@petercjl/taobao-ai-ops 0.4.1 → 0.4.2

package/INSTALL.md

@@ -0,0 +1,13 @@
+# 安装淘宝 AI 运营工具集
+
+把以下提示词发送给当前使用的 Agent：
+
+> 安装 @petercjl/taobao-ai-ops，并安装配套 Skill。
+
+当前 Agent 先解析自己的 Skill 目录与可用能力，再读取包的安装合同。安装包含完整 Skill 资源、CLI 与依赖；安装完成后由当前宿主验证 Skill 发现与实际入口。配置、登录和业务服务授权分别办理。
+
+支持能力集合合同的宿主可订阅包根的 `sealwork.collection.json`。sealwork 的插件页添加完整 npm 包名，启动后默认自动更新壳和成员，并安装以后登记的新成员。它使用宿主独占的整套版本目录，保留已有单独安装的 Skill；停止订阅后这些独立安装仍可使用。
+
+开发者合同：`collection check --previous <collection.json> --json` 只检查；`collection prepare --directory <new-directory> --previous <collection.json> --yes --json` 生成候选。首次安装省略 previous。宿主提供 Node 和 `npm_execpath` 指向的 npm CLI，不运行 npm 生命周期脚本；宿主负责任务隔离、候选验证、激活、原生 Skill 刷新和失败回退。候选回执包含完整成员、所有 Skill、目标自有 CLI 入口与运行环境。Skill 和成员方法仍由各自包拥有。
+
+目录必须是新目录。安装失败删除本次候选；未知结果先检查候选回执和实际入口，避免重复安装。安装成功与宿主发现确认分别记录。

package/UPDATE.md

@@ -0,0 +1,13 @@
+# 更新淘宝 AI 运营工具集
+
+把以下提示词发送给当前使用的 Agent：
+
+> 更新 @petercjl/taobao-ai-ops 及其成员包。
+
+已在 sealwork 订阅并启动时，默认每六小时检查壳和全部成员。即使壳版本没有变化，成员也会独立检查。管理员新增成员后发布成员包、登记清单并发布壳；既有成员更新只发布该成员即可。普通业务调用使用已经选定的版本。
+
+自动安装稳定兼容版本：1.x 及以上保持主版本，0.x 保持次版本，拒绝降版。跨兼容边界保留当前版本，并在插件详情报告需要显式选择的版本。关闭自动更新时冻结当前集合；停止时取消发现与自动检查，保留代码以便再次启动；移除清理该订阅自己的代码。
+
+宿主安装完整候选后，在任务和审批空闲时切换并刷新 Skill。下载失败、离线、候选验证失败、用户修改过受管 Skill 或宿主刷新失败时，保留上一套。更新只涉及选定宿主的订阅目录，配置和凭据留在包外。插件详情显示实际成员版本及上次检查结果。
+
+开发者：每次检查都以当前壳的注册表为准，与 previous 回执比较成员身份、版本和所需 Skill；`collection prepare` 返回独立候选，宿主验证后才激活。回执中的运行环境必须跟随 CLI 调用，当前任务内保持同一版本。新集合入口不接管历史全局 npm 安装；历史安装继续通过其已声明的维护入口操作。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@petercjl/taobao-ai-ops",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Independent Taobao AI operations SOP skills with a managed suite lifecycle",
   "repository": {
     "type": "git",
@@ -26,7 +26,10 @@
     "!skills/**/__pycache__/**",
     "!skills/**/*.pyc",
     "!skills/**/*.bak",
-    "!skills/**/.install-meta.json"
+    "!skills/**/.install-meta.json",
+    "sealwork.collection.json",
+    "INSTALL.md",
+    "UPDATE.md"
   ],
   "publishConfig": {
     "access": "public",

package/sealwork.collection.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": 1,
+  "kind": "capability-collection",
+  "id": "petercjl.taobao-ai-ops",
+  "name": "淘宝 AI 运营工具集",
+  "description": "独立发布的电商 Skill 与 CLI，自动检查壳和成员更新并安装新增成员。",
+  "entry": "bin/taobao-ai-ops.mjs",
+  "platforms": ["darwin", "win32", "linux"],
+  "autoUpdate": {"channel": "latest", "compatibility": "semver"}
+}

package/skills/taobao-ai-operations/SKILL.md

@@ -80,3 +80,10 @@ Before every audio component invocation, the suite checks stable latest, install
 输入为当次源图、商品依据和用户目标，可补充已确认文案、比例和版式要求。输出为本轮约定数量的独立成图及简短验收说明，或仅要求的转换规划。品牌方法、人物与产品约束、素材选择、摄影与排版顺序、提示词、任务恢复及效果验收由子 Skill 的当前主线承接。遇到来源/合同不兼容、缺失资产或宿主能力不可用时，保留子层结构化错误并停止受影响阶段；满足条件后回到子层执行节点，完成后返回套件主线第 6 步交付。
 
 独立包与素材不复制到套件。普通业务使用已安装版本；显式套件更新获取该组件的正式 latest 并同步受管 Skill。本应用依赖 sealseek-media-cli（0.6.1+）和配套 sealseek-media Skill；缺失或不兼容时暂停整个应用任务，给出“请安装 npm 包 @petercjl/sealseek-media-cli。”，安装并复查通过后恢复。模型和服务授权遵循媒体包当前合同，其他应用的生图路由保持各自合同。
+
+
+## 宿主管理的能力集合
+
+当前宿主通过能力集合订阅安装时，宿主提供的 collection-runtime 回执声明本任务的 runtimeEntry 与 environment。调用所选 CLI 时使用该入口和环境，依照当前 Skill 完成业务；壳通过自己的组件记录解析成员。业务期间保持该版本集合。安装、定期更新、启停、移除和热刷新由宿主订阅管理；本 Skill 负责业务路由及子 Skill 的完整当前主线。
+
+维护时，壳独立检查全部注册成员，无需壳先发布新版本。新建成员包发布后登记并发布壳；既有成员的后续更新只发布成员即可。首次订阅默认允许安装以后登记的新成员，业务登录、付费与外部操作继续遵循各能力的授权。离线、合同或安装失败保留当前集合，并回到失败阶段恢复；不要通过业务调用替换正在使用的集合。

package/src/cli.mjs

@@ -6,12 +6,14 @@ import {targetRoot,status,install} from './skill-manager.mjs';
 import {runScript,doctor,toolEntry,componentEnvironment} from './runtime.mjs';
 import {plan,workflowStatus,createHandoff} from './workflow.mjs';
 import {checkUpdate,installUpdate} from './update.mjs';
+import {collectionCheck,collectionPrepare} from './subscription.mjs';
+import fs from 'node:fs/promises';
 const print=v=>console.log(JSON.stringify(v,null,2));
-function options(args){const out={};for(let i=0;i<args.length;i++){const k=args[i];if(['--json','--adopt','--yes'].includes(k))out[k.slice(2)]=true;else if(['--path','--agent','--target-dir','--name','--node','--profile','--mode','--run-dir','--input','--out','--candidate','--query','--tag','--context','--run-id'].includes(k)){if(!args[i+1]||args[i+1].startsWith('--'))throw fail('USAGE',`${k} needs a value`);out[k.slice(2).replace(/-([a-z])/g,(_,c)=>c.toUpperCase())]=args[++i];}else throw fail('USAGE',`Unknown option ${k}`);}return out;}
+function options(args){const out={};for(let i=0;i<args.length;i++){const k=args[i];if(['--json','--adopt','--yes'].includes(k))out[k.slice(2)]=true;else if(['--directory','--previous','--path','--agent','--target-dir','--name','--node','--profile','--mode','--run-dir','--input','--out','--candidate','--query','--tag','--context','--run-id'].includes(k)){if(!args[i+1]||args[i+1].startsWith('--'))throw fail('USAGE',`${k} needs a value`);out[k.slice(2).replace(/-([a-z])/g,(_,c)=>c.toUpperCase())]=args[++i];}else throw fail('USAGE',`Unknown option ${k}`);}return out;}
 export async function main(argv){
  const [command,action,...rest]=argv;
- if(!command||['help','--help','-h'].includes(command))return console.log(`taobao-ai-ops ${PACKAGE.version}\nversion | nodes list | node show ID | capabilities\ndoctor --node ID [--mode excel|nas]\nskill source [--name NAME] | skill status|install|update --agent AGENT [--profile research] [--adopt]\ncomponents status|check|install [--agent AGENT --yes]\ncomponents register --name ID --path CHECKOUT --yes [--mode npm]\ncomponent run ID [arguments...] | script NODE SCRIPT [arguments...] | tool run TOOL [arguments...]\nworkflow plan|status --run-dir DIR [--node ID] [--input FILE]\nhandoff create --node ID --input FILE --out FILE [--candidate PATH --query QUERY]\nupdate check|install [--tag latest] [--agent AGENT --yes]`);
- if(['version','--version'].includes(command))return console.log(PACKAGE.version);
+ if(!command||['help','--help','-h'].includes(command))return console.log(`taobao-ai-ops ${PACKAGE.version}\nversion | nodes list | node show ID | capabilities\ncollection check [--previous RECEIPT] --json | collection prepare --directory NEW --yes --json [--previous RECEIPT]\ndoctor --node ID [--mode excel|nas]\nskill source [--name NAME] | skill status|install|update --agent AGENT [--profile research] [--adopt]\ncomponents status|check|install [--agent AGENT --yes]\ncomponents register --name ID --path CHECKOUT --yes [--mode npm]\ncomponent run ID [arguments...] | script NODE SCRIPT [arguments...] | tool run TOOL [arguments...]\nworkflow plan|status --run-dir DIR [--node ID] [--input FILE]\nhandoff create --node ID --input FILE --out FILE [--candidate PATH --query QUERY]\nupdate check|install [--tag latest] [--agent AGENT --yes]`);
+ if(['version','--version'].includes(command))return action==='--json'?print({ok:true,package:PACKAGE.name,version:PACKAGE.version}):console.log(PACKAGE.version);
  if(command==='script')return runScript(action,rest[0],rest.slice(1));
  if(command==='component'&&action==='run'){
   await prepareComponentRun(rest[0]);
@@ -23,9 +25,14 @@ export async function main(argv){
  }
  if(command==='nodes'&&action==='list')return print(MANIFEST.nodes);
  if(command==='node'&&action==='show')return print(nodeFor(rest[0]));
- if(command==='capabilities')return print({package:PACKAGE.name,version:PACKAGE.version,...MANIFEST});
+ if(command==='capabilities')return print({package:PACKAGE.name,version:PACKAGE.version,...MANIFEST,collectionContract:{schemaVersion:1,manifest:'sealwork.collection.json',check:['collection','check','--json'],prepare:['collection','prepare','--directory','{newDirectory}','--yes','--json'],previousOption:'--previous',installationMode:'host-owned-generation',hostDiscoveryAuthority:'host'}});
  if(command==='doctor'){const opts=options(argv.slice(1));const r=await doctor(opts.node,opts.mode);print(r);if(!r.ok)process.exitCode=1;return;}
  const opts=options(rest);
+ if(command==='collection'){
+  if(action==='check')return print(await collectionCheck(opts.previous?JSON.parse(await fs.readFile(opts.previous,'utf8')):undefined));
+  if(action==='prepare')return print(await collectionPrepare(opts));
+ }
+
  if(command==='components'){
   if(action==='status')return print({ok:true,components:componentRecords()});
   if(action==='check')return print(await checkComponents());

package/src/components.mjs

@@ -13,20 +13,8 @@ export async function inspectComponent(id,root){
  if(p.name!==c.package)throw fail('COMPONENT_IDENTITY_MISMATCH',`${id}: ${p.name}`);
  const entry=path.resolve(root,p.bin?.[c.bin]||'');
  if(!p.bin?.[c.bin]||!entry.startsWith(path.resolve(root)+path.sep))throw fail('INVALID_COMPONENT_ENTRY',id);
- const sources={};
- for(const skill of c.skills){
-  const r=spawnSync(process.execPath,[entry,'skill','source','--json'],{encoding:'utf8',timeout:30000,env:{...process.env,TBCLI_UPDATE_CHECK:'0',SYCMCLI_DISABLE_AUTO_UPDATE:'1',SEEDAUDIO_AUTO_UPDATE:'0',SEALSEEK_MEDIA_AUTO_UPDATE:'0',COMPETITOR_CANVAS_AUTO_UPDATE:'0'}});
-  if(r.status!==0)throw fail('COMPONENT_SOURCE_FAILED',r.stderr||id);
-  const envelope=JSON.parse(r.stdout);
-  if(envelope.ok===false)throw fail('COMPONENT_SOURCE_FAILED',id, envelope.error);
-  const result=envelope.data??envelope;
-  if(result.skill&&result.skill!==skill)throw fail('SKILL_IDENTITY_MISMATCH',skill);
-  const s=result.source||(result.skills||[]).find(s=>s.skill===skill)?.source;
-  if(!s||!path.resolve(s).startsWith(path.resolve(root)+path.sep))throw fail('INVALID_COMPONENT_SOURCE',skill);
-  const text=await fs.readFile(path.join(s,'SKILL.md'),'utf8');
-  if(!new RegExp(`^name: ${skill}\\s*$`,'m').test(text))throw fail('SKILL_IDENTITY_MISMATCH',skill);
-  sources[skill]=s;
- }
+ const {readSources}=await import('./subscription.mjs');
+ const sources=Object.fromEntries((await readSources(entry,root,c)).map(s=>[s.name,s.source]));
  return {package:p.name,version:p.version,root:path.resolve(root),entry,sources};
 }
 async function save(records){

package/src/subscription.mjs

@@ -0,0 +1,105 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {spawn} from 'node:child_process';
+import {ROOT,PACKAGE,MANIFEST,fail,stat,fileHashes} from './core.mjs';
+
+const stable=v=>typeof v==='string'&&/^\d+\.\d+\.\d+$/.test(v);
+export function compatible(current,next){
+ if(!stable(current)||!stable(next))return false;
+ const a=current.split('.').map(Number),b=next.split('.').map(Number);
+ return a[0]===b[0]&&(a[0]!==0||a[1]===b[1])&&next.localeCompare(current,undefined,{numeric:true})>=0;
+}
+export async function collectionCheck(previous,registry=fetch){
+ if(previous&&(previous.package!==PACKAGE.name||!Array.isArray(previous.members)||!stable(previous.version)))throw fail('INVALID_PREVIOUS_COLLECTION','Previous receipt must belong to this collection');
+ const members=[];
+ for(const [id,c] of Object.entries(MANIFEST.components)){
+  const response=await registry(`https://registry.npmjs.org/${encodeURIComponent(c.package)}/latest`,{signal:AbortSignal.timeout(15000)});
+  if(!response.ok)throw fail('REGISTRY_UNAVAILABLE',`${c.package}: HTTP ${response.status}; keep current collection`);
+  const metadata=await response.json();
+  if(metadata.name!==c.package||!stable(metadata.version))throw fail('INVALID_REGISTRY_IDENTITY',c.package);
+  const old=previous?.members?.find(m=>m.package===c.package);
+  const accepted=!old||compatible(old.version,metadata.version);
+  members.push({id,package:c.package,version:accepted?metadata.version:old.version,available:metadata.version,
+   bin:c.bin,skills:c.skills,blocked:!accepted});
+ }
+ const changed=previous?.version!==PACKAGE.version||JSON.stringify(members.map(m=>[m.id,m.package,m.version,m.skills]))!==JSON.stringify(previous?.members?.map(m=>[m.id,m.package,m.version,m.skills]));
+ return {ok:true,schemaVersion:1,package:PACKAGE.name,version:PACKAGE.version,changed,members};
+}
+export const maintenanceEnvironment=()=>({...process.env,AGENT_PACKAGE_UPDATE_CHECK:'0',TAOBAO_AI_OPS_AUTO_UPDATE:'0',TBCLI_UPDATE_CHECK:'0',SYCMCLI_DISABLE_AUTO_UPDATE:'1',SEEDAUDIO_AUTO_UPDATE:'0',SEALSEEK_MEDIA_AUTO_UPDATE:'0',COMPETITOR_CANVAS_AUTO_UPDATE:'0'});
+async function run(command,args,timeout=300000){
+ return new Promise((resolve,reject)=>{
+  const child=spawn(command,args,{env:maintenanceEnvironment(),stdio:['ignore','pipe','pipe'],windowsHide:true});
+  let output='',error='';
+  child.stdout.on('data',b=>{output+=b;if(output.length>8_000_000)child.kill();});
+  child.stderr.on('data',b=>{error=(error+b).slice(-4000);});
+  const timer=setTimeout(()=>child.kill(),timeout);
+  child.on('error',e=>{clearTimeout(timer);reject(e);});
+  child.on('close',code=>{clearTimeout(timer);code===0?resolve(output):reject(fail('COLLECTION_CHILD_FAILED',`Command exited ${code}`,{entry:command,args:args.slice(0,4),diagnostic:error}));});
+ });
+}
+function within(root,value){const p=path.resolve(root,value),r=path.relative(root,p);if(!r||r==='..'||r.startsWith('..'+path.sep)||path.isAbsolute(r))throw fail('UNSAFE_COMPONENT_PATH',value);return p;}
+export async function readSources(entry,root,member){
+ root=await fs.realpath(root);
+ let capabilities={};
+ try{capabilities=JSON.parse(await fs.readFile(path.join(root,'capabilities.json'),'utf8'));}catch{}
+ const collection=capabilities.discoveryContract?.skillCollection;
+ const argv=collection?.enumeration?.argv||['skill','source','--json'];
+ const raw=JSON.parse(await run(process.execPath,[entry,...argv],45000));
+ const data=raw.data??raw;if(raw.ok===false)throw fail('COMPONENT_SOURCE_FAILED',member.package);
+ const items=data[collection?.enumeration?.itemsField||'sources']??data.skills??(data.source?[data]:[]);
+ const discovered=items.filter(s=>s&&typeof s==='object');
+ const result=[];
+ for(const item of discovered){
+  const name=item.skill??item.name??(discovered.length===1&&member.skills.length===1?member.skills[0]:undefined);
+  if(typeof name!=='string'||!/^[a-z0-9][a-z0-9-]{1,99}$/.test(name))throw fail('INVALID_SKILL_IDENTITY',member.package);
+  let source;try{source=await fs.realpath(item.source??item.path);within(root,source);}catch{throw fail('INVALID_COMPONENT_SOURCE',name);}
+  const real=await fs.realpath(source);within(await fs.realpath(root),real);
+  const text=(await fs.readFile(path.join(source,'SKILL.md'),'utf8')).replace(/\r\n?/g,'\n');
+  if(!new RegExp(`^name:\\s*${name}\\s*$`,'m').test(text))throw fail('SKILL_IDENTITY_MISMATCH',`${member.package}: ${name}`);
+  result.push({name,source});
+ }
+ for(const name of member.skills)if(!result.some(s=>s.name===name))throw fail('INCOMPLETE_COMPONENT_SOURCES',`${member.package}: ${name}`);
+ return result;
+}
+// Creates a whole host-owned candidate. The host alone activates it or deletes it.
+// Ordinary business calls never replace this graph underneath an active task.
+export async function collectionPrepare(opts,services={}){
+ if(!opts.yes||!opts.directory)throw fail('USAGE','collection prepare requires --directory and --yes');
+ const directory=path.resolve(opts.directory);
+ if(await stat(directory))throw fail('TARGET_EXISTS','Candidate directory must be new');
+ const previous=opts.previous?JSON.parse(await fs.readFile(opts.previous,'utf8')):undefined;
+ const plan=await collectionCheck(previous,services.registry);
+ await fs.mkdir(directory,{recursive:true,mode:0o700});
+ try{
+  const shell=path.join(directory,'shell'),runtime=path.join(directory,'runtime'),skills=path.join(directory,'skills');
+  await fs.cp(ROOT,shell,{recursive:true,filter:p=>!['node_modules','.git','dev','test','.qa-skills'].includes(path.basename(p))});
+  await fs.mkdir(runtime);await fs.mkdir(skills);
+  const npmCli=process.env.npm_execpath;
+  if(!npmCli?.endsWith('npm-cli.js'))throw fail('NPM_UNAVAILABLE','Host must supply its managed npm-cli.js in npm_execpath');
+  await (services.run??run)(process.execPath,[npmCli,'install','--prefix',runtime,'--ignore-scripts','--no-audit','--no-fund','--package-lock=true',...plan.members.map(m=>`${m.package}@${m.version}`)],600000);
+  const installed=[],records={};
+  async function copySkill(name,source,entry,member){
+   if(installed.some(s=>s.name===name))throw fail('DUPLICATE_SKILL',name);
+   const destination=path.join(skills,name);await fileHashes(source);await fs.cp(source,destination,{recursive:true,dereference:true});
+   installed.push({name,package:member.package,version:member.version,source,directory:destination,runtimeEntry:entry});
+  }
+  for(const member of plan.members){
+   const root=path.join(runtime,'node_modules',...member.package.split('/'));
+   const identity=JSON.parse(await fs.readFile(path.join(root,'package.json'),'utf8'));
+   if(identity.name!==member.package||identity.version!==member.version)throw fail('COMPONENT_IDENTITY_MISMATCH',member.package);
+   const entry=within(root,typeof identity.bin==='string'?identity.bin:identity.bin?.[member.bin]??'');
+   await fs.access(entry);
+   const sources=await readSources(entry,root,member);
+   records[member.id]={package:member.package,version:member.version,root,entry,sources:Object.fromEntries(sources.map(s=>[s.name,s.source]))};
+   for(const s of sources)await copySkill(s.name,s.source,entry,member);
+  }
+  await copySkill('taobao-ai-operations',path.join(shell,'skills','taobao-ai-operations'),path.join(shell,'bin','taobao-ai-ops.mjs'),{package:PACKAGE.name,version:PACKAGE.version});
+  const state=path.join(directory,'state');await fs.mkdir(state);
+  await fs.writeFile(path.join(state,'components.json'),JSON.stringify({schema_version:1,components:records}),{flag:'wx',mode:0o600});
+  const receipt={...plan,skillsDirectory:skills,skills:installed,environment:{TAOBAO_AI_OPS_STATE_DIR:state,TAOBAO_AI_OPS_AUTO_UPDATE:'0',AGENT_PACKAGE_UPDATE_CHECK:'0'}};
+  for(const skill of installed)await fs.writeFile(path.join(skill.directory,'.collection-runtime.json'),JSON.stringify({runtimeEntry:skill.runtimeEntry,environment:receipt.environment,package:skill.package,version:skill.version}),{flag:'wx',mode:0o600});
+  await fs.writeFile(path.join(directory,'collection.json'),JSON.stringify(receipt,null,2),{flag:'wx',mode:0o600});
+  await fs.writeFile(path.join(directory,'integrity.json'),JSON.stringify(await fileHashes(skills)),{flag:'wx',mode:0o600});
+  return receipt;
+ }catch(error){await fs.rm(directory,{recursive:true,force:true});throw error;}
+}