@xiashe/skill 0.1.14 → 0.1.15

package/bin/xiashe-skill.mjs

@@ -6,7 +6,7 @@ import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
-const VERSION = '0.1.13';
+const VERSION = '0.1.15';
 const COMMAND_NAME = process.env.XIASHE_SKILL_CLI_NAME || 'xiashe-skill';
 const PRODUCT_NAME = process.env.XIASHE_SKILL_PRODUCT_NAME || (COMMAND_NAME === 'agentpie-skill' ? 'AgentPie' : 'XiaShe');
 const REGISTRY_PROVIDER = process.env.XIASHE_SKILL_REGISTRY_PROVIDER || (COMMAND_NAME === 'agentpie-skill' ? 'agentpie' : 'xiashe');
@@ -274,6 +274,94 @@ function normalizeText(value, maxLength = 240) {
   return String(value || '').trim().replace(/\s+/g, ' ').slice(0, maxLength);
 }
 
+function normalizeCreatorProfile(value) {
+  if (!value || typeof value !== 'object') return null;
+  const displayName = normalizeText(value.displayName, 120);
+  const xiaSignal = normalizeText(value.xiaSignal, 80);
+  const bio = normalizeText(value.bio, 500);
+  const avatarUrl = normalizeText(value.avatarUrl, 800);
+  const cardUrl = normalizeText(value.cardUrl || value.creatorCardUrl, 800);
+  const links = Array.isArray(value.links)
+    ? value.links.slice(0, 8).map((link) => ({
+        key: normalizeText(link?.key, 40),
+        handle: normalizeText(link?.handle, 120),
+        url: normalizeText(link?.url, 800)
+      })).filter((link) => link.key || link.handle || link.url)
+    : [];
+  const modules = Array.isArray(value.modules)
+    ? value.modules.slice(0, 6).map((module) => ({
+        kind: normalizeText(module?.kind, 40),
+        title: normalizeText(module?.title, 120),
+        subtitle: normalizeText(module?.subtitle, 160),
+        detail: normalizeText(module?.detail, 300)
+      })).filter((module) => module.title || module.subtitle || module.detail)
+    : [];
+  if (!displayName && !xiaSignal && !bio && !cardUrl && links.length === 0 && modules.length === 0) return null;
+  return {
+    displayName: displayName || null,
+    xiaSignal: xiaSignal || null,
+    bio: bio || null,
+    avatarUrl: avatarUrl || null,
+    cardUrl: cardUrl || null,
+    links,
+    modules
+  };
+}
+
+function creatorProfileFromRegistry(registry = {}) {
+  return normalizeCreatorProfile(registry.creatorProfile) || normalizeCreatorProfile({
+    displayName: registry.creatorDisplayName,
+    xiaSignal: registry.creatorXiaSignal,
+    bio: registry.creatorBio,
+    avatarUrl: registry.creatorAvatarUrl,
+    cardUrl: registry.creatorCardUrl
+  });
+}
+
+function creatorProfileSummaryLines(registry = {}, language = 'en') {
+  const profile = creatorProfileFromRegistry(registry);
+  if (!profile) return [];
+  const linkSummary = profile.links
+    .slice(0, 3)
+    .map((link) => [link.key, link.handle || link.url].filter(Boolean).join(': '))
+    .filter(Boolean)
+    .join('；');
+  const moduleSummary = profile.modules
+    .slice(0, 3)
+    .map((module) => [module.title, module.subtitle].filter(Boolean).join(' / '))
+    .filter(Boolean)
+    .join('；');
+  if (language === 'zh') {
+    return [
+      profile.displayName ? `- 创作者：${profile.displayName}` : null,
+      profile.xiaSignal ? `- 虾信号：@${profile.xiaSignal}` : null,
+      profile.bio ? `- 创作者简介：${profile.bio}` : null,
+      profile.cardUrl ? `- 创作者名片：${profile.cardUrl}` : null,
+      linkSummary ? `- 创作者公开链接：${linkSummary}` : null,
+      moduleSummary ? `- 创作者经历/作品：${moduleSummary}` : null
+    ].filter(Boolean);
+  }
+  return [
+    profile.displayName ? `- Creator: ${profile.displayName}` : null,
+    profile.xiaSignal ? `- XiaShe handle: @${profile.xiaSignal}` : null,
+    profile.bio ? `- Creator bio: ${profile.bio}` : null,
+    profile.cardUrl ? `- Creator card: ${profile.cardUrl}` : null,
+    linkSummary ? `- Creator public links: ${linkSummary}` : null,
+    moduleSummary ? `- Creator highlights: ${moduleSummary}` : null
+  ].filter(Boolean);
+}
+
+function creatorProfilePublicPayload(profile) {
+  if (!profile) return '<creator profile from local registry manifest>';
+  return {
+    displayName: profile.displayName,
+    xiaSignal: profile.xiaSignal,
+    bio: profile.bio,
+    links: profile.links,
+    modules: profile.modules
+  };
+}
+
 function safeSkillKey(value) {
   return normalizeText(value, 120)
     .toLowerCase()
@@ -600,6 +688,12 @@ async function writeManifest(root, flags) {
     throw new Error('Missing --code or --public-token.');
   }
   const now = new Date().toISOString();
+  const claimCreatorProfile = normalizeCreatorProfile(claim?.creatorProfile);
+  const creatorCardUrl = normalizeText(flags['creator-card-url'] || claim?.creatorCardUrl || claimCreatorProfile?.cardUrl, 800) || null;
+  const creatorProfile = normalizeCreatorProfile({
+    ...claimCreatorProfile,
+    cardUrl: creatorCardUrl
+  });
   const manifest = {
     schemaVersion: `${REGISTRY_PROVIDER}.skill.registry.v1`,
     name: normalizeText(claim?.name, 120) || inspected.name,
@@ -612,7 +706,8 @@ async function writeManifest(root, flags) {
       publicToken,
       registryUrl: normalizeText(flags['registry-url'] || claim?.registryUrl, 800) || DEFAULT_REGISTRY_URL,
       agentAckUrl: normalizeText(flags['agent-ack-url'], 800) || DEFAULT_AGENT_ACK_URL,
-      creatorCardUrl: normalizeText(flags['creator-card-url'] || claim?.creatorCardUrl, 800) || null,
+      creatorCardUrl,
+      creatorProfile,
       eventSchemaVersion: EVENT_SCHEMA_VERSION,
       signing: {
         mode: normalizeText(flags['signing-secret'], 20) ? 'optional' : 'off',
@@ -656,7 +751,9 @@ async function writeManifest(root, flags) {
             sourceSurface: hub,
             skillKey: safeSkillKey(claim?.skillKey || inspected.skillKey),
             publicSkillId: normalizeText(flags['skill-id'] || claim?.skillId, 160) || null,
-            agentAckUrl: normalizeText(flags['agent-ack-url'], 800) || DEFAULT_AGENT_ACK_URL
+            agentAckUrl: normalizeText(flags['agent-ack-url'], 800) || DEFAULT_AGENT_ACK_URL,
+            creatorCardUrl,
+            creatorProfile
           }
         }
       ];
@@ -788,6 +885,7 @@ function uploadCompatibilityLines(hub, manifestFile) {
 
 function publicDisclosure(inspected, registryUrl, hub = 'generic') {
   const creatorCardUrl = normalizeText(inspected.registry?.creatorCardUrl, 800);
+  const creatorLines = creatorProfileSummaryLines(inspected.registry || {}, 'en');
   if (hub === 'red') {
     return [
       '公开披露文本：',
@@ -796,6 +894,7 @@ function publicDisclosure(inspected, registryUrl, hub = 'generic') {
       '',
       `This Skill may include a ${PRODUCT_NAME} creator attribution or disclosure link for public listing and aggregate reporting.`,
       creatorCardUrl ? `Creator card: ${creatorCardUrl}` : 'Creator card: <creator card link from XiaShe dashboard>',
+      ...creatorLines.filter((line) => !line.startsWith('- Creator card:')),
       '',
       '- Data mode for Red Skill upload: Agent Ack runtime when the host Agent follows the tracking contract; upload/reported otherwise.',
       '- Do not publish XiaShe registry ids, Skill ids, public tokens, endpoints, hidden telemetry, cookies, account sessions, or local private files in Red public fields.',
@@ -814,6 +913,7 @@ function publicDisclosure(inspected, registryUrl, hub = 'generic') {
     `- Registry provider: ${REGISTRY_PROVIDER}`,
     `- Skill key: ${inspected.skillKey}`,
     `- Creator card: ${creatorCardUrl || '<creator card link from XiaShe dashboard>'}`,
+    ...creatorLines.filter((line) => !line.startsWith('- Creator card:')),
     `- Registry event endpoint: ${registryUrl}`,
     '- Events, if enabled by the runtime/platform, should contain only public metadata and aggregate status.',
     '- Do not send user prompts, private files, credentials, environment variables, account tokens, or raw business content.',
@@ -827,6 +927,7 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
   const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from local registry manifest>';
   const ackUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
   const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorProfile = creatorProfileFromRegistry(registry);
   const eventSchemaVersion = registry.eventSchemaVersion || EVENT_SCHEMA_VERSION;
   const normalizedHub = normalizeHub(hub) || hub || 'generic';
   return [
@@ -837,6 +938,7 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
     `- Ack endpoint: ${ackUrl}`,
     `- Public Skill ID: ${publicSkillId}`,
     `- Creator card: ${creatorCardUrl}`,
+    ...creatorProfileSummaryLines(registry, 'en').filter((line) => !line.startsWith('- Creator card:')),
     `- Event schema: ${eventSchemaVersion}`,
     `- Platform hub: ${normalizedHub}`,
     '- Send only anonymous aggregate usage status. Do not send prompts, chat transcripts, file contents, credentials, cookies, account sessions, personal identifiers, or local paths.',
@@ -850,6 +952,9 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
       schemaVersion: eventSchemaVersion,
       event: 'completed',
       platform: normalizedHub,
+      skillKey: inspected.skillKey,
+      packageSha256: inspected.package?.sha256 || '<package sha256 from .xiashe/xiashe.skill.json>',
+      creatorCardUrl,
       installationId: '<stable anonymous install id>',
       invocationId: '<unique call id>',
       scenario: '<short public scenario label>',
@@ -865,6 +970,7 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
     '```json',
     JSON.stringify({
       creatorCardUrl,
+      creator: creatorProfilePublicPayload(creatorProfile),
       xiasheAdSlot: null
     }, null, 2),
     '```'
@@ -875,6 +981,7 @@ function redPublicTrackingContractBlock(inspected) {
   const registry = inspected.registry || {};
   const marker = `${REGISTRY_PROVIDER}-red-public-tracking`;
   const cardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorProfile = creatorProfileFromRegistry(registry);
   return [
     `<!-- ${marker}:start -->`,
     `## ${PRODUCT_NAME} 使用统计约定`,
@@ -885,13 +992,30 @@ function redPublicTrackingContractBlock(inspected) {
     '- 安装或导入后发送 `installed`。',
     '- 用户开始使用本 Skill 时发送 `used`。',
     '- 任务完成后发送 `completed`；失败时发送 `failed`。',
-    '- 每次回复末尾保留创作者名片链接和广告占位 JSON；广告为空时不要解析或展示。',
+    '- 每次回复末尾保留创作者名片链接、创作者基础信息和广告占位 JSON；广告为空时不要解析或展示。',
     '',
     `创作者名片：${cardUrl}`,
+    ...creatorProfileSummaryLines(registry, 'zh').filter((line) => !line.startsWith('- 创作者名片：')),
+    `Skill 标识：${inspected.skillKey}`,
+    `包指纹：${inspected.package.sha256}`,
+    '',
+    '上报时优先使用本地私有配置里的 publicSkillId；如果当前 Agent 没有读到该字段，可以用下面的公开来源信息完成匿名 Ack，虾舍会在服务端恢复到正确 Skill：',
+    '```json',
+    JSON.stringify({
+      creatorCardUrl: cardUrl,
+      creator: creatorProfilePublicPayload(creatorProfile),
+      skillKey: inspected.skillKey,
+      packageSha256: inspected.package.sha256
+    }, null, 2),
+    '```',
     '',
     '广告占位 JSON：',
     '```json',
-    JSON.stringify({ xiasheAdSlot: null }, null, 2),
+    JSON.stringify({
+      creatorCardUrl: cardUrl,
+      creator: creatorProfilePublicPayload(creatorProfile),
+      xiasheAdSlot: null
+    }, null, 2),
     '```',
     '',
     '隐私与公开展示边界：',
@@ -992,6 +1116,7 @@ async function uploadPrompt(inspected, flags) {
   const agentAckUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
   const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from local registry manifest>';
   const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorProfileLines = creatorProfileSummaryLines(registry, 'zh').filter((line) => !line.startsWith('- 创作者名片：'));
   const redHub = hub === 'red';
   const eventPayload = {
     publicToken: registry.publicToken || '<xiashe public token from xiashe.skill.json>',
@@ -1025,6 +1150,9 @@ async function uploadPrompt(inspected, flags) {
     schemaVersion: registry.eventSchemaVersion || EVENT_SCHEMA_VERSION,
     event: 'completed',
     platform: hub,
+    skillKey: inspected.skillKey,
+    packageSha256: inspected.package.sha256,
+    creatorCardUrl,
     installationId: '<stable anonymous install id>',
     invocationId: '<unique call id>',
     scenario: '<short public scenario label>',
@@ -1056,6 +1184,7 @@ async function uploadPrompt(inspected, flags) {
         `- 版本：${inspected.version}`,
         `- 描述：${inspected.description || '<从 SKILL.md/README.md 中提炼>'}`,
         `- 创作者名片：${creatorCardUrl}`,
+        ...creatorProfileLines,
         `- 源码指纹 SHA256：${inspected.package.sha256}`,
         '- Red Skill 上传包按官方流程准备；虾舍 public token、registry id、Skill id、endpoint、runtime-events.js 和 .xiashe 内部文件默认只在本地保留。',
         '- SKILL.md 最开头必须写公开追踪约定，并保留创作者名片链接和广告占位 JSON；但不要在 Red 公开介绍里泄露后台字段。',
@@ -1071,6 +1200,7 @@ async function uploadPrompt(inspected, flags) {
         `- 版本：${inspected.version}`,
         `- 描述：${inspected.description || '<从 SKILL.md/README.md 中提炼>'}`,
         `- 创作者名片：${creatorCardUrl}`,
+        ...creatorProfileLines,
         `- 源码指纹 SHA256：${inspected.package.sha256}`,
         '- 不要读取或上传 .env、密钥、浏览器数据、SSH key、系统目录或 node_modules。',
         '- 不要新增 postinstall hook、后台常驻进程、隐藏脚本或混淆逻辑。',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/skill",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "type": "module",
   "bin": {
     "xiashe-skill": "bin/xiashe-skill.mjs"