openyida 2026.7.18 → 2026.7.21

package/scripts/check-release-risks.js

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * check-release-risks.js
+ *
+ * 发布前静态风险扫描，专注「跨平台浏览器/URL 拉起」这一类在 macOS 本地
+ * 测试里查不出、却会在 Windows/Linux 用户侧炸掉的历史坑：
+ *
+ *   - `cmd /c start <url>`：cmd.exe 把 URL 里的 `&` 当命令分隔符，截断
+ *     OAuth/bridge URL，丢失 client_id/state 或 bridge 配对参数（见 ce7efdd）。
+ *   - `open -n <url>`：macOS 下不会真正开新窗口，只是在默认浏览器里开新
+ *     标签页，属于「假装开新窗口」的反模式。
+ *
+ * HARD 反模式（error）→ 退出码 1，阻断发布。
+ * SOFT 提示（warning）→ 退出码 0，仅提醒发布人做人工跨端验证。
+ *
+ * 该脚本无第三方依赖，纯静态扫描 lib/ 源码；核心分析函数导出供单测使用。
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const SCAN_DIRS = ['lib'];
+
+// HARD 反模式：命中即 error，阻断发布。
+const HARD_RULES = [
+  {
+    id: 'cmd-c-start-url',
+    pattern: /cmd\s*\/c\s*start/i,
+    message:
+      'cmd /c start 会把 URL 中的 & 当作命令分隔符截断参数（丢失 client_id/state 或 bridge 配对参数）。请改用 rundll32 url.dll,FileProtocolHandler，并复用 resolveBrowserLauncher。',
+  },
+  {
+    id: 'cmd-c-start-argv',
+    pattern: /['"]cmd['"]\s*,\s*\[\s*['"]\/c['"]\s*,\s*['"]start['"]/i,
+    message:
+      'spawn("cmd", ["/c", "start", ...]) 与 cmd /c start 同源风险：& 处截断 URL。请改用 rundll32 或平台专用浏览器拉起命令。',
+  },
+  {
+    id: 'open-n-url-new-tab',
+    pattern: /\[\s*(['"])-n\1\s*,\s*url\s*\]/,
+    message:
+      'open -n <url> 在 macOS 上不会开新窗口，只会在默认浏览器新开标签页（假装开窗口）。要真正开新窗口须指定浏览器 App 并传其 --new-window/-new-window，检测不到默认浏览器时回退纯 open <url>。',
+  },
+];
+
+// SOFT 提示：命中不阻断，只提醒发布人补人工跨端验证。
+const SOFT_LAUNCH_PRIMITIVES =
+  /rundll32|xdg-open|osascript|FileProtocolHandler|--new-window|-new-window|command\s*:\s*['"]open['"]|spawn(?:Sync)?\(\s*['"]open['"]/;
+
+// 把注释内容替换成等长空白（保留换行以维持行号），避免把「解释为何避免
+// cmd /c start」这类说明性注释误判成真实反模式。会跟踪字符串/模板字面量，
+// 不会把字符串里的 // 或 /* 当注释。
+function stripComments(content) {
+  const src = String(content);
+  let out = '';
+  let i = 0;
+  const n = src.length;
+  let state = 'code'; // code | line | block | sq | dq | tpl
+  while (i < n) {
+    const ch = src[i];
+    const next = src[i + 1];
+    if (state === 'code') {
+      if (ch === '/' && next === '/') {
+        state = 'line';
+        out += '  ';
+        i += 2;
+        continue;
+      }
+      if (ch === '/' && next === '*') {
+        state = 'block';
+        out += '  ';
+        i += 2;
+        continue;
+      }
+      if (ch === "'") {
+        state = 'sq';
+      } else if (ch === '"') {
+        state = 'dq';
+      } else if (ch === '`') {
+        state = 'tpl';
+      }
+      out += ch;
+      i += 1;
+      continue;
+    }
+    if (state === 'line') {
+      if (ch === '\n') {
+        state = 'code';
+        out += ch;
+      } else {
+        out += ' ';
+      }
+      i += 1;
+      continue;
+    }
+    if (state === 'block') {
+      if (ch === '*' && next === '/') {
+        state = 'code';
+        out += '  ';
+        i += 2;
+      } else {
+        out += ch === '\n' ? '\n' : ' ';
+        i += 1;
+      }
+      continue;
+    }
+    // string / template states: copy verbatim, honor escapes, exit on matching quote
+    out += ch;
+    if (ch === '\\') {
+      out += next !== undefined ? next : '';
+      i += 2;
+      continue;
+    }
+    if (
+      (state === 'sq' && ch === "'") ||
+      (state === 'dq' && ch === '"') ||
+      (state === 'tpl' && ch === '`')
+    ) {
+      state = 'code';
+    }
+    i += 1;
+  }
+  return out;
+}
+
+function analyzeContent(relPath, content) {
+  const findings = [];
+  const scannable = stripComments(content);
+  const lines = scannable.split(/\r?\n/);
+
+  for (const rule of HARD_RULES) {
+    lines.forEach((line, index) => {
+      if (rule.pattern.test(line)) {
+        findings.push({
+          file: relPath,
+          line: index + 1,
+          severity: 'error',
+          ruleId: rule.id,
+          message: rule.message,
+        });
+      }
+    });
+  }
+
+  if (SOFT_LAUNCH_PRIMITIVES.test(scannable)) {
+    findings.push({
+      file: relPath,
+      line: 0,
+      severity: 'warning',
+      ruleId: 'cross-platform-launch-touched',
+      message:
+        '涉及浏览器/URL 拉起代码。CI 只跑纯函数单测，不覆盖真实系统拉起——发布前请在 Windows / macOS / Linux 各自实测 login 与 bridge 页面唤起。',
+    });
+  }
+
+  return findings;
+}
+
+function analyzeFiles(files) {
+  const findings = [];
+  for (const f of files) {
+    findings.push(...analyzeContent(f.path, f.content));
+  }
+  const errorCount = findings.filter((x) => x.severity === 'error').length;
+  const warnCount = findings.filter((x) => x.severity === 'warning').length;
+  return { findings, errorCount, warnCount };
+}
+
+function collectSourceFiles(root = REPO_ROOT, dirs = SCAN_DIRS) {
+  const out = [];
+  const walk = (abs) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(abs, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name === '.git') {
+          continue;
+        }
+        walk(full);
+      } else if (entry.isFile() && entry.name.endsWith('.js')) {
+        out.push({
+          path: path.relative(root, full),
+          content: fs.readFileSync(full, 'utf8'),
+        });
+      }
+    }
+  };
+  for (const dir of dirs) {
+    walk(path.join(root, dir));
+  }
+  return out;
+}
+
+function formatFindings({ findings, errorCount, warnCount }) {
+  const lines = [];
+  const errors = findings.filter((x) => x.severity === 'error');
+  const warnings = findings.filter((x) => x.severity === 'warning');
+
+  if (errors.length) {
+    lines.push('发布风险检查：发现 HARD 反模式（阻断发布）');
+    for (const f of errors) {
+      lines.push(`  ✗ [${f.ruleId}] ${f.file}:${f.line}`);
+      lines.push(`      ${f.message}`);
+    }
+  }
+
+  if (warnings.length) {
+    lines.push('发布风险检查：跨端人工验证提醒（不阻断）');
+    const byFile = new Set(warnings.map((w) => w.file));
+    for (const file of byFile) {
+      lines.push(`  ⚠ ${file}`);
+    }
+    lines.push(
+      '      涉及浏览器/URL 拉起：请在 Windows / macOS / Linux 各自实测 openyida login 与 bridge 页面唤起。'
+    );
+  }
+
+  lines.push('');
+  lines.push(`发布风险检查完成：error=${errorCount}, warning=${warnCount}`);
+  return lines.join('\n');
+}
+
+function main() {
+  const result = analyzeFiles(collectSourceFiles());
+  process.stdout.write(`${formatFindings(result)}\n`);
+  if (result.errorCount > 0) {
+    process.stdout.write(
+      '\n存在阻断发布的 HARD 反模式，请修复后重试（详见 .qoder/skills 跨端发布风险技能）。\n'
+    );
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  HARD_RULES,
+  SOFT_LAUNCH_PRIMITIVES,
+  analyzeContent,
+  analyzeFiles,
+  collectSourceFiles,
+  formatFindings,
+};

package/scripts/generate-command-docs.js

@@ -49,7 +49,12 @@ function getByPath(object, keyPath) {
 }
 
 function translate(locale, key) {
-  return getByPath(locale, key) || key;
+  const value = getByPath(locale, key);
+  if (!value) {
+    console.warn('[generate-command-docs] 缺失翻译，已回退为 key：' + key);
+    return key;
+  }
+  return value;
 }
 
 function escapeTableCell(value) {

package/scripts/i18n-baseline.json

@@ -1,13 +1,13 @@
 {
   "base": "zh",
-  "basePathCount": 1375,
+  "basePathCount": 1392,
   "locales": {
     "ar": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "de": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "en": {
@@ -15,35 +15,35 @@
       "typeMismatch": 0
     },
     "es": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "fr": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "hi": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "ja": {
-      "missing": 379,
+      "missing": 396,
       "typeMismatch": 0
     },
     "ko": {
-      "missing": 679,
+      "missing": 696,
       "typeMismatch": 0
     },
     "pt": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "vi": {
-      "missing": 680,
+      "missing": 697,
       "typeMismatch": 0
     },
     "zh-HK": {
-      "missing": 339,
+      "missing": 356,
       "typeMismatch": 0
     }
   }

package/scripts/postinstall.js

@@ -224,28 +224,24 @@ npm install -g openyida@latest
 若登录态无效，执行：
 
 \`\`\`bash
-openyida login --browser
+openyida login
 \`\`\`
 
-登录完成后再次运行 \`openyida login --check-only --json\` 验证缓存写入，再继续真实资源操作。
+登录完成后再次运行 \`openyida login --check-only --json\` 验证 token session，再继续真实资源操作。
 
 ## Codex Browser 边界
 
 Codex App 的 in-app browser / \`@Browser\` 适合打开本地开发服务器、file-backed preview 和无需登录的公开页面，用于截图、点击和检查渲染状态。
 
-不要把 Codex in-app browser 用作宜搭登录 Cookie 来源：它不支持认证流程、登录态页面、普通浏览器 profile 或 Cookie 导出。
+不要把 Codex in-app browser 用作宜搭登录 Cookie 来源：OpenYida CLI 登录使用 OAuth loopback + token session，不需要导出或手写 Cookie。
 
-需要登录并获得 CLI Cookie 时，优先运行：
+需要登录并获得 CLI token session 时，优先运行：
 
 \`\`\`bash
-openyida login --browser
+openyida login
 \`\`\`
 
-\`--browser\` 会打开常规本地浏览器并在登录成功后将 Cookie 写入 OpenYida 缓存。只有在需要纯浏览器预览或检查公开页面时才使用 \`@Browser\`。
-
-在 Codex 中如果 \`openyida login --codex-poll\` 返回 \`need_corp_selection\`，优先调用 OpenYida MCP 工具
-\`select_yida_login_organization\`，传入返回值里的 \`session_file\`。该工具会通过 MCP \`elicitation/create\`
-展示 Codex 原生组织单选控件，并在用户选择后完成 \`openyida login --codex-select\`。
+\`openyida login\` 会通过 OAuth loopback 打开常规本地浏览器；如需抑制自动打开浏览器，可设置环境变量 \`OPENYIDA_NO_BROWSER=1\`。只有在需要纯浏览器预览或检查公开页面时才使用 \`@Browser\`。
 
 ## 工作目录
 
@@ -279,8 +275,8 @@ fast_build 页面源码默认不得使用 \`this.dataSourceMap.*\`，除非本
 | \`yida-skills/analytics\` | 报表、统计、图表、ECharts、看板、驾驶舱 | \`yida-report\`, \`yida-chart\`, \`yida-dashboard\` |
 | \`yida-skills/integration\` | 连接器、外部 API、数据源、集成自动化 | \`yida-integration\`, \`yida-connector\`, \`yida-connector-safe-actions\`, \`yida-data-source-connectors\` |
 | \`yida-skills/access\` | 平台/应用/表单/页面权限、公开访问、分享 | \`yida-corp-manager\`, \`yida-app-permission\`, \`yida-form-permission\`, \`yida-page-config\` |
-| \`yida-skills/ops\` | SLS、日志、traceId、Sequence、VOC | \`sls-log-workbench\`, \`yida-db-seq-fix\`, \`yida-voc\` |
-| \`yida-skills/agent\` | 大文件写入、导出对话、会议纪要/闪记转 PRD | \`large-file-write\`, \`yida-export-conversation\`, \`yida-flash-note-to-prd\` |
+| \`yida-skills/ops\` | Sequence、VOC | \`yida-db-seq-fix\`, \`yida-voc\` |
+| \`yida-skills/agent\` | 导出对话、会议纪要/闪记转 PRD | \`yida-export-conversation\`, \`yida-flash-note-to-prd\` |
 
 ## 执行规则
 

package/scripts/validate-ci.sh

@@ -17,25 +17,25 @@ echo "=== Step 2: Validate project structure ==="
 npm run check:structure
 
 echo ""
-echo "=== Step 3: Validate skills ==="
+echo "=== Step 3: Build Wukong skills package ==="
+npm run build:skills
+
+echo ""
+echo "=== Step 4: Validate skills ==="
 npm run check:skills
 
 echo ""
-echo "=== Step 4: Validate command manifest ==="
+echo "=== Step 5: Validate command manifest ==="
 npm run check:commands
 
 echo ""
-echo "=== Step 5: Validate generated command docs ==="
+echo "=== Step 6: Validate generated command docs ==="
 npm run check:docs
 
 echo ""
-echo "=== Step 6: Validate i18n locale parity (ratchet) ==="
+echo "=== Step 7: Validate i18n locale parity (ratchet) ==="
 npm run check:i18n
 
-echo ""
-echo "=== Step 7: Build Wukong skills package ==="
-npm run build:skills
-
 echo ""
 echo "=== Step 8: Check JavaScript syntax ==="
 npm run check:syntax
@@ -45,15 +45,19 @@ echo "=== Step 9: Run lint ==="
 npm run lint
 
 echo ""
-echo "=== Step 10: Run tests ==="
+echo "=== Step 10: Scan cross-platform release risks ==="
+npm run check:release-risks
+
+echo ""
+echo "=== Step 11: Run tests ==="
 npm run test:unit -- --runInBand
 
 echo ""
-echo "=== Step 11: Validate npm package size budget ==="
+echo "=== Step 12: Validate npm package size budget ==="
 npm run check:package-size
 
 echo ""
-echo "=== Step 12: Validate npm package contents ==="
+echo "=== Step 13: Validate npm package contents ==="
 npm run check:package
 
 echo ""

package/scripts/validate-i18n.js

@@ -5,14 +5,14 @@
 /**
  * i18n 语言包一致性校验
  *
- * 以 zh（源语言）为基准，校验 lib/core/locales/ 下所有语言包的 key 是否对齐：
+ * 以 zh（源语言）为基准，校验核心语言包和 locales-extra/core 下可选语言包的 key 是否对齐：
  *   - 基准中存在但目标语言缺失的 key  -> 错误（会 fallback 到其它语言，用户可见）
  *   - 目标语言多出的 key             -> 警告（可能是残留 / 拼写错误）
  *   - 叶子/分支类型不一致（string vs object）-> 错误
  *
  * 用法：
  *   node scripts/validate-i18n.js            # 严格模式：任意缺失则退出码 1（本地全量审计）
- *   node scripts/validate-i18n.js --check    # 棘轮模式：仅当漂移超过基线时失败（CI 用）
+ *   node scripts/validate-i18n.js --check    # 棘轮模式：核心语言漂移超过基线时失败（CI 用）
  *   node scripts/validate-i18n.js --update-baseline  # 将当前漂移写入基线
  *   node scripts/validate-i18n.js --json     # 输出机器可读结果
  */
@@ -22,22 +22,42 @@ const path = require('path');
 
 const ROOT = path.resolve(__dirname, '..');
 const LOCALES_DIR = path.join(ROOT, 'lib', 'core', 'locales');
+const EXTRA_LOCALES_DIR = path.join(ROOT, 'locales-extra', 'core');
 const BASELINE_FILE = path.join(__dirname, 'i18n-baseline.json');
 const BASE_LOCALE = 'zh';
+const CORE_CHECK_LOCALES = new Set(['en']);
+
+function resolveLocaleFile(name) {
+  const coreFile = path.join(LOCALES_DIR, `${name}.js`);
+  if (fs.existsSync(coreFile)) {
+    return coreFile;
+  }
+  const extraFile = path.join(EXTRA_LOCALES_DIR, `${name}.js`);
+  if (fs.existsSync(extraFile)) {
+    return extraFile;
+  }
+  return null;
+}
 
 function loadLocale(name) {
   // 清除 require 缓存，保证多次运行结果稳定
-  const file = path.join(LOCALES_DIR, `${name}.js`);
+  const file = resolveLocaleFile(name);
+  if (!file) {
+    throw new Error(`Locale not found: ${name}`);
+  }
   delete require.cache[require.resolve(file)];
   return require(file);
 }
 
 function listLocales() {
-  return fs
-    .readdirSync(LOCALES_DIR)
-    .filter((f) => f.endsWith('.js'))
-    .map((f) => f.replace(/\.js$/, ''))
-    .sort();
+  const localeNames = new Set();
+  [LOCALES_DIR, EXTRA_LOCALES_DIR].forEach((dir) => {
+    if (!fs.existsSync(dir)) { return; }
+    fs.readdirSync(dir)
+      .filter((f) => f.endsWith('.js'))
+      .forEach((f) => localeNames.add(f.replace(/\.js$/, '')));
+  });
+  return [...localeNames].sort();
 }
 
 /**
@@ -147,6 +167,7 @@ function main() {
     }
     const regressions = [];
     Object.keys(report).forEach((name) => {
+      if (!CORE_CHECK_LOCALES.has(name)) { return; }
       const base = baseline.locales[name] || { missing: 0, typeMismatch: 0 };
       if (report[name].missing.length > base.missing) {
         regressions.push(`${name} 缺失 ${base.missing} → ${report[name].missing.length}`);
@@ -160,7 +181,7 @@ function main() {
       console.error('（存量缺失作为跟踪项，补齐后运行 --update-baseline 收紧基线）');
       process.exit(1);
     }
-    console.log('\n[i18n] 棘轮校验通过：无新增漂移 ✓（存量缺失见上，作为翻译跟踪项）');
+    console.log('\n[i18n] 棘轮校验通过：核心语言无新增漂移 ✓（可选语言同步参与结构校验）');
     return;
   }
 

package/scripts/validate-package-size.js

@@ -12,7 +12,7 @@ const path = require('path');
 // per-file cap stays fixed to catch accidental large-blob embeds.
 const MAX_TARBALL_BYTES = 1792 * 1024;
 const MAX_UNPACKED_BYTES = 5632 * 1024;
-const MAX_ENTRY_COUNT = 420;
+const MAX_ENTRY_COUNT = 433;
 const MAX_SINGLE_FILE_BYTES = 512 * 1024;
 
 function formatBytes(bytes) {
@@ -32,7 +32,10 @@ function fail(message) {
 }
 
 function resolveNpmBin() {
-  return process.env.OPENYIDA_NPM_BIN || 'npm';
+  if (process.env.OPENYIDA_NPM_BIN) {
+    return process.env.OPENYIDA_NPM_BIN;
+  }
+  return process.platform === 'win32' ? 'npm.cmd' : 'npm';
 }
 
 function runNpmPackDryRun() {

package/scripts/validate-skills.js

@@ -20,6 +20,10 @@ const SKILLS_INDEX_ENTRY_ALLOWED_FIELDS = new Set([
   'category',
   'tags',
   'aliases',
+  'positive_signals',
+  'negative_signals',
+  'command_ids',
+  'done_when',
   'priority',
   'requires',
   'capabilities',

package/scripts/validate-structure.js

@@ -41,6 +41,21 @@ if (!nodeEngine) {
 }
 console.log('engines.node: ' + nodeEngine);
 
+if (fs.existsSync('package-lock.json')) {
+  const packageLock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
+  const lockVersions = [
+    ['package-lock.json version', packageLock.version],
+    ['package-lock root package version', packageLock.packages && packageLock.packages[''] && packageLock.packages[''].version],
+  ];
+  for (const pair of lockVersions) {
+    if (pair[1] !== packageJson.version) {
+      console.error(`${pair[0]} (${pair[1] || 'missing'}) does not match package.json version (${packageJson.version})`);
+      process.exit(1);
+    }
+  }
+  console.log('package-lock version: ' + packageLock.version);
+}
+
 const skillsDir = 'yida-skills/skills';
 if (fs.existsSync(skillsDir)) {
   const skills = fs.readdirSync(skillsDir).filter(function(name) {