@playcraft/cli 0.1.34 → 0.1.35-prod

package/README.md

@@ -7,29 +7,11 @@
 
 PlayCraft CLI（Command-Line Interface，命令行工具）支持本地代码与云端编辑器实时同步，以及将 PlayCanvas/PlayCraft 项目打包为多平台 Playable Ads。
 
-## 云端工作台 Runtime
+## 云端工作台 Runtime（计划能力）
 
-`playcraft workspace-runtime serve --config <json>` 已注册。它前台常驻、跳过升级检查，读取 Runtime Server 下发的引导配置，只绑定回环并校验 control token。`runtime.ensure` 会执行到终态；设置 `PLAYCRAFT_NATIVE_ADAPTER=loopback` 或测试注入 loopback 适配器后，可跑会话 create/turn/interrupt/审批，以及本地 journal 检查点/恢复/销毁。工作空间相对路径的 `file.write` 与文件检查点不依赖 loopback。相同幂等键上的 `uncertain` 操作不会新开 turn。这不是 Codex App Server。现有 `playcraft start` 仍用于单项目本地开发，二者不要混用。
+云端工作台计划以 `@playcraft/cli` 承载自定义 AGS（Agent Sandbox，Agent 沙箱服务）内的常驻运行服务，新增 `playcraft workspace-runtime serve` 命令，管理多个 Workspace、一个 Codex App Server、文件/Git/终端/预览及持久恢复。该命令尚未实现，当前发布版本不可调用；现有 `playcraft start` 仍用于单项目本地开发。
 
-实现与模块边界见 [Sandbox Agent Server](./src/workspace-runtime/README.md)；契约见 [云端工作台后端架构方案](../../docs/architecture/backend/cloud-workspace/backend-architecture.md#cli-runtime)。
-
-## 下载云工作区并推送本地修改
-
-文件面板的下载弹窗可复制下列命令。需要发布包含 `workspace` 命令的新版 `@playcraft/cli`，并部署对应的工作区传输端点；旧版 Remix 命令保持兼容。
-
-```bash
-npx @playcraft/cli@latest login --url 'https://playcraft.example.com/__env/test-a'
-npx @playcraft/cli@latest workspace clone --workspace-id '<workspace-id>' --directory root --url 'https://playcraft.example.com/__env/test-a' --dir './my-workspace'
-cd './my-workspace'
-# 完成本地编辑后提交，再同步回原工作区
-git add -A
-git commit -m 'Update workspace'
-npx @playcraft/cli@latest workspace push
-```
-
-`--directory root` 下载整个工作区的工程目录；也可指定 `basic` 或已有工程目录。独立工作区无需关联平台项目。下载包含当前未提交文件、二进制素材和 `dist/` 产物，使用只有当前快照的新 Git 历史；排除 `.git`、`node_modules`、凭据文件和运行时路由信息。本地 `.playcraft-workspace.json` 保存目标工作区、目录、完整环境基址和快照摘要，不含访问令牌，默认不进入提交。服务基址的环境路径前缀会完整保留。
-
-`workspace push` 要求本地修改已经提交，将提交的文件同步回同一个云工作区；云端文件变化或有正在运行的任务时拒绝覆盖，需重新克隆并合并后再推送。云端现有 Git 仓库和分支元数据会保留，保存到远端项目仍使用工作区原有保存流程；针对项目分支的操作可继续使用 `remix clone` / `remix push`。传输限制为 20,000 个文件、256 MiB（Mebibyte，二进制兆字节）内容及压缩包，超限可使用弹窗中的直接下载。命令支持 `--token`、`--dir` 与 `--json`。
+新服务采用固定版本、前台非交互运行，由镜像监管器启动；独立 Runtime Server 在沙箱外部署。具体代码归属、进程权限、发布与恢复契约见 [云端工作台后端架构方案](../../docs/architecture/backend/cloud-workspace/backend-architecture.md#cli-runtime)。
 
 ## ✨ 特性
 
@@ -159,17 +141,6 @@ playcraft login --url https://your-playcraft.example.com
 
 登录成功后，`tools`、`recommend`、`fix-ids` 等所有需要后端 API 的命令均无需额外配置，直接使用。
 
-账号提示待激活时，使用同一目标环境及已保存的个人访问令牌主动激活：
-
-```bash
-playcraft login --activate
-playcraft login --activate --url https://your-playcraft.example.com
-```
-
-也可通过 `PLAYCRAFT_TOKEN` 提供个人访问令牌。激活只发送一次请求，成功后重新执行原业务命令；该动作不会打开浏览器或续签令牌。目标服务须已接入身份服务的激活入口；封禁、停用账号及沙箱执行令牌不能用于激活。
-
-若本地、全局或环境变量配置冲突，激活会要求明确指定 `--url`、所需的 `PLAYCRAFT_ENV` 和对应的个人访问令牌。
-
 ### 沙箱环境（CI / Agent）
 
 在沙箱或 CI 中可通过 `.playcraft.json` 或环境变量配置：
@@ -217,30 +188,6 @@ echo '{"token":"<sandbox-jwt>","apiUrl":"https://..."}' > .playcraft.json
 | `recommend improvements`  | Tag 改进建议        | `playcraft recommend improvements --channel Facebook`                 |
 | `recommend random`        | 随机 Tag 组合推荐   | `playcraft recommend random --channel Google`                         |
 
-### 业务工具请求恢复
-
-业务工具写请求要求服务支持持久操作协议。命令行先保存请求编号、路径和输入摘要到 `~/.playcraft/tool-requests/`，再发送请求；记录不包含凭证或请求正文。可用绝对路径环境变量 `PLAYCRAFT_TOOL_REQUEST_DIR` 指定可持久保留的目录。
-
-原样重跑同一条命令（路径与参数都相同）时，命令行按上一次的结果决定是否沿用原请求编号：
-
-| 上一次的结果                                                         | 原样重跑时                                               |
-| -------------------------------------------------------------------- | -------------------------------------------------------- |
-| 成功（2xx）                                                          | 新操作                                                   |
-| 请求被拒绝（4xx，下列 409 除外）：请求没有被执行                     | 新操作                                                   |
-| 服务端错误（5xx）、超时或连接中断：结果未知                          | 沿用原编号，不会另起一次操作；服务端按下文的恢复方式处理 |
-| 409 `business_operation_in_progress`：原操作仍在执行                 | 沿用原编号，稍后重跑取得结果                             |
-| 409 `business_operation_requires_reconciliation`：结果未知，需要核对 | 沿用原编号，不会再执行                                   |
-
-沿用原编号时，服务端按原操作的状态处理：已完成则返回原结果；仍在执行则返回 409 `business_operation_in_progress`；没有拿到结果就结束时，按该工具声明的恢复方式决定，可以安全重做的工具（生图、构建、发布到 COS 等）用原编号再执行一次，其余返回 409 `business_operation_requires_reconciliation`。原调用的执行租约有效期间（执行中每 20 秒续期，60 秒未续即过期），同一编号不会被再次执行；续期因服务或数据库故障中断超过 60 秒时，重做可能与仍在运行的原调用重叠。
-
-需要核对的操作，只有确认它没有生效后，才可设置 `PLAYCRAFT_TOOL_NEW_REQUEST=1` 强制发起新操作；不要删除记录来绕过。也可以显式指定编号，只查询原操作的确定结果（不会重新执行；声明了恢复方式的工具若上次报错，返回那次的错误）。只查询时即使是可以安全重做的工具，没有结果也返回需要核对；去掉 `PLAYCRAFT_TOOL_REQUEST_ID` 原样重跑即可续做：
-
-```bash
-PLAYCRAFT_TOOL_REQUEST_ID=<错误中显示的请求编号> playcraft tools build-project --project-id <原项目编号>
-```
-
-能力检查失败时命令会明确说明尚未发送操作。服务不兼容时命令会在发送业务请求前停止；沙箱命令行与 Business 须排空旧调用后同步升级。
-
 ### 构建相关
 
 | 命令             | 说明                                     | 示例                                                   |

package/dist/agent/local-backend.js

@@ -2,7 +2,7 @@ import express from 'express';
 import crypto from 'node:crypto';
 import path from 'node:path';
 import fs from 'node:fs/promises';
-import { eq, inArray } from '@playcraft/common/database/operators';
+import { eq, inArray } from 'drizzle-orm';
 import pc from 'picocolors';
 import { createSqliteAdapter } from '@playcraft/common/database';
 import { AssetModel, ProjectModel, SceneModel } from '@playcraft/common/models';

package/dist/cli-root-help.js

@@ -5,10 +5,8 @@ export function getCliTopicsHelpText() {
         '',
         '  本地开发   create, init, start, stop, status, logs, config, sync, fix-ids',
         '  素材       tools generate-*  |  image <子命令>  |  audio <子命令>  |  prefab <子命令>',
-        '  视频理解   video models | video understand | video jobs get/cancel',
         '  平台       build, build-base, build-playable, build-all, analyze, inspect, upgrade',
         '             tools 除 generate-* 外（Git / 沙箱构建 / 发布 / 列表 / Prefab 等，需后端 API）',
-        '  沙箱常驻   workspace-runtime serve（Cloud Workspace，由 Runtime 引导配置启动）',
         '',
         '也可运行: playcraft topics',
         '',

package/dist/commands/build.js

@@ -450,7 +450,6 @@ export async function buildCommand(projectPath, options) {
         const shouldRunPlayableOnly = options.mode === 'playable';
         // 验证平台
         const validPlatforms = [
-            'playcraft',
             'facebook',
             'snapchat',
             'ironsource',
@@ -474,7 +473,6 @@ export async function buildCommand(projectPath, options) {
         // 注：Facebook 在 Phaser（playable-scripts devkit）下的产物格式由其 devkit 输入配置决定（恒为 ZIP），
         //     平台侧不在此处做引擎判断。
         const platformFormatConfig = {
-            playcraft: { formats: ['html'], default: 'html' },
             facebook: { formats: ['html', 'zip'], default: 'html' },
             applovin: { formats: ['html'], default: 'html' },
             ironsource: { formats: ['html'], default: 'html' },
@@ -586,11 +584,8 @@ export async function buildCommand(projectPath, options) {
                     console.log(pc.dim('   无主题目录，跳过主题选择'));
                 }
             }
-            // 输入商店跳转地址（CTA）- 如果配置文件中没有则必填；通用预览（playcraft）不面向渠道，可不填
-            if (selectedPlatform === 'playcraft' && !options.storeUrls) {
-                console.log(pc.dim('\nℹ️  通用预览不需要商店地址'));
-            }
-            else if (!options.storeUrls) {
+            // 输入商店跳转地址（CTA）- 如果配置文件中没有则必填
+            if (!options.storeUrls) {
                 console.log(pc.cyan('\n🔗 商店跳转地址（CTA 按钮目标）'));
                 console.log(pc.dim('   iOS 和 Android 地址均为必填'));
                 const storeUrlAnswer = await inquirer.prompt([
@@ -641,8 +636,8 @@ export async function buildCommand(projectPath, options) {
                 // 未指定格式，使用默认值
                 options.format = formatConfig.default;
             }
-            // 如果命令行未传入 storeUrls，交互式输入（必填）；通用预览（playcraft）不面向渠道，可不填
-            if (!options.storeUrls && options.platform !== 'playcraft') {
+            // 如果命令行未传入 storeUrls，交互式输入（必填）
+            if (!options.storeUrls) {
                 spinner.stop();
                 console.log(pc.cyan('\n🔗 商店跳转地址（CTA 按钮目标）'));
                 console.log(pc.dim('   iOS 和 Android 地址均为必填'));

package/dist/commands/create.js

@@ -1,4 +1,3 @@
-import { prepareLocalSkillLifecycle } from '../project-skills/lifecycle.js';
 import { execFileSync, execSync } from 'child_process';
 import inquirer from 'inquirer';
 import fs from 'fs/promises';
@@ -7,11 +6,8 @@ import { fileURLToPath } from 'url';
 import pc from 'picocolors';
 import ora from 'ora';
 import { resolveCreateTemplate, resolveCreateTemplateDir, } from '../scaffold/templates.js';
-import { PLATFORM_SKILL_DIRS } from './platform-skills.generated.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-/** `@playcraft/skills` 包内 Platform Skill 的目录名（与 Atom Skill 的 `skills/` 区分）。 */
-const PLATFORM_SKILLS_DIRNAME = 'playcraft-skills';
 /** 生成一个本地占位 Project ID（99xxxxxx），后续可通过 playcraft config set 更新为真实 ID */
 function generateMockProjectId() {
     const suffix = Math.floor(Math.random() * 90_000_000) + 10_000_000;
@@ -853,7 +849,7 @@ function extractSkillBodyForCursor(content) {
  * @param cliCommandsDir CLI 命令所在目录（用于解析 skills 包位置）
  * @param configDir 配置目录名（如 '.claude' 或 '.codebuddy'）
  */
-export async function setupPlatformSkillLinksInner(targetDir, cliCommandsDir, configDir) {
+async function setupPlatformSkillLinksInner(targetDir, cliCommandsDir, configDir) {
     const skillsLinkDir = path.join(targetDir, configDir, 'skills');
     await fs.mkdir(skillsLinkDir, { recursive: true });
     // 以下 Skill 在项目模板中以静态目录形式存在，不创建软连接覆盖它们。
@@ -872,12 +868,11 @@ export async function setupPlatformSkillLinksInner(targetDir, cliCommandsDir, co
         'playcraft-image-generation',
         'playcraft-audio-generation',
     ]);
-    // Platform Skill 住在 playcraft-skills/，与 Atom Skill 的 skills/ 是两个目录。
-    // 尝试从 CLI 安装包的位置定位它（monorepo 内或与 CLI 平级安装时可解析）。
+    // 尝试从 CLI 安装包的位置定位 @playcraft/skills/skills 目录
     const candidateDirs = [
-        path.resolve(cliCommandsDir, '..', '..', '..', '..', 'skills', PLATFORM_SKILLS_DIRNAME),
-        path.resolve(cliCommandsDir, '..', '..', '..', 'skills', PLATFORM_SKILLS_DIRNAME),
-        path.resolve(cliCommandsDir, '..', '..', 'skills', PLATFORM_SKILLS_DIRNAME),
+        path.resolve(cliCommandsDir, '..', '..', '..', '..', 'skills', 'skills'),
+        path.resolve(cliCommandsDir, '..', '..', '..', 'skills', 'skills'),
+        path.resolve(cliCommandsDir, '..', '..', 'skills', 'skills'),
     ];
     let resolvedSkillsDir = null;
     for (const dir of candidateDirs) {
@@ -890,24 +885,18 @@ export async function setupPlatformSkillLinksInner(targetDir, cliCommandsDir, co
             // 继续下一个候选
         }
     }
-    // 相对路径（指向 npm install 后的 node_modules）作为安装后激活的备用
-    const relativeSkillsBase = path.join('..', '..', 'node_modules', '@playcraft', 'skills', PLATFORM_SKILLS_DIRNAME);
+    // 相对路径（指向 npm install 后的 node_modules）始终创建，作为安装后激活的备用
+    const relativeSkillsBase = path.join('..', '..', 'node_modules', '@playcraft', 'skills', 'skills');
     if (resolvedSkillsDir) {
-        // 能立即解析 → 以真实目录为准创建绝对路径软连接，当下即可使用。
-        // 按「是否含 SKILL.md」判定而非 playcraft- 前缀：sound-effects 无前缀但同样是平台技能。
+        // 能立即解析 → 创建指向绝对路径的软连接，当下即可使用
         const entries = await fs.readdir(resolvedSkillsDir, { withFileTypes: true });
         for (const entry of entries) {
-            if (!entry.isDirectory() || staticSkills.has(entry.name))
+            if (!entry.name.startsWith('playcraft-') || staticSkills.has(entry.name))
                 continue;
+            const linkPath = path.join(skillsLinkDir, entry.name);
             const targetPath = path.join(resolvedSkillsDir, entry.name);
             try {
-                await fs.access(path.join(targetPath, 'SKILL.md'));
-            }
-            catch {
-                continue;
-            }
-            try {
-                await fs.symlink(targetPath, path.join(skillsLinkDir, entry.name), 'dir');
+                await fs.symlink(targetPath, linkPath, 'dir');
             }
             catch {
                 // 已存在则跳过
@@ -915,9 +904,28 @@ export async function setupPlatformSkillLinksInner(targetDir, cliCommandsDir, co
         }
     }
     else {
-        // 无法立即解析 → 指向 node_modules 的相对路径软连接，npm install 后自动激活。
-        // 清单由 scripts/generate-platform-skills.mjs 从真实目录生成并由 CI 校验，不要手写。
-        for (const name of PLATFORM_SKILL_DIRS) {
+        // 无法立即解析 → 创建指向 node_modules 的相对路径软连接，npm install 后自动激活
+        const knownPlatformTools = [
+            'playcraft-asset-management',
+            'playcraft-audio-generation',
+            'playcraft-build',
+            'playcraft-code-editor',
+            'playcraft-create-remix',
+            'playcraft-deploy',
+            'playcraft-image-generation',
+            'playcraft-image-processing',
+            'playcraft-platform-intro',
+            'playcraft-prefab',
+            'playcraft-project-management',
+            'playcraft-remix-workflow',
+            'playcraft-save',
+            'playcraft-skill-recommender',
+            'playcraft-sprite-generation',
+            'playcraft-sprite-remix',
+            'playcraft-sprite-sheet',
+            'playcraft-3d-flip-sprite',
+        ];
+        for (const name of knownPlatformTools) {
             if (staticSkills.has(name))
                 continue;
             const linkPath = path.join(skillsLinkDir, name);
@@ -1281,7 +1289,6 @@ export async function createCommand(projectName, options) {
                 smokeSpinner.warn(`Harness 自检跳过: ${message}`);
             }
         }
-        await prepareLocalSkillLifecycle(targetDir, 'create');
         const gitSpinner = ora(isWorktreeMode ? '提交项目分支...' : '初始化 Git 仓库...').start();
         try {
             if (isWorktreeMode) {

package/dist/commands/image.js

@@ -677,7 +677,9 @@ async function runBatchStep(cmd, args, inputPath, outputPath) {
             const meta = await sharp(inputPath).metadata();
             const targetW = scale ? Math.round((meta.width ?? 64) * scale) : w;
             const targetH = scale ? Math.round((meta.height ?? 64) * scale) : h;
-            await safeToFile(sharp(inputPath).resize(targetW, targetH, { fit }), outputPath, inputPath);
+            await safeToFile(sharp(inputPath).resize(targetW, targetH, {
+                fit, background: { r: 0, g: 0, b: 0, alpha: 0 },
+            }), outputPath, inputPath);
             break;
         }
         case 'crop': {
@@ -836,7 +838,9 @@ export function registerImageCommands(program) {
                 process.exit(1);
             }
             const fit = parseResizeFitOption(opts.fit);
-            await safeToFile(sharp(opts.input).resize(targetW, targetH, { fit }), opts.output, opts.input);
+            await safeToFile(sharp(opts.input).resize(targetW, targetH, {
+                fit, background: { r: 0, g: 0, b: 0, alpha: 0 },
+            }), opts.output, opts.input);
             const outSz = statSync(resolveSandboxPath(opts.output)).size;
             console.log(`Resized ${w}x${h} → ${targetW ?? '?'}x${targetH ?? '?'} — ${opts.output} (${sizeLabelBytes(outSz)})`);
         }

package/dist/commands/login.js

@@ -1,8 +1,7 @@
 import http from 'http';
-import { execFile } from 'child_process';
+import { exec } from 'child_process';
 import crypto from 'crypto';
-import { loadGlobalConfig, normalizeEnvironmentBaseUrl, readEnvironmentProfile, saveEnvironmentProfile } from '../config.js';
-import { activateAccount } from '../auth/account-activation.js';
+import { saveGlobalConfig, loadGlobalConfig } from '../config.js';
 /** 默认云端 Portal（Next.js `/cli-auth` 与 API 同源时的基址；可通过 --url 或 PLAYCRAFT_URL 覆盖） */
 export const DEFAULT_PLAYCRAFT_CLOUD_BASE = 'https://playcraft.aix.intlgame.com';
 const CALLBACK_PORT = 3456;
@@ -19,11 +18,10 @@ function openBrowser(url) {
     const cmd = process.platform === 'darwin'
         ? 'open'
         : process.platform === 'win32'
-            ? 'rundll32'
+            ? 'start'
             : 'xdg-open';
     try {
-        const arguments_ = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
-        execFile(cmd, arguments_, (err, _stdout, stderr) => {
+        exec(`${cmd} "${url}"`, (err, _stdout, stderr) => {
             if (err) {
                 console.error('Failed to open browser automatically:', err.message);
                 if (stderr?.trim()) {
@@ -46,18 +44,21 @@ function resolveLoginBaseUrl(options) {
         globalConfig.url ||
         globalConfig.backendUrl ||
         DEFAULT_PLAYCRAFT_CLOUD_BASE;
-    const base = normalizeEnvironmentBaseUrl(raw);
-    if (!base)
-        throw new Error('Invalid environment address');
-    return base;
+    return raw.replace(/\/+$/, '');
 }
 function normalizeLoginEnvironmentUrl(raw) {
-    return normalizeEnvironmentBaseUrl(raw);
+    try {
+        const url = new URL(raw);
+        url.hash = '';
+        url.search = '';
+        url.pathname = url.pathname.replace(/\/+$/, '');
+        return url.toString().replace(/\/+$/, '');
+    }
+    catch {
+        return undefined;
+    }
 }
 export function resolveExistingTokenForLoginTarget(globalConfig, backendUrl) {
-    const profile = readEnvironmentProfile(globalConfig, backendUrl);
-    if (profile)
-        return profile.token;
     const token = typeof globalConfig.token === 'string' ? globalConfig.token : undefined;
     const storedBackendUrl = typeof globalConfig.backendUrl === 'string'
         ? globalConfig.backendUrl
@@ -73,17 +74,9 @@ export function resolveExistingTokenForLoginTarget(globalConfig, backendUrl) {
         : undefined;
 }
 export function buildCliAuthUrl(options) {
-    const base = normalizeEnvironmentBaseUrl(options.backendUrl);
-    if (!base)
-        throw new Error('Invalid environment address');
-    const url = new URL(`${base}/cli-auth`);
-    url.searchParams.set('callbackUrl', options.callbackUrl);
+    const url = new URL('/cli-auth', options.backendUrl);
     url.searchParams.set('callback', options.callbackUrl);
     url.searchParams.set('state', options.state);
-    if (options.codeChallenge) {
-        url.searchParams.set('codeChallenge', options.codeChallenge);
-        url.searchParams.set('codeChallengeMethod', 'S256');
-    }
     return url.toString();
 }
 export async function renewExistingToken(options) {
@@ -94,20 +87,12 @@ export async function renewExistingToken(options) {
     try {
         const res = await fetchFn(`${options.backendUrl}/api/settings/personal-access-tokens/current/renew`, {
             method: 'PATCH',
-            redirect: 'error',
-            signal: AbortSignal.timeout(10_000),
             headers: {
                 Authorization: `Bearer ${options.token}`,
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify({ expiresIn: '365d' }),
         });
-        if (res.ok && res.json && options.onRenewed) {
-            const result = await res.json();
-            if (typeof result.expiresAt === 'string' && Date.parse(result.expiresAt) > Date.now()) {
-                options.onRenewed(result.expiresAt);
-            }
-        }
         return res.ok;
     }
     catch {
@@ -115,43 +100,29 @@ export async function renewExistingToken(options) {
     }
 }
 export async function loginCommand(options) {
-    if (options.activate) {
-        await activateAccount(options, DEFAULT_PLAYCRAFT_CLOUD_BASE);
-        return;
-    }
     const backendUrl = resolveLoginBaseUrl(options);
     const callbackPort = options.callbackPort ?? CALLBACK_PORT;
     const globalConfig = loadGlobalConfig();
     const existingToken = resolveExistingTokenForLoginTarget(globalConfig, backendUrl);
     if (existingToken) {
-        let expiresAt;
-        const renewed = await renewExistingToken({ backendUrl, token: existingToken,
-            onRenewed: (value) => { expiresAt = value; } });
+        const renewed = await renewExistingToken({ backendUrl, token: existingToken });
         if (renewed) {
-            const previous = readEnvironmentProfile(globalConfig, backendUrl);
-            saveEnvironmentProfile(backendUrl, { token: existingToken,
-                ...(previous?.identity ? { identity: previous.identity } : {}),
-                ...(expiresAt ? { expiresAt } : {}) });
+            saveGlobalConfig({
+                token: existingToken,
+                url: backendUrl,
+                backendUrl,
+            });
             console.log('Existing CLI token renewed. Token saved to ~/.playcraft/config.json');
             return;
         }
     }
     const state = crypto.randomBytes(16).toString('hex');
-    const codeVerifier = crypto.randomBytes(32).toString('base64url');
-    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
-    let callbackUrl = '';
-    let exchanging = false;
     return new Promise((resolve, reject) => {
         let timeout;
         const server = http.createServer((req, res) => {
-            res.setHeader('Access-Control-Allow-Origin', new URL(backendUrl).origin);
+            res.setHeader('Access-Control-Allow-Origin', '*');
             res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-            if (req.headers.origin && req.headers.origin !== new URL(backendUrl).origin) {
-                res.writeHead(403);
-                res.end();
-                return;
-            }
             if (req.method === 'OPTIONS') {
                 res.writeHead(204);
                 res.end();
@@ -159,9 +130,8 @@ export async function loginCommand(options) {
             }
             if (req.url === '/callback' && req.method === 'POST') {
                 let body = '';
-                req.on('data', (chunk) => { body += chunk; if (body.length > 16_384)
-                    req.destroy(); });
-                req.on('end', async () => {
+                req.on('data', (chunk) => (body += chunk));
+                req.on('end', () => {
                     try {
                         const data = JSON.parse(body);
                         if (data.state !== state) {
@@ -169,36 +139,22 @@ export async function loginCommand(options) {
                                 'Content-Type': 'text/html',
                                 Connection: 'close',
                             });
-                            res.end('<html><body><h1>Invalid state</h1></body></html>');
-                            return;
-                        }
-                        if (exchanging) {
-                            res.writeHead(409);
-                            res.end();
+                            res.end('<html><body><h1>Invalid state</h1></body></html>', () => {
+                                closeServer(() => {
+                                    reject(new Error('State mismatch - possible CSRF attack'));
+                                });
+                            });
                             return;
                         }
-                        if (typeof data.code !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(data.code)) {
-                            throw new Error('Login callback did not include an authorization code');
+                        const callbackToken = typeof data.token === 'string' ? data.token : undefined;
+                        if (!callbackToken) {
+                            throw new Error('Login callback did not include a token');
                         }
-                        exchanging = true;
-                        const base = normalizeEnvironmentBaseUrl(backendUrl);
-                        if (!base)
-                            throw new Error('Invalid environment address');
-                        const exchange = await fetch(`${base}/api/cloud-environments/exchange`, {
-                            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
-                            headers: { 'Content-Type': 'application/json' },
-                            body: JSON.stringify({ code: data.code, state, callbackUrl, codeVerifier }),
+                        saveGlobalConfig({
+                            token: callbackToken,
+                            url: backendUrl,
+                            backendUrl,
                         });
-                        if (!exchange.ok)
-                            throw new Error('Authorization code exchange failed');
-                        const credential = await exchange.json();
-                        if (!credential.token || !/^playcraft_pat_[A-Za-z0-9_-]{32}$/.test(credential.token)
-                            || !credential.identity?.userId || !Array.isArray(credential.identity.identities)
-                            || !credential.expiresAt || Date.parse(credential.expiresAt) <= Date.now()) {
-                            throw new Error('Invalid environment credential response');
-                        }
-                        saveEnvironmentProfile(base, { token: credential.token,
-                            identity: credential.identity, expiresAt: credential.expiresAt });
                         res.writeHead(200, {
                             'Content-Type': 'text/html',
                             Connection: 'close',
@@ -218,6 +174,9 @@ export async function loginCommand(options) {
                     catch (err) {
                         const cause = err instanceof Error ? err : new Error(String(err));
                         console.error('[playcraft login] Callback handling failed:', cause.message);
+                        if (cause.stack) {
+                            console.error(cause.stack);
+                        }
                         const userFacing = cause instanceof SyntaxError
                             ? 'Invalid JSON in login callback.'
                             : `Login callback failed: ${cause.message}`;
@@ -262,15 +221,14 @@ export async function loginCommand(options) {
             });
         });
         try {
-            server.listen(callbackPort, '127.0.0.1', () => {
+            server.listen(callbackPort, () => {
                 const address = server.address();
                 const listeningPort = typeof address === 'object' && address ? address.port : callbackPort;
-                callbackUrl = `http://127.0.0.1:${listeningPort}/callback`;
+                const callbackUrl = `http://localhost:${listeningPort}/callback`;
                 const authUrl = buildCliAuthUrl({
                     backendUrl,
                     callbackUrl,
                     state,
-                    codeChallenge,
                 });
                 console.log('Opening browser for login...');
                 console.log(`If the browser does not open, visit this URL manually:\n  ${authUrl}\n`);

package/dist/commands/skills.js

@@ -18,7 +18,6 @@
  *   3. <cwd>/node_modules/@playcraft/skills/playcraft-skills（兼容旧路径 skills）
  *   4. <CLI 自身>/../../skills/playcraft-skills（monorepo 开发时，兼容旧路径 skills）
  */
-import { registerProjectSkillsCommands } from '../project-skills/commands.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { getFusionHintsForGameplayAtoms, } from '../atom-tree/fusion-hints.js';
@@ -1431,7 +1430,6 @@ export function registerSkillsCommands(program) {
     const skills = program
         .command('skills')
         .description('开发时 Skill 发现与脚手架工具（按 engine/intent 推荐 skill 集合，或将 ref 文件复制到项目）');
-    registerProjectSkillsCommands(skills);
     // 公共选项：skills 目录
     const addSkillsDirOption = (cmd) => cmd.option('--skills-dir <path>', '指定 skills 目录路径（默认自动发现）');
     // ── list ──────────────────────────────────────────────────────────────────

package/dist/commands/tools-3d.js

@@ -2,7 +2,6 @@ import { writeFileSync, mkdirSync, readFileSync } from 'fs';
 import { dirname } from 'path';
 import { AgentApiClient } from '../utils/agent-api-client.js';
 import { mimeTypeForImagePath, handleError } from './tools-utils.js';
-import { captureGeneratedArtifact } from '../workspace-runtime/workspaces/artifact-receipts.js';
 const AVATAR_TEMPLATES = [
     'basketball', 'badminton', 'pingpong', 'gymnastics', 'pilidance',
     'tennis', 'athletics', 'footballboykicking1', 'footballboykicking2',
@@ -149,9 +148,6 @@ export function register3DCommands(tools) {
                 writeFileSync(opts.savePreview, previewBuf);
                 console.log(`  Preview saved: ${opts.savePreview}`);
             }
-            await captureGeneratedArtifact(opts.output, 'generate-3d', {
-                ...(opts.savePreview && result.previewImageBase64 ? { thumbnailPath: opts.savePreview } : {}),
-            });
             console.log(`\nNext steps:`);
             console.log(`  Inspect:        playcraft 3d info ${opts.output}`);
             console.log(`  Apply texture:  playcraft tools generate-texture --model-url <url> --reference-image <img> --output out.glb`);
@@ -213,7 +209,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'generate-texture');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nTextured model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
             if (result.resultUrl)
@@ -258,7 +253,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'retopology');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nRetopologized model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -295,7 +289,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'uv-unwrap');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nUV-unwrapped model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -331,7 +324,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'convert-3d');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nConverted model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
             console.log(`  Format: ${result.format.toUpperCase()}`);
@@ -367,7 +359,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'generate-3d-parts');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\n3D parts model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -411,7 +402,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'generate-motion');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nMotion FBX saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -473,7 +463,6 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
-            await captureGeneratedArtifact(opts.output, 'generate-avatar');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\n3D avatar saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }