@iqiyi-intl-nadoupro/nadoupro-cli 1.0.0-test.2

package/README.md

@@ -0,0 +1,25 @@
+# Nadou Pro CLI
+
+Nadou Pro's official command-line client.
+
+## Requirements
+
+- Node.js 16 or later
+
+## Install
+
+```bash
+npm install -g @iqiyi-intl-nadoupro/nadoupro-cli
+```
+
+## Verify
+
+```bash
+nadou version --json
+```
+
+Prerelease testers can install the `test` channel explicitly:
+
+```bash
+npm install -g @iqiyi-intl-nadoupro/nadoupro-cli@test
+```

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@iqiyi-intl-nadoupro/nadoupro-cli",
+  "version": "1.0.0-test.2",
+  "description": "Nadou Pro command-line client.",
+  "bin": {
+    "nadou": "scripts/run.js",
+    "nadoupro-cli": "scripts/run.js",
+    "nadou-install": "scripts/bootstrap.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "engines": {
+    "node": ">=16"
+  },
+  "optionalDependencies": {
+    "@iqiyi-intl-nadoupro/nadoupro-cli-darwin-x64": "1.0.0-test.2",
+    "@iqiyi-intl-nadoupro/nadoupro-cli-darwin-arm64": "1.0.0-test.2",
+    "@iqiyi-intl-nadoupro/nadoupro-cli-linux-x64": "1.0.0-test.2",
+    "@iqiyi-intl-nadoupro/nadoupro-cli-linux-arm64": "1.0.0-test.2",
+    "@iqiyi-intl-nadoupro/nadoupro-cli-win32-x64": "1.0.0-test.2"
+  },
+  "license": "UNLICENSED",
+  "private": false,
+  "files": [
+    "scripts/bootstrap.js",
+    "scripts/install.js",
+    "scripts/run.js",
+    "scripts/skill-sync.js",
+    "skills/nadou/**",
+    "README.md"
+  ]
+}

package/scripts/bootstrap.js

@@ -0,0 +1,393 @@
+#!/usr/bin/env node
+"use strict";
+
+// 通用安装入口：既服务干净环境，也负责从历史 npm 包迁移。
+//
+// 推荐通过 npm exec 临时运行本脚本。安装器先在隔离目录验证完整平台包，再暂存
+// 受管的全局 nadou shim、安装当前发布版本，并在失败时恢复原 shim。
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+const { syncSkills } = require("./skill-sync.js");
+
+const CURRENT_PACKAGE = require(path.join(__dirname, "..", "package.json")).name;
+const LEGACY_PACKAGE = "@nadouai/cli-auth-poc";
+
+function npmCommand(platform = process.platform) {
+  return platform === "win32" ? "npm.cmd" : "npm";
+}
+
+function shimCandidates(prefix, platform = process.platform) {
+  if (platform === "win32") {
+    return ["nadou", "nadou.cmd", "nadou.ps1"].map((name) =>
+      path.join(prefix, name)
+    );
+  }
+  return [path.join(prefix, "bin", "nadou")];
+}
+
+function containsPackageMarker(value, packageName) {
+  return value
+    .replaceAll("\\", "/")
+    .toLowerCase()
+    .includes(`/${packageName.toLowerCase()}/`);
+}
+
+function containsLegacyMarker(value) {
+  return containsPackageMarker(value, LEGACY_PACKAGE);
+}
+
+function pathExists(candidate) {
+  try {
+    fs.lstatSync(candidate);
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+}
+
+function isPackageShim(candidate, packageName) {
+  let stat;
+  try {
+    stat = fs.lstatSync(candidate);
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+
+  if (stat.isSymbolicLink()) {
+    return containsPackageMarker(fs.readlinkSync(candidate), packageName);
+  }
+  if (!stat.isFile() || stat.size > 64 * 1024) return false;
+  return containsPackageMarker(
+    fs.readFileSync(candidate, "utf8"),
+    packageName
+  );
+}
+
+function isLegacyShim(candidate) {
+  return isPackageShim(candidate, LEGACY_PACKAGE);
+}
+
+function isManagedShim(candidate) {
+  return (
+    isPackageShim(candidate, CURRENT_PACKAGE) ||
+    isPackageShim(candidate, LEGACY_PACKAGE)
+  );
+}
+
+function assertManagedShimOwnership(prefix, platform = process.platform) {
+  for (const candidate of shimCandidates(prefix, platform)) {
+    if (pathExists(candidate) && !isManagedShim(candidate)) {
+      throw new Error(
+        `发现不属于 Nadou npm 包的同名启动文件，拒绝覆盖: ${candidate}`
+      );
+    }
+  }
+}
+
+function removeLegacyShims(prefix, platform = process.platform) {
+  const removed = [];
+  for (const candidate of shimCandidates(prefix, platform)) {
+    if (!isLegacyShim(candidate)) continue;
+    fs.rmSync(candidate, { force: true });
+    removed.push(candidate);
+  }
+  return removed;
+}
+
+function backupLegacyShims(prefix, platform = process.platform) {
+  return backupMatchingShims(prefix, isLegacyShim, platform);
+}
+
+function backupManagedShims(prefix, platform = process.platform) {
+  return backupMatchingShims(prefix, isManagedShim, platform);
+}
+
+function backupMatchingShims(prefix, matches, platform) {
+  const backups = [];
+  try {
+    for (const candidate of shimCandidates(prefix, platform)) {
+      if (!matches(candidate)) continue;
+      const backup = `${candidate}.nadou-managed-backup-${process.pid}`;
+      fs.rmSync(backup, { force: true });
+      fs.renameSync(candidate, backup);
+      backups.push({ candidate, backup });
+    }
+  } catch (err) {
+    for (const { candidate, backup } of backups.reverse()) {
+      if (pathExists(backup) && !pathExists(candidate)) {
+        fs.renameSync(backup, candidate);
+      }
+    }
+    throw err;
+  }
+  return backups;
+}
+
+function discardShimBackups(backups) {
+  for (const { backup } of backups) fs.rmSync(backup, { force: true });
+}
+
+function existingShimPaths(prefix, platform = process.platform) {
+  return new Set(
+    shimCandidates(prefix, platform).filter((candidate) =>
+      pathExists(candidate)
+    )
+  );
+}
+
+function restoreManagedShims(
+  prefix,
+  backups,
+  preexisting = new Set(),
+  platform = process.platform
+) {
+  const backedUp = new Set(backups.map(({ candidate }) => candidate));
+  for (const candidate of shimCandidates(prefix, platform)) {
+    const createdByAttempt =
+      !preexisting.has(candidate) || backedUp.has(candidate);
+    if (createdByAttempt && isPackageShim(candidate, CURRENT_PACKAGE)) {
+      fs.rmSync(candidate, { force: true });
+    }
+  }
+  for (const { candidate, backup } of backups) {
+    if (!pathExists(backup)) continue;
+    if (pathExists(candidate)) {
+      throw new Error(`无法恢复原启动文件，目标已被占用: ${candidate}`);
+    }
+    fs.renameSync(backup, candidate);
+  }
+}
+
+const restoreLegacyShims = restoreManagedShims;
+
+function commandInvocation(command, args, platform = process.platform) {
+  if (platform === "win32" && command.toLowerCase().endsWith(".cmd")) {
+    return {
+      command: process.env.ComSpec || "cmd.exe",
+      args: ["/d", "/s", "/c", command, ...args],
+    };
+  }
+  return { command, args };
+}
+
+function run(command, args, options = {}) {
+  const invocation = commandInvocation(command, args);
+  const result = spawnSync(invocation.command, invocation.args, {
+    stdio: "inherit",
+    ...options,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${command} ${args.join(" ")} 退出码 ${result.status}`);
+  }
+}
+
+function capture(command, args) {
+  const invocation = commandInvocation(command, args);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "inherit"],
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${command} ${args.join(" ")} 退出码 ${result.status}`);
+  }
+  return result.stdout.trim();
+}
+
+function installedCommand(prefix, platform = process.platform) {
+  return platform === "win32"
+    ? path.join(prefix, "nadou.cmd")
+    : path.join(prefix, "bin", "nadou");
+}
+
+function stagingInstallArgs(prefix, spec) {
+  return [
+    "install",
+    "--prefix",
+    prefix,
+    "--no-save",
+    "--no-package-lock",
+    "--include=optional",
+    spec,
+  ];
+}
+
+function globalInstallArgs(spec) {
+  return [
+    "install",
+    "-g",
+    "--include=optional",
+    "--force",
+    spec,
+  ];
+}
+
+function assertVersionEnvelope(stdout, expectedVersion, label) {
+  let envelope;
+  try {
+    envelope = JSON.parse(stdout);
+  } catch (err) {
+    throw new Error(`${label} 版本输出不是有效 JSON: ${err.message}`);
+  }
+  const actualVersion = envelope?.data?.version;
+  if (envelope?.ok !== true || actualVersion !== expectedVersion) {
+    throw new Error(
+      `${label} 版本不匹配: 期望 ${expectedVersion}, 实际 ${actualVersion || "未知"}`
+    );
+  }
+}
+
+function verifyLauncher(launcher, expectedVersion, label) {
+  const result = spawnSync(
+    process.execPath,
+    [launcher, "version", "--json"],
+    { encoding: "utf8" }
+  );
+  if (result.stderr) process.stderr.write(result.stderr);
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${label} 版本验证退出码 ${result.status}`);
+  }
+  assertVersionEnvelope(result.stdout, expectedVersion, label);
+}
+
+function main() {
+  const pkg = require("../package.json");
+  const version = pkg.version;
+  if (!version || version === "0.0.0-dev") {
+    throw new Error("安装器只能从已发布的 npm 包运行");
+  }
+
+  const npm = npmCommand();
+  const prefix = capture(npm, ["prefix", "-g"]);
+  const npmRoot = capture(npm, ["root", "-g"]);
+  const legacyRoot = path.join(npmRoot, ...LEGACY_PACKAGE.split("/"));
+  const hadLegacyPackage = fs.existsSync(legacyRoot);
+  const spec = `${CURRENT_PACKAGE}@${version}`;
+  const stagingRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), "nadou-install-")
+  );
+
+  try {
+    // 独立暂存安装可修复“全局主包存在但平台 optional 子包缺失”的状态，
+    // 且在触碰任何全局 shim 前验证 registry 包与当前平台二进制。
+    console.log(`[nadou-install] 预检 ${spec}`);
+    run(npm, stagingInstallArgs(stagingRoot, spec));
+    const stagedLauncher = path.join(
+      stagingRoot,
+      "node_modules",
+      ...CURRENT_PACKAGE.split("/"),
+      "scripts",
+      "run.js"
+    );
+    verifyLauncher(stagedLauncher, version, "预检安装");
+
+    assertManagedShimOwnership(prefix);
+    const preexistingShims = existingShimPaths(prefix);
+    const backups = backupManagedShims(prefix);
+    for (const { candidate } of backups) {
+      console.log(`[nadou-install] 已暂存原启动文件 ${candidate}`);
+    }
+
+    try {
+      console.log(`[nadou-install] 安装 ${spec}`);
+      run(npm, globalInstallArgs(spec));
+
+      console.log("[nadou-install] 验证安装结果");
+      fs.accessSync(installedCommand(prefix));
+      const launcher = path.join(
+        npmRoot,
+        ...CURRENT_PACKAGE.split("/"),
+        "scripts",
+        "run.js"
+      );
+      verifyLauncher(launcher, version, "全局安装");
+
+      const skillSync = syncSkills(launcher);
+      if (skillSync.ok) {
+        console.log("[nadou-install] 已执行 Agent Skills 同步");
+      } else {
+        console.warn(`[nadou-install] ${skillSync.message}`);
+      }
+
+      // 只有新版本通过验证后才清理旧包；清理失败不回退已经可用的新版本。
+      try {
+        fs.rmSync(legacyRoot, { recursive: true, force: true });
+        discardShimBackups(backups);
+        if (backups.length > 0 || hadLegacyPackage) {
+          console.log(`[nadou-install] 已移除历史包 ${LEGACY_PACKAGE}`);
+        }
+      } catch (cleanupErr) {
+        console.warn(
+          `[nadou-install] 新版本已可用，但历史文件清理未完成：${cleanupErr.message}\n` +
+            `可稍后重新运行 nadou-install。`
+        );
+      }
+    } catch (err) {
+      if (backups.length > 0) {
+        try {
+          restoreManagedShims(prefix, backups, preexistingShims);
+        } catch (restoreErr) {
+          throw new Error(
+            `${err.message}; 恢复原启动文件失败: ${restoreErr.message}`
+          );
+        }
+      }
+      throw err;
+    }
+  } finally {
+    try {
+      fs.rmSync(stagingRoot, { recursive: true, force: true });
+    } catch (cleanupErr) {
+      console.warn(
+        `[nadou-install] 临时目录清理失败，可手工删除 ${stagingRoot}: ${cleanupErr.message}`
+      );
+    }
+  }
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (err) {
+    console.error(
+      `[nadou-install] 安装失败：${err.message}\n` +
+        `可修复后重试同一条安装命令；不会修改 Nadou Profile 或登录凭证。`
+    );
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  assertManagedShimOwnership,
+  assertVersionEnvelope,
+  backupLegacyShims,
+  backupManagedShims,
+  capture,
+  commandInvocation,
+  containsLegacyMarker,
+  containsPackageMarker,
+  discardShimBackups,
+  existingShimPaths,
+  globalInstallArgs,
+  installedCommand,
+  isLegacyShim,
+  isManagedShim,
+  isPackageShim,
+  npmCommand,
+  pathExists,
+  removeLegacyShims,
+  restoreLegacyShims,
+  restoreManagedShims,
+  shimCandidates,
+  stagingInstallArgs,
+  syncSkills,
+  verifyLauncher,
+};

package/scripts/install.js

@@ -0,0 +1,99 @@
+// 平台子包解析 + 安装期离线预检。
+//
+// 二进制不由本脚本下载：它随同名平台子包
+// 通过主包的 optionalDependencies 分发。npm 依据子包声明的 os/cpu
+// 只安装匹配当前平台的那一个；完整性由 npm registry 的包 integrity 保证。
+//
+// postinstall 先做离线预检；仅在 npm 全局安装成功后同步随包 Skill。
+// 预检或同步失败只告警不阻断安装（非目标平台、显式 --omit=optional 等场景）。
+
+const fs = require("fs");
+const path = require("path");
+const { syncSkills } = require("./skill-sync.js");
+
+function packageName() {
+  // 安装器由自身 package.json 决定 scope，确保平台子包与当前发布通道一致。
+  return JSON.parse(
+    fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8")
+  ).name;
+}
+
+const SUPPORTED = new Set([
+  "darwin-x64",
+  "darwin-arm64",
+  "linux-x64",
+  "linux-arm64",
+  "win32-x64",
+]);
+
+// 返回当前平台对应的子包名，不支持则返回 null。
+function platformPackage() {
+  const key = `${process.platform}-${process.arch}`;
+  if (!SUPPORTED.has(key)) return null;
+  return `${packageName()}-${key}`;
+}
+
+// 解析当前平台二进制的绝对路径。定位不到时抛错，由调用方决定如何处理。
+function resolveBinary() {
+  const pkg = platformPackage();
+  if (!pkg) {
+    throw new Error(`不支持的平台: ${process.platform}-${process.arch}`);
+  }
+  const binName = process.platform === "win32" ? "nadou.exe" : "nadou";
+  // 用 package.json 定位子包根目录，避免子包 exports 限制导致的解析失败。
+  const pkgJsonPath = require.resolve(`${pkg}/package.json`);
+  return path.join(path.dirname(pkgJsonPath), "bin", binName);
+}
+
+function isGlobalInstall(env = process.env) {
+  return env.npm_config_global === "true" || env.npm_config_location === "global";
+}
+
+function main({
+  env = process.env,
+  sync = syncSkills,
+  resolve = resolveBinary,
+  access = fs.accessSync,
+} = {}) {
+  // npx exec 触发的 postinstall 无需预检。
+  if (env.npm_command === "exec") return { action: "skipped_exec" };
+
+  const pkg = platformPackage();
+  if (!pkg) {
+    console.warn(
+      `[nadou] 当前平台 ${process.platform}-${process.arch} 无预编译二进制，跳过预检`
+    );
+    return { action: "skipped_platform" };
+  }
+  try {
+    const bin = resolve();
+    access(bin);
+    console.log(`nadou 平台二进制就绪: ${pkg}`);
+    if (!isGlobalInstall(env)) return { action: "preflight_only" };
+
+    const skillSync = sync(path.join(__dirname, "run.js"));
+    if (skillSync.ok) {
+      console.log("[nadou] 已执行 Agent Skills 同步");
+    } else {
+      console.warn(`[nadou] ${skillSync.message}`);
+    }
+    return { action: skillSync.ok ? "synchronized" : "sync_failed" };
+  } catch (err) {
+    console.warn(
+      `[nadou] 预检未通过：${err.message}\n` +
+        `若运行 nadou 时报错，请重装并保留可选依赖（勿用 --omit=optional / --no-optional）：\n` +
+        `  nadou-install`
+    );
+    return { action: "preflight_failed" };
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  isGlobalInstall,
+  main,
+  packageName,
+  resolveBinary,
+  platformPackage,
+};

package/scripts/run.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// bin 入口：定位平台子包中的 nadou 原生二进制，透传参数与退出码。
+// 二进制随同名平台子包安装（optionalDependencies）。
+
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const { resolveBinary } = require("./install.js");
+
+function bundledNpxPath(nodePath = process.execPath, platform = process.platform) {
+  const name = platform === "win32" ? "npx.cmd" : "npx";
+  const candidate = path.join(path.dirname(nodePath), name);
+  return fs.existsSync(candidate) ? candidate : "";
+}
+
+function nodePathEnv(pathValue, nodePath = process.execPath) {
+  const directory = path.dirname(nodePath);
+  const entries = String(pathValue || "").split(path.delimiter).filter(Boolean);
+  return entries.includes(directory)
+    ? entries.join(path.delimiter)
+    : [directory, ...entries].join(path.delimiter);
+}
+
+function launcherEnv(env = process.env, nodePath = process.execPath) {
+  return {
+    ...env,
+    NADOU_SKILL_SOURCE: path.join(__dirname, "..", "skills", "nadou"),
+    // npm exec may launch Node with a reduced PATH. Preserve an absolute npx
+    // companion path so the native Skill workflow can still invoke skills.
+    NADOU_NPX_PATH: bundledNpxPath(nodePath) || env.NADOU_NPX_PATH || "",
+    NADOU_NODE_PATH: nodePath,
+    PATH: nodePathEnv(env.PATH, nodePath),
+  };
+}
+
+function main() {
+  let bin;
+  try {
+    bin = resolveBinary();
+  } catch (err) {
+    console.error(
+      `${err.message}\n` +
+        `未找到平台二进制包。请确认安装未禁用可选依赖，或重装：\n` +
+        `  nadou-install`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const result = spawnSync(bin, process.argv.slice(2), {
+    stdio: "inherit",
+    env: launcherEnv(),
+  });
+  if (result.error) {
+    console.error(`执行 nadou 失败 (${bin}): ${result.error.message}`);
+    process.exitCode = 1;
+    return;
+  }
+  // 被信号中断时 status 为 null，统一按失败退出。
+  process.exitCode = result.status === null ? 1 : result.status;
+}
+
+if (require.main === module) main();
+
+module.exports = { bundledNpxPath, launcherEnv, nodePathEnv };

package/scripts/skill-sync.js

@@ -0,0 +1,18 @@
+"use strict";
+
+const { spawnSync } = require("child_process");
+
+// Let the verified CLI own Skill synchronization so installation, update, and
+// a direct `nadou skill install` all use the same native implementation.
+function syncSkills(launcher, spawn = spawnSync) {
+  const result = spawn(process.execPath, [launcher, "skill", "install", "--json"], {
+    stdio: "inherit",
+  });
+  if (!result.error && result.status === 0) return { ok: true };
+  return {
+    ok: false,
+    message: "Skill 未自动同步；CLI 已安装。请检查后运行: nadou skill doctor --json",
+  };
+}
+
+module.exports = { syncSkills };