fix: 审计修复 — 启动警告、非交互死循环、--no-sourcemap 与安全护栏

- api/runtime/symbolicate: node-fetch 改为按需加载，Node >= 21 下每条命令
  不再打印 punycode DEP0040 弃用警告；`help` 启动加载模块 171 -> 129
- utils: 版本横幅只解析 react-native-update 一个依赖，不再为每条命令读取
  项目全部依赖的 package.json
- app/package/user: chooseApp/choosePackage 在非交互模式下直接报错（此前
  question 返回空串导致 while(true) 死循环）；login 缺凭据时报错而不是把
  空账号密码发到服务端；selectApp 校验 id 为正整数
- bundle: `--no-sourcemap` 真正生效（cli-arguments 以"键存在但为 undefined"
  表达 --no-<flag>，之前回落到默认 true）；拒绝多余位置参数，避免
  `--sourcemap false` 静默保持 sourcemap 开启；移除不可达的 platform 检查
- bundle-runner: 清空中间目录前拒绝项目目录本身/其上级/家目录/根目录
- versions: ppk 上传失败时也清理打包的 source map 临时目录
- symbolicate: 无文件参数且 stdin 为终端时报用法错误，不再挂起
- cli.json: deleteApp 声明 --platform（此前被解析器拒绝为未知选项）
- provider: bundle 的 sourcemap 默认值与 CLI/README 一致（默认开启）
- types/README: CLIProvider 补 listPackages，README 接口块与 types.ts 同步
- locales: 删除 14 个未使用的文案键；add-gitignore 识别 /.pushy 与 .pushy/
- 删除不可达的 src/index.ts（exports map 未暴露）；biome 配置迁移到 preset
- tests: e2e 用 bun --no-install 消除 @pnpm/npm-conf require.resolve('npm')
  触发 auto-install 造成的偶发失败；新增 12 个用例

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tusm6iL2itjJZDiemujAeL

Author: luoqingming

README.md

@@ -85,7 +85,7 @@ const publishResult = await provider.publish({
 - `hdiffFromApp`: Generate hdiff from APP files
 - `hdiffFromIpa`: Generate hdiff from IPA files
 
-Hermes projects: `bundle` always runs hermesc with `-output-source-map`, so the debug info section is stripped from the bytecode (15–40% smaller, same as React Native's own release builds). The Hermes sourcemap stays in the intermediate directory (`.pushy/intermedia/<platform>/<bundle>.map`, never packed into the ppk) and is composed with the packager map — `--sourcemap` is on by default since 2.23 (`--sourcemap false` opts out). When `bundle` publishes, that final map is uploaded and archived with the version (`sourceMapKey`), so `pushy symbolicate` can map crash stacks — including Hermes `address at` frames — back to source later. `pushy publish <ppk> --sourcemap <file.map>` archives a map for a ppk built elsewhere; publishing without a map prints a warning.
+Hermes projects: `bundle` always runs hermesc with `-output-source-map`, so the debug info section is stripped from the bytecode (15–40% smaller, same as React Native's own release builds). The Hermes sourcemap stays in the intermediate directory (`.pushy/intermedia/<platform>/<bundle>.map`, never packed into the ppk) and is composed with the packager map — `--sourcemap` is on by default since 2.23 (`--no-sourcemap` opts out). When `bundle` publishes, that final map is uploaded and archived with the version (`sourceMapKey`), so `pushy symbolicate` can map crash stacks — including Hermes `address at` frames — back to source later. `pushy publish <ppk> --sourcemap <file.map>` archives a map for a ppk built elsewhere; publishing without a map prints a warning.
 
 Hermes delta mode (`-base-bytecode`): by default (`--hermesBase auto`) `bundle` compiles against the previous HBC of the same app, which keeps Hermes string IDs stable and makes hot-update patches 5–30× smaller. The base comes from the server (`GET /app/:id/hermesBase`), verified by sha256 and kept in a local cache (`.pushy/cache/<sha256>`, 500 MB / 20 files, `PUSHY_CACHE_DIR` / `--cacheMaxMb` to tune, `pushy cache [clean]` to inspect or clear). `--hermesBase none` disables it; `--hermesBase <file.hbc|.ppk|.apk|.ipa>` uses a local artifact (for example the store build). `--verifyHermesBase` (default on) additionally compiles without the base (concurrently with the base compile) and compares both disassemblies; on any mismatch or failure the CLI silently falls back to the plain compile, so the feature can never block a release. Only hermesc builds that include the upstream delta-mode fix are used (classic `react-native/sdks/hermesc`, or `hermes-compiler` ≥ 250829098). If a base compile fails, the full hermesc output is written to `hermes-base-error.log` next to the intermediate directory. `--resetCache false` skips Metro's `--reset-cache` and reuses its transform cache, which makes repeated bundles much faster.
 
@@ -131,20 +131,23 @@ Hermes delta mode (`-base-bytecode`): by default (`--hermesBase auto`) `bundle`
 interface CLIProvider {
   bundle(options: BundleOptions): Promise<CommandResult>;
   publish(options: PublishOptions): Promise<CommandResult>;
+  symbolicate(options: SymbolicateOptions): Promise<CommandResult>;
   upload(options: UploadOptions): Promise<CommandResult>;
 
+  createApp(name: string, platform: Platform): Promise<CommandResult>;
+  listApps(platform?: Platform): Promise<CommandResult>;
   getSelectedApp(
     platform?: Platform,
+    config?: string,
   ): Promise<{ appId: string; platform: Platform }>;
-  listApps(platform?: Platform): Promise<CommandResult>;
-  createApp(name: string, platform: Platform): Promise<CommandResult>;
 
   listVersions(appId: string): Promise<CommandResult>;
   updateVersion(
     appId: string,
     versionId: string,
-    updates: Partial<Version>,
+    updates: UpdateVersionOptions,
   ): Promise<CommandResult>;
+  listPackages(appId?: string): Promise<CommandResult>;
 
   getPlatform(platform?: Platform): Promise<Platform>;
   loadSession(): Promise<Session>;

README.zh-CN.md

@@ -76,7 +76,7 @@ const publishResult = await provider.publish({
 - `hdiffFromApp`: 基于 APP 文件生成 hdiff
 - `hdiffFromIpa`: 基于 IPA 文件生成 hdiff
 
-Hermes 工程：`bundle` 调用 hermesc 时始终带 `-output-source-map`，因此字节码不含 debug info 段（小 15%～40%，与 React Native 自身 release 构建一致）。Hermes sourcemap 保留在中间目录（`.pushy/intermedia/<platform>/<bundle>.map`，不会打进 ppk），并与 packager map 合成——自 2.23 起 `--sourcemap` 默认开启（`--sourcemap false` 关闭）。`bundle` 发布时会把这份最终 map 上传并随版本归档（`sourceMapKey`），之后用 `pushy symbolicate` 即可把崩溃堆栈（含 Hermes 的 `address at` 帧）还原到源码。别处打好的 ppk 可用 `pushy publish <ppk> --sourcemap <file.map>` 归档；不带 map 发布会打印警告。
+Hermes 工程：`bundle` 调用 hermesc 时始终带 `-output-source-map`，因此字节码不含 debug info 段（小 15%～40%，与 React Native 自身 release 构建一致）。Hermes sourcemap 保留在中间目录（`.pushy/intermedia/<platform>/<bundle>.map`，不会打进 ppk），并与 packager map 合成——自 2.23 起 `--sourcemap` 默认开启（`--no-sourcemap` 关闭）。`bundle` 发布时会把这份最终 map 上传并随版本归档（`sourceMapKey`），之后用 `pushy symbolicate` 即可把崩溃堆栈（含 Hermes 的 `address at` 帧）还原到源码。别处打好的 ppk 可用 `pushy publish <ppk> --sourcemap <file.map>` 归档；不带 map 发布会打印警告。
 
 Hermes delta 模式（`-base-bytecode`）：默认 `--hermesBase auto`，`bundle` 会以同一应用上一版的 HBC 为 base 编译，让 Hermes 字符串 ID 跨版本稳定，热更 patch 可缩小 5～30 倍。base 由服务端（`GET /app/:id/hermesBase`）给出、按 sha256 校验并存入本地缓存（`.pushy/cache/<sha256>`，默认 500 MB / 20 个，可用 `PUSHY_CACHE_DIR` / `--cacheMaxMb` 调整，`pushy cache [clean]` 查看或清空）。`--hermesBase none` 关闭；`--hermesBase <file.hbc|.ppk|.apk|.ipa>` 指定本地文件（比如商店包）作 base。`--verifyHermesBase`（默认开）会并行再做一次普通编译并比对两份反汇编；任何不一致或失败都静默回退到普通编译，不会阻塞发版。只有包含上游 delta 模式修复的 hermesc 才会启用（经典 `react-native/sdks/hermesc`，或 `hermes-compiler` ≥ 250829098）。base 编译失败时，完整的 hermesc 输出会写到中间目录旁边的 `hermes-base-error.log`。`--resetCache false` 可跳过 Metro 的 `--reset-cache`，复用其转换缓存，重复打包会快很多。
 
@@ -122,20 +122,23 @@ Hermes delta 模式（`-base-bytecode`）：默认 `--hermesBase auto`，`bundle
 interface CLIProvider {
   bundle(options: BundleOptions): Promise<CommandResult>;
   publish(options: PublishOptions): Promise<CommandResult>;
+  symbolicate(options: SymbolicateOptions): Promise<CommandResult>;
   upload(options: UploadOptions): Promise<CommandResult>;
 
+  createApp(name: string, platform: Platform): Promise<CommandResult>;
+  listApps(platform?: Platform): Promise<CommandResult>;
   getSelectedApp(
     platform?: Platform,
+    config?: string,
   ): Promise<{ appId: string; platform: Platform }>;
-  listApps(platform?: Platform): Promise<CommandResult>;
-  createApp(name: string, platform: Platform): Promise<CommandResult>;
 
   listVersions(appId: string): Promise<CommandResult>;
   updateVersion(
     appId: string,
     versionId: string,
-    updates: Partial<Version>,
+    updates: UpdateVersionOptions,
   ): Promise<CommandResult>;
+  listPackages(appId?: string): Promise<CommandResult>;
 
   getPlatform(platform?: Platform): Promise<Platform>;
   loadSession(): Promise<Session>;

biome.json

@@ -5,7 +5,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "suspicious": {
         "noExplicitAny": "off",
         "noAssignInExpressions": "off",

cli.json

@@ -23,7 +23,13 @@
         }
       }
     },
-    "deleteApp": {},
+    "deleteApp": {
+      "options": {
+        "platform": {
+          "hasValue": true
+        }
+      }
+    },
     "selectApp": {
       "options": {
         "platform": {

src/api.ts

@@ -1,6 +1,9 @@
 import filesizeParser from 'filesize-parser';
 import fs from 'fs';
-import fetch from 'node-fetch';
+import type {
+  RequestInit as NodeFetchRequestInit,
+  Response as NodeFetchResponse,
+} from 'node-fetch';
 import path from 'path';
 import type ProgressBar from 'progress';
 import packageJson from '../package.json';
@@ -255,6 +258,17 @@ class UploadTimeoutError extends Error {
   }
 }
 
+/**
+ * node-fetch is only needed for the streaming multipart / PUT upload below
+ * (the built-in fetch cannot stream a form-data body). Loading it eagerly
+ * pulled whatwg-url → punycode into every command, which Node ≥ 21 greets
+ * with a DEP0040 deprecation warning on stderr; so it is loaded on first use.
+ */
+function loadNodeFetch(): typeof import('node-fetch').default {
+  const mod = require('node-fetch');
+  return (mod.default ?? mod) as typeof import('node-fetch').default;
+}
+
 /**
  * Send the file with a size-scaled deadline and one retry on a transient
  * network error. `buildRequest` is invoked per attempt with a fresh file
@@ -265,9 +279,10 @@ async function sendUpload(
   realUrl: string,
   fileSize: number,
   bar: ProgressBar,
-  buildRequest: (fileStream: fs.ReadStream) => fetch.RequestInit,
-): Promise<fetch.Response> {
+  buildRequest: (fileStream: fs.ReadStream) => NodeFetchRequestInit,
+): Promise<NodeFetchResponse> {
   const timeoutMs = uploadTimeoutMs(fileSize);
+  const nodeFetch = loadNodeFetch();
   for (let attempt = 0; ; attempt++) {
     const controller = new AbortController();
     let timedOut = false;
@@ -280,7 +295,7 @@ async function sendUpload(
       bar.tick(data.length);
     });
     try {
-      return await fetch(realUrl, {
+      return await nodeFetch(realUrl, {
         ...buildRequest(fileStream),
         signal: controller.signal,
       });
@@ -361,7 +376,7 @@ export async function uploadFile(
 
   // 自托管节点的 s3 直传:服务端下发预签名 PUT,字节直达用户的对象存储
   if (resp.method === 'PUT') {
-    let putRes: fetch.Response;
+    let putRes: NodeFetchResponse;
     try {
       putRes = await sendUpload(fn, realUrl, fileSize, bar, (fileStream) => ({
         method: 'PUT',
@@ -385,7 +400,7 @@ export async function uploadFile(
   }
 
   const FormData = require('form-data') as typeof import('form-data');
-  let res: fetch.Response;
+  let res: NodeFetchResponse;
   try {
     res = await sendUpload(fn, realUrl, fileSize, bar, (fileStream) => {
       const form = new FormData();

src/app.ts

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import { doDelete, get, post } from './api';
 import type { Platform } from './types';
-import { loadTtyTable, question } from './utils';
+import { isNonInteractive, loadTtyTable, question } from './utils';
 import { updateJson } from './utils/constants';
 import { t } from './utils/i18n';
 
@@ -144,6 +144,11 @@ export async function listApp(platform: Platform | '' = '') {
 /** Prompt until the user chooses an app belonging to the target platform. */
 export async function chooseApp(platform: Platform) {
   const list = await listApp(platform);
+  // without a terminal `question` answers '' and no app has that id: the
+  // loop below would never end
+  if (isNonInteractive()) {
+    throw new Error(t('appIdRequired'));
+  }
 
   while (true) {
     const id = await question(t('enterAppIdQuestion'));
@@ -166,6 +171,9 @@ async function selectApp({
   const id = args[0]
     ? Number.parseInt(args[0], 10)
     : (await chooseApp(platform)).id;
+  if (!Number.isInteger(id) || id <= 0) {
+    throw new Error(t('invalidId', { id: args[0] }));
+  }
 
   const configPath = options.config || updateJson;
   let updateInfo: Partial<Record<Platform, { appId: number; appKey: string }>> =

src/bundle-runner.ts

@@ -230,6 +230,7 @@ export async function runReactNativeBundleCommand({
     reactNativeBundleArgs.push(...envArgs.trim().split(/\s+/));
   }
 
+  assertSafeToEmpty(outputFolder);
   fs.emptyDirSync(outputFolder);
 
   let cliPath = '';
@@ -410,6 +411,30 @@ export async function runReactNativeBundleCommand({
   return hermesResult;
 }
 
+/**
+ * The intermediate directory is emptied before every bundle. Refuse to do that
+ * to the project itself (`--intermediaDir .`), to anything above it, to the
+ * home directory or to the filesystem root: one typo must not wipe a working
+ * tree.
+ */
+export function assertSafeToEmpty(dir: string, cwd = process.cwd()): void {
+  const target = path.resolve(cwd, dir);
+  const contains = (parent: string, child: string) => {
+    const relative = path.relative(parent, child);
+    return (
+      relative === '' ||
+      (!relative.startsWith('..') && !path.isAbsolute(relative))
+    );
+  };
+  if (
+    target === path.parse(target).root ||
+    target === path.resolve(os.homedir()) ||
+    contains(target, path.resolve(cwd))
+  ) {
+    throw new Error(t('unsafeIntermediateDir', { dir: target }));
+  }
+}
+
 async function detectHermesEnabled(
   platform: string,
   forceHermes: boolean | undefined,

src/bundle.ts

@@ -57,6 +57,11 @@ type NormalizedBundleOptions = {
   sentryDist?: string;
 };
 
+/** `--no-<flag>` as parsed by cli-arguments: the key is present without a value. */
+function isClearedFlag(options: Record<string, unknown>, key: string): boolean {
+  return key in options && options[key] === undefined;
+}
+
 /** Parse a positive cache-size option expressed in megabytes. */
 function parseCacheMaxMb(value: unknown): number | undefined {
   const parsed = typeof value === 'string' ? Number(value) : (value as number);
@@ -117,8 +122,13 @@ export function normalizeBundleOptions(
     ),
     dev: getBooleanOption(translatedOptions, 'dev', false) ? 'true' : 'false',
     // On by default since 2.23: the map is archived with the published
-    // version (pushy symbolicate). --no-sourcemap / --sourcemap=false opts out.
-    sourcemap: getBooleanOption(translatedOptions, 'sourcemap', true),
+    // version (pushy symbolicate). `--no-sourcemap` opts out: cli-arguments
+    // implements `--no-<flag>` by clearing the flag's value, so a key that is
+    // present but undefined is the opt-out and only a missing key means
+    // "default" (`--sourcemap false` would leave the flag on, see `bundle`).
+    sourcemap: isClearedFlag(translatedOptions, 'sourcemap')
+      ? false
+      : getBooleanOption(translatedOptions, 'sourcemap', true),
     taro: getBooleanOption(translatedOptions, 'taro', false),
     expo: getBooleanOption(translatedOptions, 'expo', false),
     rncli: getBooleanOption(translatedOptions, 'rncli', false),
@@ -209,11 +219,19 @@ async function publishBundleVersion(
 export const bundleCommands = {
   /** Build a bundle and optionally publish it to one operation-scoped app. */
   bundle: async ({
+    args = [],
     options,
   }: {
     args?: string[];
     options: Record<string, unknown>;
   }) => {
+    // Boolean flags take no value: `--sourcemap false` leaves the flag on and
+    // turns "false" into a stray argument. Refuse it rather than silently
+    // bundling with the wrong settings (a flag is switched off with
+    // `--no-<flag>`).
+    if (args.length > 0) {
+      throw new Error(t('bundleUnexpectedArgs', { args: args.join(' ') }));
+    }
     const platform = await getPlatform(
       typeof options.platform === 'string' ? options.platform : undefined,
     );
@@ -276,10 +294,6 @@ export const bundleCommands = {
       `${Date.now()}`,
     );
 
-    if (!platform) {
-      throw new Error(t('platformRequired'));
-    }
-
     console.log(t('bundlingWithRN', { version: depVersions['react-native'] }));
 
     const hermesResult = await runReactNativeBundleCommand({

src/index.ts

@@ -51,17 +51,12 @@ export default {
   bundlingWithRN: 'Bundling with react-native: {{version}}',
   cancelled: 'Cancelled',
   composingSourceMap: 'Composing source map',
-  copyFileFailed: 'Failed to copy file: {{error}}',
-  copyHarmonyBundleError: 'Error copying Harmony bundle: {{error}}',
   copyingDebugId: 'Copying debugid',
   createAppSuccess: 'App created successfully (id: {{id}})',
   deleteFile: 'Delete {{- file}}',
-  deletingFile: 'Delete {{- file}}',
   enterAppIdQuestion: 'Enter AppId:',
   enterNativePackageId: 'Enter native package ID:',
-  errorInHarmonyApp: 'Error in getEntryFromHarmonyApp: {{error}}',
   expiredStatus: '(Expired)',
-  failedToParseIcon: '[Warning] failed to parse icon: {{error}}',
   failedToParseUpdateJson:
     'Failed to parse file `{{- configPath}}`. Try to remove it manually.',
   fileGenerated: '{{- file}} generated.',
@@ -71,7 +66,6 @@ export default {
   hermesEnabledCompiling: 'Hermes enabled, now compiling to hermes bytecode:\n',
   ipaUploadSuccess:
     'Successfully uploaded IPA native package (id: {{id}}, version: {{version}}, buildTime: {{buildTime}})',
-  keyStrings: 'Key strings:',
   latestVersionTag: '(latest: {{version}})',
   lockBestPractice: `
 Best practices for lock files:
@@ -125,15 +119,9 @@ This can reduce the risk of inconsistent dependencies and supply chain attacks.
   packing: 'Packing',
   pausedStatus: '(Paused)',
   platform: 'Platform',
-  platformPrompt: 'Platform (ios/android/harmony):',
   platformQuestion: 'Platform(ios/android/harmony):',
-  platformRequired: 'Platform must be specified.',
   pluginDetectionError: 'error while detecting {{name}} plugin: {{error}}',
   pluginDetected: 'detected {{name}} plugin',
-  ppkPackageGenerated: 'ppk package generated and saved to: {{- output}}',
-  processingError: 'Error processing file: {{error}}',
-  processingPackage: 'Processing the package {{count}} ...',
-  processingStringPool: 'Processing the string pool ...',
   publishUsage:
     'Usage: pushy publish <ppk file> --platform ios|android|harmony',
   sourceMapNotFound: 'Source map not found: {{path}}',
@@ -165,7 +153,6 @@ This can reduce the risk of inconsistent dependencies and supply chain attacks.
   sentryReleaseCreated: 'Sentry release created for version: {{version}}',
   totalApps: 'Total {{count}} {{platform}} apps',
   totalPackages: 'Total {{count}} packages',
-  typeStrings: 'Type strings:',
   unsupportedPlatform: 'Unsupported platform `{{platform}}`',
   uploadBundlePrompt: 'Upload this bundle now?(Y/N)',
   uploadingSourcemap: 'Uploading sourcemap',
@@ -176,7 +163,6 @@ This can reduce the risk of inconsistent dependencies and supply chain attacks.
     'Usage: cresc extractApk <aab file> [--output <apk file>] [--includeAllSplits] [--splits <split names>]',
   usageParseApp: 'Usage: cresc parseApp <app file>',
   usageParseIpa: 'Usage: cresc parseIpa <ipa file>',
-  usageUnderDevelopment: 'Usage is under development now.',
   usageUploadApk: 'Usage: cresc uploadApk <apk file>',
   usageUploadAab:
     'Usage: cresc uploadAab <aab file> [--includeAllSplits] [--splits <split names>]',
@@ -254,4 +240,10 @@ This can reduce the risk of inconsistent dependencies and supply chain attacks.
     'Hermes base: bytecode differs from a plain compile; dropping the base and recompiling',
   cacheCleaned: 'Removed {{count}} cached bundle(s)',
   cacheStats: 'Bundle cache: {{- dir}} — {{files}} file(s), {{mb}} MB',
+  loginCredentialsRequired:
+    'Email and password are required. Usage: {{scriptName}} login <email> <password>',
+  bundleUnexpectedArgs:
+    'bundle takes no positional arguments, got: {{- args}}. Boolean flags take no value; switch one off with --no-<flag> (e.g. --no-sourcemap).',
+  unsafeIntermediateDir:
+    'Refusing to empty {{- dir}} as the intermediate directory: it is the project directory (or above it). Point --intermediaDir at a dedicated build directory.',
 };