@xiaohhhh1/canvas-agent 0.3.0 → 0.4.1

package/README.md

@@ -1,6 +1,6 @@
 # Infinite Canvas Agent
 
-本地 Canvas Agent 用来连接画布网页和用户电脑上的 Codex / Claude Code。本地开发时优先连接 `http://localhost:3000`，不需要先使用线上站点。
+本地 Canvas Agent 用来连接网站和用户自己电脑上的 Codex。它还负责持久化 Flow C 脚本队列、分段调用本机 Codex、自动回传草案，以及在网页关闭后继续把完成视频校验并保存到用户选择的磁盘目录。
 
 ## 启动
 
@@ -11,7 +11,7 @@ npx -y @xiaohhhh1/canvas-agent
 需要排查连接、线程、Codex app-server 或工具调用问题时，可开启 Debug 模式：
 
 ```bash
-npx -y @basketikun/canvas-agent --debug
+npx -y @xiaohhhh1/canvas-agent --debug
 ```
 
 Debug 日志会以 `[DEBUG][HH:mm:ss]` 等传统格式输出到终端，并按启动日期保存到 `~/.infinite-canvas/logs/canvas-agent-YYYY-MM-DD.log`。终端日志带级别颜色，文件日志为纯文本；日志包含 HTTP、SSE、线程、turn、Codex app-server 和工具调用事件，token 与图片 Data URL 会自动隐藏。
@@ -74,13 +74,22 @@ codex plugin marketplace add "$(pwd)"
 codex plugin add infinite-canvas@infinite-canvas-local
 ```
 
-插件默认通过 npm 启动 MCP；这个命令只提供 MCP 工具，不会把 MCP 写入全局配置，也不会在退出时自动卸载：
+插件默认通过 npm 启动 MCP。MCP 启动时会自动检查并拉起常驻本机 HTTP/中继服务，因此客户安装插件后不需要另开终端：
 
 ```bash
 npx -y @xiaohhhh1/canvas-agent mcp
 ```
 
-使用时可以直接在 Codex 里说“打开 Infinite Canvas”，插件会启动本地 Agent，读取 Local URL 和 Connect token，然后在右侧打开 `https://canvas.best/` 并自动新建、连接画布；只有明确要求使用本地项目时才会启动本地前端。
+使用时可以直接打开 `https://canvas.xiaohhhh1.com/workflow-batches`。网站通过已认证的 Agent Relay 与本机助手通信，不把本机目录、Codex 登录信息或短期任务令牌显示给客户。
+
+## Flow C 本机后台工作流
+
+1. 客户在网站添加一个或多个产品，按顺序上传每个产品 1–5 张图片并填写数量。
+2. 点击“交给本机 Codex 写全部脚本”。本机助手每次只处理 10 条并持久化进度，断网或重启后可继续；脚本完成会自动回传网站，不创建付费任务。
+3. 客户审阅脚本并确认费用后，中心 `workflow-runner` 才执行故事板和视频生成。
+4. 客户只需首次选择一个本机目录。Agent 每 10 秒检查交付，先写 `.part`，校验大小与 SHA-256 后原子改名；清单已记录的批次序号不会重复下载，网页关闭后仍会继续。
+
+本机持久状态默认保存在 `~/.infinite-canvas/workflow-state.json`，权限设为仅当前用户可读写。这里包含短期能力令牌和本机路径，不应上传、提交到 Git 或发到聊天中。
 
 Canvas Agent 启动后，给 Codex 添加 MCP：
 

package/agent-instructions.md

@@ -14,6 +14,11 @@
 
 ## 流程 C：脚本分镜到视频
 
+- 用户要求打开带货任务时，调用 `open_flow_c_website`，不要输出或询问 Local URL、连接令牌。
+- 网站把脚本任务交给本机 Codex 后，使用 `flow_c_get_script_task` 读取完整、服务器持久化的任务，再用 `flow_c_submit_script_chunk` 每次回传 1–25 条。不要要求用户复制 JSON、选择交接文件或把短期令牌发到聊天中。
+- 大批量脚本按本机助手指定的序号分段创作；批量大小不能成为降低质量、缩短脚本或套用模板的理由。每条都必须独立构思、符合目标市场自然语言习惯、保持紧凑但清晰可说完的 10 秒节奏。
+- 写脚本和回传草案不创建付费任务。只有客户在网站审阅并确认费用后，中心服务才可开始故事板和视频生成。
+
 - 用户明确选择流程 C 时，必须新建独立画布、清单和归档目录，不得混用流程 A 或 B 的资产。
 - 先使用原始同 SKU 商品图和完整脚本生成 9:16、10 秒导演分镜板；每镜必须包含时长、画面/镜头、对应配音、音效/BGM 节奏和情绪，并附专业技术规格栏。
 - 原始商品图是唯一商品标准：每一格都必须保持颜色、外形、文字或 Logo、比例、部件和数量一致。分镜通过逐格检查前，严禁提交视频任务。

package/dist/index.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import { startHttpServer } from "./server/http.js";
+import { ensureHttpServer } from "./server/ensure-http.js";
 import { startMcpServer } from "./server/mcp.js";
-if (process.argv[2] === "mcp")
+if (process.argv[2] === "mcp") {
+    await ensureHttpServer();
     await startMcpServer();
+}
 else
     startHttpServer();

package/dist/server/ensure-http.d.ts

@@ -0,0 +1,2 @@
+/** 插件 MCP 启动时确保本机 HTTP/后台队列服务常驻，无需客户另开终端。 */
+export declare function ensureHttpServer(): Promise<void>;

package/dist/server/ensure-http.js

@@ -0,0 +1,28 @@
+import { spawn } from "node:child_process";
+import { loadConfig } from "../config.js";
+/** 插件 MCP 启动时确保本机 HTTP/后台队列服务常驻，无需客户另开终端。 */
+export async function ensureHttpServer() {
+    const config = loadConfig(true);
+    if (await healthy(config.url))
+        return;
+    const entry = process.argv[1];
+    if (!entry)
+        throw new Error("无法定位 Canvas Agent 启动文件");
+    const child = spawn(process.execPath, [entry, "serve"], { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+    for (let attempt = 0; attempt < 40; attempt += 1) {
+        await new Promise((resolve) => setTimeout(resolve, 250));
+        if (await healthy(config.url))
+            return;
+    }
+    throw new Error("本机 Canvas Agent 后台服务启动失败");
+}
+async function healthy(url) {
+    try {
+        const response = await fetch(new URL("/health", url), { signal: AbortSignal.timeout(800) });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/server/http.js

@@ -8,6 +8,8 @@ import { CanvasSession } from "../canvas/session.js";
 import { DEFAULT_PORT, ensureSiteWorkspace, loadConfig, saveConfig, updateSiteWorkspace } from "../config.js";
 import { startRelayBridge } from "../relay-bridge.js";
 import { logger } from "../utils/logger.js";
+import { windowsRootExecutable, windowsSystemExecutable } from "../utils/windows.js";
+import { WorkflowManager } from "../workflow/manager.js";
 /** 启动仅监听本机的 Canvas Agent HTTP 服务。 */
 export function startHttpServer() {
     const config = loadConfig(true);
@@ -27,6 +29,7 @@ export function startHttpServer() {
         session.emitThread("workspace_changed", activeThreadId, { ...payload, activeThreadId });
         return workspace;
     };
+    const workflows = new WorkflowManager(config, emit);
     const app = express();
     app.disable("x-powered-by");
     app.use(express.json({ limit: "30mb" }));
@@ -97,6 +100,24 @@ export function startHttpServer() {
         res.type(path.extname(filePath)).send(await readFile(filePath));
     }));
     app.post("/api/tools", route(async (req, res) => res.json({ ok: true, result: await session.callTool(req.body?.name, req.body?.input || {}) })));
+    app.post("/agent/workflow/script-handoffs", route(async (req, res) => res.json({ ok: true, handoff: workflows.enqueueScript(req.body || {}) })));
+    app.get("/agent/workflow/script-handoffs/:handoffId", route(async (req, res) => res.json({ ok: true, handoff: workflows.scriptStatus(routeParam(req.params.handoffId)) })));
+    app.post("/agent/workflow/script-handoffs/:handoffId/retry", route(async (req, res) => res.json({ ok: true, handoff: workflows.retryScript(routeParam(req.params.handoffId)) })));
+    app.get("/agent/workflow/script-handoffs/:handoffId/task", route(async (req, res) => res.json({ ok: true, handoff: await workflows.scriptTask(routeParam(req.params.handoffId)) })));
+    app.post("/agent/workflow/script-handoffs/:handoffId/draft-chunks", route(async (req, res) => res.json({ ok: true, result: await workflows.submitScriptChunk(routeParam(req.params.handoffId), req.body?.jobs) })));
+    app.get("/agent/workflow/downloads", (_req, res) => res.json({ ok: true, ...workflows.downloadState() }));
+    app.post("/agent/workflow/downloads/select-directory", (_req, res) => res.json({ ok: true, selection: workflows.startDownloadDirectorySelection() }));
+    app.get("/agent/workflow/downloads/select-directory/:selectionId", route(async (req, res) => res.json({ ok: true, selection: workflows.downloadDirectorySelection(routeParam(req.params.selectionId)), ...workflows.downloadState() })));
+    app.post("/agent/workflow/downloads/clear-directory", (_req, res) => res.json({ ok: true, ...workflows.clearDownloadDirectory() }));
+    app.post("/agent/workflow/downloads/subscriptions", route(async (req, res) => res.json({ ok: true, subscription: workflows.subscribeDownload(req.body || {}) })));
+    app.post("/agent/workflow/downloads/:batchId/sync", route(async (req, res) => res.json({ ok: true, subscription: await workflows.syncDownload(routeParam(req.params.batchId)) })));
+    app.post("/agent/workflow/open", route(async (_req, res) => {
+        const url = new URL("https://canvas.xiaohhhh1.com/workflow-batches");
+        url.searchParams.set("agentUrl", config.url);
+        url.searchParams.set("agentToken", config.token);
+        await openExternalUrl(url.toString());
+        res.json({ ok: true });
+    }));
     app.get("/agent/codex/workspace", (_req, res) => {
         const workspace = ensureSiteWorkspace(config);
         res.json({ ok: true, workspace });
@@ -264,7 +285,7 @@ function permissionMode(value) {
 }
 /** 使用当前操作系统的文件管理器定位本地文件。 */
 function revealLocalFile(filePath, isDirectory) {
-    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? windowsRootExecutable("explorer.exe") : "xdg-open";
     const args = process.platform === "darwin"
         ? ["-R", filePath]
         : process.platform === "win32"
@@ -279,6 +300,16 @@ function revealLocalFile(filePath, isDirectory) {
         child.once("error", reject);
     });
 }
+/** 在默认浏览器打开本机已经配对的网站；URL 内的连接参数会被网页立即移除。 */
+function openExternalUrl(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? windowsSystemExecutable("rundll32.exe") : "xdg-open";
+    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+        child.once("spawn", () => { child.unref(); resolve(); });
+        child.once("error", reject);
+    });
+}
 /** 结合服务配置解析当前请求 URL。 */
 function requestUrl(req, config) {
     return new URL(req.originalUrl || req.url || "/", config.url);

package/dist/server/mcp.js

@@ -1,5 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
 import { toolDescriptions, toolInputSchemas, toolNames } from "../canvas/schemas.js";
 import { AGENT_PROMPT, loadConfig, VERSION } from "../config.js";
 /** 启动通过标准输入输出通信的 MCP 服务。 */
@@ -7,8 +8,36 @@ export async function startMcpServer() {
     const config = loadConfig(true);
     const server = new McpServer({ name: "canvas-agent", version: VERSION }, { instructions: AGENT_PROMPT });
     toolNames.forEach((name) => registerCanvasTool(server, config, name));
+    registerWorkflowTools(server, config);
     await server.connect(new StdioServerTransport());
 }
+/** 注册仅供本机 Codex 使用的 Flow C 交接工具，能力令牌始终留在本机 Agent。 */
+function registerWorkflowTools(server, config) {
+    server.registerTool("open_flow_c_website", {
+        description: "在客户默认浏览器打开并安全连接抖音小辉跨境工具的带货任务页。连接密钥留在本机，不会返回给模型或要求客户复制。",
+        inputSchema: {},
+    }, async () => workflowTool(config, "/agent/workflow/open", { method: "POST" }));
+    server.registerTool("flow_c_get_script_task", {
+        description: "读取一个已经由网站安全交给本机 Agent 的 Flow C 脚本任务。返回完整内容规范、产品清单、图片顺序和数量；不会返回任何令牌。",
+        inputSchema: { handoffId: z.string().uuid().describe("网站创建的脚本交接 ID") },
+    }, async ({ handoffId }) => workflowTool(config, `/agent/workflow/script-handoffs/${encodeURIComponent(handoffId)}/task`, { method: "GET" }));
+    server.registerTool("flow_c_submit_script_chunk", {
+        description: "把本段独立完成的 Flow C 高质量脚本持久化回传给网站。每次 1–25 条；成功后再创作下一段。",
+        inputSchema: {
+            handoffId: z.string().uuid().describe("脚本交接 ID"),
+            jobs: z.array(z.object({
+                ordinal: z.number().int().positive(),
+                productIndex: z.number().int().nonnegative(),
+                sellingFormId: z.string().min(1).max(100),
+                script: z.string().min(40).max(20_000),
+            })).min(1).max(25),
+        },
+    }, async ({ handoffId, jobs }) => workflowTool(config, `/agent/workflow/script-handoffs/${encodeURIComponent(handoffId)}/draft-chunks`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ jobs }) }));
+}
+async function workflowTool(config, route, init) {
+    const result = await fetchCanvasAgent(config, route, init);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+}
 /** 向 MCP Server 注册单个 Canvas Agent 工具。 */
 function registerCanvasTool(server, config, name) {
     const schema = toolInputSchemas[name];
@@ -19,9 +48,14 @@ function registerCanvasTool(server, config, name) {
 }
 /** 将 MCP 工具调用转发到本地 Canvas Agent HTTP 服务。 */
 async function postCanvasAgentTool(config, name, input) {
-    const res = await fetch(`${config.url}/api/tools`, { method: "POST", headers: { "content-type": "application/json", "x-canvas-agent-token": config.token }, body: JSON.stringify({ name, input }) });
+    return await fetchCanvasAgent(config, "/api/tools", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ name, input }) });
+}
+async function fetchCanvasAgent(config, route, init) {
+    const headers = new Headers(init.headers);
+    headers.set("x-canvas-agent-token", config.token);
+    const res = await fetch(`${config.url}${route}`, { ...init, headers });
     const body = (await res.json());
     if (!body.ok)
         throw new Error(body.error || "tool call failed");
-    return body.result;
+    return body.result ?? body;
 }

package/dist/utils/windows.d.ts

@@ -0,0 +1,5 @@
+type WindowsEnvironment = NodeJS.ProcessEnv;
+export declare function windowsRootExecutable(name: string, env?: WindowsEnvironment): string;
+export declare function windowsSystemExecutable(name: string, env?: WindowsEnvironment): string;
+export declare function windowsPowerShellExecutable(env?: WindowsEnvironment): string;
+export {};

package/dist/utils/windows.js

@@ -0,0 +1,14 @@
+import path from "node:path";
+/** Resolve Windows inbox executables without relying on a possibly restricted PATH. */
+function windowsRoot(env = process.env) {
+    return env.SystemRoot || env.SYSTEMROOT || env.WINDIR || "C:\\Windows";
+}
+export function windowsRootExecutable(name, env = process.env) {
+    return path.win32.join(windowsRoot(env), name);
+}
+export function windowsSystemExecutable(name, env = process.env) {
+    return path.win32.join(windowsRoot(env), "System32", name);
+}
+export function windowsPowerShellExecutable(env = process.env) {
+    return path.win32.join(windowsRoot(env), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}

package/dist/workflow/manager.d.ts

@@ -0,0 +1,160 @@
+import type { AgentEmit } from "../agent/types.js";
+import { type CanvasAgentConfig } from "../config.js";
+type ScriptStatus = "queued" | "running" | "complete" | "error" | "expired";
+type DownloadStatus = "waiting" | "running" | "complete" | "error" | "expired";
+type ScriptTask = {
+    id: string;
+    workflow: "flow-c";
+    market: string;
+    requested_count: number;
+    product_quantities: number[];
+    instructions: string;
+    expires_at: string;
+};
+/** 本机持久化的 Flow C 控制器：脚本交给本机 Codex，视频直接落盘。 */
+export declare class WorkflowManager {
+    private config;
+    private emit;
+    private state;
+    private runningScripts;
+    private scriptQueueRunning;
+    private syncingDownloads;
+    private directorySelection?;
+    private downloadTimer?;
+    constructor(config: CanvasAgentConfig, emit: AgentEmit);
+    /** 接收网站创建的短期交接能力并立即启动本机 Codex。 */
+    enqueueScript(input: {
+        id?: unknown;
+        apiBase?: unknown;
+        accessToken?: unknown;
+        expiresAt?: unknown;
+    }): {
+        id: string;
+        status: ScriptStatus;
+        requestedCount: number;
+        received: number;
+        threadId: string | undefined;
+        message: string | undefined;
+        expiresAt: string | undefined;
+        updatedAt: string;
+    };
+    retryScript(idValue: unknown): {
+        id: string;
+        status: ScriptStatus;
+        requestedCount: number;
+        received: number;
+        threadId: string | undefined;
+        message: string | undefined;
+        expiresAt: string | undefined;
+        updatedAt: string;
+    };
+    scriptStatus(idValue: unknown): {
+        id: string;
+        status: ScriptStatus;
+        requestedCount: number;
+        received: number;
+        threadId: string | undefined;
+        message: string | undefined;
+        expiresAt: string | undefined;
+        updatedAt: string;
+    };
+    /** MCP 读取服务端持久化的完整任务，不向模型暴露令牌。 */
+    scriptTask(idValue: unknown): Promise<ScriptTask>;
+    /** MCP 分段回传脚本，中心接口再次执行数量、产品索引和脚本完整性校验。 */
+    submitScriptChunk(idValue: unknown, jobsValue: unknown): Promise<{
+        accepted: number;
+        received: number;
+        requestedCount: number;
+        status: string;
+    } & {
+        error?: string;
+    }>;
+    downloadState(): {
+        configured: boolean;
+        directoryName: string | undefined;
+        subscriptions: {
+            batchId: string;
+            status: DownloadStatus;
+            downloaded: number;
+            market: string | undefined;
+            message: string | undefined;
+            expiresAt: string | undefined;
+            updatedAt: string;
+        }[];
+    };
+    startDownloadDirectorySelection(): {
+        id: string;
+        status: "selecting" | "selected" | "cancelled" | "error";
+        directoryName?: string;
+        error?: string;
+    } | {
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        status: "selecting";
+    };
+    downloadDirectorySelection(idValue: unknown): {
+        id: string;
+        status: "selecting" | "selected" | "cancelled" | "error";
+        directoryName?: string;
+        error?: string;
+    };
+    clearDownloadDirectory(): {
+        configured: boolean;
+        directoryName: string | undefined;
+        subscriptions: {
+            batchId: string;
+            status: DownloadStatus;
+            downloaded: number;
+            market: string | undefined;
+            message: string | undefined;
+            expiresAt: string | undefined;
+            updatedAt: string;
+        }[];
+    };
+    subscribeDownload(input: {
+        batchId?: unknown;
+        apiBase?: unknown;
+        accessToken?: unknown;
+        expiresAt?: unknown;
+    }): {
+        batchId: string;
+        status: DownloadStatus;
+        downloaded: number;
+        market: string | undefined;
+        message: string | undefined;
+        expiresAt: string | undefined;
+        updatedAt: string;
+    };
+    syncDownload(batchIdValue?: unknown): Promise<{
+        batchId: string;
+        status: DownloadStatus;
+        downloaded: number;
+        market: string | undefined;
+        message: string | undefined;
+        expiresAt: string | undefined;
+        updatedAt: string;
+    } | {
+        configured: boolean;
+        directoryName: string | undefined;
+        subscriptions: {
+            batchId: string;
+            status: DownloadStatus;
+            downloaded: number;
+            market: string | undefined;
+            message: string | undefined;
+            expiresAt: string | undefined;
+            updatedAt: string;
+        }[];
+    }>;
+    private scheduleScript;
+    /** 同一台电脑串行处理脚本交接，避免多个大批次争用一个 Codex app-server。 */
+    private pumpScriptQueue;
+    private finishDownloadDirectorySelection;
+    private runScript;
+    private syncDownloads;
+    private syncDownloadRecord;
+    private saveDelivery;
+    private scriptRecord;
+    private downloadRecord;
+    private save;
+}
+export {};

package/dist/workflow/manager.js

@@ -0,0 +1,462 @@
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import { mkdir, open, rename, stat, unlink } from "node:fs/promises";
+import path from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { runCodexTurn, startCodexThread } from "../agent/codex.js";
+import { CONFIG_DIR, ensureSiteWorkspace } from "../config.js";
+import { logger } from "../utils/logger.js";
+import { windowsPowerShellExecutable } from "../utils/windows.js";
+const STATE_FILE = path.join(CONFIG_DIR, "workflow-state.json");
+const SCRIPT_CHUNK_SIZE = 10;
+const DOWNLOAD_POLL_MS = 10_000;
+/** 本机持久化的 Flow C 控制器：脚本交给本机 Codex，视频直接落盘。 */
+export class WorkflowManager {
+    config;
+    emit;
+    state = loadState();
+    runningScripts = new Set();
+    scriptQueueRunning = false;
+    syncingDownloads = false;
+    directorySelection;
+    downloadTimer;
+    constructor(config, emit) {
+        this.config = config;
+        this.emit = emit;
+        for (const record of Object.values(this.state.scripts)) {
+            if (record.status === "queued" || record.status === "running")
+                this.scheduleScript(record.id);
+        }
+        this.downloadTimer = setInterval(() => void this.syncDownloads(), DOWNLOAD_POLL_MS);
+        this.downloadTimer.unref?.();
+        void this.syncDownloads();
+    }
+    /** 接收网站创建的短期交接能力并立即启动本机 Codex。 */
+    enqueueScript(input) {
+        const id = workflowId(input.id, "脚本交接 ID");
+        const apiBase = commerceApiBase(input.apiBase);
+        const accessToken = secret(input.accessToken, "脚本交接令牌");
+        const previous = this.state.scripts[id];
+        this.state.scripts[id] = {
+            id,
+            apiBase,
+            accessToken,
+            status: previous?.status === "complete" ? "complete" : "queued",
+            requestedCount: previous?.requestedCount || 0,
+            receivedOrdinals: previous?.receivedOrdinals || [],
+            threadId: previous?.threadId,
+            expiresAt: String(input.expiresAt || previous?.expiresAt || "") || undefined,
+            attempts: previous?.attempts || 0,
+            message: previous?.status === "complete" ? previous.message : "已进入本机 Codex 队列",
+            updatedAt: now(),
+        };
+        this.save();
+        this.scheduleScript(id);
+        return this.scriptStatus(id);
+    }
+    retryScript(idValue) {
+        const id = workflowId(idValue, "脚本交接 ID");
+        const record = this.scriptRecord(id);
+        record.status = "queued";
+        record.message = "正在重新连接本机 Codex";
+        record.updatedAt = now();
+        this.save();
+        this.scheduleScript(id);
+        return this.scriptStatus(id);
+    }
+    scriptStatus(idValue) {
+        const record = this.scriptRecord(workflowId(idValue, "脚本交接 ID"));
+        return publicScript(record);
+    }
+    /** MCP 读取服务端持久化的完整任务，不向模型暴露令牌。 */
+    async scriptTask(idValue) {
+        const record = this.scriptRecord(workflowId(idValue, "脚本交接 ID"));
+        const data = await commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/task`, record.accessToken, "x-workflow-handoff-token");
+        const task = data.handoff;
+        record.requestedCount = Number(task.requested_count || 0);
+        record.expiresAt = task.expires_at;
+        record.updatedAt = now();
+        this.save();
+        return task;
+    }
+    /** MCP 分段回传脚本，中心接口再次执行数量、产品索引和脚本完整性校验。 */
+    async submitScriptChunk(idValue, jobsValue) {
+        const record = this.scriptRecord(workflowId(idValue, "脚本交接 ID"));
+        if (!Array.isArray(jobsValue) || !jobsValue.length || jobsValue.length > 25)
+            throw new Error("每段必须包含 1–25 条脚本");
+        const jobs = jobsValue;
+        const data = await commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/draft-chunks`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ jobs }) });
+        const accepted = new Set(record.receivedOrdinals);
+        for (const job of jobs)
+            if (Number.isInteger(Number(job?.ordinal)))
+                accepted.add(Number(job.ordinal));
+        record.receivedOrdinals = [...accepted].sort((a, b) => a - b);
+        record.requestedCount = Number(data.requestedCount || record.requestedCount);
+        record.status = data.status === "ready" ? "complete" : "running";
+        record.message = data.status === "ready" ? `全部 ${record.requestedCount} 条高质量脚本已回传` : `已回传 ${data.received}/${data.requestedCount} 条脚本`;
+        record.updatedAt = now();
+        this.save();
+        return data;
+    }
+    downloadState() {
+        return {
+            configured: Boolean(this.state.downloadDirectory),
+            directoryName: this.state.downloadDirectory ? path.basename(this.state.downloadDirectory) : undefined,
+            subscriptions: Object.values(this.state.downloads).map(publicDownload),
+        };
+    }
+    startDownloadDirectorySelection() {
+        if (this.directorySelection?.status === "selecting")
+            return this.directorySelection;
+        const selection = { id: randomUUID(), status: "selecting" };
+        this.directorySelection = selection;
+        void this.finishDownloadDirectorySelection(selection.id);
+        return selection;
+    }
+    downloadDirectorySelection(idValue) {
+        const id = workflowId(idValue, "文件夹选择 ID");
+        if (!this.directorySelection || this.directorySelection.id !== id)
+            throw new Error("文件夹选择任务不存在");
+        return this.directorySelection;
+    }
+    clearDownloadDirectory() {
+        delete this.state.downloadDirectory;
+        this.save();
+        return this.downloadState();
+    }
+    subscribeDownload(input) {
+        const batchId = workflowId(input.batchId, "视频批次 ID");
+        const previous = this.state.downloads[batchId];
+        this.state.downloads[batchId] = {
+            batchId,
+            apiBase: commerceApiBase(input.apiBase),
+            accessToken: secret(input.accessToken, "下载能力令牌"),
+            status: previous?.status === "complete" ? "complete" : "waiting",
+            downloadedOrdinals: previous?.downloadedOrdinals || [],
+            market: previous?.market,
+            expiresAt: String(input.expiresAt || previous?.expiresAt || "") || undefined,
+            message: this.state.downloadDirectory ? "等待视频完成" : "请先选择本机保存文件夹",
+            updatedAt: now(),
+        };
+        this.save();
+        void this.syncDownloads();
+        return publicDownload(this.state.downloads[batchId]);
+    }
+    async syncDownload(batchIdValue) {
+        const batchId = batchIdValue ? workflowId(batchIdValue, "视频批次 ID") : undefined;
+        await this.syncDownloads(batchId);
+        return batchId ? publicDownload(this.downloadRecord(batchId)) : this.downloadState();
+    }
+    scheduleScript(_id) {
+        queueMicrotask(() => void this.pumpScriptQueue());
+    }
+    /** 同一台电脑串行处理脚本交接，避免多个大批次争用一个 Codex app-server。 */
+    async pumpScriptQueue() {
+        if (this.scriptQueueRunning)
+            return;
+        this.scriptQueueRunning = true;
+        try {
+            while (true) {
+                const next = Object.values(this.state.scripts)
+                    .filter((record) => (record.status === "queued" || record.status === "running") && !this.runningScripts.has(record.id))
+                    .sort((left, right) => left.updatedAt.localeCompare(right.updatedAt))[0];
+                if (!next)
+                    break;
+                await this.runScript(next.id);
+            }
+        }
+        finally {
+            this.scriptQueueRunning = false;
+        }
+    }
+    async finishDownloadDirectorySelection(id) {
+        try {
+            const selected = await selectNativeDirectory();
+            if (!selected) {
+                this.directorySelection = { id, status: "cancelled" };
+                return;
+            }
+            const resolved = path.resolve(selected);
+            await mkdir(resolved, { recursive: true });
+            const info = await stat(resolved);
+            if (!info.isDirectory())
+                throw new Error("选择的路径不是文件夹");
+            this.state.downloadDirectory = resolved;
+            this.save();
+            this.directorySelection = { id, status: "selected", directoryName: path.basename(resolved) };
+            void this.syncDownloads();
+        }
+        catch (error) {
+            this.directorySelection = { id, status: "error", error: error instanceof Error ? error.message : "无法选择本机文件夹" };
+        }
+    }
+    async runScript(id) {
+        if (this.runningScripts.has(id))
+            return;
+        this.runningScripts.add(id);
+        const record = this.scriptRecord(id);
+        try {
+            record.status = "running";
+            record.message = "正在读取完整产品清单";
+            record.updatedAt = now();
+            this.save();
+            const task = await this.scriptTask(id);
+            if (Date.parse(task.expires_at) <= Date.now())
+                throw new ExpiredCapabilityError("脚本交接已过期，请在网页重新点击交给本机 Codex");
+            const workspace = ensureSiteWorkspace(this.config);
+            if (!record.threadId) {
+                const thread = await startCodexThread(this.emit, workspace.workspacePath, "full");
+                record.threadId = String(thread.id || "");
+                this.save();
+            }
+            while (record.receivedOrdinals.length < task.requested_count) {
+                const missing = missingOrdinals(task.requested_count, record.receivedOrdinals).slice(0, SCRIPT_CHUNK_SIZE);
+                if (!missing.length)
+                    break;
+                let progressed = false;
+                for (let attempt = 1; attempt <= 3 && !progressed; attempt += 1) {
+                    const before = record.receivedOrdinals.length;
+                    record.attempts += 1;
+                    record.message = `本机 Codex 正在写第 ${missing[0]}–${missing.at(-1)} 条（总计 ${task.requested_count} 条）`;
+                    record.updatedAt = now();
+                    this.save();
+                    await runCodexTurn(scriptChunkPrompt(id, task, missing), this.emit, [], { threadId: record.threadId, cwd: workspace.workspacePath, permissionMode: "full", onThread: (threadId) => { record.threadId = threadId; this.save(); } });
+                    progressed = record.receivedOrdinals.length > before;
+                    if (!progressed && attempt < 3)
+                        record.message = `第 ${missing[0]}–${missing.at(-1)} 条未成功回传，正在自动重试 ${attempt + 1}/3`;
+                }
+                if (!progressed)
+                    throw new Error(`本机 Codex 连续 3 次未回传第 ${missing[0]}–${missing.at(-1)} 条，请点击重试`);
+            }
+            if (record.receivedOrdinals.length >= task.requested_count) {
+                record.status = "complete";
+                record.message = `全部 ${task.requested_count} 条高质量脚本已回传`;
+            }
+        }
+        catch (error) {
+            record.status = error instanceof ExpiredCapabilityError ? "expired" : "error";
+            record.message = error instanceof Error ? error.message : "本机 Codex 处理失败";
+            logger.warn("Local Flow C script handoff paused", { handoffId: id, error: record.message });
+        }
+        finally {
+            record.updatedAt = now();
+            this.save();
+            this.runningScripts.delete(id);
+        }
+    }
+    async syncDownloads(onlyBatchId) {
+        if (this.syncingDownloads || !this.state.downloadDirectory)
+            return;
+        this.syncingDownloads = true;
+        try {
+            const records = Object.values(this.state.downloads).filter((record) => !onlyBatchId || record.batchId === onlyBatchId);
+            for (const record of records)
+                await this.syncDownloadRecord(record);
+        }
+        finally {
+            this.syncingDownloads = false;
+            this.save();
+        }
+    }
+    async syncDownloadRecord(record) {
+        if (record.expiresAt && Date.parse(record.expiresAt) <= Date.now()) {
+            record.status = "expired";
+            record.message = "下载授权已过期；打开网站后会自动续期";
+            return;
+        }
+        try {
+            record.status = "running";
+            const data = await commerceJson(`${record.apiBase}/workflow-downloads/${encodeURIComponent(record.batchId)}`, record.accessToken, "x-workflow-download-token");
+            const batch = data.batch;
+            record.market = batch.market;
+            for (const delivery of batch.deliveries || []) {
+                await this.saveDelivery(batch, delivery);
+                if (!record.downloadedOrdinals.includes(delivery.ordinal))
+                    record.downloadedOrdinals.push(delivery.ordinal);
+            }
+            record.downloadedOrdinals.sort((a, b) => a - b);
+            const finished = ["completed", "cancelled", "failed"].includes(batch.status);
+            record.status = finished && record.downloadedOrdinals.length >= (batch.deliveries?.length || 0) ? "complete" : "waiting";
+            record.message = batch.deliveries?.length
+                ? `已自动保存 ${record.downloadedOrdinals.length} 条视频；${finished ? "本批次已结束" : "继续等待新视频"}`
+                : finished ? "批次已结束，暂无可下载视频" : "等待视频完成";
+        }
+        catch (error) {
+            record.status = /expired|not found/i.test(error instanceof Error ? error.message : "") ? "expired" : "error";
+            record.message = error instanceof Error ? error.message : "自动下载失败，稍后重试";
+            logger.warn("Local Flow C download sync failed", { batchId: record.batchId, error: record.message });
+        }
+        finally {
+            record.updatedAt = now();
+        }
+    }
+    async saveDelivery(batch, delivery) {
+        const key = `${batch.id}:${delivery.ordinal}`;
+        const manifest = this.state.manifest[key];
+        if (manifest && await isExistingFile(manifest.filePath, manifest.bytes, manifest.sha256))
+            return;
+        const source = safeDownloadUrl(delivery.archive);
+        const base = this.state.downloadDirectory;
+        if (!base)
+            return;
+        const folder = path.join(base, "抖音小辉跨境工具", `${safeName(batch.market)}-${batch.id.slice(0, 8)}`);
+        await mkdir(folder, { recursive: true });
+        const finalPath = path.join(folder, `flow-c-${batch.id.slice(0, 8)}-${String(delivery.ordinal).padStart(4, "0")}.mp4`);
+        if (await isExistingFile(finalPath, Number(delivery.bytes || 0), String(delivery.sha256 || ""))) {
+            const info = await stat(finalPath);
+            this.state.manifest[key] = { batchId: batch.id, ordinal: delivery.ordinal, filePath: finalPath, bytes: info.size, sha256: String(delivery.sha256 || ""), source, savedAt: now() };
+            return;
+        }
+        const partialPath = `${finalPath}.part`;
+        await unlink(partialPath).catch(() => undefined);
+        const response = await fetch(source, { signal: AbortSignal.timeout(10 * 60 * 1000) });
+        if (!response.ok || !response.body)
+            throw new Error(`第 ${delivery.ordinal} 条视频下载失败（HTTP ${response.status}）`);
+        const contentType = String(response.headers.get("content-type") || "").toLowerCase();
+        if (contentType && !contentType.startsWith("video/") && !contentType.includes("octet-stream"))
+            throw new Error(`第 ${delivery.ordinal} 条下载内容不是视频文件`);
+        const hash = createHash("sha256");
+        let bytes = 0;
+        const meter = new Transform({ transform(chunk, _encoding, callback) { const buffer = Buffer.from(chunk); bytes += buffer.length; hash.update(buffer); callback(null, buffer); } });
+        const handle = await open(partialPath, "wx", 0o600);
+        try {
+            await pipeline(Readable.fromWeb(response.body), meter, handle.createWriteStream());
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+        const digest = hash.digest("hex");
+        if (bytes < 1024) {
+            await unlink(partialPath).catch(() => undefined);
+            throw new Error(`第 ${delivery.ordinal} 条视频文件不完整`);
+        }
+        if (delivery.bytes && bytes !== Number(delivery.bytes)) {
+            await unlink(partialPath).catch(() => undefined);
+            throw new Error(`第 ${delivery.ordinal} 条视频字节数校验失败`);
+        }
+        if (delivery.sha256 && digest.toLowerCase() !== delivery.sha256.toLowerCase()) {
+            await unlink(partialPath).catch(() => undefined);
+            throw new Error(`第 ${delivery.ordinal} 条视频校验值不一致`);
+        }
+        await unlink(finalPath).catch(() => undefined);
+        await rename(partialPath, finalPath);
+        this.state.manifest[key] = { batchId: batch.id, ordinal: delivery.ordinal, filePath: finalPath, bytes, sha256: digest, source, savedAt: now() };
+        this.save();
+    }
+    scriptRecord(id) {
+        const record = this.state.scripts[id];
+        if (!record)
+            throw new Error("本机没有这条脚本交接记录，请从网站重新发送");
+        return record;
+    }
+    downloadRecord(id) {
+        const record = this.state.downloads[id];
+        if (!record)
+            throw new Error("本机没有这个下载批次");
+        return record;
+    }
+    save() { saveState(this.state); }
+}
+class ExpiredCapabilityError extends Error {
+}
+function scriptChunkPrompt(id, task, ordinals) {
+    return `你正在后台处理“抖音小辉跨境工具”Flow C 脚本交接 ${id}。
+必须使用 MCP 工具 flow_c_get_script_task 读取完整任务，再只创作 ordinal ${ordinals[0]} 到 ${ordinals.at(-1)}（精确列表：${ordinals.join(", ")}）。
+脚本质量绝不能因批量而降低：每条都必须独立构思、完整、真实合规，严格遵守任务 instructions、产品图片顺序和 productIndex；使用目标市场 ${task.market} 的自然本地语言与偏快但清晰的 10 秒节奏。
+写完后必须调用 flow_c_submit_script_chunk 一次回传这 ${ordinals.length} 条，handoffId=${id}。不要创建付费批次，不要调用供应商模型，不要在聊天输出大段 JSON。工具返回成功后仅简短结束。`;
+}
+function publicScript(record) {
+    return { id: record.id, status: record.status, requestedCount: record.requestedCount, received: record.receivedOrdinals.length, threadId: record.threadId, message: record.message, expiresAt: record.expiresAt, updatedAt: record.updatedAt };
+}
+function publicDownload(record) {
+    return { batchId: record.batchId, status: record.status, downloaded: record.downloadedOrdinals.length, market: record.market, message: record.message, expiresAt: record.expiresAt, updatedAt: record.updatedAt };
+}
+function missingOrdinals(total, received) { const set = new Set(received); return Array.from({ length: total }, (_, index) => index + 1).filter((ordinal) => !set.has(ordinal)); }
+function workflowId(value, label) { const id = String(value || "").trim(); if (!/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(id))
+    throw new Error(`${label}无效`); return id; }
+function secret(value, label) { const token = String(value || "").trim(); if (token.length < 32 || token.length > 512)
+    throw new Error(`${label}无效`); return token; }
+function commerceApiBase(value) {
+    const url = new URL(String(value || ""));
+    const local = ["127.0.0.1", "localhost"].includes(url.hostname);
+    if (url.protocol !== "https:" && !local)
+        throw new Error("中心接口必须使用 HTTPS");
+    if (!/\/api\/commerce\/?$/.test(url.pathname))
+        throw new Error("中心接口路径无效");
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/+$/, "");
+}
+function safeDownloadUrl(value) { const url = new URL(String(value || "")); if (url.protocol !== "https:")
+    throw new Error("下载地址必须使用 HTTPS"); return url.toString(); }
+function safeName(value) { return String(value || "市场").replace(/[<>:"/\\|?*\u0000-\u001f]/g, "-").replace(/[. ]+$/g, "").slice(0, 60) || "市场"; }
+function now() { return new Date().toISOString(); }
+async function commerceJson(url, token, tokenHeader, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("accept", "application/json");
+    headers.set(tokenHeader, token);
+    if (init.body)
+        headers.set("content-type", "application/json");
+    const response = await fetch(url, { ...init, headers, signal: AbortSignal.timeout(120_000) });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(body.error || `中心接口返回 ${response.status}`);
+    return body;
+}
+function loadState() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(STATE_FILE, "utf8"));
+        return { downloadDirectory: parsed.downloadDirectory, scripts: parsed.scripts || {}, downloads: parsed.downloads || {}, manifest: parsed.manifest || {} };
+    }
+    catch {
+        return { scripts: {}, downloads: {}, manifest: {} };
+    }
+}
+function saveState(state) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    const temporary = `${STATE_FILE}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, JSON.stringify(state, null, 2), { mode: 0o600 });
+    fs.renameSync(temporary, STATE_FILE);
+    try {
+        fs.chmodSync(STATE_FILE, 0o600);
+    }
+    catch { }
+}
+async function isExistingFile(filePath, expectedBytes, expectedSha256 = "") {
+    try {
+        const info = await stat(filePath);
+        if (!info.isFile() || info.size < 1024 || (expectedBytes && info.size !== expectedBytes))
+            return false;
+        if (!expectedSha256)
+            return true;
+        const hash = createHash("sha256");
+        for await (const chunk of fs.createReadStream(filePath))
+            hash.update(chunk);
+        return hash.digest("hex").toLowerCase() === expectedSha256.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+}
+function selectNativeDirectory() {
+    if (process.platform === "win32") {
+        const script = "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.Windows.Forms; $d=New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description='选择抖音小辉跨境工具的本机视频保存位置'; $d.ShowNewFolderButton=$true; if($d.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK){[Console]::OutputEncoding=[Text.Encoding]::UTF8; Write-Output $d.SelectedPath}";
+        return commandOutput(windowsPowerShellExecutable(), ["-NoProfile", "-STA", "-Command", script]);
+    }
+    if (process.platform === "darwin")
+        return commandOutput("osascript", ["-e", "POSIX path of (choose folder with prompt \"选择视频保存位置\")"]);
+    return commandOutput("zenity", ["--file-selection", "--directory", "--title=选择视频保存位置"]);
+}
+function commandOutput(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => { stdout += chunk.toString(); });
+        child.stderr.on("data", (chunk) => { stderr += chunk.toString(); });
+        child.once("error", reject);
+        child.once("exit", (code) => code === 0 ? resolve(stdout.trim()) : code === 1 ? resolve("") : reject(new Error(stderr.trim() || "无法打开本机文件夹选择器")));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaohhhh1/canvas-agent",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,7 +15,7 @@
   "scripts": {
     "dev": "tsx src/index.ts",
     "debug": "tsx src/index.ts --debug",
-    "test": "tsx --test src/canvas/session.test.ts",
+    "test": "tsx --test src/**/*.test.ts",
     "build": "tsc -p tsconfig.json",
     "start": "node dist/index.js",
     "prepack": "npm run build"