feat: 审计第二轮 — Hermes 检测、按需加载命令模块、Node 18 冒烟、错误输出

- bundle-runner: iOS 不再只看 ios/Pods/hermes-engine，未 pod install 时兼看
  Podfile.lock 与 Expo 的 Podfile.properties.json；Android 在 gradle.properties
  与 build.gradle 都未提及时按 RN >= 0.71 默认 Hermes；gradle.properties 缺失
  不再打印 ENOENT 堆栈；compileHermesByteCode 的 hermesc 惰性解析，复用
  base 选择阶段已解析的路径
- bin/commands: 命令模块按命令名 require（新增 src/commands.ts），`help`
  启动加载模块 129 -> 83、约 125ms -> 108ms；`--version` 别名；`-v` 只在首参
  生效；参数解析纳入错误处理，未知命令/选项不再以未处理 rejection 崩溃；
  错误默认只打印 message，RNU_DEBUG=1 时打印堆栈
- utils/git: 提交信息由 6 个 git 子进程合并为 3 个（NUL 分隔的单条 git log）
- i18n: RNU_LANG=en|zh 覆盖品牌默认语言
- package.json: 发布包不再包含 src（exports map 已禁止子路径引用，且无
  declarationMap）；新增 `smoke` 脚本
- ci: 新增 node18-smoke job，在 engines 下限的 Node 18.17 上 require 构建产物
  的全部模块并运行 help/-v，任何 Deprecation/Experimental 警告都视为失败
- tests: commands 注册表与 cli.json 双向一致性；Hermes 检测各分支；
  resolveLanguage

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tusm6iL2itjJZDiemujAeL

Author: luoqingming

.github/workflows/test.yml

@@ -68,6 +68,31 @@ jobs:
           path: coverage
           if-no-files-found: error
 
+  node18-smoke:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install Dependency
+        run: bun install --frozen-lockfile
+
+      - name: Build package
+        run: bun run build
+
+      # Node 18 goes on PATH only after the build: typescript >= 7 ships an
+      # extensionless ESM bin/tsc that Node 18.17 cannot load.
+      - name: Set up the oldest supported Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '18.17.0'
+
+      - name: Load every built module and run the offline commands
+        run: node scripts/smoke-lib.js
+
   publish-dry-run:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10

README.md

@@ -161,6 +161,8 @@ interface CLIProvider {
 ```bash
 export PUSHY_REGISTRY=https://your-api-endpoint.com
 export NO_INTERACTIVE=true
+export RNU_LANG=en      # CLI language (default: zh for pushy, en for cresc)
+export RNU_DEBUG=1      # print stack traces for errors
 ```
 
 ## Sentry Sourcemaps

README.zh-CN.md

@@ -152,6 +152,8 @@ interface CLIProvider {
 ```bash
 export PUSHY_REGISTRY=https://your-api-endpoint.com
 export NO_INTERACTIVE=true
+export RNU_LANG=en      # 界面语言（默认：pushy 为 zh，cresc 为 en）
+export RNU_DEBUG=1      # 出错时打印完整堆栈
 ```
 
 ## Sentry Sourcemap

package.json

@@ -27,7 +27,6 @@
   },
   "files": [
     "lib",
-    "src",
     "proto",
     "cli.json"
   ],
@@ -39,6 +38,7 @@
     "lint": "bun run typecheck && biome check .",
     "lint:fix": "bun run typecheck && biome check --write .",
     "test": "bun test",
+    "smoke": "node scripts/smoke-lib.js",
     "test:coverage": "bun test --coverage --coverage-reporter=text --coverage-reporter=lcov",
     "benchmark:diff-stream": "bun scripts/benchmark-diff-stream.ts"
   },

scripts/smoke-lib.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// Loads every module of the built CLI and runs its offline commands on the
+// current Node.js. CI runs this on the oldest supported Node (see engines), so
+// a dependency or an API that needs a newer runtime fails here rather than on
+// a user's machine; the test suite itself runs under bun and cannot tell.
+
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const lib = path.resolve(__dirname, '..', 'lib');
+if (!fs.existsSync(lib)) {
+  console.error('lib/ not found: run `bun run build` first');
+  process.exit(1);
+}
+
+// these two run the CLI when required
+const entryPoints = new Set(['bin.js', 'bin-cresc.js']);
+
+function listJs(dir) {
+  const files = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...listJs(full));
+    } else if (entry.name.endsWith('.js')) {
+      files.push(full);
+    }
+  }
+  return files.sort();
+}
+
+let loaded = 0;
+for (const file of listJs(lib)) {
+  if (entryPoints.has(path.relative(lib, file))) continue;
+  require(file);
+  loaded += 1;
+}
+console.log(
+  `smoke: loaded ${loaded} modules from lib/ on node ${process.version}`,
+);
+
+function runCli(args) {
+  const result = spawnSync(
+    process.execPath,
+    [path.join(lib, 'bin.js'), ...args],
+    {
+      encoding: 'utf8',
+      env: { ...process.env, NO_INTERACTIVE: 'true', RNU_AUTO_UPDATE: '0' },
+    },
+  );
+  const command = `pushy ${args.join(' ')}`;
+  if (result.status !== 0) {
+    console.error(result.stdout);
+    console.error(result.stderr);
+    throw new Error(`${command} exited with ${result.status}`);
+  }
+  // a deprecation or experimental warning on every command is a bug (it was
+  // the punycode DEP0040 warning from node-fetch until 2.24)
+  if (/(Deprecation|Experimental)Warning/.test(result.stderr)) {
+    throw new Error(`${command} printed a runtime warning:\n${result.stderr}`);
+  }
+  return result;
+}
+
+runCli(['help']);
+runCli(['-v']);
+console.log('smoke: `help` and `-v` ran without warnings');

src/bin.ts

@@ -1,19 +1,9 @@
 #!/usr/bin/env node
 
 import { loadSession } from './api';
-import { getAppCommands } from './app';
-import { bundleCommands } from './bundle';
-import { cacheCommands } from './cache';
-import { diffCommands } from './diff';
-import { installCommands } from './install';
-import { packageCommands } from './package';
-import { symbolicateCommands } from './symbolicate';
-import { userCommands } from './user';
+import { commandNames, loadCommandHandler } from './commands';
 import { printVersionCommand } from './utils';
 import { t } from './utils/i18n';
-import { versionCommands } from './versions';
-
-type CliCommandHandler = (argv: any) => Promise<unknown> | unknown;
 
 interface CliArgv {
   command: string;
@@ -29,7 +19,7 @@ function printUsage(exitCode = 1) {
   console.log('React Native Update CLI');
   console.log('');
   console.log('Commands:');
-  for (const name of Object.keys(commandHandlers)) {
+  for (const name of commandNames) {
     console.log(`  ${name}`);
   }
 
@@ -45,22 +35,24 @@ function printUsage(exitCode = 1) {
   process.exit(exitCode);
 }
 
-const commandHandlers: Record<string, CliCommandHandler> = {
-  ...userCommands,
-  ...bundleCommands,
-  ...cacheCommands,
-  ...diffCommands,
-  ...getAppCommands(),
-  ...packageCommands,
-  ...versionCommands,
-  ...symbolicateCommands,
-  ...installCommands,
-  help: printUsage,
-};
+/**
+ * Errors reaching the top level are almost always about the user's input,
+ * project or network: print their message. The stack trace, which only helps
+ * when the CLI itself is at fault, is printed on request (RNU_DEBUG=1).
+ */
+function reportError(err: unknown) {
+  if (isTruthyEnv(process.env.RNU_DEBUG)) {
+    console.error(err instanceof Error ? err.stack : err);
+    return;
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  console.error(t('errorStackHint'));
+}
 
 async function run() {
-  const versionOnly =
-    process.argv.indexOf('-v') >= 0 || process.argv[2] === 'version';
+  const versionOnly = ['-v', '--version', 'version'].includes(
+    process.argv[2] ?? '',
+  );
   // The registry check for newer versions runs alongside the command (from a
   // 1-day cache when possible) and only ever delays `-v`/`version` itself; its
   // hint is printed once the command is done, or at exit for commands that
@@ -77,37 +69,39 @@ async function run() {
     }
   });
 
-  const argv: CliArgv = require('cli-arguments').parse(require('../cli.json'));
-  global.NO_INTERACTIVE =
-    Boolean(argv.options['no-interactive']) ||
-    isTruthyEnv(process.env.NO_INTERACTIVE);
-  global.USE_ACC_OSS =
-    Boolean(argv.options.acc) || isTruthyEnv(process.env.USE_ACC_OSS);
-
   try {
+    // inside the try: an unknown command or option is reported like any other
+    // error instead of crashing with an unhandled rejection
+    const argv: CliArgv = require('cli-arguments').parse(
+      require('../cli.json'),
+    );
+    global.NO_INTERACTIVE =
+      Boolean(argv.options['no-interactive']) ||
+      isTruthyEnv(process.env.NO_INTERACTIVE);
+    global.USE_ACC_OSS =
+      Boolean(argv.options.acc) || isTruthyEnv(process.env.USE_ACC_OSS);
+
     await loadSession();
 
-    if (argv.command === 'help') {
+    if (argv.command === 'help' || argv.command === 'list') {
       printUsage(0);
-    } else if (argv.command === 'list') {
-      printUsage(0);
-    } else if (commandHandlers[argv.command]) {
-      const handler = commandHandlers[argv.command];
-      await handler(argv);
-      // a check still in flight (cold cache) gets a short grace period; the
-      // registry request itself is unref'd, so exiting never waits on it
-      await versionCheck.settle(500);
-      versionCheck.printHints();
-      versionCheck.startAutoUpdate();
-    } else {
+    }
+    const handler = loadCommandHandler(argv.command);
+    if (!handler) {
       throw new Error(t('unknownCommand', { command: argv.command }));
     }
+    await handler(argv);
+    // a check still in flight (cold cache) gets a short grace period; the
+    // registry request itself is unref'd, so exiting never waits on it
+    await versionCheck.settle(500);
+    versionCheck.printHints();
+    versionCheck.startAutoUpdate();
   } catch (err: any) {
-    if (err.status === 401) {
+    if (err?.status === 401) {
       console.log(t('loginFirst'));
       process.exit(1);
     }
-    console.error(err.stack);
+    reportError(err);
     process.exit(1);
   }
 }