From 4d7bcbe9482883b655181ae63eebe3cef8a19732 Mon Sep 17 00:00:00 2001
From: john <cynell@139.com>
Date: Fri, 24 Jul 2026 09:53:06 +0800
Subject: [PATCH] fix: harden admin production source gates

---
 .adm-api.pid            |  1 -
 .adm-preview.pid        |  1 -
 .gitignore              |  1 +
 scripts/release-prod.sh | 33 ++++++++++++++++++++++++++++++---
 4 files changed, 31 insertions(+), 5 deletions(-)
 delete mode 100644 .adm-api.pid
 delete mode 100644 .adm-preview.pid

diff --git a/.adm-api.pid b/.adm-api.pid
deleted file mode 100644
index e7579bb..0000000
--- a/.adm-api.pid
+++ /dev/null
@@ -1 +0,0 @@
-26747
diff --git a/.adm-preview.pid b/.adm-preview.pid
deleted file mode 100644
index 1b2a2f9..0000000
--- a/.adm-preview.pid
+++ /dev/null
@@ -1 +0,0 @@
-25645
diff --git a/.gitignore b/.gitignore
index 5608d60..d8fda2c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,4 +8,5 @@ dist-ssr/
 memind-lib/
 .vite/
 *.log
+*.pid
 logs/
diff --git a/scripts/release-prod.sh b/scripts/release-prod.sh
index ca0298e..0db1fe8 100755
--- a/scripts/release-prod.sh
+++ b/scripts/release-prod.sh
@@ -88,12 +88,24 @@ need_cmd shasum
 need_cmd node
 
 if [[ -x "${ROOT}/scripts/check-release-ready.sh" ]]; then
-  bash "${ROOT}/scripts/check-release-ready.sh"
+  ALLOW_MAIN_RELEASE=1 bash "${ROOT}/scripts/check-release-ready.sh"
 else
   echo "缺少发布前闸门: ${ROOT}/scripts/check-release-ready.sh" >&2
   exit 1
 fi
 
+ROOT_GIT_BRANCH="$(git -C "${ROOT}" branch --show-current)"
+ROOT_GIT_HEAD="$(git -C "${ROOT}" rev-parse HEAD)"
+ROOT_ORIGIN_HEAD="$(git -C "${ROOT}" rev-parse origin/main)"
+[[ "${ROOT_GIT_BRANCH}" == "main" ]] || {
+  echo "memindadm 生产发布必须从 main 执行，当前分支: ${ROOT_GIT_BRANCH:-detached}" >&2
+  exit 1
+}
+[[ "${ROOT_GIT_HEAD}" == "${ROOT_ORIGIN_HEAD}" ]] || {
+  echo "memindadm main 必须与 origin/main 完全一致" >&2
+  exit 1
+}
+
 [[ -f "${IGNORE_FILE}" ]] || {
   echo "缺少忽略文件: ${IGNORE_FILE}" >&2
   exit 1
@@ -127,8 +139,23 @@ say "验证共享模块图像运行依赖"
   exit 1
 }
 
-MEMIND_GIT_HEAD="$(git -C "${MEMIND_SRC}" rev-parse HEAD 2>/dev/null || echo unknown)"
-MEMIND_GIT_BRANCH="$(git -C "${MEMIND_SRC}" branch --show-current 2>/dev/null || echo detached)"
+git -C "${MEMIND_SRC}" fetch origin main --quiet
+MEMIND_GIT_HEAD="$(git -C "${MEMIND_SRC}" rev-parse HEAD)"
+MEMIND_ORIGIN_HEAD="$(git -C "${MEMIND_SRC}" rev-parse origin/main)"
+MEMIND_GIT_BRANCH="$(git -C "${MEMIND_SRC}" branch --show-current)"
+[[ "${MEMIND_GIT_BRANCH}" == "main" ]] || {
+  echo "Memind 共享模块必须从 main 打包，当前分支: ${MEMIND_GIT_BRANCH:-detached}" >&2
+  exit 1
+}
+[[ "${MEMIND_GIT_HEAD}" == "${MEMIND_ORIGIN_HEAD}" ]] || {
+  echo "Memind main 必须与 origin/main 完全一致" >&2
+  exit 1
+}
+[[ -z "$(git -C "${MEMIND_SRC}" status --porcelain=v1 --untracked-files=all)" ]] || {
+  echo "Memind 共享模块工作区必须干净" >&2
+  git -C "${MEMIND_SRC}" status --short --untracked-files=all >&2
+  exit 1
+}
 
 say "打包 Memind 共享模块到 memind-lib"
 rm -rf "${MEMIND_LIB}"