@josephyan/qingflow-cli 1.1.3 → 1.1.5

package/README.md

@@ -3,13 +3,13 @@
 Install:
 
 ```bash
-npm install @josephyan/qingflow-cli@1.1.3
+npm install @josephyan/qingflow-cli@1.1.5
 ```
 
 Run:
 
 ```bash
-npx -y -p @josephyan/qingflow-cli@1.1.3 qingflow
+npx -y -p @josephyan/qingflow-cli@1.1.5 qingflow
 ```
 
 Environment:
@@ -23,9 +23,13 @@ This package bootstraps a local Python runtime on first install and then starts
 Bundled skills:
 
 - `skills/qingflow-cli`
+- `skills/qingflow-mcp-setup`
 
 Note:
 
 - The skill files are included in the npm package.
-- On install, the package copies them to `$CODEX_HOME/skills` (or `~/.codex/skills` if `CODEX_HOME` is unset).
+- Installing the npm package does not overwrite agent skills automatically.
+- To mount bundled skills from an installed package, run `qingflow-skills install --agent codex --scope user`.
+- For one-shot `npx -p` installs, prefer `--copy` because symlinks would point into the npm execution cache.
+- Use `qingflow-skills list` to inspect bundled skills. The installer defaults to symlinks for stable package installs and refuses to overwrite existing skills unless `--force` is provided.
 - If a stdio MCP client reports `Transport closed`, delete `.npm-python`, reinstall the package, and make sure CLI/user/builder packages are on the same version. The stdio entrypoints refuse runtime bootstrap so install logs never corrupt MCP stdout.

package/docs/local-agent-install.md

@@ -101,7 +101,51 @@ npm install /absolute/path/to/dist/npm/qingflow-tech-qingflow-app-builder-mcp-<v
 1. 创建 `.npm-python/`
 2. 在其中建立 Python 虚拟环境
 3. 执行 `pip install .`
-4. 在安装位置暴露 `qingflow`、`qingflow-app-user-mcp`、`qingflow-app-builder-mcp` 命令
+4. 在安装位置暴露对应入口：CLI 包暴露 `qingflow` / `qingflow-skills`；app-user 包暴露 `qingflow-app-user-mcp` / `qingflow-app-user-mcp-skills`；app-builder 包暴露 `qingflow-app-builder-mcp` / `qingflow-app-builder-mcp-skills`
+5. 携带 `skills/<skill-name>/SKILL.md`，但不在 `postinstall` 阶段自动覆盖本机 agent skills
+
+## Skills 挂载
+
+显式查看包内 skills：
+
+```bash
+qingflow-skills list
+```
+
+独立 MCP split 包使用包专属 skills 命令，避免全局安装多个包时发生 bin 覆盖：
+
+```bash
+qingflow-app-user-mcp-skills list
+qingflow-app-builder-mcp-skills list
+```
+
+显式挂载到 Codex 用户目录：
+
+```bash
+qingflow-skills install --agent codex --scope user
+```
+
+如果通过一次性 `npx -p <package>` 执行安装，请加 `--copy`，避免 symlink 指向 npm 临时执行缓存：
+
+```bash
+npx -y -p @qingflow-tech/qingflow-cli qingflow-skills install --agent codex --scope user --copy
+```
+
+也可以挂载到项目级 agent 目录：
+
+```bash
+qingflow-skills install --agent claude-code --scope project
+qingflow-skills install --agent cursor --scope project --copy
+qingflow-skills install --agent all --scope project
+```
+
+默认行为：
+
+- `--mode symlink`：使用 symlink，让 npm 包版本成为单一来源
+- `--scope user`：安装到用户级 agent skills 目录
+- `--agent codex`：目标 agent 为 Codex
+- 不覆盖已有同名 skill；需要替换时显式加 `--force`
+- 每次安装会在目标 skills 目录下写入 `.qingflow-skill-sources/<skill>.json`，记录 package、version、source、destination、agent、scope、mode
 
 ## 本地验证
 
@@ -110,24 +154,31 @@ npm install /absolute/path/to/dist/npm/qingflow-tech-qingflow-app-builder-mcp-<v
 ```bash
 cd qingflow-support/mcp-server
 node ./npm/bin/qingflow.mjs --help
+node ./npm/bin/qingflow-skills.mjs list
 node ./npm/bin/qingflow-app-user-mcp.mjs
 node ./npm/bin/qingflow-app-builder-mcp.mjs
 ```
 
-如果你是全局安装：
+如果你是全局安装对应包：
 
 ```bash
 qingflow --help
+qingflow-skills list
 qingflow-app-user-mcp
+qingflow-app-user-mcp-skills list
 qingflow-app-builder-mcp
+qingflow-app-builder-mcp-skills list
 ```
 
-如果你是把包安装到了某个本地 agent workspace，命令通常位于：
+如果你是把包安装到了某个本地 agent workspace，安装对应包后命令通常位于：
 
 ```bash
 /absolute/path/to/agent-workspace/node_modules/.bin/qingflow
+/absolute/path/to/agent-workspace/node_modules/.bin/qingflow-skills
 /absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-user-mcp
+/absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-user-mcp-skills
 /absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-builder-mcp
+/absolute/path/to/agent-workspace/node_modules/.bin/qingflow-app-builder-mcp-skills
 ```
 
 如果你是从 tgz 安装到某个空目录，命令通常位于：
@@ -217,7 +268,7 @@ qingflow-app-builder-mcp
       "command": "npx",
       "args": [
         "-y",
-        "@josephyan/qingflow-app-user-mcp"
+        "@qingflow-tech/qingflow-app-user-mcp"
       ],
       "env": {
         "QINGFLOW_MCP_DEFAULT_BASE_URL": "https://qingflow.com/api",
@@ -230,7 +281,7 @@ qingflow-app-builder-mcp
       "command": "npx",
       "args": [
         "-y",
-        "@josephyan/qingflow-app-builder-mcp"
+        "@qingflow-tech/qingflow-app-builder-mcp"
       ],
       "env": {
         "QINGFLOW_MCP_DEFAULT_BASE_URL": "https://qingflow.com/api",
@@ -272,7 +323,7 @@ npm install
 
 如果 MCP 客户端一调用工具就报 `Transport closed`，优先检查这几件事：
 
-1. 不要混用不同版本的 `@josephyan/qingflow-cli`、`@josephyan/qingflow-app-user-mcp`、`@josephyan/qingflow-app-builder-mcp`
+1. 不要混用不同版本的 `@qingflow-tech/qingflow-cli`、`@qingflow-tech/qingflow-app-user-mcp`、`@qingflow-tech/qingflow-app-builder-mcp`
 2. 删除安装目录下的 `.npm-python`
 3. 重新执行 `npm install` 或重新安装对应 tgz/npm 包
 4. 再启动 MCP 客户端

package/entry_point.py

@@ -7,7 +7,7 @@ src_path = os.path.abspath(os.path.join(os.path.dirname(__file__), "src"))
 if src_path not in sys.path:
     sys.path.insert(0, src_path)
 
-from qingflow_mcp.server import main
+from qingflow_mcp.server_app_user import main
 
 if __name__ == "__main__":
     main()

package/npm/bin/qingflow-skills.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { getPackageRoot, runSkillsCli } from "../lib/runtime.mjs";
+
+const packageRoot = getPackageRoot(import.meta.url);
+runSkillsCli(packageRoot, process.argv.slice(2));

package/npm/bin/qingflow.mjs

@@ -1,39 +1,6 @@
 #!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawnServer, getPackageRoot, runSkillsCli } from "../lib/runtime.mjs";
 
-const PKG_BY_BIN = {
-  qingflow: "qingflow-cli",
-  "qingflow-app-user-mcp": "qingflow-app-user-mcp",
-  "qingflow-app-builder-mcp": "qingflow-app-builder-mcp",
-};
-
-function resolvePackageModule(metaUrl, ...segments) {
-  const scriptPath = fileURLToPath(metaUrl);
-  const scriptDir = path.dirname(scriptPath);
-  // bin files live in <pkg>/npm/bin/, runtime.mjs lives in the sibling <pkg>/npm/lib/,
-  // so step up one level before joining the requested segments.
-  const direct = path.join(scriptDir, "..", ...segments);
-  if (fs.existsSync(direct)) {
-    return pathToFileURL(direct).href;
-  }
-  if (path.basename(scriptDir) === ".bin") {
-    const binName = path.basename(scriptPath);
-    const pkgName = PKG_BY_BIN[binName];
-    if (!pkgName) {
-      throw new Error(`Unknown qingflow command: ${binName}`);
-    }
-    const scope = process.env.QINGFLOW_NPM_SCOPE || "@josephyan";
-    const fromBin = path.join(scriptDir, "..", scope, pkgName, "npm", ...segments);
-    if (fs.existsSync(fromBin)) {
-      return pathToFileURL(fromBin).href;
-    }
-  }
-  throw new Error(`Cannot locate ${segments.join("/")} from ${scriptPath}`);
-}
-
-const { getPackageRoot, spawnServer, runSkillsCli } = await import(resolvePackageModule(import.meta.url, "lib", "runtime.mjs"));
 const packageRoot = getPackageRoot(import.meta.url);
 const args = process.argv.slice(2);
 if (args[0] === "skills") {

package/npm/lib/runtime.mjs

@@ -5,12 +5,6 @@ import { fileURLToPath } from "node:url";
 
 const WINDOWS = process.platform === "win32";
 
-const PKG_BY_BIN = {
-  qingflow: "qingflow-cli",
-  "qingflow-app-user-mcp": "qingflow-app-user-mcp",
-  "qingflow-app-builder-mcp": "qingflow-app-builder-mcp",
-};
-
 function runChecked(command, args, options = {}) {
   const result = spawnSync(command, args, {
     encoding: "utf8",
@@ -34,18 +28,7 @@ function commandWorks(command, args) {
 }
 
 export function getPackageRoot(metaUrl) {
-  const scriptPath = fileURLToPath(metaUrl);
-  const scriptDir = path.dirname(scriptPath);
-  if (path.basename(scriptDir) === ".bin") {
-    const binName = path.basename(scriptPath);
-    const pkgName = PKG_BY_BIN[binName];
-    if (!pkgName) {
-      throw new Error(`Unknown qingflow command: ${binName}`);
-    }
-    const scope = process.env.QINGFLOW_NPM_SCOPE || "@josephyan";
-    return path.join(scriptDir, "..", scope, pkgName);
-  }
-  return path.resolve(scriptDir, "..", "..");
+  return path.resolve(path.dirname(fileURLToPath(metaUrl)), "..", "..");
 }
 
 export function getCodexHome() {
@@ -154,43 +137,6 @@ function writeSkillProvenance(skillsDestRoot, skillName, payload) {
   fs.writeFileSync(path.join(provenanceRoot, `${skillName}.json`), `${JSON.stringify(payload, null, 2)}\n`);
 }
 
-function sleepMs(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-
-function withSkillInstallLock(skillsDestRoot, callback) {
-  const lockDir = path.join(skillsDestRoot, ".qingflow-skill-install.lock");
-  const startedAt = Date.now();
-  while (true) {
-    try {
-      fs.mkdirSync(lockDir);
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST") {
-        throw error;
-      }
-      try {
-        const stat = fs.statSync(lockDir);
-        if (Date.now() - stat.mtimeMs > 300_000) {
-          fs.rmSync(lockDir, { recursive: true, force: true });
-          continue;
-        }
-      } catch {
-        continue;
-      }
-      if (Date.now() - startedAt > 30_000) {
-        throw new Error(`Timed out waiting for skill install lock: ${lockDir}`);
-      }
-      sleepMs(100);
-    }
-  }
-  try {
-    return callback();
-  } finally {
-    fs.rmSync(lockDir, { recursive: true, force: true });
-  }
-}
-
 export function installBundledSkills(
   packageRoot,
   {
@@ -234,29 +180,27 @@ export function installBundledSkills(
     mode,
   };
 
-  return withSkillInstallLock(skillsDestRoot, () => {
-    for (const skillName of wanted) {
-      const src = path.join(skillsSrc, skillName);
-      const dest = path.join(skillsDestRoot, skillName);
-      const installResult = installOneSkill(src, dest, { force, mode });
-      result[installResult.status === "conflict" ? "conflicts" : installResult.status].push(skillName);
-      if (installResult.status !== "conflict") {
-        writeSkillProvenance(skillsDestRoot, skillName, {
-          package: packageJson.name ?? null,
-          version: packageJson.version ?? null,
-          skill: skillName,
-          source: src,
-          destination: dest,
-          agent,
-          scope,
-          mode,
-          installed_at: new Date().toISOString(),
-        });
-      }
+  for (const skillName of wanted) {
+    const src = path.join(skillsSrc, skillName);
+    const dest = path.join(skillsDestRoot, skillName);
+    const installResult = installOneSkill(src, dest, { force, mode });
+    result[installResult.status === "conflict" ? "conflicts" : installResult.status].push(skillName);
+    if (installResult.status !== "conflict") {
+      writeSkillProvenance(skillsDestRoot, skillName, {
+        package: packageJson.name ?? null,
+        version: packageJson.version ?? null,
+        skill: skillName,
+        source: src,
+        destination: dest,
+        agent,
+        scope,
+        mode,
+        installed_at: new Date().toISOString(),
+      });
     }
+  }
 
-    return result;
-  });
+  return result;
 }
 
 function parseSkillsCliArgs(args) {
@@ -536,17 +480,6 @@ function getVenvPip(packageRoot) {
     : path.join(getVenvDir(packageRoot), "bin", "pip");
 }
 
-function findOfflineProjectWheel(findLinksDir) {
-  const wheels = fs
-    .readdirSync(findLinksDir)
-    .filter((name) => /^qingflow_mcp-.*\.whl$/i.test(name))
-    .sort();
-  if (wheels.length === 0) {
-    throw new Error(`Offline install expected a qingflow_mcp wheel in ${findLinksDir}`);
-  }
-  return path.join(findLinksDir, wheels[wheels.length - 1]);
-}
-
 export function findPython() {
   const preferred = process.env.QINGFLOW_MCP_PYTHON?.trim();
   const candidates = preferred
@@ -595,20 +528,7 @@ export function ensurePythonEnv(packageRoot, { force = false, commandName = "qin
   }
 
   const pip = getVenvPip(packageRoot);
-  const pipArgs = ["install", "--disable-pip-version-check"];
-  const offlineFindLinks = process.env.QINGFLOW_MCP_PIP_FIND_LINKS?.trim();
-  if (process.env.QINGFLOW_MCP_PIP_NO_INDEX === "1") {
-    pipArgs.push("--no-index");
-  }
-  if (offlineFindLinks) {
-    pipArgs.push("--find-links", offlineFindLinks);
-  }
-  if (process.env.QINGFLOW_MCP_PIP_NO_INDEX === "1" && offlineFindLinks) {
-    pipArgs.push(findOfflineProjectWheel(offlineFindLinks));
-  } else {
-    pipArgs.push(".");
-  }
-  runChecked(pip, pipArgs, { cwd: packageRoot });
+  runChecked(pip, ["install", "--disable-pip-version-check", "."], { cwd: packageRoot });
 
   fs.writeFileSync(
     stampPath,

package/npm/scripts/postinstall.mjs

@@ -1,4 +1,4 @@
-import { ensurePythonEnv, getPackageRoot, installBundledSkills } from "../lib/runtime.mjs";
+import { ensurePythonEnv, getPackageRoot } from "../lib/runtime.mjs";
 
 const packageRoot = getPackageRoot(import.meta.url);
 
@@ -6,15 +6,6 @@ try {
   console.log("[qingflow-mcp] Bootstrapping Python runtime...");
   ensurePythonEnv(packageRoot, { commandName: "qingflow" });
   console.log("[qingflow-mcp] Python runtime is ready.");
-  const skills = installBundledSkills(packageRoot, { force: true });
-  if (!skills.skipped) {
-    const changed = [
-      skills.installed.length ? `installed=${skills.installed.join(",")}` : "",
-      skills.unchanged.length ? `unchanged=${skills.unchanged.join(",")}` : "",
-      skills.conflicts.length ? `conflicts=${skills.conflicts.join(",")}` : "",
-    ].filter(Boolean).join(" ");
-    console.log(`[qingflow-mcp] Installed skills to ${skills.destination}: ${changed || "none"}`);
-  }
 } catch (error) {
   console.error(`[qingflow-mcp] postinstall failed: ${error.message}`);
   process.exit(1);

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@josephyan/qingflow-cli",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",
   "license": "MIT",
   "type": "module",
   "bin": {
-    "qingflow": "./npm/bin/qingflow.mjs"
+    "qingflow": "./npm/bin/qingflow.mjs",
+    "qingflow-skills": "./npm/bin/qingflow-skills.mjs"
   },
   "scripts": {
     "postinstall": "node ./npm/scripts/postinstall.mjs"

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qingflow-mcp"
-version = "1.1.3"
+version = "1.1.5"
 description = "User-authenticated MCP server for Qingflow"
 readme = "README.md"
 license = "MIT"