expo-harmony-toolkit 1.11.1 → 1.11.3

package/README.en.md

@@ -9,7 +9,7 @@
   <p>
     <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/actions/workflows/ci.yml"><img alt="Checks" src="https://img.shields.io/badge/checks-passing-16a34a?style=flat-square&logo=githubactions&logoColor=white"></a>
     <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-MIT-0f766e?style=flat-square"></a>
-    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.11.1-111827?style=flat-square"></a>
+    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.11.3-111827?style=flat-square"></a>
     <a href="./docs/support-matrix.md"><img alt="Matrix" src="https://img.shields.io/badge/matrix-expo55--rnoh082--ui--stack-2563eb?style=flat-square"></a>
     <img alt="Input" src="https://img.shields.io/badge/input-Managed%2FCNG%20%2B%20bare%20intake-059669?style=flat-square">
   </p>
@@ -24,7 +24,7 @@
 </div>
 
 > [!IMPORTANT]
-> `v1.11.1` is the first public `v1.11.x` release. It closes the diagnosable managed sidecar drift behavior: non-build-required drift preserves user edits and points to `sync-template --force` / `init --force`, while build-required autolinking and RNOH shim drift can be refreshed by the bundle/build gate. `v1.11.0` remains an unpublished burn-down ledger checkpoint; the public promise stays tight: `latest` only carries fully accepted `verified` capabilities, and v1.11.1 is not a verified expansion.
+> `v1.11.3` updates repository code with the v2 readiness non-device gate / fallback / exception ledger; this update does not create a tag, publish npm, or create a GitHub Release. `v1.11.2` remains the current npm `latest` release and keeps the ccnubox_rn signed simulator app-shell gate record; the public promise stays tight: `latest` only carries fully accepted `verified` capabilities, and v1.11.3 is not a verified expansion.
 
 > [!TIP]
 > The two validated `@react-native-oh-tpl/*` adapters in the public matrix are currently consumed via exact Git URLs and commits. For repository development and the official UI-stack sample, prefer `pnpm install --ignore-scripts` so adapter prepare hooks do not fail on private upstream resources.
@@ -48,7 +48,7 @@
 <!-- GENERATED:readme-current-status:start -->
 | Item | Status |
 | --- | --- |
-| Current version | `v1.11.1` |
+| Current version | `v1.11.3` |
 | Support model | `verified + preview + experimental` |
 | Public `verified` matrix | `expo55-rnoh082-ui-stack` |
 | Supported input | Managed/CNG Expo projects; bare and catalog-out intake classification |
@@ -264,7 +264,7 @@ Additional preview evidence semantics:
 - `bundle/debugBuild` are marked as `automated`
 - `device` is marked as `manual-doc`, which means a human acceptance record exists rather than CI automation
 - `release` is marked as `none`, which means no release evidence exists yet
-- `v1.8.2` additionally records local signing plus simulator install/start evidence for the ccnubox release HAP; this only proves the minimal app-shell release-HAP path and does not close per-capability release acceptance
+- `v1.11.2` additionally records the current local ccnubox_rn dirty checkout signed simulator install/start gate; this only proves the app-shell non-device smoke and does not close per-capability release acceptance
 - `v1.8.3` aligns the RNOH runtime / CLI to the current latest `0.82.x` patch (`0.82.29`) while keeping the buildable `react-native@0.82.1` matrix boundary
 
 Manual Harmony acceptance still requires:

package/README.md

@@ -9,7 +9,7 @@
   <p>
     <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/actions/workflows/ci.yml"><img alt="Checks" src="https://img.shields.io/badge/checks-passing-16a34a?style=flat-square&logo=githubactions&logoColor=white"></a>
     <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-MIT-0f766e?style=flat-square"></a>
-    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.11.1-111827?style=flat-square"></a>
+    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.11.3-111827?style=flat-square"></a>
     <a href="./docs/support-matrix.md"><img alt="Matrix" src="https://img.shields.io/badge/matrix-expo55--rnoh082--ui--stack-2563eb?style=flat-square"></a>
     <img alt="Input" src="https://img.shields.io/badge/input-Managed%2FCNG%20%2B%20bare%20intake-059669?style=flat-square">
   </p>
@@ -24,7 +24,7 @@
 </div>
 
 > [!IMPORTANT]
-> `v1.11.1` 是第一个公开发布的 `v1.11.x`，收口 managed sidecar drift 的可诊断行为：非 build-required drift 会保留用户改动并提示 `sync-template --force` / `init --force`，build-required autolinking 与 RNOH shim drift 可由 bundle/build gate 自动刷新。`v1.11.0` 只作为未发布的 burn-down ledger checkpoint；当前公开承诺仍然收紧为：`latest` 只承诺完整验收的 `verified` 能力，v1.11.1 不是 verified 扩容。
+> `v1.11.3` 已更新仓库代码，完成 v2 readiness 非实机 gate / fallback / exception 台账；本次不创建 tag、不发布 npm、不创建 GitHub Release。`v1.11.2` 仍是当前已发布到 npm `latest` 的版本，并保留 ccnubox_rn signed simulator app-shell gate 记录；当前公开承诺仍然收紧为：`latest` 只承诺完整验收的 `verified` 能力，v1.11.3 不是 verified 扩容。
 
 > [!TIP]
 > 由于当前公开矩阵内的两套 `@react-native-oh-tpl/*` adapter 依赖以 Git URL + exact commit 形式接入，仓库开发和官方 UI-stack sample 推荐使用 `pnpm install --ignore-scripts`，避免 Git adapter 在 prepare 阶段拉取私有资源而中断安装。
@@ -48,7 +48,7 @@
 <!-- GENERATED:readme-current-status:start -->
 | 项目 | 说明 |
 | --- | --- |
-| 当前版本 | `v1.11.1` |
+| 当前版本 | `v1.11.3` |
 | 支持模型 | `verified + preview + experimental` |
 | 唯一 `verified` 公开矩阵 | `expo55-rnoh082-ui-stack` |
 | 输入范围 | Managed/CNG Expo 项目；bare 与 catalog 外项目 intake 分类 |
@@ -270,7 +270,7 @@ preview 证据的额外说明：
 - `bundle/debugBuild` 标记为 `automated`
 - `device` 标记为 `manual-doc`，表示已有人工验收记录，不等于 CI 自动验收
 - `release` 标记为 `none`，表示当前仍没有 release 证据
-- `v1.8.2` 额外记录了 ccnubox release HAP 的本地签名、模拟器安装与启动证据；这只证明 app-shell release HAP 最低链路，不关闭单 capability release acceptance
+- `v1.11.2` 额外记录了当前本地 ccnubox_rn dirty checkout 的 signed simulator install/start gate；这只证明 app-shell 非实机 smoke，不关闭单 capability release acceptance
 - `v1.8.3` 将 RNOH runtime / CLI 对齐到当前 `0.82.x` 最新 patch（`0.82.29`），继续保留 `react-native@0.82.1` 的可构建矩阵边界
 
 手动 Harmony 验收继续要求：

package/build/core/constants.d.ts

@@ -1,6 +1,6 @@
 export declare const TOOLKIT_PACKAGE_NAME = "expo-harmony-toolkit";
 export declare const CLI_NAME = "expo-harmony";
-export declare const TOOLKIT_VERSION = "1.11.1";
+export declare const TOOLKIT_VERSION = "1.11.3";
 export declare const TEMPLATE_VERSION = "rnoh-0.82.29";
 export declare const RNOH_VERSION = "0.82.29";
 export declare const RNOH_CLI_VERSION = "0.82.29";

package/build/core/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DESIRED_PACKAGE_SCRIPTS = exports.HARMONY_RUNTIME_PRELUDE_RELATIVE_PATH = exports.HARMONY_ROUTER_ENTRY_FILENAME = exports.STRICT_ENV_EXIT_CODE = exports.STRICT_DOCTOR_EXIT_CODE = exports.DEFAULT_HVIGOR_PLUGIN_FILENAME = exports.PREBUILD_METADATA_FILENAME = exports.TOOLKIT_CONFIG_FILENAME = exports.BUILD_REPORT_FILENAME = exports.ENV_REPORT_FILENAME = exports.DOCTOR_REPORT_FILENAME = exports.MANIFEST_FILENAME = exports.SIGNING_LOCAL_EXAMPLE_FILENAME = exports.SIGNING_LOCAL_FILENAME = exports.GENERATED_SHIMS_DIR = exports.GENERATED_DIR = exports.SUPPORTED_EXPO_SDKS = exports.RNOH_CLI_VERSION = exports.RNOH_VERSION = exports.TEMPLATE_VERSION = exports.TOOLKIT_VERSION = exports.CLI_NAME = exports.TOOLKIT_PACKAGE_NAME = void 0;
 exports.TOOLKIT_PACKAGE_NAME = 'expo-harmony-toolkit';
 exports.CLI_NAME = 'expo-harmony';
-exports.TOOLKIT_VERSION = '1.11.1';
+exports.TOOLKIT_VERSION = '1.11.3';
 exports.TEMPLATE_VERSION = 'rnoh-0.82.29';
 exports.RNOH_VERSION = '0.82.29';
 exports.RNOH_CLI_VERSION = '0.82.29';

package/build/core/metadata.js

@@ -14,6 +14,7 @@ exports.writeBuildReport = writeBuildReport;
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
 const constants_1 = require("./constants");
+const safeProjectWrite_1 = require("./safeProjectWrite");
 function getManifestPath(projectRoot) {
     return path_1.default.join(projectRoot, constants_1.GENERATED_DIR, constants_1.MANIFEST_FILENAME);
 }
@@ -42,13 +43,23 @@ async function readToolkitConfig(projectRoot) {
 }
 async function writeEnvReport(projectRoot, report, outputPath) {
     const resolvedOutputPath = outputPath ?? getEnvReportPath(projectRoot);
-    await fs_extra_1.default.ensureDir(path_1.default.dirname(resolvedOutputPath));
-    await fs_extra_1.default.writeJson(resolvedOutputPath, report, { spaces: 2 });
+    if (outputPath) {
+        await fs_extra_1.default.ensureDir(path_1.default.dirname(resolvedOutputPath));
+        await fs_extra_1.default.writeJson(resolvedOutputPath, report, { spaces: 2 });
+    }
+    else {
+        await (0, safeProjectWrite_1.writeProjectJson)(projectRoot, path_1.default.join(constants_1.GENERATED_DIR, constants_1.ENV_REPORT_FILENAME), report);
+    }
     return resolvedOutputPath;
 }
 async function writeBuildReport(projectRoot, report, outputPath) {
     const resolvedOutputPath = outputPath ?? getBuildReportPath(projectRoot);
-    await fs_extra_1.default.ensureDir(path_1.default.dirname(resolvedOutputPath));
-    await fs_extra_1.default.writeJson(resolvedOutputPath, report, { spaces: 2 });
+    if (outputPath) {
+        await fs_extra_1.default.ensureDir(path_1.default.dirname(resolvedOutputPath));
+        await fs_extra_1.default.writeJson(resolvedOutputPath, report, { spaces: 2 });
+    }
+    else {
+        await (0, safeProjectWrite_1.writeProjectJson)(projectRoot, path_1.default.join(constants_1.GENERATED_DIR, constants_1.BUILD_REPORT_FILENAME), report);
+    }
     return resolvedOutputPath;
 }

package/build/core/report.js

@@ -10,6 +10,7 @@ const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
 const semver_1 = __importDefault(require("semver"));
 const constants_1 = require("./constants");
+const safeProjectWrite_1 = require("./safeProjectWrite");
 const dependencyInspection_1 = require("./dependencyInspection");
 const dependencyCatalog_1 = require("../data/dependencyCatalog");
 const validatedMatrices_1 = require("../data/validatedMatrices");
@@ -178,8 +179,13 @@ async function buildDoctorReport(projectRoot, options = {}) {
 }
 async function writeDoctorReport(projectRoot, report, outputPath) {
     const resolvedOutputPath = outputPath ?? path_1.default.join(projectRoot, constants_1.GENERATED_DIR, constants_1.DOCTOR_REPORT_FILENAME);
-    await fs_extra_1.default.ensureDir(path_1.default.dirname(resolvedOutputPath));
-    await fs_extra_1.default.writeJson(resolvedOutputPath, report, { spaces: 2 });
+    if (outputPath) {
+        await fs_extra_1.default.ensureDir(path_1.default.dirname(resolvedOutputPath));
+        await fs_extra_1.default.writeJson(resolvedOutputPath, report, { spaces: 2 });
+    }
+    else {
+        await (0, safeProjectWrite_1.writeProjectJson)(projectRoot, path_1.default.join(constants_1.GENERATED_DIR, constants_1.DOCTOR_REPORT_FILENAME), report);
+    }
     return resolvedOutputPath;
 }
 function renderDoctorReport(report) {
@@ -508,7 +514,7 @@ function buildNextActions(input) {
         actions.push(`Align Expo SDK, React Native, RNOH, and validated adapter versions to ${validatedMatrices_1.DEFAULT_VALIDATED_MATRIX_ID}, then rerun \`expo-harmony doctor --project-root . --strict\`.`);
     }
     if (coverageProfile === 'bare') {
-        actions.push('Keep this project on the bare workflow track for now: preserve the native directories, use `expo-harmony doctor --project-root .` for classification, and only claim verified support after bare workflow support lands in the mainline capability catalog.');
+        actions.push('Keep this project on the bare workflow track for now: preserve the native directories, use `expo-harmony doctor --project-root .` for classification, keep release HAP/runtime evidence as the v1.11.x blocker, and do not call it release-ready until that evidence closes.');
     }
     if (hasRouterBlockingIssues) {
         actions.push('Add the missing expo-router peers/plugin/scheme or update the Harmony bundle script to use `expo-harmony bundle`, then rerun doctor before trusting router builds.');
@@ -529,10 +535,10 @@ function buildNextActions(input) {
     }
     if (coverageProfile === 'third-party-native-heavy') {
         if (hasThirdPartyWaveA) {
-            actions.push('Keep Third-party Native Wave A on `doctor --target-tier experimental`: pair async-storage and screens with their Harmony adapters, keep safe-area on the toolkit shim, and close device/release evidence before any promotion.');
+            actions.push('Keep Third-party Native Wave A on `doctor --target-tier experimental`: pair async-storage and screens with their Harmony adapters, keep safe-area on the toolkit shim, and record fallback paths before any promotion when device/release evidence cannot close in v1.11.x.');
         }
         if (hasThirdPartyWaveB) {
-            actions.push('Keep Third-party Native Wave B on `doctor --target-tier experimental`: pair ccnubox WebView, media-library, Lottie, and Skia surfaces with their Harmony adapters, keep JPush runtime evidence separate, and require debug/release simulator delivery gates before shipping.');
+            actions.push('Keep Third-party Native Wave B on `doctor --target-tier experimental`: pair ccnubox WebView, media-library, Lottie, and Skia surfaces with their Harmony adapters, keep JPush runtime evidence separate, and record fallback paths if release/runtime evidence cannot close in v1.11.x.');
         }
         if (!hasThirdPartyWaveA && !hasThirdPartyWaveB) {
             actions.push('Isolate third-party native packages and onboard them through the mainline capability catalog one by one; start with `react-native-gesture-handler` if it is present, and treat unknown native surfaces as explicit unblockers rather than matrix drift.');

package/build/core/safeProjectWrite.d.ts

@@ -0,0 +1,3 @@
+export declare function resolveProjectPathForWrite(projectRoot: string, relativePath: string): Promise<string>;
+export declare function writeProjectFile(projectRoot: string, relativePath: string, contents: string | Buffer): Promise<string>;
+export declare function writeProjectJson(projectRoot: string, relativePath: string, value: unknown): Promise<string>;

package/build/core/safeProjectWrite.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveProjectPathForWrite = resolveProjectPathForWrite;
+exports.writeProjectFile = writeProjectFile;
+exports.writeProjectJson = writeProjectJson;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+async function resolveProjectPathForWrite(projectRoot, relativePath) {
+    if (path_1.default.isAbsolute(relativePath)) {
+        throw new Error(`Project output path must be relative: ${relativePath}`);
+    }
+    const realProjectRoot = await fs_extra_1.default.realpath(projectRoot);
+    const targetPath = path_1.default.resolve(realProjectRoot, relativePath);
+    if (!isPathInside(targetPath, realProjectRoot)) {
+        throw new Error(`Project output path escapes project root: ${relativePath}`);
+    }
+    await assertNoSymlinkPath(realProjectRoot, targetPath, relativePath);
+    return targetPath;
+}
+async function writeProjectFile(projectRoot, relativePath, contents) {
+    const targetPath = await resolveProjectPathForWrite(projectRoot, relativePath);
+    await fs_extra_1.default.ensureDir(path_1.default.dirname(targetPath));
+    await fs_extra_1.default.writeFile(targetPath, contents);
+    return targetPath;
+}
+async function writeProjectJson(projectRoot, relativePath, value) {
+    const targetPath = await resolveProjectPathForWrite(projectRoot, relativePath);
+    await fs_extra_1.default.ensureDir(path_1.default.dirname(targetPath));
+    await fs_extra_1.default.writeJson(targetPath, value, { spaces: 2 });
+    return targetPath;
+}
+async function assertNoSymlinkPath(realProjectRoot, targetPath, displayPath) {
+    let currentPath = realProjectRoot;
+    const relativeSegments = path_1.default.relative(realProjectRoot, targetPath).split(path_1.default.sep);
+    for (const segment of relativeSegments) {
+        currentPath = path_1.default.join(currentPath, segment);
+        try {
+            const stat = await fs_extra_1.default.lstat(currentPath);
+            if (stat.isSymbolicLink()) {
+                throw new Error(`Project output path contains a symlink: ${displayPath}`);
+            }
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return;
+            }
+            throw error;
+        }
+    }
+}
+function isPathInside(candidatePath, parentPath) {
+    const relativePath = path_1.default.relative(parentPath, candidatePath);
+    return relativePath === '' || (!relativePath.startsWith('..') && !path_1.default.isAbsolute(relativePath));
+}

package/build/core/template.js

@@ -15,6 +15,7 @@ const capabilities_1 = require("../data/capabilities");
 const project_1 = require("./project");
 const javascriptDependencies_1 = require("./javascriptDependencies");
 const report_1 = require("./report");
+const safeProjectWrite_1 = require("./safeProjectWrite");
 const signing_1 = require("./signing");
 const autolinking_1 = require("./autolinking");
 const capabilityRegistry_1 = require("./template/capabilityRegistry");
@@ -95,7 +96,7 @@ async function syncProjectTemplate(projectRoot, force = false, options = {}) {
     result.warnings.push(...(0, support_1.collectMetadataWarnings)(previousManifest, previousToolkitConfig));
     const manifestFiles = [];
     for (const file of desiredFiles) {
-        const targetPath = path_1.default.join(loadedProject.projectRoot, file.relativePath);
+        const targetPath = await (0, safeProjectWrite_1.resolveProjectPathForWrite)(loadedProject.projectRoot, file.relativePath);
         const expectedHash = (0, project_1.createGeneratedSha)(file.contents);
         const previousRecord = previousManifest?.files.find((record) => record.relativePath === file.relativePath);
         if (await fs_extra_1.default.pathExists(targetPath)) {
@@ -114,15 +115,13 @@ async function syncProjectTemplate(projectRoot, force = false, options = {}) {
                 continue;
             }
         }
-        await fs_extra_1.default.ensureDir(path_1.default.dirname(targetPath));
-        await fs_extra_1.default.writeFile(targetPath, file.contents);
+        await (0, safeProjectWrite_1.writeProjectFile)(loadedProject.projectRoot, file.relativePath, file.contents);
         result.writtenFiles.push(file.relativePath);
         manifestFiles.push({ relativePath: file.relativePath, sha1: expectedHash });
     }
     if (!options.skipJavaScriptDependencyNormalization) {
         await (0, javascriptDependencies_1.normalizeKnownJavaScriptDependencies)(loadedProject.projectRoot, loadedProject.packageJson);
     }
-    await fs_extra_1.default.ensureDir(path_1.default.dirname(result.manifestPath));
     const manifest = {
         generatedAt: new Date().toISOString(),
         toolkitVersion: constants_1.TOOLKIT_VERSION,
@@ -131,7 +130,7 @@ async function syncProjectTemplate(projectRoot, force = false, options = {}) {
         projectRoot: loadedProject.projectRoot,
         files: manifestFiles,
     };
-    await fs_extra_1.default.writeJson(result.manifestPath, manifest, { spaces: 2 });
+    await (0, safeProjectWrite_1.writeProjectJson)(loadedProject.projectRoot, path_1.default.relative(loadedProject.projectRoot, result.manifestPath), manifest);
     return result;
 }
 function renderSidecarDriftRequiresForceWarning(relativePath) {
@@ -267,7 +266,7 @@ async function buildManagedFiles(loadedProject, identifiers, previousToolkitConf
     ];
 }
 async function syncPackageScripts(projectRoot, _force) {
-    const packageJsonPath = path_1.default.join(projectRoot, 'package.json');
+    const packageJsonPath = await (0, safeProjectWrite_1.resolveProjectPathForWrite)(projectRoot, 'package.json');
     const packageJson = (await fs_extra_1.default.readJson(packageJsonPath));
     const desiredScripts = (0, support_1.buildDesiredPackageScripts)(packageJson);
     const scripts = { ...(packageJson.scripts ?? {}) };
@@ -290,14 +289,13 @@ async function syncPackageScripts(projectRoot, _force) {
     }
     if (didChange) {
         packageJson.scripts = (0, support_1.sortRecordByKey)(scripts);
-        await fs_extra_1.default.writeJson(packageJsonPath, packageJson, { spaces: 2 });
-        await fs_extra_1.default.writeFile(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
+        await (0, safeProjectWrite_1.writeProjectFile)(projectRoot, 'package.json', JSON.stringify(packageJson, null, 2) + '\n');
     }
     return warnings;
 }
 function renderTemplate(template, loadedProject, identifiers, hvigorPluginFilename) {
     const appDescription = `${identifiers.appName} official minimal Harmony sample`;
-    const replacements = {
+    const rawReplacements = {
         APP_NAME: identifiers.appName,
         APP_SLUG: identifiers.slug,
         APP_VERSION: String(loadedProject.expoConfig.version ?? loadedProject.packageJson.version ?? '1.0.0'),
@@ -309,8 +307,24 @@ function renderTemplate(template, loadedProject, identifiers, hvigorPluginFilena
         RNOH_CLI_VERSION: constants_1.RNOH_CLI_VERSION,
         RNOH_HVIGOR_PLUGIN_FILENAME: hvigorPluginFilename,
     };
+    const replacements = {
+        ...rawReplacements,
+        APP_NAME_JSON: JSON.stringify(rawReplacements.APP_NAME),
+        APP_VERSION_JSON: JSON.stringify(rawReplacements.APP_VERSION),
+        APP_VERSION_JSON5: renderSingleQuotedStringContents(rawReplacements.APP_VERSION),
+        APP_DESCRIPTION_JSON: JSON.stringify(rawReplacements.APP_DESCRIPTION),
+        APP_DESCRIPTION_JSON5: renderSingleQuotedStringContents(rawReplacements.APP_DESCRIPTION),
+        APP_SLUG_ARKTS: renderSingleQuotedStringContents(rawReplacements.APP_SLUG),
+    };
     return template.replace(/\{\{([A-Z0-9_]+)\}\}/g, (_, key) => replacements[key] ?? '');
 }
+function renderSingleQuotedStringContents(value) {
+    return JSON.stringify(value)
+        .slice(1, -1)
+        .replace(/'/g, "\\'")
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
 function renderRnohGeneratedTsShim() {
     let relativeTarget = path_1.default.relative(path_1.default.dirname(RNOH_GENERATED_TS_SHIM_RELATIVE_PATH), path_1.default.join('harmony', 'expo-harmony-local-deps', 'rnoh-react-native-openharmony-react_native_openharmony', 'ts.ts'));
     relativeTarget = relativeTarget.replace(/\\/g, '/').replace(/\.ts$/, '');

package/build/data/publicDocs.d.ts

@@ -8,4 +8,4 @@ export declare const SUPPORTING_SAMPLE_PATHS: readonly ["examples/official-app-s
 export declare const VERIFIED_JS_UI_CAPABILITY_NAMES: readonly ["expo-router", "expo-linking", "expo-constants", ...("react-native-reanimated" | "react-native-svg")[]];
 export declare const PREVIEW_CAPABILITY_DEFINITIONS: import("..").CapabilityDefinition[];
 export declare const EXPERIMENTAL_CAPABILITY_NAMES: readonly string[];
-export declare const PUBLIC_CURRENT_VERSION = "1.11.1";
+export declare const PUBLIC_CURRENT_VERSION = "1.11.3";

package/build/docs/render.js

@@ -134,6 +134,7 @@ function renderSupportMatrixCapabilityTelemetry(locale) {
             '- `runtimeMode=shim`：说明当前还在桥接或占位阶段，即使 bundle / debug build 已完成，也不应宣称 verified',
             '- `runtimeMode=adapter`：说明已经进入真实适配路径，但仍缺少某些验收证据',
             '- `runtimeMode=verified`：说明能力已进入正式承诺，且证据闭环完成',
+            '- `release=no[none]`：说明 release HAP/runtime evidence 尚未关闭，不能写成 release-ready',
         ]
         : [
             'All capabilities now publish the following fields together:',
@@ -154,6 +155,7 @@ function renderSupportMatrixCapabilityTelemetry(locale) {
             '- `runtimeMode=shim`: the capability is still on a bridge or placeholder path and must not be described as verified',
             '- `runtimeMode=adapter`: the capability is on a real adapter path but still lacks part of the evidence needed for verified promotion',
             '- `runtimeMode=verified`: the capability has entered the formal public promise and closed the evidence loop',
+            '- `release=no[none]`: release HAP/runtime evidence is still open and must not be described as release-ready',
         ];
     return lines.join('\n');
 }

package/build/plugin.js

@@ -6,13 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.withExpoHarmony = void 0;
 exports.buildPrebuildMetadata = buildPrebuildMetadata;
 exports.validatePluginProps = validatePluginProps;
-const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
 const config_plugins_1 = require("expo/config-plugins");
 const validatedMatrices_1 = require("./data/validatedMatrices");
 const constants_1 = require("./core/constants");
 const project_1 = require("./core/project");
 const project_2 = require("./core/project");
+const safeProjectWrite_1 = require("./core/safeProjectWrite");
 const withExpoHarmony = (config, props = {}) => {
     validatePluginProps(props);
     const identifiers = (0, project_1.deriveHarmonyIdentifiers)(config, undefined, props);
@@ -59,9 +59,7 @@ function registerMetadataDangerousMod(config, platform, identifiers, props) {
         async (currentConfig) => {
             const metadata = buildPrebuildMetadata(currentConfig, identifiers, props);
             const projectRoot = currentConfig.modRequest.projectRoot;
-            const targetPath = path_1.default.join(projectRoot, constants_1.GENERATED_DIR, constants_1.PREBUILD_METADATA_FILENAME);
-            await fs_extra_1.default.ensureDir(path_1.default.dirname(targetPath));
-            await fs_extra_1.default.writeJson(targetPath, metadata, { spaces: 2 });
+            await (0, safeProjectWrite_1.writeProjectJson)(projectRoot, path_1.default.join(constants_1.GENERATED_DIR, constants_1.PREBUILD_METADATA_FILENAME), metadata);
             return currentConfig;
         },
     ]);

package/docs/cli-build.md

@@ -1,6 +1,6 @@
 # CLI 构建指南
 
-`v1.11.1` 延续 `verified + preview + experimental` 支持分层，并把 `v1.11.0` 的 sidecar drift 台账收口成第一个公开 `v1.11.x` 工具链 patch：`doctor` 继续分类任意 Expo 项目、标出 blocker 类型并给出有序下一步；`expo55-rnoh082-ui-stack` 仍是唯一 verified 矩阵。
+`v1.11.3` 延续 `verified + preview + experimental` 支持分层，并完成 v2 readiness 非实机 gate / fallback / exception 台账：v1.11.x 剩余 blocker 继续写成 burn-down 台账与降级策略，`v1.11.2` 的 ccnubox_rn signed simulator app-shell gate 作为既有证据保留；`doctor` 继续分类任意 Expo 项目、标出 blocker 类型并给出有序下一步；`expo55-rnoh082-ui-stack` 仍是唯一 verified 矩阵。
 
 CLI 命令集合不变：
 

package/docs/npm-release.md

@@ -61,7 +61,10 @@ pnpm release:check
 - hosted CI 默认仍可通过 `EXPO_HARMONY_RELEASE_SKIP_HAP=1` 跳过真实 DevEco HAP 构建
 - debug / release HAP gate 继续由 capability acceptance、带工具链环境的 CI 或本地验收补齐
 - `v1.11.0` 是未发布的 burn-down ledger checkpoint；`v1.11.1` 是第一个公开 `v1.11.x`，发布到 `latest` 只代表 sidecar drift 工具链行为收口，不代表 verified/capability 边界放宽
-- `v1.8.2` 已补一条 ccnubox release HAP 的本地签名、模拟器安装与启动记录；该记录不替代真机 device acceptance，也不把 preview capability 标为 release-ready
+- `v1.11.2` 已完成非实机 closeout 与 ccnubox signed simulator app-shell gate，并已通过 tag/npm/GitHub Release 发布到 `latest`
+- `v1.11.2` 远端状态：npm `latest -> 1.11.2`，npm `next -> 1.9.0`，GitHub Release `v1.11.2` 已建立
+- `v1.11.2` 的 ccnubox signed simulator install/start 记录不替代真机 device acceptance，也不把 preview capability 标为 release-ready
+- `v1.11.3` 当前只更新仓库代码与 v2 readiness 非实机台账；未创建 tag，未发布 npm，未创建 GitHub Release
 - `v1.8.3` 只刷新 RNOH runtime / CLI 到 `0.82.29`，仍不宣称 RN `0.83.x` 已进入公开 Harmony 矩阵
 - preview capability 若在报告里显示 `device=yes`，必须同时以 `evidenceSource.device=manual-doc` 对外说明其来源，不得表述成 CI 自动设备验证
 

package/docs/roadmap.md

@@ -252,7 +252,7 @@ Acceptance checklist：
 
 目标日期：`2026-11-30`
 
-状态：`v1.11.0` 是未发布的 burn-down ledger checkpoint；`v1.11.1` 是第一个公开 `v1.11.x`，发布到 `latest`，只收口 sidecar drift 工具链行为，不提升任何 capability 到 `verified`。
+状态：`v1.11.0` 是未发布的 burn-down ledger checkpoint；`v1.11.1` 是第一个公开 `v1.11.x`，发布到 `latest`，只收口 sidecar drift 工具链行为；`v1.11.2` 已发布到 `latest`，完成非实机 closeout 与 ccnubox signed simulator app-shell gate；`v1.11.3` 更新仓库代码，完成 v2 readiness 非实机 gate / fallback / exception 台账，但不发布 tag/npm/GitHub Release，也不提升任何 capability 到 `verified`。
 
 目标：把还会阻止“任何 Expo 项目可靠打包”的剩余高频 blocker 清到只剩极少数明确已知例外。
 
@@ -282,6 +282,8 @@ Acceptance checklist：
 
 - 新增 `acceptance/v1.11.0-burn-down-ledger.md` 记录 v1.11.x 起始台账
 - 新增 `acceptance/v1.11.1-acceptance.md` 记录第一个公开 v1.11.x release、`v1.11.0` 不发布决策与 sidecar drift 收口结果
+- 更新 `acceptance/v1.11.2-acceptance.md` 记录非实机 closeout、ccnubox signed simulator app-shell gate、bare release gap 与 third-party fallback 策略
+- 新增 `acceptance/v1.11.3-acceptance.md` 记录 v2 readiness 非实机 gate、fallback、exception 与公开边界
 - 明确本阶段不改变 `latest` / `verified` 边界
 - 不把 debug/release HAP build pass 表述为真机 device 或 runtime pass
 - 对每个无法在 v1.11.x 关闭的 blocker 写出降级或替代路径

package/docs/support-matrix.md

@@ -15,7 +15,7 @@
 - `v2.0.0` 本身被定义成“任何 Expo 项目都能可靠打包成鸿蒙 App”的目标版本
 - 但当前公开承诺依旧没有放宽；它们只是进入同一主线 backlog，而不是已经进入 `verified`
 - `v1.10.0` 已冻结 Any-project Intake：任何 Expo 项目进入 `doctor` 后都应有分类、明确 blocker 类型与有序 `nextActions`
-- `v1.11.1` 是第一个公开 `v1.11.x`，只收口 sidecar drift 的可诊断行为；`v1.11.0` 保留为未发布的 burn-down ledger checkpoint
+- `v1.11.3` 已更新仓库代码，完成 v2 readiness 非实机 gate / fallback / exception 台账；`v1.11.2` 是当前已发布到 `latest` 的 tag/npm/GitHub Release，并完成非实机 closeout 与 ccnubox signed simulator app-shell gate；`v1.11.1` 是第一个公开 `v1.11.x`，只收口 sidecar drift 的可诊断行为；`v1.11.0` 保留为未发布的 burn-down ledger checkpoint
 - 这不是 verified 扩容；`latest` 仍只承诺完整验收的 `verified` 能力，catalog 外项目只承诺可诊断路径
 
 `doctor --strict` 继续只代表 `verified`。
@@ -93,6 +93,7 @@
 - `runtimeMode=shim`：说明当前还在桥接或占位阶段，即使 bundle / debug build 已完成，也不应宣称 verified
 - `runtimeMode=adapter`：说明已经进入真实适配路径，但仍缺少某些验收证据
 - `runtimeMode=verified`：说明能力已进入正式承诺，且证据闭环完成
+- `release=no[none]`：说明 release HAP/runtime evidence 尚未关闭，不能写成 release-ready
 <!-- GENERATED:support-matrix-capability-telemetry:end -->
 
 为了避免把“只差真机”与“当前子 API 还没实现到位”混在一起，`v1.8.x` 文档额外使用以下标记：
@@ -122,7 +123,7 @@
 - 四项 preview capability 都已经进入 `adapter` 路径；`device=yes[manual-doc]` 只表示已有人工设备验收记录，仍不代表 verified 或 release-ready
 - 当前原生 adapter preview baseline 的默认 evidenceSource 固定为：`bundle/debugBuild=automated`、`device=manual-doc`、`release=none`
 - `v1.9.0` 新增的 app foundation modules 当前是 `runtimeMode=shim`，`bundle/debugBuild=automated`，`device/release=none`
-- `v1.8.2` 的 ccnubox release HAP 模拟器安装/启动记录只证明 app-shell release 构建链路，不改变上述 per-capability `release=no[none]`
+- `v1.8.2` 的 ccnubox release HAP 模拟器安装/启动记录与 `v1.11.2` 的 ccnubox_rn signed simulator app-shell gate 都只证明 app-shell 非实机链路，不改变上述 per-capability `release=no[none]`
 - `v1.8.x` 开始，combined sample smoke 只负责总回归；每项 capability 还必须单独维护 device / release acceptance 记录，见 [acceptance/v1.8.x-capability-board.md](../acceptance/v1.8.x-capability-board.md)
 - `v1.8.x` repo 内可完成的 closeout 已完成；剩余 carryover 只包括单 capability 真机 device record 与 release HAP runtime acceptance
 - `expo-file-system`
@@ -249,7 +250,7 @@ toolkit 受管的核心产物仍包括：
 
 ## Release Tracks
 
-从 `v1.8` 开始，发布节奏按双轨设计；`v1.11.1` 继续沿用同一规则：
+从 `v1.8` 开始，发布节奏按双轨设计；`v1.11.3` 继续沿用同一规则：
 
 <!-- GENERATED:support-matrix-release-tracks:start -->
 - `latest`
@@ -273,7 +274,7 @@ toolkit 受管的核心产物仍包括：
 - release signing / release HAP 验收完成
 - 文档、矩阵、roadmap、acceptance 记录同 PR 更新
 
-`v1.8.2` 记录的 simulator release-HAP evidence 只覆盖 ccnubox app-shell 的 signed HAP 构建、安装和启动；单 capability 的 release acceptance 仍必须按各自记录单独关闭。
+`v1.11.2` 记录的 simulator evidence 只覆盖当前本地 ccnubox_rn dirty checkout 的 signed HAP 构建、安装和启动；单 capability 的 release acceptance 仍必须按各自记录单独关闭。
 
 `v1.8.x` repo-only closeout 不改变 capability evidence source：`device=yes[manual-doc]` 仍只代表既有人工基线，`release=no[none]` 仍表示没有单 capability release HAP runtime evidence。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-harmony-toolkit",
-  "version": "1.11.1",
+  "version": "1.11.3",
   "description": "面向 Managed/CNG Expo 项目的 HarmonyOS 迁移、准入检查与 UI-stack 构建工具链",
   "main": "app.plugin.js",
   "types": "build/index.d.ts",

package/templates/harmony/AppScope/app.json5

@@ -3,7 +3,7 @@
     "bundleName": "{{BUNDLE_NAME}}",
     "vendor": "expo-harmony-toolkit",
     "versionCode": 1000000,
-    "versionName": "{{APP_VERSION}}",
+    "versionName": {{APP_VERSION_JSON}},
     "icon": "$media:app_icon",
     "label": "$string:app_name"
   }

package/templates/harmony/AppScope/resources/base/element/string.json

@@ -2,7 +2,7 @@
   "string": [
     {
       "name": "app_name",
-      "value": "{{APP_NAME}}"
+      "value": {{APP_NAME_JSON}}
     }
   ]
 }

package/templates/harmony/entry/oh-package.json5

@@ -1,7 +1,7 @@
 {
   "name": "{{ENTRY_MODULE_NAME}}",
-  "description": "{{APP_DESCRIPTION}}",
-  "version": "{{APP_VERSION}}",
+  "description": {{APP_DESCRIPTION_JSON}},
+  "version": {{APP_VERSION_JSON}},
   "modelVersion": "5.0.0",
   "license": "ISC",
   "dependencies": {

package/templates/harmony/entry/src/main/ets/pages/Index.ets

@@ -21,12 +21,12 @@ struct Index {
         }
         RNApp({
           rnInstanceConfig: {
-            name: '{{APP_SLUG}}',
+            name: '{{APP_SLUG_ARKTS}}',
             createRNPackages: getRNOHPackages,
             fontResourceByFontFamily: {},
             enableDebugger: this.rnohCoreContext?.isDebugModeEnabled,
           },
-          appKey: '{{APP_SLUG}}',
+          appKey: '{{APP_SLUG_ARKTS}}',
           jsBundleProvider: this.rnohCoreContext?.isDebugModeEnabled
             ? new AnyJSBundleProvider([
                 new MetroJSBundleProvider(),

package/templates/harmony/entry/src/main/resources/base/element/string.json

@@ -2,15 +2,15 @@
   "string": [
     {
       "name": "module_desc",
-      "value": "{{APP_DESCRIPTION}}"
+      "value": {{APP_DESCRIPTION_JSON}}
     },
     {
       "name": "EntryAbility_desc",
-      "value": "{{APP_DESCRIPTION}}"
+      "value": {{APP_DESCRIPTION_JSON}}
     },
     {
       "name": "EntryAbility_label",
-      "value": "{{APP_NAME}}"
+      "value": {{APP_NAME_JSON}}
     }
   ]
 }

package/templates/harmony/oh-package.json5

@@ -1,8 +1,8 @@
 {
   modelVersion: '5.0.0',
   name: '{{BUNDLE_NAME}}',
-  version: '{{APP_VERSION}}',
-  description: '{{APP_DESCRIPTION}}',
+  version: '{{APP_VERSION_JSON5}}',
+  description: '{{APP_DESCRIPTION_JSON5}}',
   dependencies: {},
   devDependencies: {
     '@ohos/hypium': '1.0.6',