@aswless_854771076/ai_short_studio_cli 0.1.0-beta.0

package/dist/skill/skill-manager.js

@@ -0,0 +1,100 @@
+import { createHash } from 'node:crypto';
+import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const BUNDLED_SKILL = fileURLToPath(new URL('../../skills/using-vvicat-cli', import.meta.url));
+const PACKAGE_JSON = fileURLToPath(new URL('../../package.json', import.meta.url));
+const MANIFEST = '.vvicat-skill.json';
+export function bundledSkillPath() {
+    return BUNDLED_SKILL;
+}
+export function defaultSkillTarget(target) {
+    return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills', 'using-vvicat-cli');
+}
+export async function skillStatus(target) {
+    const packageVersion = await readPackageVersion();
+    const bundledChecksum = await directoryChecksum(BUNDLED_SKILL);
+    const installed = await exists(target);
+    const manifest = installed ? await readManifest(target) : null;
+    const installedChecksum = installed ? await directoryChecksum(target) : null;
+    return {
+        target,
+        installed,
+        managed: Boolean(manifest),
+        current: Boolean(manifest && manifest.packageVersion === packageVersion && installedChecksum === bundledChecksum),
+        packageVersion,
+        installedVersion: manifest?.packageVersion ?? null,
+        modified: Boolean(manifest && installedChecksum !== manifest.checksum),
+    };
+}
+export async function installSkill(input) {
+    const current = await skillStatus(input.target);
+    if (current.installed && !input.force) {
+        if (!current.managed)
+            throw new Error('目标目录不是 CLI 管理的 Skill；使用 --force 才能替换');
+        if (current.modified)
+            throw new Error('已安装 Skill 已被修改；使用 --force 才能替换');
+    }
+    const checksum = await directoryChecksum(BUNDLED_SKILL);
+    const packageVersion = await readPackageVersion();
+    const temporary = `${input.target}.tmp-${process.pid}`;
+    const backup = `${input.target}.backup-${process.pid}`;
+    await mkdir(dirname(input.target), { recursive: true });
+    await rm(temporary, { recursive: true, force: true });
+    await cp(BUNDLED_SKILL, temporary, { recursive: true });
+    await writeFile(join(temporary, MANIFEST), `${JSON.stringify({ packageVersion, checksum }, null, 2)}\n`, 'utf8');
+    const hadTarget = await exists(input.target);
+    try {
+        if (hadTarget)
+            await rename(input.target, backup);
+        await rename(temporary, input.target);
+        if (hadTarget)
+            await rm(backup, { recursive: true, force: true });
+    }
+    catch (error) {
+        await rm(temporary, { recursive: true, force: true });
+        if (hadTarget && await exists(backup) && !await exists(input.target))
+            await rename(backup, input.target);
+        throw error;
+    }
+    return skillStatus(input.target);
+}
+async function directoryChecksum(root) {
+    const files = await filesBelow(root);
+    const hash = createHash('sha256');
+    for (const file of files.filter((item) => relative(root, item) !== MANIFEST).sort()) {
+        hash.update(relative(root, file));
+        hash.update(await readFile(file));
+    }
+    return hash.digest('hex');
+}
+async function filesBelow(root) {
+    const entries = await readdir(root, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory())
+            files.push(...await filesBelow(path));
+        else if (entry.isFile())
+            files.push(path);
+    }
+    return files;
+}
+async function readManifest(root) {
+    try {
+        const value = JSON.parse(await readFile(join(root, MANIFEST), 'utf8'));
+        return typeof value.packageVersion === 'string' && typeof value.checksum === 'string'
+            ? { packageVersion: value.packageVersion, checksum: value.checksum }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readPackageVersion() {
+    return JSON.parse(await readFile(PACKAGE_JSON, 'utf8')).version;
+}
+async function exists(path) {
+    return stat(path).then(() => true, () => false);
+}

package/dist/terminal/prompt.d.ts

@@ -0,0 +1,2 @@
+export declare function promptLine(label: string): Promise<string>;
+export declare function promptPassword(label: string): Promise<string>;

package/dist/terminal/prompt.js

@@ -0,0 +1,49 @@
+import { createInterface } from 'node:readline/promises';
+export async function promptLine(label) {
+    const terminal = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const value = (await terminal.question(label)).trim();
+        if (!value)
+            throw new Error('输入不能为空');
+        return value;
+    }
+    finally {
+        terminal.close();
+    }
+}
+export async function promptPassword(label) {
+    if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
+        throw new Error('非交互终端请使用 --password-stdin');
+    }
+    process.stderr.write(label);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    return new Promise((resolve, reject) => {
+        let value = '';
+        const finish = (error) => {
+            process.stdin.off('data', onData);
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stderr.write('\n');
+            if (error)
+                reject(error);
+            else if (!value)
+                reject(new Error('密码不能为空'));
+            else
+                resolve(value);
+        };
+        const onData = (chunk) => {
+            const text = chunk.toString('utf8');
+            if (text === '\u0003')
+                return finish(new Error('已取消'));
+            if (text === '\r' || text === '\n')
+                return finish();
+            if (text === '\u007f') {
+                value = value.slice(0, -1);
+                return;
+            }
+            value += text;
+        };
+        process.stdin.on('data', onData);
+    });
+}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@aswless_854771076/ai_short_studio_cli",
+  "version": "0.1.0-beta.0",
+  "description": "VVICAT 无限画布项目命令行工具",
+  "license": "MIT",
+  "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/854771076/waoowaoo.git",
+    "directory": "packages/ai_short_studio_cli"
+  },
+  "homepage": "https://github.com/854771076/waoowaoo#readme",
+  "bugs": "https://github.com/854771076/waoowaoo/issues",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "vvicat": "bin/run.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "skills",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "node scripts/clean.mjs && tsc -p tsconfig.json",
+    "prepack": "npm run build",
+    "release:dry-run": "node scripts/publish.mjs --dry-run",
+    "release:test": "node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta",
+    "release": "node scripts/publish.mjs --tag latest",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.3.0",
+    "@oclif/core": "^4.12.0",
+    "@supabase/supabase-js": "^2.110.7"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.43",
+    "typescript": "^5.9.3",
+    "vitest": "^2.1.9"
+  },
+  "oclif": {
+    "bin": "vvicat",
+    "dirname": "vvicat",
+    "commands": "./dist/commands",
+    "topicSeparator": " "
+  }
+}

package/skills/using-vvicat-cli/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: using-vvicat-cli
+description: Use when an agent needs to inspect or operate VVICAT infinite-canvas projects, nodes, edges, assets, tasks, or model configuration through the vvicat CLI.
+---
+
+# 使用 VVICAT CLI
+
+## 核心原则
+
+把 `vvicat` 当作机器可读的远程控制接口。先读取服务端节点目录和实时画布，再构造写操作；不要猜测节点类型、端口或数据结构。
+
+## 工作流
+
+1. 运行 `vvicat auth status --json`。未登录时优先运行 `vvicat auth login --google`；非交互环境才通过 stdin 传密码。
+   若 Skill 来自 CLI 安装，先运行 `vvicat skill status --json`；`current` 为 false 时提示用户运行 `vvicat skill update`。
+2. 运行 `vvicat project list --json`，确认目标是 `INFINITE_CANVAS`。创建测试项目时使用唯一前缀，并记录项目 ID。
+3. 操作节点前运行 `vvicat canvas node types --json`。严格按返回的 `inputSchema`、`outputSchema`、`configSchema` 和 `defaultConfig` 构造数据。
+4. 写入前运行 `vvicat canvas get --project <id> --json` 获取当前结构；优先使用专用 node/edge 命令，批量变更才用 `canvas apply`。
+5. 执行节点后读取返回的任务 ID，并用 `vvicat task wait <taskId> --json` 等待终态。不要使用固定时长 sleep。
+6. 下载前读取资产及所选版本，再使用 `canvas asset download` 写入明确目录。
+7. 对临时项目始终在结束路径中执行 `vvicat project delete <id> --yes`，包括命令失败时。
+
+详细命令按需读取 [references/commands.md](references/commands.md)，或运行 `vvicat <topic> --help`。
+
+## 安全边界
+
+- 不把密码、access token、refresh token 或 API Key 放入参数、日志、Skill 或仓库。
+- 密码登录使用 `printf`/管道以外的安全 stdin 来源；自动化环境使用秘密管理器注入 stdin。
+- `config get` 只应返回 `hasApiKey`，不得依赖或要求服务端回显密钥。
+- 删除用户既有项目、覆盖完整画布或修改模型配置前，先明确目标和影响；没有授权就停在读取或生成变更计划。
+- 对版本冲突重新读取画布后重算变更，不盲目重试旧的 `expectedVersion`。
+
+## 示例
+
+```bash
+vvicat canvas node types --json
+vvicat project create --name "agent-draft-20260722" --json
+vvicat canvas node add text --project "$PROJECT_ID" --config ./node.json --json
+vvicat canvas node list --project "$PROJECT_ID" --json
+```
+
+从 JSON 输出中取得真实 ID；示例中的环境变量仅表示调用方已安全解析并保存结果。
+
+## 常见错误
+
+- 节点类型写死：先读 `canvas node types`，服务端目录才是事实来源。
+- 只检查任务创建响应：必须 `task wait` 并检查终态和错误字段。
+- 下载列表中的任意 URL：先确认资产的 selected version，再下载。
+- 测试创建资源但未清理：用调用方的 `finally`/trap 删除唯一前缀项目。

package/skills/using-vvicat-cli/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "使用 VVICAT CLI"
+  short_description: "通过命令行安全操作 VVICAT 无限画布项目与产物"
+  default_prompt: "使用 $using-vvicat-cli 安全地完成 VVICAT 无限画布项目、节点、任务、产物或模型配置操作。"

package/skills/using-vvicat-cli/references/commands.md

@@ -0,0 +1,90 @@
+# 命令参考
+
+所有命令支持 `--base-url`、`--profile`、`--locale zh|en` 和 `--json`。默认档案保存服务地址与默认项目；refresh token 仅保存在系统钥匙串。
+
+## Skill 管理
+
+```bash
+vvicat skill path --json
+vvicat skill install --target codex --json
+vvicat skill status --target codex --json
+vvicat skill update --target codex --json
+```
+
+`--target agents` 安装到 `~/.agents/skills`，`--directory` 可指定其他目录。更新不会覆盖用户修改，除非显式传入 `--force`。
+
+## 认证
+
+```bash
+vvicat auth login --google
+vvicat auth login --email user@example.com --password-stdin
+vvicat auth status --json
+vvicat auth logout
+```
+
+Google 登录会打开浏览器并通过本机环回地址完成 PKCE 回调。
+
+## 项目
+
+```bash
+vvicat project list --json
+vvicat project get <projectId> --json
+vvicat project create --name <name> [--description <text>] --json
+vvicat project update <projectId> [--name <name>] [--description <text>] --json
+vvicat project delete <projectId> --yes --json
+```
+
+创建操作固定写入 `INFINITE_CANVAS`；列表也只返回该类型。
+
+## 画布和节点
+
+```bash
+vvicat canvas get --project <projectId> --json
+vvicat canvas apply --project <projectId> --file <patch.json> --json
+vvicat canvas node types --json
+vvicat canvas node list --project <projectId> --json
+vvicat canvas node get <nodeId> --project <projectId> --json
+vvicat canvas node add <kind> --project <projectId> [--x N] [--y N] [--title <text>] [--config <config.json>] --json
+vvicat canvas node update <nodeId> --project <projectId> --config <config.json> --json
+vvicat canvas node delete <nodeId> --project <projectId> --yes --json
+vvicat canvas node run <nodeId> --project <projectId> --json
+```
+
+`canvas apply` 的 JSON 可以通过 `--file` 读取；省略文件时从 stdin 读取。提交批量变更时携带最近读取到的 `canvasId` 与 `expectedVersion`。
+
+## 连线
+
+```bash
+vvicat canvas edge list --project <projectId> --json
+vvicat canvas edge connect --project <projectId> --source-node <id> --source-handle <name> --target-node <id> --target-handle <name> --json
+vvicat canvas edge disconnect <edgeId> --project <projectId> --yes --json
+```
+
+handle 名称来自节点类型目录中的输入输出 schema，不要自行推断。
+
+## 资产与下载
+
+```bash
+vvicat canvas asset list --project <projectId> --json
+vvicat canvas asset get <assetId> --project <projectId> --json
+vvicat canvas asset upload <file> --project <projectId> --json
+vvicat canvas asset select <assetId> <versionId> --project <projectId> --json
+vvicat canvas asset download <assetId> --project <projectId> --output <directory>
+```
+
+## 异步任务
+
+```bash
+vvicat task get <taskId> --json
+vvicat task wait <taskId> [--interval 1000] --json
+vvicat task cancel <taskId> --yes --json
+```
+
+## 模型配置
+
+```bash
+vvicat config get --json
+vvicat config set --file <config.json> --json
+```
+
+`config set` 接受 `models`、`providers`、`defaultModels`、`capabilityDefaults`、`workflowConcurrency` 的部分对象。provider 的 `apiKey` 缺省时保留现有密钥，空字符串表示清除；敏感配置文件不要提交到版本库。