ygl-trees 0.77.0 → 0.77.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.77.2（2026-10-17）JSON 纯净性修复
+- **契约修复**：unknown-group 错误路径的 try 提示不再泄漏到 --json stdout（冷启动之旅实测发现）
+- degraded mode 提示在 json 模式改走 stderr
+- 冷安装全链路验证通过（npm install → init → doctor → research → tree → kb → webui）
+
+## 0.77.1（2026-10-17）DEP0190 hotfix
+- 所有 shell:true 消除（resolvePm 的 where/version 检查改用无 shell 调用）
+- plugin install/remove 零弃用警告
+
 ## 0.77.0（2026-10-17）plugin 安全加固 + DEP0190 消除
 - **P0 修复**：plugin install 坏路径不再被记录——存在性校验 + package.json name 校验（a2a 7aa5c871）
 - **P0 修复**：StartupError 时 plugin 命令走 degraded mode——坏插件不再砖死 home，plugin remove 自愈可用

package/dist/apps/cli/src/bin.js

@@ -386,7 +386,11 @@ async function main(argv) {
                     home, dbFile: dbFile2, ctx,
                     db: null, store: null, cordis: null,
                 };
-                (0, fmt_1.out)(ctx, (0, fmt_1.paint)(fmt_1.C.yellow, "  ! degraded mode: user plugins failed to load — plugin commands only", ctx.color));
+                // JSON purity: stdout is the machine channel — degraded-mode notice goes to stderr there
+                if (ctx.json)
+                    console.error((0, fmt_1.paint)(fmt_1.C.yellow, "  ! degraded mode: user plugins failed to load — plugin commands only", ctx.color));
+                else
+                    (0, fmt_1.out)(ctx, (0, fmt_1.paint)(fmt_1.C.yellow, "  ! degraded mode: user plugins failed to load — plugin commands only", ctx.color));
                 return pluginCmds.runPluginCommand(env2, action || "list", args._.slice(2), args);
             }
             (0, startup_diagnostics_1.reportStartupFailure)(e, home, VERSION);
@@ -541,8 +545,9 @@ async function main(argv) {
             else {
                 (0, fmt_1.bad)(ctx, `unknown group: ${group}`);
             }
-            (0, fmt_1.out)(ctx, (0, fmt_1.paint)(fmt_1.C.dim, "  try: ygl-trees (no args) for full usage", ctx.color));
-            ;
+            if (!ctx.json) {
+                (0, fmt_1.out)(ctx, (0, fmt_1.paint)(fmt_1.C.dim, "  try: ygl-trees (no args) for full usage", ctx.color));
+            }
             if (!ctx.json)
                 (0, fmt_1.out)(ctx, usage()); // usage text belongs to the human channel
             return 2;

package/dist/bundle/bin.cjs

@@ -3164,13 +3164,14 @@ function resolvePm(pm) {
 	try {
 		const where = (0, node_child_process.execFileSync)("where", [pm], {
 			stdio: "pipe",
-			shell: true
+			shell: false
 		}).toString().split(/\r?\n/).filter(Boolean);
 		for (const candidate of where) try {
-			(0, node_child_process.execFileSync)([q2(candidate), "--version"].join(" "), {
-				stdio: "pipe",
-				shell: true
-			});
+			(0, node_child_process.execFileSync)("cmd", [
+				"/c",
+				candidate,
+				"--version"
+			], { stdio: "pipe" });
 			cachedPm = candidate;
 			return candidate;
 		} catch {}
@@ -3317,7 +3318,7 @@ function loadUserPlugins(home) {
 		issues
 	};
 }
-var PROFILE_PKG, cachedPm, q2;
+var PROFILE_PKG, cachedPm;
 var init_plugins = require_rolldown_runtime.__esmMin((() => {
 	PROFILE_PKG = () => ({
 		name: "ygl-user-plugins",
@@ -3325,7 +3326,6 @@ var init_plugins = require_rolldown_runtime.__esmMin((() => {
 		version: "0.0.0",
 		description: "ygl-trees user plugin profile (spec R14 L3)"
 	});
-	q2 = (s) => `"${String(s).replace(/["&|<>^]/g, "")}"`;
 }));
 //#endregion
 //#region apps/cli/src/startup-diagnostics.ts
@@ -11071,7 +11071,8 @@ async function main(argv) {
 					store: null,
 					cordis: null
 				};
-				out(ctx, paint(C.yellow, "  ! degraded mode: user plugins failed to load — plugin commands only", ctx.color));
+				if (ctx.json) console.error(paint(C.yellow, "  ! degraded mode: user plugins failed to load — plugin commands only", ctx.color));
+				else out(ctx, paint(C.yellow, "  ! degraded mode: user plugins failed to load — plugin commands only", ctx.color));
 				return pluginCmds.runPluginCommand(env2, action || "list", args._.slice(2), args);
 			}
 			reportStartupFailure(e, home, VERSION);
@@ -11238,7 +11239,7 @@ async function main(argv) {
 			if (suggestions.length === 1) bad(ctx, `unknown group: ${group} — did you mean "${suggestions[0]}"?`);
 			else if (suggestions.length > 1) bad(ctx, `unknown group: ${group} — did you mean: ${suggestions.slice(0, 3).join(" | ")}?`);
 			else bad(ctx, `unknown group: ${group}`);
-			out(ctx, paint(C.dim, "  try: ygl-trees (no args) for full usage", ctx.color));
+			if (!ctx.json) out(ctx, paint(C.dim, "  try: ygl-trees (no args) for full usage", ctx.color));
 			if (!ctx.json) out(ctx, usage());
 			return 2;
 		}

package/dist/packages/ops/tools/src/plugins.js

@@ -182,10 +182,10 @@ function resolvePm(pm) {
         return cachedPm || pm;
     cachedPm = null;
     try {
-        const where = (0, node_child_process_1.execFileSync)("where", [pm], { stdio: "pipe", shell: true }).toString().split(/\r?\n/).filter(Boolean);
+        const where = (0, node_child_process_1.execFileSync)("where", [pm], { stdio: "pipe", shell: false }).toString().split(/\r?\n/).filter(Boolean);
         for (const candidate of where) {
             try {
-                (0, node_child_process_1.execFileSync)([q2(candidate), "--version"].join(" "), { stdio: "pipe", shell: true });
+                (0, node_child_process_1.execFileSync)("cmd", ["/c", candidate, "--version"], { stdio: "pipe" });
                 cachedPm = candidate;
                 return candidate;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ygl-trees",
-  "version": "0.77.0",
+  "version": "0.77.2",
   "description": "猿光 · 科技树 — database-centric CLI for research → production → knowledge reuse, built for AI agents.",
   "type": "commonjs",
   "main": "dist/apps/cli/index.js",
@@ -26,9 +26,9 @@
     "reflect-metadata": "^0.2.2",
     "typeorm": "^1.1.2",
     "@deepseek-ai/cordis": "~4.0.5-alpha.2",
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.2",
     "@deepseek-ai/cordis-plugin-timer": "~1.1.7-alpha.2",
-    "@deepseek-ai/cosmokit": "~1.8.6-alpha.2"
+    "@deepseek-ai/cosmokit": "~1.8.6-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",