@remixmate/cli 0.9.72 → 0.9.74

package/dist/cli.js

@@ -1,212 +1,40 @@
 #!/usr/bin/env node
-/**
- * remixmate CLI entrypoint.
- *
- *   remixmate --list                          list registered skills
- *   remixmate <name> --help                   forward --help to underlying skill
- *   remixmate <name> [--flag value ...]       invoke the skill
- *
- * For python skills (entry.type === 'python') we spawn the script and inherit
- * its stdio so progress / errors flow through unchanged.
- * For http / builtin skills we dispatch in-process to handlers/.
- */
-import path from 'node:path';
-import { loadSkills, SKILLS_DIR } from './registry.js';
-import { parseArgv } from './argv.js';
-import { runSkill } from './runner.js';
-import { runAuthCommand } from './auth/commands.js';
-import { HOST_VERB, PROJECT_VERB, runHostCommand, runProjectCommand } from './project/commands.js';
-import { INSTALL_VERB, UNINSTALL_VERB, runInstall, runUninstall, skillInstallHint, packageVersion } from './install.js';
-import { runExec } from './exec.js';
-import { authStatusLine, runDoctor } from './doctor.js';
-import { padDisplay } from './text.js';
-import { EXIT, SkillError } from './errors.js';
-import { TEMPLATE_VERB, runTemplateCommand } from './template/commands.js';
-import { diagnostic } from './diagnostics.js';
-/** Reserved auth verbs handled before skill dispatch. */
-const AUTH_VERBS = new Set(['login', 'logout', 'whoami']);
-/**
- * SKILL_BASE_DIR can arrive as a relative path (e.g. from a developer .env or
- * from ab-agent's spawn env). The cli script's cwd isn't a stable anchor for
- * that — it's whatever the caller set, often the bundled `skills-cli/`
- * directory. Resolve against process.cwd() (= the caller's intended root) up
- * front so any later existsSync / readdirSync call sees an absolute,
- * predictable path.
- */
-function resolveBaseDir() {
-    const raw = process.env.SKILL_BASE_DIR;
-    if (!raw)
-        return SKILLS_DIR;
-    return path.isAbsolute(raw) ? raw : path.resolve(process.cwd(), raw);
-}
-function describeEntryTail(s) {
-    if (s.entry.type === 'python') {
-        // scriptPath 可以指向别的 skill 目录（如 web-record → ../web-screenshot/…），
-        // 这种相对路径原样打印，只给同目录脚本补上 scripts/ 前缀。
-        const p = s.entry.scriptPath;
-        return `(${p.startsWith('.') ? p : `scripts/${p.replace(/^scripts\//, '')}`})`;
-    }
-    return `[${s.entry.handler}]`;
-}
-function printUsage() {
-    // Match runSkill: honor SKILL_BASE_DIR so `remixmate --help` and the
-    // subsequent `remixmate <name>` invocation list / run from the same tree.
-    const skills = loadSkills(resolveBaseDir());
-    process.stdout.write('Usage:\n');
-    process.stdout.write('  remixmate --list                      List all skills\n');
-    process.stdout.write('  remixmate install [--host <h>]        Install the skills into Claude Code / Codex\n');
-    process.stdout.write('  remixmate uninstall                   Remove skills installed by this CLI\n');
-    process.stdout.write('  remixmate doctor                      Diagnose environment, credentials, backend\n');
-    process.stdout.write('  remixmate login                       Authorize this CLI via the browser\n');
-    process.stdout.write('  remixmate login --start | --wait      Non-blocking authorization (for agent hosts)\n');
-    process.stdout.write('  remixmate logout                      Remove stored credentials\n');
-    process.stdout.write('  remixmate whoami                      Show the current identity\n');
-    process.stdout.write('  remixmate exec -- <cmd> [args...]     Run a command with credentials injected\n');
-    process.stdout.write('  remixmate project list                List your projects\n');
-    process.stdout.write('  remixmate project use <prj> [--global]  Bind output to a project (this dir, or globally)\n');
-    process.stdout.write('  remixmate project show                Show the current project binding\n');
-    process.stdout.write('  remixmate host probe                  Diagnose host detection and take grouping\n');
-    process.stdout.write('  remixmate template init <dir>         Create a video-template project (no login)\n');
-    process.stdout.write('  remixmate template check [name]       Validate templates locally (no login)\n');
-    process.stdout.write('  remixmate template preview <name>     Render a draft preview mp4 remotely\n');
-    process.stdout.write('  remixmate template publish <name>     Publish as your private template\n');
-    process.stdout.write('  remixmate template list               List your private templates\n');
-    process.stdout.write('  remixmate template upgrade            Update the project\'s local check rules (no login)\n');
-    process.stdout.write('  remixmate <name> [--flag value ...]   Invoke a skill\n');
-    process.stdout.write('  remixmate <name> --help               Show skill-specific help\n');
-    process.stdout.write('  remixmate --version                   Print the CLI version\n');
-    process.stdout.write('\nAvailable skills:\n');
-    for (const s of skills) {
-        const summary = s.description.split('\n')[0].slice(0, 60);
-        process.stdout.write(`  ${s.name.padEnd(22)} ${s.entry.type.padEnd(8)} ${summary}\n`);
-    }
-}
-/** Human-facing note on what a skill's auth mode means in practice. */
-const AUTH_NOTE = {
-    required: '需登录',
-    optional: '可选',
-    none: '免登录',
-};
-/**
- * List skills.
- *
- * The default output is for a person: what each skill is and whether it needs a
- * credential. The previous tab-separated form leaked internals (toolName, entry
- * type, script path) that only tooling cares about — that shape now lives behind
- * `--json`, which is a stabler contract for tooling anyway.
- */
-function printList(json) {
-    const skills = loadSkills(resolveBaseDir());
-    if (json) {
-        process.stdout.write(JSON.stringify(skills.map((s) => ({
-            name: s.name,
-            toolName: s.toolName,
-            runtime: s.entry.type,
-            auth: s.auth,
-            entry: describeEntryTail(s),
-            description: s.description.split('\n')[0],
-        }))) + '\n');
-        return;
-    }
-    for (const s of skills) {
-        const summary = s.description.split('\n')[0].slice(0, 58);
-        process.stdout.write(`  ${s.name.padEnd(22)} ${padDisplay(AUTH_NOTE[s.auth], 8)}${summary}\n`);
-    }
-}
-/**
- * Auth status footer for the listing commands, on stderr so stdout stays clean
- * for anything piping the list. A fresh install used to say nothing at all about
- * credentials until a skill failed.
- */
-async function printAuthFooter() {
-    try {
-        process.stderr.write(`\n${await authStatusLine()}\n`);
-        // `npm i -g` 之后第一条命令通常就是 --help / --list：这里提醒一次「还没 remixmate install」，
-        // 代替会被 npm 吞掉输出、且侵入家目录的 postinstall。
-        const hint = skillInstallHint();
-        if (hint)
-            process.stderr.write(`${hint}\n`);
-    }
-    catch {
-        // A diagnostic footer must never be the reason a listing command fails.
-    }
-}
-async function main() {
-    const argv = process.argv.slice(2);
-    // 只认首位参数：`remixmate <skill> --version` 之类仍原样交给 skill。
-    if (argv[0] === '--version' || argv[0] === '-v' || argv[0] === '-V' || argv[0] === 'version') {
-        process.stdout.write(`${packageVersion()}\n`);
-        process.exit(EXIT.OK);
-    }
-    if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
-        printUsage();
-        await printAuthFooter();
-        process.exit(EXIT.OK);
-    }
-    if (argv[0] === '--list' || argv[0] === 'list') {
-        const json = argv.includes('--json') || argv.includes('--json-output');
-        printList(json);
-        if (!json)
-            await printAuthFooter();
-        process.exit(EXIT.OK);
-    }
-    // Host-install verbs, like the auth verbs, resolve before skill dispatch so a
-    // future skill named `install` could never shadow them.
-    if (argv[0] === INSTALL_VERB) {
-        process.exit(runInstall(argv.slice(1)));
-    }
-    if (argv[0] === UNINSTALL_VERB) {
-        process.exit(runUninstall(argv.slice(1)));
-    }
-    if (argv[0] === 'doctor') {
-        const code = await runDoctor({ skipNetwork: argv.includes('--offline') });
-        process.exit(code);
-    }
-    // Auth verbs are handled before skill dispatch so they never collide with skill names.
-    if (AUTH_VERBS.has(argv[0])) {
-        const code = await runAuthCommand(argv[0], argv.slice(1));
-        process.exit(code);
-    }
-    // Project / host verbs, like the auth verbs, are resolved before skill dispatch.
-    if (argv[0] === PROJECT_VERB) {
-        process.exit(await runProjectCommand(argv.slice(1)));
-    }
-    if (argv[0] === HOST_VERB) {
-        process.exit(await runHostCommand(argv.slice(1)));
-    }
-    if (argv[0] === TEMPLATE_VERB) {
-        const started = performance.now();
-        const code = await runTemplateCommand(argv.slice(1));
-        diagnostic(code, performance.now() - started);
-        process.exit(code);
-    }
-    if (argv[0] === 'exec') {
-        // Raw argv (not parsed) — everything after `--` belongs to the child command.
-        const code = await runExec(argv.slice(1));
-        process.exit(code);
-    }
-    if (argv[0].startsWith('-')) {
-        process.stderr.write(`❌ unknown option: ${argv[0]}\n`);
-        printUsage();
-        process.exit(EXIT.USAGE);
-    }
-    const skillName = argv[0];
-    const rest = argv.slice(1);
-    const code = await runSkill(skillName, {
-        baseDir: resolveBaseDir(),
-        rawArgs: rest,
-        parsedArgs: parseArgv(rest),
-    });
-    process.exit(code);
-}
-main().catch((err) => {
-    // A SkillError is an expected, already-worded failure (most often "not
-    // authenticated", exit 4) — print the message and honor its exit code rather
-    // than dumping a stack trace the user can do nothing with.
-    if (err instanceof SkillError) {
-        process.stderr.write(err.message + '\n');
-        process.exit(err.exitCode);
-    }
-    process.stderr.write(`❌ fatal: ${err?.stack ?? err?.message ?? String(err)}\n`);
-    process.exit(EXIT.ERROR);
-});
+var u=Object.defineProperty;var o=(t,s)=>u(t,"name",{value:s,configurable:!0});import p from"node:path";import{loadSkills as l,SKILLS_DIR as w}from"./registry.js";import{parseArgv as f}from"./argv.js";import{runSkill as h}from"./runner.js";import{runAuthCommand as x}from"./auth/commands.js";import{HOST_VERB as g,PROJECT_VERB as y,runHostCommand as k,runProjectCommand as v}from"./project/commands.js";import{INSTALL_VERB as E,UNINSTALL_VERB as S,runInstall as L,runUninstall as R,skillInstallHint as b,packageVersion as A}from"./install.js";import{runExec as j}from"./exec.js";import{authStatusLine as I,runDoctor as $}from"./doctor.js";import{padDisplay as C}from"./text.js";import{EXIT as i,SkillError as T}from"./errors.js";import{TEMPLATE_VERB as N,runTemplateCommand as _}from"./template/commands.js";import{diagnostic as B}from"./diagnostics.js";const V=new Set(["login","logout","whoami"]);function a(){const t=process.env.SKILL_BASE_DIR;return t?p.isAbsolute(t)?t:p.resolve(process.cwd(),t):w}o(a,"resolveBaseDir");function D(t){if(t.entry.type==="python"){const s=t.entry.scriptPath;return`(${s.startsWith(".")?s:`scripts/${s.replace(/^scripts\//,"")}`})`}return`[${t.entry.handler}]`}o(D,"describeEntryTail");function m(){const t=l(a());process.stdout.write(`Usage:
+`),process.stdout.write(`  remixmate --list                      List all skills
+`),process.stdout.write(`  remixmate install [--host <h>]        Install the skills into Claude Code / Codex
+`),process.stdout.write(`  remixmate uninstall                   Remove skills installed by this CLI
+`),process.stdout.write(`  remixmate doctor                      Diagnose environment, credentials, backend
+`),process.stdout.write(`  remixmate login                       Authorize this CLI via the browser
+`),process.stdout.write(`  remixmate login --start | --wait      Non-blocking authorization (for agent hosts)
+`),process.stdout.write(`  remixmate logout                      Remove stored credentials
+`),process.stdout.write(`  remixmate whoami                      Show the current identity
+`),process.stdout.write(`  remixmate exec -- <cmd> [args...]     Run a command with credentials injected
+`),process.stdout.write(`  remixmate project list                List your projects
+`),process.stdout.write(`  remixmate project use <prj> [--global]  Bind output to a project (this dir, or globally)
+`),process.stdout.write(`  remixmate project show                Show the current project binding
+`),process.stdout.write(`  remixmate host probe                  Diagnose host detection and take grouping
+`),process.stdout.write(`  remixmate template init <dir>         Create a video-template project (no login)
+`),process.stdout.write(`  remixmate template check [name]       Validate templates locally (no login)
+`),process.stdout.write(`  remixmate template preview <name>     Render a draft preview mp4 remotely
+`),process.stdout.write(`  remixmate template publish <name>     Publish as your private template
+`),process.stdout.write(`  remixmate template list               List your private templates
+`),process.stdout.write(`  remixmate template upgrade            Update the project's local check rules (no login)
+`),process.stdout.write(`  remixmate <name> [--flag value ...]   Invoke a skill
+`),process.stdout.write(`  remixmate <name> --help               Show skill-specific help
+`),process.stdout.write(`  remixmate --version                   Print the CLI version
+`),process.stdout.write(`
+Available skills:
+`);for(const s of t){const e=s.description.split(`
+`)[0].slice(0,60);process.stdout.write(`  ${s.name.padEnd(22)} ${s.entry.type.padEnd(8)} ${e}
+`)}}o(m,"printUsage");const O={required:"需登录",optional:"可选",none:"免登录"};function U(t){const s=l(a());if(t){process.stdout.write(JSON.stringify(s.map(e=>({name:e.name,toolName:e.toolName,runtime:e.entry.type,auth:e.auth,entry:D(e),description:e.description.split(`
+`)[0]})))+`
+`);return}for(const e of s){const n=e.description.split(`
+`)[0].slice(0,58);process.stdout.write(`  ${e.name.padEnd(22)} ${C(O[e.auth],8)}${n}
+`)}}o(U,"printList");async function d(){try{process.stderr.write(`
+${await I()}
+`);const t=b();t&&process.stderr.write(`${t}
+`)}catch{}}o(d,"printAuthFooter");async function P(){const t=process.argv.slice(2);if((t[0]==="--version"||t[0]==="-v"||t[0]==="-V"||t[0]==="version")&&(process.stdout.write(`${A()}
+`),process.exit(i.OK)),(t.length===0||t[0]==="--help"||t[0]==="-h")&&(m(),await d(),process.exit(i.OK)),t[0]==="--list"||t[0]==="list"){const r=t.includes("--json")||t.includes("--json-output");U(r),r||await d(),process.exit(i.OK)}if(t[0]===E&&process.exit(L(t.slice(1))),t[0]===S&&process.exit(R(t.slice(1))),t[0]==="doctor"){const r=await $({skipNetwork:t.includes("--offline")});process.exit(r)}if(V.has(t[0])){const r=await x(t[0],t.slice(1));process.exit(r)}if(t[0]===y&&process.exit(await v(t.slice(1))),t[0]===g&&process.exit(await k(t.slice(1))),t[0]===N){const r=performance.now(),c=await _(t.slice(1));B(c,performance.now()-r),process.exit(c)}if(t[0]==="exec"){const r=await j(t.slice(1));process.exit(r)}t[0].startsWith("-")&&(process.stderr.write(`❌ unknown option: ${t[0]}
+`),m(),process.exit(i.USAGE));const s=t[0],e=t.slice(1),n=await h(s,{baseDir:a(),rawArgs:e,parsedArgs:f(e)});process.exit(n)}o(P,"main"),P().catch(t=>{t instanceof T&&(process.stderr.write(t.message+`
+`),process.exit(t.exitCode)),process.stderr.write(`❌ fatal: ${t?.stack??t?.message??String(t)}
+`),process.exit(i.ERROR)});

package/dist/diagnostics.js

@@ -1,70 +1,2 @@
-import { randomBytes, randomUUID } from 'node:crypto';
-export function traceHeaders() {
-    const parent = process.env.AB_TRACEPARENT ?? '';
-    const match = /^00-([a-f0-9]{32})-([a-f0-9]{16})-[a-f0-9]{2}$/.exec(parent);
-    const trace = match && !/^0+$/.test(match[1]) && !/^0+$/.test(match[2]) ? match[1] : randomBytes(16).toString('hex');
-    const header = `00-${trace}-${randomBytes(8).toString('hex')}-01`;
-    process.env.AB_TRACEPARENT = header;
-    process.env.AB_OPERATION_ID ||= randomUUID();
-    return { traceparent: header };
-}
-/**
- * Redact a string for anything that leaves this process (diagnostic lines,
- * execution traces).
- *
- * Kept in lockstep with ab-agent's `lib/telemetry.cleanText` — the two feed the
- * same `media_chat_turn_trace` table, and a table whose rows were sanitized by
- * two different rulesets is a table nobody can reason about. ANSI stripping,
- * e-mail and phone redaction were added here to close that gap.
- *
- * `max` caps the result in BYTES, keeping the head. Callers that need the tail
- * (a command's decisive line is its last one) slice before calling.
- */
-export function cleanDiagnosticText(value, max = 2048) {
-    let text = value
-        .replace(/\x1b\[[0-9;]*m/g, '')
-        .replace(/https?:\/\/[^\s"'<>]+/g, raw => {
-        try {
-            const url = new URL(raw);
-            return url.origin + url.pathname;
-        }
-        catch {
-            return '[url]';
-        }
-    })
-        .replace(/(Bearer\s+|(?:token|secret|password|api[_-]?key)\s*[=:]\s*)[^\s,;}]+/gi, '$1[redacted]')
-        .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, '[email]')
-        .replace(/\b1[3-9]\d{9}\b/g, '[phone]');
-    for (const [key, secret] of Object.entries(process.env)) {
-        if (/TOKEN|SECRET|PASSWORD|API_KEY/i.test(key) && secret && secret.length >= 6)
-            text = text.split(secret).join('[redacted]');
-    }
-    return Buffer.from(text).subarray(0, max).toString('utf8');
-}
-/**
- * Exit code → the outcome vocabulary of the logging contract.
- *
- * Exported because the execution trace (project/trace.ts) reports the same
- * verdict for the same run: two mappings would let a run be `failure` in the
- * diagnostic line and `success` in the database.
- */
-export function outcomeOf(exitCode) {
-    if (exitCode === 0)
-        return 'success';
-    if (exitCode === 130)
-        return 'cancelled';
-    return [2, 3, 4].includes(exitCode) ? 'rejected' : 'failure';
-}
-/** Opt-in line framing for hosts; stdout is exclusively the existing skill protocol. */
-export function diagnostic(exitCode, durationMs, error) {
-    if (process.env.AB_DIAGNOSTICS !== '1')
-        return;
-    traceHeaders();
-    const outcome = outcomeOf(exitCode);
-    const record = { schema_version: 1, timestamp: new Date().toISOString(), service: 'remixmate-cli', environment: process.env.APP_ENV ?? 'dev',
-        level: outcome === 'failure' ? 'error' : 'info', event: 'cli.execution.completed', message: 'CLI execution completed', outcome,
-        trace_id: process.env.AB_TRACEPARENT?.split('-')[1], operation_id: process.env.AB_OPERATION_ID,
-        duration_ms: durationMs, attributes: { exit_code: exitCode },
-        error: error instanceof Error ? { type: error.name, message: cleanDiagnosticText(error.message), stack: cleanDiagnosticText(error.stack ?? '') } : undefined };
-    process.stderr.write('__diagnostic_v1__ ' + JSON.stringify(record) + '\n');
-}
+var i=Object.defineProperty;var c=(e,t)=>i(e,"name",{value:t,configurable:!0});import{randomBytes as o,randomUUID as p}from"node:crypto";function u(){const e=process.env.AB_TRACEPARENT??"",t=/^00-([a-f0-9]{32})-([a-f0-9]{16})-[a-f0-9]{2}$/.exec(e),n=`00-${t&&!/^0+$/.test(t[1])&&!/^0+$/.test(t[2])?t[1]:o(16).toString("hex")}-${o(8).toString("hex")}-01`;return process.env.AB_TRACEPARENT=n,process.env.AB_OPERATION_ID||=p(),{traceparent:n}}c(u,"traceHeaders");function a(e,t=2048){let r=e.replace(/\x1b\[[0-9;]*m/g,"").replace(/https?:\/\/[^\s"'<>]+/g,n=>{try{const s=new URL(n);return s.origin+s.pathname}catch{return"[url]"}}).replace(/(Bearer\s+|(?:token|secret|password|api[_-]?key)\s*[=:]\s*)[^\s,;}]+/gi,"$1[redacted]").replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi,"[email]").replace(/\b1[3-9]\d{9}\b/g,"[phone]");for(const[n,s]of Object.entries(process.env))/TOKEN|SECRET|PASSWORD|API_KEY/i.test(n)&&s&&s.length>=6&&(r=r.split(s).join("[redacted]"));return Buffer.from(r).subarray(0,t).toString("utf8")}c(a,"cleanDiagnosticText");function f(e){return e===0?"success":e===130?"cancelled":[2,3,4].includes(e)?"rejected":"failure"}c(f,"outcomeOf");function d(e,t,r){if(process.env.AB_DIAGNOSTICS!=="1")return;u();const n=f(e),s={schema_version:1,timestamp:new Date().toISOString(),service:"remixmate-cli",environment:process.env.APP_ENV??"dev",level:n==="failure"?"error":"info",event:"cli.execution.completed",message:"CLI execution completed",outcome:n,trace_id:process.env.AB_TRACEPARENT?.split("-")[1],operation_id:process.env.AB_OPERATION_ID,duration_ms:t,attributes:{exit_code:e},error:r instanceof Error?{type:r.name,message:a(r.message),stack:a(r.stack??"")}:void 0};process.stderr.write("__diagnostic_v1__ "+JSON.stringify(s)+`
+`)}c(d,"diagnostic");export{a as cleanDiagnosticText,d as diagnostic,f as outcomeOf,u as traceHeaders};

package/dist/doctor.js

@@ -1,188 +1,9 @@
-/**
- * `remixmate doctor` — one command that answers "why isn't this working?".
- *
- * The failure modes this package actually produces in the field are: no
- * credential, a credential bound to a different backend, a missing python3, a
- * missing Playwright, and an unreachable backend. Each of those used to surface
- * only as a downstream error from whichever skill happened to be run first, in
- * that skill's own wording. Checking them up front, in one place, turns a
- * scavenger hunt into a list.
- *
- * Also exports the one-line status shown under `--list` / `--help`, so a first
- * run says "you are not logged in" instead of leaving the user to find out by
- * invoking a skill.
- */
-import { spawnSync } from 'node:child_process';
-import { resolveApiBaseUrl } from './http.js';
-import { EXIT } from './errors.js';
-import { resolvePrivToken } from './auth/resolve.js';
-import { listCredentials } from './auth/credential-store.js';
-import { resolveTakeKey } from './project/host.js';
-import { readBinding } from './project/store.js';
-import { canAutoAuth, isHeadless } from './auth/environment.js';
-import { installStates, skillInstallHint } from './install.js';
-import { padDisplay } from './text.js';
-/**
- * Short auth status suitable for a footer. Never performs network I/O — a
- * listing command must stay instant and work offline.
- */
-export async function authStatusLine() {
-    const apiBaseUrl = resolveApiBaseUrl();
-    const resolved = await resolvePrivToken({ apiBaseUrl });
-    if (resolved) {
-        const who = resolved.userLabel ? `${resolved.userLabel} ` : '';
-        return `✅ 已登录 ${who}@ ${apiBaseUrl}（来源：${resolved.source}）`;
-    }
-    const others = await listCredentials();
-    if (others.length > 0) {
-        return (`⚠️  当前后端 ${apiBaseUrl} 未登录；` +
-            `已有凭证的后端：${others.map((c) => c.apiBaseUrl).join(', ')}`);
-    }
-    return `⚠️  未登录（${apiBaseUrl}）→ 运行 remixmate login`;
-}
-const ICON = { ok: '✅', warn: '⚠️ ', fail: '❌' };
-/** Probe a command's presence and version line without failing on absence. */
-function probe(cmd, args) {
-    try {
-        const res = spawnSync(cmd, args, { encoding: 'utf8', timeout: 10_000 });
-        if (res.error || res.status !== 0)
-            return null;
-        return (res.stdout || res.stderr || '').trim().split('\n')[0] || null;
-    }
-    catch {
-        return null;
-    }
-}
-async function checkBackend(apiBaseUrl) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 8_000);
-    try {
-        // The device-code endpoint is public, so reachability can be probed without
-        // a credential — and without side effects, since we never redeem the code.
-        const resp = await fetch(`${apiBaseUrl}/auth/device/code`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ clientLabel: 'remixmate-doctor' }),
-            signal: controller.signal,
-        });
-        return {
-            name: '后端可达性',
-            status: resp.ok ? 'ok' : 'warn',
-            detail: `${apiBaseUrl} → HTTP ${resp.status}`,
-        };
-    }
-    catch (err) {
-        const reason = err instanceof Error && err.name === 'AbortError' ? '超时' : err.message;
-        return { name: '后端可达性', status: 'fail', detail: `${apiBaseUrl} 不可达（${reason}）` };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-export async function runDoctor(opts = {}) {
-    const apiBaseUrl = resolveApiBaseUrl();
-    const checks = [];
-    const major = Number(process.versions.node.split('.')[0]);
-    checks.push({
-        name: 'Node',
-        status: major >= 18 ? 'ok' : 'fail',
-        detail: `v${process.versions.node}${major >= 18 ? '' : '（需要 >= 18）'}`,
-    });
-    const py = probe('python3', ['--version']);
-    checks.push({
-        name: 'python3',
-        status: py ? 'ok' : 'fail',
-        detail: py ?? '未找到 —— 12 个 skill 中的 8 个需要 python3 >= 3.10',
-    });
-    const playwright = py ? probe('python3', ['-c', 'import playwright; print(playwright.__version__)']) : null;
-    checks.push({
-        name: 'Playwright',
-        status: playwright ? 'ok' : 'warn',
-        detail: playwright ?? '当前解释器下未安装 —— 仅 web-screenshot / web-record 需要，首次运行会自动装',
-    });
-    checks.push({ name: '后端地址', status: 'ok', detail: apiBaseUrl });
-    // 宿主安装状态。这套方案唯一的静默失败模式是漂移：`npm update -g` 只动包，不动
-    // 已经铺进 ~/.claude/skills、~/.codex/skills 的副本,用户会拿着旧 SKILL.md 打新
-    // 后端,而且第一个症状往往是某个参数「莫名其妙不认」。
-    const hostStates = installStates();
-    for (const s of hostStates) {
-        checks.push({
-            // 只取宿主名的第一段（Claude Code → Claude）——检查名要留在 padDisplay 的
-            // 对齐宽度内，宿主目录已经写在 detail 里，不会有歧义。
-            name: `${s.label.split(' ')[0]} skill`,
-            status: s.installedVersion == null ? 'warn' : s.drifted ? 'warn' : 'ok',
-            detail: s.installedVersion == null
-                ? `未安装 —— 该 agent 不会自动发现这些 skill（remixmate install 可安装到 ${s.skillsDir}）`
-                : s.drifted
-                    ? `已装 ${s.installedVersion}，当前包 ${s.currentVersion} → 运行 remixmate install 覆盖`
-                    : `${s.installedVersion}（${s.skillsDir}）`,
-        });
-    }
-    // Where will this machine's renders land, and will repeated renders group?
-    // Both were previously invisible — the first sign of trouble was a finished
-    // video that appeared nowhere in the web app.
-    const binding = await readBinding(apiBaseUrl);
-    checks.push({
-        name: '项目归属',
-        status: 'ok',
-        detail: binding
-            ? `${binding.projectId}（${binding.scope === 'path' ? '目录绑定' : '全局绑定'}）`
-            : '未绑定 → 产物落进默认项目「未分类」（remixmate project use <prj> 可改）',
-    });
-    const take = resolveTakeKey(undefined);
-    checks.push({
-        name: 'take 分组',
-        status: take.source === 'none' ? 'warn' : 'ok',
-        detail: take.source === 'none'
-            ? '宿主未提供会话 ID —— 每次渲染各自成为一个 take。可 export REMIXMATE_TAKE_KEY 手动分组，详见 remixmate host probe'
-            : `${take.key}（宿主：${take.host || 'unknown'}，来源：${take.source}）`,
-    });
-    const resolved = await resolvePrivToken({ apiBaseUrl });
-    const stored = await listCredentials();
-    if (resolved) {
-        checks.push({
-            name: '凭证',
-            status: 'ok',
-            detail: `${resolved.userLabel ?? '(已认证)'}（来源：${resolved.source}）`,
-        });
-    }
-    else if (stored.length > 0) {
-        checks.push({
-            name: '凭证',
-            status: 'fail',
-            detail: `当前后端无凭证；已存储：${stored.map((c) => c.apiBaseUrl).join(', ')}。` +
-                ' 设置 MM_API_BASE_URL 指向其中之一，或重新 remixmate login',
-        });
-    }
-    else {
-        checks.push({ name: '凭证', status: 'fail', detail: '未登录 → 运行 remixmate login' });
-    }
-    checks.push({
-        name: '浏览器授权',
-        status: canAutoAuth() ? 'ok' : 'warn',
-        detail: canAutoAuth()
-            ? '可用（缺凭证时会自动打开授权页）'
-            : `不可用（${isHeadless() ? 'CI / 无桌面会话' : '已被 REMIXMATE_NO_BROWSER_AUTH 关闭'}）→ 请用 PRIV_TOKEN`,
-    });
-    if (!opts.skipNetwork)
-        checks.push(await checkBackend(apiBaseUrl));
-    for (const c of checks) {
-        // 16 而不是 14：宿主检查名最长是「WorkBuddy skill」，窄一格就会把那两行的
-        // detail 列顶出去，报告看起来像是漏了对齐。
-        process.stdout.write(`${ICON[c.status]} ${padDisplay(c.name, 16)}${c.detail}\n`);
-    }
-    // 宿主未装 skill 只算 warn（不影响退出码），但它是「agent 说不知道 RemixMate」的头号原因，
-    // 单独在报告末尾点名，避免淹没在一屏 ✅ 里。
-    const installHint = skillInstallHint(hostStates);
-    if (installHint)
-        process.stdout.write(`\n${installHint}\n`);
-    const failed = checks.filter((c) => c.status === 'fail');
-    if (failed.length === 0) {
-        process.stdout.write('\n一切正常。\n');
-        return EXIT.OK;
-    }
-    process.stdout.write(`\n${failed.length} 项需要处理：${failed.map((c) => c.name).join('、')}\n`);
-    // A missing credential is the single most common cause and has a dedicated
-    // exit code, so a host can act on it without parsing the report.
-    return failed.some((c) => c.name === '凭证') ? EXIT.NOT_AUTHENTICATED : EXIT.ERROR;
-}
+var T=Object.defineProperty;var i=(n,s)=>T(n,"name",{value:s,configurable:!0});import{spawnSync as _}from"node:child_process";import{resolveApiBaseUrl as $}from"./http.js";import{EXIT as m}from"./errors.js";import{resolvePrivToken as k}from"./auth/resolve.js";import{listCredentials as w}from"./auth/credential-store.js";import{resolveTakeKey as b}from"./project/host.js";import{readBinding as E}from"./project/store.js";import{canAutoAuth as y,isHeadless as A}from"./auth/environment.js";import{installStates as v,skillInstallHint as x}from"./install.js";import{padDisplay as I}from"./text.js";async function V(){const n=$(),s=await k({apiBaseUrl:n});if(s)return`✅ 已登录 ${s.userLabel?`${s.userLabel} `:""}@ ${n}（来源：${s.source}）`;const t=await w();return t.length>0?`⚠️  当前后端 ${n} 未登录；已有凭证的后端：${t.map(o=>o.apiBaseUrl).join(", ")}`:`⚠️  未登录（${n}）→ 运行 remixmate login`}i(V,"authStatusLine");const N={ok:"✅",warn:"⚠️ ",fail:"❌"};function g(n,s){try{const t=_(n,s,{encoding:"utf8",timeout:1e4});return t.error||t.status!==0?null:(t.stdout||t.stderr||"").trim().split(`
+`)[0]||null}catch{return null}}i(g,"probe");async function O(n){const s=new AbortController,t=setTimeout(()=>s.abort(),8e3);try{const o=await fetch(`${n}/auth/device/code`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({clientLabel:"remixmate-doctor"}),signal:s.signal});return{name:"后端可达性",status:o.ok?"ok":"warn",detail:`${n} → HTTP ${o.status}`}}catch(o){const r=o instanceof Error&&o.name==="AbortError"?"超时":o.message;return{name:"后端可达性",status:"fail",detail:`${n} 不可达（${r}）`}}finally{clearTimeout(t)}}i(O,"checkBackend");async function K(n={}){const s=$(),t=[],o=Number(process.versions.node.split(".")[0]);t.push({name:"Node",status:o>=18?"ok":"fail",detail:`v${process.versions.node}${o>=18?"":"（需要 >= 18）"}`});const r=g("python3",["--version"]);t.push({name:"python3",status:r?"ok":"fail",detail:r??"未找到 —— 12 个 skill 中的 8 个需要 python3 >= 3.10"});const p=r?g("python3",["-c","import playwright; print(playwright.__version__)"]):null;t.push({name:"Playwright",status:p?"ok":"warn",detail:p??"当前解释器下未安装 —— 仅 web-screenshot / web-record 需要，首次运行会自动装"}),t.push({name:"后端地址",status:"ok",detail:s});const d=v();for(const e of d)t.push({name:`${e.label.split(" ")[0]} skill`,status:e.installedVersion==null||e.drifted?"warn":"ok",detail:e.installedVersion==null?`未安装 —— 该 agent 不会自动发现这些 skill（remixmate install 可安装到 ${e.skillsDir}）`:e.drifted?`已装 ${e.installedVersion}，当前包 ${e.currentVersion} → 运行 remixmate install 覆盖`:`${e.installedVersion}（${e.skillsDir}）`});const u=await E(s);t.push({name:"项目归属",status:"ok",detail:u?`${u.projectId}（${u.scope==="path"?"目录绑定":"全局绑定"}）`:"未绑定 → 产物落进默认项目「未分类」（remixmate project use <prj> 可改）"});const a=b(void 0);t.push({name:"take 分组",status:a.source==="none"?"warn":"ok",detail:a.source==="none"?"宿主未提供会话 ID —— 每次渲染各自成为一个 take。可 export REMIXMATE_TAKE_KEY 手动分组，详见 remixmate host probe":`${a.key}（宿主：${a.host||"unknown"}，来源：${a.source}）`});const c=await k({apiBaseUrl:s}),f=await w();c?t.push({name:"凭证",status:"ok",detail:`${c.userLabel??"(已认证)"}（来源：${c.source}）`}):f.length>0?t.push({name:"凭证",status:"fail",detail:`当前后端无凭证；已存储：${f.map(e=>e.apiBaseUrl).join(", ")}。 设置 MM_API_BASE_URL 指向其中之一，或重新 remixmate login`}):t.push({name:"凭证",status:"fail",detail:"未登录 → 运行 remixmate login"}),t.push({name:"浏览器授权",status:y()?"ok":"warn",detail:y()?"可用（缺凭证时会自动打开授权页）":`不可用（${A()?"CI / 无桌面会话":"已被 REMIXMATE_NO_BROWSER_AUTH 关闭"}）→ 请用 PRIV_TOKEN`}),n.skipNetwork||t.push(await O(s));for(const e of t)process.stdout.write(`${N[e.status]} ${I(e.name,16)}${e.detail}
+`);const h=x(d);h&&process.stdout.write(`
+${h}
+`);const l=t.filter(e=>e.status==="fail");return l.length===0?(process.stdout.write(`
+一切正常。
+`),m.OK):(process.stdout.write(`
+${l.length} 项需要处理：${l.map(e=>e.name).join("、")}
+`),l.some(e=>e.name==="凭证")?m.NOT_AUTHENTICATED:m.ERROR)}i(K,"runDoctor");export{V as authStatusLine,K as runDoctor};

package/dist/errors.js

@@ -1,33 +1 @@
-/**
- * Process-wide error type and exit-code contract.
- *
- * Extracted from http.ts so the auth gateway (auth/ensure.ts) can throw the same
- * error type without creating an import cycle (http.ts → ensure.ts → http.ts).
- * `SkillError` is still re-exported from http.ts, so existing imports are unchanged.
- *
- * Exit codes are a CONTRACT with hosts (Claude Code / Codex / ab-agent): an agent
- * reads the code to decide whether to guide the user through authorization, retry
- * later, or surface a hard failure. Never reuse a code for a different meaning.
- */
-export const EXIT = {
-    /** Success. */
-    OK: 0,
-    /** Generic runtime failure. */
-    ERROR: 1,
-    /** Usage error — unknown skill / unknown option. */
-    USAGE: 2,
-    /** No usable credential, or the credential was rejected. Host should offer to authorize. */
-    NOT_AUTHENTICATED: 4,
-    /** Backend unreachable / timed out. Distinct from 4 so "log in" isn't suggested for an outage. */
-    BACKEND_UNREACHABLE: 5,
-    /** Failed to spawn the underlying interpreter. */
-    SPAWN_FAILED: 127,
-};
-export class SkillError extends Error {
-    exitCode;
-    constructor(message, exitCode = EXIT.ERROR) {
-        super(message);
-        this.exitCode = exitCode;
-        this.name = 'SkillError';
-    }
-}
+var t=Object.defineProperty;var e=(E,r)=>t(E,"name",{value:r,configurable:!0});const s={OK:0,ERROR:1,USAGE:2,NOT_AUTHENTICATED:4,BACKEND_UNREACHABLE:5,SPAWN_FAILED:127};class R extends Error{static{e(this,"SkillError")}exitCode;constructor(r,o=s.ERROR){super(r),this.exitCode=o,this.name="SkillError"}}export{s as EXIT,R as SkillError};

package/dist/exec.js

@@ -1,47 +1,4 @@
-/**
- * `remixmate exec -- <command> [args...]`
- *
- * Runs an arbitrary command with the resolved credential injected into its
- * environment (`PRIV_TOKEN` + `MM_API_BASE_URL`), using the same gateway that
- * skill dispatch uses.
- *
- * This is the general form of the invariant the auth rework establishes: Node
- * is the only thing that reads the credential store / keychain / device flow,
- * and every child process receives the result through its environment. Without
- * it, maintenance scripts that import `registry_loader` directly (e.g.
- * scripts/test-template-pipeline.py) would have to re-implement credential
- * lookup — which is exactly the duplication, and the cross-origin token leak,
- * that was just removed.
- *
- * The token is never printed; it only ever reaches the child's environment.
- */
-import { spawn } from 'node:child_process';
-import { parseArgv } from './argv.js';
-import { EXIT } from './errors.js';
-import { authChildEnv, ensureAuth } from './auth/ensure.js';
-const USAGE = 'Usage: remixmate exec [--api-base-url URL] [--token TOKEN] -- <command> [args...]\n';
-export async function runExec(argv) {
-    const separator = argv.indexOf('--');
-    if (separator === -1 || separator === argv.length - 1) {
-        process.stderr.write(`❌ exec 需要一个 \`--\` 分隔符与要执行的命令。\n${USAGE}`);
-        return EXIT.USAGE;
-    }
-    const flags = parseArgv(argv.slice(0, separator));
-    const [command, ...args] = argv.slice(separator + 1);
-    const auth = await ensureAuth({
-        mode: 'required',
-        apiBaseUrl: typeof flags.api_base_url === 'string' ? flags.api_base_url : undefined,
-        flagToken: typeof flags.token === 'string' ? flags.token : undefined,
-    });
-    return await new Promise((resolve) => {
-        const proc = spawn(command, args, {
-            stdio: 'inherit',
-            env: { ...process.env, ...authChildEnv(auth) },
-        });
-        proc.on('exit', (code, signal) => resolve(signal ? EXIT.ERROR : code ?? EXIT.ERROR));
-        proc.on('error', (err) => {
-            process.stderr.write(`❌ failed to spawn ${command}: ${err.message}\n`);
-            resolve(EXIT.SPAWN_FAILED);
-        });
-    });
-}
+var f=Object.defineProperty;var c=(e,r)=>f(e,"name",{value:r,configurable:!0});import{spawn as u}from"node:child_process";import{parseArgv as l}from"./argv.js";import{EXIT as t}from"./errors.js";import{authChildEnv as E,ensureAuth as g}from"./auth/ensure.js";const w=`Usage: remixmate exec [--api-base-url URL] [--token TOKEN] -- <command> [args...]
+`;async function _(e){const r=e.indexOf("--");if(r===-1||r===e.length-1)return process.stderr.write(`❌ exec 需要一个 \`--\` 分隔符与要执行的命令。
+${w}`),t.USAGE;const n=l(e.slice(0,r)),[s,...p]=e.slice(r+1),m=await g({mode:"required",apiBaseUrl:typeof n.api_base_url=="string"?n.api_base_url:void 0,flagToken:typeof n.token=="string"?n.token:void 0});return await new Promise(i=>{const a=u(s,p,{stdio:"inherit",env:{...process.env,...E(m)}});a.on("exit",(o,d)=>i(d?t.ERROR:o??t.ERROR)),a.on("error",o=>{process.stderr.write(`❌ failed to spawn ${s}: ${o.message}
+`),i(t.SPAWN_FAILED)})})}c(_,"runExec");export{_ as runExec};