From 0620fb56011ba76f1cc9c9e99ab14cda80409e15 Mon Sep 17 00:00:00 2001
From: uncle6me-web <uncle6.me@gmail.com>
Date: Sat, 6 Jun 2026 17:33:14 +0800
Subject: [PATCH] =?UTF-8?q?chore(release):=20local-deploy.sh=20CLI=20publi?=
 =?UTF-8?q?sh=20=E5=84=AA=E5=85=88=E7=94=A8=20.env=20NPM=5FAPI=5FTOKEN?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

互動 npm login 常因 publish 安全政策 403；改優先讀 .env 的 NPM_API_TOKEN
（authToken 方式）publish，無 token 才退回 npm whoami。token 不入 log。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/local-deploy.sh | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/scripts/local-deploy.sh b/scripts/local-deploy.sh
index fb249db..9a2d615 100644
--- a/scripts/local-deploy.sh
+++ b/scripts/local-deploy.sh
@@ -278,18 +278,31 @@ if [[ "${DRY_RUN:-false}" != "true" ]]; then
       echo "  · 已 bump → $NEW_V，並記錄進 $CHANGELOG（記得 commit 這兩個檔）"
     fi
 
-    if ! npm whoami >/dev/null 2>&1; then
-      echo "  ⚠ 未 npm login（npm whoami 失敗），跳過 publish。手動：cd cli && npm publish"
+    # 優先用 .env 的 NPM_API_TOKEN（authToken）——互動 npm login 常因 publish 政策 403。
+    # 無 token 才退回 npm whoami（互動登入）。token 不入 log。
+    NPM_TOK=""
+    if [[ -f .env ]]; then
+      NPM_TOK=$(grep '^NPM_API_TOKEN=' .env 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"'"'"' \r\n')
+    fi
+    PUB_RC=""
+    if [[ -n "$NPM_TOK" ]]; then
+      PUB_RC=$(mktemp)
+      printf '//registry.npmjs.org/:_authToken=%s\n' "$NPM_TOK" > "$PUB_RC"
+    fi
+    if [[ -z "$NPM_TOK" ]] && ! npm whoami >/dev/null 2>&1; then
+      echo "  ⚠ 無 .env NPM_API_TOKEN 且未 npm login，跳過 publish。手動：cd cli && npm publish"
       FAILED+=("cli:npm-publish(未登入)")
     else
       echo "  📦 publish arcrun $REMOTE_V → $LOCAL_V ..."
-      if (cd cli && npm run build >/dev/null 2>&1 && npm publish --access public 2>&1 | tail -3); then
+      if (cd cli && npm run build >/dev/null 2>&1 && \
+          NPM_CONFIG_USERCONFIG="${PUB_RC:-$HOME/.npmrc}" npm publish --access public 2>&1 | tail -3); then
         echo "  ✅ npm publish 完成（arcrun@$LOCAL_V）"
       else
         echo "  ❌ npm publish 失敗"
         FAILED+=("cli:npm-publish")
       fi
     fi
+    [[ -n "$PUB_RC" ]] && rm -f "$PUB_RC"
   fi
 fi