openxiangda 1.0.83 → 1.0.84

package/README.md

@@ -34,12 +34,15 @@ openxiangda data-view status ticket_with_customer --profile dev
 openxiangda resource validate --profile dev
 openxiangda resource plan --profile dev
 openxiangda resource publish --profile dev
+openxiangda runtime deploy --profile dev
 openxiangda inspect app --profile dev --json
 openxiangda app snapshot APP_XXXX --profile dev --json
 ```
 
 User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions. Shared workspace environment values, including `APP_OSS_*`, can live in `~/.openxiangda/.env` and are inherited by new workspaces. Project `.env` files still work and override the global defaults. Project state is stored in `.openxiangda/state.json` and contains only profile-specific resource IDs.
 
+React SPA workspaces publish their frontend with `openxiangda runtime deploy`. The default upload mode is staged multipart: each `dist/` file is uploaded separately, then the CLI submits a release manifest and activates it unless `--no-activate` is passed. Upload progress, timeout, and `traceId` are written to stderr; `--json` stdout remains the final JSON result. Use `--upload-timeout-ms <ms>` or `OPENXIANGDA_RUNTIME_UPLOAD_TIMEOUT_MS` to tune runtime upload/finalize timeouts. Use `--upload-mode legacy-json` only as a compatibility fallback for older platforms.
+
 Feedback can be sent to a DingTalk custom robot from the CLI. AI agents should proactively report platform defects, missing capabilities, unclear design rules, repeated workarounds, implementation uncertainty, and user-visible UX gaps during development. Store the robot settings in `~/.openxiangda/.env`, not in project files:
 
 ```env

package/lib/cli.js

@@ -35,6 +35,8 @@ const { version: CURRENT_VERSION } = require('../package.json');
 
 const NPM_PACKAGE_NAME = 'openxiangda';
 const OFFICIAL_NPM_REGISTRY = 'https://registry.npmjs.org';
+const RUNTIME_UPLOAD_DEFAULT_TIMEOUT_MS = 120000;
+const RUNTIME_UPLOAD_CONCURRENCY = 3;
 
 async function main(argv) {
   const [command, ...rest] = argv;
@@ -114,7 +116,7 @@ Usage:
   openxiangda permission form-group-list|form-group-create|form-group-bind
   openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access
   openxiangda resource validate|plan|publish|pull [--profile name] [--json]
-  openxiangda runtime deploy [--profile name] [--dist dist] [--build-id id] [--no-build] [--no-activate] [--json]
+  openxiangda runtime deploy [--profile name] [--dist dist] [--build-id id] [--upload-mode staged|legacy-json] [--upload-timeout-ms ms] [--no-build] [--no-activate] [--json]
   openxiangda runtime releases [--profile name] [--json]
   openxiangda runtime activate <releaseId> [--profile name] [--json]
   openxiangda inspect app|form|workflow|automation|permissions
@@ -2766,30 +2768,57 @@ async function runtime(args) {
     const buildId = normalizeRuntimeBuildId(flags['build-id'] || createRuntimeBuildId());
     const distDir = path.resolve(process.cwd(), flags.dist || 'dist');
     const assetBaseUrl = buildRuntimeAssetBaseUrl(target.appType, buildId);
+    const uploadMode = normalizeRuntimeUploadMode(flags['upload-mode']);
+    const uploadTimeoutMs = normalizeRuntimeUploadTimeoutMs(flags['upload-timeout-ms']);
+    const traceId = createRuntimeTraceId();
     if (!flags['no-build']) {
       runRuntimeBuild({
         buildId,
         appType: target.appType,
         assetBaseUrl,
         command: flags['build-command'],
+        jsonOutput: Boolean(flags.json),
       });
     }
     const files = collectRuntimeDistFiles(distDir, {
       includeSourceMaps: Boolean(flags['include-sourcemaps']),
     });
     const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
+    printRuntimeProgress(
+      `runtime release upload: mode=${uploadMode} traceId=${traceId} files=${files.length} size=${formatBytes(totalBytes)} timeout=${uploadTimeoutMs}ms`
+    );
+    const releaseFiles =
+      uploadMode === 'legacy-json'
+        ? files.map(file => ({
+            path: file.path,
+            size: file.size,
+            sha256: file.sha256,
+            contentType: file.contentType,
+            contentBase64: file.buffer.toString('base64'),
+          }))
+        : await uploadRuntimeDistFilesStaged({
+            config,
+            profileName: target.profileName,
+            appType: target.appType,
+            buildId,
+            files,
+            traceId,
+            timeoutMs: uploadTimeoutMs,
+          });
     const data = await requestWithAuth(
       config,
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/runtime/releases`,
       {
         method: 'POST',
+        timeoutMs: uploadTimeoutMs,
+        headers: { 'x-openxiangda-trace-id': traceId },
         body: {
           buildId,
           version: flags.version || readWorkspaceVersion(),
           releaseNotes: flags.notes || flags['release-notes'] || '',
           activate: !flags['no-activate'],
-          files,
+          files: releaseFiles,
         },
       }
     );
@@ -2803,6 +2832,8 @@ async function runtime(args) {
       totalBytes,
       assetBaseUrl,
       activated: !flags['no-activate'],
+      uploadMode,
+      traceId,
     };
     if (flags.json) return writeJson(result);
     print(
@@ -2810,6 +2841,8 @@ async function runtime(args) {
         `runtime release 已上传: ${target.appType}`,
         `build: ${buildId}`,
         `files: ${files.length} (${formatBytes(totalBytes)})`,
+        `upload: ${uploadMode}`,
+        `traceId: ${traceId}`,
         `assetBase: ${assetBaseUrl}`,
         `active: ${result.activated ? 'yes' : 'no'}`,
       ].join('\n')
@@ -2822,11 +2855,16 @@ async function runtime(args) {
 
 function runRuntimeBuild(options) {
   const command = options.command || defaultRuntimeBuildCommand();
-  print(`构建 React SPA runtime: ${command}`);
+  if (options.jsonOutput) {
+    printRuntimeProgress(`构建 React SPA runtime: ${command}`);
+  } else {
+    print(`构建 React SPA runtime: ${command}`);
+  }
   const result = spawnSync(command, [], {
     cwd: process.cwd(),
     shell: true,
-    stdio: 'inherit',
+    stdio: options.jsonOutput ? 'pipe' : 'inherit',
+    encoding: options.jsonOutput ? 'utf8' : undefined,
     env: {
       ...process.env,
       OPENXIANGDA_APP_TYPE: options.appType,
@@ -2835,6 +2873,10 @@ function runRuntimeBuild(options) {
       OPENXIANGDA_RUNTIME_ASSET_BASE: options.assetBaseUrl,
     },
   });
+  if (options.jsonOutput) {
+    if (result.stdout) process.stderr.write(maskText(result.stdout));
+    if (result.stderr) process.stderr.write(maskText(result.stderr));
+  }
   if (result.error) fail(`runtime build 无法启动: ${result.error.message}`);
   if (result.status !== 0) fail(`runtime build 失败: exit ${result.status}`);
 }
@@ -2856,7 +2898,7 @@ function collectRuntimeDistFiles(distDir, options = {}) {
   }
   const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
   if (totalBytes > 25 * 1024 * 1024) {
-    fail(`runtime dist 过大: ${formatBytes(totalBytes)}，当前 JSON 发布通道上限为 25MB`);
+    fail(`runtime dist 过大: ${formatBytes(totalBytes)}，当前 runtime 发布通道上限为 25MB`);
   }
   return files;
 }
@@ -2878,11 +2920,112 @@ function walkRuntimeDist(rootDir, currentDir, files, options) {
       size: buffer.length,
       sha256: crypto.createHash('sha256').update(buffer).digest('hex'),
       contentType: inferRuntimeContentType(relative),
-      contentBase64: buffer.toString('base64'),
+      buffer,
     });
   }
 }
 
+async function uploadRuntimeDistFilesStaged(options) {
+  const files = options.files || [];
+  let completed = 0;
+  const results = await runWithConcurrency(
+    files,
+    RUNTIME_UPLOAD_CONCURRENCY,
+    async file => {
+      const uploaded = await uploadRuntimeDistFile(options, file);
+      completed += 1;
+      printRuntimeProgress(
+        `runtime file uploaded [${completed}/${files.length}] ${file.path} ${formatBytes(file.size)} traceId=${options.traceId}`
+      );
+      return uploaded;
+    }
+  );
+  return results.map(file => ({
+    path: file.path,
+    size: file.size,
+    sha256: file.sha256,
+    contentType: file.contentType,
+  }));
+}
+
+async function uploadRuntimeDistFile(options, file) {
+  const apiPath = apiPathWithQuery(
+    `/openxiangda-api/v1/apps/${encodeURIComponent(options.appType)}/runtime/releases/files`,
+    {
+      buildId: options.buildId,
+      path: file.path,
+      size: file.size,
+      sha256: file.sha256,
+      contentType: file.contentType,
+    }
+  );
+  return await requestFormWithAuth(
+    options.config,
+    options.profileName,
+    apiPath,
+    () => {
+      const form = new FormData();
+      form.append(
+        'file',
+        new Blob([file.buffer], { type: file.contentType }),
+        path.basename(file.path)
+      );
+      return form;
+    },
+    {
+      timeoutMs: options.timeoutMs,
+      headers: { 'x-openxiangda-trace-id': options.traceId },
+    }
+  );
+}
+
+async function runWithConcurrency(items, concurrency, worker) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  let firstError = null;
+  const workers = Array.from(
+    { length: Math.min(concurrency, items.length) },
+    async () => {
+      while (nextIndex < items.length && !firstError) {
+        const index = nextIndex;
+        nextIndex += 1;
+        try {
+          results[index] = await worker(items[index], index);
+        } catch (error) {
+          firstError = error;
+        }
+      }
+    }
+  );
+  await Promise.all(workers);
+  if (firstError) throw firstError;
+  return results;
+}
+
+function normalizeRuntimeUploadMode(value) {
+  const normalized = String(value || 'staged').trim().toLowerCase();
+  if (normalized === 'staged' || normalized === 'legacy-json') return normalized;
+  fail(`--upload-mode 只支持 staged 或 legacy-json，当前: ${value}`);
+}
+
+function normalizeRuntimeUploadTimeoutMs(value) {
+  const candidate =
+    value === undefined || value === null || value === ''
+      ? process.env.OPENXIANGDA_RUNTIME_UPLOAD_TIMEOUT_MS
+      : value;
+  const parsed = Number(candidate);
+  if (Number.isFinite(parsed) && parsed > 0) return parsed;
+  return RUNTIME_UPLOAD_DEFAULT_TIMEOUT_MS;
+}
+
+function createRuntimeTraceId() {
+  return `oxd-${Date.now().toString(36)}-${crypto.randomBytes(4).toString('hex')}`;
+}
+
+function printRuntimeProgress(message) {
+  process.stderr.write(`${maskText(message)}\n`);
+}
+
 function buildRuntimeAssetBaseUrl(appType, buildId) {
   return `/service/openxiangda-api/v1/apps/${encodeURIComponent(appType)}/runtime/releases/by-build/${encodeURIComponent(buildId)}/files/`;
 }
@@ -7087,7 +7230,7 @@ async function requestWithAuth(config, profileName, apiPath, options = {}) {
   }
 }
 
-async function requestFormWithAuth(config, profileName, apiPath, formDataFactory) {
+async function requestFormWithAuth(config, profileName, apiPath, formDataFactory, options = {}) {
   const resolved = getProfile(config, profileName);
   const profile = resolved.profile;
   if (!profile.token?.accessToken) {
@@ -7099,7 +7242,8 @@ async function requestFormWithAuth(config, profileName, apiPath, formDataFactory
       profile.baseUrl,
       apiPath,
       formDataFactory(),
-      profile.token.accessToken
+      profile.token.accessToken,
+      options
     );
     return unwrapApi(payload);
   } catch (error) {
@@ -7111,25 +7255,41 @@ async function requestFormWithAuth(config, profileName, apiPath, formDataFactory
       profile.baseUrl,
       apiPath,
       formDataFactory(),
-      profile.token.accessToken
+      profile.token.accessToken,
+      options
     );
     return unwrapApi(payload);
   }
 }
 
-async function requestForm(baseUrl, apiPath, formData, accessToken) {
+async function requestForm(baseUrl, apiPath, formData, accessToken, options = {}) {
   if (typeof fetch !== 'function') {
     throw new Error('当前 Node.js 版本不支持 fetch，请使用 Node.js 18 或更高版本');
   }
   const url = `${baseUrl.replace(/\/+$/, '')}${apiPath}`;
-  const response = await fetch(url, {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      authorization: `Bearer ${accessToken}`,
-    },
-    body: formData,
-  });
+  const timeoutMs = normalizeRuntimeUploadTimeoutMs(options.timeoutMs);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        authorization: `Bearer ${accessToken}`,
+        ...(options.headers || {}),
+      },
+      body: formData,
+      signal: controller.signal,
+    });
+  } catch (error) {
+    if (isAbortError(error)) {
+      throw new Error(maskText(`HTTP form request timed out after ${timeoutMs}ms: ${apiPath}`));
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
   const text = await response.text();
   let payload = null;
   if (text) {
@@ -7146,6 +7306,13 @@ async function requestForm(baseUrl, apiPath, formData, accessToken) {
   return payload;
 }
 
+function isAbortError(error) {
+  return (
+    error?.name === 'AbortError' ||
+    String(error?.message || '').toLowerCase().includes('aborted')
+  );
+}
+
 async function refreshProfile(config, profileName) {
   const { profile } = getProfile(config, profileName);
   if (!profile.token?.refreshToken) {

package/lib/http.js

@@ -1,11 +1,16 @@
 const { maskText } = require('./utils');
 
+const DEFAULT_REQUEST_TIMEOUT_MS = 60000;
+
 async function requestJson(baseUrl, apiPath, options = {}) {
   if (typeof fetch !== 'function') {
     throw new Error('当前 Node.js 版本不支持 fetch，请使用 Node.js 18 或更高版本');
   }
 
   const url = `${baseUrl.replace(/\/+$/, '')}${apiPath}`;
+  const timeoutMs = normalizeTimeoutMs(options.timeoutMs, DEFAULT_REQUEST_TIMEOUT_MS);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   const headers = {
     accept: 'application/json',
     ...(options.headers || {}),
@@ -17,12 +22,23 @@ async function requestJson(baseUrl, apiPath, options = {}) {
     headers.authorization = `Bearer ${options.accessToken}`;
   }
 
-  const response = await fetch(url, {
-    method: options.method || 'GET',
-    headers,
-    body:
-      options.body === undefined ? undefined : JSON.stringify(options.body),
-  });
+  let response;
+  try {
+    response = await fetch(url, {
+      method: options.method || 'GET',
+      headers,
+      body:
+        options.body === undefined ? undefined : JSON.stringify(options.body),
+      signal: controller.signal,
+    });
+  } catch (error) {
+    if (isAbortError(error)) {
+      throw new Error(maskText(`HTTP request timed out after ${timeoutMs}ms: ${apiPath}`));
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
 
   const text = await response.text();
   let payload = null;
@@ -42,6 +58,19 @@ async function requestJson(baseUrl, apiPath, options = {}) {
   return payload;
 }
 
+function normalizeTimeoutMs(value, fallback) {
+  const parsed = Number(value);
+  if (Number.isFinite(parsed) && parsed > 0) return parsed;
+  return fallback;
+}
+
+function isAbortError(error) {
+  return (
+    error?.name === 'AbortError' ||
+    String(error?.message || '').toLowerCase().includes('aborted')
+  );
+}
+
 module.exports = {
   requestJson,
 };

package/openxiangda-skills/SKILL.md

@@ -37,6 +37,7 @@ OpenXiangda supports two workspace modes. Classic `sy-lowcode-app-workspace` pub
 ### Hard rules — always
 
 - ✅ Publish classic workspaces through `openxiangda workspace publish --profile <name>`; publish React SPA workspaces through `openxiangda resource publish` + `openxiangda runtime deploy`.
+- ✅ `runtime deploy` defaults to staged multipart `dist/` uploads plus a final manifest. Use `--upload-mode legacy-json` only for old platform servers.
 - ✅ User token lives in `~/.openxiangda/profiles.json`; project state in `.openxiangda/state.json` (IDs only).
 - ✅ Each profile (dev / prod / ...) has its own `appType` and resource IDs; never copy a `formUuid` / `pageId` / `workflowId` / `automationId` across profiles.
 - ✅ Run `openxiangda update check --json` at the start of substantial work; if `updateAvailable`, run `openxiangda update install` and `openxiangda skill install --force`.

package/openxiangda-skills/skills/openxiangda-app/SKILL.md

@@ -64,7 +64,7 @@ openxiangda resource publish --profile <name>
 openxiangda runtime deploy --profile <name>
 ```
 
-`runtime deploy` builds and activates the app-level SPA release for `/view/:appType/*`.
+`runtime deploy` builds and activates the app-level SPA release for `/view/:appType/*`. It uploads `dist/` through staged multipart file uploads by default; use `--upload-mode legacy-json` only as an older-server fallback.
 Publish React SPA forms separately with `openxiangda workspace publish --form <formCode>`;
 with `runtimeMode: "react-spa"` this is schema-only and does not require OSS.
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -43,7 +43,7 @@ openxiangda resource publish --profile <name>
 openxiangda runtime deploy --profile <name>
 ```
 
-`runtime deploy` builds the Vite app with a release-specific asset base, uploads `dist/` to the platform runtime release store, and activates the release unless `--no-activate` is passed.
+`runtime deploy` builds the Vite app with a release-specific asset base, uploads `dist/` to the platform runtime release store, and activates the release unless `--no-activate` is passed. The default upload mode is staged multipart file upload plus a final release manifest; use `--upload-mode legacy-json` only for older platform servers that have not been upgraded.
 
 For React SPA forms, still use targeted form publish to create/bind the form and
 sync schema:
@@ -282,8 +282,11 @@ openxiangda runtime deploy --profile prod
 It is responsible for:
 
 1. Running the workspace build command with `OPENXIANGDA_APP_TYPE`, `OPENXIANGDA_BUILD_ID`, and `OPENXIANGDA_RUNTIME_ASSET_BASE`.
-2. Uploading `dist/` to `/openxiangda-api/v1/apps/:appType/runtime/releases`.
-3. Activating the new runtime release so `/view/:appType/*` enters the React app.
+2. Uploading each `dist/` file to `/openxiangda-api/v1/apps/:appType/runtime/releases/files` with a shared trace id.
+3. Submitting the final release manifest to `/openxiangda-api/v1/apps/:appType/runtime/releases` without inline base64 content.
+4. Activating the new runtime release so `/view/:appType/*` enters the React app.
+
+Runtime upload/finalize timeout defaults to 120s. Override with `--upload-timeout-ms <ms>` or `OPENXIANGDA_RUNTIME_UPLOAD_TIMEOUT_MS`; progress and `traceId` are written to stderr, while `--json` keeps stdout as final JSON only.
 
 ## References
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.83",
+  "version": "1.0.84",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {