@limecloud/cli 0.11.0 → 0.13.0

package/src/product-skills.mjs

@@ -5,13 +5,15 @@ import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { currentLocalizer, defaultLocale, localeRegistry, message, translate } from "./i18n.mjs";
 import { CLIError } from "./protocol.mjs";
 import { actionContract } from "./action-contracts.mjs";
-import { commandOperations, inspectSchema } from "./commands.mjs";
-import { attachContractCompatibility } from "./compatibility.mjs";
+import { commandOperations } from "./commands.mjs";
+import { compareActionContracts } from "./compatibility.mjs";
+import { skillContractDeclaration, skillContractPath, validSkillContractDeclaration } from "./product-skill-contracts.mjs";
+import { reviewSkillUpdate, skillActionAccess, skillEffect, validSkillAccess } from "./product-skill-access.mjs";
 
 export const skillWrappers = ["codex", "skill"];
 const httpMethods = new Set(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]);
 // 仅概括正式HTTP动作，供安装前审阅；不表示当前权或已获得人的确认。
-export const skillEffect = actions => actions.every(action => ["GET", "HEAD", "OPTIONS"].includes(action.method)) ? "read" : "write";
+export { skillEffect };
 const sha = value => `sha256:${createHash("sha256").update(value).digest("hex")}`;
 const canonical = value => Array.isArray(value) ? value.map(canonical) : value && typeof value === "object"
   ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value;
@@ -23,10 +25,11 @@ const invalid = () => { throw new CLIError("skill_artifact_invalid", message("sk
 
 // 只验证随已安装CLI提供的公开候选。摘要检查完整性，不构造独立发布证明或线上撤回结论。
 export function validateSkillBundle(bundle, { registry = localeRegistry, version, contract } = {}) {
-  if (bundle?.schema_version !== 1 || bundle.package !== "@limecloud/cli" || !/^\d+\.\d+\.\d+$/.test(bundle.version) ||
+  if (bundle?.schema_version !== 2 || bundle.package !== "@limecloud/cli" || !/^\d+\.\d+\.\d+$/.test(bundle.version) ||
       version && bundle.version !== version || !Array.isArray(bundle.artifacts) || bundle.artifacts.length > 32) invalid();
   const identities = new Set();
   const actions = contract && new Map(commandOperations(contract).map(operation => [operation.operationId, actionContract(contract, operation)]));
+  const access = contract && new Map(commandOperations(contract).map(operation => [operation.operationId, skillActionAccess(contract, operation)]));
   for (const artifact of bundle.artifacts) {
     if (!artifact || typeof artifact !== "object" || Array.isArray(artifact)) invalid();
     const identity = `${artifact.id}:${artifact.wrapper}`;
@@ -40,19 +43,27 @@ export function validateSkillBundle(bundle, { registry = localeRegistry, version
     // 同一CLI内混入另一份动作资料时先拒绝，不能拿当前Schema替候选悄悄解释旧步骤。
     if (new Set(artifact.operations.map(action => action.operation_id)).size !== artifact.operations.length || actions && artifact.operations.some(action =>
       !actions.has(action.operation_id) || JSON.stringify(canonical(action)) !== JSON.stringify(canonical(actions.get(action.operation_id))))) invalid();
+    if (!validSkillAccess(artifact.access_requirements, artifact.operations) || access && artifact.access_requirements.some(requirement =>
+      JSON.stringify(canonical(requirement)) !== JSON.stringify(canonical(access.get(requirement.operation_id))))) invalid();
     for (const { code } of registry.locales) {
       if (!["title", "description"].every(key => typeof artifact.localizations?.[code]?.[key] === "string" && artifact.localizations[code][key].trim())) invalid();
     }
     const prefix = artifact.wrapper === "codex" ? `skills/${artifact.id}/` : "";
+    if (artifact.action_contract_file !== skillContractPath(artifact.id, artifact.wrapper)) invalid();
     const paths = new Set();
     let bytes = 0;
     for (const file of artifact.files) {
       if (!file || !safePath(file.path) || paths.has(file.path) || typeof file.content !== "string" || !/\.(?:md|json)$/.test(file.path) ||
-          !(file.path === "plugin.json" && artifact.wrapper === "codex" || file.path === `${prefix}SKILL.md` || file.path.startsWith(`${prefix}references/`) && file.path.endsWith(".md")) ||
+          !(file.path === "plugin.json" && artifact.wrapper === "codex" || file.path === artifact.action_contract_file || file.path === `${prefix}SKILL.md` || file.path.startsWith(`${prefix}references/`) && file.path.endsWith(".md")) ||
           Buffer.byteLength(file.content) !== file.bytes || file.sha256 !== sha(file.content) || file.bytes > 131072) invalid();
       paths.add(file.path); bytes += file.bytes;
     }
     if (bytes > 524288 || !paths.has(`${prefix}SKILL.md`) || artifact.wrapper === "codex" && !paths.has("plugin.json") || artifact.digest !== skillArtifactDigest(artifact)) invalid();
+    let declaration;
+    try { declaration = JSON.parse(artifact.files.find(file => file.path === artifact.action_contract_file)?.content ?? ""); } catch { invalid(); }
+    if (!validSkillContractDeclaration(declaration, artifact) || JSON.stringify(canonical(declaration)) !== JSON.stringify(canonical(skillContractDeclaration({
+      ...artifact, files: artifact.files.filter(file => file.path !== artifact.action_contract_file),
+    })))) invalid();
     const entry = artifact.files.find(file => file.path === `${prefix}SKILL.md`).content;
     const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(entry)?.[1];
     if (!frontmatter || /^name:\s*([a-z0-9-]+)\s*$/m.exec(frontmatter)?.[1] !== artifact.id || !/^description:\s*\S.+$/m.test(frontmatter)) invalid();
@@ -86,18 +97,27 @@ export function describeSkill(artifact, { includeFiles = false } = {}) {
     installation: { performed_by_this_command: false, on_disk: "not-evaluated", current_session_loaded: "unknown" }, message: translate("skills.candidateNotice") };
 }
 
-export async function inspectSkill(artifact, contract, options = {}) {
+export async function inspectSkill(artifact, options = {}) {
   const description = describeSkill(artifact, { includeFiles: true });
+  if (options.directoryInspection) {
+    description.directory_comparison = options.directoryInspection;
+    description.update_review = reviewSkillUpdate(artifact, options.directoryInspection.action_contracts);
+    description.installation.on_disk = "explicit-directory-inspected";
+    description.message = translate("skills.directoryNotice");
+  }
   if (!options.online) return description;
-  const methods = artifact.operations.map(action => inspectSchema(contract, [action.operation_id]));
-  const checked = await attachContractCompatibility(methods, contract, options);
-  const actions = checked.map(method => ({ operation_id: method._meta.operationId, contract_revision: method._meta.contract_revision,
-    ...method._meta.compatibility }));
-  const statuses = new Set(actions.map(action => action.status));
-  return { ...description, compatibility: { ...description.compatibility,
-    remote: statuses.has("different") ? "different" : statuses.has("absent") ? "absent" : statuses.has("unknown") ? "unknown" : "matched",
-    complete: !statuses.has("unknown"), checked_at: new Date((options.now ?? Date.now)()).toISOString(), actions },
-    message: translate("skills.onlineNotice") };
+  const installed = description.directory_comparison?.action_contracts;
+  const installedActions = installed?.status === "declared" ? installed.operations : [];
+  const checked = await compareActionContracts([...artifact.operations, ...installedActions], options);
+  const summarize = checked => {
+    const actions = checked.map(({ compatibility, ...identity }) => ({ ...identity, ...compatibility }));
+    const statuses = new Set(actions.map(action => action.status));
+    return { remote: statuses.has("different") ? "different" : statuses.has("absent") ? "absent" : statuses.has("unknown") ? "unknown" : "matched",
+      complete: !statuses.has("unknown"), checked_at: new Date((options.now ?? Date.now)()).toISOString(), authorization: "not-evaluated", actions };
+  };
+  if (installedActions.length) installed.compatibility = summarize(checked.slice(artifact.operations.length));
+  return { ...description, compatibility: { ...description.compatibility, ...summarize(checked.slice(0, artifact.operations.length)) },
+    message: translate(installed ? "skills.directoryOnlineNotice" : "skills.onlineNotice") };
 }
 
 async function physicalDirectory(path) {

package/src/release-version.mjs

@@ -0,0 +1,13 @@
+// npm渠道和安装目标只接受本项目正式的三段版本，不接受标签、范围或预发行串。
+export function releaseVersion(value) {
+  if (typeof value !== "string" || value.length > 64 || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(value)) return null;
+  const parts = value.split(".").map(Number);
+  return parts.every(Number.isSafeInteger) ? parts : null;
+}
+
+export function compareReleaseVersions(left, right) {
+  const a = releaseVersion(left), b = releaseVersion(right);
+  if (!a || !b) throw new Error("Invalid release version");
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return a[i] > b[i] ? 1 : -1;
+  return 0;
+}

package/src/update.mjs

@@ -0,0 +1,57 @@
+import { message, translate } from "./i18n.mjs";
+import { success } from "./output.mjs";
+import { CLIError } from "./protocol.mjs";
+import { fetchPublicJSON } from "./public-json.mjs";
+import { compareReleaseVersions, releaseVersion } from "./release-version.mjs";
+import { cliRegistry } from "./distribution.mjs";
+
+export const cliUpdateURL = `${cliRegistry}/@limecloud%2fcli/latest`;
+const reasonMessages = { registry_unavailable: "registryUnavailable", invalid_metadata: "invalidMetadata", latest_deprecated: "latestDeprecated" };
+
+// latest是渠道推荐的观察，不是业务合同、发布者证明或本地安装来源的证明。
+export async function checkCLIUpdate(version, { fetchMetadata = fetchPublicJSON, signal, now = Date.now } = {}) {
+  if (!releaseVersion(version)) throw new CLIError("invalid_arguments", message("install.invalidVersion"));
+  signal?.throwIfAborted();
+  const result = { package: "@limecloud/cli", current_version: version, registry: cliRegistry, channel: "latest", metadata_url: cliUpdateURL,
+    status: "unknown", reason: null, latest_version: null, observed_at: null, candidate: null,
+    installation_performed: false, installation_owner: "unknown", methods_updated: 0, current_session_loaded: "unknown",
+    provenance: "not-evaluated", online_withdrawal: "not-evaluated", compatibility: "not-evaluated", authorization: "not-evaluated" };
+  let metadata;
+  try { metadata = await fetchMetadata(cliUpdateURL, { signal, maxBytes: 256 * 1024 }); }
+  catch {
+    signal?.throwIfAborted();
+    result.reason = "registry_unavailable";
+  }
+  signal?.throwIfAborted();
+  result.observed_at = new Date(now()).toISOString();
+  if (!result.reason) {
+    if (!metadata || typeof metadata !== "object" || Array.isArray(metadata) || metadata.name !== result.package || !releaseVersion(metadata.version) ||
+        metadata.deprecated !== undefined && typeof metadata.deprecated !== "string") result.reason = "invalid_metadata";
+    else {
+      result.latest_version = metadata.version;
+      if (metadata.deprecated) { result.status = "unavailable"; result.reason = "latest_deprecated"; }
+      else {
+        const comparison = compareReleaseVersions(metadata.version, version);
+        result.status = comparison > 0 ? "available" : comparison < 0 ? "ahead" : "current";
+        if (comparison > 0) result.candidate = { version: metadata.version, package_spec: `@limecloud/cli@${metadata.version}`,
+          // 固定argv只预览现有安装器；不执行元数据提供的命令/URL，也不推定当前安装前缀。
+          review_argv: ["npx", `--registry=${cliRegistry}`, `--@limecloud:registry=${cliRegistry}`, "--ignore-scripts",
+            `@limecloud/cli@${metadata.version}`, "install", "--dry-run", "--no-config"] };
+      }
+    }
+  }
+  result.message = translate(`update.${reasonMessages[result.reason] ?? result.status}`);
+  result.next_steps = [translate("update.owner"), translate("update.methods"), translate("update.recovery")];
+  return result;
+}
+
+export function writeUpdateCheck(io, result, format) {
+  if (format !== "table") { success(io, result, { identity: "local", format }); return; }
+  const rows = [
+    ["currentVersion", result.current_version], ["latestVersion", result.latest_version], ["source", result.metadata_url],
+    ["observedAt", result.observed_at], ["result", `${result.status}${result.reason ? ` / ${result.reason}` : ""}: ${result.message}`],
+    ...(result.candidate ? [["review", JSON.stringify(result.candidate.review_argv)]] : []),
+    ...result.next_steps.map(value => ["nextStep", value]),
+  ];
+  success(io, rows.map(([key, value]) => ({ field: translate(`update.${key}`), value: value === null ? "null" : value })), { identity: "local", format, tableTruncate: false });
+}