@yufengtadian/freedom-cli 1.13.2 → 1.14.0-preview

package/lib/toolchain.js

@@ -0,0 +1,339 @@
+'use strict';
+
+// 工具链自动装配扩展：探测 Go / Rust / C++ 是否就位，缺失时给出安装动作（--apply 才真跑），
+// 并把镜像源等编译配置优化写进各工具自己的配置位。
+//
+// 「检测到配置好就不去检测」：探测要 spawn 子进程跑 --version，三平台冷启动累计几百毫秒，
+// 故 ok 结论进缓存（按 PATH 指纹 + TTL 失效）。失败结论**永不入缓存**——刚装好的工具必须
+// 当场被认出来，否则用户装完再跑一次会说「没装」，那是比慢得多的缺陷。
+//
+// 安装动作默认只打印不执行：这些命令要联网、要管理员权限、会改系统，属高危面（见 AGENTS.md
+// 铁律 8 口径），必须 --apply 显式授权。
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const CACHE_VERSION = 1;
+const CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+const SPECS = [
+  {
+    key: 'go',
+    name: 'Go 工具链',
+    why: '编译 Freedom 壳与内嵌 Go 后端（freedom shell build / cmd/freedom build）',
+    probes: [{ exe: 'go', args: ['version'], re: /go(\d+\.\d+(?:\.\d+)?)/ }],
+    manual: 'https://go.dev/dl/',
+    install: {
+      win32: [{ cmd: 'winget', args: ['install', '-e', '--id', 'GoLang.Go'] }],
+      darwin: [{ cmd: 'brew', args: ['install', 'go'] }],
+      linux: [{ cmd: 'sudo', args: ['apt-get', 'install', '-y', 'golang-go'] }],
+    },
+  },
+  {
+    key: 'rust',
+    name: 'Rust 工具链',
+    why: '编译 examples/multiproc 的 Rust 后端（rustc -O 单文件，不走 cargo）',
+    probes: [
+      { exe: 'rustc', args: ['--version'], re: /rustc\s+(\d+\.\d+(?:\.\d+)?)/ },
+      { exe: 'rustc', args: ['--version'], re: /rustc\s+(\d+\.\d+(?:\.\d+)?)/, homeRelative: true },
+    ],
+    manual: 'https://rustup.rs/',
+    install: {
+      win32: [{ cmd: 'winget', args: ['install', '-e', '--id', 'Rustlang.Rustup'] }],
+      darwin: [{ cmd: 'brew', args: ['install', 'rust'] }],
+      linux: [{ cmd: 'sudo', args: ['apt-get', 'install', '-y', 'rustc'] }],
+    },
+  },
+  {
+    key: 'cpp',
+    name: 'C/C++ 工具链',
+    why: 'cgo 依赖：Linux WebKitGTK 壳与 Windows WebView2 层需要宿主 C 编译器',
+    probes: [
+      { exe: 'cl', args: [], re: /Version\s+(\d+\.\d+)/, okNonZero: true },
+      { exe: 'g++', args: ['--version'], re: /(\d+\.\d+(?:\.\d+)?)/ },
+      { exe: 'clang++', args: ['--version'], re: /(\d+\.\d+(?:\.\d+)?)/ },
+    ],
+    manual: 'https://visualstudio.microsoft.com/visual-cpp-build-tools/',
+    install: {
+      win32: [{
+        cmd: 'winget',
+        args: ['install', '-e', '--id', 'Microsoft.VisualStudio.2022.BuildTools',
+          '--override', '"--quiet --wait --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended"'],
+      }],
+      darwin: [{ cmd: 'xcode-select', args: ['--install'] }],
+      linux: [{ cmd: 'sudo', args: ['apt-get', 'install', '-y', 'build-essential', 'pkg-config'] }],
+    },
+  },
+];
+
+function toolchainHome(opts = {}) {
+  return opts.home || process.env.FREEDOM_TOOLCHAIN_HOME || os.homedir();
+}
+
+function cacheFile(opts) {
+  return path.join(toolchainHome(opts), '.freedom', 'toolchain-cache.json');
+}
+
+function findInPath(exe, env) {
+  const dirs = String(env.PATH || '').split(path.delimiter).filter(Boolean);
+  const exts = env.FREEDOM_HOST_PLATFORM === 'win32' || process.platform === 'win32'
+    ? String(env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';').concat([''])
+    : [''];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const full = path.join(dir, exe + ext);
+      try { if (fs.existsSync(full) && fs.statSync(full).isFile()) return full; } catch (e) { /* 无权访问的 PATH 项：跳过 */ }
+    }
+  }
+  return null;
+}
+
+// PATH 指纹：工具可见性只取决于 PATH 变了没有，变了就必须重探（新装工具通常在 PATH 尾部）。
+function pathFingerprint(env) {
+  let h = 0;
+  const s = String(env.PATH || '');
+  for (let i = 0; i < s.length; i++) h = (Math.imul(h, 31) + s.charCodeAt(i)) | 0;
+  return h.toString(16);
+}
+
+function readCache(opts) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(cacheFile(opts), 'utf8'));
+    if (raw && raw.version === CACHE_VERSION && raw.host === hostPlatform(opts)) return raw;
+  } catch (e) { /* 无缓存 / 损坏 / 跨平台搬运：一律当未命中 */ }
+  return { version: CACHE_VERSION, host: hostPlatform(opts), pathHash: null, tools: {} };
+}
+
+function writeCache(opts, cache) {
+  const file = cacheFile(opts);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(cache, null, 2) + '\n');
+}
+
+function hostPlatform(opts) {
+  return (opts.env && opts.env.FREEDOM_HOST_PLATFORM) || process.platform;
+}
+
+// 单个工具链探测：返回 { ok, version, exe, reason }。
+function resolveProbe(p, o) {
+  if (p.homeRelative) {
+    // rustup 的默认安装位不进 PATH 时也要认出来（装完没重开终端是常态）。
+    const bin = path.join(o.env.CARGO_HOME || path.join(toolchainHome(o), '.cargo'), 'bin');
+    const exts = hostPlatform(o) === 'win32' ? ['.exe', ''] : [''];
+    for (const ext of exts) {
+      const full = path.join(bin, p.exe + ext);
+      try { if (fs.statSync(full).isFile()) return full; } catch (e) { /* 不存在 */ }
+    }
+    return null;
+  }
+  return findInPath(p.exe, o.env);
+}
+
+function probe(spec, opts) {
+  const o = Object.assign({ env: process.env, exec: spawnSync }, opts);
+  const reasons = [];
+  for (const p of spec.probes) {
+    const resolved = resolveProbe(p, o);
+    if (!resolved) continue;
+    let r;
+    try { r = o.exec(resolved, p.args, { encoding: 'utf8', timeout: 8000 }); } catch (e) { reasons.push(`${resolved}: 无法启动`); continue; }
+    const text = `${(r && r.stdout) || ''}${(r && r.stderr) || ''}`;
+    const m = text.match(p.re);
+    if (m && (r.status === 0 || p.okNonZero)) return { ok: true, version: m[1], exe: resolved };
+    if (r && r.error) { reasons.push(`${resolved}: ${r.error.code || r.error.message}`); continue; }
+    // 找得到可执行但跑不通（cl 未加载 vcvarsall 环境是最常见的一种）：记原因再试下一个候选。
+    reasons.push(`${resolved}: 可执行但输出无法识别（MSVC 需先加载 vcvarsall 环境）`);
+  }
+  return { ok: false, reason: reasons.length ? reasons[reasons.length - 1] : 'PATH 中未找到可执行' };
+}
+
+// status：命中缓存的 ok 记录直接跳过 spawn。
+function status(opts = {}) {
+  const o = Object.assign({ env: process.env, refresh: false }, opts);
+  const cache = readCache(o);
+  const hash = pathFingerprint(o.env);
+  const stale = cache.pathHash !== hash;
+  const rows = [];
+  for (const spec of SPECS) {
+    const hit = !o.refresh && !stale && cache.tools[spec.key] && cache.tools[spec.key].ok
+      && (Date.now() - cache.tools[spec.key].at) < CACHE_TTL_MS;
+    if (hit) {
+      rows.push({ key: spec.key, name: spec.name, why: spec.why, source: 'cache', cached: true, ...cache.tools[spec.key] });
+      continue;
+    }
+    const res = probe(spec, o);
+    rows.push({ key: spec.key, name: spec.name, why: spec.why, source: 'probe', cached: false, ...res });
+    if (res.ok) cache.tools[spec.key] = { ok: true, version: res.version, exe: res.exe, at: Date.now() };
+    else delete cache.tools[spec.key]; // 失败不入缓存：下次仍探
+  }
+  cache.pathHash = hash;
+  writeCache(o, cache);
+  return { rows, skipped: rows.filter((r) => r.cached).length };
+}
+
+function installPlan(spec, opts) {
+  const list = spec.install[hostPlatform(opts)] || [];
+  return list.map((s) => [s.cmd].concat(s.args).join(' '));
+}
+
+// install：默认只打印计划；--apply 才真跑（联网 + 提权 + 改系统，属高危动作）。
+function install(targets, opts = {}) {
+  const o = Object.assign({ env: process.env, apply: false, exec: spawnSync }, opts);
+  const want = resolveTargets(targets);
+  const st = status(Object.assign({}, o, { refresh: o.apply ? true : false }));
+  const out = [];
+  for (const spec of want) {
+    const row = st.rows.find((r) => r.key === spec.key);
+    if (row.ok && !o.force) {
+      out.push({ key: spec.key, action: 'skip', version: row.version, note: '已就位' });
+      continue;
+    }
+    const cmds = installPlan(spec, o);
+    if (!cmds.length) { out.push({ key: spec.key, action: 'manual', note: `本平台无自动安装命令，请手动获取：${spec.manual}` }); continue; }
+    if (!o.apply) { out.push({ key: spec.key, action: 'plan', commands: cmds, manual: spec.manual }); continue; }
+    const ran = [];
+    for (const line of cmds) {
+      const [cmd, ...args] = splitCmd(line);
+      let r;
+      try { r = o.exec(cmd, args, { stdio: 'inherit', env: o.env }); } catch (e) { r = { status: -1, error: e }; }
+      ran.push({ command: line, status: r ? r.status : -1 });
+      if (!r || r.status !== 0) break; // 前置步骤失败就别往下跑
+    }
+    out.push({ key: spec.key, action: 'applied', ran });
+  }
+  return { rows: out, dryRun: !o.apply };
+}
+
+function resolveTargets(raw) {
+  const keys = !raw || !raw.length || raw === 'missing' ? SPECS.map((s) => s.key) : String(raw).split(',').map((s) => s.trim()).filter(Boolean);
+  return SPECS.filter((s) => keys.includes(s.key));
+}
+
+function splitCmd(line) {
+  const m = String(line).match(/(?:[^\s"']+|"[^"]*")+/g) || [];
+  return m.map((t) => t.replace(/^"|"$/g, ''));
+}
+
+// ---- 配置优化：只写各工具自己的配置位，幂等 + .bak，缺省只打印 diff ----
+
+// 大陆网络提示：locale 或时区命中才提议换镜像（不误伤海外机器），也可 FREEDOM_CN_MIRROR=1/0 强制。
+function mainlandHint(env) {
+  const force = env.FREEDOM_CN_MIRROR;
+  if (force === '0' || force === 'false') return false;
+  if (force === '1' || force === 'true') return true;
+  const loc = `${env.LANG || ''}${env.LC_ALL || ''}${env.LC_CTYPE || ''}`;
+  const tz = env.TZ || '';
+  return /zh[-_]CN|chinese/i.test(loc) || /Asia\/(Shanghai|Chongqing|Harbin|Urumqi|Beijing|Kashgar)/i.test(tz);
+}
+
+const GO_PROXY = 'https://goproxy.cn,direct';
+const CARGO_SOURCE = {
+  'source.crates-io': { 'replace-with': 'rsproxy-sparse' },
+  'source.rsproxy-sparse': { registry: 'sparse+https://rsproxy.cn/index/' },
+};
+
+// cargo 的 config.toml：表名可含点（[source.crates-io]），按表头整块替换/追加。
+function upsertTomlTable(text, header, fields) {
+  const lines = String(text).split(/\r?\n/);
+  const block = [header];
+  for (const [k, v] of Object.entries(fields)) block.push(`${k} = ${JSON.stringify(v)}`);
+  const start = lines.findIndex((l) => l.trim() === header);
+  if (start < 0) {
+    while (lines.length && !lines[lines.length - 1].trim()) lines.pop();
+    return { text: lines.concat('', block).join('\n') + '\n', had: false };
+  }
+  let end = start + 1;
+  while (end < lines.length && !/^\s*\[/.test(lines[end])) end++;
+  const out = lines.slice(0, start).concat(block, lines.slice(end));
+  return { text: out.join('\n').replace(/\n*$/, '\n'), had: true };
+}
+
+function cargoConfigFile(env, home) {
+  const root = env.CARGO_HOME ? env.CARGO_HOME : path.join(home, '.cargo');
+  return path.join(root, 'config.toml');
+}
+
+// optimize：返回每个工具链的配置动作。apply=false 只回报将要写什么。
+function optimize(opts = {}) {
+  const o = Object.assign({ env: process.env, apply: false, exec: spawnSync }, opts);
+  const home = toolchainHome(o);
+  const actions = [];
+  const st = status(Object.assign({}, o, { refresh: false }));
+
+  const go = st.rows.find((r) => r.key === 'go');
+  if (!mainlandHint(o.env)) {
+    actions.push({ key: 'go', action: 'skip', note: '非大陆网络环境提示，保留官方 GOPROXY' });
+  } else if (!go || !go.ok) {
+    actions.push({ key: 'go', action: 'blocked', note: '未检测到 Go，先 freedom toolchain install go' });
+  } else {
+    const cur = runCapture(o.exec, go.exe, ['env', 'GOPROXY']);
+    if (cur && cur.includes('goproxy.cn')) {
+      actions.push({ key: 'go', action: 'skip', note: `GOPROXY 已是镜像（${cur}）` });
+    } else {
+      const cmdLine = `${go.exe} env -w GOPROXY=${GO_PROXY}`;
+      if (!o.apply) { actions.push({ key: 'go', action: 'plan', commands: [cmdLine], from: cur }); }
+      else {
+        const r = o.exec(go.exe, ['env', '-w', `GOPROXY=${GO_PROXY}`], { env: o.env, encoding: 'utf8' });
+        actions.push({ key: 'go', action: 'applied', to: GO_PROXY, status: r ? r.status : -1, error: r && r.error ? String(r.error.message) : null });
+      }
+    }
+  }
+
+  const rust = st.rows.find((r) => r.key === 'rust');
+  if (!mainlandHint(o.env)) {
+    actions.push({ key: 'rust', action: 'skip', note: '非大陆网络环境提示，不改 cargo 源' });
+  } else if (!rust || !rust.ok) {
+    actions.push({ key: 'rust', action: 'blocked', note: '未检测到 Rust，先 freedom toolchain install rust' });
+  } else {
+    const file = cargoConfigFile(o.env, home);
+    let text = '';
+    try { text = fs.readFileSync(file, 'utf8'); } catch (e) { /* 首次创建 */ }
+    if (/rsproxy\.cn/.test(text)) {
+      actions.push({ key: 'rust', action: 'skip', note: `cargo 源已是 rsproxy（${file}）`, file });
+    } else {
+      let next = text;
+      for (const [header, fields] of Object.entries(CARGO_SOURCE)) next = upsertTomlTable(next, `[${header}]`, fields).text;
+      if (!o.apply) actions.push({ key: 'rust', action: 'plan', file, writes: next });
+      else {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        if (fs.existsSync(file)) fs.copyFileSync(file, `${file}.bak`);
+        fs.writeFileSync(file, next);
+        actions.push({ key: 'rust', action: 'applied', file, backup: fs.existsSync(`${file}.bak`) ? `${file}.bak` : null });
+      }
+    }
+  }
+
+  const cpp = st.rows.find((r) => r.key === 'cpp');
+  actions.push({
+    key: 'cpp',
+    action: 'report',
+    ok: !!(cpp && cpp.ok),
+    note: cpp && cpp.ok
+      ? `已就位：${cpp.exe}（cgo 可直接使用，无用户配置需改）`
+      : `${cpp && cpp.reason ? cpp.reason + '；' : ''}Windows 需经 vcvarsall 注入环境（freedom build 已在子进程内处理），或安装 Build Tools`,
+  });
+  return { rows: actions, dryRun: !o.apply };
+}
+
+function runCapture(exec, exe, args) {
+  try {
+    const r = exec(exe, args, { encoding: 'utf8', timeout: 8000 });
+    if (!r || r.status !== 0) return null;
+    return String(r.stdout || '').trim();
+  } catch (e) {
+    return null;
+  }
+}
+
+// 清理缓存（测试与「重装后重探」用）。
+function clearCache(opts = {}) {
+  try { fs.unlinkSync(cacheFile(opts)); return true; } catch (e) { return false; }
+}
+
+module.exports = {
+  SPECS, status, install, optimize, probe, mainlandHint, upsertTomlTable,
+  cacheFile, clearCache, findInPath, pathFingerprint, installPlan, splitCmd, cargoConfigFile,
+  GO_PROXY, CACHE_VERSION, CACHE_TTL_MS,
+};

package/lib/utils.js

@@ -25,6 +25,9 @@ function goTemplateDir() {
 }
 
 function shellDir() {
+  // 壳目录可经 env 覆写（离线/测试注入假壳；与 FREEDOM_SHELL_REPO 等既有旋钮同族）。
+  const override = process.env.FREEDOM_SHELL_DIR;
+  if (override) return path.resolve(override);
   return path.join(PKG_ROOT, 'shell');
 }
 
@@ -81,6 +84,53 @@ function nativePlatform() {
   return `${plat}-${arch}`;
 }
 
+// 平台别名归一化：把口语写法（win / mac / linux / windows / osx / ubuntu）与架构同义词
+// （x86_64 / amd64 / aarch64）统一到 ALL_PLATFORMS 的 key，无法识别返回 null。
+// 缺架构时的默认值与历史 build.js keyMap 一致：win→x64、darwin→arm64（已不支持 Intel Mac）、
+// linux→x64。
+const PLAT_FAMILY = {
+  win: 'win', win32: 'win', win64: 'win', windows: 'win', pc: 'win',
+  mac: 'darwin', macos: 'darwin', 'mac-os': 'darwin', 'mac-os-x': 'darwin',
+  osx: 'darwin', darwin: 'darwin', apple: 'darwin',
+  linux: 'linux', lin: 'linux', ubuntu: 'linux', debian: 'linux',
+};
+const PLAT_ARCH = {
+  x64: 'x64', x86_64: 'x64', 'x86-64': 'x64', amd64: 'x64',
+  arm64: 'arm64', aarch64: 'arm64', 'aarch-64': 'arm64',
+};
+const PLAT_DEFAULT_ARCH = { win: 'x64', darwin: 'arm64', linux: 'x64' };
+
+function normalizePlatform(raw) {
+  if (typeof raw !== 'string') return null;
+  const s = raw.trim().toLowerCase().replace(/\s+/g, '-').replace(/_/g, '-');
+  if (!s) return null;
+  if (ALL_PLATFORMS.includes(s)) return s;
+  // 从右往左试两种切法（架构名自身可能带分隔符，如 x86-64；族名也一样，如 mac-os-x）：
+  // 先按最后一个分隔符切，切不出架构再按倒数第二个切，还不行就整串当族名。
+  let fam = s;
+  let arch;
+  const cuts = [];
+  const last = s.lastIndexOf('-');
+  if (last > 0) {
+    cuts.push([last, s.slice(last + 1)]);
+    const prev = s.lastIndexOf('-', last - 1);
+    if (prev > 0) cuts.push([prev, s.slice(prev + 1)]);
+  }
+  for (const [at, tail] of cuts) {
+    if (PLAT_ARCH[tail]) {
+      arch = PLAT_ARCH[tail];
+      fam = s.slice(0, at);
+      break;
+    }
+  }
+  const family = PLAT_FAMILY[fam];
+  if (!family) return null;
+  const key = `${family}-${arch || PLAT_DEFAULT_ARCH[family]}`;
+  // 归一后仍须落在支持矩阵里：darwin-x64（Intel Mac 已停止支持）之类的组合
+  // 不能因为"语法像对的"就放行。
+  return ALL_PLATFORMS.includes(key) ? key : null;
+}
+
 function localShellPath(plat) {
   return path.join(shellDir(), plat, SHELL_EXE_NAME[plat] || 'freedom-shell');
 }
@@ -134,6 +184,7 @@ module.exports = {
   isMacPlat,
   platformExeName,
   nativePlatform,
+  normalizePlatform,
   localShellPath,
   tutorialFile,
   loadConfig,

package/lib/verify.js

@@ -9,8 +9,18 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { isWinPlat, platformExeName } = require('./utils');
-const { APP_BIN_MAGIC, decryptApp, buildIntegrity } = require('./security');
+const {
+  APP_BIN_MAGIC,
+  APP_BIN_MAGIC3,
+  decryptAppV3,
+  loadProductKey,
+  verifyIntegrityV3,
+  signingKeyPath,
+  rawPubHexFromKey,
+  sha256hex,
+} = require('./security');
 
 // ---- 产物定位 ----
 
@@ -67,8 +77,66 @@ function fmtSize(n) {
   return `${(n / 1024 / 1024).toFixed(2)} MB`;
 }
 
+// checkSignedProduct —— FRDM3 high 产物的签名链复核，返回解密载荷（失败返回 null）。
+//
+// 三步与壳的启动校验同源同序（先比锚、再验签、后解密），verify 绿即启动必绿：
+//   1) .integrity 用发布方公钥验签，并把 appBin/identity/salt 与真实产物逐项比对；
+//   2) claims.self 与 exe 本体哈希比对（壳被替换或 build 后改写 exe 即红）；
+//   3) 用每产物主密钥真解一次容器（认证失败 = 内容被篡改）。
+// 信任锚来自项目内的发布方私钥（freedom keygen 资产）：私钥不在就无从判真伪，
+// 按红处理而不是跳过——"没钥匙所以当作没问题"正是降级攻击要走的那一步。
+function checkSignedProduct({ projectDir, resDir, bin, appName, exePath, fail, okc }) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(resDir, '.integrity'), 'utf8'));
+  } catch (e) {
+    fail('签名清单', `.integrity 读取/解析失败：${e.message}`);
+    return null;
+  }
+  const privPath = signingKeyPath(projectDir);
+  if (!fs.existsSync(privPath)) {
+    fail('签名清单', `缺信任锚（发布方私钥 ${privPath} 不存在）：无法判定清单真伪，请先 freedom keygen 或用同钥匙重新构建`);
+    return null;
+  }
+  let anchorPubHex;
+  try {
+    anchorPubHex = rawPubHexFromKey(crypto.createPrivateKey(fs.readFileSync(privPath)));
+  } catch (e) {
+    fail('签名清单', `发布方私钥不可用：${e.message}`);
+    return null;
+  }
+  let claims;
+  try {
+    claims = verifyIntegrityV3({ manifest, anchorPubHex, name: appName, appBin: bin });
+    okc('签名清单', `ed25519 验签通过，且清单与 app.bin/应用标识/容器盐逐项吻合（built ${claims.built}）`);
+  } catch (e) {
+    fail('签名清单', e.message);
+    return null;
+  }
+  if (claims.self) {
+    try {
+      const got = sha256hex(fs.readFileSync(exePath));
+      if (got !== claims.self.toLowerCase()) {
+        fail('exe 自绑定', `exe 哈希与清单不符（清单 ${claims.self.slice(0, 8)}…，实际 ${got.slice(0, 8)}…）：壳被替换，或 build 之后改写过 exe（含事后补做代码签名）`);
+      } else {
+        okc('exe 自绑定', `exe 哈希与签名清单一致（${got.slice(0, 8)}…）`);
+      }
+    } catch (e) {
+      fail('exe 自绑定', e.message);
+    }
+  }
+  try {
+    const p = decryptAppV3(loadProductKey(projectDir, appName), appName, bin);
+    okc('容器解密', `认证通过，html ${fmtSize(p.html.length)} / config ${fmtSize(p.config.length)}`);
+    return p;
+  } catch (e) {
+    fail('容器解密', e.message);
+    return null;
+  }
+}
+
 // 单平台产物校验，返回 [{ name, pass, detail }]。
-function checkPlatformProduct({ targetDir, plat, appName, hasBackend }) {
+function checkPlatformProduct({ projectDir, targetDir, plat, appName, hasBackend }) {
   const checks = [];
   const fail = (name, detail) => checks.push({ name, pass: false, detail });
   const okc = (name, detail) => checks.push({ name, pass: true, detail });
@@ -117,34 +185,20 @@ function checkPlatformProduct({ targetDir, plat, appName, hasBackend }) {
     }
     if (!hasIntegrity) fail('完整性清单', '缺失 .integrity');
     else okc('完整性清单', '.integrity 存在');
-    // app.bin 容器头校验（FRDM2）
+    // app.bin 容器代际校验。FRDM2 及其以前一律红：壳侧同样拒收旧代际（其主密钥与清单
+    // 密钥都随 npm 包公开，人人可伪造），verify 放行就会出现"自检绿、启动红"。
     let bin = Buffer.alloc(0);
     try {
       bin = fs.readFileSync(path.join(resDir, 'app.bin'));
     } catch (e) { /* 读取失败按不通过处理 */ }
-    const head = bin.subarray(0, APP_BIN_MAGIC.length).toString('latin1');
-    if (head !== APP_BIN_MAGIC) {
-      fail('app.bin 容器', `容器头不是 ${APP_BIN_MAGIC}（实际 "${head}"），文件损坏、非本工具产物或旧版产物`);
+    const head = bin.subarray(0, APP_BIN_MAGIC3.length).toString('latin1');
+    if (head === APP_BIN_MAGIC) {
+      fail('app.bin 容器', `${APP_BIN_MAGIC} 属旧代际（密钥在公开源里，清单可被任意伪造）：请用 freedom-cli 1.14.0-preview 及以上重新 build（预览代走 preview 通道：npm i -D @yufengtadian/freedom-cli@preview）`);
+    } else if (head !== APP_BIN_MAGIC3) {
+      fail('app.bin 容器', `容器头不是 ${APP_BIN_MAGIC3}（实际 "${head}"），文件损坏、非本工具产物或旧代产物`);
     } else {
-      okc('app.bin 容器', `${APP_BIN_MAGIC} 头有效（${fmtSize(bin.length)}）`);
-      // 真解一次容器：认证失败 = 产物被篡改或 name 与容器不匹配；同时拿到 backend 供后端检查。
-      try {
-        securePayload = decryptApp(appName, bin);
-        okc('容器解密', `认证通过，html ${fmtSize(securePayload.html.length)} / config ${fmtSize(securePayload.config.length)}`);
-      } catch (e) {
-        fail('容器解密', e.message);
-      }
-      // .integrity 与容器一致（防整体替换：清单值由构建期容器盐派生密钥签名）
-      if (hasIntegrity) {
-        try {
-          const list = JSON.parse(fs.readFileSync(path.join(resDir, '.integrity'), 'utf8'));
-          const want = buildIntegrity(appName, bin).appBin;
-          if (list.appBin !== want) fail('完整性清单', '.integrity 与 app.bin 不一致（产物可能被替换）');
-          else okc('完整性清单', '.integrity 与 app.bin 一致');
-        } catch (e) {
-          fail('完整性清单', e.message);
-        }
-      }
+      okc('app.bin 容器', `${APP_BIN_MAGIC3} 头有效（${fmtSize(bin.length)}）`);
+      securePayload = checkSignedProduct({ projectDir, resDir, bin, appName, exePath, fail, okc });
     }
   } else {
     if (hasIntegrity) {
@@ -209,7 +263,7 @@ async function verifyProduct(projectDir, opts = {}) {
 
   const targets = findProducts(dir, cfg)
     .filter((t) => !opts.platform || t.plat === opts.platform)
-    .map((t) => ({ ...t, checks: checkPlatformProduct({ targetDir: t.dir, plat: t.plat, appName, hasBackend: hasBackendDir }) }));
+    .map((t) => ({ ...t, checks: checkPlatformProduct({ projectDir: dir, targetDir: t.dir, plat: t.plat, appName, hasBackend: hasBackendDir }) }));
 
   const ok = targets.length > 0 && targets.every((t) => t.checks.every((c) => c.pass));
   return { ok, targets, appName };
@@ -226,13 +280,14 @@ function collectTree(dir, depth, out, maxDepth) {
     return out;
   }
   for (const e of entries) {
+    const abs = path.join(dir, e.name);
+    const stat = safeStat(abs);
     if (e.name === '.integrity') {
-      // 完整性清单内容为敏感校验值，仅标注存在与大小，不展开内容
-      out.push({ rel: e.name, size: 0, isDir: false, depth, hidden: true });
+      // 清单内容是不对外展开的校验值，但大小必须照实报：写死 0 会让产物自检打印
+      // 「.integrity (0 B)」，在高模式安检语境下读起来像清单是空的，反而制造误判。
+      out.push({ rel: e.name, size: stat ? stat.size : 0, isDir: false, depth, hidden: true });
       continue;
     }
-    const abs = path.join(dir, e.name);
-    const stat = safeStat(abs);
     if (e.isDirectory()) {
       out.push({ rel: e.name, size: 0, isDir: true, depth });
       if (depth < maxDepth) collectTree(abs, depth + 1, out, maxDepth);

package/lib/webkit.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// Linux 构建的 WebKitGTK 依赖名选择。
+//
+// 背景：webview_go 的 cgo 依赖名在本地补丁副本（third_party/webview_go）里拆成了
+// webkit2_40.go / webkit2_41.go 两个互斥标签文件。Ubuntu 24.04 / Debian 13 已移除
+// webkit2gtk-4.0，只保留同一套 C API 的 webkit2gtk-4.1 —— 沿用 4.0 会让 `go build`
+// 在新发行版上直接失败。
+//
+// 这里做的事：探测 pkg-config 实际装了哪个，缺 4.0 且有 4.1 时给 go 命令加
+// `-tags webkit2_41`；否则返回原始环境（老发行版与 CI 产物基线零变化）。
+// webkitgtk-6.0 是另一套 API，不能这样桥接（需上游适配）。
+
+const { spawnSync } = require('child_process');
+
+function pkgConfigExists(mod, exec = spawnSync) {
+  try {
+    return exec('pkg-config', ['--exists', mod], { stdio: 'ignore' }).status === 0;
+  } catch (e) {
+    return false;
+  }
+}
+
+// 需要 4.1 标签吗：仅 Linux、仅当 4.0 不可用而 4.1 可用。
+function needsWebkit241(env = process.env, exec = spawnSync) {
+  if (env.FREEDOM_WEBKIT_FORCE_41 === '1') return true;
+  const platform = env.FREEDOM_HOST_PLATFORM || process.platform;
+  if (platform !== 'linux') return false;
+  if (pkgConfigExists('webkit2gtk-4.0', exec)) return false;
+  return pkgConfigExists('webkit2gtk-4.1', exec);
+}
+
+// 把标签并入 GOFLAGS（go 命令原生识别 GOFLAGS，故子进程与人工命令行都吃到）。
+// 已有 GOFLAGS 时追加，不覆盖。
+function applyWebkitTags(env = process.env, exec = spawnSync) {
+  const out = Object.assign({}, env);
+  if (!needsWebkit241(env, exec)) return { env: out, tags: [] };
+  const tags = ['webkit2_41'];
+  const existing = (env.GOFLAGS || '').trim();
+  const merged = existing ? `${existing} -tags=${tags.join(',')}` : `-tags=${tags.join(',')}`;
+  out.GOFLAGS = merged;
+  return { env: out, tags };
+}
+
+module.exports = { needsWebkit241, applyWebkitTags, pkgConfigExists };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yufengtadian/freedom-cli",
-  "version": "1.13.2",
+  "version": "1.14.0-preview",
   "description": "Freedom WebView desktop shell packaging tool - no Go toolchain required, one command packs three-platform desktop apps",
   "repository": {
     "type": "git",
@@ -15,7 +15,7 @@
     "frontend",
     "cross-platform"
   ],
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "publishConfig": {
     "access": "public"
   },
@@ -33,7 +33,8 @@
     "README.md"
   ],
   "scripts": {
-    "postinstall": "node postinstall.js"
+    "postinstall": "node postinstall.js",
+    "prepublishOnly": "node -e \"require('./lib/shell').preflightBundledShells()\""
   },
   "engines": {
     "node": ">=18"

package/skill/freedom/SKILL.md

@@ -121,9 +121,9 @@ freedom titlebar <native|frameless> | icon <path> | security <mode>
 freedom shell list|download <plat>|build <plat>
 freedom keygen               # 生成自更新 ed25519 密钥对（私钥只在发布方）
 freedom manifest --artifact <产物> --url <下载地址> [--version x] [--notes y]
-freedom agents                          # Agent 集成支持矩阵（本机证据判定）
-freedom skill install --agent all [--dry-run]
-freedom mcp install --agent <key> [--config <path> --format json|toml|yaml]
+freedom agents                          # Agent 集成支持矩阵（本机足迹判定「是否安装」，未安装不写入）
+freedom skill install --agent all [--dry-run] [--force]
+freedom mcp install --agent <key> [--config <path> --format json|toml|toml-aot|yaml] [--force]
 freedom mcp serve                       # stdio MCP 服务（一般由 agent 拉起，不手敲）
 freedom update | version | tutorial | help
 ```