('checkDetail.oidcAtPublish')
       if (detail === 'EMPTY') return t('checkDetail.tokenEmpty')
       if (detail === 'GRANULAR_TOKEN') return t('checkDetail.tokenFilled')
+      if (detail === 'CANNOT_DETECT') return t('checkDetail.cannotDetect')
       if (detail === 'github-actions') return t('checkDetail.oidcGithub')
       if (detail === 'gitlab') return t('checkDetail.oidcGitlab')
       if (detail === 'UNAVAILABLE') return t('checkDetail.oidcUnavailable')
@@ -1214,6 +1250,10 @@ window.__ModuleLoader__.load({
       play: [
         ['path', { d: 'M5 3.5 12.5 8 5 12.5V3.5Z' }],
       ],
+      terminal: [
+        ['rect', { x: 2.2, y: 3.2, width: 11.6, height: 9.6, rx: 1.6 }],
+        ['path', { d: 'm4.8 6.1 2.4 2.2-2.4 2.2M8.6 10.5h2.8' }],
+      ],
       pencil: [
         ['path', { d: 'M3 13l.9-3.1 6.3-6.3 2.2 2.2-6.3 6.3L3 13Z' }],
         ['path', { d: 'M9.6 4.2 11.8 6.4' }],
@@ -1337,6 +1377,57 @@ window.__ModuleLoader__.load({
       )
     }
 
+    function ErrorDialog(props) {
+      const [t] = useText()
+      const [copied, setCopied] = React.useState(false)
+      const message = props.message || t('common.error')
+      React.useEffect(() => {
+        setCopied(false)
+      }, [props.title, props.message])
+      React.useEffect(() => {
+        const onKeyDown = (event) => {
+          if (event.key === 'Escape') props.onClose()
+        }
+        document.addEventListener('keydown', onKeyDown)
+        return () => document.removeEventListener('keydown', onKeyDown)
+      }, [props.onClose])
+      async function copy() {
+        try {
+          const parts = [props.title, message, props.detail, props.hint].filter(Boolean)
+          await navigator.clipboard.writeText(parts.join('\n\n'))
+          setCopied(true)
+        } catch {
+          // Clipboard may be unavailable; the message stays selectable.
+        }
+      }
+      return h('div', {
+        className: 'np-modal',
+        role: 'presentation',
+        onMouseDown: (event) => {
+          if (event.target === event.currentTarget) props.onClose()
+        },
+      },
+        h('div', { className: 'np-dialog np-dialog--error', role: 'dialog', 'aria-modal': 'true', 'aria-labelledby': 'np-error-title' },
+          h('div', { className: 'np-info__head' },
+            h('h2', { id: 'np-error-title' }, props.title),
+            h('button', {
+              type: 'button',
+              className: 'np-btn np-btn--ghost np-btn--small',
+              'aria-label': t('action.close'),
+              onClick: props.onClose,
+            }, h(Glyph, { name: 'close', size: 13 })),
+          ),
+          h('div', { className: 'np-error__message' }, message),
+          props.detail ? h('p', { className: 'np-error__detail' }, props.detail) : null,
+          props.hint ? h('p', { className: 'np-error__detail' }, props.hint) : null,
+          h('div', { className: 'np-dialog__actions' },
+            h('button', { type: 'button', className: 'np-btn', onClick: copy }, copied ? t('action.copied') : t('action.copy')),
+            h('button', { type: 'button', className: 'np-btn np-btn--primary', autoFocus: true, onClick: props.onClose }, t('action.close')),
+          ),
+        ),
+      )
+    }
+
     function useToast() {
       const [toast, setToast] = React.useState(null)
       const timer = React.useRef(null)
@@ -1567,6 +1658,7 @@ window.__ModuleLoader__.load({
       const [accessToken, setAccessToken] = React.useState('')
       const [showToken, setShowToken] = React.useState(false)
       const [toast, showToast] = useToast()
+      const [errorDialog, setErrorDialog] = React.useState(null)
       const okButtonRef = React.useRef(null)
       const otpInputRef = React.useRef(null)
       const tokenInputRef = React.useRef(null)
@@ -1655,6 +1747,18 @@ window.__ModuleLoader__.load({
       const effectiveAccess = isScopedPackage ? (settings ? settings.access : 'public') : 'public'
       const isPrerelease = typeof targetVersion === 'string' && targetVersion.includes('-')
 
+      const closeError = React.useCallback(() => setErrorDialog(null), [])
+      const showError = React.useCallback((title, message, detail, hint) => {
+        setModalOpen(false)
+        setInfoMode(null)
+        setErrorDialog({
+          title,
+          message: message || t('common.error'),
+          detail,
+          hint,
+        })
+      }, [t])
+
       async function saveSettings(next, silent) {
         if (!next) return
         setBusy('save')
@@ -1664,7 +1768,7 @@ window.__ModuleLoader__.load({
           if (!silent) showToast('ok', t('toast.settingsSaved'))
           return data.settings
         } catch (failure) {
-          showToast('error', failure && failure.message ? failure.message : t('common.error'))
+          showError(t('error.saveTitle'), failure && failure.message ? failure.message : t('common.error'))
           return null
         } finally {
           setBusy('')
@@ -1728,7 +1832,7 @@ window.__ModuleLoader__.load({
           setCheckInfo({ ran: true, at: Date.now(), npmInfo: data.npmInfo || null })
           showToast('ok', t('toast.checkDone'))
         } catch (failure) {
-          showToast('error', failure && failure.message ? failure.message : t('common.error'))
+          showError(t('error.checkTitle'), failure && failure.message ? failure.message : t('common.error'))
         } finally {
           setBusy('')
         }
@@ -1771,7 +1875,18 @@ window.__ModuleLoader__.load({
               setAccessToken('')
             }
           } else {
-            showToast('error', data.error || (dryRun ? t('toast.dryFail') : t('toast.publishFail')))
+            const failureMessage = data.error
+              || (data.record && data.record.message)
+              || (dryRun ? t('toast.dryFail') : t('toast.publishFail'))
+            const context = dryRun
+              ? `${component.name}@${targetVersion} · ${settings.registry}`
+              : `${component.name}@${targetVersion} · ${t(`auth.mode.${authMode}`)} · ${settings.registry}`
+            showError(
+              dryRun ? t('error.dryTitle') : t('error.publishTitle'),
+              failureMessage,
+              context,
+              t('error.publishHint'),
+            )
             if (Array.isArray(data.checks) && data.checks.length > 0) {
               setChecks(data.checks)
               setCheckInfo({ ran: true, at: Date.now(), npmInfo: checkInfo.npmInfo })
@@ -1779,21 +1894,84 @@ window.__ModuleLoader__.load({
             if (data.otpRequired === true) {
               setOtp('')
               setOtpEnteredAt(0)
-              setModalOpen(true)
             }
           }
-          const fresh = await apiGet(`/component?dir=${encodeURIComponent(dir)}`)
-          payloadRef.current = fresh
-          setPayload(fresh)
-          setSettings(fresh.settings)
-          if (!data.ok) setChecks(Array.isArray(data.checks) && data.checks.length > 0 ? data.checks : fresh.checks)
+          try {
+            const fresh = await apiGet(`/component?dir=${encodeURIComponent(dir)}`)
+            payloadRef.current = fresh
+            setPayload(fresh)
+            setSettings(fresh.settings)
+            if (!data.ok) setChecks(Array.isArray(data.checks) && data.checks.length > 0 ? data.checks : fresh.checks)
+            if (data.ok) {
+              setChecks(fresh.checks)
+              setCheckInfo({ ran: false, at: null, npmInfo: null })
+            }
+            setTargetVersion(fresh.component.version)
+          } catch {
+            // The publish result is already on screen; a refresh failure must
+            // not replace it with a misleading "publish failed" dialog.
+          }
+        } catch (failure) {
+          showError(t('error.publishTitle'), failure && failure.message ? failure.message : t('common.error'))
+        } finally {
+          setBusy('')
+        }
+      }
+
+      async function publishInTerminal() {
+        if (!settings) return
+        setModalOpen(false)
+        setOtp('')
+        setOtpEnteredAt(0)
+        setBusy('terminal')
+        try {
+          const data = await apiPost('/publish-terminal', {
+            dir,
+            version: targetVersion,
+            authMode,
+            registry: settings.registry,
+            tag: settings.tag,
+            access: effectiveAccess,
+            buildScript: settings.buildScript,
+            note: settings.note,
+            requireChecks: settings.requireChecks,
+            checksFresh: settings.requireChecks && checkInfo.ran && summary.fail === 0,
+            checksSummary: settings.requireChecks && checkInfo.ran ? summary : undefined,
+            writeVersion: settings.writeVersion,
+          }, { allowFailure: true })
+          if (data.record) {
+            setResult(data.record)
+            setExpandedRecord(null)
+          }
           if (data.ok) {
+            showToast('ok', t('toast.publishOk'))
+            setConfirmed(false)
+          } else {
+            showError(
+              t('error.terminalTitle'),
+              data.error || t('toast.publishFail'),
+              `${component.name}@${targetVersion}`,
+              t('error.terminalHint'),
+            )
+          }
+          try {
+            const fresh = await apiGet(`/component?dir=${encodeURIComponent(dir)}`)
+            payloadRef.current = fresh
+            setPayload(fresh)
+            setSettings(fresh.settings)
             setChecks(fresh.checks)
             setCheckInfo({ ran: false, at: null, npmInfo: null })
+            setTargetVersion(fresh.component.version)
+          } catch {
+            // Keep the terminal result visible.
           }
-          setTargetVersion(fresh.component.version)
         } catch (failure) {
-          showToast('error', failure && failure.message ? failure.message : t('common.error'))
+          showError(
+            t('error.terminalTitle'),
+            failure && failure.message ? failure.message : t('common.error'),
+            undefined,
+            t('error.terminalHint'),
+          )
         } finally {
           setBusy('')
         }
@@ -2180,7 +2358,7 @@ window.__ModuleLoader__.load({
                   className: 'np-btn np-btn--primary',
                   disabled: busy !== '' || blocked !== '',
                   onClick: openPublishDialog,
-                }, h(Glyph, { name: 'upload', size: 13 }), busy === 'publish' ? t('action.publishing') : t('action.publish')),
+                }, h(Glyph, { name: 'upload', size: 13 }), busy === 'terminal' ? t('action.terminalWaiting') : busy === 'publish' ? t('action.publishing') : t('action.publish')),
                 blocked
                   ? h('span', { className: 'np-hint' }, blocked)
                   : h('span', { className: 'np-hint' }, t('hint.targetVersion')),
@@ -2192,7 +2370,15 @@ window.__ModuleLoader__.load({
                     h('span', null, t('execute.resultTitle')),
                     h('span', { className: `np-chip ${result.ok ? 'np-chip--ok' : 'np-chip--fail'}` }, result.ok ? t('execute.resultOk') : t('execute.resultFail')),
                     result.authMode && !result.dryRun ? h('span', { className: 'np-chip' }, t(`auth.mode.${result.authMode}`)) : null,
+                    result.terminal ? h('span', { className: 'np-chip np-chip--accent' }, t('record.terminal')) : null,
                     h('span', { className: 'np-count' }, `v${result.version} · ${formatDuration(result.durationMs)}`),
+                    h('button', {
+                      type: 'button',
+                      className: 'np-result__close',
+                      title: t('action.close'),
+                      'aria-label': t('action.close'),
+                      onClick: () => setResult(null),
+                    }, h(Glyph, { name: 'close', size: 12 })),
                   ),
                   Array.isArray(result.logs) && result.logs.length > 0
                     ? result.logs.map((log, index) => h('div', { key: index },
@@ -2245,6 +2431,7 @@ window.__ModuleLoader__.load({
                         h('span', { className: `np-chip ${record.ok ? 'np-chip--ok' : 'np-chip--fail'}` }, record.ok ? t('record.ok') : t('record.fail')),
                         record.authMode && !record.dryRun ? h('span', { className: 'np-chip' }, t(`auth.mode.${record.authMode}`)) : null,
                         record.otpProvided ? h('span', { className: 'np-chip np-chip--accent' }, t('record.otp')) : null,
+                        record.terminal ? h('span', { className: 'np-chip np-chip--accent' }, t('record.terminal')) : null,
                         record.name && record.name !== packageName ? h('span', { className: 'np-chip', title: record.name }, record.name) : null,
                       ),
                       h('div', { className: 'np-record__time' },
@@ -2335,12 +2522,21 @@ window.__ModuleLoader__.load({
               ),
               h('p', { className: 'np-hint' }, tr('modal.authNote', { mode: t(`auth.mode.${authMode}`) })),
               authMode === 'session' && settings.buildScript ? h('p', { className: 'np-hint' }, t('modal.buildBeforeOtp')) : null,
+              authMode === 'session' ? h('p', { className: 'np-hint' }, t('modal.terminalHint')) : null,
               blocked ? h('p', { className: 'np-hint' }, blocked) : null,
               h('p', { className: 'np-dialog__warn' }, t('modal.publishWarning')),
               settings.dryRunFirst && !records.some((record) => record.dryRun === true)
                 ? h('p', { className: 'np-hint' }, t('modal.dryFirstHint'))
                 : null,
               h('div', { className: 'np-dialog__actions' },
+                authMode === 'session'
+                  ? h('button', {
+                    type: 'button',
+                    className: 'np-btn',
+                    disabled: busy !== '' || blocked !== '',
+                    onClick: publishInTerminal,
+                  }, h(Glyph, { name: 'terminal', size: 13 }), busy === 'terminal' ? t('action.terminalWaiting') : t('action.publishTerminal'))
+                  : null,
                 h('button', { type: 'button', className: 'np-btn np-btn--ghost', onClick: () => setModalOpen(false) }, t('action.cancel')),
                 h('button', {
                   type: 'button',
@@ -2398,6 +2594,16 @@ window.__ModuleLoader__.load({
           )
           : null,
 
+        errorDialog
+          ? h(ErrorDialog, {
+            title: errorDialog.title,
+            message: errorDialog.message,
+            detail: errorDialog.detail,
+            hint: errorDialog.hint,
+            onClose: closeError,
+          })
+          : null,
+
         h(Toast, { toast }),
       )
     }

package/index.js

@@ -234,8 +234,14 @@ export function apply(ctx, config = {}) {
       seen.add(candidate)
       candidates.push(candidate)
     }
+    const npmName = process.platform === 'win32' ? 'npm.cmd' : 'npm'
     for (const dir of String(process.env.PATH || '').split(delimiter)) {
-      if (dir) add(join(dir, 'npm'))
+      if (dir) add(join(dir, npmName))
+    }
+    if (process.platform === 'win32') {
+      if (process.env.APPDATA) add(join(process.env.APPDATA, 'npm', 'npm.cmd'))
+      if (process.env.ProgramFiles) add(join(process.env.ProgramFiles, 'nodejs', 'npm.cmd'))
+      if (process.env.NVM_SYMLINK) add(join(process.env.NVM_SYMLINK, 'npm.cmd'))
     }
     add('/opt/homebrew/bin/npm')
     add('/usr/local/bin/npm')
@@ -301,11 +307,17 @@ export function apply(ctx, config = {}) {
       const startedAt = Date.now()
       let child
       try {
-        child = spawn(executable, args, {
+        const isWindowsScript = process.platform === 'win32' && /\.(cmd|bat)$/i.test(executable)
+        const command = isWindowsScript ? (process.env.ComSpec || 'cmd.exe') : executable
+        const commandArgs = isWindowsScript
+          ? ['/d', '/s', '/c', `"${[executable, ...args].map(quoteCmdArg).join(' ')}"`]
+          : args
+        child = spawn(command, commandArgs, {
           cwd: processOptions.cwd,
           env: processOptions.env || process.env,
           stdio: ['ignore', 'pipe', 'pipe'],
           windowsHide: true,
+          ...(isWindowsScript ? { windowsVerbatimArguments: true } : {}),
         })
       } catch (error) {
         const message = String(error && error.message ? error.message : error)
@@ -842,6 +854,13 @@ export function apply(ctx, config = {}) {
           status: tokenProvided ? 'pass' : 'fail',
           detail: tokenProvided ? 'GRANULAR_TOKEN' : 'EMPTY',
         })
+        if (tokenProvided) {
+          // The Bypass 2FA flag is server-side token metadata, not part of the
+          // token string. npm exposes it in `npm token list --json`, but that
+          // needs an account session and returns masked tokens, so the pasted
+          // token cannot be matched reliably here.
+          checks.push({ id: 'token-bypass', status: 'warn', detail: 'CANNOT_DETECT' })
+        }
       }
     }
 
@@ -1145,6 +1164,7 @@ export function apply(ctx, config = {}) {
       otpAgeMs: Number.isFinite(input.otpAgeMs) ? input.otpAgeMs : null,
       authMode: AUTH_MODES.has(input.authMode) ? input.authMode : 'session',
       tokenProvided: input.tokenProvided === true,
+      terminal: input.terminal === true,
       checksFresh: input.checksFresh === true,
       at: new Date().toISOString(),
       durationMs: commands.reduce((sum, command) => sum + (Number(command.durationMs) || 0), 0),
@@ -1321,6 +1341,7 @@ export function apply(ctx, config = {}) {
       const result = await runNpm(args, { cwd: dir, timeoutMs: options.publishTimeoutMs, extraEnv: env })
       const resultText = `${result.stderr || ''}\n${result.output || ''}`
       const otpRequired = /EOTP|one-time password|one-time pass/i.test(resultText)
+      const bypassRequired = /bypass 2fa|two-factor authentication or granular access token with bypass|granular access token with bypass 2fa enabled/i.test(resultText)
       const versionConflict = /EPUBLISHCONFLICT|previously published|cannot publish over|已发布的版本/i.test(resultText)
       const latestTagConflict = /Cannot implicitly apply the ["']?latest["']? tag|previously published version .* is higher/i.test(resultText)
       const authFailure = /ENEEDAUTH|need auth|not logged in|E401|401 Unauthorized|Unauthorized|E403|403 Forbidden|not authorized/i.test(resultText)
@@ -1356,9 +1377,17 @@ export function apply(ctx, config = {}) {
         message = '该版本已经存在于 registry，不能被覆盖；请提升版本号后重试。'
       } else if (latestTagConflict) {
         message = '目标版本低于已发布的最新版，不能把 latest 指回旧版本；请提升版本号或改用其他 tag。'
+      } else if (bypassRequired) {
+        if (authMode === 'token') {
+          message = '该 Granular Token 未开启 Bypass 2FA：npm 要求发布时进行 2FA（插件不会弹出浏览器）。请重新创建令牌并开启 Bypass 2FA（npm token create --bypass-2fa），或改用「本机登录会话 + OTP」。'
+        } else if (authMode === 'session') {
+          message = 'npm 要求发布时进行 2FA：请填写 OTP；如果账号使用安全密钥/网页型 2FA，请在终端发布或使用开启 Bypass 2FA 的令牌。'
+        } else {
+          message = 'OIDC 发布仍被要求 2FA：请检查 npm 包的 Trusted Publisher 配置。'
+        }
       } else if (otpRequired) {
         if (authMode === 'token') {
-          message = '该 Granular Token 仍要求 2FA：请重新创建令牌并开启 Bypass 2FA（npm token create --bypass-2fa），或切换到「本机登录会话 + OTP」。'
+          message = '该 Granular Token 仍要求 2FA（插件不会弹出浏览器）：请重新创建令牌并开启 Bypass 2FA（npm token create --bypass-2fa），或切换到「本机登录会话 + OTP」。'
         } else if (authMode === 'oidc') {
           message = 'OIDC 发布仍被要求额外验证：请检查 npm 包的 Trusted Publisher 配置。'
         } else if (otpProvided) {
@@ -1420,6 +1449,220 @@ export function apply(ctx, config = {}) {
     }
   }
 
+  async function openSystemTerminal(scriptPath) {
+    if (process.platform === 'darwin') {
+      const opened = await runProcess('/usr/bin/open', ['-a', 'Terminal', scriptPath], { timeoutMs: 15_000 })
+      if (!opened.ok) {
+        const detail = firstLine(opened.stderr || opened.output) || 'open 失败'
+        throw httpError(500, `无法打开 Terminal：${detail}`)
+      }
+      return 'Terminal'
+    }
+    if (process.platform === 'win32') {
+      try {
+        await launchDetached('cmd.exe', ['/d', '/s', '/c', 'start', '', 'cmd.exe', '/k', scriptPath])
+        return 'cmd'
+      } catch (error) {
+        throw httpError(500, `无法打开命令提示符：${String(error && error.message ? error.message : error)}`)
+      }
+    }
+    if (process.platform === 'linux') {
+      const candidates = [
+        ['x-terminal-emulator', ['-e', 'bash', scriptPath]],
+        ['gnome-terminal', ['--', 'bash', scriptPath]],
+        ['konsole', ['-e', 'bash', scriptPath]],
+        ['xfce4-terminal', ['--command', `bash ${shellQuote(scriptPath)}`]],
+        ['xterm', ['-e', 'bash', scriptPath]],
+      ]
+      for (const [command, args] of candidates) {
+        const resolved = await findOnPath(command)
+        if (!resolved) continue
+        try {
+          await launchDetached(resolved, args)
+          return command
+        } catch {
+          // Try the next terminal emulator.
+        }
+      }
+      throw httpError(500, '未找到可用的系统终端（x-terminal-emulator / gnome-terminal / konsole / xfce4-terminal / xterm）。')
+    }
+    throw httpError(400, `当前系统（${process.platform}）不支持自动打开终端。`)
+  }
+
+  async function publishInTerminal(input) {
+    const startedAt = Date.now()
+    const { dir, pkg: initialPkg } = await requireComponentDir(input.dir)
+    if (publishing.has(dir)) throw httpError(409, '该组件正在发布中，请稍候。')
+    publishing.add(dir)
+    try {
+      await ensureState()
+      const settings = mergeSettings({ ...(state.settings[dir] || {}), ...sanitizeSettings(input) })
+      if (!options.allowPublish) throw httpError(403, '当前插件配置禁止正式发布（allowPublish: false）。')
+      const requestedAuthMode = AUTH_MODES.has(input.authMode) ? input.authMode : settings.authMode
+      if (requestedAuthMode !== 'session') {
+        throw httpError(400, '「在系统终端发布」只适用于本机登录会话方式。')
+      }
+      const version = (typeof input.version === 'string' && input.version.trim() !== '')
+        ? input.version.trim()
+        : String(initialPkg.version || '')
+      if (!isValidVersion(version)) throw httpError(400, '目标版本号不是合法的语义化版本，例如 1.2.3 或 1.3.0-beta.1。')
+      const registry = normalizeRegistry(input.registry, settings.registry)
+      const tag = TAGS.has(input.tag) ? input.tag : settings.tag
+      const access = ACCESS.has(input.access) ? input.access : settings.access
+      const isScoped = typeof initialPkg.name === 'string' && initialPkg.name.startsWith('@')
+      const effectiveAccess = isScoped ? access : 'public'
+      const note = typeof input.note === 'string' ? input.note.trim().slice(0, 500) : settings.note
+      const buildScript = typeof input.buildScript === 'string'
+        ? cleanScriptName(input.buildScript)
+        : settings.buildScript
+      if (settings.requireChecks && input.checksFresh !== true) {
+        throw httpError(400, '请先运行发布预检查并通过，再在系统终端发布。')
+      }
+      if (buildScript && (!isPlainObject(initialPkg.scripts) || typeof initialPkg.scripts[buildScript] !== 'string')) {
+        throw httpError(400, `package.json 中没有名为 ${buildScript} 的脚本。`)
+      }
+      const previousVersion = String(initialPkg.version || '')
+      let versionUpdated = false
+      let pkg = initialPkg
+
+      await exclusive(async () => {
+        state.settings[dir] = {
+          ...settings, registry, tag, access: effectiveAccess, note, buildScript, authMode: 'session',
+        }
+        await persist()
+      })
+
+      if (version !== previousVersion) {
+        if (settings.writeVersion === false) {
+          throw httpError(400, `package.json 当前版本为 ${previousVersion}，请先改为 ${version}，或允许自动写入版本号。`)
+        }
+        await writePackageVersion(dir, initialPkg, version)
+        versionUpdated = true
+        pkg = await readPackage(dir)
+      }
+
+      const npm = await resolveNpm()
+      if (!npm.available) throw httpError(500, '找不到 npm 可执行文件。')
+      const publishArgs = ['publish', '--tag', tag]
+      if (isScoped) publishArgs.push('--access', effectiveAccess)
+      publishArgs.push('--registry', registry)
+      const display = `${buildScript ? `npm run ${buildScript} && ` : ''}npm publish --tag ${tag}${isScoped ? ` --access ${effectiveAccess}` : ''} --registry ${registry} # auth: local session (system terminal)`
+      const id = randomUUID()
+      const taskDir = join(dataDir, 'terminal', id)
+      await mkdir(taskDir, { recursive: true })
+      const statusPath = join(taskDir, 'publish.status')
+      const scriptPath = join(taskDir, process.platform === 'win32' ? 'publish.cmd' : 'publish.command')
+      const binDir = npm.binDir || dirname(npm.executable)
+
+      let script
+      if (process.platform === 'win32') {
+        const q = cmdQuote
+        const lines = [
+          '@echo off',
+          'chcp 65001 >nul',
+          'setlocal',
+          `set "PATH=${String(binDir).replace(/%/g, '%%')};%PATH%"`,
+          `cd /d ${q(dir)}`,
+        ]
+        if (buildScript) {
+          lines.push(`${q(npm.executable)} run ${q(buildScript)}`)
+          lines.push('set "code=%ERRORLEVEL%"')
+          lines.push('if not "%code%"=="0" goto done')
+        } else {
+          lines.push('set "code=0"')
+        }
+        lines.push(`${q(npm.executable)} ${publishArgs.map(q).join(' ')}`)
+        lines.push('set "code=%ERRORLEVEL%"')
+        lines.push(':done')
+        lines.push(`> ${q(statusPath)} echo %code%`)
+        lines.push('echo.')
+        lines.push('echo Publish finished with exit code %code%.')
+        lines.push('pause')
+        lines.push('exit /b %code%')
+        lines.push('')
+        script = lines.join('\r\n')
+      } else {
+        const q = shellQuote
+        const lines = [
+          '#!/bin/bash',
+          `export PATH=${q(binDir)}:"$PATH"`,
+          `cd ${q(dir)} || exit 90`,
+        ]
+        if (buildScript) {
+          lines.push(`${q(npm.executable)} run ${q(buildScript)}`)
+          lines.push('code=$?')
+        } else {
+          lines.push('code=0')
+        }
+        lines.push('if [ "$code" -eq 0 ]; then')
+        lines.push(`  ${q(npm.executable)} ${publishArgs.map(q).join(' ')}`)
+        lines.push('  code=$?')
+        lines.push('fi')
+        lines.push(`printf '%s\\n' "$code" > ${q(statusPath)}`)
+        lines.push(`printf '\\n发布结束，退出码 %s。按任意键关闭窗口…\\n' "$code"`)
+        lines.push('read -n 1 -s -r')
+        lines.push('exit "$code"')
+        lines.push('')
+        script = lines.join('\n')
+      }
+      await writeFile(scriptPath, script, { encoding: 'utf8', mode: 0o700 })
+
+      const terminalName = await openSystemTerminal(scriptPath)
+      const deadline = Date.now() + 15 * 60_000
+      let code = null
+      while (Date.now() < deadline) {
+        if (await exists(statusPath)) {
+          const text = (await readFile(statusPath, 'utf8')).trim()
+          if (/^-?\d+$/.test(text)) {
+            code = Number(text)
+            break
+          }
+        }
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, 1000))
+      }
+      if (code === null) {
+        throw httpError(504, `已打开系统终端（${terminalName}），但等待发布结果超时。请查看终端窗口；如果仍在运行，完成后重新运行发布预检查确认状态。`)
+      }
+      const ok = code === 0
+      const record = makeRecord({
+        dir, pkg, version, tag, access: effectiveAccess, registry, dryRun: false, ok, stage: 'publish',
+        message: ok
+          ? `已在系统终端完成发布 ${String(pkg.name || '')}@${version}。`
+          : `终端发布失败（退出码 ${code}）；请查看系统终端窗口中的输出。`,
+        note, previousVersion, versionUpdated,
+        commands: [{
+          label: 'publish',
+          command: display,
+          code,
+          signal: null,
+          timedOut: false,
+          durationMs: Date.now() - startedAt,
+          output: '',
+        }],
+        checksSummary: input.checksSummary,
+        checksFresh: true,
+        authMode: 'session',
+        tokenProvided: false,
+        otpProvided: false,
+        otpRequired: false,
+        terminal: true,
+      })
+      await saveRecord(record)
+      overviewCache = { at: 0, value: null }
+      return {
+        ok,
+        record,
+        versionUpdated,
+        previousVersion,
+        authMode: 'session',
+        terminal: terminalName,
+        ...(ok ? {} : { error: record.message }),
+      }
+    } finally {
+      publishing.delete(dir)
+    }
+  }
+
   /* ---------------------------------------------------------------- routing */
 
   async function requireComponentDir(raw) {
@@ -1549,6 +1792,9 @@ export function apply(ctx, config = {}) {
       if (pathname === `${API}/publish`) {
         return sendJson(response, 200, { ok: true, ...(await publishComponent(body || {})) })
       }
+      if (pathname === `${API}/publish-terminal`) {
+        return sendJson(response, 200, { ok: true, ...(await publishInTerminal(body || {})) })
+      }
       return sendJson(response, 404, { ok: false, code: 'not-found', message: '未知的发布管理接口。' })
     } catch (error) {
       const status = error && Number.isInteger(error.status) ? error.status : 500
@@ -1720,6 +1966,47 @@ function isInside(root, target) {
   return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel))
 }
 
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, "'\\''")}'`
+}
+
+function quoteCmdArg(value) {
+  const text = String(value)
+  if (text === '') return '""'
+  if (!/[\s"&|<>^()%!]/.test(text)) return text
+  return `"${text.replace(/"/g, '\\"')}"`
+}
+
+function cmdQuote(value) {
+  return `"${String(value).replace(/"/g, '""')}"`
+}
+
+async function findOnPath(command) {
+  for (const dir of String(process.env.PATH || '').split(delimiter)) {
+    if (!dir) continue
+    const candidate = join(dir, command)
+    if (await exists(candidate)) return candidate
+  }
+  return null
+}
+
+function launchDetached(command, args) {
+  return new Promise((resolveLaunch, rejectLaunch) => {
+    let child
+    try {
+      child = spawn(command, args, { detached: true, stdio: 'ignore', windowsHide: false })
+    } catch (error) {
+      rejectLaunch(error)
+      return
+    }
+    child.once('error', rejectLaunch)
+    child.once('spawn', () => {
+      child.unref()
+      resolveLaunch()
+    })
+  })
+}
+
 async function exists(path) {
   try {
     await stat(path)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wangnanshan/dsh-nanshan-publish-manager",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "type": "module",
   "description": "【南山】DSH发布管理：以 npm 包（dsh.bundle + dsh.client）的官方形式，管理本机 DSH 组件的发布设置、发布预检查、npm 发布与发布记录。",
   "license": "MIT",