@follenfang/fupload 0.0.17 → 0.0.19

package/fupload/SKILL.md

@@ -2,7 +2,7 @@
 name: fupload
 description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox, NetEase DD, CurseForge, Heybox Workshop, and ModUs.Creator, including local Creator login reuse and plugin ZIP publishing. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, CurseForge, Heybox, ModUs, plugins, configurations, or WA.
 metadata:
-  version: "0.0.17"
+  version: "0.0.19"
 ---
 
 # Fupload
@@ -22,7 +22,7 @@ Map natural language consistently:
 
 - `create`: create the main record. If first content is a separate platform action, plan it as a following atomic step.
 - `update`: publish a plugin version, change selected configuration-backup content, or publish a WA/string version.
-- `edit`: change fields allowed by the target platform's action allowlist. For DD plugins, this is existing-record commercial, association, room/channel, and creation-statement settings; first-publication metadata, categories, media, and version fields are create/update-only.
+- `edit`: change fields allowed by the target platform's action allowlist. For DD plugins, this includes `description` and existing-record commercial, association, room/channel, and creation-statement settings; other first-publication metadata, categories, media, and version fields are create/update-only. Description edits read both detail and author-list projections; either may confirm the value, but if neither matches, report verification-required.
 - `delete`: delete one main record only. It never deletes an individual version, media object, or associated record.
 
 Never offer bulk delete, drafts, guides, messages, or GUI control automation. Heybox supports individual version deletion with asynchronous readback; whole-module deletion is not supported. The DD task-session command may close verified official GUI processes only after the consent flow below.
@@ -109,7 +109,7 @@ For ModUs, require all four `modus session doctor` booleans to be true before an
 
 Before any DD live GET or write, run `dd session doctor`. If it reports `gui_running=true`, tell the user that continuing will close the listed official DD GUI instances and ask for explicit consent. Without consent, do not run start, do not close a process, and do not issue a native login. After consent, run `dd session start --confirm-close-gui`; when no GUI is running, run `dd session start` without that flag.
 
-`dd session start` automatically selects the native relogin flow from the official `Account.method`, `Cred.type`, and `Cred.modifier` enums. `urs + urs_token + normal` uses `UrsReLoginFlow` for an email session; `mobile + urs_mobile_token + mobile_password|mobile_uplink` uses `MobileReLoginFlow` for a mobile session. Missing, unknown, or contradictory combinations fail before any flow runs. Never infer the account kind from its text, coerce an enum, or try the other flow after a failure.
+`dd session start` automatically selects the native relogin flow from the official `Account.method`, `Cred.type`, and `Cred.modifier` enums. `urs + urs_token + normal` uses `UrsReLoginFlow` for an email session; `mobile + urs_mobile_token + normal|mobile_password|mobile_uplink` uses `MobileReLoginFlow` for a mobile session. Missing, unknown, or contradictory combinations fail before any flow runs. Never infer the account kind from its text, coerce an enum, or try the other flow after a failure.
 
 Keep the returned opaque `session_id` only in task memory and pass it as `--session <id>` to every DD GET, write, readback, status, and delete. Reuse this one session for the complete task, serialize all commands, stop on the first failure, and never start one session per item in a batch. In a `finally` path, always run `dd session stop --session <id>` and require `cleanup_complete=true`; the ten-minute idle timeout is only an abnormal-exit fallback.
 

package/fupload/references/dd.md

@@ -7,7 +7,7 @@ Run `dd session doctor` first. Doctor only discovers the installation, verifies
 `start` closes only identity- and signature-verified official GUI processes, starts one task broker, and reads the official `AccountCredStorage` auto account and credential. It selects the native relogin flow only from this strict enum matrix:
 
 - `Account.method=urs`, `Cred.type=urs_token`, `Cred.modifier=normal`: run `UrsReLoginFlow(controller, sdk, token, username)` for the email login state.
-- `Account.method=mobile`, `Cred.type=urs_mobile_token`, `Cred.modifier=mobile_password|mobile_uplink`: run `MobileReLoginFlow(controller, sdk, cgi, netconfig, token, isPassword, username)` for the mobile login state. `isPassword` is true only for `mobile_password`.
+- `Account.method=mobile`, `Cred.type=urs_mobile_token`, `Cred.modifier=normal|mobile_password|mobile_uplink`: run `MobileReLoginFlow(controller, sdk, cgi, netconfig, token, isPassword, username)` for the mobile login state. `normal` is emitted by the official DD 100130 client for SMS/non-password mobile login. `isPassword` is true only for `mobile_password`.
 
 Missing, unknown, or contradictory enum combinations fail before either flow is called. Do not infer account kind from the account string, coerce a value, or fall back to the other flow after a login failure. Do not request or accept manual account names, passwords, tokens, credential values, or account-type overrides.
 
@@ -65,7 +65,7 @@ Omission on edit preserves the remote value. Explicit false follows the field-sp
 
 Every path in `detail_img_files` must exist as a regular local file. Validation reports the exact indexed path, such as `$.detail_img_files[0]`, before any upload or mutation.
 
-`game_type` and the outer free/paid state are create-only. `plugin update` requires `sn`, `game_versions`, `version`, and `update_desc`; optional `file`, `detail_url`, and `release_type` publish a new version. `plugin edit` requires `sn` and only accepts the official existing-record commercial and association controls (`scope`, payment/lifetime/VIP fields, room/channel linkage, `creation_statement`, and associated content). First-publication metadata (`addon_type`, `name`, `description`, logo, detail images, categories, and `html_desc`) and version fields are not edit fields; in particular, sending `description` to `/addon/modify` can be accepted while leaving the remote value unchanged, so the CLI rejects it instead of reporting a false success.
+`game_type` and the outer free/paid state are create-only. `plugin update` requires `sn`, `game_versions`, `version`, and `update_desc`; optional `file`, `detail_url`, and `release_type` publish a new version. `plugin edit` requires `sn` and accepts `description` plus the official existing-record commercial and association controls (`scope`, payment/lifetime/VIP fields, room/channel linkage, `creation_statement`, and associated content). Other first-publication metadata (`addon_type`, `name`, logo, detail images, categories, and `html_desc`) and version fields are not edit fields. The CLI verifies a description edit through both detail and author-list readback; if DD accepts the request but leaves the remote value unchanged, it reports a verification-required error rather than false success.
 
 When `assign_user_sn` is present, the official UI exposes only the public scope option. Python validates the final rebuilt form and rejects a private scope before upload or mutation.
 

package/fupload/scripts/fupload_cli/__init__.py

@@ -1,3 +1,3 @@
 """Fupload Python CLI."""
 
-__version__ = "0.0.17"
+__version__ = "0.0.19"

package/fupload/scripts/fupload_cli/dd.py

@@ -20,6 +20,8 @@ from .trust import trusted_local_dir, trusted_roaming_dir, verify_dd_executable
 
 
 EXPECTED_DD_VERSION = os.environ.get("FUPLOAD_DD_EXPECTED_VERSION", "any")
+SIDECAR_DEFAULT_RESPONSE_TIMEOUT_SECONDS = 180
+SIDECAR_UPLOAD_RESPONSE_TIMEOUT_SECONDS = 660
 LIFE_TYPES = [
     {"name": "7 days", "value": "seven_day"},
     {"name": "14 days", "value": "fourteen_day"},
@@ -326,7 +328,7 @@ class Sidecar:
             self.responses.put(FuploadError("DD sidecar exited without a result", kind="sidecar_error"))
 
     def _next_result(
-        self, *, timeout: float = 180, endpoint: Optional[str] = None,
+        self, *, timeout: float = SIDECAR_DEFAULT_RESPONSE_TIMEOUT_SECONDS, endpoint: Optional[str] = None,
         stage: Optional[str] = None,
         verification_required: bool = False,
     ) -> Dict[str, Any]:
@@ -377,6 +379,11 @@ class Sidecar:
         else:
             expected_stage, uncertain = "dependency_get", False
         response = self._next_result(
+            timeout=(
+                SIDECAR_UPLOAD_RESPONSE_TIMEOUT_SECONDS
+                if action == "upload"
+                else SIDECAR_DEFAULT_RESPONSE_TIMEOUT_SECONDS
+            ),
             endpoint=endpoint,
             stage=expected_stage,
             verification_required=uncertain,
@@ -1456,10 +1463,12 @@ PLUGIN_CREATE_DEFAULTS = {
     "with_associate": False,
 }
 
-# DD's modify form is not a second create form.  The official edit page
-# rebuilds the payload from the existing commercial/association controls;
-# first-publication metadata and version fields belong to create/update.
+# DD's modify form is not a second create form. The official edit page
+# rebuilds the payload from existing commercial/association controls. The
+# brief description is the supported metadata exception and is verified by
+# detail and author-list readback after every edit.
 PLUGIN_EDIT_FIELDS = (
+    "description",
     "scope", "share_code_life_type", "need_buy", "price_fen", "buy_life_type",
     "jump_room", "room_id", "channel_id", "channel_type", "sync_room",
     "creation_statement", "with_associate", "associated_acts", "need_anchor_vip",
@@ -1950,7 +1959,10 @@ class DD:
         if available and any(str(value) not in available for value in values):
             raise ValidationError("selection contains an unavailable live option", path=path)
 
-    def _validate_options(self, session: Sidecar, resource: str, form: Mapping[str, Any]) -> None:
+    def _validate_options(
+        self, session: Sidecar, resource: str, form: Mapping[str, Any], *,
+        validate_optional_dependencies: bool = True,
+    ) -> None:
         game_type = form.get("game_type")
         if resource == "plugin":
             versions = session.get("/game_versions/list", {"game_type": game_type})
@@ -1983,11 +1995,11 @@ class DD:
         if form.get("share_code_life_type"):
             self._validate_choices(LIFE_TYPES, [form.get("share_code_life_type")], ("value",), "$.share_code_life_type")
 
-        if form.get("need_anchor_vip"):
+        if validate_optional_dependencies and form.get("need_anchor_vip"):
             vip_levels = session.get("/anchor_vip/level/list", {"enrich_acts": "false"})
             self._validate_choices(vip_levels, form.get("vip_levels") or [], ("id", "level", "value"), "$.vip_levels")
 
-        if form.get("jump_room"):
+        if validate_optional_dependencies and form.get("jump_room"):
             channels = safe_channels(session.cc_get("https://api.cc.163.com/v1/mixteammsgproxy/channelList?source=pluginPublish"))
             if not channels["items"]:
                 raise FuploadError("live channel response contained no selectable values", kind="platform_data_error")
@@ -1996,7 +2008,7 @@ class DD:
             if wanted not in available:
                 raise ValidationError("room/channel selection is unavailable", path="$.channel_id")
 
-        if form.get("with_associate"):
+        if validate_optional_dependencies and form.get("with_associate"):
             references = self._associated_refs(session, game_type)
             if not references:
                 raise FuploadError("live association response contained no selectable values", kind="platform_data_error")
@@ -2105,7 +2117,14 @@ class DD:
         validate_locked_usage_mode(current, form, doc)
         normalize_commercial(form, "plugin", create=action == "create")
         validate_plugin_submission(form, doc)
-        self._validate_options(session, "plugin", form)
+        # A version-only update cannot change these optional metadata fields.
+        # Validate their live dependencies on create/edit, but do not block a
+        # release merely because an already-saved room, VIP, or association is
+        # temporarily absent from an auxiliary option endpoint.
+        self._validate_options(
+            session, "plugin", form,
+            validate_optional_dependencies=action != "update",
+        )
         validate_no_display_objects(form, "plugin")
         if doc.get("logo_file"):
             form["logo"] = session.upload(doc["logo_file"], "addon", file_name="", media=True, max_bytes=10 * 1024 * 1024)

package/fupload/scripts/fupload_cli/dd_broker.py

@@ -23,6 +23,7 @@ STATE_NAME = "broker.json"
 STARTUP_NAME = "broker.starting.json"
 MAX_REQUEST_BYTES = 64 * 1024 * 1024
 IDLE_SECONDS = 10 * 60
+BROKER_WRITE_TIMEOUT_SECONDS = 15 * 60
 
 
 def _dd_module():
@@ -545,7 +546,7 @@ def execute(session_id: str, kind: str, resource: str, action: str, payload: Dic
         "resource": resource,
         "action": action,
         "payload": payload,
-    })
+    }, timeout=BROKER_WRITE_TIMEOUT_SECONDS if kind == "write" else 300)
 
 
 def _read_request(connection: socket.socket) -> Dict[str, Any]:

package/fupload/scripts/fupload_cli/dd_sidecar.py

@@ -42,6 +42,7 @@ _SENSITIVE_KEYS = {
     "presigneduri", "presigned_uri", "signature", "client_secret", "api_key", "auth_key", "password", "secret",
 }
 _MAX_LOG_BODY = 1024 * 1024
+OBJECT_PUT_TIMEOUT_SECONDS = 600
 _CONFIG_CONTENT_KEYS = {
     "known_addon", "unknown_addon", "wtf", "material", "font",
     "known_wa", "unknown_wa", "retail_ui_config",
@@ -624,8 +625,9 @@ def _create_relogin_flow(
     if (
         method == "mobile"
         and credential_type == "urs_mobile_token"
-        and modifier in ("mobile_password", "mobile_uplink")
+        and modifier in ("normal", "mobile_password", "mobile_uplink")
     ):
+        # Official DD 100130 emits normal for SMS/non-password mobile credentials.
         return mobile_flow_class(
             controller, sdk, cgi, netconfig, credential.value,
             modifier == "mobile_password", account.name,
@@ -642,7 +644,7 @@ def _credential_kind(account, credential):
     if (
         method == "mobile"
         and credential_type == "urs_mobile_token"
-        and modifier in ("mobile_password", "mobile_uplink")
+        and modifier in ("normal", "mobile_password", "mobile_uplink")
     ):
         return "mobile"
     raise RuntimeError("DD persisted login state uses an unsupported credential combination")
@@ -831,7 +833,7 @@ def run_command(session, command):
                 request = urllib.request.Request(
                     info["url"], data=data, method="PUT", headers=headers,
                 )
-                with urllib.request.urlopen(request, timeout=180) as response:
+                with urllib.request.urlopen(request, timeout=OBJECT_PUT_TIMEOUT_SECONDS) as response:
                     if response.status != 200:
                         try:
                             response_body = response.read()

package/fupload/scripts/fupload_cli/schema.py

@@ -580,6 +580,7 @@ DD_PLUGIN_EDIT_META = {
     name: DD_COMMERCIAL[name]
     for name in DD_COMMERCIAL
 }
+DD_PLUGIN_EDIT_META["description"] = DD_PLUGIN_META["description"]
 DD_PLUGIN_VERSION = {
     "game_versions": f("array", nonempty=True), "detail_url": f("string"),
     "file": f("string", local_file=True), "release_type": f("integer", choices=(1, 2, 3)),

package/npm/skill-manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "fupload.npm-skill-manifest.v1",
   "package_name": "@follenfang/fupload",
-  "package_version": "0.0.17",
-  "skill_version": "0.0.17",
-  "tree_sha256": "064aeb1a1291d240a3bea7e71458846395abe29c6e91f682d269ec0e684c4294",
+  "package_version": "0.0.19",
+  "skill_version": "0.0.19",
+  "tree_sha256": "dd39f508a55b1b4fe50e5bd076d2a2cd85cb03c6864cdedcb4a7de521ea92197",
   "files": [
     {
       "path": "agents/openai.yaml",
@@ -87,8 +87,8 @@
     },
     {
       "path": "references/dd.md",
-      "bytes": 19727,
-      "sha256": "2804e4b77c000d0bd12ca3f69bbcd5720f759fd4e84b4127ea3461093bf5da7c"
+      "bytes": 19868,
+      "sha256": "79498778d5d9f9c6205b2343b382fc71981d3c3e2cacd7470b63ad18e3afb491"
     },
     {
       "path": "references/modus.md",
@@ -113,7 +113,7 @@
     {
       "path": "scripts/fupload_cli/__init__.py",
       "bytes": 50,
-      "sha256": "8e72acb94a18f173cf9cbbf0436b20f64e1991f54a3537b7e930b4196bab8439"
+      "sha256": "f292736d0644ad8cdfc2c5c693957ec320f889bab0ed5845b574d60e7998f225"
     },
     {
       "path": "scripts/fupload_cli/blackbox_web.py",
@@ -137,18 +137,18 @@
     },
     {
       "path": "scripts/fupload_cli/dd_broker.py",
-      "bytes": 28248,
-      "sha256": "6bbae4ed7aef4feca552816d7dbefa6069dc3d1d9a39a4af35582a06db4ce2d5"
+      "bytes": 28353,
+      "sha256": "1b05604c27253cd77b40bb2b549a5cd1c99434245ccb60959f989ec690e3c70f"
     },
     {
       "path": "scripts/fupload_cli/dd_sidecar.py",
-      "bytes": 39150,
-      "sha256": "42791c82e5518838aedbe209823b94deb7de09b2f3eccb4fe563364f58becc6c"
+      "bytes": 39309,
+      "sha256": "fa0658f9cd4d5c85f4f1f84dd79bf7b33b5cafb74813107acc09fcf1f17d508c"
     },
     {
       "path": "scripts/fupload_cli/dd.py",
-      "bytes": 114434,
-      "sha256": "cf808efdd4a93d80bddb533af4ac14696e889e0fd359acdacd58a7a49ce050b0"
+      "bytes": 115390,
+      "sha256": "e160eeebb2914016d99f6dad1ad38b61fa201c884bb2314090839408fa70cd58"
     },
     {
       "path": "scripts/fupload_cli/errors.py",
@@ -182,8 +182,8 @@
     },
     {
       "path": "scripts/fupload_cli/schema.py",
-      "bytes": 54561,
-      "sha256": "17d57a9c9c53e556faf9e415020d47f84965283680c66f3f1c33beef6b83d104"
+      "bytes": 54628,
+      "sha256": "6eead57520d6f1d0db62d6da764c4e419cca24a267483dd3708f212a492e396a"
     },
     {
       "path": "scripts/fupload_cli/state_machine.py",
@@ -207,8 +207,8 @@
     },
     {
       "path": "SKILL.md",
-      "bytes": 28383,
-      "sha256": "9aebce883e6d83f0e3c8b36f497e59eb6f4df5e1e4af231df60ca3299188fb86"
+      "bytes": 28568,
+      "sha256": "e2f60649f6d239c555fac24e85fef6ab0d3354b2736e2022b2b9221eedbf0841"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@follenfang/fupload",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "description": "Install and run the Fuploader Agent Skill and Python CLI.",
   "type": "module",
   "bin": {