@yufengtadian/freedom-cli 1.13.1 → 1.13.3

package/lib/toolchain.js

@@ -0,0 +1,339 @@
+'use strict';
+
+// 工具链自动装配扩展：探测 Go / Rust / C++ 是否就位，缺失时给出安装动作（--apply 才真跑），
+// 并把镜像源等编译配置优化写进各工具自己的配置位。
+//
+// 「检测到配置好就不去检测」：探测要 spawn 子进程跑 --version，三平台冷启动累计几百毫秒，
+// 故 ok 结论进缓存（按 PATH 指纹 + TTL 失效）。失败结论**永不入缓存**——刚装好的工具必须
+// 当场被认出来，否则用户装完再跑一次会说「没装」，那是比慢得多的缺陷。
+//
+// 安装动作默认只打印不执行：这些命令要联网、要管理员权限、会改系统，属高危面（见 AGENTS.md
+// 铁律 8 口径），必须 --apply 显式授权。
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const CACHE_VERSION = 1;
+const CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+const SPECS = [
+  {
+    key: 'go',
+    name: 'Go 工具链',
+    why: '编译 Freedom 壳与内嵌 Go 后端（freedom shell build / cmd/freedom build）',
+    probes: [{ exe: 'go', args: ['version'], re: /go(\d+\.\d+(?:\.\d+)?)/ }],
+    manual: 'https://go.dev/dl/',
+    install: {
+      win32: [{ cmd: 'winget', args: ['install', '-e', '--id', 'GoLang.Go'] }],
+      darwin: [{ cmd: 'brew', args: ['install', 'go'] }],
+      linux: [{ cmd: 'sudo', args: ['apt-get', 'install', '-y', 'golang-go'] }],
+    },
+  },
+  {
+    key: 'rust',
+    name: 'Rust 工具链',
+    why: '编译 examples/multiproc 的 Rust 后端（rustc -O 单文件，不走 cargo）',
+    probes: [
+      { exe: 'rustc', args: ['--version'], re: /rustc\s+(\d+\.\d+(?:\.\d+)?)/ },
+      { exe: 'rustc', args: ['--version'], re: /rustc\s+(\d+\.\d+(?:\.\d+)?)/, homeRelative: true },
+    ],
+    manual: 'https://rustup.rs/',
+    install: {
+      win32: [{ cmd: 'winget', args: ['install', '-e', '--id', 'Rustlang.Rustup'] }],
+      darwin: [{ cmd: 'brew', args: ['install', 'rust'] }],
+      linux: [{ cmd: 'sudo', args: ['apt-get', 'install', '-y', 'rustc'] }],
+    },
+  },
+  {
+    key: 'cpp',
+    name: 'C/C++ 工具链',
+    why: 'cgo 依赖：Linux WebKitGTK 壳与 Windows WebView2 层需要宿主 C 编译器',
+    probes: [
+      { exe: 'cl', args: [], re: /Version\s+(\d+\.\d+)/, okNonZero: true },
+      { exe: 'g++', args: ['--version'], re: /(\d+\.\d+(?:\.\d+)?)/ },
+      { exe: 'clang++', args: ['--version'], re: /(\d+\.\d+(?:\.\d+)?)/ },
+    ],
+    manual: 'https://visualstudio.microsoft.com/visual-cpp-build-tools/',
+    install: {
+      win32: [{
+        cmd: 'winget',
+        args: ['install', '-e', '--id', 'Microsoft.VisualStudio.2022.BuildTools',
+          '--override', '"--quiet --wait --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended"'],
+      }],
+      darwin: [{ cmd: 'xcode-select', args: ['--install'] }],
+      linux: [{ cmd: 'sudo', args: ['apt-get', 'install', '-y', 'build-essential', 'pkg-config'] }],
+    },
+  },
+];
+
+function toolchainHome(opts = {}) {
+  return opts.home || process.env.FREEDOM_TOOLCHAIN_HOME || os.homedir();
+}
+
+function cacheFile(opts) {
+  return path.join(toolchainHome(opts), '.freedom', 'toolchain-cache.json');
+}
+
+function findInPath(exe, env) {
+  const dirs = String(env.PATH || '').split(path.delimiter).filter(Boolean);
+  const exts = env.FREEDOM_HOST_PLATFORM === 'win32' || process.platform === 'win32'
+    ? String(env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';').concat([''])
+    : [''];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const full = path.join(dir, exe + ext);
+      try { if (fs.existsSync(full) && fs.statSync(full).isFile()) return full; } catch (e) { /* 无权访问的 PATH 项：跳过 */ }
+    }
+  }
+  return null;
+}
+
+// PATH 指纹：工具可见性只取决于 PATH 变了没有，变了就必须重探（新装工具通常在 PATH 尾部）。
+function pathFingerprint(env) {
+  let h = 0;
+  const s = String(env.PATH || '');
+  for (let i = 0; i < s.length; i++) h = (Math.imul(h, 31) + s.charCodeAt(i)) | 0;
+  return h.toString(16);
+}
+
+function readCache(opts) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(cacheFile(opts), 'utf8'));
+    if (raw && raw.version === CACHE_VERSION && raw.host === hostPlatform(opts)) return raw;
+  } catch (e) { /* 无缓存 / 损坏 / 跨平台搬运：一律当未命中 */ }
+  return { version: CACHE_VERSION, host: hostPlatform(opts), pathHash: null, tools: {} };
+}
+
+function writeCache(opts, cache) {
+  const file = cacheFile(opts);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(cache, null, 2) + '\n');
+}
+
+function hostPlatform(opts) {
+  return (opts.env && opts.env.FREEDOM_HOST_PLATFORM) || process.platform;
+}
+
+// 单个工具链探测：返回 { ok, version, exe, reason }。
+function resolveProbe(p, o) {
+  if (p.homeRelative) {
+    // rustup 的默认安装位不进 PATH 时也要认出来（装完没重开终端是常态）。
+    const bin = path.join(o.env.CARGO_HOME || path.join(toolchainHome(o), '.cargo'), 'bin');
+    const exts = hostPlatform(o) === 'win32' ? ['.exe', ''] : [''];
+    for (const ext of exts) {
+      const full = path.join(bin, p.exe + ext);
+      try { if (fs.statSync(full).isFile()) return full; } catch (e) { /* 不存在 */ }
+    }
+    return null;
+  }
+  return findInPath(p.exe, o.env);
+}
+
+function probe(spec, opts) {
+  const o = Object.assign({ env: process.env, exec: spawnSync }, opts);
+  const reasons = [];
+  for (const p of spec.probes) {
+    const resolved = resolveProbe(p, o);
+    if (!resolved) continue;
+    let r;
+    try { r = o.exec(resolved, p.args, { encoding: 'utf8', timeout: 8000 }); } catch (e) { reasons.push(`${resolved}: 无法启动`); continue; }
+    const text = `${(r && r.stdout) || ''}${(r && r.stderr) || ''}`;
+    const m = text.match(p.re);
+    if (m && (r.status === 0 || p.okNonZero)) return { ok: true, version: m[1], exe: resolved };
+    if (r && r.error) { reasons.push(`${resolved}: ${r.error.code || r.error.message}`); continue; }
+    // 找得到可执行但跑不通（cl 未加载 vcvarsall 环境是最常见的一种）：记原因再试下一个候选。
+    reasons.push(`${resolved}: 可执行但输出无法识别（MSVC 需先加载 vcvarsall 环境）`);
+  }
+  return { ok: false, reason: reasons.length ? reasons[reasons.length - 1] : 'PATH 中未找到可执行' };
+}
+
+// status：命中缓存的 ok 记录直接跳过 spawn。
+function status(opts = {}) {
+  const o = Object.assign({ env: process.env, refresh: false }, opts);
+  const cache = readCache(o);
+  const hash = pathFingerprint(o.env);
+  const stale = cache.pathHash !== hash;
+  const rows = [];
+  for (const spec of SPECS) {
+    const hit = !o.refresh && !stale && cache.tools[spec.key] && cache.tools[spec.key].ok
+      && (Date.now() - cache.tools[spec.key].at) < CACHE_TTL_MS;
+    if (hit) {
+      rows.push({ key: spec.key, name: spec.name, why: spec.why, source: 'cache', cached: true, ...cache.tools[spec.key] });
+      continue;
+    }
+    const res = probe(spec, o);
+    rows.push({ key: spec.key, name: spec.name, why: spec.why, source: 'probe', cached: false, ...res });
+    if (res.ok) cache.tools[spec.key] = { ok: true, version: res.version, exe: res.exe, at: Date.now() };
+    else delete cache.tools[spec.key]; // 失败不入缓存：下次仍探
+  }
+  cache.pathHash = hash;
+  writeCache(o, cache);
+  return { rows, skipped: rows.filter((r) => r.cached).length };
+}
+
+function installPlan(spec, opts) {
+  const list = spec.install[hostPlatform(opts)] || [];
+  return list.map((s) => [s.cmd].concat(s.args).join(' '));
+}
+
+// install：默认只打印计划；--apply 才真跑（联网 + 提权 + 改系统，属高危动作）。
+function install(targets, opts = {}) {
+  const o = Object.assign({ env: process.env, apply: false, exec: spawnSync }, opts);
+  const want = resolveTargets(targets);
+  const st = status(Object.assign({}, o, { refresh: o.apply ? true : false }));
+  const out = [];
+  for (const spec of want) {
+    const row = st.rows.find((r) => r.key === spec.key);
+    if (row.ok && !o.force) {
+      out.push({ key: spec.key, action: 'skip', version: row.version, note: '已就位' });
+      continue;
+    }
+    const cmds = installPlan(spec, o);
+    if (!cmds.length) { out.push({ key: spec.key, action: 'manual', note: `本平台无自动安装命令，请手动获取：${spec.manual}` }); continue; }
+    if (!o.apply) { out.push({ key: spec.key, action: 'plan', commands: cmds, manual: spec.manual }); continue; }
+    const ran = [];
+    for (const line of cmds) {
+      const [cmd, ...args] = splitCmd(line);
+      let r;
+      try { r = o.exec(cmd, args, { stdio: 'inherit', env: o.env }); } catch (e) { r = { status: -1, error: e }; }
+      ran.push({ command: line, status: r ? r.status : -1 });
+      if (!r || r.status !== 0) break; // 前置步骤失败就别往下跑
+    }
+    out.push({ key: spec.key, action: 'applied', ran });
+  }
+  return { rows: out, dryRun: !o.apply };
+}
+
+function resolveTargets(raw) {
+  const keys = !raw || !raw.length || raw === 'missing' ? SPECS.map((s) => s.key) : String(raw).split(',').map((s) => s.trim()).filter(Boolean);
+  return SPECS.filter((s) => keys.includes(s.key));
+}
+
+function splitCmd(line) {
+  const m = String(line).match(/(?:[^\s"']+|"[^"]*")+/g) || [];
+  return m.map((t) => t.replace(/^"|"$/g, ''));
+}
+
+// ---- 配置优化：只写各工具自己的配置位，幂等 + .bak，缺省只打印 diff ----
+
+// 大陆网络提示：locale 或时区命中才提议换镜像（不误伤海外机器），也可 FREEDOM_CN_MIRROR=1/0 强制。
+function mainlandHint(env) {
+  const force = env.FREEDOM_CN_MIRROR;
+  if (force === '0' || force === 'false') return false;
+  if (force === '1' || force === 'true') return true;
+  const loc = `${env.LANG || ''}${env.LC_ALL || ''}${env.LC_CTYPE || ''}`;
+  const tz = env.TZ || '';
+  return /zh[-_]CN|chinese/i.test(loc) || /Asia\/(Shanghai|Chongqing|Harbin|Urumqi|Beijing|Kashgar)/i.test(tz);
+}
+
+const GO_PROXY = 'https://goproxy.cn,direct';
+const CARGO_SOURCE = {
+  'source.crates-io': { 'replace-with': 'rsproxy-sparse' },
+  'source.rsproxy-sparse': { registry: 'sparse+https://rsproxy.cn/index/' },
+};
+
+// cargo 的 config.toml：表名可含点（[source.crates-io]），按表头整块替换/追加。
+function upsertTomlTable(text, header, fields) {
+  const lines = String(text).split(/\r?\n/);
+  const block = [header];
+  for (const [k, v] of Object.entries(fields)) block.push(`${k} = ${JSON.stringify(v)}`);
+  const start = lines.findIndex((l) => l.trim() === header);
+  if (start < 0) {
+    while (lines.length && !lines[lines.length - 1].trim()) lines.pop();
+    return { text: lines.concat('', block).join('\n') + '\n', had: false };
+  }
+  let end = start + 1;
+  while (end < lines.length && !/^\s*\[/.test(lines[end])) end++;
+  const out = lines.slice(0, start).concat(block, lines.slice(end));
+  return { text: out.join('\n').replace(/\n*$/, '\n'), had: true };
+}
+
+function cargoConfigFile(env, home) {
+  const root = env.CARGO_HOME ? env.CARGO_HOME : path.join(home, '.cargo');
+  return path.join(root, 'config.toml');
+}
+
+// optimize：返回每个工具链的配置动作。apply=false 只回报将要写什么。
+function optimize(opts = {}) {
+  const o = Object.assign({ env: process.env, apply: false, exec: spawnSync }, opts);
+  const home = toolchainHome(o);
+  const actions = [];
+  const st = status(Object.assign({}, o, { refresh: false }));
+
+  const go = st.rows.find((r) => r.key === 'go');
+  if (!mainlandHint(o.env)) {
+    actions.push({ key: 'go', action: 'skip', note: '非大陆网络环境提示，保留官方 GOPROXY' });
+  } else if (!go || !go.ok) {
+    actions.push({ key: 'go', action: 'blocked', note: '未检测到 Go，先 freedom toolchain install go' });
+  } else {
+    const cur = runCapture(o.exec, go.exe, ['env', 'GOPROXY']);
+    if (cur && cur.includes('goproxy.cn')) {
+      actions.push({ key: 'go', action: 'skip', note: `GOPROXY 已是镜像（${cur}）` });
+    } else {
+      const cmdLine = `${go.exe} env -w GOPROXY=${GO_PROXY}`;
+      if (!o.apply) { actions.push({ key: 'go', action: 'plan', commands: [cmdLine], from: cur }); }
+      else {
+        const r = o.exec(go.exe, ['env', '-w', `GOPROXY=${GO_PROXY}`], { env: o.env, encoding: 'utf8' });
+        actions.push({ key: 'go', action: 'applied', to: GO_PROXY, status: r ? r.status : -1, error: r && r.error ? String(r.error.message) : null });
+      }
+    }
+  }
+
+  const rust = st.rows.find((r) => r.key === 'rust');
+  if (!mainlandHint(o.env)) {
+    actions.push({ key: 'rust', action: 'skip', note: '非大陆网络环境提示，不改 cargo 源' });
+  } else if (!rust || !rust.ok) {
+    actions.push({ key: 'rust', action: 'blocked', note: '未检测到 Rust，先 freedom toolchain install rust' });
+  } else {
+    const file = cargoConfigFile(o.env, home);
+    let text = '';
+    try { text = fs.readFileSync(file, 'utf8'); } catch (e) { /* 首次创建 */ }
+    if (/rsproxy\.cn/.test(text)) {
+      actions.push({ key: 'rust', action: 'skip', note: `cargo 源已是 rsproxy（${file}）`, file });
+    } else {
+      let next = text;
+      for (const [header, fields] of Object.entries(CARGO_SOURCE)) next = upsertTomlTable(next, `[${header}]`, fields).text;
+      if (!o.apply) actions.push({ key: 'rust', action: 'plan', file, writes: next });
+      else {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        if (fs.existsSync(file)) fs.copyFileSync(file, `${file}.bak`);
+        fs.writeFileSync(file, next);
+        actions.push({ key: 'rust', action: 'applied', file, backup: fs.existsSync(`${file}.bak`) ? `${file}.bak` : null });
+      }
+    }
+  }
+
+  const cpp = st.rows.find((r) => r.key === 'cpp');
+  actions.push({
+    key: 'cpp',
+    action: 'report',
+    ok: !!(cpp && cpp.ok),
+    note: cpp && cpp.ok
+      ? `已就位：${cpp.exe}（cgo 可直接使用，无用户配置需改）`
+      : `${cpp && cpp.reason ? cpp.reason + '；' : ''}Windows 需经 vcvarsall 注入环境（freedom build 已在子进程内处理），或安装 Build Tools`,
+  });
+  return { rows: actions, dryRun: !o.apply };
+}
+
+function runCapture(exec, exe, args) {
+  try {
+    const r = exec(exe, args, { encoding: 'utf8', timeout: 8000 });
+    if (!r || r.status !== 0) return null;
+    return String(r.stdout || '').trim();
+  } catch (e) {
+    return null;
+  }
+}
+
+// 清理缓存（测试与「重装后重探」用）。
+function clearCache(opts = {}) {
+  try { fs.unlinkSync(cacheFile(opts)); return true; } catch (e) { return false; }
+}
+
+module.exports = {
+  SPECS, status, install, optimize, probe, mainlandHint, upsertTomlTable,
+  cacheFile, clearCache, findInPath, pathFingerprint, installPlan, splitCmd, cargoConfigFile,
+  GO_PROXY, CACHE_VERSION, CACHE_TTL_MS,
+};

package/lib/tui.js

@@ -372,4 +372,40 @@ async function tui(cwd) {
   return 0;
 }
 
-module.exports = { tui, TUI };
+// 裸 `freedom` 的显示方式选择器：终端 TUI 或 Freedom Desktop（图形窗口）。
+// 先退出 raw mode 再拉起窗口 / 再进主菜单，避免两个界面抢同一个终端。
+async function pickDisplay(cwd) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.error('[freedom] 当前非交互式终端，请改用具体子命令（freedom help 查看全部命令）。');
+    return 1;
+  }
+  const app = new TUI();
+  app.enter();
+  let idx;
+  try {
+    idx = await app.menu('选择显示方式', ['终端 TUI（纯文本菜单）', 'Freedom Desktop（图形窗口，由 freedom 自身打包）'], {
+      footer: '↑ ↓ 选择 · Enter 确认 · q 退出',
+    });
+  } finally {
+    app.exit();
+  }
+  if (idx === null) return 0;
+  if (idx === 1) return desktopFlow(cwd);
+  return await tui(cwd);
+}
+
+async function desktopFlow(cwd) {
+  const { desktop } = require('./desktop');
+  const theme = require('./theme');
+  try {
+    const r = await desktop({});
+    process.stdout.write(`${theme.ok('Freedom Desktop 已拉起：')}${r.exe}\n`);
+    if (r.rebuilt) process.stdout.write(`${theme.dim(`（本次已重新打包，CLI v${r.version}）`)}\n`);
+    return 0;
+  } catch (e) {
+    process.stdout.write(`\n${theme.err(e.message)}\n`);
+    return 1;
+  }
+}
+
+module.exports = { tui, pickDisplay, TUI };

package/lib/utils.js

@@ -25,6 +25,9 @@ function goTemplateDir() {
 }
 
 function shellDir() {
+  // 壳目录可经 env 覆写（离线/测试注入假壳；与 FREEDOM_SHELL_REPO 等既有旋钮同族）。
+  const override = process.env.FREEDOM_SHELL_DIR;
+  if (override) return path.resolve(override);
   return path.join(PKG_ROOT, 'shell');
 }
 
@@ -81,6 +84,53 @@ function nativePlatform() {
   return `${plat}-${arch}`;
 }
 
+// 平台别名归一化：把口语写法（win / mac / linux / windows / osx / ubuntu）与架构同义词
+// （x86_64 / amd64 / aarch64）统一到 ALL_PLATFORMS 的 key，无法识别返回 null。
+// 缺架构时的默认值与历史 build.js keyMap 一致：win→x64、darwin→arm64（已不支持 Intel Mac）、
+// linux→x64。
+const PLAT_FAMILY = {
+  win: 'win', win32: 'win', win64: 'win', windows: 'win', pc: 'win',
+  mac: 'darwin', macos: 'darwin', 'mac-os': 'darwin', 'mac-os-x': 'darwin',
+  osx: 'darwin', darwin: 'darwin', apple: 'darwin',
+  linux: 'linux', lin: 'linux', ubuntu: 'linux', debian: 'linux',
+};
+const PLAT_ARCH = {
+  x64: 'x64', x86_64: 'x64', 'x86-64': 'x64', amd64: 'x64',
+  arm64: 'arm64', aarch64: 'arm64', 'aarch-64': 'arm64',
+};
+const PLAT_DEFAULT_ARCH = { win: 'x64', darwin: 'arm64', linux: 'x64' };
+
+function normalizePlatform(raw) {
+  if (typeof raw !== 'string') return null;
+  const s = raw.trim().toLowerCase().replace(/\s+/g, '-').replace(/_/g, '-');
+  if (!s) return null;
+  if (ALL_PLATFORMS.includes(s)) return s;
+  // 从右往左试两种切法（架构名自身可能带分隔符，如 x86-64；族名也一样，如 mac-os-x）：
+  // 先按最后一个分隔符切，切不出架构再按倒数第二个切，还不行就整串当族名。
+  let fam = s;
+  let arch;
+  const cuts = [];
+  const last = s.lastIndexOf('-');
+  if (last > 0) {
+    cuts.push([last, s.slice(last + 1)]);
+    const prev = s.lastIndexOf('-', last - 1);
+    if (prev > 0) cuts.push([prev, s.slice(prev + 1)]);
+  }
+  for (const [at, tail] of cuts) {
+    if (PLAT_ARCH[tail]) {
+      arch = PLAT_ARCH[tail];
+      fam = s.slice(0, at);
+      break;
+    }
+  }
+  const family = PLAT_FAMILY[fam];
+  if (!family) return null;
+  const key = `${family}-${arch || PLAT_DEFAULT_ARCH[family]}`;
+  // 归一后仍须落在支持矩阵里：darwin-x64（Intel Mac 已停止支持）之类的组合
+  // 不能因为"语法像对的"就放行。
+  return ALL_PLATFORMS.includes(key) ? key : null;
+}
+
 function localShellPath(plat) {
   return path.join(shellDir(), plat, SHELL_EXE_NAME[plat] || 'freedom-shell');
 }
@@ -134,6 +184,7 @@ module.exports = {
   isMacPlat,
   platformExeName,
   nativePlatform,
+  normalizePlatform,
   localShellPath,
   tutorialFile,
   loadConfig,

package/lib/verify.js

@@ -10,6 +10,7 @@
 const fs = require('fs');
 const path = require('path');
 const { isWinPlat, platformExeName } = require('./utils');
+const { APP_BIN_MAGIC, decryptApp, buildIntegrity } = require('./security');
 
 // ---- 产物定位 ----
 
@@ -107,6 +108,7 @@ function checkPlatformProduct({ targetDir, plat, appName, hasBackend }) {
   const hasIntegrity = fs.existsSync(path.join(resDir, '.integrity'));
   const hasHtml = fs.existsSync(path.join(resDir, 'index.html'));
   const hasConfig = fs.existsSync(path.join(resDir, 'config.json'));
+  let securePayload = null;
   if (hasBin) {
     if (hasHtml || hasConfig) {
       fail('资源形态', 'high 模式残留明文 index.html/config.json（互斥被破坏）');
@@ -115,13 +117,35 @@ function checkPlatformProduct({ targetDir, plat, appName, hasBackend }) {
     }
     if (!hasIntegrity) fail('完整性清单', '缺失 .integrity');
     else okc('完整性清单', '.integrity 存在');
-    // app.bin 容器头校验（FRDM1）
-    let head = '';
+    // app.bin 容器头校验（FRDM2）
+    let bin = Buffer.alloc(0);
     try {
-      head = fs.readFileSync(path.join(resDir, 'app.bin')).subarray(0, 5).toString('latin1');
+      bin = fs.readFileSync(path.join(resDir, 'app.bin'));
     } catch (e) { /* 读取失败按不通过处理 */ }
-    if (head === 'FRDM1') okc('app.bin 容器', 'FRDM1 头有效');
-    else fail('app.bin 容器', '容器头不是 FRDM1，文件损坏或非本工具产物');
+    const head = bin.subarray(0, APP_BIN_MAGIC.length).toString('latin1');
+    if (head !== APP_BIN_MAGIC) {
+      fail('app.bin 容器', `容器头不是 ${APP_BIN_MAGIC}（实际 "${head}"），文件损坏、非本工具产物或旧版产物`);
+    } else {
+      okc('app.bin 容器', `${APP_BIN_MAGIC} 头有效（${fmtSize(bin.length)}）`);
+      // 真解一次容器：认证失败 = 产物被篡改或 name 与容器不匹配；同时拿到 backend 供后端检查。
+      try {
+        securePayload = decryptApp(appName, bin);
+        okc('容器解密', `认证通过，html ${fmtSize(securePayload.html.length)} / config ${fmtSize(securePayload.config.length)}`);
+      } catch (e) {
+        fail('容器解密', e.message);
+      }
+      // .integrity 与容器一致（防整体替换：清单值由构建期容器盐派生密钥签名）
+      if (hasIntegrity) {
+        try {
+          const list = JSON.parse(fs.readFileSync(path.join(resDir, '.integrity'), 'utf8'));
+          const want = buildIntegrity(appName, bin).appBin;
+          if (list.appBin !== want) fail('完整性清单', '.integrity 与 app.bin 不一致（产物可能被替换）');
+          else okc('完整性清单', '.integrity 与 app.bin 一致');
+        } catch (e) {
+          fail('完整性清单', e.message);
+        }
+      }
+    }
   } else {
     if (hasIntegrity) {
       fail('资源形态', '明文模式残留 high 产物（.integrity）');
@@ -148,10 +172,21 @@ function checkPlatformProduct({ targetDir, plat, appName, hasBackend }) {
     }
   }
 
-  // 4) 后端目录
+  // 4) 后端：明文模式看 resources/backend 目录；high 模式看容器内 backend 条目
+  //    （容器模式下磁盘不得有明文后端目录，运行时由壳解密到临时目录）。
   if (hasBackend) {
-    if (fs.existsSync(path.join(resDir, 'backend'))) okc('后端进程', 'resources/backend 存在');
-    else fail('后端进程', '配置了 backend 但 resources/backend 缺失');
+    if (hasBin) {
+      const n = securePayload && securePayload.backend ? Object.keys(securePayload.backend).length : 0;
+      if (n === 0) fail('后端进程', 'high 模式容器内无 backend 条目（后端源码未入容器）');
+      else okc('后端进程', `容器内 ${n} 个后端文件（磁盘无明文）`);
+      if (fs.existsSync(path.join(resDir, 'backend'))) {
+        fail('后端进程', 'high 模式残留明文 resources/backend（与容器互斥被破坏）');
+      }
+    } else if (fs.existsSync(path.join(resDir, 'backend'))) {
+      okc('后端进程', 'resources/backend 存在');
+    } else {
+      fail('后端进程', '配置了 backend 但 resources/backend 缺失');
+    }
   }
 
   return checks;
@@ -191,13 +226,14 @@ function collectTree(dir, depth, out, maxDepth) {
     return out;
   }
   for (const e of entries) {
+    const abs = path.join(dir, e.name);
+    const stat = safeStat(abs);
     if (e.name === '.integrity') {
-      // 完整性清单内容为敏感校验值，仅标注存在与大小，不展开内容
-      out.push({ rel: e.name, size: 0, isDir: false, depth, hidden: true });
+      // 清单内容是不对外展开的校验值，但大小必须照实报：写死 0 会让产物自检打印
+      // 「.integrity (0 B)」，在高模式安检语境下读起来像清单是空的，反而制造误判。
+      out.push({ rel: e.name, size: stat ? stat.size : 0, isDir: false, depth, hidden: true });
       continue;
     }
-    const abs = path.join(dir, e.name);
-    const stat = safeStat(abs);
     if (e.isDirectory()) {
       out.push({ rel: e.name, size: 0, isDir: true, depth });
       if (depth < maxDepth) collectTree(abs, depth + 1, out, maxDepth);

package/lib/webkit.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// Linux 构建的 WebKitGTK 依赖名选择。
+//
+// 背景：webview_go 的 cgo 依赖名在本地补丁副本（third_party/webview_go）里拆成了
+// webkit2_40.go / webkit2_41.go 两个互斥标签文件。Ubuntu 24.04 / Debian 13 已移除
+// webkit2gtk-4.0，只保留同一套 C API 的 webkit2gtk-4.1 —— 沿用 4.0 会让 `go build`
+// 在新发行版上直接失败。
+//
+// 这里做的事：探测 pkg-config 实际装了哪个，缺 4.0 且有 4.1 时给 go 命令加
+// `-tags webkit2_41`；否则返回原始环境（老发行版与 CI 产物基线零变化）。
+// webkitgtk-6.0 是另一套 API，不能这样桥接（需上游适配）。
+
+const { spawnSync } = require('child_process');
+
+function pkgConfigExists(mod, exec = spawnSync) {
+  try {
+    return exec('pkg-config', ['--exists', mod], { stdio: 'ignore' }).status === 0;
+  } catch (e) {
+    return false;
+  }
+}
+
+// 需要 4.1 标签吗：仅 Linux、仅当 4.0 不可用而 4.1 可用。
+function needsWebkit241(env = process.env, exec = spawnSync) {
+  if (env.FREEDOM_WEBKIT_FORCE_41 === '1') return true;
+  const platform = env.FREEDOM_HOST_PLATFORM || process.platform;
+  if (platform !== 'linux') return false;
+  if (pkgConfigExists('webkit2gtk-4.0', exec)) return false;
+  return pkgConfigExists('webkit2gtk-4.1', exec);
+}
+
+// 把标签并入 GOFLAGS（go 命令原生识别 GOFLAGS，故子进程与人工命令行都吃到）。
+// 已有 GOFLAGS 时追加，不覆盖。
+function applyWebkitTags(env = process.env, exec = spawnSync) {
+  const out = Object.assign({}, env);
+  if (!needsWebkit241(env, exec)) return { env: out, tags: [] };
+  const tags = ['webkit2_41'];
+  const existing = (env.GOFLAGS || '').trim();
+  const merged = existing ? `${existing} -tags=${tags.join(',')}` : `-tags=${tags.join(',')}`;
+  out.GOFLAGS = merged;
+  return { env: out, tags };
+}
+
+module.exports = { needsWebkit241, applyWebkitTags, pkgConfigExists };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yufengtadian/freedom-cli",
-  "version": "1.13.1",
+  "version": "1.13.3",
   "description": "Freedom WebView desktop shell packaging tool - no Go toolchain required, one command packs three-platform desktop apps",
   "repository": {
     "type": "git",
@@ -15,7 +15,7 @@
     "frontend",
     "cross-platform"
   ],
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "publishConfig": {
     "access": "public"
   },
@@ -26,6 +26,7 @@
     "bin",
     "lib",
     "shell",
+    "skill",
     "templates",
     "tutorial",
     "postinstall.js",