@iducky/media-agent 1.1.0 → 1.1.1

package/resources/capabilities.json

@@ -30,5 +30,47 @@
         "agents/openai.yaml": "cfe112ae911831c7f9947b80bea7fa5adbaf44d8461bbe23c9d987aecae99f6e"
       }
     }
-  ]
+  ],
+  "commands": {
+    "collect-douyin-index": {
+      "status": "IMPLEMENTATION_REQUIRED",
+      "execution": "skill",
+      "reason": "Legacy CLI does not verify all supplied arguments"
+    },
+    "collect-video-rankings": {
+      "status": "IMPLEMENTATION_REQUIRED",
+      "execution": "skill",
+      "reason": "Legacy CLI does not verify all supplied arguments"
+    },
+    "collect-industry-taxonomy": {
+      "status": "IMPLEMENTATION_REQUIRED",
+      "execution": "skill",
+      "reason": "Legacy CLI does not verify all supplied arguments"
+    },
+    "export-short-video": {
+      "status": "IMPLEMENTATION_REQUIRED",
+      "execution": "skill",
+      "reason": "Legacy CLI does not verify all supplied arguments"
+    },
+    "publish-prepare": {
+      "status": "OFFLINE_VERIFIED",
+      "execution": "cli"
+    },
+    "xhs-publish-prepare": {
+      "status": "IMPLEMENTED_UNVERIFIED",
+      "execution": "cli"
+    },
+    "douyin-creator-image-text-publish": {
+      "status": "ADAPTED_UNVERIFIED",
+      "execution": "skill"
+    },
+    "xiaohongshu-creator-image-text-publish": {
+      "status": "ADAPTED_UNVERIFIED",
+      "execution": "skill"
+    },
+    "toutiao-creator-article-draft": {
+      "status": "AGENT_WORKFLOW",
+      "execution": "skill"
+    }
+  }
 }

package/skills/douyin-creator-index/SKILL.md

@@ -30,3 +30,5 @@ media-agent collect-douyin-index <profile_id> [--lists realtime,rising] [--pages
 v1.0.3 的 `douyin_hotspot_v2.py` 硬编码测试 Profile，`media-agent` 未把 `<profile_id>` 传入采集脚本。对其他 Profile 执行前必须确认安装版本已参数化，否则返回 `IMPLEMENTATION_REQUIRED`，不得声称使用了请求的账号。
 
 检查上述参数化限制时，必须读取实现 `src/media_agent/platforms/douyin/douyin_hotspot_v2.py` 和命令路由 `src/media_agent/commands.sh`；已安装环境对应 `<MEDIA_AGENT_HOME>/.app/current/` 下的这些路径。命令存在不代表参数化限制已消除。
+
+1.1.1 安全修订：旧采集/导出 CLI 的真实执行已在浏览器启动前拦截并返回 IMPLEMENTATION_REQUIRED（退出码 6）。不要尝试绕过门禁直接运行历史脚本；需要业务操作时按本 Skill 的可见浏览器工作流执行并核验输入条件。dry-run 成功不表示真实采集已支持。

package/skills/douyin-creator-publish/SKILL.md

@@ -10,7 +10,7 @@ description: 在抖音创作者中心准备、确认、提交和核验视频作
 ```bash
 media-agent publish-dry-run <profile_id> --media-path <path> [--scheduled-at <ISO>]
 media-agent publish-prepare <profile_id> --media-path <path> [--scheduled-at <ISO>]
-media-agent publish-confirm <profile_id>
+media-agent publish-confirm <profile_id> --task-id <task_id>
 media-agent publish-status <profile_id> --task-id <task_id>
 media-agent publish-close <profile_id>
 ```
@@ -54,3 +54,5 @@ URL 跳转、点击计数、按钮消失或本地账本均不是成功证据。C
 ## 收尾
 
 成功或明确失败后正常关闭并释放 lock。`indeterminate` 默认保持现场。禁止 `kill`、`pkill`、覆盖账本原记录或自动重试。
+
+发布确认必须带 prepare 返回的 task_id；没有对应的存活准备进程时拒绝执行，不重新打开页面补点发布。确认信号不等于发布成功。结果 indeterminate 的素材禁止直接重试，应先人工核验。

package/skills/douyin-enterprise-short-video-export/SKILL.md

@@ -27,3 +27,5 @@ media-agent export-short-video <profile_id> [--date YYYY-MM-DD]
 ## 返回
 
 返回 `profile_id`、日期范围、`file_name`、`file_size`、`sheet_names`、`data_rows`、下载状态、附件投递状态、浏览器关闭和 lock 释放状态。不得把榜单抓取结果冒充平台原始导出。
+
+1.1.1 安全修订：旧采集/导出 CLI 的真实执行已在浏览器启动前拦截并返回 IMPLEMENTATION_REQUIRED（退出码 6）。不要尝试绕过门禁直接运行历史脚本；需要业务操作时按本 Skill 的可见浏览器工作流执行并核验输入条件。dry-run 成功不表示真实采集已支持。

package/skills/douyin-enterprise-video-rankings/SKILL.md

@@ -49,3 +49,5 @@ media-agent validate-rankings <task_dir>
 正常关闭浏览器并释放 lock；本地文件必须作为真实附件发送后才算完成。
 
 检查上述参数化限制时，必须读取实现 `src/media_agent/platforms/douyin/collect_video_rankings.py` 和命令路由 `src/media_agent/commands.sh`；已安装环境对应 `<MEDIA_AGENT_HOME>/.app/current/` 下的这些路径。命令存在不代表参数化限制已消除。
+
+1.1.1 安全修订：旧采集/导出 CLI 的真实执行已在浏览器启动前拦截并返回 IMPLEMENTATION_REQUIRED（退出码 6）。不要尝试绕过门禁直接运行历史脚本；需要业务操作时按本 Skill 的可见浏览器工作流执行并核验输入条件。dry-run 成功不表示真实采集已支持。

package/skills/xiaohongshu-creator-publish/SKILL.md

@@ -23,7 +23,7 @@ description: 在小红书创作服务平台上传、填写标题、发布并核
 ```bash
 media-agent xhs-publish-dry-run  <profile_id> --media-path <path>              # 素材校验 + SHA-256 账本去重，不开浏览器
 media-agent xhs-publish-prepare  <profile_id> --media-path <path> --title <标题>  # 上传、填标题并读回、写账本、保持浏览器
-media-agent xhs-publish-confirm  <profile_id>                                   # 单次真实点击“发布”
+media-agent xhs-publish-confirm  <profile_id> --task-id <task_id>                                   # 单次真实点击“发布”
 media-agent xhs-publish-status   <profile_id> [--task-id <id>]                  # 查询发布/审核状态
 media-agent xhs-publish-close    <profile_id>                                   # 正常关闭浏览器并释放 lock
 ```
@@ -151,3 +151,5 @@ current_url=<移除敏感查询参数后的 URL>
 ## 收尾
 
 成功、拒绝或只读查询结束后正常关闭 page/context/browser 并释放 lock，让 Profile 正常写盘。`PUBLISH_INDETERMINATE` 默认保留现场供人工检查。禁止使用 `kill`、`pkill`、清空 `browser_data`、删除作品或自动重复提交。
+
+发布确认必须带 prepare 返回的 task_id；没有对应的存活准备进程时拒绝执行，不重新打开页面补点发布。确认信号不等于发布成功。结果 indeterminate 的素材禁止直接重试，应先人工核验。

package/src/media_agent/cli.py

@@ -10,6 +10,11 @@ import sys
 def main(argv=None):
     args = list(sys.argv[1:] if argv is None else argv)
     package = Path(__file__).resolve().parent
+    if args and (args[0] in ('tasks', 'upgrade') or args[:2] == ['config', 'validate']):
+        from media_agent.runtime.diagnostics import main as diagnose
+        return diagnose(args)
+    from media_agent.runtime.arguments import validate
+    args = validate(args)
     if args and args[0] == 'run-script':
         mapping = json.loads((package / 'script_map.json').read_text())
         name = args[1].removesuffix('.py') if len(args) > 1 else ''

package/src/media_agent/commands.sh

@@ -87,7 +87,6 @@ case "$CMD" in
     PROFILE_ID="$1"; require_profile "$PROFILE_ID"
     run_script login_controller.py "$PROFILE_ID" --send '{"action":"close"}'
     sleep 3
-    rm -f "$SCRIPT_DIR/locks/${PROFILE_ID}.lock"
     ;;
 
   login-refresh-qr)
@@ -163,18 +162,8 @@ case "$CMD" in
     ;;
 
   close)
-    PROFILE_ID="$1"; require_profile "$PROFILE_ID"
-    echo "关闭: $PROFILE_ID"
-    touch "$SCRIPT_DIR/locks/${PROFILE_ID}.close"
-    # Wait for browser to actually close (check with lsof)
-    for i in $(seq 1 30); do
-        if ! lsof -n 2>/dev/null | grep -q "$PROFILE_ID/browser_data"; then
-            break
-        fi
-        sleep 2
-    done
-    rm -f "$SCRIPT_DIR/locks/${PROFILE_ID}.lock" "$SCRIPT_DIR/locks/${PROFILE_ID}.close"
-    echo "已关闭并释放锁"
+    echo "Use the owning controller's login-close, xhs-login-close, toutiao-login-close or publish-close command; no lock was removed."
+    exit 1
     ;;
 
   collect-douyin-index)
@@ -252,26 +241,32 @@ case "$CMD" in
 
   publish-prepare)
     PROFILE_ID="$1"; require_profile "$PROFILE_ID"; check_capability "$PROFILE_ID" "creator_publish"
-    shift; MEDIA_PATH=""; SCHEDULED=""
+    shift; MEDIA_PATH=""; SCHEDULED=""; TEXT_ARGS=()
     while [[ $# -gt 0 ]]; do
         case "$1" in
             --help) echo "publish-prepare <profile_id> --media-path <path> [--scheduled-at <ISO>]"; exit 0 ;;
             --media-path) MEDIA_PATH="$2"; shift 2 ;;
             --scheduled-at) SCHEDULED="$2"; shift 2 ;;
+            --title|--description) TEXT_ARGS+=("$1" "$2"); shift 2 ;;
             *) shift ;;
         esac
     done
     [ -z "$MEDIA_PATH" ] && { echo "错误: 缺少 --media-path"; exit 1; }
     if [ -n "$SCHEDULED" ]; then
-        run_script douyin_publish.py --prepare --profile-id "$PROFILE_ID" --media-path "$MEDIA_PATH" --scheduled-at "$SCHEDULED"
+        run_script douyin_publish.py --prepare --profile-id "$PROFILE_ID" --media-path "$MEDIA_PATH" "${TEXT_ARGS[@]}" --scheduled-at "$SCHEDULED"
     else
-        run_script douyin_publish.py --prepare --profile-id "$PROFILE_ID" --media-path "$MEDIA_PATH"
+        run_script douyin_publish.py --prepare --profile-id "$PROFILE_ID" --media-path "$MEDIA_PATH" "${TEXT_ARGS[@]}"
     fi
     ;;
 
   publish-confirm)
     PROFILE_ID="$1"; require_profile "$PROFILE_ID"; check_capability "$PROFILE_ID" "creator_publish"
-    run_script douyin_publish.py --confirm-submit --profile-id "$PROFILE_ID"
+    shift; TASK_ID=""
+    while [[ $# -gt 0 ]]; do
+        case "$1" in --task-id) TASK_ID="$2"; shift 2 ;; *) echo "Unknown option: $1"; exit 1 ;; esac
+    done
+    [ -n "$TASK_ID" ] || { echo "TASK_ID_REQUIRED"; exit 1; }
+    run_script douyin_publish.py --confirm-submit --profile-id "$PROFILE_ID" --task-id "$TASK_ID"
     ;;
 
   publish-status)
@@ -363,7 +358,12 @@ case "$CMD" in
 
   xhs-publish-confirm)
     PROFILE_ID="$1"; require_profile "$PROFILE_ID"; check_capability "$PROFILE_ID" "creator_publish"
-    run_script xiaohongshu_publish.py --confirm-submit --profile-id "$PROFILE_ID"
+    shift; TASK_ID=""
+    while [[ $# -gt 0 ]]; do
+        case "$1" in --task-id) TASK_ID="$2"; shift 2 ;; *) echo "Unknown option: $1"; exit 1 ;; esac
+    done
+    [ -n "$TASK_ID" ] || { echo "TASK_ID_REQUIRED"; exit 1; }
+    run_script xiaohongshu_publish.py --confirm-submit --profile-id "$PROFILE_ID" --task-id "$TASK_ID"
     ;;
 
   xhs-publish-status)
@@ -408,7 +408,7 @@ case "$CMD" in
     echo "  collect-industry-taxonomy <id>"
     echo "  publish-dry-run <id> --media-path <path>"
     echo "  publish-prepare <id> --media-path <path> [--scheduled-at <ISO>]"
-    echo "  publish-confirm <id>"
+    echo "  publish-confirm <id> --task-id <id>"
     echo "  publish-status <id> [--task-id <id>]"
     echo "  publish-close <id>"
     echo "  toutiao-login-start <id>       启动今日头条持久化登录控制器"
@@ -426,7 +426,7 @@ case "$CMD" in
     echo "  xhs-check-login <id>         小红书登录状态检查"
     echo "  xhs-publish-dry-run <id> --media-path <path>"
     echo "  xhs-publish-prepare <id> --media-path <path> --title <标题>"
-    echo "  xhs-publish-confirm <id>"
+    echo "  xhs-publish-confirm <id> --task-id <id>"
     echo "  xhs-publish-status <id> [--task-id <id>]"
     echo "  xhs-publish-close <id>"
     echo "Exit: 0=OK 1=err 2=LOGIN_REQUIRED 3=PROFILE_LOCKED 4=NO_CAPABILITY 5=NOT_FOUND 6=WAIT_INDUSTRY 7=indeterminate 8=DUPLICATE_BLOCKED"

package/src/media_agent/platforms/douyin/check_login.py

@@ -42,15 +42,12 @@ def main():
         if not sites_to_check:
             sites_to_check = sites_cfg  # backward compat
 
-    LOCK_FILE.parent.mkdir(parents=True, exist_ok=True)
-    if LOCK_FILE.exists():
-        try:
-            os.kill(json.loads(LOCK_FILE.read_text()).get('pid', 0), 0)
-            print(json.dumps({'profile_id': ALIAS, 'login_status': 'locked', 'lock_status': 'locked'}, indent=2))
-            sys.exit(3)
-        except:
-            LOCK_FILE.unlink()
-    LOCK_FILE.write_text(json.dumps({'task_id': 'check-login', 'pid': os.getpid(), 'time': datetime.now().isoformat(), 'site': SITE}, indent=2))
+    TASK_ID = 'check-login'
+    from media_agent.runtime.locking import acquire, release
+    if not acquire(LOCK_FILE, TASK_ID):
+        print('PROFILE_LOCKED')
+        raise SystemExit(3)
+
 
     try:
         ctx = launch_persistent_context(
@@ -154,7 +151,7 @@ def main():
             }
 
         ctx.close()
-        LOCK_FILE.unlink(missing_ok=True)
+        release(LOCK_FILE, TASK_ID)
 
         # Update state
         for site_name, r in results.items():
@@ -188,7 +185,7 @@ def main():
         print(json.dumps(output, indent=2, ensure_ascii=False))
         sys.exit(exit_code)
     except Exception as e:
-        LOCK_FILE.unlink(missing_ok=True)
+        release(LOCK_FILE, TASK_ID)
         print(json.dumps({'profile_id': ALIAS, 'login_status': 'check_failed', 'error': str(e)[:100]}, indent=2))
         sys.exit(1)
 

package/src/media_agent/platforms/douyin/collect_industry_taxonomy.py

@@ -1,6 +1,15 @@
 """Legacy operation, executed only through main()."""
 
 def main():
+    import json
+    import sys
+    print(json.dumps({'state': 'IMPLEMENTATION_REQUIRED',
+                      'operation': 'collect_industry_taxonomy',
+                      'reason': 'Legacy browser flow cannot yet verify all requested parameters; use the documented Skill workflow.'}))
+    raise SystemExit(6)
+
+
+def _legacy_reference():
     #!/usr/bin/env python3
     """Collect industry taxonomy v2 — fixed readback and proper cascader interaction."""
     import yaml
@@ -22,7 +31,7 @@ def main():
     LOCK_FILE.parent.mkdir(parents=True, exist_ok=True)
     if LOCK_FILE.exists():
         try: os.kill(json.loads(LOCK_FILE.read_text()).get('pid',0), 0); print('LOCKED'); sys.exit(1)
-        except: LOCK_FILE.unlink()
+        except Exception: LOCK_FILE.unlink()
     LOCK_FILE.write_text(json.dumps({'task_id':f'taxonomy_v2_{ts}','pid':os.getpid()}, indent=2))
     print(f'TASK|taxonomy_v2_{ts}', flush=True)
 

package/src/media_agent/platforms/douyin/collect_video_rankings.py

@@ -1,6 +1,15 @@
 """Legacy operation, executed only through main()."""
 
 def main():
+    import json
+    import sys
+    print(json.dumps({'state': 'IMPLEMENTATION_REQUIRED',
+                      'operation': 'collect_video_rankings',
+                      'reason': 'Legacy browser flow cannot yet verify all requested parameters; use the documented Skill workflow.'}))
+    raise SystemExit(6)
+
+
+def _legacy_reference():
     #!/usr/bin/env python3
     """Collect video rankings - DOM-based extraction, verified locators."""
     from media_agent.runtime.paths import runtime_home
@@ -28,7 +37,7 @@ def main():
     LOCK_FILE.parent.mkdir(parents=True, exist_ok=True)
     if LOCK_FILE.exists():
         try: os.kill(json.loads(LOCK_FILE.read_text()).get('pid',0), 0); sys.exit(1)
-        except: LOCK_FILE.unlink()
+        except Exception: LOCK_FILE.unlink()
     LOCK_FILE.write_text(json.dumps({'task_id':TASK_ID,'pid':os.getpid()}, indent=2))
     print(f'TASK|{TASK_ID}', flush=True)
 
@@ -119,21 +128,21 @@ def main():
 
     def click_tab(page, name):
         try: page.locator(f'text={name}').first.click(); time.sleep(5); return True
-        except: return False
+        except Exception: return False
 
     def parse_numeric(val):
         if not val: return {'display': val, 'numeric': None}
         t = val.strip()
         if t.endswith('%'):
             try: return {'display': t, 'numeric': float(t[:-1]) / 100}
-            except: return {'display': t, 'numeric': None}
+            except Exception: return {'display': t, 'numeric': None}
         if t.endswith('万'):
             try: return {'display': t, 'numeric': round(float(t[:-1]) * 10000)}
-            except: return {'display': t, 'numeric': None}
+            except Exception: return {'display': t, 'numeric': None}
         try:
             n = float(t.replace(',', ''))
             return {'display': t, 'numeric': int(n) if n == int(n) else n}
-        except:
+        except Exception:
             return {'display': t, 'numeric': None}
 
     # ===== Collect =====

package/src/media_agent/platforms/douyin/douyin_hotspot_v2.py

@@ -1,6 +1,15 @@
 """Legacy operation, executed only through main()."""
 
 def main():
+    import json
+    import sys
+    print(json.dumps({'state': 'IMPLEMENTATION_REQUIRED',
+                      'operation': 'douyin_hotspot_v2',
+                      'reason': 'Legacy browser flow cannot yet verify all requested parameters; use the documented Skill workflow.'}))
+    raise SystemExit(6)
+
+
+def _legacy_reference():
     #!/usr/bin/env python3
     """Douyin热点数据完整采集 v2 - 独立容器分页 + 趋势修复"""
     from media_agent.runtime.paths import runtime_home
@@ -27,7 +36,7 @@ def main():
             if pid:
                 try: os.kill(pid, 0); print('ERROR|Lock active', flush=True); sys.exit(1)
                 except OSError: LOCK_FILE.unlink()
-        except: LOCK_FILE.unlink()
+        except Exception: LOCK_FILE.unlink()
     LOCK_FILE.write_text(json.dumps({'task_id':TASK_ID,'pid':os.getpid()}, indent=2))
     print(f'LOCK|{TASK_ID}', flush=True)
 
@@ -49,7 +58,7 @@ def main():
     try:
         confirm = page.locator('text=确认').first
         if confirm and confirm.is_visible(timeout=3000): confirm.click(); time.sleep(3)
-    except: pass
+    except Exception: pass
 
     collected_at = datetime.now(timezone(timedelta(hours=8))).isoformat()
     source_url = page.url
@@ -123,7 +132,7 @@ def main():
         if '万' in t:
             return round(float(t.replace('万', '').strip()) * 10000), t
         try: return round(float(t.replace(',', ''))), t
-        except: return 0, t
+        except Exception: return 0, t
 
     def parse_trend_dom(page):
         """Parse trend from DOM using JS to inspect icon/SVG/class."""