@metagptx/deepflow-suite-cli 0.1.2 → 0.2.3

package/README.md

@@ -13,10 +13,21 @@ deepflow-suite install --source package
 deepflow-suite doctor --source package --json
 ```
 
-The package installation mode copies the seven bundled Skills into
-`$CODEX_HOME/skills` (or `~/.codex/skills`). Use `--target` to choose another
-Skill directory and `--force` only when replacing an existing installation is
-intentional.
+The public package includes the `deepflow-suite` entrypoint, the five service
+CLI launchers (`df-workbench`, `df-task`, `df-taskdriver`, `df-agentctrl`, and
+`df-agentrt`), and seven bundled Skills. npm automatically selects the matching
+runtime package for `darwin-arm64`, `darwin-x64`, `linux-arm64`, `linux-x64`, or
+`win32-x64`; the user does not need a DeepFlow checkout, Go, or Make.
+
+`install --source package` copies the seven Skills into `$CODEX_HOME/skills`
+(or `~/.codex/skills`) and verifies all six command launchers plus the selected
+runtime package. `doctor --source package --json` reports the same complete
+distribution check. Use `--target` to choose another Skill directory and
+`--force` only when replacing an existing installation is intentional.
+
+If npm is run with `--omit=optional`, package installation fails before changing
+the Skill directory and reports the missing platform runtime package. Reinstall
+without `--omit=optional` to obtain the four Go-backed CLIs.
 
 ## Workspace development
 
@@ -40,10 +51,14 @@ The package is prepared for public scoped publication like Console CLI:
 
 ```bash
 npm run test
+npm run build:runtime
+npm run check:runtime
 npm run pack:dry-run
 npm publish
 ```
 
-`prepack` materializes the seven Skill bundle and its release manifest. The
-published `deepflow-suite` command never overwrites an existing Skill or CLI
-file without `--force`.
+Publish the five platform runtime packages before publishing the main package;
+all six entrypoints and platform packages must use the same version. `prepack`
+materializes the seven Skill bundle, the Workbench Node entrypoint, and the
+runtime release metadata. The published installer never overwrites an existing
+Skill or CLI file without `--force`.

package/bin/df-agentctrl.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { runRuntimeCli } from "../src/cli-launcher.mjs";
+
+try {
+  process.exitCode = await runRuntimeCli("df-agentctrl", process.argv.slice(2));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/bin/df-agentrt.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { runRuntimeCli } from "../src/cli-launcher.mjs";
+
+try {
+  process.exitCode = await runRuntimeCli("df-agentrt", process.argv.slice(2));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/bin/df-task.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { runRuntimeCli } from "../src/cli-launcher.mjs";
+
+try {
+  process.exitCode = await runRuntimeCli("df-task", process.argv.slice(2));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/bin/df-taskdriver.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { runRuntimeCli } from "../src/cli-launcher.mjs";
+
+try {
+  process.exitCode = await runRuntimeCli("df-taskdriver", process.argv.slice(2));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/bin/df-workbench.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { runWorkbench } from "../src/cli-launcher.mjs";
+
+try {
+  process.exitCode = await runWorkbench(process.argv.slice(2));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/bundle/deepflow-release.json

@@ -2,13 +2,13 @@
   "schemaVersion": 1,
   "distribution": "deepflow-suite",
   "package": "@metagptx/deepflow-suite-cli",
-  "version": "0.1.2",
-  "platform": "darwin",
-  "arch": "arm64",
+  "version": "0.2.3",
+  "platform": "any",
+  "arch": "any",
   "cli": {
     "name": "deepflow-suite",
     "package": "@metagptx/deepflow-suite-cli",
-    "version": "0.1.2",
+    "version": "0.2.3",
     "command": "deepflow-suite"
   },
   "skills": [
@@ -19,7 +19,7 @@
         {
           "path": "manifest.yaml",
           "size": 362,
-          "sha256": "494531d6a0532b6d7e5db03b4e3adbcc4eb8b3c754e2074091728a81ce7fffbd"
+          "sha256": "dc6578c11a62a29fee194a268ede90d1d8659b0f731787ca3fdab557bc39d51f"
         },
         {
           "path": "SKILL.md",
@@ -138,8 +138,8 @@
       "files": [
         {
           "path": "SKILL.md",
-          "size": 10079,
-          "sha256": "f1d8abb45c3bd7010b01a89393a16c143ed5718b092af9804f2fd849a2274f68"
+          "size": 10128,
+          "sha256": "baa0cac18c1683a0b2e52ab301854d8dc9e907ccd3ae451b2357b1780c2e3f33"
         }
       ]
     },
@@ -159,27 +159,37 @@
     {
       "name": "df-workbench",
       "project": "deepflow-workbench",
-      "install": "project"
+      "install": "project",
+      "package": "@metagptx/deepflow-suite-cli",
+      "mode": "node"
     },
     {
       "name": "df-task",
       "project": "deepflow-task",
-      "install": "make install-cli"
+      "install": "make install-cli",
+      "package": "platform-runtime",
+      "mode": "binary"
     },
     {
       "name": "df-taskdriver",
       "project": "deepflow-task-driver",
-      "install": "make install-cli"
+      "install": "make install-cli",
+      "package": "platform-runtime",
+      "mode": "binary"
     },
     {
       "name": "df-agentctrl",
       "project": "deepflow-agent-ctrl",
-      "install": "make install-cli"
+      "install": "make install-cli",
+      "package": "platform-runtime",
+      "mode": "binary"
     },
     {
       "name": "df-agentrt",
       "project": "deepflow-agent-runtime",
-      "install": "make build"
+      "install": "make build",
+      "package": "platform-runtime",
+      "mode": "binary"
     }
   ]
 }

package/bundle/skills/deepflow-suite/manifest.yaml

@@ -1,5 +1,5 @@
 id: deepflow-suite
-version: 0.1.2
+version: 0.2.3
 kind: composite-skill
 requires:
   skills:

package/bundle/skills/df-agentrt/SKILL.md

@@ -169,7 +169,7 @@ key 时每次新建。同 key 只保留首次成功写入的配置，released
 ### 有三件事不归你做
 
 `session release`、`session rm`、`ops orphans --fix` **不要用**。它们都是替别人做决定：
-回收工作目录由控制面决定，删会话会抹掉永久可见的消息流，判死滞留轮次动的是别的会话。
+release 会停止会话接收新轮次（第一期不会归档 Worker 工作目录），删会话会抹掉永久可见的消息流，判死滞留轮次动的是别的会话。
 二进制不会拦你——它会照做，所以这条只能靠你守住。
 
 发现某个会话像是卡住了、或者某个工作目录该回收了，**在回复里说出来**，

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "distribution": "deepflow-suite",
-  "version": "0.1.2",
+  "version": "0.2.3",
   "skills": [
     {
       "name": "deepflow-suite",
@@ -42,27 +42,37 @@
     {
       "name": "df-workbench",
       "project": "deepflow-workbench",
-      "install": "project"
+      "install": "project",
+      "package": "@metagptx/deepflow-suite-cli",
+      "mode": "node"
     },
     {
       "name": "df-task",
       "project": "deepflow-task",
-      "install": "make install-cli"
+      "install": "make install-cli",
+      "package": "platform-runtime",
+      "mode": "binary"
     },
     {
       "name": "df-taskdriver",
       "project": "deepflow-task-driver",
-      "install": "make install-cli"
+      "install": "make install-cli",
+      "package": "platform-runtime",
+      "mode": "binary"
     },
     {
       "name": "df-agentctrl",
       "project": "deepflow-agent-ctrl",
-      "install": "make install-cli"
+      "install": "make install-cli",
+      "package": "platform-runtime",
+      "mode": "binary"
     },
     {
       "name": "df-agentrt",
       "project": "deepflow-agent-runtime",
-      "install": "make build"
+      "install": "make build",
+      "package": "platform-runtime",
+      "mode": "binary"
     }
   ]
 }

package/package.json

@@ -1,16 +1,22 @@
 {
   "name": "@metagptx/deepflow-suite-cli",
-  "version": "0.1.2",
+  "version": "0.2.3",
   "description": "Agent-friendly installer and distribution CLI for the DeepFlow suite.",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {
-    "deepflow-suite": "bin/deepflow-suite.js"
+    "deepflow-suite": "bin/deepflow-suite.js",
+    "df-workbench": "bin/df-workbench.js",
+    "df-task": "bin/df-task.js",
+    "df-taskdriver": "bin/df-taskdriver.js",
+    "df-agentctrl": "bin/df-agentctrl.js",
+    "df-agentrt": "bin/df-agentrt.js"
   },
   "files": [
     "bin/",
     "bundle/",
     "manifest.json",
+    "runtime/",
     "skills/",
     "src/",
     "scripts/",
@@ -19,11 +25,20 @@
   "publishConfig": {
     "access": "public"
   },
+  "optionalDependencies": {
+    "@metagptx/deepflow-suite-cli-darwin-arm64": "0.2.3",
+    "@metagptx/deepflow-suite-cli-darwin-x64": "0.2.3",
+    "@metagptx/deepflow-suite-cli-linux-arm64": "0.2.3",
+    "@metagptx/deepflow-suite-cli-linux-x64": "0.2.3",
+    "@metagptx/deepflow-suite-cli-win32-x64": "0.2.3"
+  },
   "engines": {
     "node": ">=22.13.0"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
+    "build:runtime": "node scripts/build-runtime-packages.mjs",
+    "check:runtime": "node scripts/build-runtime-packages.mjs --check",
     "prepack": "node scripts/build-package.mjs",
     "pack:dry-run": "npm pack --dry-run"
   }

package/runtime/df-workbench.mjs

@@ -0,0 +1,463 @@
+#!/usr/bin/env node
+
+import { randomUUID } from "node:crypto";
+import { pathToFileURL } from "node:url";
+
+const DEFAULT_BASE_URL = "http://127.0.0.1:8793";
+const MAX_MESSAGE_LENGTH = 20000;
+
+export class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UsageError";
+    this.exitCode = 2;
+  }
+}
+
+export class RequestError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = "RequestError";
+    this.status = details.status || 0;
+    this.code = details.code || "request_failed";
+    this.details = details;
+    this.exitCode = 1;
+  }
+}
+
+function valueAfter(argv, index, option) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new UsageError(`${option} 需要一个值。`);
+  return value;
+}
+
+export function parseArgs(argv, env = process.env) {
+  const options = {
+    baseUrl: env.DF_WORKBENCH_BASE_URL || DEFAULT_BASE_URL,
+    token: env.DF_WORKBENCH_TOKEN || "",
+    workspace: env.DF_WORKBENCH_WORKSPACE_ID || "",
+    json: false,
+    idempotencyKey: "",
+    message: "",
+    title: "",
+    after: "",
+    limit: "",
+  };
+  const positionals = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--json") {
+      options.json = true;
+      continue;
+    }
+    if (argument === "--help" || argument === "-h") {
+      options.help = true;
+      continue;
+    }
+    const equals = argument.indexOf("=");
+    const name = equals === -1 ? argument : argument.slice(0, equals);
+    const inline = equals === -1 ? undefined : argument.slice(equals + 1);
+    if (
+      [
+        "--base-url",
+        "--workspace",
+        "--idempotency-key",
+        "--message",
+        "--title",
+        "--after",
+        "--limit",
+      ].includes(name)
+    ) {
+      const parsed =
+        inline === undefined ? valueAfter(argv, index, name) : inline;
+      if (inline === undefined) index += 1;
+      if (name === "--base-url") options.baseUrl = parsed;
+      if (name === "--workspace") options.workspace = parsed;
+      if (name === "--idempotency-key") options.idempotencyKey = parsed;
+      if (name === "--message") options.message = parsed;
+      if (name === "--title") options.title = parsed;
+      if (name === "--after") options.after = parsed;
+      if (name === "--limit") options.limit = parsed;
+      continue;
+    }
+    if (argument.startsWith("--"))
+      throw new UsageError(`不支持的选项：${argument}`);
+    positionals.push(argument);
+  }
+  options.positionals = positionals;
+  return options;
+}
+
+export function normalizeBaseUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new UsageError(`Workbench 地址无效：${value}`);
+  }
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    (url.pathname !== "/" && url.pathname !== "")
+  )
+    throw new UsageError(
+      "Workbench 地址必须是没有凭据、路径、查询参数或片段的 HTTP(S) 根地址。",
+    );
+  return url.toString().replace(/\/$/, "");
+}
+
+export function buildCreateBody(message, title = "") {
+  const text = String(message || "").trim();
+  if (!text || text.length > MAX_MESSAGE_LENGTH)
+    throw new UsageError(`消息需要 1–${MAX_MESSAGE_LENGTH} 个字符。`);
+  const body = { description: text, conversation: { type: "task" } };
+  if (title) {
+    const trimmed = title.trim();
+    if (!trimmed || trimmed.length > 160)
+      throw new UsageError("任务标题需要 1–160 个字符。");
+    body.title = trimmed;
+  }
+  return body;
+}
+
+function messageValue(value) {
+  const text = String(value || "").trim();
+  if (!text || text.length > MAX_MESSAGE_LENGTH)
+    throw new UsageError(`消息需要 1–${MAX_MESSAGE_LENGTH} 个字符。`);
+  return text;
+}
+
+function integerOption(value, option, fallback, minimum, maximum) {
+  if (value === "") return fallback;
+  if (!/^\d+$/.test(value)) throw new UsageError(`${option} 必须是整数。`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum)
+    throw new UsageError(`${option} 必须在 ${minimum}–${maximum} 之间。`);
+  return parsed;
+}
+
+function idempotencyKey(options) {
+  const key = options.idempotencyKey || randomUUID();
+  if (!/^[\w.:/-]{8,160}$/.test(key))
+    throw new UsageError("--idempotency-key 格式无效。");
+  return key;
+}
+
+function requestHeaders(options, context = {}, key) {
+  const headers = { Accept: "application/json" };
+  if (options.token) headers.Authorization = `Bearer ${options.token}`;
+  if (context.workspace) headers["X-Deepflow-Workspace"] = context.workspace;
+  if (context.actorId) headers["X-Deepflow-Expected-Actor"] = context.actorId;
+  if (key) headers["Idempotency-Key"] = key;
+  return headers;
+}
+
+async function request(options, path, requestOptions = {}, context = {}) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl);
+  const url = new URL(path, `${baseUrl}/`);
+  const headers = requestHeaders(options, context, requestOptions.key);
+  if (requestOptions.body !== undefined)
+    headers["Content-Type"] = "application/json";
+  let response;
+  try {
+    response = await fetch(url, {
+      method: requestOptions.method || "GET",
+      headers,
+      body:
+        requestOptions.body === undefined
+          ? undefined
+          : JSON.stringify(requestOptions.body),
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+    });
+  } catch (error) {
+    throw new RequestError(
+      `无法连接 Workbench：${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    );
+  }
+  let data;
+  try {
+    data = await response.json();
+  } catch {
+    throw new RequestError("Workbench 没有返回有效 JSON。", {
+      status: response.status,
+      code: "invalid_response",
+    });
+  }
+  if (!response.ok)
+    throw new RequestError(
+      data.message || `Workbench 请求失败（HTTP ${response.status}）。`,
+      {
+        status: response.status,
+        code: data.code || "request_failed",
+        response: data,
+      },
+    );
+  return data;
+}
+
+async function currentContext(options) {
+  const me = await request(
+    options,
+    "/api/v1/me",
+    {},
+    options.workspace ? { workspace: options.workspace } : {},
+  );
+  const workspace = options.workspace || me.workspaceId;
+  if (!workspace)
+    throw new RequestError("Workbench 没有返回当前工作区。", {
+      code: "workspace_missing",
+    });
+  if (
+    Array.isArray(me.workspaces) &&
+    !me.workspaces.some((item) => item.id === workspace)
+  )
+    throw new RequestError(`当前用户无权访问工作区：${workspace}`, {
+      status: 403,
+      code: "workspace_forbidden",
+    });
+  if (!me.user?.id)
+    throw new RequestError("Workbench 没有返回当前用户。", {
+      code: "identity_missing",
+    });
+  return { me, workspace, actorId: me.user.id };
+}
+
+async function loadConfig(options) {
+  const context = await currentContext(options);
+  const [platform, auth, readiness, capabilities] = await Promise.all([
+    request(options, "/api/v1/platform-state"),
+    request(options, "/api/v1/auth/config"),
+    request(options, "/api/v1/task-service-readiness", {}, context),
+    request(options, "/api/v1/task-ui/capabilities", {}, context),
+  ]);
+  return {
+    baseUrl: normalizeBaseUrl(options.baseUrl),
+    authentication: auth,
+    platform,
+    identity: context.me.user,
+    workspace: context.me.workspaces?.find(
+      (item) => item.id === context.workspace,
+    ) || { id: context.workspace },
+    workspaces: context.me.workspaces || [],
+    taskService: readiness,
+    taskUi: capabilities,
+  };
+}
+
+function writeResult(value, options, human) {
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+    return;
+  }
+  process.stdout.write(`${human(value)}\n`);
+}
+
+function taskSummary(value) {
+  const task = value.task || value;
+  return [
+    `Task: ${task.id || "未知"}`,
+    task.title ? `标题: ${task.title}` : "",
+    task.workspaceId ? `工作区: ${task.workspaceId}` : "",
+  ]
+    .filter(Boolean)
+    .join("\n");
+}
+
+function factsSummary(value) {
+  const facts = Array.isArray(value.facts) ? value.facts : [];
+  const lines = [`事实数量: ${facts.length}`];
+  for (const fact of facts.slice(-8)) {
+    const text =
+      fact.payload?.text || fact.payload?.reason || fact.type || "未知事实";
+    lines.push(
+      `#${fact.seq ?? "?"} ${fact.type || "unknown"}: ${String(text).replaceAll("\n", " ").slice(0, 160)}`,
+    );
+  }
+  if (value.next_after_seq !== undefined)
+    lines.push(`下一游标: ${value.next_after_seq}`);
+  return lines.join("\n");
+}
+
+function help() {
+  return `用法：
+  df-workbench me [--json]
+  df-workbench config [--json]
+  df-workbench health [--json]
+  df-workbench task create --message <消息> [--title <标题>] [--idempotency-key <key>]
+  df-workbench task send <task-id> --message <消息> [--idempotency-key <key>]
+  df-workbench task get <task-id> [--json]
+  df-workbench task facts <task-id> [--after <seq>] [--limit <n>] [--json]
+  df-workbench task list [--limit <n>] [--json]
+
+全局配置：
+  DF_WORKBENCH_BASE_URL       Workbench 根地址，默认 http://127.0.0.1:8793
+  DF_WORKBENCH_TOKEN          OIDC 环境使用的 personal token
+  DF_WORKBENCH_WORKSPACE_ID   当前工作区覆盖值
+  --base-url <url>             覆盖 Workbench 根地址
+  --workspace <id>             覆盖当前工作区
+  --json                      输出机器可读 JSON`;
+}
+
+async function run(options) {
+  const [command, subject, ...rest] = options.positionals;
+  if (options.help || !command || command === "help") {
+    process.stdout.write(`${help()}\n`);
+    return;
+  }
+  if (command === "health") {
+    const value = await request(options, "/healthz");
+    writeResult(value, options, (value) => JSON.stringify(value));
+    return;
+  }
+  if (command === "me") {
+    const context = await currentContext(options);
+    writeResult(
+      context.me,
+      options,
+      (value) =>
+        `用户: ${value.user.name} (${value.user.id})\n工作区: ${value.workspaceId}`,
+    );
+    return;
+  }
+  if (command === "config") {
+    const value = await loadConfig(options);
+    writeResult(
+      value,
+      options,
+      (config) =>
+        `用户: ${config.identity.name} (${config.identity.id})\n工作区: ${config.workspace.name || config.workspace.id} (${config.workspace.id})\n认证: ${config.authentication.mode} / ${config.authentication.configured ? "已配置" : "未配置"}\nTask 写入: ${config.taskService.writeAvailable ? "可用" : "不可用"}`,
+    );
+    return;
+  }
+  if (command !== "task") throw new UsageError(`不支持的命令：${command}`);
+  if (subject === "create") {
+    const context = await currentContext(options);
+    const key = idempotencyKey(options);
+    const value = await request(
+      options,
+      "/api/v1/tasks",
+      {
+        method: "POST",
+        key,
+        body: buildCreateBody(options.message, options.title),
+      },
+      context,
+    );
+    writeResult(value, options, taskSummary);
+    return;
+  }
+  if (subject === "send") {
+    const taskId = rest[0];
+    if (!taskId) throw new UsageError("task send 需要 Task ID。");
+    const context = await currentContext(options);
+    const key = idempotencyKey(options);
+    const value = await request(
+      options,
+      `/api/v1/tasks/${encodeURIComponent(taskId)}/messages`,
+      { method: "POST", key, body: { text: messageValue(options.message) } },
+      context,
+    );
+    writeResult(
+      value,
+      options,
+      (value) => `消息已发送，事实序号：${value.fact?.seq ?? "未知"}`,
+    );
+    return;
+  }
+  if (subject === "get") {
+    const taskId = rest[0];
+    if (!taskId) throw new UsageError("task get 需要 Task ID。");
+    const context = await currentContext(options);
+    const value = await request(
+      options,
+      `/api/v1/tasks/${encodeURIComponent(taskId)}`,
+      {},
+      context,
+    );
+    writeResult(value, options, taskSummary);
+    return;
+  }
+  if (subject === "facts") {
+    const taskId = rest[0];
+    if (!taskId) throw new UsageError("task facts 需要 Task ID。");
+    const context = await currentContext(options);
+    const after = integerOption(
+      options.after,
+      "--after",
+      0,
+      0,
+      Number.MAX_SAFE_INTEGER,
+    );
+    const limit = integerOption(options.limit, "--limit", 200, 1, 1000);
+    const query = new URLSearchParams({
+      after_seq: String(after),
+      limit: String(limit),
+    });
+    const value = await request(
+      options,
+      `/api/v1/tasks/${encodeURIComponent(taskId)}/facts?${query}`,
+      {},
+      context,
+    );
+    writeResult(value, options, factsSummary);
+    return;
+  }
+  if (subject === "list") {
+    const context = await currentContext(options);
+    const limit = integerOption(options.limit, "--limit", 50, 1, 200);
+    const value = await request(
+      options,
+      `/api/v1/tasks?scope=mine&limit=${limit}`,
+      {},
+      context,
+    );
+    writeResult(
+      value,
+      options,
+      (value) =>
+        (value.tasks || [])
+          .map((task) => `${task.id} ${task.title || ""}`.trim())
+          .join("\n") || "没有任务。",
+    );
+    return;
+  }
+  throw new UsageError(`不支持的 task 命令：${subject || ""}`);
+}
+
+export async function main(argv = process.argv.slice(2), env = process.env) {
+  const options = parseArgs(argv, env);
+  await run(options);
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  main().catch((error) => {
+    if (error instanceof UsageError) {
+      process.stderr.write(`参数错误：${error.message}\n\n${help()}\n`);
+    } else if (error instanceof RequestError) {
+      const suffix = error.details?.response?.code
+        ? ` [${error.details.response.code}]`
+        : error.code
+          ? ` [${error.code}]`
+          : "";
+      process.stderr.write(`请求失败${suffix}：${error.message}\n`);
+      if (error.details?.status === 401 || error.details?.status === 403)
+        process.stderr.write(
+          "请检查 DF_WORKBENCH_TOKEN、工作区和目标环境配置。\n",
+        );
+    } else {
+      process.stderr.write(
+        `失败：${error instanceof Error ? error.message : String(error)}\n`,
+      );
+    }
+    process.exitCode = error.exitCode || 1;
+  });
+}

package/scripts/build-package.mjs

@@ -1,12 +1,26 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { cp, mkdir, rm, readFile } from "node:fs/promises";
 
 import { assembleBundle } from "../src/bundle.mjs";
+import { buildRuntimePackages } from "../src/runtime-build.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const workspaceRoot = path.resolve(packageRoot, "../..");
+const packageJson = JSON.parse(await readFile(path.join(packageRoot, "package.json"), "utf8"));
 await assembleBundle({
   workspaceRoot,
   outputDir: path.join(packageRoot, "bundle"),
   manifestPath: path.join(packageRoot, "manifest.json"),
 });
+await rm(path.join(packageRoot, "runtime"), { recursive: true, force: true });
+await mkdir(path.join(packageRoot, "runtime"), { recursive: true });
+await cp(
+  path.join(workspaceRoot, "deepflow-workbench", "cli", "df-workbench.mjs"),
+  path.join(packageRoot, "runtime", "df-workbench.mjs"),
+);
+await buildRuntimePackages({
+  workspaceRoot,
+  outputRoot: path.join(packageRoot, "platform-packages"),
+  version: packageJson.version,
+});

package/scripts/build-runtime-packages.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { readFile } from "node:fs/promises";
+
+import {
+  buildRuntimePackages,
+  verifyRuntimePackage,
+} from "../src/runtime-build.mjs";
+import { supportedRuntimePlatforms } from "../src/runtime-package.mjs";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const workspaceRoot = path.resolve(packageRoot, "../..");
+
+function option(argv, name, fallback) {
+  const index = argv.indexOf(name);
+  return index === -1 ? fallback : argv[index + 1];
+}
+
+const argv = process.argv.slice(2);
+const outputRoot = path.resolve(option(argv, "--output", path.join(packageRoot, "platform-packages")));
+const version = option(argv, "--version", JSON.parse(await readFile(path.join(packageRoot, "package.json"), "utf8")).version);
+const check = argv.includes("--check");
+
+if (check) {
+  for (const target of supportedRuntimePlatforms()) {
+    await verifyRuntimePackage({
+      packageRoot: path.join(outputRoot, target.package.replace(/^@[^/]+\//, "")),
+      target,
+      expectedVersion: version,
+    });
+  }
+  console.log(JSON.stringify({ ok: true, outputRoot, version, packages: supportedRuntimePlatforms().map((target) => target.package) }, null, 2));
+} else {
+  const result = await buildRuntimePackages({ workspaceRoot, outputRoot, version });
+  console.log(JSON.stringify({ ok: true, outputRoot, version, packages: result.packages }, null, 2));
+}

package/skills/deepflow-suite/manifest.yaml

@@ -1,5 +1,5 @@
 id: deepflow-suite
-version: 0.1.2
+version: 0.2.3
 kind: composite-skill
 requires:
   skills:

package/src/bundle.mjs

@@ -78,8 +78,8 @@ async function assembleInto({ workspaceRoot, outputDir, manifestPath }) {
     distribution: manifest.distribution,
     package: PACKAGE_NAME,
     version: manifest.version,
-    platform: process.platform,
-    arch: process.arch,
+    platform: "any",
+    arch: "any",
     cli: {
       name: CLI_NAME,
       package: PACKAGE_NAME,

package/src/cli-launcher.mjs

@@ -0,0 +1,71 @@
+import { createRequire } from "node:module";
+import { readFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { verifyRuntimePackage } from "./runtime-build.mjs";
+import {
+  runtimeBinaryFileName,
+  runtimeBinaryNames,
+  runtimePackageForPlatform,
+} from "./runtime-package.mjs";
+
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function defaultPackageRoot() {
+  return PACKAGE_ROOT;
+}
+
+function packageTarget(platform, arch) {
+  const packageName = runtimePackageForPlatform(platform, arch);
+  if (!packageName) throw new Error(`unsupported DeepFlow CLI platform: ${platform}/${arch}`);
+  return { platform, arch, package: packageName };
+}
+
+export function resolveInstalledPackageRoot(packageRoot, packageName) {
+  const require = createRequire(path.join(packageRoot, "package.json"));
+  try {
+    return path.dirname(require.resolve(`${packageName}/package.json`, { paths: [packageRoot] }));
+  } catch {
+    throw new Error(`optional runtime package ${packageName} is not installed; reinstall without --omit=optional`);
+  }
+}
+
+function runProcess(command, args, env = process.env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { env, stdio: "inherit" });
+    child.once("error", reject);
+    child.once("close", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+  });
+}
+
+export async function runRuntimeCli(name, argv = [], options = {}) {
+  if (!runtimeBinaryNames().includes(name)) throw new Error(`unsupported runtime CLI: ${name}`);
+  const packageRoot = options.packageRoot ?? defaultPackageRoot();
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const target = packageTarget(platform, arch);
+  const runtimeRoot = resolveInstalledPackageRoot(packageRoot, target.package);
+  const packageJson = JSON.parse(await readFile(path.join(packageRoot, "package.json"), "utf8"));
+  const release = await verifyRuntimePackage({
+    packageRoot: runtimeRoot,
+    target,
+    expectedVersion: packageJson.version,
+  });
+  const binary = release.binaries.find((entry) => entry.name === name);
+  const binaryPath = path.join(runtimeRoot, binary.path);
+  return runProcess(binaryPath, argv, options.env ?? process.env);
+}
+
+export async function runWorkbench(argv = [], options = {}) {
+  const packageRoot = options.packageRoot ?? defaultPackageRoot();
+  const entry = path.join(packageRoot, "runtime", "df-workbench.mjs");
+  return runProcess(process.execPath, [entry, ...argv], options.env ?? process.env);
+}
+
+export function runtimeLauncherTarget(platform = process.platform, arch = process.arch) {
+  return packageTarget(platform, arch);
+}
+
+export { runtimeBinaryFileName };

package/src/commands/doctor.mjs

@@ -5,6 +5,7 @@ import { verifyInstalledBundle } from "../bundle-installer.mjs";
 import { verifyWorkspaceSkills } from "../linker.mjs";
 import { verifyWorkspaceClis } from "../cli-install.mjs";
 import { loadManifest } from "../manifest.mjs";
+import { verifyPackageClis } from "../package-cli.mjs";
 
 export async function doctor(options) {
   if (options.source === "package" || options.source === "bundle") {
@@ -13,11 +14,24 @@ export async function doctor(options) {
     try {
       const manifest = await loadManifest(options.manifestPath);
       const release = await verifyInstalledBundle({ bundleDir, targetDir, expectedVersion: manifest.version });
+      if (options.source === "bundle") {
+        return {
+          ok: true,
+          bundleDir,
+          targetDir,
+          release,
+        };
+      }
+      const clis = await verifyPackageClis({
+        packageRoot: path.dirname(options.manifestPath),
+        expectedVersion: manifest.version,
+      });
       return {
-        ok: true,
+        ok: clis.ok,
         bundleDir,
         targetDir,
         release,
+        clis,
       };
     } catch (error) {
       return { ok: false, bundleDir, error: error.message };

package/src/commands/install.mjs

@@ -5,20 +5,30 @@ import { installBundleSkills } from "../bundle-installer.mjs";
 import { installWorkspaceSkills } from "../linker.mjs";
 import { installWorkspaceClis } from "../cli-install.mjs";
 import { loadManifest } from "../manifest.mjs";
+import { verifyPackageClis } from "../package-cli.mjs";
 
 export async function install(options) {
   if (options.source === "package") {
     const packageRoot = path.dirname(options.manifestPath);
     const manifest = await loadManifest(options.manifestPath);
     const bundleDir = options.bundleDir ?? path.join(packageRoot, "bundle");
+    const clis = await verifyPackageClis({
+      packageRoot,
+      expectedVersion: manifest.version,
+    });
+    if (!clis.ok) {
+      throw new Error(`package CLI verification failed: ${JSON.stringify(clis)}`);
+    }
+    const skills = await installBundleSkills({
+      bundleDir,
+      targetDir: options.targetDir ?? defaultCodexSkillsDir(),
+      force: options.force,
+      expectedVersion: manifest.version,
+    });
     return {
-      skills: await installBundleSkills({
-        bundleDir,
-        targetDir: options.targetDir ?? defaultCodexSkillsDir(),
-        force: options.force,
-        expectedVersion: manifest.version,
-      }),
-      clis: { package: "@metagptx/deepflow-suite-cli" },
+      ok: clis.ok,
+      skills,
+      clis,
     };
   }
   if (options.source !== "workspace") {

package/src/package-cli.mjs

@@ -0,0 +1,66 @@
+import { access, lstat } from "node:fs/promises";
+import path from "node:path";
+
+import { resolveInstalledPackageRoot } from "./cli-launcher.mjs";
+import { verifyRuntimePackage } from "./runtime-build.mjs";
+import { runtimeBinaryNames, runtimePackageForPlatform } from "./runtime-package.mjs";
+
+const PACKAGE_BINARIES = ["deepflow-suite", "df-workbench", ...runtimeBinaryNames()];
+
+async function regularFile(filePath) {
+  try {
+    const stats = await lstat(filePath);
+    if (!stats.isFile()) return false;
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function verifyPackageClis({
+  packageRoot,
+  expectedVersion,
+  platform = process.platform,
+  arch = process.arch,
+}) {
+  const missing = [];
+  const invalid = [];
+  const binaries = [];
+  for (const name of PACKAGE_BINARIES) {
+    const filePath = path.join(packageRoot, "bin", `${name}.js`);
+    if (await regularFile(filePath)) binaries.push({ name, path: filePath });
+    else missing.push(name);
+  }
+
+  const packageName = runtimePackageForPlatform(platform, arch);
+  const platformInfo = { platform, arch, package: packageName };
+  if (!packageName) {
+    invalid.push({ name: "platform", reason: `unsupported DeepFlow CLI platform: ${platform}/${arch}` });
+  } else {
+    try {
+      const runtimeRoot = resolveInstalledPackageRoot(packageRoot, packageName);
+      await verifyRuntimePackage({
+        packageRoot: runtimeRoot,
+        target: platformInfo,
+        expectedVersion,
+      });
+    } catch (error) {
+      invalid.push({ name: packageName, reason: error.message });
+    }
+  }
+
+  const workbenchEntry = path.join(packageRoot, "runtime", "df-workbench.mjs");
+  if (!await regularFile(workbenchEntry)) invalid.push({ name: "df-workbench", reason: "packaged Workbench CLI entry is missing" });
+
+  return {
+    ok: missing.length === 0 && invalid.length === 0,
+    platform: platformInfo,
+    package: packageRoot,
+    binaries,
+    missing,
+    invalid,
+  };
+}
+
+export { PACKAGE_BINARIES };

package/src/runtime-build.mjs

@@ -0,0 +1,193 @@
+import { access, chmod, lstat, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { execFile as execFileCallback } from "node:child_process";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+
+import {
+  runtimeBinaryFileName,
+  runtimeBinaryNames,
+  runtimePackageForPlatform,
+  supportedRuntimePlatforms,
+} from "./runtime-package.mjs";
+
+const execFile = promisify(execFileCallback);
+const SOURCE_PROJECTS = Object.freeze({
+  "df-task": { project: "deepflow-task", target: "./cmd/df-task" },
+  "df-taskdriver": { project: "deepflow-task-driver", target: "./cmd/df-taskdriver" },
+  "df-agentctrl": { project: "deepflow-agent-ctrl", target: "./cmd/df-agentctrl" },
+  "df-agentrt": { project: "deepflow-agent-runtime", target: "./cmd/df-agentrt-cli" },
+});
+
+function packageDirectoryName(packageName) {
+  return packageName.replace(/^@[^/]+\//, "");
+}
+
+function validateTarget(target) {
+  const expectedPackage = runtimePackageForPlatform(target.platform, target.arch);
+  if (!expectedPackage || target.package !== expectedPackage) {
+    throw new Error(`runtime package name does not match target ${target.platform}/${target.arch}`);
+  }
+}
+
+async function sha256(filePath) {
+  const contents = await readFile(filePath);
+  return {
+    size: contents.byteLength,
+    sha256: createHash("sha256").update(contents).digest("hex"),
+  };
+}
+
+async function verifyRegularFile(filePath) {
+  const stats = await lstat(filePath);
+  if (!stats.isFile()) throw new Error(`runtime binary is not a regular file: ${filePath}`);
+  await access(filePath);
+  return stats;
+}
+
+export async function verifyRuntimePackage({ packageRoot, target, expectedVersion }) {
+  validateTarget(target);
+  const packageJson = JSON.parse(await readFile(path.join(packageRoot, "package.json"), "utf8"));
+  if (packageJson.name !== target.package) throw new Error(`runtime package name must be ${target.package}`);
+  if (packageJson.version !== expectedVersion) throw new Error(`runtime package version ${packageJson.version} does not match ${expectedVersion}`);
+  if (JSON.stringify(packageJson.os) !== JSON.stringify([target.platform])) {
+    throw new Error(`runtime package OS must be ${target.platform}`);
+  }
+  if (JSON.stringify(packageJson.cpu) !== JSON.stringify([target.arch])) {
+    throw new Error(`runtime package CPU must be ${target.arch}`);
+  }
+  const release = JSON.parse(await readFile(path.join(packageRoot, "deepflow-runtime-release.json"), "utf8"));
+  if (release.schemaVersion !== 1 || release.distribution !== "deepflow-suite" || release.package !== target.package) {
+    throw new Error("invalid DeepFlow runtime release metadata");
+  }
+  if (release.version !== expectedVersion || release.platform !== target.platform || release.arch !== target.arch) {
+    throw new Error("runtime release metadata does not match package target");
+  }
+  if (!Array.isArray(release.binaries) || release.binaries.length !== runtimeBinaryNames().length) {
+    throw new Error("runtime release must contain exactly four CLI binaries");
+  }
+  const expectedNames = runtimeBinaryNames().sort();
+  const actualNames = release.binaries.map((binary) => binary?.name).sort();
+  if (JSON.stringify(expectedNames) !== JSON.stringify(actualNames)) {
+    throw new Error("runtime release contains an unexpected CLI binary");
+  }
+  for (const binary of release.binaries) {
+    const expectedPath = path.posix.join("bin", runtimeBinaryFileName(binary.name, target.platform));
+    if (binary.path !== expectedPath || !Number.isSafeInteger(binary.size) || binary.size < 1
+      || !/^[a-f0-9]{64}$/.test(binary.sha256)) {
+      throw new Error(`invalid runtime binary metadata: ${binary.name}`);
+    }
+    const binaryPath = path.join(packageRoot, binary.path);
+    const stats = await verifyRegularFile(binaryPath);
+    const digest = await sha256(binaryPath);
+    if (digest.size !== binary.size || digest.sha256 !== binary.sha256) {
+      throw new Error(`runtime binary hash does not match release metadata: ${binary.name}`);
+    }
+    if (target.platform !== "win32" && (stats.mode & 0o111) === 0) {
+      throw new Error(`runtime binary is not executable: ${binary.name}`);
+    }
+  }
+  return release;
+}
+
+async function buildGoBinary({ workspaceRoot, source, outputPath, target }) {
+  const projectRoot = path.join(workspaceRoot, source.project);
+  await execFile("go", ["build", "-trimpath", "-ldflags=-s -w", "-o", outputPath, source.target], {
+    cwd: projectRoot,
+    env: {
+      ...process.env,
+      CGO_ENABLED: "0",
+      GOOS: target.platform === "win32" ? "windows" : target.platform,
+      GOARCH: target.arch === "x64" ? "amd64" : target.arch,
+    },
+  });
+}
+
+function packageJsonForTarget(target, version) {
+  return {
+    name: target.package,
+    version,
+    description: `DeepFlow Suite CLI runtime binaries for ${target.platform}/${target.arch}.`,
+    license: "UNLICENSED",
+    files: ["bin/", "deepflow-runtime-release.json", "README.md"],
+    os: [target.platform],
+    cpu: [target.arch],
+  };
+}
+
+async function buildOnePackage({ workspaceRoot, outputRoot, version, target, buildBinary }) {
+  validateTarget(target);
+  const packageRoot = path.join(outputRoot, packageDirectoryName(target.package));
+  const stagingRoot = await mkdtemp(path.join(outputRoot, `.${packageDirectoryName(target.package)}.tmp-`));
+  try {
+    await mkdir(path.join(stagingRoot, "bin"), { recursive: true });
+    const binaries = [];
+    for (const name of runtimeBinaryNames()) {
+      const fileName = runtimeBinaryFileName(name, target.platform);
+      const relativePath = path.posix.join("bin", fileName);
+      const outputPath = path.join(stagingRoot, "bin", fileName);
+      const source = SOURCE_PROJECTS[name];
+      await buildBinary({ name, outputPath, source, target, workspaceRoot });
+      if (target.platform !== "win32") await chmod(outputPath, 0o755);
+      const digest = await sha256(outputPath);
+      binaries.push({ name, path: relativePath, ...digest });
+    }
+
+    const release = {
+      schemaVersion: 1,
+      distribution: "deepflow-suite",
+      package: target.package,
+      version,
+      platform: target.platform,
+      arch: target.arch,
+      binaries,
+    };
+    await writeFile(path.join(stagingRoot, "package.json"), `${JSON.stringify(packageJsonForTarget(target, version), null, 2)}\n`);
+    await writeFile(path.join(stagingRoot, "deepflow-runtime-release.json"), `${JSON.stringify(release, null, 2)}\n`);
+    await writeFile(
+      path.join(stagingRoot, "README.md"),
+      `# ${target.package}\n\nPlatform runtime binaries for DeepFlow Suite ${version} (${target.platform}/${target.arch}).\n`,
+    );
+    await rm(packageRoot, { recursive: true, force: true });
+    await rename(stagingRoot, packageRoot);
+    return { package: target.package, directory: packageRoot, release };
+  } catch (error) {
+    await rm(stagingRoot, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+export async function buildRuntimePackages({
+  workspaceRoot,
+  outputRoot,
+  version,
+  targets = supportedRuntimePlatforms(),
+  buildBinary = buildGoBinary,
+}) {
+  if (!workspaceRoot) throw new Error("runtime build workspace root is required");
+  if (!outputRoot) throw new Error("runtime build output root is required");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error("runtime package version must be a semantic version");
+  }
+  await mkdir(outputRoot, { recursive: true });
+  const results = [];
+  for (const target of targets) {
+    results.push(await buildOnePackage({ workspaceRoot, outputRoot, version, target, buildBinary }));
+  }
+  return { packages: results.map((result) => result.package), results };
+}
+
+export function runtimeSourceProjects() {
+  return structuredClone(SOURCE_PROJECTS);
+}
+
+export function hostRuntimeTarget() {
+  return { platform: process.platform, arch: process.arch, package: runtimePackageForPlatform(process.platform, process.arch) };
+}
+
+export async function buildHostRuntimePackage(options) {
+  const target = hostRuntimeTarget();
+  if (!target.package) throw new Error(`unsupported runtime platform: ${os.platform()}/${os.arch()}`);
+  return buildRuntimePackages({ ...options, targets: [target] });
+}

package/src/runtime-package.mjs

@@ -0,0 +1,31 @@
+const RUNTIME_BINARY_NAMES = Object.freeze([
+  "df-task",
+  "df-taskdriver",
+  "df-agentctrl",
+  "df-agentrt",
+]);
+
+const RUNTIME_TARGETS = Object.freeze([
+  Object.freeze({ platform: "darwin", arch: "arm64", package: "@metagptx/deepflow-suite-cli-darwin-arm64" }),
+  Object.freeze({ platform: "darwin", arch: "x64", package: "@metagptx/deepflow-suite-cli-darwin-x64" }),
+  Object.freeze({ platform: "linux", arch: "arm64", package: "@metagptx/deepflow-suite-cli-linux-arm64" }),
+  Object.freeze({ platform: "linux", arch: "x64", package: "@metagptx/deepflow-suite-cli-linux-x64" }),
+  Object.freeze({ platform: "win32", arch: "x64", package: "@metagptx/deepflow-suite-cli-win32-x64" }),
+]);
+
+export function supportedRuntimePlatforms() {
+  return RUNTIME_TARGETS.map((target) => ({ ...target }));
+}
+
+export function runtimePackageForPlatform(platform, arch) {
+  return RUNTIME_TARGETS.find((target) => target.platform === platform && target.arch === arch)?.package ?? null;
+}
+
+export function runtimeBinaryNames() {
+  return [...RUNTIME_BINARY_NAMES];
+}
+
+export function runtimeBinaryFileName(name, platform) {
+  if (!RUNTIME_BINARY_NAMES.includes(name)) throw new Error(`unsupported runtime CLI: ${name}`);
+  return platform === "win32" ? `${name}.exe` : name;
+}