@maxiaochao/pi-toolkit 0.8.0 → 0.8.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/README.md +1 -1
  3. package/package.json +1 -1
  4. package/skills/agent-team/SKILL.md +0 -2
  5. package/skills/herdr/NOTICE +6 -5
  6. package/skills/herdr/SKILL.md +2 -2
  7. package/skills/tapd/SKILL.md +12 -0
package/CHANGELOG.md CHANGED
@@ -1,3 +1,11 @@
1
+ ## 2026-09-24 - v0.8.2
2
+
3
+ - tapd skill: document the safe attachment-download flow for the short-lived signed URLs (re-fetch the URL for every attempt, download to .part with curl --fail --location --retry 3, reject text/error bodies before resuming, accept only 206 with a matching Content-Range, then verify size and zip integrity before renaming); it is a local addition on top of the `tapd skill init` output, recorded in AGENTS.md
4
+
5
+ ## 2026-09-24 - v0.8.1
6
+
7
+ - lowercase the herdr skill name in its description and H1 (a deliberate local edit over the upstream v0.9.1 copy, now recorded in NOTICE, README and AGENTS.md); drop the stale `herdr --skill` pointer from the agent-team skill
8
+
1
9
  ## 2026-09-24 - v0.8.0
2
10
 
3
11
  - add the agent-team skill: cross-vendor adversarial review in herdr panes, with the model roster in skills/agent-team/models.json
package/README.md CHANGED
@@ -85,7 +85,7 @@ The bundled `show-me` skill (derived from [humanlayer/skills](https://github.com
85
85
 
86
86
  The bundled `pdlog` skill decompresses and reads Pudu `.pdlog` proprietary log files, which are binary gibberish when opened directly. It ships a self-contained `ppmd` decompressor (`skills/pdlog/tools/ppmd`, Linux x86-64) and triggers automatically on `.pdlog` files, Pudu logs, ppmd decompression, or logs that open as binary gibberish.
87
87
 
88
- The bundled `herdr` skill (copied verbatim from [herdrdev/herdr](https://github.com/herdrdev/herdr) at tag `v0.9.1`, Apache-2.0) drives Herdr, a terminal multiplexer for coding agents: inspecting workspaces, tabs, and panes, starting and prompting other agents, running commands in background panes without stealing focus, reading pane output, and waiting on agent lifecycle states. It activates only when you explicitly mention Herdr, and only when the agent itself runs inside a Herdr pane (`HERDR_ENV=1`); outside a pane it refuses to control the session and stops.
88
+ The bundled `herdr` skill (from [herdrdev/herdr](https://github.com/herdrdev/herdr) at tag `v0.9.1` with the skill name lowercased, Apache-2.0) drives Herdr, a terminal multiplexer for coding agents: inspecting workspaces, tabs, and panes, starting and prompting other agents, running commands in background panes without stealing focus, reading pane output, and waiting on agent lifecycle states. It activates only when you explicitly mention Herdr, and only when the agent itself runs inside a Herdr pane (`HERDR_ENV=1`); outside a pane it refuses to control the session and stops.
89
89
 
90
90
  The bundled `tapd` skill documents the third-party `tapd` CLI ([studyzy/tapd-ai-cli](https://github.com/studyzy/tapd-ai-cli)) for TAPD: requirements, defects, tasks, iterations, wikis, comments, attachments, timesheets, and workflow status maps, including the `--filter` advanced query syntax. It is the CLI's own command reference, so refresh the file with `tapd skill init` when the CLI changes.
91
91
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@maxiaochao/pi-toolkit",
3
- "version": "0.8.0",
3
+ "version": "0.8.2",
4
4
  "description": "Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.",
5
5
  "type": "module",
6
6
  "keywords": [
package/skills/agent-team/SKILL.md CHANGED
@@ -6,8 +6,6 @@ disable-model-invocation: true
6
6
 
7
7
  当前会话是**管理者**，不是转述人：自己也承担一份实证工作，并对每一轮的裁决负责。队员是长驻的 herdr pane，不是一次性 subagent —— 它们要能被反复追问、被点名互相反驳。
8
8
 
9
- herdr 的完整 CLI 语义在 `herdr --skill`，本文只写这套协作协议。
10
-
11
9
  ## 何时值得开
12
10
 
13
11
  只在用户要求组队时开，它会在用户的终端里真的分屏。值得开的条件：结论会驱动一个代价高的动作（改内核、下线设备、向客户定责），或者证据链已经长到单模型会自我确认。查一个事实、读一份文件用不上。
package/skills/herdr/NOTICE CHANGED
@@ -1,12 +1,13 @@
1
1
  Herdr Skill
2
2
 
3
- This directory is copied verbatim from the Herdr repository:
3
+ This directory is based on the Herdr repository:
4
4
  https://github.com/herdrdev/herdr (skills/herdr/SKILL.md, tag v0.9.1)
5
5
 
6
6
  The upstream repository is licensed under Apache License 2.0. A copy of that
7
7
  license is included in LICENSE.
8
8
 
9
- pi-toolkit ships the file unchanged, so the installed skill always matches the
10
- stable Herdr release it was taken from. Upstream updates SKILL.md only on stable
11
- releases; to refresh it, copy skills/herdr/SKILL.md and LICENSE from a newer
12
- Herdr tag and update the tag above.
9
+ pi-toolkit ships the file with one deliberate local edit: the skill name is
10
+ lowercased ("Herdr" -> "herdr") in the frontmatter description and the H1.
11
+ Everything else matches tag v0.9.1 byte for byte. Upstream updates SKILL.md only
12
+ on stable releases; to refresh it, copy skills/herdr/SKILL.md and LICENSE from a
13
+ newer Herdr tag, update the tag above, and re-apply the lowercase edit.
package/skills/herdr/SKILL.md CHANGED
@@ -1,9 +1,9 @@
1
1
  ---
2
2
  name: herdr
3
- description: "Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1."
3
+ description: "Control herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1."
4
4
  ---
5
5
 
6
- # Herdr
6
+ # herdr
7
7
 
8
8
  Herdr organizes terminals into workspaces, tabs, and panes, recognizes coding agents running inside panes, and exposes the current session through the `herdr` CLI.
9
9
 
package/skills/tapd/SKILL.md CHANGED
@@ -280,6 +280,18 @@ tapd attachment download --id=<必需> # 获取附件下载链接
280
280
  tapd attachment upload --custom-field=<必需> --entry-id=<必需> --file=<必需> --type=<如 story_custom_field> # 上传附件
281
281
  ```
282
282
 
283
+ #### 安全下载附件
284
+
285
+ `attachment download` 返回的是带短期授权 token 的临时 URL，不是附件内容。下载大附件时必须遵循以下流程：
286
+
287
+ 1. 先用 `attachment list` 记录附件文件名和预期大小；每次发起下载或续传前，重新执行 `attachment download` 获取新 URL。
288
+ 2. 下载到 `<文件名>.part`，使用 `curl --fail --location --retry 3`；HTTP 失败时立即停止，禁止把响应正文直接写入最终文件。
289
+ 3. 续传前检查 `.part` 开头不是 `token expire`、JSON/HTML 错误信息等文本响应。发现污染时删除 `.part` 并重新下载，不修补或继续追加。
290
+ 4. 使用新 URL 和 `curl -C -` 续传。已有部分长度为 N 时，只接受状态 `206` 且 `Content-Range` 从 N 开始；返回 `200`、范围不符或服务器不支持 Range 时，删除 `.part` 后从头下载。
291
+ 5. 下载完成后，文件大小必须等于 `attachment list` 的预期大小。ZIP 附件还必须通过 `unzip -t`；其他格式执行相应完整性检查。全部通过后才将 `.part` 重命名为最终文件。
292
+
293
+ 临时 URL 过期只需重新获取链接，不能据此判断 TAPD 原附件损坏。
294
+
283
295
  ### baseline — 基线管理
284
296
 
285
297
  ```bash