@viyzhu/boss-cli-fork 0.7.2-rc.1 → 0.7.3

package/skills/boss-frontend-analysis/SKILL.md

@@ -1,58 +1,58 @@
----
-name: boss-frontend-analysis
-description: Capture, archive, diff, and assess Boss/Zhipin frontend JavaScript for boss-cli safety gates and anti-debug guard updates. Use when Codex needs to re-analyze current Boss frontend scripts, compare online JS with docs/research/boss-online-js baselines, update boss_availability, or recommend code changes after Boss changes zhipin-boss, zhipin-sign, risk-detection, remoteEntry, or security scripts.
----
-
-# Boss Frontend Analysis
-
-Use this skill when Boss online frontend assets changed and boss-cli must decide whether to stay disabled, update the verified baseline, or change page guards.
-
-## Workflow
-
-1. Run the capture script from the repository root:
-
-```bash
-node skills/boss-frontend-analysis/scripts/capture_boss_frontend.mjs
-```
-
-2. Read the generated files under `docs/research/boss-online-js/<date>/`:
-
-- `manifest.json`: captured URLs, final URLs, byte sizes, SHA-256 hashes, and source category.
-- `analysis.md`: version changes, high-risk script notes, and code-change recommendations.
-- `raw/`: unmodified script bodies for diffing.
-
-3. Compare against the previous verified baseline, usually the latest dated folder under `docs/research/boss-online-js/`.
-
-4. Inspect these repo files before recommending or changing code:
-
-- `src/common/boss_availability.ts`
-- `src/common/boss_page_guards.ts`
-- `docs/anti-detection.md`
-- `docs/browser-session.md`
-
-5. Keep the policy strict:
-
-- Do not add fallback or bypass switches for availability checks.
-- If online entry pages reference unverified Boss JS versions, boss-cli must remain disabled.
-- Only update `boss_availability.ts` after raw scripts are archived and the risk strategy has been reviewed.
-- Puppeteer `page.evaluate` / `page.waitForFunction` additions must use string scripts, not callback functions.
-
-## Analysis Checklist
-
-- Chat entry page: identify current `zhipin-boss/index/v*/static/js/app.js`, `polyfill.js`, and `risk-detection.js`.
-- Remote bundle: identify current `zhipin-boss/bundle/v*/static/remoteEntry.js` and downloaded chunks.
-- Sign/login page: identify `zhipin-sign/v*/static/js/app.*.js`, `iframe-core.*.js`, and `vendors~app.*.js`.
-- Security scripts: note `zhipin-security`, `browser-check`, Warlock, APM, MQTT, and reporting SDK version changes.
-- Risk detector: search for codes such as `99001`, `99002`, `99004`, `99005`, `srcdoc`, `MutationObserver`, `isTrusted`, `sendAction`, and security redirects.
-- Sign vendor anti-debug: search for `debugger`, `Function(`, `constructor`, `setInterval`, `console`, `devtools`, and obfuscated modules around those hits.
-- Guard coverage: verify request-blocking patterns in `boss_page_guards.ts` still cover risk scripts and security redirects.
-
-## Output Guidance
-
-When reporting results, include:
-
-- Current online versions and whether they match the verified baseline.
-- Whether boss-cli should remain disabled.
-- Exact files or constants that need updates.
-- Any selectors, request patterns, or script guards that changed.
-- Build and runtime checks performed.
+---
+name: boss-frontend-analysis
+description: Capture, archive, diff, and assess Boss/Zhipin frontend JavaScript for boss-cli safety gates and anti-debug guard updates. Use when Codex needs to re-analyze current Boss frontend scripts, compare online JS with docs/research/boss-online-js baselines, update boss_availability, or recommend code changes after Boss changes zhipin-boss, zhipin-sign, risk-detection, remoteEntry, or security scripts.
+---
+
+# Boss Frontend Analysis
+
+Use this skill when Boss online frontend assets changed and boss-cli must decide whether to stay disabled, update the verified baseline, or change page guards.
+
+## Workflow
+
+1. Run the capture script from the repository root:
+
+```bash
+node skills/boss-frontend-analysis/scripts/capture_boss_frontend.mjs
+```
+
+2. Read the generated files under `docs/research/boss-online-js/<date>/`:
+
+- `manifest.json`: captured URLs, final URLs, byte sizes, SHA-256 hashes, and source category.
+- `analysis.md`: version changes, high-risk script notes, and code-change recommendations.
+- `raw/`: unmodified script bodies for diffing.
+
+3. Compare against the previous verified baseline, usually the latest dated folder under `docs/research/boss-online-js/`.
+
+4. Inspect these repo files before recommending or changing code:
+
+- `src/common/boss_availability.ts`
+- `src/common/boss_page_guards.ts`
+- `docs/anti-detection.md`
+- `docs/browser-session.md`
+
+5. Keep the policy strict:
+
+- Do not add fallback or bypass switches for availability checks.
+- If online entry pages reference unverified Boss JS versions, boss-cli must remain disabled.
+- Only update `boss_availability.ts` after raw scripts are archived and the risk strategy has been reviewed.
+- Puppeteer `page.evaluate` / `page.waitForFunction` additions must use string scripts, not callback functions.
+
+## Analysis Checklist
+
+- Chat entry page: identify current `zhipin-boss/index/v*/static/js/app.js`, `polyfill.js`, and `risk-detection.js`.
+- Remote bundle: identify current `zhipin-boss/bundle/v*/static/remoteEntry.js` and downloaded chunks.
+- Sign/login page: identify `zhipin-sign/v*/static/js/app.*.js`, `iframe-core.*.js`, and `vendors~app.*.js`.
+- Security scripts: note `zhipin-security`, `browser-check`, Warlock, APM, MQTT, and reporting SDK version changes.
+- Risk detector: search for codes such as `99001`, `99002`, `99004`, `99005`, `srcdoc`, `MutationObserver`, `isTrusted`, `sendAction`, and security redirects.
+- Sign vendor anti-debug: search for `debugger`, `Function(`, `constructor`, `setInterval`, `console`, `devtools`, and obfuscated modules around those hits.
+- Guard coverage: verify request-blocking patterns in `boss_page_guards.ts` still cover risk scripts and security redirects.
+
+## Output Guidance
+
+When reporting results, include:
+
+- Current online versions and whether they match the verified baseline.
+- Whether boss-cli should remain disabled.
+- Exact files or constants that need updates.
+- Any selectors, request patterns, or script guards that changed.
+- Build and runtime checks performed.

package/skills/boss-frontend-analysis/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Boss Frontend Analysis"
-  short_description: "Capture and diff Boss frontend JS"
-  default_prompt: "Use $boss-frontend-analysis to capture current Boss frontend scripts, compare them with the verified baseline, and recommend boss-cli code changes."
+interface:
+  display_name: "Boss Frontend Analysis"
+  short_description: "Capture and diff Boss frontend JS"
+  default_prompt: "Use $boss-frontend-analysis to capture current Boss frontend scripts, compare them with the verified baseline, and recommend boss-cli code changes."