Refactor Hermes detection and improve CLI safety checks (#81)

Refactor Hermes detection across Android, iOS, Expo, and CI environments; harden intermediate-directory cleanup against protected paths and symlink redirection; add proxy-aware networking, lazy command loading, non-interactive guards, stricter app selection, improved diagnostics, Provider API fixes, and Node 18 smoke validation.

Review follow-ups include Podfile comment handling, appKey validation scoped to selectApp, credential-safe workflow permissions, URL redaction, preserved network error causes, upload timeout retries, cwd-aware dependency caching, and comprehensive regression coverage.

Author: sunnylqm

.github/workflows/test.yml

@@ -12,13 +12,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@v2
 
@@ -43,6 +48,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@v2
 
@@ -68,6 +75,33 @@ jobs:
           path: coverage
           if-no-files-found: error
 
+  node18-smoke:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install Dependency
+        run: bun install --frozen-lockfile
+
+      - name: Build package
+        run: bun run build
+
+      # Node 18 goes on PATH only after the build: typescript >= 7 ships an
+      # extensionless ESM bin/tsc that Node 18.17 cannot load.
+      - name: Set up the oldest supported Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '18.17.0'
+
+      - name: Load every built module and run the offline commands
+        run: node scripts/smoke-lib.js
+
   publish-dry-run:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
@@ -76,6 +110,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@v2
 

README.md

@@ -85,7 +85,7 @@ const publishResult = await provider.publish({
 - `hdiffFromApp`: Generate hdiff from APP files
 - `hdiffFromIpa`: Generate hdiff from IPA files
 
-Hermes projects: `bundle` always runs hermesc with `-output-source-map`, so the debug info section is stripped from the bytecode (15–40% smaller, same as React Native's own release builds). The Hermes sourcemap stays in the intermediate directory (`.pushy/intermedia/<platform>/<bundle>.map`, never packed into the ppk) and is composed with the packager map — `--sourcemap` is on by default since 2.23 (`--sourcemap false` opts out). When `bundle` publishes, that final map is uploaded and archived with the version (`sourceMapKey`), so `pushy symbolicate` can map crash stacks — including Hermes `address at` frames — back to source later. `pushy publish <ppk> --sourcemap <file.map>` archives a map for a ppk built elsewhere; publishing without a map prints a warning.
+Hermes projects: `bundle` always runs hermesc with `-output-source-map`, so the debug info section is stripped from the bytecode (15–40% smaller, same as React Native's own release builds). The Hermes sourcemap stays in the intermediate directory (`.pushy/intermedia/<platform>/<bundle>.map`, never packed into the ppk) and is composed with the packager map — `--sourcemap` is on by default since 2.23 (`--no-sourcemap` opts out). When `bundle` publishes, that final map is uploaded and archived with the version (`sourceMapKey`), so `pushy symbolicate` can map crash stacks — including Hermes `address at` frames — back to source later. `pushy publish <ppk> --sourcemap <file.map>` archives a map for a ppk built elsewhere; publishing without a map prints a warning.
 
 Hermes delta mode (`-base-bytecode`): by default (`--hermesBase auto`) `bundle` compiles against the previous HBC of the same app, which keeps Hermes string IDs stable and makes hot-update patches 5–30× smaller. The base comes from the server (`GET /app/:id/hermesBase`), verified by sha256 and kept in a local cache (`.pushy/cache/<sha256>`, 500 MB / 20 files, `PUSHY_CACHE_DIR` / `--cacheMaxMb` to tune, `pushy cache [clean]` to inspect or clear). `--hermesBase none` disables it; `--hermesBase <file.hbc|.ppk|.apk|.ipa>` uses a local artifact (for example the store build). `--verifyHermesBase` (default on) additionally compiles without the base (concurrently with the base compile) and compares both disassemblies; on any mismatch or failure the CLI silently falls back to the plain compile, so the feature can never block a release. Only hermesc builds that include the upstream delta-mode fix are used (classic `react-native/sdks/hermesc`, or `hermes-compiler` ≥ 250829098). If a base compile fails, the full hermesc output is written to `hermes-base-error.log` next to the intermediate directory. `--resetCache false` skips Metro's `--reset-cache` and reuses its transform cache, which makes repeated bundles much faster.
 
@@ -131,20 +131,23 @@ Hermes delta mode (`-base-bytecode`): by default (`--hermesBase auto`) `bundle`
 interface CLIProvider {
   bundle(options: BundleOptions): Promise<CommandResult>;
   publish(options: PublishOptions): Promise<CommandResult>;
+  symbolicate(options: SymbolicateOptions): Promise<CommandResult>;
   upload(options: UploadOptions): Promise<CommandResult>;
 
+  createApp(name: string, platform: Platform): Promise<CommandResult>;
+  listApps(platform?: Platform): Promise<CommandResult>;
   getSelectedApp(
     platform?: Platform,
+    config?: string,
   ): Promise<{ appId: string; platform: Platform }>;
-  listApps(platform?: Platform): Promise<CommandResult>;
-  createApp(name: string, platform: Platform): Promise<CommandResult>;
 
   listVersions(appId: string): Promise<CommandResult>;
   updateVersion(
     appId: string,
     versionId: string,
-    updates: Partial<Version>,
+    updates: UpdateVersionOptions,
   ): Promise<CommandResult>;
+  listPackages(appId: string): Promise<CommandResult>;
 
   getPlatform(platform?: Platform): Promise<Platform>;
   loadSession(): Promise<Session>;
@@ -158,8 +161,12 @@ interface CLIProvider {
 ```bash
 export PUSHY_REGISTRY=https://your-api-endpoint.com
 export NO_INTERACTIVE=true
+export RNU_LANG=en      # CLI language (default: zh for pushy, en for cresc)
+export RNU_DEBUG=1      # print stack traces for errors
 ```
 
+`HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` (upper or lower case) are honored by every request: the API, package and bundle uploads, source map and Hermes base downloads, and the registry version check.
+
 ## Sentry Sourcemaps
 
 When `ios/sentry.properties` or `android/sentry.properties` exists, `bundle` uploads sourcemaps for OTA packages. The default matching path is Sentry Debug IDs; the CLI no longer infers release/dist from the native package.

README.zh-CN.md

@@ -76,7 +76,7 @@ const publishResult = await provider.publish({
 - `hdiffFromApp`: 基于 APP 文件生成 hdiff
 - `hdiffFromIpa`: 基于 IPA 文件生成 hdiff
 
-Hermes 工程：`bundle` 调用 hermesc 时始终带 `-output-source-map`，因此字节码不含 debug info 段（小 15%～40%，与 React Native 自身 release 构建一致）。Hermes sourcemap 保留在中间目录（`.pushy/intermedia/<platform>/<bundle>.map`，不会打进 ppk），并与 packager map 合成——自 2.23 起 `--sourcemap` 默认开启（`--sourcemap false` 关闭）。`bundle` 发布时会把这份最终 map 上传并随版本归档（`sourceMapKey`），之后用 `pushy symbolicate` 即可把崩溃堆栈（含 Hermes 的 `address at` 帧）还原到源码。别处打好的 ppk 可用 `pushy publish <ppk> --sourcemap <file.map>` 归档；不带 map 发布会打印警告。
+Hermes 工程：`bundle` 调用 hermesc 时始终带 `-output-source-map`，因此字节码不含 debug info 段（小 15%～40%，与 React Native 自身 release 构建一致）。Hermes sourcemap 保留在中间目录（`.pushy/intermedia/<platform>/<bundle>.map`，不会打进 ppk），并与 packager map 合成——自 2.23 起 `--sourcemap` 默认开启（`--no-sourcemap` 关闭）。`bundle` 发布时会把这份最终 map 上传并随版本归档（`sourceMapKey`），之后用 `pushy symbolicate` 即可把崩溃堆栈（含 Hermes 的 `address at` 帧）还原到源码。别处打好的 ppk 可用 `pushy publish <ppk> --sourcemap <file.map>` 归档；不带 map 发布会打印警告。
 
 Hermes delta 模式（`-base-bytecode`）：默认 `--hermesBase auto`，`bundle` 会以同一应用上一版的 HBC 为 base 编译，让 Hermes 字符串 ID 跨版本稳定，热更 patch 可缩小 5～30 倍。base 由服务端（`GET /app/:id/hermesBase`）给出、按 sha256 校验并存入本地缓存（`.pushy/cache/<sha256>`，默认 500 MB / 20 个，可用 `PUSHY_CACHE_DIR` / `--cacheMaxMb` 调整，`pushy cache [clean]` 查看或清空）。`--hermesBase none` 关闭；`--hermesBase <file.hbc|.ppk|.apk|.ipa>` 指定本地文件（比如商店包）作 base。`--verifyHermesBase`（默认开）会并行再做一次普通编译并比对两份反汇编；任何不一致或失败都静默回退到普通编译，不会阻塞发版。只有包含上游 delta 模式修复的 hermesc 才会启用（经典 `react-native/sdks/hermesc`，或 `hermes-compiler` ≥ 250829098）。base 编译失败时，完整的 hermesc 输出会写到中间目录旁边的 `hermes-base-error.log`。`--resetCache false` 可跳过 Metro 的 `--reset-cache`，复用其转换缓存，重复打包会快很多。
 
@@ -122,20 +122,23 @@ Hermes delta 模式（`-base-bytecode`）：默认 `--hermesBase auto`，`bundle
 interface CLIProvider {
   bundle(options: BundleOptions): Promise<CommandResult>;
   publish(options: PublishOptions): Promise<CommandResult>;
+  symbolicate(options: SymbolicateOptions): Promise<CommandResult>;
   upload(options: UploadOptions): Promise<CommandResult>;
 
+  createApp(name: string, platform: Platform): Promise<CommandResult>;
+  listApps(platform?: Platform): Promise<CommandResult>;
   getSelectedApp(
     platform?: Platform,
+    config?: string,
   ): Promise<{ appId: string; platform: Platform }>;
-  listApps(platform?: Platform): Promise<CommandResult>;
-  createApp(name: string, platform: Platform): Promise<CommandResult>;
 
   listVersions(appId: string): Promise<CommandResult>;
   updateVersion(
     appId: string,
     versionId: string,
-    updates: Partial<Version>,
+    updates: UpdateVersionOptions,
   ): Promise<CommandResult>;
+  listPackages(appId: string): Promise<CommandResult>;
 
   getPlatform(platform?: Platform): Promise<Platform>;
   loadSession(): Promise<Session>;
@@ -149,8 +152,12 @@ interface CLIProvider {
 ```bash
 export PUSHY_REGISTRY=https://your-api-endpoint.com
 export NO_INTERACTIVE=true
+export RNU_LANG=en      # 界面语言（默认：pushy 为 zh，cresc 为 en）
+export RNU_DEBUG=1      # 出错时打印完整堆栈
 ```
 
+所有请求都遵循 `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`（大小写均可）：API 调用、原生包与热更包上传、source map 与 Hermes base 下载、registry 版本检查。
+
 ## Sentry Sourcemap
 
 当项目存在 `ios/sentry.properties` 或 `android/sentry.properties` 时，`bundle` 会为 OTA 包上传 sourcemap。默认使用 Sentry Debug ID 匹配，不再根据原生包推导 release/dist。

biome.json

@@ -5,7 +5,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "suspicious": {
         "noExplicitAny": "off",
         "noAssignInExpressions": "off",

bun.lock

@@ -23,7 +23,13 @@
         }
       }
     },
-    "deleteApp": {},
+    "deleteApp": {
+      "options": {
+        "platform": {
+          "hasValue": true
+        }
+      }
+    },
     "selectApp": {
       "options": {
         "platform": {

cli.json

@@ -27,7 +27,6 @@
   },
   "files": [
     "lib",
-    "src",
     "proto",
     "cli.json"
   ],
@@ -39,6 +38,7 @@
     "lint": "bun run typecheck && biome check .",
     "lint:fix": "bun run typecheck && biome check --write .",
     "test": "bun test",
+    "smoke": "node scripts/smoke-lib.js",
     "test:coverage": "bun test --coverage --coverage-reporter=text --coverage-reporter=lcov",
     "benchmark:diff-stream": "bun scripts/benchmark-diff-stream.ts"
   },
@@ -71,6 +71,7 @@
     "fs-extra": "^11.4.0",
     "global-dirs": "^4.0.0",
     "gradle-to-js": "^2.0.1",
+    "https-proxy-agent": "^7.0.6",
     "i18next": "^26.4.0",
     "node-fetch": "^2.6.1",
     "plist": "^5.0.0",
@@ -81,6 +82,7 @@
     "registry-auth-token": "^5.1.1",
     "source-map": "0.6.1",
     "tty-table": "5.0",
+    "undici": "^6.28.0",
     "yauzl": "^3.4.0",
     "yazl": "3.3.1"
   },