@uzooai/anime-ai-cli 0.0.0-stage → 0.6.0

package/src/image-output.js

@@ -0,0 +1,385 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { atomic } from './store.js'
+import { scopedCanvas } from './materials.js'
+import { segment, uploadParts } from './workflows.js'
+import { bindUpload } from './resource.js'
+import { hashFile } from './media.js'
+const text = (value) => String(value ?? '').trim()
+const digest = (value) => crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex')
+const fail = (code, message, error) =>
+  Object.assign(new Error(message), {
+    code,
+    ...(error
+      ? {
+          cause: error,
+          diagnostic: {
+            ...(error.status ? { http_status: error.status } : {}),
+            ...(error.apiCode ? { api_code: error.apiCode } : {}),
+            ...(error.requestId ? { request_id: error.requestId } : {})
+          }
+        }
+      : {})
+  })
+
+// Shared persistence/upload contract for locally processed image outputs.
+// Callers own source validation, geometry, decoding and operation journals.
+export function imageOutputWorkflow({
+  recordPath,
+  readContext,
+  nodeTitle,
+  nodePosition,
+  edgeRole,
+  edgePrefix,
+  codePrefix,
+  mime,
+  summarize,
+  nodeType = () => 'image_upload'
+}) {
+  async function persistNodes(client, profile, record, current) {
+    const doc = current.doc
+    const existing = record.items.map((item) => doc.nodes.find((node) => node.id === item.nodeId))
+    if (existing.every(Boolean)) {
+      for (let i = 0; i < existing.length; i++) {
+        const node = existing[i],
+          item = record.items[i]
+        if (
+          node.type !== nodeType(record, item) ||
+          (node.data?.extra?.node_kind &&
+            node.data.extra.node_kind !==
+              (nodeType(record, item) === 'image' ? 'generation' : 'asset')) ||
+          (node.data?.file_name && node.data.file_name !== item.fileName) ||
+          !doc.edges.some(
+            (e) =>
+              e.source === record.input.node_id && e.target === node.id && e.data?.role === edgeRole
+          )
+        )
+          throw new Error('图片处理结果节点或来源连线已变化，停止保存')
+      }
+      record.nodesSaved = true
+      await atomic(recordPath(profile, record.operation), record)
+      return
+    }
+    if (record.nodesSaved || record.saveAttempted || existing.some(Boolean))
+      throw fail(
+        codePrefix + '_SYNC_PENDING',
+        '图片处理节点/连线缺失或保存结果不明；先核对用户删除/画布内容，不自动重建'
+      )
+    if (
+      !Number.isSafeInteger(doc.version) ||
+      !doc.viewport ||
+      !doc.meta ||
+      !Array.isArray(doc.edges)
+    )
+      throw new Error('图片处理画布快照不完整')
+    const nodes = structuredClone(doc.nodes),
+      edges = structuredClone(doc.edges)
+    for (const item of record.items) {
+      const node = {
+        id: item.nodeId,
+        type: nodeType(record, item),
+        position: nodePosition(nodes, current.node),
+        data: {
+          title: nodeTitle(item),
+          mediaType: 'image',
+          url: '',
+          file_name: item.fileName,
+          file_size: item.local.bytes,
+          width: item.local.width,
+          height: item.local.height,
+          uploading: true,
+          ...(nodeType(record, item) === 'image'
+            ? {
+                status: 'processing',
+                runtime: { status: 'processing', operation: 'upload', progress: 0, error: '' }
+              }
+            : {}),
+          extra: {
+            node_kind: nodeType(record, item) === 'image_upload' ? 'asset' : 'generation',
+            aspect_ratio: item.local.width + ':' + item.local.height
+          }
+        }
+      }
+      nodes.push(node)
+      edges.push({
+        id: edgePrefix + item.nodeId,
+        source: record.input.node_id,
+        target: item.nodeId,
+        sourceHandle: '',
+        targetHandle: '',
+        type: 'default',
+        data: { role: edgeRole }
+      })
+    }
+    record.saveAttempted = true
+    await atomic(recordPath(profile, record.operation), record)
+    try {
+      const saved = await client.raw(
+        '/canvas/docs/' + segment(doc.id),
+        {
+          method: 'PUT',
+          body: {
+            version: doc.version,
+            name: doc.name,
+            viewport: doc.viewport,
+            nodes,
+            edges,
+            meta: doc.meta
+          }
+        },
+        { retry: false }
+      )
+      if (
+        saved.id !== doc.id ||
+        saved.version <= doc.version ||
+        record.items.some(
+          (item) =>
+            !saved.nodes?.some((n) => n.id === item.nodeId) ||
+            !saved.edges?.some((e) => e.id === edgePrefix + item.nodeId)
+        )
+      )
+        throw new Error('节点保存响应不完整')
+      record.nodesSaved = true
+      await atomic(recordPath(profile, record.operation), record)
+    } catch (error) {
+      record.state = 'sync_pending'
+      if (error.status === 409 || error.apiCode === 3002) {
+        record.saveAttempted = false
+      }
+      await atomic(recordPath(profile, record.operation), record)
+      throw fail(
+        codePrefix + '_SYNC_PENDING',
+        '图片处理已在本地导出，节点保存未确认；查询原画布后恢复，不重复处理',
+        error
+      )
+    }
+  }
+  function validateUpload(response, record, item) {
+    if (
+      response?.source_doc_id !== record.input.doc_id ||
+      response.source_node_id !== item.nodeId ||
+      response.segment_type !== 'image' ||
+      !response.result?.file_ref ||
+      !response.result.url ||
+      !/^image\//.test(response.result.mime_type || '') ||
+      response.result.width !== item.local.width ||
+      response.result.height !== item.local.height ||
+      !/^[1-9]\d*$/.test(text(response.task_id))
+    )
+      throw fail(
+        codePrefix + '_UPLOAD_UNKNOWN',
+        '上传响应缺少真实图片/任务关联；查询原节点和任务，不重复上传'
+      )
+    return response
+  }
+  async function reconcile(client, record, item) {
+    const list = await client.raw(
+      '/canvas/generations?' +
+        new URLSearchParams({
+          doc_id: record.input.doc_id,
+          node_id: item.nodeId,
+          status: 'completed',
+          limit: '100'
+        })
+    )
+    const current = await readContext(client, record.input)
+    if (digest(current.binding) !== digest(record.binding))
+      throw new Error('恢复上传前源素材已变化，停止')
+    const node = current.doc.nodes.find((n) => n.id === item.nodeId)
+    const uploadTask = String(node?.data?.task_id || '')
+    const uploadRef = node?.data?.file_ref
+    const candidates = list.items?.filter(
+      (task) =>
+        task.doc_id === record.input.doc_id &&
+        task.node_id === item.nodeId &&
+        task.segment_type === 'image' &&
+        (task.model_name === 'local-upload' ||
+          (uploadTask &&
+            String(task.task_id ?? task.id) === uploadTask &&
+            uploadRef &&
+            task.result?.file_ref === uploadRef &&
+            task.credit_cost === 0 &&
+            task.billing_status === 'charged')) &&
+        task.status === 'completed' &&
+        task.result?.filename === item.fileName &&
+        task.result?.file_ref &&
+        task.result?.url
+    )
+    if (candidates?.length !== 1)
+      throw fail(
+        codePrefix + '_UPLOAD_UNKNOWN',
+        '原上传 complete 结果未知；原节点未查到唯一真实任务，不重新 complete 或重传'
+      )
+    const task = candidates[0]
+    item.response = validateUpload(
+      {
+        source_doc_id: task.doc_id,
+        source_node_id: task.node_id,
+        segment_type: 'image',
+        task_id: task.task_id ?? task.id,
+        result: task.result
+      },
+      record,
+      item
+    )
+    item.state = 'uploaded'
+  }
+  async function runUploads(client, profile, record) {
+    record.state = 'uploading'
+    await atomic(recordPath(profile, record.operation), record)
+    for (const item of record.items) {
+      const current = await readContext(client, record.input)
+      if (digest(record.binding) !== digest(current.binding))
+        throw new Error('上传前源素材已变化，停止')
+      const node = current.doc.nodes.find((node) => node.id === item.nodeId)
+      if (
+        !node ||
+        node.type !== nodeType(record, item) ||
+        !current.doc.edges.some(
+          (e) =>
+            e.source === record.input.node_id &&
+            e.target === item.nodeId &&
+            e.data?.role === edgeRole
+        )
+      )
+        throw new Error('图片处理节点或连线已被删除，不自动重建')
+      const currentRef =
+        node.data?.file_ref || node.data?.extra?.file_ref || node.data?.result?.file_ref
+      if (
+        currentRef &&
+        currentRef !== item.response?.result?.file_ref &&
+        !['completing', 'unknown'].includes(item.state)
+      )
+        throw new Error('图片处理节点已换成其他素材；保留用户编辑')
+      if (['completing', 'unknown'].includes(item.state)) {
+        record.state = 'upload_unknown'
+        await atomic(recordPath(profile, record.operation), record)
+        await reconcile(client, record, item)
+        record.state = 'uploading'
+        await atomic(recordPath(profile, record.operation), record)
+      }
+      if (item.state === 'session_unknown') {
+        record.state = 'upload_unknown'
+        await atomic(recordPath(profile, record.operation), record)
+        throw fail(
+          codePrefix + '_UPLOAD_UNKNOWN',
+          '上传会话创建结果未知，停止；不自动创建第二个会话'
+        )
+      }
+      if (!item.response) {
+        const image = path.join(record.directory, item.fileName)
+        const local = await hashFile(image)
+        if (local.sha256 !== item.local.sha256 || local.bytes !== item.local.bytes)
+          throw new Error('本地图片处理产物发生变化，不上传')
+        const endpoint =
+          '/canvas/docs/' + segment(record.input.doc_id) + '/nodes/' + segment(item.nodeId)
+        if (!item.session) {
+          item.state = 'session_unknown'
+          record.state = 'upload_unknown'
+          await atomic(recordPath(profile, record.operation), record)
+          try {
+            item.session = await client.raw(
+              endpoint + '/upload-session',
+              {
+                method: 'POST',
+                body: {
+                  filename: item.fileName,
+                  file_size: local.bytes,
+                  expected_type: 'image',
+                  mime_type: mime
+                }
+              },
+              { retry: false }
+            )
+          } catch (error) {
+            throw fail(
+              codePrefix + '_UPLOAD_UNKNOWN',
+              '创建图片处理上传会话未确认；停止并保留原操作',
+              error
+            )
+          }
+          item.state = 'uploading'
+          record.state = 'uploading'
+          await atomic(recordPath(profile, record.operation), record)
+        }
+        if (!item.parts) {
+          const handle = await fs.open(image, 'r')
+          try {
+            item.parts = await uploadParts(client, handle, await handle.stat(), item.session, mime)
+          } finally {
+            await handle.close()
+          }
+          await atomic(recordPath(profile, record.operation), record)
+        }
+        item.state = 'completing'
+        await atomic(recordPath(profile, record.operation), record)
+        try {
+          item.response = validateUpload(
+            await client.raw(
+              endpoint + '/upload-complete',
+              {
+                method: 'POST',
+                body: {
+                  upload_id: item.session.upload_id,
+                  object_key: item.session.object_key,
+                  expected_parts: item.parts.length,
+                  parts: item.parts
+                }
+              },
+              { retry: false }
+            ),
+            record,
+            item
+          )
+        } catch (error) {
+          item.state = 'unknown'
+          record.state = 'upload_unknown'
+          await atomic(recordPath(profile, record.operation), record)
+          throw fail(
+            codePrefix + '_UPLOAD_UNKNOWN',
+            '图片处理上传完成结果未确认；只查询原节点/任务恢复，不再次 complete',
+            error
+          )
+        }
+        item.state = 'uploaded'
+        await atomic(recordPath(profile, record.operation), record)
+      }
+      if (!item.bound) {
+        try {
+          await bindUpload(client, {
+            docId: record.input.doc_id,
+            nodeId: item.nodeId,
+            result: item.response,
+            imageNode: nodeType(record, item) === 'image'
+          })
+          // Clear the preparation flag only after real upload binding succeeds.
+          const doc = await scopedCanvas(
+            client,
+            record.input.doc_id,
+            record.input.space,
+            record.input.team_uid
+          )
+          const node = doc.nodes.find((n) => n.id === item.nodeId)
+          if (node?.data?.extra?.file_ref !== item.response.result.file_ref)
+            throw new Error('图片处理引用读回不一致')
+          item.bound = true
+          item.state = 'completed'
+          await atomic(recordPath(profile, record.operation), record)
+        } catch (error) {
+          record.state = 'sync_pending'
+          await atomic(recordPath(profile, record.operation), record)
+          throw fail(
+            codePrefix + '_SYNC_PENDING',
+            '图片已上传，画布绑定未确认；恢复原响应，不重传图片',
+            error
+          )
+        }
+      }
+    }
+    record.state = 'completed'
+    await atomic(recordPath(profile, record.operation), record)
+    return summarize(record)
+  }
+  return { persistNodes, runUploads }
+}

package/src/install.js

@@ -0,0 +1,237 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { homedir } from 'node:os'
+import { createHash } from 'node:crypto'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { createInterface } from 'node:readline/promises'
+import { setTimeout as delay } from 'node:timers/promises'
+import { packageInfo } from './package-info.js'
+
+const exec = promisify(execFile)
+const skillName = 'uzoo-anime-cli'
+const receipt = '.uzoo-install.json'
+const bundle = path.join('.agents', 'skills', skillName)
+const registry = 'https://registry.npmjs.org/'
+const agents = {
+  codex: { label: 'Codex', config: '.agents', detect: '.codex' },
+  workbuddy: { label: 'WorkBuddy', config: '.workbuddy' },
+  'claude-code': { label: 'Claude Code', config: '.claude' },
+}
+const help = `安装或更新同版本的 CLI 和 Skill（用户级）
+  install                              检测并选择一个或多个 Agent
+  install --agent codex --agent workbuddy
+  install --agent codex --yes           非交互，须明确指定 Agent
+  install --agent workbuddy --dry-run   仅预览，不安装
+Agent：codex、workbuddy、claude-code
+原 npm install -g 仍只安装 CLI 和随包文件，不写 Agent 技能目录。`
+
+export function parseInstall(args) {
+  const selected = [], flags = new Set()
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (arg === '--agent') {
+      const id = args[++i]?.toLowerCase()
+      if (!Object.hasOwn(agents, id)) throw new Error('未知或缺少 --agent；可选 codex、workbuddy、claude-code')
+      if (!selected.includes(id)) selected.push(id)
+    } else if (['--yes', '--dry-run', '--help', '-h'].includes(arg) && !flags.has(arg)) {
+      flags.add(arg)
+    } else throw new Error(`未知或重复的安装参数：${arg}`)
+  }
+  if (flags.has('--yes') && !selected.length) throw new Error('--yes 需要明确指定至少一个 --agent')
+  return { selected, yes: flags.has('--yes'), dryRun: flags.has('--dry-run'), help: flags.has('--help') || flags.has('-h') }
+}
+
+async function stat(file) {
+  try { return await fs.lstat(file) } catch (error) { if (error.code !== 'ENOENT') throw error }
+}
+
+async function safeDirectories(...directories) {
+  for (const dir of directories) {
+    const s = await stat(dir)
+    if (s && (!s.isDirectory() || s.isSymbolicLink())) throw new Error(`不是普通目录，未修改：${dir}`)
+  }
+}
+
+export async function agentTargets(home) {
+  return Promise.all(Object.entries(agents).map(async ([id, agent]) => {
+    const config = path.join(home, agent.config)
+    const root = path.join(config, 'skills')
+    const detected = Boolean((await stat(path.join(home, agent.detect || agent.config)))?.isDirectory())
+    return { id, label: agent.label, config, root, target: path.join(root, skillName), detected }
+  }))
+}
+
+async function fingerprint(directory) {
+  const hash = createHash('sha256')
+  async function walk(dir, prefix = '') {
+    for (const entry of (await fs.readdir(dir, { withFileTypes: true })).sort((a, b) => a.name < b.name ? -1 : a.name === b.name ? 0 : 1)) {
+      if (!prefix && entry.name === receipt) continue
+      const file = path.join(dir, entry.name), name = prefix + entry.name
+      if (entry.isDirectory() && !entry.isSymbolicLink()) {
+        hash.update(JSON.stringify(['directory', name]))
+        await walk(file, name + '/')
+      } else if (entry.isFile() && !entry.isSymbolicLink()) {
+        hash.update(JSON.stringify(['file', name, createHash('sha256').update(await fs.readFile(file)).digest('hex')]))
+      } else throw new Error(`技能中存在链接或特殊文件：${file}`)
+    }
+  }
+  await safeDirectories(directory)
+  await walk(directory)
+  return hash.digest('hex')
+}
+
+async function inspect(target) {
+  await safeDirectories(target.config, target.root, target.target)
+  if (!await stat(target.target)) return { kind: 'new' }
+  const marker = path.join(target.target, receipt)
+  if (!(await stat(marker))?.isFile()) return { kind: 'protected' }
+  let meta
+  try { meta = JSON.parse(await fs.readFile(marker, 'utf8')) } catch (error) {
+    if (!(error instanceof SyntaxError)) throw error
+    return { kind: 'protected' }
+  }
+  if (meta?.package !== packageInfo.name || meta?.schema !== 1) return { kind: 'protected' }
+  const digest = await fingerprint(target.target)
+  if (meta.digest !== digest) return { kind: 'protected' }
+  return { kind: 'managed', digest, version: meta.version }
+}
+
+async function verifyBundle(directory) {
+  if (!(await stat(path.join(directory, 'SKILL.md')))?.isFile() ||
+      !(await stat(path.join(directory, 'references')))?.isDirectory() ||
+      await stat(path.join(directory, receipt))) throw new Error('npm 包内 Skill 不完整或含安装记录')
+  return fingerprint(directory)
+}
+
+async function renameSkill(from, to) {
+  // Windows indexers can briefly hold a handle to freshly copied files.
+  for (const wait of [25, 50, 100, 200, 400, 0]) {
+    if (await stat(to)) throw new Error(`目标目录已存在，未覆盖：${to}`)
+    try { await fs.rename(from, to); return } catch (error) {
+      if (process.platform !== 'win32' || !wait || !['EPERM', 'EACCES', 'EBUSY'].includes(error.code)) throw error
+      await delay(wait)
+    }
+  }
+}
+
+async function installSkill(target, directory, digest, version, expected) {
+  const current = await inspect(target)
+  if (JSON.stringify(current) !== JSON.stringify(expected)) throw new Error(`${target.label} 的 Skill 在确认后有变化，请重新预览`)
+  if (current.digest === digest && current.version === version) return 'unchanged'
+  await fs.mkdir(target.root, { recursive: true })
+  const stage = await fs.mkdtemp(path.join(target.config, '.uzoo-install-'))
+  const next = path.join(stage, 'next'), previous = path.join(stage, 'previous')
+  let moved = false
+  try {
+    await fs.cp(directory, next, { recursive: true, errorOnExist: true, force: false })
+    if (await fingerprint(next) !== digest) throw new Error('Skill 暂存校验失败')
+    await fs.writeFile(path.join(next, receipt), JSON.stringify({ schema: 1, package: packageInfo.name, version, digest }) + '\n', { flag: 'wx' })
+    if (JSON.stringify(await inspect(target)) !== JSON.stringify(current)) throw new Error(`${target.label} 的 Skill 已变化，请重新预览`)
+    if (current.kind === 'managed') {
+      await renameSkill(target.target, previous); moved = true
+      // Preserve an edit made between the final check and the directory move.
+      if (await fingerprint(previous) !== current.digest) throw new Error(`${target.label} 的 Skill 在替换前有变化`)
+    }
+    await renameSkill(next, target.target)
+    moved = false
+    return current.kind === 'new' ? 'installed' : 'updated'
+  } catch (error) {
+    if (moved) {
+      try { await renameSkill(previous, target.target); moved = false } catch {
+        throw new Error(`${error.message}；原 Skill 保留于 ${previous}`)
+      }
+    }
+    throw error
+  } finally {
+    if (!moved) await fs.rm(stage, { recursive: true, force: true }).catch(() => {})
+  }
+}
+
+export async function runNpm(args, signal) {
+  const npmCli = process.env.npm_execpath
+  const options = { timeout: 120_000, windowsHide: true, signal }
+  if (npmCli && path.isAbsolute(npmCli) && path.basename(npmCli) === 'npm-cli.js') {
+    return (await exec(process.execPath, [npmCli, ...args], options)).stdout.trim()
+  }
+  if (process.platform !== 'win32') return (await exec('npm', args, options)).stdout.trim()
+  // cmd is needed for npm.cmd. Only the fixed command and validated tokens may reach it.
+  if (args.some(arg => !/^[\w.@:/-]+$/.test(arg))) throw new Error('不支持的 npm 参数')
+  return (await exec('cmd.exe', ['/d', '/c', 'npm', ...args], options)).stdout.trim()
+}
+
+export async function runInstall(args, {
+  home = homedir(), npm = runNpm, input = process.stdin, output = process.stdout,
+  log = console.log, version = packageInfo.version, signal,
+} = {}) {
+  const opts = parseInstall(args)
+  if (opts.help) { log(help); return }
+  if (!/^\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(version)) throw new Error('安装入口要求明确的包版本')
+  const pkg = `${packageInfo.name}@${version}`
+  const all = await agentTargets(home)
+  let selected = all.filter(agent => opts.selected.includes(agent.id))
+  const detected = all.filter(agent => agent.detected)
+  const interactive = input.isTTY && output.isTTY
+  let rl
+  const ask = async prompt => {
+    rl ??= createInterface({ input, output })
+    return (await rl.question(prompt, { signal })).trim()
+  }
+  try {
+    if (!selected.length && opts.dryRun) {
+      log(JSON.stringify({ package: pkg, dry_run: true, detected: detected.map(({ id, target }) => ({ id, target })) }, null, 2))
+      return
+    }
+    if (!interactive && !opts.dryRun && !opts.yes) throw new Error('非交互安装需指定 --agent NAME --yes；可先运行 install --dry-run')
+    if (!selected.length) {
+      const choices = detected.length ? detected : all
+      log(detected.length ? '检测到以下 Agent：' : '未检测到 Agent，可手动选择已安装的宿主：')
+      choices.forEach(({ label, target }, i) => log(`  ${i + 1}. ${label}  ${target}`))
+      if (detected.length && detected.length < all.length) log('其他宿主可通过 --agent 明确指定。')
+      const answer = await ask('输入一个或多个序号（空格或逗号分隔，回车取消）：')
+      if (!answer) { log('已取消，未安装。'); return }
+      const indexes = [...new Set(answer.split(/[\s,，]+/))]
+      if (indexes.some(i => !/^[1-9]\d*$/.test(i) || Number(i) > choices.length)) throw new Error('Agent 序号无效')
+      selected = indexes.map(i => choices[Number(i) - 1])
+    }
+    const states = await Promise.all(selected.map(inspect))
+    const blocked = selected.filter((_, i) => states[i].kind === 'protected')
+    log(JSON.stringify({ package: pkg, dry_run: opts.dryRun, skills: selected.map(({ id, target }, i) => ({ id, target, state: states[i].kind })) }, null, 2))
+    if (opts.dryRun) return
+    if (blocked.length) throw new Error(`已有手动安装或改动过的 Skill：${blocked.map(x => x.target).join('；')}。未安装；请先备份至扫描目录之外，或只选择其它 Agent。`)
+    if (!opts.yes && !/^(?:y|yes)$/i.test(await ask('安装或更新以上 CLI 和 Skill？[y/N] '))) { log('已取消，未安装。'); return }
+
+    signal?.throwIfAborted()
+    const root = await npm(['root', '--global'], signal)
+    if (!path.isAbsolute(root)) throw new Error('无法定位 npm 全局目录')
+    const directory = path.join(root, ...packageInfo.name.split('/'))
+    const metadata = async () => {
+      try { return JSON.parse(await fs.readFile(path.join(directory, 'package.json'), 'utf8')) } catch (error) {
+        if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error
+      }
+    }
+    let installed = await metadata()
+    if (installed?.name !== packageInfo.name || installed?.version !== version) {
+      await npm(['install', '--global', pkg, '--registry=' + registry, '--ignore-scripts', '--no-audit', '--no-fund'], signal)
+      installed = await metadata()
+    }
+    if (installed?.name !== packageInfo.name || installed?.version !== version || installed?.bin?.['uzoo-anime'] !== 'src/cli.js') {
+      throw new Error('全局 CLI 包身份、版本或入口验证失败，未写入 Skill')
+    }
+    const entry = path.join(directory, 'src', 'cli.js')
+    const prefix = await npm(['prefix', '--global'], signal)
+    if (!path.isAbsolute(prefix)) throw new Error('无法定位 npm 全局命令目录，未写入 Skill')
+    const bin = process.platform === 'win32' ? path.join(prefix, 'uzoo-anime.cmd') : path.join(prefix, 'bin', 'uzoo-anime')
+    const result = await exec(process.execPath, [entry, '--version'], { timeout: 15_000, windowsHide: true, signal })
+    if (!await stat(bin) || result.stdout.trim() !== version) throw new Error('全局 CLI 命令或版本验证失败，未写入 Skill')
+    const source = path.join(directory, bundle)
+    const digest = await verifyBundle(source)
+    for (let i = 0; i < selected.length; i++) {
+      signal?.throwIfAborted()
+      const status = await installSkill(selected[i], source, digest, version, states[i])
+      log(`${selected[i].label}: ${status} — ${selected[i].target}`)
+    }
+    log(`CLI ${version}: ${bin}`)
+    log('请在目标 Agent 的新会话验证 uzoo-anime --version；若命令不可见，请检查 npm 全局命令目录是否在其 PATH。')
+  } finally { rl?.close() }
+}

package/src/local-output.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+// A failed download/write never occupies the requested filename. Linking in the
+// same directory publishes a complete file without replacing an existing file.
+export async function exclusiveOutput(output, write) {
+  const target = path.resolve(output)
+  const temporary = path.join(path.dirname(target), '.' + crypto.randomUUID() + '.part')
+  try {
+    try {
+      await fs.lstat(target)
+      throw Object.assign(new Error('目标文件已存在；请指定新文件，不覆盖'), { code: 'EEXIST' })
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error
+    }
+    const result = await write(temporary)
+    await fs.link(temporary, target)
+    return { output: target, ...result }
+  } finally {
+    await fs.rm(temporary, { force: true })
+  }
+}