@josephyan/qingflow-cli 1.0.11 → 1.1.2

package/README.md

@@ -3,13 +3,13 @@
 Install:
 
 ```bash
-npm install @josephyan/qingflow-cli@1.0.11
+npm install @josephyan/qingflow-cli@1.1.2
 ```
 
 Run:
 
 ```bash
-npx -y -p @josephyan/qingflow-cli@1.0.11 qingflow
+npx -y -p @josephyan/qingflow-cli@1.1.2 qingflow
 ```
 
 Environment:
@@ -22,7 +22,7 @@ This package bootstraps a local Python runtime on first install and then starts
 
 Bundled skills:
 
-- none
+- `skills/qingflow-cli`
 
 Note:
 

package/npm/bin/qingflow.mjs

@@ -1,5 +1,43 @@
 #!/usr/bin/env node
-import { spawnServer, getPackageRoot } from "../lib/runtime.mjs";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
+const PKG_BY_BIN = {
+  qingflow: "qingflow-cli",
+  "qingflow-app-user-mcp": "qingflow-app-user-mcp",
+  "qingflow-app-builder-mcp": "qingflow-app-builder-mcp",
+};
+
+function resolvePackageModule(metaUrl, ...segments) {
+  const scriptPath = fileURLToPath(metaUrl);
+  const scriptDir = path.dirname(scriptPath);
+  // bin files live in <pkg>/npm/bin/, runtime.mjs lives in the sibling <pkg>/npm/lib/,
+  // so step up one level before joining the requested segments.
+  const direct = path.join(scriptDir, "..", ...segments);
+  if (fs.existsSync(direct)) {
+    return pathToFileURL(direct).href;
+  }
+  if (path.basename(scriptDir) === ".bin") {
+    const binName = path.basename(scriptPath);
+    const pkgName = PKG_BY_BIN[binName];
+    if (!pkgName) {
+      throw new Error(`Unknown qingflow command: ${binName}`);
+    }
+    const scope = process.env.QINGFLOW_NPM_SCOPE || "@josephyan";
+    const fromBin = path.join(scriptDir, "..", scope, pkgName, "npm", ...segments);
+    if (fs.existsSync(fromBin)) {
+      return pathToFileURL(fromBin).href;
+    }
+  }
+  throw new Error(`Cannot locate ${segments.join("/")} from ${scriptPath}`);
+}
+
+const { getPackageRoot, spawnServer, runSkillsCli } = await import(resolvePackageModule(import.meta.url, "lib", "runtime.mjs"));
 const packageRoot = getPackageRoot(import.meta.url);
-spawnServer(packageRoot, process.argv.slice(2), "qingflow", { allowRuntimeBootstrap: true, stdio: "inherit" });
+const args = process.argv.slice(2);
+if (args[0] === "skills") {
+  runSkillsCli(packageRoot, args.slice(1));
+} else {
+  spawnServer(packageRoot, args, "qingflow", { allowRuntimeBootstrap: true, stdio: "inherit" });
+}

package/npm/lib/runtime.mjs

@@ -5,6 +5,12 @@ import { fileURLToPath } from "node:url";
 
 const WINDOWS = process.platform === "win32";
 
+const PKG_BY_BIN = {
+  qingflow: "qingflow-cli",
+  "qingflow-app-user-mcp": "qingflow-app-user-mcp",
+  "qingflow-app-builder-mcp": "qingflow-app-builder-mcp",
+};
+
 function runChecked(command, args, options = {}) {
   const result = spawnSync(command, args, {
     encoding: "utf8",
@@ -28,7 +34,18 @@ function commandWorks(command, args) {
 }
 
 export function getPackageRoot(metaUrl) {
-  return path.resolve(path.dirname(fileURLToPath(metaUrl)), "..", "..");
+  const scriptPath = fileURLToPath(metaUrl);
+  const scriptDir = path.dirname(scriptPath);
+  if (path.basename(scriptDir) === ".bin") {
+    const binName = path.basename(scriptPath);
+    const pkgName = PKG_BY_BIN[binName];
+    if (!pkgName) {
+      throw new Error(`Unknown qingflow command: ${binName}`);
+    }
+    const scope = process.env.QINGFLOW_NPM_SCOPE || "@josephyan";
+    return path.join(scriptDir, "..", scope, pkgName);
+  }
+  return path.resolve(scriptDir, "..", "..");
 }
 
 export function getCodexHome() {
@@ -43,29 +60,359 @@ export function getCodexHome() {
   return path.join(home, ".codex");
 }
 
-export function installBundledSkills(packageRoot) {
+function getHomeDir() {
+  const home = process.env.HOME || process.env.USERPROFILE;
+  if (!home) {
+    throw new Error("Cannot resolve user home because HOME is not set.");
+  }
+  return home;
+}
+
+function getAgentSkillDest(agent, scope, cwd = process.cwd()) {
+  const normalizedAgent = agent.trim().toLowerCase();
+  const normalizedScope = scope.trim().toLowerCase();
+  const home = getHomeDir();
+  if (!["user", "project"].includes(normalizedScope)) {
+    throw new Error(`Unsupported skills scope '${scope}'. Expected 'user' or 'project'.`);
+  }
+
+  const projectRoots = {
+    codex: [cwd, ".codex", "skills"],
+    claude: [cwd, ".claude", "skills"],
+    "claude-code": [cwd, ".claude", "skills"],
+    cursor: [cwd, ".cursor", "skills"],
+    generic: [cwd, ".agents", "skills"],
+  };
+  const userRoots = {
+    codex: [process.env.CODEX_HOME?.trim() || path.join(home, ".codex"), "skills"],
+    claude: [home, ".claude", "skills"],
+    "claude-code": [home, ".claude", "skills"],
+    cursor: [home, ".cursor", "skills"],
+    generic: [home, ".agents", "skills"],
+  };
+
+  const roots = normalizedScope === "project" ? projectRoots : userRoots;
+  const parts = roots[normalizedAgent];
+  if (!parts) {
+    throw new Error(`Unsupported skills agent '${agent}'. Expected one of: codex, claude, claude-code, cursor, generic.`);
+  }
+  return path.resolve(...parts);
+}
+
+export function listBundledSkills(packageRoot) {
   const skillsSrc = path.join(packageRoot, "skills");
   if (!fs.existsSync(skillsSrc)) {
-    return { installed: [], skipped: true, destination: null };
+    return [];
   }
 
-  const codexHome = getCodexHome();
-  const skillsDestRoot = path.join(codexHome, "skills");
-  fs.mkdirSync(skillsDestRoot, { recursive: true });
+  return fs
+    .readdirSync(skillsSrc, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && fs.existsSync(path.join(skillsSrc, entry.name, "SKILL.md")))
+    .map((entry) => entry.name)
+    .sort();
+}
+
+function sameRealPath(a, b) {
+  try {
+    return fs.realpathSync(a) === fs.realpathSync(b);
+  } catch {
+    return false;
+  }
+}
 
-  const installed = [];
-  for (const entry of fs.readdirSync(skillsSrc, { withFileTypes: true })) {
-    if (!entry.isDirectory()) {
-      continue;
+function installOneSkill(src, dest, { force, mode }) {
+  let existingStat = null;
+  try {
+    existingStat = fs.lstatSync(dest);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (existingStat) {
+    if (existingStat.isSymbolicLink() && sameRealPath(dest, src)) {
+      return { status: "unchanged" };
+    }
+    if (!force) {
+      return { status: "conflict" };
     }
-    const src = path.join(skillsSrc, entry.name);
-    const dest = path.join(skillsDestRoot, entry.name);
     fs.rmSync(dest, { recursive: true, force: true });
+  }
+
+  if (mode === "copy") {
     fs.cpSync(src, dest, { recursive: true });
-    installed.push(entry.name);
+    return { status: "installed" };
   }
 
-  return { installed, skipped: false, destination: skillsDestRoot };
+  fs.symlinkSync(src, dest, "dir");
+  return { status: "installed" };
+}
+
+function writeSkillProvenance(skillsDestRoot, skillName, payload) {
+  const provenanceRoot = path.join(skillsDestRoot, ".qingflow-skill-sources");
+  fs.mkdirSync(provenanceRoot, { recursive: true });
+  fs.writeFileSync(path.join(provenanceRoot, `${skillName}.json`), `${JSON.stringify(payload, null, 2)}\n`);
+}
+
+function sleepMs(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function withSkillInstallLock(skillsDestRoot, callback) {
+  const lockDir = path.join(skillsDestRoot, ".qingflow-skill-install.lock");
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      fs.mkdirSync(lockDir);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw error;
+      }
+      try {
+        const stat = fs.statSync(lockDir);
+        if (Date.now() - stat.mtimeMs > 300_000) {
+          fs.rmSync(lockDir, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - startedAt > 30_000) {
+        throw new Error(`Timed out waiting for skill install lock: ${lockDir}`);
+      }
+      sleepMs(100);
+    }
+  }
+  try {
+    return callback();
+  } finally {
+    fs.rmSync(lockDir, { recursive: true, force: true });
+  }
+}
+
+export function installBundledSkills(
+  packageRoot,
+  {
+    agent = "codex",
+    scope = "user",
+    mode = "symlink",
+    force = false,
+    skills = [],
+    cwd = process.cwd(),
+  } = {},
+) {
+  const skillsSrc = path.join(packageRoot, "skills");
+  if (!fs.existsSync(skillsSrc)) {
+    return { installed: [], unchanged: [], conflicts: [], skipped: true, destination: null };
+  }
+
+  const validModes = new Set(["symlink", "copy"]);
+  if (!validModes.has(mode)) {
+    throw new Error(`Unsupported skills install mode '${mode}'. Expected 'symlink' or 'copy'.`);
+  }
+
+  const available = listBundledSkills(packageRoot);
+  const wanted = skills.length ? skills : available;
+  const unknown = wanted.filter((skillName) => !available.includes(skillName));
+  if (unknown.length) {
+    throw new Error(`Unknown bundled skill(s): ${unknown.join(", ")}. Available: ${available.join(", ")}`);
+  }
+
+  const skillsDestRoot = getAgentSkillDest(agent, scope, cwd);
+  fs.mkdirSync(skillsDestRoot, { recursive: true });
+
+  const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+  const result = {
+    installed: [],
+    unchanged: [],
+    conflicts: [],
+    skipped: false,
+    destination: skillsDestRoot,
+    agent,
+    scope,
+    mode,
+  };
+
+  return withSkillInstallLock(skillsDestRoot, () => {
+    for (const skillName of wanted) {
+      const src = path.join(skillsSrc, skillName);
+      const dest = path.join(skillsDestRoot, skillName);
+      const installResult = installOneSkill(src, dest, { force, mode });
+      result[installResult.status === "conflict" ? "conflicts" : installResult.status].push(skillName);
+      if (installResult.status !== "conflict") {
+        writeSkillProvenance(skillsDestRoot, skillName, {
+          package: packageJson.name ?? null,
+          version: packageJson.version ?? null,
+          skill: skillName,
+          source: src,
+          destination: dest,
+          agent,
+          scope,
+          mode,
+          installed_at: new Date().toISOString(),
+        });
+      }
+    }
+
+    return result;
+  });
+}
+
+function parseSkillsCliArgs(args) {
+  const parsed = {
+    command: "help",
+    agent: "codex",
+    scope: "user",
+    mode: "symlink",
+    force: false,
+    json: false,
+    skills: [],
+  };
+  const rest = [...args];
+  if (rest.length && !rest[0].startsWith("-")) {
+    parsed.command = rest.shift();
+  }
+  for (let index = 0; index < rest.length; index += 1) {
+    const arg = rest[index];
+    const next = () => {
+      index += 1;
+      if (index >= rest.length) {
+        throw new Error(`Missing value for ${arg}`);
+      }
+      return rest[index];
+    };
+    switch (arg) {
+      case "--agent":
+      case "-a":
+        parsed.agent = next();
+        break;
+      case "--scope":
+      case "-s":
+        parsed.scope = next();
+        break;
+      case "--mode":
+      case "-m":
+        parsed.mode = next();
+        break;
+      case "--skill":
+        parsed.skills.push(next());
+        break;
+      case "--all":
+        parsed.agent = "all";
+        break;
+      case "--force":
+      case "-f":
+        parsed.force = true;
+        break;
+      case "--copy":
+        parsed.mode = "copy";
+        break;
+      case "--json":
+        parsed.json = true;
+        break;
+      case "--help":
+      case "-h":
+        parsed.command = "help";
+        break;
+      default:
+        if (arg.startsWith("-")) {
+          throw new Error(`Unknown option ${arg}`);
+        }
+        parsed.skills.push(arg);
+        break;
+    }
+  }
+  return parsed;
+}
+
+function printSkillsHelp() {
+  console.log(`Qingflow bundled skills
+
+Usage:
+  qingflow-skills list [--json]
+  qingflow-skills install [--agent codex|claude|claude-code|cursor|generic|all] [--scope user|project] [--mode symlink|copy] [--skill name] [--force] [--json]
+
+Examples:
+  qingflow-skills list
+  qingflow-skills install --agent codex --scope user
+  qingflow-skills install --agent claude-code --scope project --copy
+  qingflow-skills install --agent all --scope project
+
+Defaults:
+  --agent codex
+  --scope user
+  --mode symlink
+
+Existing skills are not overwritten unless --force is provided.`);
+}
+
+function printInstallSummary(result) {
+  console.log(`[qingflow-skills] destination: ${result.destination}`);
+  if (result.installed.length) {
+    console.log(`[qingflow-skills] installed: ${result.installed.join(", ")}`);
+  }
+  if (result.unchanged.length) {
+    console.log(`[qingflow-skills] unchanged: ${result.unchanged.join(", ")}`);
+  }
+  if (result.conflicts.length) {
+    console.log(`[qingflow-skills] conflicts: ${result.conflicts.join(", ")}`);
+    console.log("[qingflow-skills] Re-run with --force to replace conflicting skills.");
+  }
+}
+
+export function runSkillsCli(packageRoot, args) {
+  let parsed;
+  try {
+    parsed = parseSkillsCliArgs(args);
+    if (parsed.command === "help") {
+      printSkillsHelp();
+      return;
+    }
+    if (parsed.command === "list") {
+      const skills = listBundledSkills(packageRoot);
+      if (parsed.json) {
+        console.log(JSON.stringify({ skills }, null, 2));
+      } else {
+        for (const skill of skills) {
+          console.log(skill);
+        }
+      }
+      return;
+    }
+    if (parsed.command !== "install") {
+      throw new Error(`Unknown qingflow skills command '${parsed.command}'.`);
+    }
+
+    const agents = parsed.agent === "all" ? ["codex", "claude-code", "cursor", "generic"] : [parsed.agent];
+    const results = agents.map((agent) =>
+      installBundledSkills(packageRoot, {
+        agent,
+        scope: parsed.scope,
+        mode: parsed.mode,
+        force: parsed.force,
+        skills: parsed.skills,
+      }),
+    );
+    if (parsed.json) {
+      console.log(JSON.stringify({ results }, null, 2));
+    } else {
+      for (const result of results) {
+        printInstallSummary(result);
+      }
+    }
+    if (results.some((result) => result.conflicts.length)) {
+      process.exit(2);
+    }
+  } catch (error) {
+    if (parsed?.json) {
+      console.error(JSON.stringify({ error: error.message }, null, 2));
+    } else {
+      console.error(`[qingflow-skills] ${error.message}`);
+      console.error("Run 'qingflow-skills --help' for usage.");
+    }
+    process.exit(1);
+  }
 }
 
 export function getVenvDir(packageRoot) {
@@ -189,6 +536,17 @@ function getVenvPip(packageRoot) {
     : path.join(getVenvDir(packageRoot), "bin", "pip");
 }
 
+function findOfflineProjectWheel(findLinksDir) {
+  const wheels = fs
+    .readdirSync(findLinksDir)
+    .filter((name) => /^qingflow_mcp-.*\.whl$/i.test(name))
+    .sort();
+  if (wheels.length === 0) {
+    throw new Error(`Offline install expected a qingflow_mcp wheel in ${findLinksDir}`);
+  }
+  return path.join(findLinksDir, wheels[wheels.length - 1]);
+}
+
 export function findPython() {
   const preferred = process.env.QINGFLOW_MCP_PYTHON?.trim();
   const candidates = preferred
@@ -237,7 +595,20 @@ export function ensurePythonEnv(packageRoot, { force = false, commandName = "qin
   }
 
   const pip = getVenvPip(packageRoot);
-  runChecked(pip, ["install", "--disable-pip-version-check", "."], { cwd: packageRoot });
+  const pipArgs = ["install", "--disable-pip-version-check"];
+  const offlineFindLinks = process.env.QINGFLOW_MCP_PIP_FIND_LINKS?.trim();
+  if (process.env.QINGFLOW_MCP_PIP_NO_INDEX === "1") {
+    pipArgs.push("--no-index");
+  }
+  if (offlineFindLinks) {
+    pipArgs.push("--find-links", offlineFindLinks);
+  }
+  if (process.env.QINGFLOW_MCP_PIP_NO_INDEX === "1" && offlineFindLinks) {
+    pipArgs.push(findOfflineProjectWheel(offlineFindLinks));
+  } else {
+    pipArgs.push(".");
+  }
+  runChecked(pip, pipArgs, { cwd: packageRoot });
 
   fs.writeFileSync(
     stampPath,

package/npm/scripts/postinstall.mjs

@@ -6,9 +6,14 @@ try {
   console.log("[qingflow-mcp] Bootstrapping Python runtime...");
   ensurePythonEnv(packageRoot, { commandName: "qingflow" });
   console.log("[qingflow-mcp] Python runtime is ready.");
-  const skills = installBundledSkills(packageRoot);
+  const skills = installBundledSkills(packageRoot, { force: true });
   if (!skills.skipped) {
-    console.log(`[qingflow-mcp] Installed skills to ${skills.destination}: ${skills.installed.join(", ")}`);
+    const changed = [
+      skills.installed.length ? `installed=${skills.installed.join(",")}` : "",
+      skills.unchanged.length ? `unchanged=${skills.unchanged.join(",")}` : "",
+      skills.conflicts.length ? `conflicts=${skills.conflicts.join(",")}` : "",
+    ].filter(Boolean).join(" ");
+    console.log(`[qingflow-mcp] Installed skills to ${skills.destination}: ${changed || "none"}`);
   }
 } catch (error) {
   console.error(`[qingflow-mcp] postinstall failed: ${error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@josephyan/qingflow-cli",
-  "version": "1.0.11",
+  "version": "1.1.2",
   "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",
   "license": "MIT",
   "type": "module",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qingflow-mcp"
-version = "1.0.11"
+version = "1.1.2"
 description = "User-authenticated MCP server for Qingflow"
 readme = "README.md"
 license = "MIT"