@petercjl/procli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 petercjl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,26 @@
+# procli
+
+`procli` 是自建项目管理系统面向人和 Agent 的稳定 CLI。npm 包同时分发唯一真源的 `project-management` Skill。
+
+```bash
+npm install -g @petercjl/procli@latest
+procli profile add nas --url http://NAS地址:14317 --environment production
+procli auth login --profile nas
+procli skill install --agent codex
+```
+
+默认 Profile 是 `nas`。开发时可持久切换到本地，或只覆盖一条命令：
+
+```bash
+procli profile add local --url http://127.0.0.1:4317 --environment development
+procli profile use local
+procli --profile nas project create --name "NAS 测试项目" --goal "验证最终服务" --yes
+```
+
+创建生产项目支持目标确认、幂等和写后回读：
+
+```bash
+procli project create --name "新品项目" --goal "完成市场验证与上市" --yes
+```
+
+配置和每个 Profile 的个人凭证保存在用户配置目录，不进入 npm 包或项目仓库。运行 `procli doctor --json` 查看当前 Profile、服务指纹和认证状态。

package/bin/procli.mjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { main } from "../src/main.mjs";
+
+main(process.argv.slice(2)).catch((error) => {
+  const result = {
+    ok: false,
+    error: {
+      code: error.code || "CLI_ERROR",
+      message: error.message || String(error),
+      ...(error.details ? { details: error.details } : {}),
+    },
+  };
+  console.log(JSON.stringify(result, null, 2));
+  process.exitCode = Number(error.exitCode || 1);
+});

package/capabilities.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "1",
+  "name": "procli",
+  "version": "0.1.0",
+  "defaultProfile": "nas",
+  "capabilities": [
+    {
+      "id": "project.create",
+      "command": "procli project create",
+      "effect": "write",
+      "risk": "medium",
+      "requiredInputs": ["name"],
+      "optionalInputs": ["goal", "template", "mode", "profile", "idempotencyKey"],
+      "supports": ["dryRun", "idempotency", "targetVerification", "postWriteReadback"],
+      "productionConfirmation": true
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@petercjl/procli",
+  "version": "0.1.0",
+  "description": "Agent-first CLI and portable Skill for SealSeek project management",
+  "type": "module",
+  "bin": {
+    "procli": "bin/procli.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "skill",
+    "capabilities.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test tests/*.test.mjs",
+    "prepack": "npm test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "agent",
+    "project-management",
+    "cli",
+    "dingtalk",
+    "skill"
+  ],
+  "author": "petercjl",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/petercjl/agent-project-lab.git",
+    "directory": "packages/procli"
+  }
+}

package/skill/project-management/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: project-management
+description: Create and manage projects in a procli-compatible project management service. Use when a user asks to create a new product project, choose between local development and NAS production, or verify which project environment an Agent will modify.
+---
+
+# Project Management
+
+Use the bundled `procli` executable as the only execution surface. Do not call the service API directly or infer success from prose.
+
+## Input → Strategy → Output
+
+- Input: project name is required; goal is optional; profile is optional and defaults through procli to `nas`.
+- Strategy: discover the live target, preview the write, obtain confirmation for production, create with one idempotency key, then require the CLI's write-after-readback result.
+- Output: the selected target, project record, generated task and Wiki summary, idempotency key, and an explicit success or structured error.
+
+## Main line: create a project
+
+1. Run `procli profile current --json`, then `procli doctor --json`. If the selected Profile is missing, unreachable, mismatched, or unauthenticated, stop and report the structured error.
+2. Collect the project name. Use the user's stated business outcome as `--goal`; do not invent a detailed goal when it would change project intent.
+3. Generate one UUID for this logical creation attempt and retain it across retries as `--idempotency-key`.
+4. Run a preview:
+
+   ```bash
+   procli project create --name "<name>" --goal "<goal>" --idempotency-key "<uuid>" --dry-run --json
+   ```
+
+5. State the previewed Profile, URL, environment and project name. A production write requires the user's explicit creation intent; once present, execute the same request with `--yes`. A local development write does not require `--yes`.
+6. Accept success only when the CLI returns `ok=true`, the target matches the preview, and the result contains the created project plus generated task and Wiki counts.
+7. Report the project name, ID, target Profile/environment and generated structure. Never expose stored credentials.
+
+## Profile routing
+
+The default Profile is `nas`. Respect the CLI precedence exactly:
+
+```text
+--profile > PROCLI_PROFILE > saved current Profile > nas
+```
+
+Use `--profile local` for a one-command development override. Use `procli profile use local` only when the user asks to persistently change the default. Never replace a named Profile with a raw URL during normal execution.
+
+## Failure branches
+
+- `PROFILE_NOT_CONFIGURED`: show the required `procli profile add` command and stop.
+- `TARGET_MISMATCH` or `API_VERSION_UNSUPPORTED`: stop without writing; do not bypass instance verification.
+- `AUTH_REQUIRED`: run `procli auth login --profile <name>` only when interactive browser authorization is available; otherwise return the login command.
+- `CONFIRMATION_REQUIRED`: show the target and wait for explicit authorization; then return to main-line step 5 with the same idempotency key.
+- `SERVICE_UNAVAILABLE`: do not switch from local to NAS or from NAS to local automatically. Report the selected Profile and stop.
+- Unknown write result: retry only with the same idempotency key. Never create a second logical attempt merely because the response was interrupted.
+
+## Capability contract
+
+Before execution, load `capabilities.json` and the adapter matching the advertised Agent platform. The required logical capability is `project.service.project.create`. If its mapping is unresolved or unsupported, return `CAPABILITY_UNAVAILABLE`; do not guess another API or CLI.
+
+After a reported execution failure, preserve the failed command, structured error code and target metadata for a separately authorized plugin update. Runtime execution must not edit this Skill or its adapters.

package/skill/project-management/adapters/codex.json

@@ -0,0 +1,30 @@
+{
+  "schema": "portable-skill-adapter",
+  "schema_version": "1.0.0",
+  "platform": "codex",
+  "mappings": [
+    {
+      "capability_id": "project.service.project.create",
+      "implementation": {
+        "kind": "stable-cli",
+        "discovery": "Resolve procli from PATH and verify it with procli version and procli capabilities --json.",
+        "execution": "Run procli project create with the selected Profile, one idempotency key, preview and required confirmation.",
+        "normalization": "Use the procli JSON envelope without reinterpretation."
+      },
+      "features": [
+        "profile_selection",
+        "target_identity_verification",
+        "dry_run",
+        "production_confirmation",
+        "idempotent_write",
+        "post_write_readback",
+        "structured_json"
+      ],
+      "status": "tested",
+      "permissions": ["Network access to the selected service", "Permission to create a project"],
+      "normalization": "Use the procli JSON envelope without reinterpretation.",
+      "tested_date": "2026-09-15",
+      "evidence": ["Codex resolved the installed procli 0.1.0 entry point, verified authenticated DingTalk identities for local development and NAS production Profiles, confirmed an unacknowledged production write was rejected, then created one project in each environment and received matching write-after-readback counts for seven tasks and eight Wiki paths."]
+    }
+  ]
+}

package/skill/project-management/adapters/sealseek.json

@@ -0,0 +1,28 @@
+{
+  "schema": "portable-skill-adapter",
+  "schema_version": "1.0.0",
+  "platform": "sealseek",
+  "mappings": [
+    {
+      "capability_id": "project.service.project.create",
+      "implementation": {
+        "kind": "stable-cli",
+        "discovery": "Resolve procli from PATH and verify it with procli version and procli capabilities --json.",
+        "execution": "Run procli project create with the selected Profile, one idempotency key, preview and required confirmation.",
+        "normalization": "Use the procli JSON envelope without reinterpretation."
+      },
+      "features": [
+        "profile_selection",
+        "target_identity_verification",
+        "dry_run",
+        "production_confirmation",
+        "idempotent_write",
+        "post_write_readback",
+        "structured_json"
+      ],
+      "status": "implemented",
+      "permissions": ["Network access to the selected service", "Permission to create a project"],
+      "normalization": "Use the procli JSON envelope without reinterpretation."
+    }
+  ]
+}

package/skill/project-management/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "项目管理"
+  short_description: "让 Agent 安全创建并管理商品项目及项目知识"
+  default_prompt: "Use $project-management to create a new product project in the selected procli profile."
+policy:
+  allow_implicit_invocation: true

package/skill/project-management/capabilities.json

@@ -0,0 +1,36 @@
+{
+  "schema": "portable-skill-capabilities",
+  "schema_version": "1.0.0",
+  "skill": "project-management",
+  "target_platforms": ["codex", "sealseek"],
+  "capabilities": [
+    {
+      "id": "project.service.project.create",
+      "purpose": "Create one project in the selected project-management service and verify its generated structure",
+      "required": true,
+      "required_features": [
+        "profile_selection",
+        "target_identity_verification",
+        "dry_run",
+        "production_confirmation",
+        "idempotent_write",
+        "post_write_readback",
+        "structured_json"
+      ],
+      "input_fields": ["profile", "name", "goal", "template", "mode", "idempotency_key"],
+      "output_fields": ["target", "project", "tasks", "wiki", "idempotency_key"],
+      "side_effects": {
+        "external_mutation": true,
+        "may_cost_money": false,
+        "authorization": "The user must explicitly intend to create the project; production additionally requires CLI confirmation."
+      },
+      "errors": [
+        "CAPABILITY_UNAVAILABLE",
+        "AUTH_REQUIRED",
+        "PERMISSION_REQUIRED",
+        "PROVIDER_FAILURE",
+        "OUTPUT_CONTRACT_FAILED"
+      ]
+    }
+  ]
+}

package/src/client.mjs

@@ -0,0 +1,65 @@
+import { CliError, readToken } from "./config.mjs";
+
+export async function request(profile, pathname, options = {}) {
+  const token = options.token === undefined ? await readToken(profile.name) : options.token;
+  let response;
+  try {
+    response = await fetch(profile.url + pathname, {
+      method: options.method || "GET",
+      headers: {
+        accept: "application/json",
+        ...(options.body !== undefined ? { "content-type": "application/json" } : {}),
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+        ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}),
+      },
+      body: options.body === undefined ? undefined : JSON.stringify(options.body),
+      signal: AbortSignal.timeout(options.timeoutMs || 15000),
+      redirect: options.redirect || "follow",
+    });
+  } catch (error) {
+    throw new CliError("SERVICE_UNAVAILABLE", `无法连接 Profile “${profile.name}”：${profile.url}`, {
+      cause: error.name,
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    throw new CliError("INVALID_RESPONSE", `服务返回了非 JSON 响应（HTTP ${response.status}）`);
+  }
+  if (!response.ok || payload.ok === false) {
+    const upstream = payload?.error || {};
+    throw new CliError(upstream.code || `HTTP_${response.status}`, upstream.message || `请求失败（HTTP ${response.status}）`, {
+      status: response.status,
+      profile: profile.name,
+    });
+  }
+  return { status: response.status, data: payload.data };
+}
+
+export async function inspectTarget(profile) {
+  const { data } = await request(profile, "/api/health", { token: "" });
+  const target = {
+    profile: profile.name,
+    url: profile.url,
+    environment: data.environment || "unknown",
+    instanceId: data.instanceId || "unknown",
+    apiVersion: data.apiVersion || "unknown",
+    commit: data.commit || "unknown",
+  };
+  if (profile.environment && target.environment !== profile.environment)
+    throw new CliError("TARGET_MISMATCH", "Profile 环境与服务端环境不一致", {
+      expected: profile.environment,
+      actual: target.environment,
+      profile: profile.name,
+    });
+  if (profile.instanceId && target.instanceId !== profile.instanceId)
+    throw new CliError("TARGET_MISMATCH", "Profile 实例指纹与服务端不一致", {
+      expected: profile.instanceId,
+      actual: target.instanceId,
+      profile: profile.name,
+    });
+  if (String(target.apiVersion) !== "1")
+    throw new CliError("API_VERSION_UNSUPPORTED", `服务端 API 版本不受支持：${target.apiVersion}`);
+  return target;
+}

package/src/config.mjs

@@ -0,0 +1,121 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+export class CliError extends Error {
+  constructor(code, message, details, exitCode = 1) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.exitCode = exitCode;
+  }
+}
+
+export function configPath(env = process.env, platform = process.platform) {
+  if (env.PROCLI_CONFIG_PATH) return path.resolve(env.PROCLI_CONFIG_PATH);
+  const base =
+    platform === "win32"
+      ? env.APPDATA || path.join(os.homedir(), "AppData", "Roaming")
+      : env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+  return path.join(base, "procli", "config.json");
+}
+
+export async function readConfig(file = configPath()) {
+  try {
+    const data = JSON.parse(await fs.readFile(file, "utf8"));
+    return {
+      schemaVersion: 1,
+      currentProfile: "nas",
+      profiles: {},
+      ...data,
+      profiles: data.profiles || {},
+    };
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { schemaVersion: 1, currentProfile: "nas", profiles: {} };
+    if (error instanceof SyntaxError)
+      throw new CliError("CONFIG_INVALID", `配置文件不是有效 JSON：${file}`);
+    throw error;
+  }
+}
+
+export async function writeConfig(data, file = configPath()) {
+  const dir = path.dirname(file);
+  await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+  const temp = path.join(dir, `.config.${process.pid}.${Date.now()}.tmp`);
+  await fs.writeFile(temp, JSON.stringify(data, null, 2) + "\n", {
+    flag: "wx",
+    mode: 0o600,
+  });
+  await fs.rename(temp, file);
+  await fs.chmod(file, 0o600).catch(() => {});
+}
+
+export function normalizeUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new CliError("ARGUMENT", "--url 必须是有效的 HTTP(S) 地址");
+  }
+  if (!['http:', 'https:'].includes(parsed.protocol))
+    throw new CliError("ARGUMENT", "--url 只支持 HTTP(S)");
+  parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed.toString().replace(/\/$/, "");
+}
+
+export function selectedProfileName(options, config, env = process.env) {
+  return String(options.profile || env.PROCLI_PROFILE || config.currentProfile || "nas");
+}
+
+export function resolveProfile(options, config, env = process.env) {
+  const name = selectedProfileName(options, config, env);
+  const profile = config.profiles[name];
+  if (!profile)
+    throw new CliError(
+      "PROFILE_NOT_CONFIGURED",
+      `Profile “${name}”尚未配置，请先运行 procli profile add ${name} --url <服务地址> --environment development|production`,
+      { profile: name },
+    );
+  return { name, ...profile };
+}
+
+function credentialPath(profileName, file = configPath()) {
+  if (!/^[a-zA-Z0-9._-]+$/.test(profileName))
+    throw new CliError("ARGUMENT", "Profile 名称只能包含字母、数字、点、下划线和连字符");
+  return path.join(path.dirname(file), "credentials", `${profileName}.token`);
+}
+
+export async function saveToken(profileName, token, file = configPath()) {
+  if (!token || token.length < 24)
+    throw new CliError("AUTH_FAILED", "服务端没有返回有效的 CLI 凭证");
+  const dest = credentialPath(profileName, file);
+  await fs.mkdir(path.dirname(dest), { recursive: true, mode: 0o700 });
+  const temp = `${dest}.${process.pid}.${Date.now()}.tmp`;
+  await fs.writeFile(temp, token, { flag: "wx", mode: 0o600 });
+  await fs.rename(temp, dest);
+  await fs.chmod(dest, 0o600).catch(() => {});
+  return dest;
+}
+
+export async function readToken(profileName, file = configPath()) {
+  try {
+    return (await fs.readFile(credentialPath(profileName, file), "utf8")).trim();
+  } catch (error) {
+    if (error.code === "ENOENT") return "";
+    throw error;
+  }
+}
+
+export async function deleteToken(profileName, file = configPath()) {
+  const dest = credentialPath(profileName, file);
+  try {
+    await fs.unlink(dest);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}

package/src/main.mjs

@@ -0,0 +1,204 @@
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import { CliError, configPath, deleteToken, normalizeUrl, readConfig, readToken, resolveProfile, saveToken, selectedProfileName, writeConfig } from "./config.mjs";
+import { inspectTarget, request } from "./client.mjs";
+import { installSkill, skillSource, skillStatus } from "./skill.mjs";
+
+const VERSION = "0.1.0";
+const help = `procli ${VERSION} — Agent-first project management CLI
+
+Profile（默认 nas）：
+  profile add NAME --url URL --environment development|production
+  profile list | current | use NAME | remove NAME
+
+认证：
+  auth login [--profile NAME] [--no-open] [--timeout-ms 300000]
+  auth status|logout [--profile NAME]
+
+项目：
+  project create --name NAME [--goal TEXT] [--template ecommerce-v1]
+                 [--mode agent] [--idempotency-key KEY] [--dry-run] [--yes]
+
+发现与安装：
+  capabilities [--profile NAME]
+  doctor [--profile NAME]
+  skill source
+  skill status|install|update --agent codex|agents|sealseek|openclaw [--mode auto|link|copy]
+
+全局：--profile NAME --json
+Profile 选择顺序：--profile > PROCLI_PROFILE > profile use > nas。`;
+
+export function parseArgs(argv) {
+  const options = {};
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const value = argv[i];
+    if (value.startsWith("--")) {
+      const key = value.slice(2);
+      if (["json", "yes", "dry-run", "no-open", "help", "version"].includes(key)) options[key] = true;
+      else {
+        if (!argv[i + 1] || argv[i + 1].startsWith("--")) throw new CliError("ARGUMENT", `缺少 --${key} 的值`);
+        options[key] = argv[++i];
+      }
+    } else positional.push(value);
+  }
+  return { options, positional };
+}
+
+function required(options, key) {
+  if (typeof options[key] !== "string" || !options[key].trim()) throw new CliError("ARGUMENT", `缺少 --${key}`);
+  return options[key].trim();
+}
+
+function output(data, ok = true) {
+  console.log(JSON.stringify({ ok, data }, null, 2));
+  if (!ok) process.exitCode = 1;
+}
+
+async function openUrl(url) {
+  const command = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  const child = spawn(command[0], command[1], { detached: true, stdio: "ignore" });
+  child.unref();
+}
+
+async function authLogin(profile, options) {
+  const verifier = crypto.randomBytes(32).toString("base64url");
+  const verifierHash = crypto.createHash("sha256").update(verifier).digest("hex");
+  const started = await request(profile, "/api/auth/cli/start", { method: "POST", body: { verifierHash, clientName: `procli/${VERSION}` }, token: "" });
+  if (!options["no-open"]) await openUrl(started.data.verificationUrl);
+  process.stderr.write(`请在浏览器完成钉钉授权：${started.data.verificationUrl}\n`);
+  const timeoutMs = Math.max(10000, Number(options["timeout-ms"] || 300000));
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, Number(started.data.intervalMs || 1500)));
+    const response = await fetch(profile.url + "/api/auth/cli/poll", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ requestId: started.data.requestId, verifier }),
+      signal: AbortSignal.timeout(15000),
+    });
+    const payload = await response.json();
+    if (response.status === 202) continue;
+    if (!response.ok || !payload.ok) throw new CliError(payload?.error?.code || "AUTH_FAILED", payload?.error?.message || "CLI 授权失败");
+    await saveToken(profile.name, payload.data.token);
+    return { profile: profile.name, url: profile.url, authenticated: true, member: payload.data.member, expiresAt: payload.data.expiresAt };
+  }
+  throw new CliError("AUTH_TIMEOUT", "等待钉钉授权超时，请重新运行 auth login");
+}
+
+export async function main(argv) {
+  const { options, positional } = parseArgs(argv);
+  const [group, command] = positional;
+  if (options.version || group === "version") return output({ version: VERSION });
+  if (!group || group === "help" || options.help) return console.log(help);
+  const file = configPath();
+  const config = await readConfig(file);
+
+  if (group === "profile") {
+    if (command === "add") {
+      const name = positional[2];
+      if (!name || !/^[a-zA-Z0-9._-]+$/.test(name)) throw new CliError("ARGUMENT", "请提供有效 Profile 名称");
+      const environment = required(options, "environment");
+      if (!['development', 'production'].includes(environment)) throw new CliError("ARGUMENT", "--environment 必须是 development 或 production");
+      const candidate = { name, url: normalizeUrl(required(options, "url")), environment };
+      const target = await inspectTarget(candidate);
+      config.profiles[name] = { url: candidate.url, environment, instanceId: target.instanceId };
+      await writeConfig(config, file);
+      return output({ profile: name, ...config.profiles[name], verified: true });
+    }
+    if (command === "list") return output({ currentProfile: config.currentProfile || "nas", profiles: config.profiles });
+    if (command === "current") {
+      const name = selectedProfileName(options, config);
+      return output({ selectedBy: options.profile ? "flag" : process.env.PROCLI_PROFILE ? "environment" : "default", profile: name, ...(config.profiles[name] || { configured: false }) });
+    }
+    if (command === "use") {
+      const name = positional[2];
+      if (!config.profiles[name]) throw new CliError("PROFILE_NOT_CONFIGURED", `Profile “${name}”尚未配置`);
+      config.currentProfile = name;
+      await writeConfig(config, file);
+      return output({ currentProfile: name, ...config.profiles[name] });
+    }
+    if (command === "remove") {
+      const name = positional[2];
+      if (!config.profiles[name]) throw new CliError("PROFILE_NOT_CONFIGURED", `Profile “${name}”尚未配置`);
+      delete config.profiles[name];
+      if (config.currentProfile === name) config.currentProfile = "nas";
+      await writeConfig(config, file);
+      await deleteToken(name, file);
+      return output({ removed: name, currentProfile: config.currentProfile });
+    }
+    throw new CliError("UNKNOWN_COMMAND", "未知 profile 命令");
+  }
+
+  if (group === "skill") {
+    if (command === "source") return output({ skill: "project-management", source: skillSource });
+    const agent = options.agent || "";
+    if (command === "status") return output(await skillStatus(agent, options["target-dir"]));
+    if (command === "install") return output(await installSkill({ agent, customRoot: options["target-dir"], mode: options.mode || "auto" }));
+    if (command === "update") return output(await installSkill({ agent, customRoot: options["target-dir"], mode: options.mode || "auto", update: true }));
+    throw new CliError("UNKNOWN_COMMAND", "未知 skill 命令");
+  }
+
+  const profile = resolveProfile(options, config);
+  if (group === "doctor") {
+    const checks = { node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.versions.node }, config: { ok: true, path: file }, profile: { ok: true, ...profile } };
+    try { checks.server = { ok: true, ...(await inspectTarget(profile)) }; } catch (error) { checks.server = { ok: false, code: error.code, message: error.message }; }
+    const token = await readToken(profile.name, file);
+    if (!token) checks.auth = { ok: false, code: "AUTH_REQUIRED" };
+    else {
+      try { checks.auth = { ok: true, ...(await request(profile, "/api/auth/cli/status", { token })).data }; }
+      catch (error) { checks.auth = { ok: false, code: error.code, message: error.message }; }
+    }
+    const ok = Object.values(checks).every((item) => item.ok);
+    return output({ checks }, ok);
+  }
+  if (group === "capabilities") {
+    const manifest = JSON.parse(await fs.readFile(new URL("../capabilities.json", import.meta.url), "utf8"));
+    let server;
+    try { server = (await request(profile, "/api/capabilities", { token: "" })).data; } catch (error) { server = { available: false, code: error.code }; }
+    return output({ cli: manifest, server, target: await inspectTarget(profile) });
+  }
+  if (group === "auth") {
+    if (command === "login") return output(await authLogin(profile, options));
+    if (command === "status") {
+      const token = await readToken(profile.name, file);
+      if (!token) throw new CliError("AUTH_REQUIRED", `Profile “${profile.name}”尚未登录`);
+      return output({ profile: profile.name, url: profile.url, ...(await request(profile, "/api/auth/cli/status", { token })).data });
+    }
+    if (command === "logout") {
+      const token = await readToken(profile.name, file);
+      if (token) await request(profile, "/api/auth/cli/revoke", { method: "POST", token }).catch(() => {});
+      const removed = await deleteToken(profile.name, file);
+      return output({ profile: profile.name, loggedOut: true, localCredentialRemoved: removed });
+    }
+    throw new CliError("UNKNOWN_COMMAND", "未知 auth 命令");
+  }
+  if (group === "project" && command === "create") {
+    const target = await inspectTarget(profile);
+    const input = { name: required(options, "name"), goal: options.goal || "", template: options.template || "ecommerce-v1", mode: options.mode || "agent" };
+    if (input.template !== "ecommerce-v1") throw new CliError("ARGUMENT", "当前只支持模板 ecommerce-v1");
+    const idempotencyKey = options["idempotency-key"] || crypto.randomUUID();
+    if (options["dry-run"]) return output({ dryRun: true, target, input, idempotencyKey });
+    if (target.environment === "production" && !options.yes)
+      throw new CliError("CONFIRMATION_REQUIRED", "目标是生产环境；确认创建后请增加 --yes", { target, input });
+    const result = await request(profile, "/api/v1/projects", { method: "POST", body: input, idempotencyKey });
+    const readback = await request(profile, `/api/v1/projects/${encodeURIComponent(result.data.project.id)}`);
+    if (
+      readback.data.project.id !== result.data.project.id ||
+      readback.data.tasks.count !== result.data.tasks.count ||
+      readback.data.wiki.count !== result.data.wiki.count
+    )
+      throw new CliError("OUTPUT_CONTRACT_FAILED", "项目写入后的回读结果与创建结果不一致", {
+        projectId: result.data.project.id,
+      });
+    return output({
+      target,
+      idempotencyKey,
+      ...readback.data,
+      audit: result.data.audit,
+      verification: "write-after-readback",
+    });
+  }
+  throw new CliError("UNKNOWN_COMMAND", "未知命令，运行 procli help 查看用法");
+}

package/src/skill.mjs

@@ -0,0 +1,73 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { CliError } from "./config.mjs";
+
+export const skillSource = fileURLToPath(new URL("../skill/project-management/", import.meta.url));
+
+function targetRoot(agent) {
+  const roots = {
+    codex: path.join(os.homedir(), ".codex", "skills"),
+    agents: path.join(os.homedir(), ".agents", "skills"),
+    sealseek: path.join(os.homedir(), ".sealseek", "skill_pool"),
+    openclaw: path.join(os.homedir(), ".openclaw", "skills"),
+  };
+  if (!roots[agent]) throw new CliError("ARGUMENT", "--agent 必须是 codex、agents、sealseek 或 openclaw");
+  return roots[agent];
+}
+
+async function digest(root) {
+  const hash = crypto.createHash("sha256");
+  async function walk(dir) {
+    for (const entry of (await fs.readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) await walk(full);
+      else if (entry.isFile()) {
+        hash.update(path.relative(root, full));
+        hash.update(await fs.readFile(full));
+      }
+    }
+  }
+  await walk(root);
+  return hash.digest("hex");
+}
+
+export async function skillStatus(agent, customRoot) {
+  const root = customRoot ? path.resolve(customRoot) : targetRoot(agent);
+  const destination = path.join(root, "project-management");
+  const sourceDigest = await digest(skillSource);
+  try {
+    const stat = await fs.lstat(destination);
+    if (stat.isSymbolicLink()) {
+      const resolved = await fs.realpath(destination);
+      return { skill: "project-management", source: skillSource, sourceDigest, targetRoot: root, destination, state: resolved === await fs.realpath(skillSource) ? "current" : "foreign-link", mode: "link", managed: resolved === await fs.realpath(skillSource), current: resolved === await fs.realpath(skillSource), resolved };
+    }
+    const marker = JSON.parse(await fs.readFile(path.join(destination, ".procli-managed.json"), "utf8"));
+    const current = marker.sourceDigest === sourceDigest;
+    return { skill: "project-management", source: skillSource, sourceDigest, targetRoot: root, destination, state: current ? "current" : "outdated", mode: "copy", managed: true, current };
+  } catch (error) {
+    if (error.code === "ENOENT") return { skill: "project-management", source: skillSource, sourceDigest, targetRoot: root, destination, state: "absent", managed: false, current: false };
+    if (error instanceof SyntaxError) return { skill: "project-management", source: skillSource, sourceDigest, targetRoot: root, destination, state: "foreign-directory", managed: false, current: false };
+    throw error;
+  }
+}
+
+export async function installSkill({ agent, customRoot, mode = "auto", update = false }) {
+  const status = await skillStatus(agent, customRoot);
+  if (status.current) return status;
+  if (status.state !== "absent" && !status.managed)
+    throw new CliError("SKILL_TARGET_OCCUPIED", `目标已有非 procli 管理的 Skill：${status.destination}`);
+  const selectedMode = mode === "auto" ? (process.platform === "win32" ? "copy" : "link") : mode;
+  if (!['link', 'copy'].includes(selectedMode)) throw new CliError("ARGUMENT", "--mode 必须是 auto、link 或 copy");
+  await fs.mkdir(status.targetRoot, { recursive: true });
+  if (status.managed && update) await fs.rm(status.destination, { recursive: true, force: true });
+  else if (status.state !== "absent") throw new CliError("SKILL_UPDATE_REQUIRED", "Skill 已存在，请使用 procli skill update");
+  if (selectedMode === "link") await fs.symlink(skillSource, status.destination, process.platform === "win32" ? "junction" : "dir");
+  else {
+    await fs.cp(skillSource, status.destination, { recursive: true, errorOnExist: true });
+    await fs.writeFile(path.join(status.destination, ".procli-managed.json"), JSON.stringify({ sourceDigest: status.sourceDigest, package: "@petercjl/procli" }, null, 2) + "\n");
+  }
+  return skillStatus(agent, customRoot);
+}