1688-cli 0.1.42 → 0.1.43

package/docs/generated/command-index.md

@@ -38,12 +38,12 @@ _Generated by `scripts/generate_agent_context.mjs`._
 | `whoami` | `src/commands/whoami.ts` | - | `--verify`<br>`--profile <name>` | Show the current logged-in account |
 | `logout` | `src/commands/logout.ts` | - | `-y, --yes`<br>`--profile <name>` | Log out and clear local session |
 | `doctor` | `src/commands/doctor.ts` | - | `--no-launch`<br>`--live`<br>`--profile <name>` | Check environment, profile, Chromium, and session |
-| `serve` | - | - | `--idle-timeout <minutes>`<br>`--no-prewarm` | Run the 1688 daemon in the foreground |
+| `serve` | - | - | `--profile <name>`<br>`--idle-timeout <minutes>`<br>`--no-prewarm` | Run the 1688 daemon in the foreground |
 | `daemon` | - | - | - | - |
-| `daemon start` | - | - | - | Start the daemon as a background process |
-| `daemon stop` | - | - | - | Stop the running daemon |
-| `daemon reload` | - | - | - | Restart the daemon (stop start) to pick up new code |
-| `daemon status` | - | - | - | Show daemon status |
+| `daemon start` | - | - | `--profile <name>` | Start the daemon as a background process |
+| `daemon stop` | - | - | `--profile <name>` | Stop the running daemon |
+| `daemon reload` | - | - | `--profile <name>` | Restart the daemon (stop start) to pick up new code |
+| `daemon status` | - | - | `--profile <name>` | Show daemon status |
 | `profile` | - | - | - | - |
 | `profile list` | `src/commands/profile.ts` | - | - | List local profiles |
 | `profile status` | `src/commands/profile.ts` | `[name]` | - | Show profile status |

package/docs/generated/json-shapes.md

@@ -84,7 +84,7 @@ This is a heuristic index of exported TypeScript interfaces that are likely to m
 | `SupplierSearchArgs` | `src/commands/supplier-search.ts` | `keywords: string[];`<br>`maxPerQuery: number;`<br>`enrichTop?: number;`<br>`filters?: SupplierFilters;`<br>`headed?: boolean;` |
 | `SupplierSearchOpts` | `src/commands/supplier-search.ts` | `keywords: string[];`<br>`max?: string;`<br>`enrich?: string;`<br>`factoryOnly?: boolean;`<br>`province?: string;`<br>`city?: string;`<br>`minYears?: string;`<br>`minRepeatRate?: string;`<br>`minResponseRate?: string;`<br>`jsonl?: boolean;`<br>`csv?: boolean;`<br>`output?: string;`<br>`profile?: string;`<br>`headed?: boolean;` |
 | `SupplierSearchResult` | `src/commands/supplier-search.ts` | `queries: string[];`<br>`source: {`<br>`kind: 'company-search';`<br>`endpoint: 'companySearchBusinessService';`<br>`offerAggregation: false;`<br>`filters: SupplierFilters;`<br>`maxPerQuery: number;`<br>`enrichTop: number;`<br>`totalBeforeFilter: number;`<br>`total: number;`<br>`enrichedCount: number;`<br>`items: SupplierSearchItem[];` |
-| `WhoamiArgs` | `src/commands/whoami.ts` | `verify?: boolean;` |
+| `WhoamiArgs` | `src/commands/whoami.ts` | `verify?: boolean;`<br>`profile?: string;` |
 | `WhoamiOpts` | `src/commands/whoami.ts` | `verify?: boolean;`<br>`profile?: string;` |
 | `WhoamiResult` | `src/commands/whoami.ts` | `loggedIn: boolean;`<br>`memberId?: string;`<br>`nick?: string \| null;`<br>`lastVerifiedAt?: string \| null;` |
 | `FakeShippedOpts` | `src/commands/workflows.ts` | `days?: string;`<br>`limit?: string;`<br>`maxPages?: string;`<br>`maxCheck?: string;`<br>`debug?: boolean;` |

package/docs/generated/test-index.md

@@ -19,7 +19,7 @@ _Generated by `scripts/generate_agent_context.mjs`._
 | `tests/navigation-guard.test.ts` | navigation-guard | live/session-sensitive |
 | `tests/output.test.ts` | output | - |
 | `tests/page-state.test.ts` | page-state | live/session-sensitive, browser/page-state |
-| `tests/paths.test.ts` | paths | - |
+| `tests/paths.test.ts` | paths | live/session-sensitive |
 | `tests/profile.test.ts` | profile | live/session-sensitive |
 | `tests/recovery.test.ts` | recovery | browser/page-state |
 | `tests/replay-fixtures.test.ts` | replay-fixtures | browser/page-state, fixture/parser |

package/docs/playbooks/update-cli-release.md

@@ -1,11 +1,61 @@
 # Playbook: Update CLI Release Behavior
 
-1. Check `package.json`, `CHANGELOG.md`, `README.md`, and update-notifier
-   behavior in `src/cli.ts`.
-2. Preserve the update protocol in `docs/SAFETY.md`: never run a global install
+Use this playbook for version bumps, npm publishes, GitHub release/tag work,
+postinstall changes, and update-notifier behavior.
+
+## Release Checklist
+
+1. Update `CHANGELOG.md` first.
+   - Keep current in-progress docs/features under `## [Unreleased]`.
+   - Before publishing, move released items into
+     `## [x.y.z] - YYYY-MM-DD`.
+   - Do not describe post-tag work as part of an already-published npm version.
+2. Check `package.json`, `README.md`, npm metadata, and update-notifier behavior
+   in `src/cli.ts`.
+3. Preserve the update protocol in `docs/SAFETY.md`: never run a global install
    command without explicit current-turn user approval.
-3. If daemon behavior changes after upgrade, document whether
+4. If daemon behavior changes after upgrade, document whether
    `1688 daemon reload` is required.
-4. Run `pnpm build`, `pnpm test`, and `pnpm agent-context`.
-5. Update docs when install, postinstall, or release packaging behavior changes.
+5. Run:
+
+   ```bash
+   pnpm agent-context
+   pnpm agent-verify
+   npm pack --dry-run
+   ```
+
+6. Verify the release gate explicitly:
+
+   ```bash
+   pnpm release-check
+   ```
+
+7. Publish only after npm auth is valid:
+
+   ```bash
+   npm whoami
+   npm publish
+   ```
+
+8. Push both branch and tag. Lightweight tags are not pushed by
+   `git push --follow-tags`, so push the release tag explicitly:
+
+   ```bash
+   git push origin main
+   git push origin vX.Y.Z
+   ```
+
+9. After publish, verify:
+
+   ```bash
+   npm view 1688-cli version dist-tags --json
+   npm view 1688-cli@X.Y.Z readmeFilename version --json
+   git ls-remote --tags origin refs/tags/vX.Y.Z
+   ```
+
+## Omission Tracking
 
+If a release step is missed, record it in
+`docs/records/release-omissions.md` with symptom, cause, fix, and prevention.
+Then update this playbook or a script so the same omission becomes harder to
+repeat.

package/docs/records/release-omissions.md

@@ -0,0 +1,34 @@
+# Release Omissions
+
+Record release misses here so the process improves instead of relying on memory.
+
+## 2026-06-08 - 0.1.42 CHANGELOG Omitted
+
+### Symptom
+
+After `1688-cli@0.1.42` was published and pushed, the GitHub file list still
+showed `CHANGELOG.md` last changed by `chore(release): 0.1.41`. The npm
+package included the old changelog because the 0.1.42 release commit only
+bumped `package.json`.
+
+### Cause
+
+The release playbook said to check `CHANGELOG.md`, but there was no executable
+gate in `agent-verify` or `prepublishOnly` to fail when the package version was
+missing from `CHANGELOG.md`.
+
+### Fix
+
+- Backfilled `CHANGELOG.md` with a `0.1.42` section for released work.
+- Added an `Unreleased` section for post-tag README/npm-metadata documentation
+  changes that should ship in the next npm version.
+- Added `pnpm release-check`, backed by `scripts/check_release.mjs`.
+- Added `release-check` to `pnpm agent-verify` and `prepublishOnly`.
+- Expanded `docs/playbooks/update-cli-release.md` with changelog, npm, tag, and
+  post-publish verification steps.
+
+### Prevention
+
+Before the next publish, move `Unreleased` items into the new version section,
+run `pnpm agent-verify`, run `npm pack --dry-run`, and push the release tag
+explicitly with `git push origin vX.Y.Z`.

package/docs/specs/index.md

@@ -0,0 +1,9 @@
+# Specs Index
+
+- [Checkout And Orders](checkout-and-orders.md)
+- [Profile Daemon](profile-daemon.md)
+- [Seller IM](seller-im.md)
+- [Sourcing Research](sourcing-research.md)
+- [Supplier Inspect](supplier-inspect.md)
+- [Supplier Search](supplier-search.md)
+- [Windows CLI Compatibility](windows-cli-compatibility.md)

package/docs/specs/profile-daemon.md

@@ -0,0 +1,114 @@
+# Spec: Profile Daemon
+
+> Status: draft
+> Product: 1688-cli daemon/session runtime
+> Scope: profile-scoped daemon processes, browser contexts, locks, runtime artifacts, and diagnostics
+
+## 1. Summary
+
+`1688-cli` supports multiple local profiles, but the warm daemon runtime is
+currently global/default-oriented. This spec changes daemon ownership to one
+daemon per profile so commands run against the daemon for their selected
+profile, different profiles can operate in parallel, and default-profile
+behavior remains compatible for users who do not pass `--profile`.
+
+## 2. Goals
+
+- Resolve every command profile to `default` when no profile is supplied.
+- Support `1688 serve --profile <name>`.
+- Support `1688 daemon start|stop|status|reload --profile <name>`.
+- Route ordinary dispatched commands such as `search --profile acc-a` to the
+  daemon for `acc-a` when that daemon is reachable.
+- Keep headed mode and explicitly daemon-disabled runs inline.
+- Use one persistent browser context per daemon, bound to that daemon profile.
+- Use profile-scoped lock, socket or named pipe, pid, version, log, and state
+  artifacts.
+- Allow different profiles to run concurrently without sharing one process lock.
+- Surface profile names in daemon, lock, and diagnostic error messages.
+- Preserve default behavior for commands that omit `--profile`.
+
+## 3. Non-goals
+
+- Do not build one daemon that multiplexes multiple profiles.
+- Do not change checkout confirmation safety or route `checkout confirm`
+  through the daemon.
+- Do not run live 1688 login, search, or browser mutation checks as automated
+  verification.
+- Do not change command result contracts except for additive diagnostic fields
+  on daemon/profile/doctor surfaces.
+- Do not migrate or delete historical global daemon artifacts automatically
+  beyond normal stale-artifact cleanup for the selected profile.
+
+## 4. Behavior contract
+
+- `defaultProfileName(profile)` resolves missing, empty, or whitespace-only
+  profile input to `default`.
+- Runtime artifact helpers accept an optional profile argument and use the
+  resolved profile:
+  - `socketPath(profile)`
+  - `pidFile(profile)`
+  - `daemonVersionFile(profile)`
+  - `daemonLogFile(profile)`
+  - `lockFile(profile)`
+  - `stateFile(profile)`
+- Windows named pipe names include both the root hash and a profile-derived
+  segment so two profiles under the same `BB1688_HOME` do not collide.
+- Non-Windows daemon sockets are profile-scoped filesystem paths under the
+  selected profile/runtime area.
+- `acquireLock(profile)` locks only the selected profile.
+- Inline sessions use `profilePath(profile)` and `acquireLock(profile)`.
+- A daemon process is bound to exactly one profile at startup.
+- `getSharedContext(profile)` creates or reuses the browser context only for
+  the daemon-bound profile and stores cookies/session in that profile's
+  persistent context directory.
+- `runOnSharedCtx` serializes operations within one daemon process only.
+- `dispatch(name, args, { profile })` attempts the selected profile daemon
+  unless headed, no-daemon, or `BB1688_NO_DAEMON=1` is set.
+- If inline fallback is needed, dispatch pauses only the selected profile
+  daemon, not daemons for other profiles.
+- `login --profile <name>` writes identity state for that profile and, unless
+  `--no-daemon` is set, attempts to start that profile daemon after login or
+  after detecting an already-logged-in profile.
+- `doctor --profile <name>` checks the selected profile's directory, lock,
+  state, daemon, and live daemon socket status.
+- `profile status <name>` reports the selected profile's profile directory,
+  profile-scoped lock, profile-scoped state, recent event, and daemon status.
+- Error messages for daemon running, start timeout, lock busy, stale daemon, and
+  daemon pause identify the affected profile.
+
+## 5. Verification
+
+- Focused unit coverage for profile-scoped paths, including Windows pipe names.
+- Focused unit coverage for profile status using profile-scoped locks/states.
+- Focused unit coverage for doctor platform helpers and profile-aware daemon
+  checks where deterministic.
+- Typecheck with `pnpm typecheck`.
+- Deterministic tests with `pnpm test:unit`.
+- Regenerate generated docs with `pnpm agent-context` after command/source/test
+  changes.
+- Run `pnpm agent-verify` as the final local gate.
+
+## 6. Acceptance criteria
+
+- `1688 daemon start --profile acc-a` starts only the `acc-a` daemon.
+- `1688 daemon start --profile acc-b` can coexist with `acc-a`.
+- `1688 daemon status --profile acc-a` and `--profile acc-b` inspect different
+  artifacts and sockets.
+- `1688 serve --profile acc-a` binds a daemon to `acc-a`.
+- `1688 search "..." --profile acc-a` tries the `acc-a` daemon first.
+- `1688 search "..." --profile acc-b` tries the `acc-b` daemon first.
+- A lock held by `acc-a` does not make `acc-b` report `LOCK_BUSY`.
+- A daemon pause or risk-control state in one profile is represented in that
+  profile daemon status and does not stop another profile daemon.
+- Commands without `--profile` continue to use the `default` profile.
+
+## 7. Assumptions and open questions
+
+- [ASSUMED] Profile names used by real workflows are simple names such as
+  `default`, `acc-a`, or `work`, without path separators.
+- [ASSUMED] Moving default daemon artifacts behind profile-aware helpers is
+  compatible because all public commands use those helpers rather than fixed
+  artifact paths.
+- [ASSUMED] Historical global `state.json` does not need an automated migration
+  for this change; a profile-specific state file is authoritative once this
+  version runs.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "1688-cli",
-  "version": "0.1.42",
-  "description": "1688.com CLI for humans, Codex, and Claude Code. Sourcing (search / image-search / offer / inquire) and orders (list / detail / logistics / seller chat).",
+  "version": "0.1.43",
+  "description": "1688.com CLI for humans, Codex, and Claude Code. Product search, supplier scraper/research, inquiry, cart, orders, logistics, and seller chat.",
   "license": "MIT",
   "author": "nobodyjack",
   "homepage": "https://github.com/superjack2050/1688-cli#readme",
@@ -22,6 +22,11 @@
     "claude-code",
     "codex",
     "automation",
+    "scraper",
+    "supplier-scraper",
+    "supplier-search",
+    "product-scraper",
+    "sourcing",
     "ecommerce",
     "procurement",
     "playwright",
@@ -39,6 +44,7 @@
     "scripts/fix_bin_mode.mjs",
     "scripts/generate_agent_context.mjs",
     "scripts/check_agent_map.mjs",
+    "scripts/check_release.mjs",
     "docs",
     "AGENTS.md",
     "ARCHITECTURE.md",
@@ -59,8 +65,9 @@
     "agent-context": "node scripts/generate_agent_context.mjs",
     "docs-check": "node scripts/generate_agent_context.mjs --check",
     "agent-map-check": "node scripts/check_agent_map.mjs",
-    "agent-verify": "pnpm typecheck && pnpm test:unit && pnpm docs-check && pnpm agent-map-check",
-    "prepublishOnly": "pnpm build",
+    "release-check": "node scripts/check_release.mjs",
+    "agent-verify": "pnpm typecheck && pnpm test:unit && pnpm docs-check && pnpm agent-map-check && pnpm release-check",
+    "prepublishOnly": "pnpm release-check && pnpm build",
     "postinstall": "node scripts/postinstall.mjs"
   },
   "dependencies": {

package/scripts/check_agent_map.mjs

@@ -38,6 +38,7 @@ const requiredFiles = [
   'docs/playbooks/debug-risk-control.md',
   'docs/playbooks/add-mtop-capture.md',
   'docs/playbooks/update-cli-release.md',
+  'docs/records/release-omissions.md',
   'docs/generated/command-index.md',
   'docs/generated/module-map.md',
   'docs/generated/test-index.md',
@@ -63,7 +64,7 @@ if (agents.split('\n').length > 220)
   failures.push('AGENTS.md should stay short (<= 220 lines).');
 
 const pkg = JSON.parse(await read('package.json'));
-for (const scriptName of ['agent-context', 'docs-check', 'agent-map-check', 'agent-verify']) {
+for (const scriptName of ['agent-context', 'docs-check', 'agent-map-check', 'release-check', 'agent-verify']) {
   if (!pkg.scripts?.[scriptName]) failures.push(`package.json missing script: ${scriptName}`);
 }
 

package/scripts/check_release.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+async function readJson(relPath) {
+  return JSON.parse(await fs.readFile(path.join(root, relPath), 'utf8'));
+}
+
+async function read(relPath) {
+  return fs.readFile(path.join(root, relPath), 'utf8');
+}
+
+const pkg = await readJson('package.json');
+const changelog = await read('CHANGELOG.md');
+
+const version = pkg.version;
+const releaseHeading = new RegExp(`^## \\[${version.replaceAll('.', '\\.')}\\] - \\d{4}-\\d{2}-\\d{2}$`, 'm');
+const failures = [];
+
+if (!releaseHeading.test(changelog)) {
+  failures.push(`CHANGELOG.md missing release heading for package version ${version}.`);
+}
+
+if (!pkg.files?.includes('CHANGELOG.md')) {
+  failures.push('package.json files must include CHANGELOG.md.');
+}
+
+if (!pkg.scripts?.['release-check']) {
+  failures.push('package.json missing script: release-check.');
+}
+
+if (failures.length) {
+  console.error(failures.join('\n'));
+  process.exit(1);
+}
+
+console.log(`Release metadata looks good for ${pkg.name}@${version}.`);