@metagptx/deepflow-suite-cli 0.2.10 → 0.3.0

package/runtime/{df-workbench.mjs → df-workbench/df-workbench.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { randomUUID, createHash } from "node:crypto";
-import { readFile, stat } from "node:fs/promises";
-import { basename } from "node:path";
-import { pathToFileURL } from "node:url";
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
 
 const DEFAULT_BASE_URL = "http://127.0.0.1:8793";
 const MAX_MESSAGE_LENGTH = 20000;
@@ -39,7 +39,6 @@ export function parseArgs(argv, env = process.env) {
     baseUrl: env.DF_WORKBENCH_BASE_URL || DEFAULT_BASE_URL,
     token: env.DF_WORKBENCH_TOKEN || "",
     workspace: env.DF_WORKBENCH_WORKSPACE_ID || "",
-    expectedActor: undefined,
     json: false,
     idempotencyKey: "",
     message: "",
@@ -49,8 +48,6 @@ export function parseArgs(argv, env = process.env) {
     scope: "mine",
     squadId: undefined,
     file: undefined,
-    attachmentIds: [],
-    participantIds: [],
   };
   const positionals = [];
   for (let index = 0; index < argv.length; index += 1) {
@@ -70,7 +67,6 @@ export function parseArgs(argv, env = process.env) {
       [
         "--base-url",
         "--workspace",
-        "--expected-actor",
         "--idempotency-key",
         "--message",
         "--title",
@@ -79,11 +75,6 @@ export function parseArgs(argv, env = process.env) {
         "--scope",
         "--squad-id",
         "--file",
-        "--attachment-id",
-        "--member-id",
-        "--expected-owner",
-        "--owner-id",
-        "--participant-id",
       ].includes(name)
     ) {
       const parsed =
@@ -91,11 +82,6 @@ export function parseArgs(argv, env = process.env) {
       if (inline === undefined) index += 1;
       if (name === "--base-url") options.baseUrl = parsed;
       if (name === "--workspace") options.workspace = parsed;
-      if (name === "--expected-actor") {
-        if (!parsed.trim() || parsed.length > 160 || /[\r\n]/.test(parsed))
-          throw new UsageError("--expected-actor 需要有效的用户 ID。");
-        options.expectedActor = parsed;
-      }
       if (name === "--idempotency-key") options.idempotencyKey = parsed;
       if (name === "--message") options.message = parsed;
       if (name === "--title") options.title = parsed;
@@ -104,11 +90,6 @@ export function parseArgs(argv, env = process.env) {
       if (name === "--scope") options.scope = parsed;
       if (name === "--squad-id") options.squadId = parsed;
       if (name === "--file") options.file = parsed;
-      if (name === "--attachment-id") options.attachmentIds.push(parsed);
-      if (name === "--member-id") options.memberId = parsed;
-      if (name === "--expected-owner") options.expectedOwner = parsed;
-      if (name === "--owner-id") options.ownerId = parsed;
-      if (name === "--participant-id") options.participantIds.push(parsed);
       continue;
     }
     if (argument.startsWith("--"))
@@ -264,13 +245,6 @@ async function currentContext(options) {
     throw new RequestError("Workbench 没有返回当前用户。", {
       code: "identity_missing",
     });
-  if (
-    options.expectedActor !== undefined &&
-    options.expectedActor !== me.user.id
-  )
-    throw new RequestError("Workbench 操作身份已变化；未提交业务请求。", {
-      code: "identity_changed",
-    });
   return { me, workspace, actorId: me.user.id };
 }
 
@@ -449,19 +423,11 @@ function help() {
   df-workbench squad get <squad-id> [--json]
   df-workbench squad create --file <配置.json> [--idempotency-key <key>] [--json]
   df-workbench squad update <squad-id> --file <配置.json> [--idempotency-key <key>] [--json]
-  df-workbench workspace members [--json]
-  df-workbench task create --message <消息> [--title <标题>] [--squad-id <squad-id>] [--owner-id <user-id>] [--participant-id <user-id>] [--idempotency-key <key>]
-  df-workbench task member-options <task-id>
-  df-workbench task invite <task-id> --member-id <user-id> [--idempotency-key <key>]
-  df-workbench task transfer-owner <task-id> --member-id <user-id> --expected-owner <user-id> [--idempotency-key <key>]
+  df-workbench task create --message <消息> [--title <标题>] [--squad-id <squad-id>] [--idempotency-key <key>]
   df-workbench task send <task-id> --message <消息> [--idempotency-key <key>]
-  df-workbench task lookup <DF-number> [--json]
   df-workbench task get <task-id> [--json]
   df-workbench task facts <task-id> [--after <seq>] [--limit <n>] [--json]
   df-workbench task list [--scope <mine|workspace>] [--limit <n>] [--json]
-  df-workbench attachment upload --file <文件> [--idempotency-key <key>] [--json]
-
-task create/send 可重复传入 --attachment-id <id>，每次最多 10 个。
 
 全局配置：
   DF_WORKBENCH_BASE_URL       Workbench 根地址，默认 http://127.0.0.1:8793
@@ -469,7 +435,6 @@ task create/send 可重复传入 --attachment-id <id>，每次最多 10 个。
   DF_WORKBENCH_WORKSPACE_ID   当前工作区覆盖值
   --base-url <url>             覆盖 Workbench 根地址
   --workspace <id>             覆盖当前工作区
-  --expected-actor <user-id>    固定操作身份；身份变化时停止请求
   --json                      输出机器可读 JSON`;
 }
 
@@ -479,11 +444,6 @@ async function run(options) {
     process.stdout.write(`${help()}\n`);
     return;
   }
-  if ((options.ownerId !== undefined || options.participantIds.length) && !(command === "task" && subject === "create")) throw new UsageError("--owner-id 和 --participant-id 仅用于 task create。");
-  if (options.ownerId !== undefined && !/^[\w-]{1,100}$/.test(options.ownerId)) throw new UsageError("初始负责人 ID 无效。");
-  if ((options.memberId !== undefined && !(command === "task" && ["invite","transfer-owner"].includes(subject))) ||
-      (options.expectedOwner !== undefined && !(command === "task" && subject === "transfer-owner")))
-    throw new UsageError("成员和负责人参数只用于对应的任务成员命令。");
   if (
     options.squadId !== undefined &&
     !(command === "task" && subject === "create")
@@ -493,57 +453,9 @@ async function run(options) {
     );
   if (
     options.file !== undefined &&
-    !(command === "squad" && ["create", "update"].includes(subject)) &&
-    !(command === "attachment" && subject === "upload")
-  )
-    throw new UsageError(
-      "--file 仅用于 squad create/update 或 attachment upload。",
-    );
-  if (
-    options.attachmentIds.length &&
-    !(command === "task" && ["create", "send"].includes(subject))
-  )
-    throw new UsageError("--attachment-id 仅用于 task create/send。");
-  if (
-    options.attachmentIds.length > 10 ||
-    new Set(options.attachmentIds).size !== options.attachmentIds.length ||
-    options.attachmentIds.some((id) => !/^[\w-]{1,100}$/.test(id))
+    !(command === "squad" && ["create", "update"].includes(subject))
   )
-    throw new UsageError("附件列表无效，每次最多发送 10 个不同附件。");
-  if (command === "attachment" && subject === "upload") {
-    if (!options.file) throw new UsageError("attachment upload 需要 --file。");
-    const fileInfo = await stat(options.file);
-    if (!fileInfo.isFile() || !fileInfo.size || fileInfo.size > 4 * 1024 * 1024)
-      throw new UsageError("每个附件需为 1 字节至 4 MiB。");
-    const bytes = await readFile(options.file);
-    const filename = basename(options.file);
-    if (!bytes.length || bytes.length > 4 * 1024 * 1024)
-      throw new UsageError("每个附件需为 1 字节至 4 MiB。");
-    if (
-      !filename.trim() ||
-      filename.length > 180 ||
-      /[\x00-\x1f\x7f\\]/.test(filename)
-    )
-      throw new UsageError("附件名称无效。");
-    const context = await currentContext(options);
-    const value = await request(
-      options,
-      "/api/v1/task-attachments",
-      {
-        method: "POST",
-        key: idempotencyKey(options),
-        body: { filename, bytesBase64: bytes.toString("base64") },
-      },
-      context,
-    );
-    writeResult(
-      value,
-      options,
-      (value) =>
-        `已上传附件：${value.attachment?.filename} (${value.attachment?.id})`,
-    );
-    return;
-  }
+    throw new UsageError("--file 仅用于 squad create/update。");
   if (command === "squad") return squadCommand(options, subject, rest);
   if (command === "health") {
     const value = await request(options, "/healthz");
@@ -570,44 +482,16 @@ async function run(options) {
     );
     return;
   }
-  if (command === "workspace" && subject === "members") {
-    const context = await currentContext(options);
-    const value = await request(options,"/api/v1/members",{},context);
-    if (!Array.isArray(value.members)) throw new RequestError("工作区成员目录回执无效。",{code:"invalid_member_directory"});
-    writeResult(value,options,value => value.members.map(member=>`${member.userId} ${member.name || ""}`).join("\n"));return;
-  }
   if (command !== "task") throw new UsageError(`不支持的命令：${command}`);
-  if (["member-options", "invite", "transfer-owner"].includes(subject)) {
-    const taskId = rest[0];
-    if (!taskId || !/^[\w-]{1,160}$/.test(taskId)) throw new UsageError("需要有效的 Task ID。");
-    const writes = subject !== "member-options";
-    if (writes && !/^[\w-]{1,100}$/.test(options.memberId || "")) throw new UsageError("需要 --member-id 指定有效的 DF 用户 ID。");
-    if (subject === "transfer-owner" && !/^[\w-]{1,100}$/.test(options.expectedOwner || "")) throw new UsageError("需要 --expected-owner 指定当前负责人 ID。");
-    const context = await currentContext(options);
-    const path = subject === "member-options" ? `/api/v1/task-ui/tasks/${encodeURIComponent(taskId)}/property-options`
-      : `/api/v1/tasks/${encodeURIComponent(taskId)}/${subject === "invite" ? "member-invitations" : "owner-transfer"}`;
-    const value = await request(options, path, writes ? {method:"POST", key:idempotencyKey(options), body:subject === "invite"
-      ? {invitee_ids:[options.memberId]} : {new_owner_id:options.memberId,expected_owner_id:options.expectedOwner}} : {}, context);
-    writeResult(value, options, value => JSON.stringify(value));
-    return;
-  }
   if (subject === "create") {
     const body = buildCreateBody(
       options.message,
       options.title,
       options.squadId,
     );
-    if (options.ownerId) {
-      if (![options.ownerId,...options.participantIds].every(id=>/^[\w-]{1,100}$/.test(id))) throw new UsageError("初始负责人和参与人 ID 无效。");
-      body.initial_owner_id=options.ownerId;
-      body.first_message="";
-      body.invitee_ids=[...new Set(options.participantIds)].sort();
-    } else if(options.participantIds.length) throw new UsageError("--participant-id 需要同时指定 --owner-id。");
-    if (options.attachmentIds.length && !options.ownerId)
-      body.attachment_ids = options.attachmentIds;
     const context = await currentContext(options);
     const key = idempotencyKey(options);
-    let value = await request(
+    const value = await request(
       options,
       "/api/v1/tasks",
       {
@@ -630,23 +514,6 @@ async function run(options) {
           idempotencyKey: key,
         },
       );
-    if (options.ownerId) {
-      const task=value?.task,data=task?.metadata?.data;
-      if (!task?.id || data?.workspace_id!==context.workspace || data.owner_id!==options.ownerId || data.created_by!==context.actorId ||
-        ![context.actorId,options.ownerId,...options.participantIds].every(id=>data.members?.includes(id))) throw new RequestError("已创建的任务初始负责人或成员回执不匹配，请保留原幂等键核对，不要重建。",{code:"task_metadata_mismatch",outcome:"unknown",taskId:task?.id,idempotencyKey:key});
-      // Current squad edits must never change a retry of the original message.
-      const agentId=data.initial_message_context?.agentId;
-      if (!agentId) throw new RequestError("任务已创建，但创建时的小队快照没有可接收首条消息的伙伴；请保留原任务与幂等键核对。",{code:"initial_agent_unavailable",outcome:"unknown",taskId:task.id,idempotencyKey:key});
-      const firstKey="initial-message:"+createHash("sha256").update(key).digest("hex");
-      let first;
-      try {
-        first=await request(options,`/api/v1/tasks/${encodeURIComponent(task.id)}/messages`,{method:"POST",key:firstKey,body:{text:messageValue(options.message),agentIds:[agentId],...(options.attachmentIds.length?{attachment_ids:options.attachmentIds}:{})}},context);
-      } catch(error) {
-        throw new RequestError(`任务 ${task.id} 已创建，首条消息回执尚待确认；保留幂等键 ${key} 重试，不换键或重建。`,{code:"initial_message_unconfirmed",outcome:"unknown",taskId:task.id,idempotencyKey:key,causeCode:error.code});
-      }
-      if (!Number.isSafeInteger(first?.fact?.seq) || first.fact.task_id!==task.id) throw new RequestError("初始消息回执不匹配；保留原任务与幂等键重试。",{code:"initial_message_unconfirmed",outcome:"unknown",taskId:task.id,idempotencyKey:key});
-      value={...value,first_fact:first.fact,first_fact_seq:first.fact.seq};
-    }
     writeResult(value, options, taskSummary);
     return;
   }
@@ -658,16 +525,7 @@ async function run(options) {
     const value = await request(
       options,
       `/api/v1/tasks/${encodeURIComponent(taskId)}/messages`,
-      {
-        method: "POST",
-        key,
-        body: {
-          text: messageValue(options.message),
-          ...(options.attachmentIds.length
-            ? { attachment_ids: options.attachmentIds }
-            : {}),
-        },
-      },
+      { method: "POST", key, body: { text: messageValue(options.message) } },
       context,
     );
     writeResult(
@@ -677,29 +535,6 @@ async function run(options) {
     );
     return;
   }
-  if (subject === "lookup") {
-    const number = String(rest[0] || "").toUpperCase();
-    if (!/^DF-\d+$/.test(number)) throw new UsageError("task lookup 需要 DF 编号。");
-    const context = await currentContext(options);
-    for (let page = 0, offset = 0; page < 20; page++) {
-      const result = await request(options, `/api/v1/tasks?${new URLSearchParams({scope:"workspace",limit:"200",offset:String(offset)})}`, {}, context);
-      if (!Array.isArray(result.tasks) || typeof result.hasMore !== "boolean") throw new RequestError("工作区任务分页回执不完整，尚不能判断该编号是否存在。",{code:"task_lookup_incomplete"});
-      const matches = result.tasks.filter(task => task.number === number);
-      if (matches.length > 1) throw new RequestError("工作区中出现重复任务编号，请核实目标。",{code:"task_lookup_ambiguous"});
-      if (matches.length) {
-        const task = matches[0];
-        if (task.access === "overview") throw new RequestError(`${number} 存在，但当前账号尚未加入任务，请先获得参与权限。`,{code:"task_participation_required",status:403});
-        const value = await request(options, `/api/v1/tasks/${encodeURIComponent(task.id)}`, {}, context);
-        if (value.task?.id !== task.id || value.task?.number !== number || value.task?.metadata?.data?.workspace_id !== context.workspace || value.task?.access === "overview")
-          throw new RequestError("DF 编号、工作区或内容权限读回不一致，暂停操作。",{code:"task_lookup_mismatch"});
-        writeResult(value, options, taskSummary);return;
-      }
-      if (!result.hasMore) throw new RequestError(`当前工作区未找到 ${number}，请确认编号。`,{code:"task_not_found",status:404});
-      if (!result.tasks.length) break;
-      offset += result.tasks.length;
-    }
-    throw new RequestError("工作区任务查询尚未完成，请稍后再试；不会新建任务。",{code:"task_lookup_incomplete"});
-  }
   if (subject === "get") {
     const taskId = rest[0];
     if (!taskId) throw new UsageError("task get 需要 Task ID。");
@@ -769,13 +604,20 @@ async function run(options) {
 }
 
 export async function main(argv = process.argv.slice(2), env = process.env) {
+  if (argv[0] === '--cli-version') {
+    let version = 'workspace';
+    try { version = JSON.parse(await readFile(new URL('./release.json', import.meta.url), 'utf8')).version; } catch {}
+    const report = { name: 'df-workbench', version, entry: fileURLToPath(import.meta.url) };
+    process.stdout.write((argv.includes('--json') ? JSON.stringify(report) : `df-workbench ${version}`) + '\n');
+    return;
+  }
   const options = parseArgs(argv, env);
   await run(options);
 }
 
 if (
   process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
+  fileURLToPath(import.meta.url) === realpathSync(process.argv[1])
 ) {
   main().catch((error) => {
     if (error instanceof UsageError) {

package/runtime/df-workbench/release.json

@@ -0,0 +1 @@
+{"version":"0.3.0","project":"deepflow-workbench","sourceCommit":"6afd4dec2000e93a971c94d4f18126c10f74a300","sourceDirty":false}

package/scripts/build-package.mjs

@@ -1,26 +1,30 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { cp, mkdir, rm, readFile } from "node:fs/promises";
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { chmod, cp, mkdir, rm, readFile, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { assembleBundle } from '../src/bundle.mjs';
+import { loadManifest } from '../src/manifest.mjs';
 
-import { assembleBundle } from "../src/bundle.mjs";
-import { buildRuntimePackages } from "../src/runtime-build.mjs";
-
-const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const workspaceRoot = path.resolve(packageRoot, "../..");
-const packageJson = JSON.parse(await readFile(path.join(packageRoot, "package.json"), "utf8"));
-await assembleBundle({
-  workspaceRoot,
-  outputDir: path.join(packageRoot, "bundle"),
-  manifestPath: path.join(packageRoot, "manifest.json"),
-});
-await rm(path.join(packageRoot, "runtime"), { recursive: true, force: true });
-await mkdir(path.join(packageRoot, "runtime"), { recursive: true });
-await cp(
-  path.join(workspaceRoot, "deepflow-workbench", "cli", "df-workbench.mjs"),
-  path.join(packageRoot, "runtime", "df-workbench.mjs"),
-);
-await buildRuntimePackages({
-  workspaceRoot,
-  outputRoot: path.join(packageRoot, "platform-packages"),
-  version: packageJson.version,
-});
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const workspaceRoot = path.resolve(packageRoot, '../..');
+const packageJson = JSON.parse(await readFile(path.join(packageRoot, 'package.json'), 'utf8'));
+const manifest = await loadManifest(path.join(packageRoot, 'manifest.json'));
+if (manifest.version !== packageJson.version) throw Error('Manifest and npm package versions differ');
+await promisify(execFile)(process.execPath, ['cli/generate-protocol.mjs', '--check'], { cwd: path.join(workspaceRoot, 'deepflow-task') });
+await assembleBundle({ workspaceRoot, outputDir: path.join(packageRoot, 'bundle'), manifestPath: path.join(packageRoot, 'manifest.json') });
+const runtime = path.join(packageRoot, 'runtime');
+await rm(runtime, { recursive: true, force: true });
+await mkdir(runtime, { recursive: true });
+for (const cli of manifest.clis) {
+  const target = path.join(runtime, cli.name);
+  await cp(path.join(workspaceRoot, cli.project, 'cli'), target, {
+    recursive: true,
+    filter: (source) => !/(?:[\\/]contract(?:[\\/]|$)|\.test\.mjs$|[\\/]generate-protocol\.mjs$)/.test(source),
+  });
+  const { stdout } = await promisify(execFile)('git', ['rev-parse', 'HEAD'], { cwd: path.join(workspaceRoot, cli.project) });
+  const { stdout: status } = await promisify(execFile)('git', ['status', '--porcelain'], { cwd: path.join(workspaceRoot, cli.project) });
+  await writeFile(path.join(target, 'release.json'), JSON.stringify({ version: packageJson.version, project: cli.project, sourceCommit: stdout.trim(), sourceDirty: !!status.trim() }) + '\n');
+  await chmod(path.join(target, path.basename(cli.entry)), 0o755);
+  if (cli.name === 'df-agentrt') await chmod(path.join(target, 'agentrt.mjs'), 0o755);
+}

package/src/bundle.mjs

@@ -65,7 +65,10 @@ async function assembleInto({ workspaceRoot, outputDir, manifestPath }) {
       throw new Error(`missing or empty Skill source: ${skillFile}`);
     }
     const destination = path.join(outputDir, "skills", skill.name);
-    await cp(skill.sourcePath, destination, { recursive: true, dereference: false });
+    await cp(skill.sourcePath, destination, {
+      recursive: true, dereference: false,
+      filter: (source) => !/(?:_test\.go$|\.test\.mjs$|[\\/]__pycache__(?:[\\/]|$))/.test(source),
+    });
     skills.push({
       name: skill.name,
       source: skill.source,

package/src/cli-install.mjs

@@ -1,140 +1,50 @@
-import { spawn } from "node:child_process";
-import { access, lstat, mkdir, mkdtemp, readlink, rename, rm, symlink, unlink } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
+import { access, lstat, mkdir, mkdtemp, readFile, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
 
-function run(command, args, options) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { cwd: options.cwd, stdio: "inherit", env: options.env });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (code === 0) resolve();
-      else reject(new Error(`${command} ${args.join(" ")} exited with ${code ?? signal}`));
-    });
-  });
-}
-
-async function replaceLink(source, target) {
-  await mkdir(path.dirname(target), { recursive: true });
+const destinationFor = (binDir) => binDir ? path.resolve(binDir) : path.join(os.homedir(), '.local', 'bin');
+async function inspect(target) { try { return await lstat(target); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } }
+async function matches(target, source) {
   try {
-    const stats = await lstat(target);
-    if (!stats.isSymbolicLink()) {
-      throw new Error(`refusing to replace non-symlink CLI target: ${target}`);
-    }
-    const current = path.resolve(path.dirname(target), await readlink(target));
-    if (current === source) return "unchanged";
-    await unlink(target);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  await symlink(path.relative(path.dirname(target), source), target);
-  return "created";
+    if (process.platform === 'win32') return (await readFile(target, 'utf8')).includes(source);
+    return await realpath(target) === await realpath(source);
+  } catch { return false; }
 }
-
-async function sourceExists(source) {
-  try {
+export async function installWorkspaceClis({ workspaceRoot, manifest, binDir, force = false }) {
+  const destination = destinationFor(binDir), unchanged = [], targets = [];
+  for (const cli of manifest.clis) {
+    const source = path.resolve(workspaceRoot, cli.project, cli.entry);
     await access(source);
-    return true;
-  } catch {
-    return false;
+    const target = path.join(destination, cli.name + (process.platform === 'win32' ? '.cmd' : ''));
+    if (await matches(target, source)) { unchanged.push(cli.name); continue; }
+    const stats = await inspect(target);
+    if (stats?.isDirectory() || (stats && !force)) throw Error(`refusing to replace existing CLI without --force: ${target}`);
+    targets.push({ name: cli.name, source, target });
   }
-}
-
-export async function installWorkspaceClis({ workspaceRoot, manifest, binDir, force = false }) {
-  const destination = binDir
-    ? path.resolve(binDir)
-    : path.join(process.env.HOME ?? os.homedir(), ".local", "bin");
-  const result = { linked: [], built: [] };
-
   await mkdir(destination, { recursive: true });
-  const targets = manifest.clis.map((cli) => ({ cli, target: path.join(destination, cli.name) }));
-  for (const { cli, target } of targets) {
-    try {
-      const stats = await lstat(target);
-      if (!force) {
-        throw new Error(`refusing to replace existing CLI without --force: ${target}`);
-      }
-      if (stats.isDirectory()) throw new Error(`refusing to replace CLI directory: ${target}`);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-  }
-
-  const backup = await mkdtemp(path.join(destination, ".deepflow-cli-backup-"));
-  const backedUp = [];
-  const touched = [];
+  const backup = await mkdtemp(path.join(destination, '.deepflow-cli-backup-'));
+  const backedUp = [], installed = [];
   try {
-    for (const { cli, target } of targets) {
-      try {
-        await lstat(target);
-        await rename(target, path.join(backup, cli.name));
-        backedUp.push(cli.name);
-      } catch (error) {
-        if (error.code !== "ENOENT") throw error;
-      }
-    }
-
-  for (const cli of manifest.clis) {
-    const projectRoot = path.join(workspaceRoot, cli.project);
-    const target = path.join(destination, cli.name);
-
-    if (cli.name === "df-workbench") {
-      const source = path.join(projectRoot, "cli", "df-workbench.mjs");
-      if (!(await sourceExists(source))) throw new Error(`missing CLI source: ${source}`);
-      await replaceLink(source, target);
-      touched.push(cli.name);
-      result.linked.push(cli.name);
-      continue;
-    }
-
-    if (cli.name === "df-agentrt") {
-      await run("make", ["build"], { cwd: projectRoot, env: process.env });
-      const source = path.join(projectRoot, "deploy", "bin", "df-agentrt");
-      if (!(await sourceExists(source))) throw new Error(`missing built CLI: ${source}`);
-      await replaceLink(source, target);
-      touched.push(cli.name);
-      result.built.push(cli.name);
-      continue;
+    for (const entry of targets) {
+      if (await inspect(entry.target)) { await rename(entry.target, path.join(backup, entry.name)); backedUp.push(entry); }
+      if (process.platform === 'win32') await writeFile(entry.target, `@ECHO off\r\n"${process.execPath}" "${entry.source}" %*\r\n`);
+      else await symlink(path.relative(destination, entry.source), entry.target);
+      installed.push(entry);
     }
-
-    await run("make", ["install-cli", `BIN_DIR=${destination}`], {
-      cwd: projectRoot,
-      env: process.env,
-    });
-    touched.push(cli.name);
-    result.built.push(cli.name);
-  }
-
-  await rm(backup, { recursive: true, force: true });
-  return { binDir: destination, ...result };
+    return { binDir: destination, linked: installed.map((entry) => entry.name), unchanged };
   } catch (error) {
-    for (const { cli } of targets) await rm(path.join(destination, cli.name), { recursive: true, force: true });
-    for (const name of backedUp) await rename(path.join(backup, name), path.join(destination, name));
+    for (const entry of installed) await rm(entry.target, { force: true });
+    for (const entry of backedUp) await rename(path.join(backup, entry.name), entry.target);
     throw error;
-  } finally {
-    await rm(backup, { recursive: true, force: true });
-  }
+  } finally { await rm(backup, { recursive: true, force: true }); }
 }
-
 export async function verifyWorkspaceClis({ workspaceRoot, manifest, binDir }) {
-  const destination = binDir
-    ? path.resolve(binDir)
-    : path.join(process.env.HOME ?? os.homedir(), ".local", "bin");
-  const missing = [];
-  const invalid = [];
+  const bin = destinationFor(binDir), missing = [], invalid = [];
   for (const cli of manifest.clis) {
-    try {
-      const target = path.join(destination, cli.name);
-      const stats = await lstat(target);
-      await access(target);
-      if (stats.isDirectory()) invalid.push({ name: cli.name, reason: "target is a directory" });
-    } catch (error) {
-      if (error.code === "ENOENT") {
-      missing.push(cli.name);
-      } else {
-        invalid.push({ name: cli.name, reason: error.message });
-      }
-    }
+    const target = path.join(bin, cli.name + (process.platform === 'win32' ? '.cmd' : ''));
+    const source = path.resolve(workspaceRoot, cli.project, cli.entry);
+    if (!await inspect(target)) missing.push(cli.name);
+    else if (!await matches(target, source)) invalid.push({ name: cli.name, reason: 'CLI points to another installation', expected: source, actual: target });
   }
-  return { binDir: destination, missing, invalid };
+  return { binDir: bin, missing, invalid };
 }

package/src/commands/doctor.mjs

@@ -25,6 +25,8 @@ export async function doctor(options) {
       const clis = await verifyPackageClis({
         packageRoot: path.dirname(options.manifestPath),
         expectedVersion: manifest.version,
+        checkPath: true,
+        env: options.env ?? process.env,
       });
       return {
         ok: clis.ok,

package/src/linker.mjs

@@ -24,7 +24,7 @@ async function inspectTarget(targetPath) {
 
 export async function installWorkspaceSkills({ workspaceRoot, targetDir, force = false, manifestPath }) {
   const manifest = await loadManifest(manifestPath);
-  const skills = resolveSkillSources(manifest, workspaceRoot, "workspace");
+  const skills = resolveSkillSources(manifest, workspaceRoot);
   const destination = targetDir ?? path.join(workspaceRoot, ".agents", "skills");
 
   for (const skill of skills) {
@@ -68,7 +68,7 @@ export async function installWorkspaceSkills({ workspaceRoot, targetDir, force =
 
 export async function verifyWorkspaceSkills({ workspaceRoot, targetDir, manifestPath }) {
   const manifest = await loadManifest(manifestPath);
-  const skills = resolveSkillSources(manifest, workspaceRoot, "workspace");
+  const skills = resolveSkillSources(manifest, workspaceRoot);
   const destination = targetDir ?? path.join(workspaceRoot, ".agents", "skills");
   const missing = [];
   const invalid = [];

package/src/manifest.mjs

@@ -2,7 +2,7 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { CLI_NAMES, DISTRIBUTION, PACKAGE_NAME, SKILL_NAMES } from "./constants.mjs";
+import { CLI_NAMES, DISTRIBUTION, SKILL_NAMES } from "./constants.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -10,6 +10,7 @@ export const defaultManifestPath = path.join(packageRoot, "manifest.json");
 
 export async function loadManifest(manifestPath = defaultManifestPath) {
   const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  if (!manifest.version) manifest.version = JSON.parse(await readFile(path.join(path.dirname(manifestPath), 'package.json'), 'utf8')).version;
   validateManifest(manifest);
   return manifest;
 }
@@ -50,23 +51,16 @@ export function validateManifest(manifest) {
     }
   }
   for (const cli of manifest.clis) {
-    if (!cli || typeof cli.name !== "string" || typeof cli.project !== "string" || typeof cli.install !== "string") {
-      throw new Error("DeepFlow manifest CLIs must define name, project, and install");
+    if (!cli || typeof cli.name !== "string" || typeof cli.project !== "string" || typeof cli.entry !== "string") {
+      throw new Error("DeepFlow manifest CLIs must define name, project, and entry");
     }
+    if (path.isAbsolute(cli.entry) || cli.entry.split(/[\\/]/).includes('..') || !cli.entry.endsWith('.mjs')) throw new Error(`invalid Node CLI entry: ${cli.name}`);
   }
 }
 
-export function resolveSkillSources(manifest, workspaceRoot, mode = "workspace") {
+export function resolveSkillSources(manifest, workspaceRoot) {
   return manifest.skills.map((skill) => ({
     ...skill,
-    sourcePath: path.resolve(workspaceRoot, mode === "package" ? (skill.packageSource || `skills/${skill.name}`) : skill.source),
+    sourcePath: path.resolve(workspaceRoot, skill.source),
   }));
 }
-
-export function packageManifest() {
-  return {
-    distribution: DISTRIBUTION,
-    package: PACKAGE_NAME,
-    cli: "deepflow-suite",
-  };
-}