@josephyan/qingflow-app-user-mcp 1.1.24 → 1.1.26

package/README.md

@@ -3,13 +3,13 @@
 Install:
 
 ```bash
-npm install @josephyan/qingflow-app-user-mcp@1.1.24
+npm install @josephyan/qingflow-app-user-mcp@1.1.26
 ```
 
 Run:
 
 ```bash
-npx -y -p @josephyan/qingflow-app-user-mcp@1.1.24 qingflow-app-user-mcp
+npx -y -p @josephyan/qingflow-app-user-mcp@1.1.26 qingflow-app-user-mcp
 ```
 
 Environment:
@@ -23,19 +23,19 @@ This package bootstraps a local Python runtime on first install and then starts
 Bundled skills:
 
 - `skills/qingflow-app-user`
-- `skills/qingflow-mcp-setup`
 - `skills/qingflow-record-insert`
 - `skills/qingflow-record-update`
 - `skills/qingflow-record-delete`
 - `skills/qingflow-record-import`
 - `skills/qingflow-task-ops`
 - `skills/qingflow-record-analysis`
+- `skills/qingflow-mcp-setup`
+- `skills/qingflow-app-builder`
+- `skills/qingflow-app-builder-code-integrations`
+- `skills/qingflow-workflow-builder`
 
 Note:
 
 - The skill files are included in the npm package.
-- Installing the npm package does not overwrite agent skills automatically.
-- To mount bundled skills from an installed package, run `qingflow-app-user-mcp-skills install --agent codex --scope user`.
-- For one-shot `npx -p` installs, prefer `--copy` because symlinks would point into the npm execution cache.
-- Use `qingflow-app-user-mcp-skills list` to inspect bundled skills. The installer defaults to symlinks for stable package installs and refuses to overwrite existing skills unless `--force` is provided.
+- On install, the package copies them to `$CODEX_HOME/skills` (or `~/.codex/skills` if `CODEX_HOME` is unset).
 - If a stdio MCP client reports `Transport closed`, delete `.npm-python`, reinstall the package, and make sure CLI/user/builder packages are on the same version. The stdio entrypoints refuse runtime bootstrap so install logs never corrupt MCP stdout.

package/docs/local-agent-install.md

@@ -101,51 +101,7 @@ npm install /absolute/path/to/dist/npm/qingflow-tech-qingflow-app-builder-mcp-<v
 1. 创建 `.npm-python/`
 2. 在其中建立 Python 虚拟环境
 3. 执行 `pip install .`
-4. 在安装位置暴露对应入口：CLI 包暴露 `qingflow` / `qingflow-skills`；app-user 包暴露 `qingflow-app-user-mcp` / `qingflow-app-user-mcp-skills`；app-builder 包暴露 `qingflow-app-builder-mcp` / `qingflow-app-builder-mcp-skills`
-5. 携带 `skills/<skill-name>/SKILL.md`，但不在 `postinstall` 阶段自动覆盖本机 agent skills
-
-## Skills 挂载
-
-显式查看包内 skills：
-
-```bash
-qingflow-skills list
-```
-
-独立 MCP split 包使用包专属 skills 命令，避免全局安装多个包时发生 bin 覆盖：
-
-```bash
-qingflow-app-user-mcp-skills list
-qingflow-app-builder-mcp-skills list
-```
-
-显式挂载到 Codex 用户目录：
-
-```bash
-qingflow-skills install --agent codex --scope user
-```
-
-如果通过一次性 `npx -p <package>` 执行安装，请加 `--copy`，避免 symlink 指向 npm 临时执行缓存：
-
-```bash
-npx -y -p @qingflow-tech/qingflow-cli qingflow-skills install --agent codex --scope user --copy
-```
-
-也可以挂载到项目级 agent 目录：
-
-```bash
-qingflow-skills install --agent claude-code --scope project
-qingflow-skills install --agent cursor --scope project --copy
-qingflow-skills install --agent all --scope project
-```
-
-默认行为：
-
-- `--mode symlink`：使用 symlink，让 npm 包版本成为单一来源
-- `--scope user`：安装到用户级 agent skills 目录
-- `--agent codex`：目标 agent 为 Codex
-- 不覆盖已有同名 skill；需要替换时显式加 `--force`
-- 每次安装会在目标 skills 目录下写入 `.qingflow-skill-sources/<skill>.json`，记录 package、version、source、destination、agent、scope、mode
+4. 在安装位置暴露 `qingflow`、`qingflow-app-user-mcp`、`qingflow-app-builder-mcp` 命令
 
 ## 本地验证
 
@@ -154,31 +110,24 @@ qingflow-skills install --agent all --scope project
 ```bash
 cd qingflow-support/mcp-server
 node ./npm/bin/qingflow.mjs --help
-node ./npm/bin/qingflow-skills.mjs list
 node ./npm/bin/qingflow-app-user-mcp.mjs
 node ./npm/bin/qingflow-app-builder-mcp.mjs
 ```
 
-如果你是全局安装对应包：
+如果你是全局安装：
 
 ```bash
 qingflow --help
-qingflow-skills list
 qingflow-app-user-mcp
-qingflow-app-user-mcp-skills list
 qingflow-app-builder-mcp
-qingflow-app-builder-mcp-skills list
 ```
 
-如果你是把包安装到了某个本地 agent workspace，安装对应包后命令通常位于：
+如果你是把包安装到了某个本地 agent workspace，命令通常位于：
 
 ```bash
 /absolute/path/to/agent-workspace/node_modules/.bin/qingflow
-/absolute/path/to/agent-workspace/node_modules/.bin/qingflow-skills
 /absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-user-mcp
-/absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-user-mcp-skills
 /absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-builder-mcp
-/absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-builder-mcp-skills
 ```
 
 如果你是从 tgz 安装到某个空目录，命令通常位于：
@@ -268,7 +217,7 @@ qingflow-app-builder-mcp-skills list
       "command": "npx",
       "args": [
         "-y",
-        "@qingflow-tech/qingflow-app-user-mcp"
+        "@josephyan/qingflow-app-user-mcp"
       ],
       "env": {
         "QINGFLOW_MCP_DEFAULT_BASE_URL": "https://qingflow.com/api",
@@ -281,7 +230,7 @@ qingflow-app-builder-mcp-skills list
       "command": "npx",
       "args": [
         "-y",
-        "@qingflow-tech/qingflow-app-builder-mcp"
+        "@josephyan/qingflow-app-builder-mcp"
       ],
       "env": {
         "QINGFLOW_MCP_DEFAULT_BASE_URL": "https://qingflow.com/api",
@@ -323,7 +272,7 @@ npm install
 
 如果 MCP 客户端一调用工具就报 `Transport closed`，优先检查这几件事：
 
-1. 不要混用不同版本的 `@qingflow-tech/qingflow-cli`、`@qingflow-tech/qingflow-app-user-mcp`、`@qingflow-tech/qingflow-app-builder-mcp`
+1. 不要混用不同版本的 `@josephyan/qingflow-cli`、`@josephyan/qingflow-app-user-mcp`、`@josephyan/qingflow-app-builder-mcp`
 2. 删除安装目录下的 `.npm-python`
 3. 重新执行 `npm install` 或重新安装对应 tgz/npm 包
 4. 再启动 MCP 客户端

package/entry_point.py

@@ -7,7 +7,7 @@ src_path = os.path.abspath(os.path.join(os.path.dirname(__file__), "src"))
 if src_path not in sys.path:
     sys.path.insert(0, src_path)
 
-from qingflow_mcp.server_app_user import main
+from qingflow_mcp.server import main
 
 if __name__ == "__main__":
     main()

package/npm/bin/qingflow-app-user-mcp.mjs

@@ -1,7 +1,38 @@
 #!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { getPackageRoot, spawnServer } from "../lib/runtime.mjs";
+const PKG_BY_BIN = {
+  qingflow: "qingflow-cli",
+  "qingflow-app-user-mcp": "qingflow-app-user-mcp",
+  "qingflow-app-builder-mcp": "qingflow-app-builder-mcp",
+};
 
-const packageRoot = getPackageRoot(import.meta.url);
+function resolvePackageModule(metaUrl, ...segments) {
+  const scriptPath = fileURLToPath(metaUrl);
+  const scriptDir = path.dirname(scriptPath);
+  // bin files live in <pkg>/npm/bin/, runtime.mjs lives in the sibling <pkg>/npm/lib/,
+  // so step up one level before joining the requested segments.
+  const direct = path.join(scriptDir, "..", ...segments);
+  if (fs.existsSync(direct)) {
+    return pathToFileURL(direct).href;
+  }
+  if (path.basename(scriptDir) === ".bin") {
+    const binName = path.basename(scriptPath);
+    const pkgName = PKG_BY_BIN[binName];
+    if (!pkgName) {
+      throw new Error(`Unknown qingflow command: ${binName}`);
+    }
+    const scope = process.env.QINGFLOW_NPM_SCOPE || "@josephyan";
+    const fromBin = path.join(scriptDir, "..", scope, pkgName, "npm", ...segments);
+    if (fs.existsSync(fromBin)) {
+      return pathToFileURL(fromBin).href;
+    }
+  }
+  throw new Error(`Cannot locate ${segments.join("/")} from ${scriptPath}`);
+}
 
+const { getPackageRoot, spawnServer } = await import(resolvePackageModule(import.meta.url, "lib", "runtime.mjs"));
+const packageRoot = getPackageRoot(import.meta.url);
 spawnServer(packageRoot, process.argv.slice(2), "qingflow-app-user-mcp", { allowRuntimeBootstrap: false });

package/npm/lib/runtime.mjs

@@ -5,6 +5,12 @@ import { fileURLToPath } from "node:url";
 
 const WINDOWS = process.platform === "win32";
 
+const PKG_BY_BIN = {
+  qingflow: "qingflow-cli",
+  "qingflow-app-user-mcp": "qingflow-app-user-mcp",
+  "qingflow-app-builder-mcp": "qingflow-app-builder-mcp",
+};
+
 function runChecked(command, args, options = {}) {
   const result = spawnSync(command, args, {
     encoding: "utf8",
@@ -28,7 +34,18 @@ function commandWorks(command, args) {
 }
 
 export function getPackageRoot(metaUrl) {
-  return path.resolve(path.dirname(fileURLToPath(metaUrl)), "..", "..");
+  const scriptPath = fileURLToPath(metaUrl);
+  const scriptDir = path.dirname(scriptPath);
+  if (path.basename(scriptDir) === ".bin") {
+    const binName = path.basename(scriptPath);
+    const pkgName = PKG_BY_BIN[binName];
+    if (!pkgName) {
+      throw new Error(`Unknown qingflow command: ${binName}`);
+    }
+    const scope = process.env.QINGFLOW_NPM_SCOPE || "@josephyan";
+    return path.join(scriptDir, "..", scope, pkgName);
+  }
+  return path.resolve(scriptDir, "..", "..");
 }
 
 export function getCodexHome() {
@@ -137,6 +154,43 @@ function writeSkillProvenance(skillsDestRoot, skillName, payload) {
   fs.writeFileSync(path.join(provenanceRoot, `${skillName}.json`), `${JSON.stringify(payload, null, 2)}\n`);
 }
 
+function sleepMs(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function withSkillInstallLock(skillsDestRoot, callback) {
+  const lockDir = path.join(skillsDestRoot, ".qingflow-skill-install.lock");
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      fs.mkdirSync(lockDir);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw error;
+      }
+      try {
+        const stat = fs.statSync(lockDir);
+        if (Date.now() - stat.mtimeMs > 300_000) {
+          fs.rmSync(lockDir, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - startedAt > 30_000) {
+        throw new Error(`Timed out waiting for skill install lock: ${lockDir}`);
+      }
+      sleepMs(100);
+    }
+  }
+  try {
+    return callback();
+  } finally {
+    fs.rmSync(lockDir, { recursive: true, force: true });
+  }
+}
+
 export function installBundledSkills(
   packageRoot,
   {
@@ -180,27 +234,29 @@ export function installBundledSkills(
     mode,
   };
 
-  for (const skillName of wanted) {
-    const src = path.join(skillsSrc, skillName);
-    const dest = path.join(skillsDestRoot, skillName);
-    const installResult = installOneSkill(src, dest, { force, mode });
-    result[installResult.status === "conflict" ? "conflicts" : installResult.status].push(skillName);
-    if (installResult.status !== "conflict") {
-      writeSkillProvenance(skillsDestRoot, skillName, {
-        package: packageJson.name ?? null,
-        version: packageJson.version ?? null,
-        skill: skillName,
-        source: src,
-        destination: dest,
-        agent,
-        scope,
-        mode,
-        installed_at: new Date().toISOString(),
-      });
+  return withSkillInstallLock(skillsDestRoot, () => {
+    for (const skillName of wanted) {
+      const src = path.join(skillsSrc, skillName);
+      const dest = path.join(skillsDestRoot, skillName);
+      const installResult = installOneSkill(src, dest, { force, mode });
+      result[installResult.status === "conflict" ? "conflicts" : installResult.status].push(skillName);
+      if (installResult.status !== "conflict") {
+        writeSkillProvenance(skillsDestRoot, skillName, {
+          package: packageJson.name ?? null,
+          version: packageJson.version ?? null,
+          skill: skillName,
+          source: src,
+          destination: dest,
+          agent,
+          scope,
+          mode,
+          installed_at: new Date().toISOString(),
+        });
+      }
     }
-  }
 
-  return result;
+    return result;
+  });
 }
 
 function parseSkillsCliArgs(args) {
@@ -480,6 +536,17 @@ function getVenvPip(packageRoot) {
     : path.join(getVenvDir(packageRoot), "bin", "pip");
 }
 
+function findOfflineProjectWheel(findLinksDir) {
+  const wheels = fs
+    .readdirSync(findLinksDir)
+    .filter((name) => /^qingflow_mcp-.*\.whl$/i.test(name))
+    .sort();
+  if (wheels.length === 0) {
+    throw new Error(`Offline install expected a qingflow_mcp wheel in ${findLinksDir}`);
+  }
+  return path.join(findLinksDir, wheels[wheels.length - 1]);
+}
+
 export function findPython() {
   const preferred = process.env.QINGFLOW_MCP_PYTHON?.trim();
   const candidates = preferred
@@ -528,7 +595,20 @@ export function ensurePythonEnv(packageRoot, { force = false, commandName = "qin
   }
 
   const pip = getVenvPip(packageRoot);
-  runChecked(pip, ["install", "--disable-pip-version-check", "."], { cwd: packageRoot });
+  const pipArgs = ["install", "--disable-pip-version-check"];
+  const offlineFindLinks = process.env.QINGFLOW_MCP_PIP_FIND_LINKS?.trim();
+  if (process.env.QINGFLOW_MCP_PIP_NO_INDEX === "1") {
+    pipArgs.push("--no-index");
+  }
+  if (offlineFindLinks) {
+    pipArgs.push("--find-links", offlineFindLinks);
+  }
+  if (process.env.QINGFLOW_MCP_PIP_NO_INDEX === "1" && offlineFindLinks) {
+    pipArgs.push(findOfflineProjectWheel(offlineFindLinks));
+  } else {
+    pipArgs.push(".");
+  }
+  runChecked(pip, pipArgs, { cwd: packageRoot });
 
   fs.writeFileSync(
     stampPath,

package/npm/scripts/postinstall.mjs

@@ -1,4 +1,4 @@
-import { ensurePythonEnv, getPackageRoot } from "../lib/runtime.mjs";
+import { ensurePythonEnv, getPackageRoot, installBundledSkills } from "../lib/runtime.mjs";
 
 const packageRoot = getPackageRoot(import.meta.url);
 
@@ -6,6 +6,15 @@ try {
   console.log("[qingflow-mcp] Bootstrapping Python runtime...");
   ensurePythonEnv(packageRoot, { commandName: "qingflow-app-user-mcp" });
   console.log("[qingflow-mcp] Python runtime is ready.");
+  const skills = installBundledSkills(packageRoot, { force: true });
+  if (!skills.skipped) {
+    const changed = [
+      skills.installed.length ? `installed=${skills.installed.join(",")}` : "",
+      skills.unchanged.length ? `unchanged=${skills.unchanged.join(",")}` : "",
+      skills.conflicts.length ? `conflicts=${skills.conflicts.join(",")}` : "",
+    ].filter(Boolean).join(" ");
+    console.log(`[qingflow-mcp] Installed skills to ${skills.destination}: ${changed || "none"}`);
+  }
 } catch (error) {
   console.error(`[qingflow-mcp] postinstall failed: ${error.message}`);
   process.exit(1);

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@josephyan/qingflow-app-user-mcp",
-  "version": "1.1.24",
+  "version": "1.1.26",
   "description": "Operational end-user MCP for Qingflow records, tasks, comments, and directory workflows.",
   "license": "MIT",
   "type": "module",
   "bin": {
-    "qingflow-app-user-mcp": "./npm/bin/qingflow-app-user-mcp.mjs",
-    "qingflow-app-user-mcp-skills": "./npm/bin/qingflow-skills.mjs"
+    "qingflow-app-user-mcp": "./npm/bin/qingflow-app-user-mcp.mjs"
   },
   "scripts": {
     "postinstall": "node ./npm/scripts/postinstall.mjs"

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qingflow-mcp"
-version = "1.1.24"
+version = "1.1.26"
 description = "User-authenticated MCP server for Qingflow"
 readme = "README.md"
 license = "MIT"