openyida 2026.7.18-1 → 2026.7.18-2

package/lib/auth/oauth-loopback.js

@@ -2,7 +2,10 @@
 
 const crypto = require('crypto');
 const http = require('http');
-const { spawn } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn, spawnSync } = require('child_process');
 
 const CALLBACK_PATH = '/oauth/callback';
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
@@ -11,7 +14,266 @@ function randomToken(bytes = 24) {
   return crypto.randomBytes(bytes).toString('base64url');
 }
 
-function resolveBrowserLauncher(url, platform = process.platform) {
+const CHROMIUM_MAC_BUNDLES = {
+  'com.google.chrome': 'com.google.Chrome',
+  'com.microsoft.edgemac': 'com.microsoft.edgemac',
+  'com.brave.browser': 'com.brave.Browser',
+  'com.operasoftware.opera': 'com.operasoftware.Opera',
+  'com.vivaldi.vivaldi': 'com.vivaldi.Vivaldi',
+  'org.chromium.chromium': 'org.chromium.Chromium',
+};
+
+// Only these browser families have a known reliable new-window launch path.
+// Anything else (unknown/unsupported default browser) must fall back.
+const SUPPORTED_BROWSER_FAMILIES = new Set(['chromium', 'firefox', 'safari']);
+
+// Chromium accepts `--new-window`; Firefox uses the single-dash `-new-window`.
+function newWindowFlag(family) {
+  return family === 'firefox' ? '-new-window' : '--new-window';
+}
+
+function appleScriptSafe(value) {
+  return String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+function classifyMacBundleId(bundleId) {
+  if (!bundleId) {
+    return null;
+  }
+  const id = String(bundleId).toLowerCase();
+  if (id === 'com.apple.safari') {
+    return { family: 'safari' };
+  }
+  if (id === 'org.mozilla.firefox') {
+    return { family: 'firefox', bundleId: 'org.mozilla.firefox' };
+  }
+  if (CHROMIUM_MAC_BUNDLES[id]) {
+    return { family: 'chromium', bundleId: CHROMIUM_MAC_BUNDLES[id] };
+  }
+  return null;
+}
+
+function classifyWindowsProgId(progId) {
+  if (!progId) {
+    return null;
+  }
+  const id = String(progId).toLowerCase();
+  if (id.includes('firefox')) {
+    return 'firefox';
+  }
+  if (
+    id.startsWith('chromehtml') ||
+    id.startsWith('msedge') ||
+    id.startsWith('bravehtml') ||
+    id.startsWith('opera') ||
+    id.includes('vivaldi') ||
+    id.includes('chromium')
+  ) {
+    return 'chromium';
+  }
+  return null;
+}
+
+function classifyLinuxDesktop(name) {
+  if (!name) {
+    return null;
+  }
+  const id = String(name).toLowerCase();
+  if (id.includes('firefox')) {
+    return 'firefox';
+  }
+  if (
+    id.includes('chrome') ||
+    id.includes('chromium') ||
+    id.includes('brave') ||
+    id.includes('edge') ||
+    id.includes('opera') ||
+    id.includes('vivaldi')
+  ) {
+    return 'chromium';
+  }
+  return null;
+}
+
+function parseMacDefaultBrowser(defaultsOutput) {
+  if (!defaultsOutput) {
+    return null;
+  }
+  // The secure plist is an array of dicts; each `}` closes one handler entry.
+  const blocks = String(defaultsOutput).split('}');
+  for (const block of blocks) {
+    if (/LSHandlerURLScheme\s*=\s*https\b/i.test(block)) {
+      const match = block.match(/LSHandlerRole(?:All|Viewer)\s*=\s*"?([\w.-]+)"?/i);
+      if (match) {
+        return match[1].toLowerCase();
+      }
+    }
+  }
+  return null;
+}
+
+function parseWindowsProgId(regOutput) {
+  if (!regOutput) {
+    return null;
+  }
+  const match = String(regOutput).match(/ProgId\s+REG_\w+\s+(\S+)/i);
+  return match ? match[1] : null;
+}
+
+function parseWindowsCommandExec(regOutput) {
+  if (!regOutput) {
+    return null;
+  }
+  const match = String(regOutput).match(/REG_\w+\s+(.+)$/m);
+  if (!match) {
+    return null;
+  }
+  const value = match[1].trim();
+  if (value.startsWith('"')) {
+    const end = value.indexOf('"', 1);
+    if (end > 1) {
+      return value.slice(1, end);
+    }
+  }
+  return value.split(/\s+/)[0] || null;
+}
+
+function parseLinuxExec(desktopContent) {
+  if (!desktopContent) {
+    return null;
+  }
+  const match = String(desktopContent).match(/^Exec=(.+)$/m);
+  if (!match) {
+    return null;
+  }
+  // Drop desktop-entry field codes (%u %U %f %F ...) then take the executable.
+  const withoutCodes = match[1].replace(/%[a-zA-Z]/g, '').trim();
+  const first = withoutCodes.match(/^"([^"]+)"|^(\S+)/);
+  if (!first) {
+    return null;
+  }
+  return first[1] || first[2] || null;
+}
+
+function runCapture(command, args) {
+  try {
+    const result = spawnSync(command, args, {
+      encoding: 'utf8',
+      timeout: 2500,
+      windowsHide: true,
+    });
+    if (result && typeof result.stdout === 'string' && result.stdout.length > 0) {
+      return result.stdout;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+// Detect the system default browser so we can open a real new window.
+// Returns { family, bundleId? , execPath? } or null when detection fails or
+// the default browser is not a supported family (unknown ProgId/desktop/bundle).
+// `deps` allows injecting command runner / file reader for deterministic tests.
+function detectDefaultBrowser(platform = process.platform, deps = {}) {
+  const run = deps.run || runCapture;
+  const readFile = deps.readFile || ((filePath) => fs.readFileSync(filePath, 'utf8'));
+  const homedir = deps.homedir || os.homedir;
+  try {
+    if (platform === 'darwin') {
+      const output = run('defaults', [
+        'read',
+        'com.apple.LaunchServices/com.apple.launchservices.secure',
+      ]);
+      return classifyMacBundleId(parseMacDefaultBrowser(output));
+    }
+    if (platform === 'win32') {
+      const progOutput = run('reg', [
+        'query',
+        'HKCU\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice',
+        '/v',
+        'ProgId',
+      ]);
+      const progId = parseWindowsProgId(progOutput);
+      const family = classifyWindowsProgId(progId);
+      // Unknown ProgId (e.g. IE.HTTP or any browser we don't map) -> fall back.
+      if (!family) {
+        return null;
+      }
+      const commandOutput =
+        run('reg', ['query', `HKCU\\Software\\Classes\\${progId}\\shell\\open\\command`, '/ve']) ||
+        run('reg', ['query', `HKEY_CLASSES_ROOT\\${progId}\\shell\\open\\command`, '/ve']);
+      const execPath = parseWindowsCommandExec(commandOutput);
+      if (!execPath) {
+        return null;
+      }
+      return { family, execPath };
+    }
+    // linux and other unix-like desktops
+    const desktop = run('xdg-settings', ['get', 'default-web-browser']);
+    const name = desktop ? desktop.trim() : '';
+    if (!name) {
+      return null;
+    }
+    const family = classifyLinuxDesktop(name);
+    // Unknown .desktop (e.g. some non-browser or unmapped browser) -> fall back.
+    if (!family) {
+      return null;
+    }
+    const candidates = [
+      path.join(homedir(), '.local/share/applications', name),
+      path.join('/usr/share/applications', name),
+      path.join('/usr/local/share/applications', name),
+    ];
+    for (const candidate of candidates) {
+      try {
+        const content = readFile(candidate);
+        const execPath = parseLinuxExec(content);
+        if (execPath) {
+          return { family, execPath };
+        }
+      } catch {
+        // try the next candidate location
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function resolveBrowserLauncher(url, platform = process.platform, openMode = 'legacy', browser = null) {
+  if (openMode === 'newWindow' && browser && SUPPORTED_BROWSER_FAMILIES.has(browser.family)) {
+    if (platform === 'darwin') {
+      if (browser.family === 'safari') {
+        // Safari has no CLI new-window flag; AppleScript opens a new window.
+        const safeUrl = appleScriptSafe(url);
+        return {
+          command: 'osascript',
+          args: [
+            '-e',
+            `tell application "Safari" to make new document with properties {URL:"${safeUrl}"}`,
+            '-e',
+            'tell application "Safari" to activate',
+          ],
+        };
+      }
+      if (browser.bundleId) {
+        // `open -b <bundle> -n --args --new-window <url>` forces a new window
+        // in the specific Chromium/Firefox app instead of a new tab.
+        return {
+          command: 'open',
+          args: ['-b', browser.bundleId, '-n', '--args', newWindowFlag(browser.family), url],
+        };
+      }
+    } else if (browser.execPath) {
+      return {
+        command: browser.execPath,
+        args: [newWindowFlag(browser.family), url],
+      };
+    }
+  }
+
   if (platform === 'darwin') {
     return { command: 'open', args: [url] };
   }
@@ -25,25 +287,65 @@ function resolveBrowserLauncher(url, platform = process.platform) {
   return { command: 'xdg-open', args: [url] };
 }
 
-function openBrowser(url) {
-  if (process.env.OPENYIDA_NO_BROWSER === '1') {
-    return false;
-  }
-
-  const { command, args } = resolveBrowserLauncher(url);
-
+function launchBrowserLauncher(launcher, onError) {
   try {
-    const child = spawn(command, args, {
+    const child = spawn(launcher.command, launcher.args, {
       detached: true,
       stdio: 'ignore',
     });
     child.unref();
+    if (onError) {
+      child.once('error', onError);
+    }
     return true;
   } catch {
+    if (onError) {
+      onError();
+    }
     return false;
   }
 }
 
+function openBrowser(url) {
+  if (process.env.OPENYIDA_NO_BROWSER === '1') {
+    return false;
+  }
+
+  const platform = process.platform;
+  const legacyLauncher = resolveBrowserLauncher(url, platform, 'legacy');
+  const runLegacy = () => launchBrowserLauncher(legacyLauncher);
+
+  let browser = null;
+  try {
+    browser = detectDefaultBrowser(platform);
+  } catch {
+    browser = null;
+  }
+
+  // Default browser detected and supported → open a real new window in that
+  // browser, falling back to the plain default-browser open if launch errors.
+  if (browser && SUPPORTED_BROWSER_FAMILIES.has(browser.family)) {
+    const newWindowLauncher = resolveBrowserLauncher(url, platform, 'newWindow', browser);
+    let fallbackUsed = false;
+    const runFallback = () => {
+      if (fallbackUsed) {
+        return false;
+      }
+      fallbackUsed = true;
+      return runLegacy();
+    };
+
+    const launched = launchBrowserLauncher(newWindowLauncher, runFallback);
+    if (!launched) {
+      return runFallback();
+    }
+    return true;
+  }
+
+  // Detection failed → fall back to the system default browser (new tab).
+  return runLegacy();
+}
+
 function buildDingtalkOAuthUrl(options) {
   const {
     clientId,
@@ -66,8 +368,45 @@ function buildDingtalkOAuthUrl(options) {
   return url.toString();
 }
 
-function responseHtml(title, body) {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><h3>${title}</h3><p>${body}</p></body></html>`;
+function responseHtml(title, body, options = {}) {
+  const {
+    autoClose = false,
+    autoCloseDelayMs = 1200,
+    staticHint = 'You can close this page and return to the terminal.',
+  } = options;
+
+  const closeScript = autoClose ? `
+    <script>
+      (function() {
+        const delay = Math.max(0, ${Number(autoCloseDelayMs)});
+        function forceClose() {
+          try {
+            if (window.opener && !window.opener.closed && window.opener.focus) {
+              window.opener.focus();
+            }
+          } catch (err) {}
+
+          try {
+            window.close();
+          } catch (err) {}
+
+          if (!window.closed) {
+            try {
+              window.open('', '_self').close();
+            } catch (err) {}
+          }
+        }
+
+        setTimeout(forceClose, delay);
+      })();
+    </script>
+  ` : '';
+
+  const closeHint = autoClose
+    ? ''
+    : `<p>${staticHint}</p>`;
+
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><h3>${title}</h3><p>${body}</p>${closeHint}${closeScript}</body></html>`;
 }
 
 function runDingtalkLoopback(options = {}) {
@@ -122,7 +461,13 @@ function runDingtalkLoopback(options = {}) {
 
       res.statusCode = 200;
       res.setHeader('content-type', 'text/html; charset=utf-8');
-      res.end(responseHtml('OpenYida login completed', 'You can close this page and return to the terminal.'));
+      res.end(responseHtml(
+        'OpenYida login completed',
+        'Login callback received. Returning to terminal.',
+        {
+          autoClose: true,
+        }
+      ));
       finish(null, {
         code,
         authCode,
@@ -160,5 +505,13 @@ module.exports = {
   runDingtalkLoopback,
   buildDingtalkOAuthUrl,
   resolveBrowserLauncher,
+  detectDefaultBrowser,
+  classifyMacBundleId,
+  classifyWindowsProgId,
+  classifyLinuxDesktop,
+  parseMacDefaultBrowser,
+  parseWindowsProgId,
+  parseWindowsCommandExec,
+  parseLinuxExec,
   CALLBACK_PATH,
 };

package/lib/process/preview-process.js

@@ -21,6 +21,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 const {
   findProjectRoot,
 } = require('../core/utils');
@@ -859,16 +860,25 @@ async function run(args) {
   return result;
 }
 
+function resolvePreviewBrowserLauncher(filePath, platform = process.platform) {
+  if (platform === 'darwin') {
+    return { command: 'open', args: [filePath] };
+  }
+  if (platform === 'win32') {
+    return { command: 'rundll32', args: ['url.dll,FileProtocolHandler', filePath] };
+  }
+  return { command: 'xdg-open', args: [filePath] };
+}
+
 function tryOpenBrowser(filePath) {
   try {
-    const { execSync } = require('child_process');
-    const platform = process.platform;
-    if (platform === 'darwin') {
-      execSync(`open "${filePath}"`, { stdio: 'ignore' });
-    } else if (platform === 'win32') {
-      execSync(`start "" "${filePath}"`, { stdio: 'ignore' });
-    } else {
-      execSync(`xdg-open "${filePath}"`, { stdio: 'ignore' });
+    const launcher = resolvePreviewBrowserLauncher(filePath);
+    const result = spawnSync(launcher.command, launcher.args, {
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+    if (result && (result.error || (typeof result.status === 'number' && result.status !== 0))) {
+      throw result.error || new Error('open_browser_failed');
     }
     warn(`🌐 ${t('preview_process.browser_opened')}`);
   } catch {
@@ -883,4 +893,6 @@ module.exports = {
   fetchProcessInstance,
   fetchOperationRecords,
   parseProcessData,
+  resolvePreviewBrowserLauncher,
+  tryOpenBrowser,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.7.18-1",
+  "version": "2026.7.18-2",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",
@@ -53,6 +53,7 @@
     "check:i18n:audit": "node scripts/validate-i18n.js",
     "check:i18n:baseline": "node scripts/validate-i18n.js --update-baseline",
     "check:syntax": "node scripts/check-syntax.js",
+    "check:release-risks": "node scripts/check-release-risks.js",
     "check:package-size": "node scripts/validate-package-size.js",
     "check:package": "npm pack --dry-run",
     "check:release": "npm run check:ci",

package/scripts/check-release-risks.js

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * check-release-risks.js
+ *
+ * 发布前静态风险扫描，专注「跨平台浏览器/URL 拉起」这一类在 macOS 本地
+ * 测试里查不出、却会在 Windows/Linux 用户侧炸掉的历史坑：
+ *
+ *   - `cmd /c start <url>`：cmd.exe 把 URL 里的 `&` 当命令分隔符，截断
+ *     OAuth/bridge URL，丢失 client_id/state 或 bridge 配对参数（见 ce7efdd）。
+ *   - `open -n <url>`：macOS 下不会真正开新窗口，只是在默认浏览器里开新
+ *     标签页，属于「假装开新窗口」的反模式。
+ *
+ * HARD 反模式（error）→ 退出码 1，阻断发布。
+ * SOFT 提示（warning）→ 退出码 0，仅提醒发布人做人工跨端验证。
+ *
+ * 该脚本无第三方依赖，纯静态扫描 lib/ 源码；核心分析函数导出供单测使用。
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const SCAN_DIRS = ['lib'];
+
+// HARD 反模式：命中即 error，阻断发布。
+const HARD_RULES = [
+  {
+    id: 'cmd-c-start-url',
+    pattern: /cmd\s*\/c\s*start/i,
+    message:
+      'cmd /c start 会把 URL 中的 & 当作命令分隔符截断参数（丢失 client_id/state 或 bridge 配对参数）。请改用 rundll32 url.dll,FileProtocolHandler，并复用 resolveBrowserLauncher。',
+  },
+  {
+    id: 'cmd-c-start-argv',
+    pattern: /['"]cmd['"]\s*,\s*\[\s*['"]\/c['"]\s*,\s*['"]start['"]/i,
+    message:
+      'spawn("cmd", ["/c", "start", ...]) 与 cmd /c start 同源风险：& 处截断 URL。请改用 rundll32 或平台专用浏览器拉起命令。',
+  },
+  {
+    id: 'open-n-url-new-tab',
+    pattern: /\[\s*(['"])-n\1\s*,\s*url\s*\]/,
+    message:
+      'open -n <url> 在 macOS 上不会开新窗口，只会在默认浏览器新开标签页（假装开窗口）。要真正开新窗口须指定浏览器 App 并传其 --new-window/-new-window，检测不到默认浏览器时回退纯 open <url>。',
+  },
+];
+
+// SOFT 提示：命中不阻断，只提醒发布人补人工跨端验证。
+const SOFT_LAUNCH_PRIMITIVES =
+  /rundll32|xdg-open|osascript|FileProtocolHandler|--new-window|-new-window|command\s*:\s*['"]open['"]|spawn(?:Sync)?\(\s*['"]open['"]/;
+
+// 把注释内容替换成等长空白（保留换行以维持行号），避免把「解释为何避免
+// cmd /c start」这类说明性注释误判成真实反模式。会跟踪字符串/模板字面量，
+// 不会把字符串里的 // 或 /* 当注释。
+function stripComments(content) {
+  const src = String(content);
+  let out = '';
+  let i = 0;
+  const n = src.length;
+  let state = 'code'; // code | line | block | sq | dq | tpl
+  while (i < n) {
+    const ch = src[i];
+    const next = src[i + 1];
+    if (state === 'code') {
+      if (ch === '/' && next === '/') {
+        state = 'line';
+        out += '  ';
+        i += 2;
+        continue;
+      }
+      if (ch === '/' && next === '*') {
+        state = 'block';
+        out += '  ';
+        i += 2;
+        continue;
+      }
+      if (ch === "'") {
+        state = 'sq';
+      } else if (ch === '"') {
+        state = 'dq';
+      } else if (ch === '`') {
+        state = 'tpl';
+      }
+      out += ch;
+      i += 1;
+      continue;
+    }
+    if (state === 'line') {
+      if (ch === '\n') {
+        state = 'code';
+        out += ch;
+      } else {
+        out += ' ';
+      }
+      i += 1;
+      continue;
+    }
+    if (state === 'block') {
+      if (ch === '*' && next === '/') {
+        state = 'code';
+        out += '  ';
+        i += 2;
+      } else {
+        out += ch === '\n' ? '\n' : ' ';
+        i += 1;
+      }
+      continue;
+    }
+    // string / template states: copy verbatim, honor escapes, exit on matching quote
+    out += ch;
+    if (ch === '\\') {
+      out += next !== undefined ? next : '';
+      i += 2;
+      continue;
+    }
+    if (
+      (state === 'sq' && ch === "'") ||
+      (state === 'dq' && ch === '"') ||
+      (state === 'tpl' && ch === '`')
+    ) {
+      state = 'code';
+    }
+    i += 1;
+  }
+  return out;
+}
+
+function analyzeContent(relPath, content) {
+  const findings = [];
+  const scannable = stripComments(content);
+  const lines = scannable.split(/\r?\n/);
+
+  for (const rule of HARD_RULES) {
+    lines.forEach((line, index) => {
+      if (rule.pattern.test(line)) {
+        findings.push({
+          file: relPath,
+          line: index + 1,
+          severity: 'error',
+          ruleId: rule.id,
+          message: rule.message,
+        });
+      }
+    });
+  }
+
+  if (SOFT_LAUNCH_PRIMITIVES.test(scannable)) {
+    findings.push({
+      file: relPath,
+      line: 0,
+      severity: 'warning',
+      ruleId: 'cross-platform-launch-touched',
+      message:
+        '涉及浏览器/URL 拉起代码。CI 只跑纯函数单测，不覆盖真实系统拉起——发布前请在 Windows / macOS / Linux 各自实测 login 与 bridge 页面唤起。',
+    });
+  }
+
+  return findings;
+}
+
+function analyzeFiles(files) {
+  const findings = [];
+  for (const f of files) {
+    findings.push(...analyzeContent(f.path, f.content));
+  }
+  const errorCount = findings.filter((x) => x.severity === 'error').length;
+  const warnCount = findings.filter((x) => x.severity === 'warning').length;
+  return { findings, errorCount, warnCount };
+}
+
+function collectSourceFiles(root = REPO_ROOT, dirs = SCAN_DIRS) {
+  const out = [];
+  const walk = (abs) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(abs, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name === '.git') {
+          continue;
+        }
+        walk(full);
+      } else if (entry.isFile() && entry.name.endsWith('.js')) {
+        out.push({
+          path: path.relative(root, full),
+          content: fs.readFileSync(full, 'utf8'),
+        });
+      }
+    }
+  };
+  for (const dir of dirs) {
+    walk(path.join(root, dir));
+  }
+  return out;
+}
+
+function formatFindings({ findings, errorCount, warnCount }) {
+  const lines = [];
+  const errors = findings.filter((x) => x.severity === 'error');
+  const warnings = findings.filter((x) => x.severity === 'warning');
+
+  if (errors.length) {
+    lines.push('发布风险检查：发现 HARD 反模式（阻断发布）');
+    for (const f of errors) {
+      lines.push(`  ✗ [${f.ruleId}] ${f.file}:${f.line}`);
+      lines.push(`      ${f.message}`);
+    }
+  }
+
+  if (warnings.length) {
+    lines.push('发布风险检查：跨端人工验证提醒（不阻断）');
+    const byFile = new Set(warnings.map((w) => w.file));
+    for (const file of byFile) {
+      lines.push(`  ⚠ ${file}`);
+    }
+    lines.push(
+      '      涉及浏览器/URL 拉起：请在 Windows / macOS / Linux 各自实测 openyida login 与 bridge 页面唤起。'
+    );
+  }
+
+  lines.push('');
+  lines.push(`发布风险检查完成：error=${errorCount}, warning=${warnCount}`);
+  return lines.join('\n');
+}
+
+function main() {
+  const result = analyzeFiles(collectSourceFiles());
+  process.stdout.write(`${formatFindings(result)}\n`);
+  if (result.errorCount > 0) {
+    process.stdout.write(
+      '\n存在阻断发布的 HARD 反模式，请修复后重试（详见 .qoder/skills 跨端发布风险技能）。\n'
+    );
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  HARD_RULES,
+  SOFT_LAUNCH_PRIMITIVES,
+  analyzeContent,
+  analyzeFiles,
+  collectSourceFiles,
+  formatFindings,
+};

package/scripts/validate-ci.sh

@@ -17,25 +17,25 @@ echo "=== Step 2: Validate project structure ==="
 npm run check:structure
 
 echo ""
-echo "=== Step 3: Validate skills ==="
+echo "=== Step 3: Build Wukong skills package ==="
+npm run build:skills
+
+echo ""
+echo "=== Step 4: Validate skills ==="
 npm run check:skills
 
 echo ""
-echo "=== Step 4: Validate command manifest ==="
+echo "=== Step 5: Validate command manifest ==="
 npm run check:commands
 
 echo ""
-echo "=== Step 5: Validate generated command docs ==="
+echo "=== Step 6: Validate generated command docs ==="
 npm run check:docs
 
 echo ""
-echo "=== Step 6: Validate i18n locale parity (ratchet) ==="
+echo "=== Step 7: Validate i18n locale parity (ratchet) ==="
 npm run check:i18n
 
-echo ""
-echo "=== Step 7: Build Wukong skills package ==="
-npm run build:skills
-
 echo ""
 echo "=== Step 8: Check JavaScript syntax ==="
 npm run check:syntax
@@ -45,15 +45,19 @@ echo "=== Step 9: Run lint ==="
 npm run lint
 
 echo ""
-echo "=== Step 10: Run tests ==="
+echo "=== Step 10: Scan cross-platform release risks ==="
+npm run check:release-risks
+
+echo ""
+echo "=== Step 11: Run tests ==="
 npm run test:unit -- --runInBand
 
 echo ""
-echo "=== Step 11: Validate npm package size budget ==="
+echo "=== Step 12: Validate npm package size budget ==="
 npm run check:package-size
 
 echo ""
-echo "=== Step 12: Validate npm package contents ==="
+echo "=== Step 13: Validate npm package contents ==="
 npm run check:package
 
 echo ""

package/scripts/validate-structure.js

@@ -41,6 +41,21 @@ if (!nodeEngine) {
 }
 console.log('engines.node: ' + nodeEngine);
 
+if (fs.existsSync('package-lock.json')) {
+  const packageLock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
+  const lockVersions = [
+    ['package-lock.json version', packageLock.version],
+    ['package-lock root package version', packageLock.packages && packageLock.packages[''] && packageLock.packages[''].version],
+  ];
+  for (const pair of lockVersions) {
+    if (pair[1] !== packageJson.version) {
+      console.error(`${pair[0]} (${pair[1] || 'missing'}) does not match package.json version (${packageJson.version})`);
+      process.exit(1);
+    }
+  }
+  console.log('package-lock version: ' + packageLock.version);
+}
+
 const skillsDir = 'yida-skills/skills';
 if (fs.existsSync(skillsDir)) {
   const skills = fs.readdirSync(skillsDir).filter(function(name) {