@petercjl/boardmixcli 0.0.0-stage → 0.1.6

package/lib/page-adapter.js

@@ -0,0 +1,155 @@
+// Versioned adapter for the Boardmix web bundle observed in desktop 1.7.2.
+// Called with explicit local endpoint/token; no business layout decisions here.
+async function installPageAdapter(config,mainScript){
+  if(window.__boardmixcliPageBridge)window.__boardmixcliPageBridge.stop();
+  const src=Array.from(document.scripts).map(s=>s.src).find(s=>/\/assets\/index-[^/]+\.js/.test(s));
+  if(!src||!src.endsWith('/index-DjSD2oPg.js'))throw Error('UNVERIFIED_BOARDMIX_BUILD');
+  const module=await import(src), manager=module.z(),files=module.bm(),importer=module.eb;
+  if(typeof manager.renameFile!=='function'||typeof files.httpCreateFile!=='function'||typeof importer.importPureRefFiles!=='function')throw Error('ADAPTER_CONTRACT_MISMATCH');
+  const headers={Authorization:'Bearer '+config.token,'Content-Type':'application/json'};
+  let stopped=false,timer,pendingReply;
+  async function send(route,data){const r=await fetch(config.endpoint+route,{method:data?'POST':'GET',headers,body:data?JSON.stringify(data):undefined});if(!r.ok)throw Error('LOCAL_BRIDGE_'+r.status);return r.json();}
+  const runner=module.lr;
+  await runner.run({id:'boardmixcli-atomic',name:'boardmixcli',main:'main.js'},mainScript,'<!doctype html><meta charset="utf-8"><p>boardmixcli 已连接</p>');
+  function onReply(e){const r=e.data?.pluginMessage;if(r?.channel==='boardmixcli-v1'&&typeof r.ok==='boolean'&&pendingReply?.id===r.id){const done=pendingReply.resolve;pendingReply=null;done(r);}}
+  window.addEventListener('message',onReply);
+  async function plugin(op,params={}){
+    if(pendingReply)throw Error('PLUGIN_BUSY');
+    const id=crypto.randomUUID();
+    return new Promise((resolve,reject)=>{
+      const t=setTimeout(()=>{if(pendingReply?.id===id)pendingReply=null;reject(Error('PLUGIN_TIMEOUT'));},10000);
+      pendingReply={id,resolve:r=>{clearTimeout(t);r.ok?resolve(r.result):reject(Error(r.error));}};
+      window.postMessage({pluginMessage:{channel:'boardmixcli-v1',id,op,fileKey:manager.fileKey,params}},location.origin);
+    });
+  }
+  function boardInfo(){const f=manager.fileInfo;return {fileKey:manager.fileKey,name:f.name,teamId:f.team_id,projectId:f.project_id,folderId:f.folder_id,localSavePending:manager.isLocalSpaceActive&&manager.isEditorNeedSave,coopStatus:module.rl().coopStatus,uploading:importer.progressMap?.size||0};}
+  async function execute(job){
+    if(job.fileKey!==manager.fileKey)throw Error('FILE_MISMATCH');
+    const p=job.params;
+    if(job.op==='board.info')return boardInfo();
+    if(job.op==='board.create'){
+      const r=await files.httpCreateFile(p.teamId,p.projectId,p.folderId,undefined);
+      return {fileKey:r.file_key,name:r.name,teamId:r.team_id,projectId:r.project_id};
+    }
+    if(job.op==='board.rename'){await manager.renameFile(p.name);const read=await files.httpGetFile(job.fileKey);if(read.name!==p.name)throw Error('RENAME_READBACK_MISMATCH');return {fileKey:job.fileKey,name:read.name};}
+    if(job.op==='board.open'){if(!window.desktopManagerApi?.openFile)throw Error('DESKTOP_OPEN_UNAVAILABLE');window.desktopManagerApi.openFile(p.targetFileKey);return {requested:true,targetFileKey:p.targetFileKey};}
+    if(job.op==='board.close'){
+      if(importer.progressMap?.size||(manager.isLocalSpaceActive&&manager.isEditorNeedSave)||(!manager.isLocalSpaceActive&&module.rl().coopStatus!==1))throw Error('SAVE_OR_UPLOAD_PENDING');
+      if(!window.desktopManagerApi?.closeView)throw Error('DESKTOP_CLOSE_UNAVAILABLE');return {closeRequested:true,fileKey:job.fileKey};
+    }
+    if(job.op==='frame.create'){
+      const result=await plugin('frame.create',p),guid=result.readback.guid;
+      module.mK({nodes:[{guid,name:p.content||''}]});await new Promise(r=>setTimeout(r,150));
+      const readback=await plugin('object.get',guid);if(readback.name!==(p.content||''))throw Error('FRAME_NAME_READBACK_MISMATCH');return {created:result.created,readback};
+    }
+    if(job.op==='object.resize'){
+      const guid={sessionID:p.sessionID,localID:p.localID},original=await plugin('object.get',guid);
+      if(original.mediaType==='video/mp4')return plugin('object.resize',p);
+      const locked=original.aspectRatioLocked;
+      let matched=false;
+      try{
+        if(locked){module.mK({nodes:[{guid,privateInfo:{lockAspectRatio:false}}]});await new Promise(r=>setTimeout(r,150));}
+        module.mK({nodes:[{guid,width:p.width,height:p.height}]});
+        const deadline=Date.now()+3000;
+        while(Date.now()<deadline){await new Promise(r=>setTimeout(r,100));const shape=await plugin('object.get',guid);if(Math.abs(shape.width-p.width)<0.01&&Math.abs(shape.height-p.height)<0.01){matched=true;break;}}
+        if(!matched)throw Error('RESIZE_READBACK_MISMATCH');
+      }finally{if(locked){module.mK({nodes:[{guid,privateInfo:{lockAspectRatio:true}}]});await new Promise(r=>setTimeout(r,150));}}
+      return plugin('object.get',guid);
+    }
+    if(job.op==='object.place.batch'){
+      const guids=p.items.map(({sessionID,localID})=>({sessionID,localID}));
+      const before=(await plugin('object.get.batch',{guids})).objects;
+      const unlocked=before.filter(o=>o.aspectRatioLocked&&o.mediaType!=='video/mp4').map(o=>({guid:o.guid,privateInfo:{lockAspectRatio:false}}));
+      try{
+        if(unlocked.length)module.mK({nodes:unlocked});
+        for(let i=0;i<before.length;i++)if(before[i].mediaType==='video/mp4')await plugin('object.resize',p.items[i]);
+        module.mK({nodes:p.items.filter((_,i)=>before[i].mediaType!=='video/mp4').map((i)=>({guid:{sessionID:i.sessionID,localID:i.localID},width:i.width,height:i.height}))});
+        let ready=false;const deadline=Date.now()+5000;
+        while(Date.now()<deadline){const read=(await plugin('object.get.batch',{guids})).objects;if(read.every((o,i)=>Math.abs(o.width-p.items[i].width)<0.01&&Math.abs(o.height-p.items[i].height)<0.01)){ready=true;break;}await new Promise(r=>setTimeout(r,100));}
+        if(!ready)throw Error('RESIZE_READBACK_MISMATCH');
+        await plugin('object.move.batch',{items:p.items});
+      }finally{if(unlocked.length)module.mK({nodes:before.filter(o=>o.aspectRatioLocked).map(o=>({guid:o.guid,privateInfo:{lockAspectRatio:true}}))});}
+      const deadline=Date.now()+5000;
+      while(Date.now()<deadline){
+        const result=await plugin('object.get.batch',{guids});
+        if(result.objects.every((o,i)=>['x','y','width','height'].every(k=>Math.abs(o[k]-p.items[i][k])<0.02)&&o.aspectRatioLocked===before[i].aspectRatioLocked))return result;
+        await new Promise(r=>setTimeout(r,100));
+      }
+      throw Error('PLACE_READBACK_MISMATCH');
+    }
+    if(job.op==='image.import.batch'){
+      if(importer.progressMap?.size)throw Error('UPLOAD_ALREADY_PENDING');
+      const before=await plugin('object.selection'),known=new Set(before.objects.map(o=>o.guid.sessionID+':'+o.guid.localID));
+      const inputs=[];
+      // Bound local reads; provider upload scheduling belongs to the native importer.
+      for(let start=0;start<p.items.length;start+=4){inputs.push(...await Promise.all(p.items.slice(start,start+4).map(async i=>{
+        const a=await send('/asset-info/'+i.assetId),r=await fetch(config.endpoint+'/asset/'+i.assetId,{headers});if(!r.ok)throw Error('ASSET_FETCH_FAILED');
+        return {...i,asset:a,file:new File([await r.blob()],a.name,{type:a.mime})};
+      })));}
+      const submitted=await importer.importPureRefFiles(inputs.map(i=>({file:i.file})));
+      if(submitted!==inputs.length)throw Error('BATCH_IMPORT_OUTCOME_UNKNOWN');
+      const deadline=Date.now()+120000;
+      while(Date.now()<deadline){
+        await new Promise(r=>setTimeout(r,250));
+        const selected=(await plugin('object.selection')).objects.filter(o=>!known.has(o.guid.sessionID+':'+o.guid.localID));
+        if(selected.length>inputs.length)throw Error('CONCURRENT_CANVAS_MUTATION');
+        if(selected.length===inputs.length&&!importer.progressMap?.size&&selected.every(o=>o.width>0&&o.height>0)){
+          const unused=[...selected],items=[];
+          for(const i of inputs){const n=unused.findIndex(o=>o.resourceHash===i.asset.md5);if(n<0)throw Error('BATCH_RESOURCE_MISMATCH');const object=unused.splice(n,1)[0];items.push({key:i.key,asset:i.asset,object});}
+          return {items,uploadFinished:true};
+        }
+      }
+      throw Error('BATCH_IMPORT_OUTCOME_UNKNOWN');
+    }
+    if(job.op==='video.import'){
+      if(importer.progressMap?.size)throw Error('UPLOAD_ALREADY_PENDING');
+      const a=await send('/asset-info/'+p.assetId),before=await plugin('object.selection');
+      if(a.kind!=='video')throw Error('VIDEO_ASSET_REQUIRED');
+      const r=await fetch(config.endpoint+'/asset/'+p.assetId,{headers});if(!r.ok)throw Error('ASSET_FETCH_FAILED');
+      const file=new File([await r.blob()],a.name,{type:a.mime});
+      const prepared=await importer.formatPlaceHolderInfo({splitFiles:{file:[file]}});
+      if(prepared.uploadTask?.length!==1||prepared.uploadTask[0].fileType!=='video')throw Error('VIDEO_PREPARATION_FAILED');
+      const task=prepared.uploadTask[0];
+      await importer.filesTask(prepared.placeholderResult,[]);
+      await importer.uploadVideo(task.promiseId,file);
+      const known=new Set(before.objects.map(o=>o.guid.sessionID+':'+o.guid.localID));
+      const deadline=Date.now()+10000;
+      while(Date.now()<deadline){
+        const added=(await plugin('object.selection')).objects.filter(o=>!known.has(o.guid.sessionID+':'+o.guid.localID));
+        if(added.length>1)throw Error('CONCURRENT_CANVAS_MUTATION');
+        if(added.length===1&&added[0].width>0&&added[0].height>0&&added[0].resourceHash===a.md5&&added[0].mediaType==='video/mp4'&&!added[0].mediaLoading)return {asset:a,object:added[0],uploadFinished:true};
+        await new Promise(r=>setTimeout(r,250));
+      }
+      throw Error('VIDEO_IMPORT_OUTCOME_UNKNOWN');
+    }
+    if(job.op==='image.import'){
+      const a=await send('/asset-info/'+p.assetId),before=await plugin('object.selection');
+      const r=await fetch(config.endpoint+'/asset/'+p.assetId,{headers});if(!r.ok)throw Error('ASSET_FETCH_FAILED');
+      const blob=await r.blob(),file=new File([blob],a.name,{type:a.mime});
+      const submitted=await importer.importPureRefFiles([{file}]);if(submitted!==1)throw Error('IMPORT_REJECTED');
+      const known=new Set(before.objects.map(x=>x.guid.sessionID+':'+x.guid.localID));
+      const deadline=Date.now()+120000;
+      while(Date.now()<deadline){
+        await new Promise(r=>setTimeout(r,500));
+        const current=await plugin('object.selection'),added=current.objects.filter(x=>!known.has(x.guid.sessionID+':'+x.guid.localID));
+        if(added.length>1)throw Error('CONCURRENT_CANVAS_MUTATION');
+        if(added.length===1&&!(importer.progressMap?.size)&&added[0].width>0&&added[0].height>0)return {asset:{name:a.name,sha256:a.sha256,width:a.width,height:a.height},object:added[0],uploadFinished:true};
+      }
+      throw Error('IMPORT_OUTCOME_UNKNOWN');
+    }
+    return plugin(job.op,p);
+  }
+  async function poll(){
+    if(stopped)return;
+    try{
+      const next=await send('/next?fileKey='+encodeURIComponent(manager.fileKey));
+      if(next.request){const job=next.request;let response;try{response={id:job.id,ok:true,result:await execute(job)};}catch(e){response={id:job.id,ok:false,error:String(e.message||e)};}
+        await send('/result',response);
+        if(job.op==='board.close'&&response.ok){window.__boardmixcliPageBridge.stop();setTimeout(()=>window.desktopManagerApi.closeView(),100);return;}
+      }
+    }catch(e){console.warn('boardmixcli connection',e.message);}
+    timer=setTimeout(poll,350);
+  }
+  window.__boardmixcliPageBridge={endpoint:config.endpoint,active:true,stop(){this.active=false;stopped=true;clearTimeout(timer);window.removeEventListener('message',onReply);}};
+  poll();return {connected:true,...boardInfo()};
+}

package/lib/protocol.mjs

@@ -0,0 +1,35 @@
+export const operations = ['video.import','image.import.batch','object.get.batch','object.place.batch','info','text.create','frame.create','object.get','object.selection','object.move','object.resize','view.fit','board.info','board.create','board.rename','board.open','board.close','image.import'];
+export function validate(input) {
+  if (!input || !operations.includes(input.op)) throw new Error('UNSUPPORTED_OPERATION');
+  if (typeof input.fileKey !== 'string' || !/^[A-Za-z0-9_-]{8,100}$/.test(input.fileKey)) throw new Error('INVALID_FILE_KEY');
+  const p = input.params ?? {};
+  if (!p || typeof p !== 'object' || Array.isArray(p)) throw new Error('INVALID_PARAMS');
+  const fields = ({'video.import':['assetId','operationId'],'image.import.batch':['items','operationId'],'object.get.batch':['guids'],'object.place.batch':['items'],'text.create':['x','y','width','height','content','fontSize'],'frame.create':['x','y','width','height','content'],'object.get':['sessionID','localID'],'object.move':['sessionID','localID','x','y'],'object.resize':['sessionID','localID','width','height'],'view.fit':['guids'],'board.create':['teamId','projectId','folderId'],'board.rename':['name'],'board.open':['targetFileKey'],'image.import':['assetId']})[input.op]||[];
+  if (Object.keys(p).some(k => !fields.includes(k))) throw new Error('UNKNOWN_PARAMETER');
+  if (['frame.create','text.create'].includes(input.op)) {
+    for (const k of ['x','y','width','height']) if (!Number.isFinite(p[k]) || Math.abs(p[k]) > 1e6) throw new Error('INVALID_GEOMETRY');
+    if (p.width <= 0 || p.height <= 0) throw new Error('INVALID_GEOMETRY');
+    if (p.content !== undefined && (typeof p.content !== 'string' || p.content.length > 1000)) throw new Error('INVALID_CONTENT');
+  }
+  if(input.op==='text.create'&&p.fontSize!==undefined&&(!Number.isFinite(p.fontSize)||p.fontSize<=0||p.fontSize>200))throw Error('INVALID_FONT_SIZE');
+  if (['object.get','object.move','object.resize'].includes(input.op)) for (const k of ['sessionID','localID']) if (!Number.isSafeInteger(p[k]) || p[k] < 0) throw new Error('INVALID_GUID');
+  if(input.op==='object.move')for(const k of ['x','y'])if(!Number.isFinite(p[k])||Math.abs(p[k])>1e7)throw Error('INVALID_GEOMETRY');
+  if(input.op==='object.resize')for(const k of ['width','height'])if(!Number.isFinite(p[k])||p[k]<=0||p[k]>1e6)throw Error('INVALID_GEOMETRY');
+  if(input.op==='board.create')for(const k of ['teamId','projectId','folderId'])if(!Number.isSafeInteger(p[k])||p[k]<0)throw Error('INVALID_DESTINATION');
+  if(input.op==='board.rename'&&(typeof p.name!=='string'||!p.name.trim()||p.name.length>100))throw Error('INVALID_NAME');
+  if(input.op==='board.open'&&(typeof p.targetFileKey!=='string'||!/^[A-Za-z0-9_-]{8,100}$/.test(p.targetFileKey)))throw Error('INVALID_FILE_KEY');
+  if(['image.import','video.import'].includes(input.op)&&(typeof p.assetId!=='string'||!/^[a-f0-9]{64}$/.test(p.assetId)))throw Error('INVALID_ASSET_ID');
+  if(input.op==='view.fit'&&(!Array.isArray(p.guids)||!p.guids.length||p.guids.length>1000||p.guids.some(g=>!Number.isSafeInteger(g.sessionID)||g.sessionID<0||!Number.isSafeInteger(g.localID)||g.localID<0)))throw Error('INVALID_GUID_LIST');
+  if(input.op==='video.import'&&(typeof p.operationId!=='string'||!/^[a-f0-9-]{36}$/.test(p.operationId)))throw Error('INVALID_OPERATION_ID');
+  if(input.op==='image.import.batch'){
+    if(typeof p.operationId!=='string'||!/^[a-f0-9-]{36}$/.test(p.operationId))throw Error('INVALID_OPERATION_ID');
+    if(!Array.isArray(p.items)||!p.items.length||p.items.length>20)throw Error('INVALID_BATCH');
+    const keys=new Set();for(const i of p.items){if(!i||Object.keys(i).some(k=>!['key','assetId'].includes(k))||typeof i.key!=='string'||!i.key||i.key.length>200||keys.has(i.key))throw Error('INVALID_BATCH_KEY');keys.add(i.key);validate({op:'image.import',fileKey:input.fileKey,params:{assetId:i.assetId}});}
+  }
+  if(input.op==='object.get.batch')validate({op:'view.fit',fileKey:input.fileKey,params:{guids:p.guids}});
+  if(input.op==='object.place.batch'){
+    if(!Array.isArray(p.items)||!p.items.length||p.items.length>200)throw Error('INVALID_BATCH');
+    const seen=new Set();for(const i of p.items){if(!i||Object.keys(i).some(k=>!['sessionID','localID','x','y','width','height'].includes(k)))throw Error('UNKNOWN_PARAMETER');const {sessionID,localID,x,y,width,height}=i;validate({op:'object.move',fileKey:input.fileKey,params:{sessionID,localID,x,y}});validate({op:'object.resize',fileKey:input.fileKey,params:{sessionID,localID,width,height}});const key=sessionID+':'+localID;if(seen.has(key))throw Error('DUPLICATE_GUID');seen.add(key);}
+  }
+  return {op:input.op,fileKey:input.fileKey,params:p};
+}

package/lib/video.mjs

@@ -0,0 +1,33 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+const exec=promisify(execFile);
+export async function inspectVideo(file){
+ const absolute=path.resolve(file),s=await fs.stat(absolute);
+ if(!s.isFile()||s.size>100*1024*1024)throw Error('INVALID_VIDEO_SIZE');
+ const bytes=await fs.readFile(absolute);if(bytes.toString('ascii',4,8)!=='ftyp')throw Error('MP4_REQUIRED');
+ let result;try{result=await exec('ffprobe',['-v','error','-show_streams','-show_format','-of','json',absolute],{timeout:30000,maxBuffer:1024*1024});}catch(e){throw Error(e.code==='ENOENT'?'FFPROBE_REQUIRED':'VIDEO_PROBE_FAILED');}
+ const info=JSON.parse(result.stdout),stream=info.streams.find(s=>s.codec_type==='video'),duration=Number(info.format.duration);
+ if(!stream?.width||!stream?.height||!Number.isFinite(duration)||duration<=0)throw Error('INVALID_VIDEO');
+ return {file:absolute,name:path.basename(absolute),kind:'video',mime:'video/mp4',size:bytes.length,width:stream.width,height:stream.height,duration,sha256:crypto.createHash('sha256').update(bytes).digest('hex'),md5:crypto.createHash('md5').update(bytes).digest('hex')};
+}
+export async function downloadVideo(url,output){
+ if(new URL(url).protocol!=='https:')throw Error('HTTPS_REQUIRED');
+ try{await fs.stat(output);throw Error('TARGET_EXISTS');}catch(e){if(e.code!=='ENOENT')throw e;}
+ const r=await fetch(url,{signal:AbortSignal.timeout(120000)});if(!r.ok||new URL(r.url).protocol!=='https:')throw Error('VIDEO_DOWNLOAD_FAILED');
+ const chunks=[];let size=0;for await(const c of r.body){size+=c.length;if(size>100*1024*1024)throw Error('INVALID_VIDEO_SIZE');chunks.push(c);}
+ const bytes=Buffer.concat(chunks);if(bytes.toString('ascii',4,8)!=='ftyp')throw Error('MP4_REQUIRED');
+ await fs.writeFile(output,bytes,{flag:'wx',mode:0o600});return {...await inspectVideo(output),sourceUrl:url};
+}
+export async function importVideo(client,fileKey,file,receiptPath){
+ const asset=await inspectVideo(file),identity=crypto.createHash('sha256').update(JSON.stringify({fileKey,sha256:asset.sha256})).digest('hex');
+ let old;try{old=JSON.parse(await fs.readFile(receiptPath,'utf8'));}catch(e){if(e.code!=='ENOENT')throw e;}
+ async function complete(value){await fs.copyFile(receiptPath,receiptPath+'.'+crypto.randomUUID()+'.backup',fs.constants.COPYFILE_EXCL);await fs.writeFile(receiptPath,JSON.stringify(value,null,2),{mode:0o600});}
+ if(old){if(old.owner!=='@petercjl/boardmixcli'||old.identity!==identity)throw Error('RECEIPT_CONFLICT');if(old.result)return {ok:true,result:old.result,recovered:true};const out=await client.call('/outcome/'+old.operationId);if(!out.ok||!out.result)throw Error('VIDEO_OUTCOME_UNRESOLVED');await complete({...old,status:'completed',result:out.result});return out;}
+ await client.call('/register-asset',{file:asset.file,sha256:asset.sha256,kind:'video'});
+ const receipt={owner:'@petercjl/boardmixcli',identity,fileKey,operationId:crypto.randomUUID(),status:'submitted',sha256:asset.sha256};
+ await fs.writeFile(receiptPath,JSON.stringify(receipt,null,2),{flag:'wx',mode:0o600});
+ const out=await client.request('video.import',fileKey,{assetId:asset.sha256,operationId:receipt.operationId});await complete({...receipt,status:'completed',result:out.result});return out;
+}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@petercjl/boardmixcli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.6",
+  "type": "module",
+  "description": "Atomic Boardmix desktop operations and portable Agent capability manual",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/petercjl/boardmixcli.git"
+  },
+  "homepage": "https://github.com/petercjl/boardmixcli#readme",
+  "bugs": {
+    "url": "https://github.com/petercjl/boardmixcli/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "boardmixcli": "bin/boardmixcli.mjs"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "check": "node scripts/validate-package.mjs",
+    "prepack": "node scripts/validate-package.mjs",
+    "postinstall": "node scripts/install-notice.mjs",
+    "smoke": "node scripts/packed-smoke.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "bin/*.mjs",
+    "lib/*.mjs",
+    "lib/page-adapter.js",
+    "plugin/main.js",
+    "scripts/*.mjs",
+    "skills/boardmixcli/**",
+    "README.md",
+    "INSTALL.md",
+    "UPDATE.md",
+    "LICENSE",
+    "CONTRACT.md",
+    "capabilities.json"
+  ]
+}

package/plugin/main.js

@@ -0,0 +1,51 @@
+// Boardmix plugin sandbox. Only named operations are accepted.
+function compact(r) {
+  return {guid:r.guid,name:r.name,content:r.content,fontSize:r.textInfo&&r.textInfo.fontSize,x:r.x,y:r.y,width:r.width,height:r.height,objectType:r.objectType,aspectRatioLocked:r.lockAspectRatio,resourceHash:(r.imageInfo&&r.imageInfo.hash)||(r.fileInfo&&r.fileInfo.hash),mediaType:r.fileInfo&&r.fileInfo.mimeType,mediaLoading:r.fileInfo&&r.fileInfo.isInLoading,cropped:r.imageInfo&&r.imageInfo.cropped,imageNum:r.imageNum};
+}
+boardmix.ui.on('message', function(message) {
+  if (!message || message.channel !== 'boardmixcli-v1' || typeof message.op !== 'string') return;
+  var response = {channel:'boardmixcli-v1', id:message.id};
+  try {
+    if (message.fileKey !== boardmix.fileKey) throw new Error('FILE_MISMATCH');
+    var p = message.params || {};
+    if (message.op === 'info') response.result = {fileKey:boardmix.fileKey, apiVersion:boardmix.apiVersion, view:boardmix.viewport.getView(), zoom:boardmix.viewport.getZoom(), operations:['info','frame.create','object.get']};
+    else if ((message.op === 'frame.create'||message.op==='text.create')) {
+      var created = message.op==='frame.create'?boardmix.createFrame(p):boardmix.createText({...p,style:{fontSize:p.fontSize||28}});
+      boardmix.moveTo(created.guid.sessionID,created.guid.localID,p.x+created.width/2,p.y+created.height/2);
+      var g = created.guid;
+      response.result = {created:compact(created), readback:compact(boardmix.getById(g.sessionID,g.localID))};
+    } else if (message.op === 'object.get') response.result = compact(boardmix.getById(p.sessionID,p.localID));
+    else if(message.op==='object.get.batch')response.result={objects:p.guids.map(function(g){return compact(boardmix.getById(g.sessionID,g.localID));})};
+    else if(message.op==='object.move.batch'){
+      p.items.forEach(function(i){var o=boardmix.getById(i.sessionID,i.localID);boardmix.moveTo(i.sessionID,i.localID,i.x+o.width/2,i.y+o.height/2);});
+      response.result={objects:p.items.map(function(i){return compact(boardmix.getById(i.sessionID,i.localID));})};
+    }
+    else if(message.op==='object.selection'){
+      var selection=boardmix.getSelect();response.result={objects:selection.guids.map(function(g){return compact(boardmix.getById(g.sessionID,g.localID));})};
+    }
+    else if(message.op==='view.fit'){
+      boardmix.viewport.zoomTo({guids:p.guids});response.result={guids:p.guids,zoom:boardmix.viewport.getZoom(),view:boardmix.viewport.getView()};
+    }
+    else if(message.op==='object.move'){
+      var original=boardmix.getById(p.sessionID,p.localID);
+      boardmix.moveTo(p.sessionID,p.localID,p.x+original.width/2,p.y+original.height/2);
+      var moved=compact(boardmix.getById(p.sessionID,p.localID));
+      if(Math.abs(moved.x-p.x)>0.01||Math.abs(moved.y-p.y)>0.01)throw new Error('MOVE_READBACK_MISMATCH:'+JSON.stringify(moved));
+      response.result=moved;
+    }
+    else if(message.op==='object.resize'){
+      var before=compact(boardmix.getById(p.sessionID,p.localID));
+      if(before.mediaType!=='video/mp4')throw new Error('HOST_ADAPTER_REQUIRED_FOR_EXACT_RESIZE');
+      boardmix.resize(p.sessionID,p.localID,p.width,p.height);
+      var after=compact(boardmix.getById(p.sessionID,p.localID));
+      if(Math.abs(after.width-p.width)>0.02||Math.abs(after.height-p.height)>0.02||after.aspectRatioLocked!==before.aspectRatioLocked)throw new Error('RESIZE_READBACK_MISMATCH');
+      response.result=after;
+    }
+    else throw new Error('UNSUPPORTED_OPERATION');
+    response.ok = true;
+  } catch (error) { response.ok = false; response.error = String(error.message || error); }
+  boardmix.ui.postMessage(response);
+});
+// Boardmix routes sandbox replies through its plugin window wrapper.
+boardmix.showUI({title:'boardmixcli',width:280,height:90});
+boardmix.ui.hide();

package/scripts/install-notice.mjs

@@ -0,0 +1 @@
+console.log('@petercjl/boardmixcli: CLI installation is one phase. Ask your current Agent to read INSTALL.md / UPDATE.md, resolve its own Skill destination, run skill install/update, verify hashes and refresh host discovery. No service access is granted by installation.');

package/scripts/packed-smoke.mjs

@@ -0,0 +1,32 @@
+import {mkdtemp,readFile,rm,writeFile,stat} from 'node:fs/promises';
+import {execFileSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import assert from 'node:assert/strict';
+const root=fileURLToPath(new URL('../',import.meta.url)),scratch=await mkdtemp(path.join(tmpdir(),'boardmix-packed-'));
+const npmCli=process.env.npm_execpath||fileURLToPath(new URL('../../../npm/bin/npm-cli.js',import.meta.url));
+function npm(args){return execFileSync(process.execPath,[npmCli,...args],{cwd:root,encoding:'utf8',env:{...process.env,BOARDMIXCLI_UPDATE_CHECK:'0'}});}
+function cli(entry,args){return JSON.parse(execFileSync(process.execPath,[entry,...args],{encoding:'utf8',env:{...process.env,BOARDMIXCLI_UPDATE_CHECK:'0'}}));}
+try{
+ const packed=JSON.parse(npm(['pack','--silent','--json','--pack-destination',scratch]))[0];
+ assert.ok(packed.files.every(f=>!/(evidence|\.bak-|\.session\.|bootstrap\.js)/.test(f.path)));
+ const bootstrap=path.join(scratch,'bootstrap');npm(['install','--prefix',bootstrap,'--ignore-scripts','--no-audit','--no-fund',path.join(scratch,packed.filename)]);
+ const entry=path.join(bootstrap,'node_modules/@petercjl/boardmixcli/bin/boardmixcli.mjs');
+ const version=cli(entry,['version']).version;
+ for(const name of ['host-a','host-b']){
+  const target=path.join(scratch,name),args=['--agent',name,'--destination',target,'--json'];
+  assert.equal(cli(entry,['skill','status',...args]).installed,false);
+  assert.equal(cli(entry,['skill','install',...args]).current,true);
+  assert.equal(cli(entry,['skill','update',...args]).changed,false);
+ }
+ const a=path.join(scratch,'host-a/.runtime/bin/boardmixcli.mjs'),b=path.join(scratch,'host-b/.runtime/bin/boardmixcli.mjs');
+ if(process.platform!=='win32')assert.notEqual((await stat(a)).ino,(await stat(b)).ino);
+ await rm(bootstrap,{recursive:true});await rm(path.join(scratch,'host-a'),{recursive:true});
+ assert.equal(cli(b,['version']).version,version);
+ const png=Buffer.alloc(24);Buffer.from('89504e470d0a1a0a','hex').copy(png);png.write('IHDR',12);png.writeUInt32BE(750,16);png.writeUInt32BE(1475,20);
+ const image=path.join(scratch,'图片.png');await writeFile(image,png);
+ const result=cli(b,['image.inspect','--file',image]);assert.equal(result.width,750);assert.equal(result.height,1475);
+ assert.equal(cli(b,['skill','status','--agent','host-b','--destination',path.join(scratch,'host-b'),'--json']).current,true);
+ console.log(JSON.stringify({ok:true,version,packedFiles:packed.files.length,isolation:'bootstrap and host-a removed; host-b version, image.inspect and receipt verified',historicalUpdater:'0.1.0 retains the same explicit Skill destination and target-owned runtime contract; this smoke tests candidate isolation'}));
+}finally{await rm(scratch,{recursive:true,force:true});}

package/scripts/sync-version.mjs

@@ -0,0 +1,13 @@
+// Release-only identity synchronization; prepack remains read-only.
+import {readFile,writeFile,copyFile,stat,mkdir} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {randomUUID} from 'node:crypto';
+const root=fileURLToPath(new URL('../',import.meta.url));
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+for(const name of ['capabilities.json','skills/boardmixcli/manifest.json']){
+ const p=path.join(root,name);await stat(p);const x=JSON.parse(await readFile(p,'utf8'));
+ if(x.version===pkg.version&&x.package===pkg.name)continue;
+ const backup=path.join(root,'evidence','version-backups',randomUUID(),name);await mkdir(path.dirname(backup),{recursive:true});await copyFile(p,backup);x.version=pkg.version;x.package=pkg.name;
+ await writeFile(p,JSON.stringify(x,null,2)+'\n');
+}

package/scripts/validate-package.mjs

@@ -0,0 +1,11 @@
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+const root=fileURLToPath(new URL('../',import.meta.url));
+const p=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+for(const f of ['capabilities.json','skills/boardmixcli/manifest.json']){
+ const x=JSON.parse(await readFile(path.join(root,f),'utf8'));
+ if(x.version!==p.version||x.package!==p.name)throw Error('VERSION_DRIFT: '+f);
+}
+for(const f of ['INSTALL.md','UPDATE.md','CONTRACT.md','skills/boardmixcli/SKILL.md'])if(!(await readFile(path.join(root,f),'utf8')).trim())throw Error('MISSING_RESOURCE: '+f);
+console.error('Package and Skill identity verified: '+p.name+'@'+p.version);

package/skills/boardmixcli/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: boardmixcli
+description: Operate Boardmix desktop boards through explicit atomic CLI commands for files, images, videos, object geometry and viewport. Use for authorized Boardmix automation; the caller owns content and layout decisions.
+---
+
+# BoardmixCLI capability manual
+
+Input: explicit operations, Boardmix file keys, local PNG/JPEG/WebP/MP4 paths and object GUIDs, authorized by the user. Strategy: discover the installed contract, connect the selected editor, execute atomic operations and verify readback. Output: JSON receipts and verified Boardmix state. The calling Agent or application Skill owns business methods, material selection, ordering and layout.
+
+## Main line
+
+1. Resolve this Skill directory from the host's actual loaded resource path. Use Node.js with its target-owned `.runtime/bin/boardmixcli.mjs`; never infer a different Agent's installation path. Read this Skill’s `capabilities.json` and `adapters/generic.json` to resolve the logical execution and desktop features from the current host. Run `version`, `capabilities --json`, and `doctor --json`. In a source npm checkout, resolve the canonical runtime through the package CLI instead. Node.js >=22, local filesystem, loopback HTTP and an authorized browser CDP connection or desktop console access are required. Any Agent with these capabilities may use the generic adapter. Native desktop execution is tested on macOS Boardmix 1.7.2; other desktop platforms remain unverified.
+2. For local inspection, `image.list --directory ABSOLUTE_DIRECTORY` returns supported image filenames in natural numeric order; `image.inspect --file ABSOLUTE_PNG` returns source dimensions and SHA256. Caller decides whether this order suits the task. For editor actions, read the runtime's `CONTRACT.md` before the first write to obtain exact flags and response/error contracts.
+3. Start `serve --session NEW_ABSOLUTE_PRIVATE_FILE`, or reuse a confirmed live session. For the default browser route first run `browser.ensure --json`. It starts or reuses Chrome on 9223 with the persistent home-relative `.dianshang-chrome-profile`, opens Boardmix, and checks login. On AUTH_REQUIRED relay the returned prompt to the user; after user login run `auth.wait --wait-ms 60000 --json` or repeat browser.ensure. Continue only on state ready. AUTH_STATE_UNKNOWN requires page/load diagnosis, never assumed login. Automatic launch is macOS-only; an explicitly selected alternative endpoint remains caller-managed. Then use the returned endpoint: `browser.targets --endpoint URL` discovers Boardmix app tabs; `browser.open --endpoint URL --file-key KEY` opens a specified existing file; `browser.connect --endpoint URL --session FILE --file-key KEY` attaches it without visible DevTools. The endpoint must use loopback and must belong to the intended browser. Verify `status` and `board.info` identify the exact file. Read the browser connection contract in CONTRACT.md. Missing target, ambiguous tabs or a changed front-end build stops this branch; preserve the selected host. For explicitly selected desktop mode, use authorized native controls to execute the bootstrap once in that editor's Console, then minimize the specific DevTools window and verify the board is visible. Console connection is a fallback prerequisite, not a window that stays in front throughout the task.
+4. Execute only caller-selected operations: file create/name/open/close; Frame/text creation; single or batch PNG/JPEG/WebP import; native MP4 import; object get/move/resize or batch placement; explicit viewport fit. Every editor command requires `--session` and `--file-key`. GUID sessionID/localID are separate numeric flags. Move uses absolute top-left board coordinates. Resize sets both dimensions and preserves aspect-ratio lock. Inspect each receipt, then read object/file state to verify the requested change before proceeding.
+5. Prefer the batch operations in CONTRACT.md for multiple explicit inputs: inspect up to 1000 files, import up to 20 with a durable receipt, read up to 1000 GUIDs, or place up to 200 objects. Match returned caller keys and GUIDs; keep one write in flight per editor. Save returned GUIDs before layout verification. Repeat a batch import only with its original input and receipt; unresolved outcomes require inspection, not a new receipt.
+6. Report actual file identity, operations, verified state and unresolved outcomes. For browser close, use browser.close with its save guard; for desktop close, use board.close and verify the file is absent from the desktop's open-file tabs after the close receipt. Fit animates asynchronously, so an immediate viewport value may precede the final visual state.
+
+## Recovery and boundaries
+
+- Missing Node, desktop controls, console access, login or supported front-end build: return CAPABILITY_UNAVAILABLE / AUTH_REQUIRED / FEATURE_UNSUPPORTED with the prerequisite. Resume at step 1 or 3 after resolution; do not invent a different adapter.
+- File create or image import timeout: outcome may be unknown. Inspect the operation receipt/outcome and actual file/object state before any new mutation. Avoid duplicate creates/imports. Resume at step 4 only when the outcome is known.
+- Protected local destination: preserve unmanaged targets and edits; use CLI-managed skill status/install/update with the current Agent's explicit destination. Installation does not authorize Boardmix writes or paid service actions.
+- Package update: read `.runtime/UPDATE.md`, reconcile only this selected installation, verify CLI/Skill/receipt versions and hashes, then refresh host discovery. A current verified receipt takes a read-only completion branch. Host discovery requires host evidence.
+- New recurring integration failures belong in a separately authorized capability-package repair with tests. Business quality and layout rules remain owned by the application layer.
+
+The runtime CONTRACT.md and capabilities.json are authoritative versioned operation references. This mechanical manual directly internalizes tested command behavior; it has no nested Skill or private knowledge-base dependency. Clean-context regression is separate from ordinary operation.
+
+For remote images, image.download receives one explicit URL and a new output file. Frame and text operations are documented under Added capability operations in CONTRACT.md; native text bounds auto-fit, and Frame containment verification is geometric.
+
+For videos, require ffprobe on PATH. Use `video.download --url HTTPS_URL --output NEW_FILE`, then `video.inspect --file FILE`. `video.import --file FILE --receipt NEW_RECEIPT --session SESSION --file-key KEY` uploads a native video and verifies the source MD5, video MIME and completed loading state. MP4 limit: 100 MiB. Persist the returned GUID before moving/resizing. Reuse the same receipt after interruption; VIDEO_OUTCOME_UNRESOLVED requires inspection and must not trigger another import. A poster alone does not satisfy video import. The caller owns region placement and playback acceptance.

package/skills/boardmixcli/adapters/generic.json

@@ -0,0 +1,44 @@
+{
+  "schema": "portable-skill-adapter",
+  "schema_version": "1.0.0",
+  "platform": "generic",
+  "mappings": [
+    {
+      "capability_id": "command.execute",
+      "status": "implemented",
+      "implementation": {
+        "kind": "instruction",
+        "discovery": "Resolve command execution and native desktop controls from the current Agent advertised tools. CLI is target-owned .runtime/bin/boardmixcli.mjs; run with Node >=22. Console and tab inspection use host-authorized native desktop control. Return CAPABILITY_UNAVAILABLE when missing."
+      },
+      "features": [
+        "node22",
+        "json-results"
+      ]
+    },
+    {
+      "capability_id": "desktop.console",
+      "status": "implemented",
+      "implementation": {
+        "kind": "instruction",
+        "discovery": "Resolve command execution and native desktop controls from the current Agent advertised tools. CLI is target-owned .runtime/bin/boardmixcli.mjs; run with Node >=22. Console and tab inspection use host-authorized native desktop control. Return CAPABILITY_UNAVAILABLE when missing."
+      },
+      "features": [
+        "console-paste",
+        "inspect-open-tabs"
+      ]
+    },
+    {
+      "capability_id": "browser.cdp",
+      "status": "implemented",
+      "implementation": {
+        "kind": "cli",
+        "command": "boardmixcli browser.connect",
+        "discovery": "Current target-owned CLI; explicit authorized loopback CDP endpoint and exact Boardmix file key."
+      },
+      "features": [
+        "loopback-cdp",
+        "existing-login"
+      ]
+    }
+  ]
+}

package/skills/boardmixcli/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "BoardmixCLI"
+  short_description: "Operate Boardmix through explicit atomic CLI commands"

package/skills/boardmixcli/capabilities.json

@@ -0,0 +1,98 @@
+{
+  "schema": "portable-skill-capabilities",
+  "schema_version": "1.0.0",
+  "skill": "boardmixcli",
+  "target_platforms": [
+    "generic"
+  ],
+  "host_resolution": {
+    "fallback_adapter": "generic",
+    "destination": "host-supplied explicit Skill directory"
+  },
+  "capabilities": [
+    {
+      "id": "command.execute",
+      "purpose": "Execute target-owned Node CLI",
+      "required": true,
+      "required_features": [
+        "node22",
+        "json-results"
+      ],
+      "input_fields": [
+        "argv"
+      ],
+      "output_fields": [
+        "stdout",
+        "exitCode"
+      ],
+      "side_effects": {
+        "local_process": true,
+        "authorization": "Explicit caller operation",
+        "external_mutation": false,
+        "may_cost_money": false
+      },
+      "errors": [
+        "CAPABILITY_UNAVAILABLE",
+        "FEATURE_UNSUPPORTED"
+      ]
+    },
+    {
+      "id": "desktop.console",
+      "purpose": "Connect authorized Boardmix editor",
+      "required": false,
+      "required_features": [
+        "console-paste",
+        "inspect-open-tabs"
+      ],
+      "input_fields": [
+        "bootstrap-file",
+        "editor-file-key"
+      ],
+      "output_fields": [
+        "connected",
+        "visible-file-state"
+      ],
+      "side_effects": {
+        "application_access": true,
+        "authorization": "User authorized Boardmix access",
+        "external_mutation": true,
+        "may_cost_money": false
+      },
+      "errors": [
+        "CAPABILITY_UNAVAILABLE",
+        "FEATURE_UNSUPPORTED"
+      ]
+    },
+    {
+      "id": "browser.cdp",
+      "purpose": "Connect a caller-selected Boardmix editor without visible DevTools; alternative to desktop.console",
+      "required": false,
+      "required_features": [
+        "loopback-cdp",
+        "existing-login"
+      ],
+      "input_fields": [
+        "endpoint",
+        "file-key",
+        "session"
+      ],
+      "output_fields": [
+        "connected",
+        "fileKey",
+        "reused"
+      ],
+      "side_effects": {
+        "application_access": true,
+        "authorization": "Caller-selected browser and file",
+        "external_mutation": false,
+        "may_cost_money": false
+      },
+      "errors": [
+        "BROWSER_ENDPOINT_REQUIRED",
+        "EDITOR_NOT_OPEN",
+        "AMBIGUOUS_EDITOR",
+        "DESKTOP_ADAPTER_FAILED"
+      ]
+    }
+  ]
+}

package/skills/boardmixcli/manifest.json

@@ -0,0 +1,5 @@
+{
+  "name": "boardmixcli",
+  "package": "@petercjl/boardmixcli",
+  "version": "0.1.6"
+}