@pm_zhousl/xinyun-ai-init 1.16.0 → 3.0.0

package/README.md

@@ -1,73 +1,58 @@
-# @pm_zhousl/xinyun-ai-init
+# @pm_zhousl/xinyun-ai-init v3
 
-欣芸技术开发 Agent 流初始化包。
+欣芸技术开发 Skill Runtime 初始化包。v3 将项目接管、任务分析、技术设计、实现、验证、安全审查、发布审查和交接同步封装为可直接路由的 Skills。
 
-## Codex 一句话入口
-
-用 Codex 打开项目后，直接发送：
-
-```md
-请执行 `npx --yes @pm_zhousl/xinyun-ai-init@latest --force`，然后读取 `xinyun-ai-init/README.md`，按其中规则初始化或升级当前项目。
-```
-
-## 手动使用
+## 使用
 
 ```bash
-npx --yes @pm_zhousl/xinyun-ai-init@latest --force
+npx --yes @pm_zhousl/xinyun-ai-init@latest --force --offline
 ```
 
-执行后会在当前目录生成 `xinyun-ai-init/`。
+默认只 materialize `xinyun-ai-init/` 中的核心 Runtime，不创建 `xinyun-ai/`，不修改业务代码，也不读取整套历史兼容材料。
 
-## 维护者校验
+初始化后，宿主 AI 使用：
 
 ```bash
-npm run verify:init
-npm run verify:rules
-npm run verify:rules -- --json
-npm run verify:rules -- --tarball ./pm_zhousl-xinyun-ai-init-1.10.1.tgz
+node xinyun-ai-init/runtime/route-skill.js --facts task-facts.json
 ```
 
-`verify:rules` 为只读规则包一致性检查，不自动修复、不安装依赖、不修改 Git 或业务代码。
-
-## 注意
+## 参数
 
-该 CLI 只释放初始化包，不修改业务代码、不创建 `xinyun-ai/`。
+- `--offline`：跳过 npm registry 版本检查。
+- `--no-version-check`：跳过版本检查。
+- `--strict-version`：发现本地版本落后时退出。
+- `--force`：覆盖脚本托管文件；用户自行修改的文件仍会记录冲突。
 
-完整执行要求已经内置在 `xinyun-ai-init/README.md`、`rules/` 和 `templates/` 中。后续不需要复制长提示词，只需要让 AI 读取本地释放出来的 `xinyun-ai-init/README.md`。
+## 维护者校验
 
-CLI 执行时会显示当前版本，并尽量检测 npm 线上最新版本；检测失败不会阻塞初始化。
+```bash
+npm run verify:v3
+npm run verify:runtime
+npm run verify:cleanup
+npm run verify:rules:security
+npm pack --dry-run
+```
 
-用户发送 Codex 一句话入口后，AI 可按初始化包规则创建或补齐最小 `xinyun-ai/`；这不代表授权修改业务代码。
+## v3 升级
 
-可选参数：
+旧项目升级先预览：
 
 ```bash
---no-version-check
---strict-version
+node xinyun-ai-init/runtime/migrate-v3.js --project-root <project-root>
 ```
 
-## 维护者发布
-
-发布新版时，在本包目录执行：
+确认清理后执行：
 
-```powershell
-npm run publish:token
+```bash
+node xinyun-ai-init/runtime/migrate-v3.js --project-root <project-root> --apply
 ```
 
-脚本会提示输入 npm token，临时写入 `.npmrc`，发布完成或失败后自动删除 `.npmrc`。
-发布脚本会先执行 `npm run verify:release`；v1.16 要求可审计的真实宿主运行证据，且只有证据完整时才允许进入发布流程。未验证范围必须继续保留在证据记录中。
+升级会合并必要的项目事实和任务结果，然后移除已知的 team、角色任务和角色会话运行目录。v3 不再提供旧兼容运行路径。
 
-如果需要让 AI 代执行，可先在当前终端设置临时环境变量：
+## 发布
 
 ```powershell
-$env:NPM_TOKEN="你的 npm token"
 npm run publish:token
-$env:NPM_TOKEN=$null
 ```
 
-发布前预演：
-
-```powershell
-npm run verify:release
-npm run publish:token:dry
-```
+发布只要求在安全提示中输入一次 token，不需要 `npm login`、环境变量或第二会话验证。npm publish 仍需用户针对目标版本单独授权。

package/bin/xinyun-ai-init.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 
 const fs = require("fs");
+const crypto = require("crypto");
 const https = require("https");
 const os = require("os");
 const path = require("path");
 
 const packageJson = require("../package.json");
-
 const args = new Set(process.argv.slice(2));
 const force = args.has("--force") || args.has("-f");
+const offline = args.has("--offline");
 const noVersionCheck = args.has("--no-version-check");
 const strictVersion = args.has("--strict-version");
 const cwd = process.cwd();
@@ -16,240 +17,185 @@ const source = path.resolve(__dirname, "..", "init", "xinyun-ai-init");
 const target = path.join(cwd, "xinyun-ai-init");
 const packageName = packageJson.name;
 const currentVersion = packageJson.version;
-const versionChannel = "latest";
 const registryMetadataUrl = "https://registry.npmjs.org/@pm_zhousl%2Fxinyun-ai-init";
 const updateCheckTtlMs = 24 * 60 * 60 * 1000;
 
-function copyDir(src, dest) {
-  fs.mkdirSync(dest, { recursive: true });
-  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path.join(src, entry.name);
-    const destPath = path.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDir(srcPath, destPath);
-    } else {
-      fs.copyFileSync(srcPath, destPath);
-    }
-  }
+function hashFile(filePath) {
+  return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
 }
 
-function compareVersions(a, b) {
-  const pa = String(a).split(".").map((part) => Number.parseInt(part, 10) || 0);
-  const pb = String(b).split(".").map((part) => Number.parseInt(part, 10) || 0);
-  const length = Math.max(pa.length, pb.length);
-
-  for (let index = 0; index < length; index += 1) {
-    const av = pa[index] || 0;
-    const bv = pb[index] || 0;
-    if (av > bv) return 1;
-    if (av < bv) return -1;
-  }
-
-  return 0;
+function copyFileAtomic(sourcePath, targetPath) {
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+  const tempPath = `${targetPath}.${process.pid}.tmp`;
+  fs.copyFileSync(sourcePath, tempPath);
+  fs.renameSync(tempPath, targetPath);
 }
 
-function fetchLatestVersion(timeoutMs = 1500) {
-  return new Promise((resolve) => {
-    const request = https.get(
-      registryMetadataUrl,
-      { headers: { Accept: "application/json", "User-Agent": "xinyun-ai-init" } },
-      (response) => {
-        let body = "";
-
-        response.setEncoding("utf8");
-        response.on("data", (chunk) => {
-          body += chunk;
-        });
-        response.on("end", () => {
-          if (response.statusCode < 200 || response.statusCode >= 300) {
-            resolve(null);
-            return;
-          }
-
-          try {
-            const data = JSON.parse(body);
-            resolve(data && data["dist-tags"] ? data["dist-tags"].latest : null);
-          } catch (error) {
-            resolve(null);
-          }
-        });
-      }
-    );
-
-    request.setTimeout(timeoutMs, () => {
-      request.destroy();
-      resolve(null);
-    });
-
-    request.on("error", () => {
-      resolve(null);
-    });
-  });
+function readJson(filePath, fallback) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    return fallback;
+  }
 }
 
 function getUpdateCachePath() {
   if (process.platform === "win32" && process.env.LOCALAPPDATA) {
     return path.join(process.env.LOCALAPPDATA, "xinyun-ai-init", "update-check.json");
   }
-
   if (process.env.XDG_CACHE_HOME) {
     return path.join(process.env.XDG_CACHE_HOME, "xinyun-ai-init", "update-check.json");
   }
-
   return path.join(os.homedir(), ".cache", "xinyun-ai-init", "update-check.json");
 }
 
 function readUpdateCache() {
-  try {
-    const cachePath = getUpdateCachePath();
-    if (!fs.existsSync(cachePath)) {
-      return null;
-    }
-    return JSON.parse(fs.readFileSync(cachePath, "utf8"));
-  } catch (error) {
-    return null;
-  }
+  return readJson(getUpdateCachePath(), null);
 }
 
 function writeUpdateCache(cache) {
   try {
     const cachePath = getUpdateCachePath();
-    const cacheDir = path.dirname(cachePath);
-    fs.mkdirSync(cacheDir, { recursive: true });
+    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
     const tempPath = `${cachePath}.${process.pid}.tmp`;
     fs.writeFileSync(tempPath, `${JSON.stringify(cache, null, 2)}\n`, "utf8");
     fs.renameSync(tempPath, cachePath);
-    return true;
   } catch (error) {
-    return false;
+    // A cache is an optimization. Failure must not block initialization.
   }
 }
 
-function shouldNotifyUpdate(cache, observedVersion, nowMs) {
-  if (!cache || cache.packageName !== packageName || cache.channel !== versionChannel) {
-    return true;
-  }
-
-  if (cache.lastNotifiedVersion !== observedVersion || !cache.lastNotifiedAt) {
-    return true;
-  }
-
-  const notifiedAt = Date.parse(cache.lastNotifiedAt);
-  if (Number.isNaN(notifiedAt)) {
-    return true;
+function compareVersions(a, b) {
+  const left = String(a).split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const right = String(b).split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    if ((left[index] || 0) > (right[index] || 0)) return 1;
+    if ((left[index] || 0) < (right[index] || 0)) return -1;
   }
-
-  return nowMs - notifiedAt >= updateCheckTtlMs;
+  return 0;
 }
 
-function buildUpdateCache(observedVersion, checkStatus, notification, nowIso, previousCache) {
-  const lastNotifiedVersion = notification
-    ? observedVersion
-    : previousCache && previousCache.lastNotifiedVersion
-      ? previousCache.lastNotifiedVersion
-      : null;
-  const lastNotifiedAt = notification
-    ? nowIso
-    : previousCache && previousCache.lastNotifiedAt
-      ? previousCache.lastNotifiedAt
-      : null;
-
-  return {
-    schemaVersion: 1,
-    packageName,
-    channel: versionChannel,
-    lastCheckedAt: nowIso,
-    observedVersion: observedVersion || null,
-    lastNotifiedVersion,
-    lastNotifiedAt,
-    checkStatus,
-  };
+function fetchLatestVersion(timeoutMs = 1200) {
+  return new Promise((resolve) => {
+    const request = https.get(
+      registryMetadataUrl,
+      { headers: { Accept: "application/json", "User-Agent": "xinyun-ai-init" } },
+      (response) => {
+        let body = "";
+        response.setEncoding("utf8");
+        response.on("data", (chunk) => { body += chunk; });
+        response.on("end", () => {
+          if (response.statusCode < 200 || response.statusCode >= 300) return resolve(null);
+          try {
+            const data = JSON.parse(body);
+            resolve(data && data["dist-tags"] ? data["dist-tags"].latest : null);
+          } catch (error) {
+            resolve(null);
+          }
+        });
+      }
+    );
+    request.setTimeout(timeoutMs, () => { request.destroy(); resolve(null); });
+    request.on("error", () => resolve(null));
+  });
 }
 
 async function checkVersion() {
   console.log(`[xinyun-ai-init] Current version: ${currentVersion}`);
-
-  if (noVersionCheck) {
-    console.log("[xinyun-ai-init] Version check skipped.");
+  const cache = readUpdateCache();
+  const now = Date.now();
+  const cacheFresh = cache && cache.packageName === packageName && cache.observedVersion &&
+    Date.parse(cache.lastCheckedAt || "") > now - updateCheckTtlMs;
+
+  if (offline || noVersionCheck || cacheFresh) {
+    if (cacheFresh) console.log(`[xinyun-ai-init] Using cached latest version: ${cache.observedVersion}`);
+    else console.log("[xinyun-ai-init] Version check skipped.");
     return true;
   }
 
   const latestVersion = await fetchLatestVersion();
-  const nowMs = Date.now();
-  const nowIso = new Date(nowMs).toISOString();
-
+  const nowIso = new Date().toISOString();
   if (!latestVersion) {
-    console.log("[xinyun-ai-init] Could not check latest npm version. Continue with local version.");
-    writeUpdateCache(buildUpdateCache(null, "unknown", false, nowIso, readUpdateCache()));
+    console.log("[xinyun-ai-init] Version check unavailable. Continue with local version.");
+    writeUpdateCache({ schemaVersion: 1, packageName, observedVersion: null, lastCheckedAt: nowIso, checkStatus: "unknown" });
     return true;
   }
 
   console.log(`[xinyun-ai-init] Latest version: ${latestVersion}`);
-
+  writeUpdateCache({ schemaVersion: 1, packageName, observedVersion: latestVersion, lastCheckedAt: nowIso, checkStatus: "current" });
+  if (compareVersions(currentVersion, latestVersion) < 0 && strictVersion) {
+    console.error("[xinyun-ai-init] Strict version mode is enabled. Stop because local version is outdated.");
+    return false;
+  }
   if (compareVersions(currentVersion, latestVersion) < 0) {
-    const cache = readUpdateCache();
-    const shouldNotify = shouldNotifyUpdate(cache, latestVersion, nowMs);
-
-    if (shouldNotify) {
-      console.log("[xinyun-ai-init] A newer version is available. Recommended command:");
-      console.log(`npx --yes ${packageName}@latest --force`);
-      console.log("[xinyun-ai-init] After upgrading the npm package, ask AI to reread xinyun-ai-init/README.md and check whether xinyun-ai/ needs a controlled upgrade.");
-    } else {
-      console.log("[xinyun-ai-init] A newer version is available, but the same update was already shown within 24 hours.");
-    }
-
-    writeUpdateCache(buildUpdateCache(latestVersion, "available", shouldNotify, nowIso, cache));
-
-    if (strictVersion) {
-      console.error("[xinyun-ai-init] Strict version mode is enabled. Stop because local version is outdated.");
-      return false;
-    }
-
-    return true;
+    console.log(`[xinyun-ai-init] A newer version is available: npx --yes ${packageName}@latest --force`);
   }
-
-  writeUpdateCache(buildUpdateCache(latestVersion, "current", false, nowIso, readUpdateCache()));
   return true;
 }
 
-async function main() {
-  const canContinue = await checkVersion();
-  if (!canContinue) {
-    process.exit(1);
+function materialize() {
+  const manifestPath = path.join(source, "runtime-manifest.json");
+  const manifest = readJson(manifestPath, null);
+  if (!manifest || !Array.isArray(manifest.files)) {
+    throw new Error("Missing or invalid runtime-manifest.json");
   }
 
-  if (!fs.existsSync(source)) {
-    console.error("[xinyun-ai-init] Init package missing:", source);
-    console.error("[xinyun-ai-init] Please reinstall or run with @latest.");
-    process.exit(1);
-  }
-
-  if (fs.existsSync(target)) {
-    if (!force) {
-      console.log("[xinyun-ai-init] xinyun-ai-init/ already exists. Skip overwrite.");
-      console.log(`[xinyun-ai-init] To overwrite, run: npx --yes ${packageName}@latest --force`);
-      console.log("");
-      printNextStep();
-      return;
+  const statePath = path.join(target, ".runtime-state.json");
+  const previous = readJson(statePath, { schemaVersion: 1, files: {} });
+  const next = {
+    schemaVersion: 1,
+    packageName,
+    packageVersion: currentVersion,
+    managedFiles: manifest.files,
+    files: {},
+    updatedAt: new Date().toISOString()
+  };
+  let copied = 0;
+  let skipped = 0;
+
+  fs.mkdirSync(target, { recursive: true });
+  for (const relative of manifest.files) {
+    const sourcePath = path.join(source, relative);
+    const targetPath = path.join(target, relative);
+    const sourceHash = hashFile(sourcePath);
+    const existingHash = fs.existsSync(targetPath) ? hashFile(targetPath) : null;
+    const previousEntry = previous.files && previous.files[relative];
+    const userModified = previousEntry && existingHash && existingHash !== previousEntry.targetHash;
+
+    if (userModified && !force) {
+      next.files[relative] = { sourceHash, targetHash: existingHash, status: "conflict" };
+      skipped += 1;
+      continue;
+    }
+    if (!existingHash || !previousEntry || previousEntry.sourceHash !== sourceHash || existingHash !== sourceHash || force) {
+      copyFileAtomic(sourcePath, targetPath);
+      copied += 1;
+    } else {
+      skipped += 1;
     }
-    fs.rmSync(target, { recursive: true, force: true });
+    next.files[relative] = { sourceHash, targetHash: hashFile(targetPath), status: "managed" };
   }
-
-  copyDir(source, target);
-  console.log("[xinyun-ai-init] Created init package:", target);
-  console.log("[xinyun-ai-init] This CLI only creates xinyun-ai-init/. It does not create xinyun-ai/ or modify business code.");
-  console.log("");
-  printNextStep();
+  copyFileAtomic(manifestPath, path.join(target, "runtime-manifest.json"));
+  next.files["runtime-manifest.json"] = { sourceHash: hashFile(manifestPath), targetHash: hashFile(path.join(target, "runtime-manifest.json")), status: "managed" };
+  const tempState = `${statePath}.${process.pid}.tmp`;
+  fs.writeFileSync(tempState, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+  fs.renameSync(tempState, statePath);
+  return { copied, skipped, conflicts: Object.values(next.files).filter((item) => item.status === "conflict").length };
 }
 
 function printNextStep() {
-  console.log("Next step: send this message to Codex / Cursor / Claude Code:");
-  console.log("");
-  console.log("请执行 `npx --yes @pm_zhousl/xinyun-ai-init@latest --force`，然后读取 `xinyun-ai-init/README.md`，按其中规则初始化或升级当前项目。");
-  console.log("");
-  console.log("The full workflow is in xinyun-ai-init/README.md. No long prompt is needed.");
-  console.log("After this message, the AI may create or update the minimal xinyun-ai/ workspace, but must not modify business code without confirmation.");
-  console.log("");
+  console.log("Next step: ask the host AI to read xinyun-ai-init/README.md and call the bundled Skill Runtime.");
+  console.log("The default route command is: node xinyun-ai-init/runtime/route-skill.js --facts <task-facts.json>");
+}
+
+async function main() {
+  if (!(await checkVersion())) process.exit(1);
+  if (!fs.existsSync(source)) throw new Error(`Init package missing: ${source}`);
+  const result = materialize();
+  console.log(`[xinyun-ai-init] Materialized v${currentVersion}: ${result.copied} updated, ${result.skipped} reused, ${result.conflicts} conflicts.`);
+  console.log("[xinyun-ai-init] This CLI only manages xinyun-ai-init/. It does not modify business code.");
+  printNextStep();
 }
 
 main().catch((error) => {