@xiashe/skill 0.1.21 → 0.1.22

package/bin/xiashe-skill.mjs

@@ -1,19 +1,97 @@
 #!/usr/bin/env node
 
 import { createHash, createHmac } from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { gzip } from 'node:zlib';
 
-const VERSION = '0.1.21';
+function parseEnvFile(filePath) {
+  if (!existsSync(filePath)) return {};
+  const parsed = {};
+  const raw = readFileSync(filePath, 'utf8');
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) continue;
+    let value = match[2].trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    parsed[match[1]] = value;
+  }
+  return parsed;
+}
+
+function nearestEnvFiles() {
+  const files = [];
+  let cursor = process.cwd();
+  for (let index = 0; index < 8; index += 1) {
+    files.push(path.join(cursor, '.env.local'));
+    files.push(path.join(cursor, 'convex', '.env.local'));
+    const next = path.dirname(cursor);
+    if (next === cursor) break;
+    cursor = next;
+  }
+  return files;
+}
+
+function loadLocalEnvDefaults() {
+  const cliDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+  const candidates = [
+    path.join(cliDir, '.env.local'),
+    path.join(cliDir, 'convex', '.env.local'),
+    ...nearestEnvFiles()
+  ];
+  const env = {};
+  for (const filePath of candidates) {
+    Object.assign(env, parseEnvFile(filePath));
+  }
+  return env;
+}
+
+function normalizeBaseUrl(value) {
+  const text = String(value || '').trim().replace(/\/+$/, '');
+  return /^https?:\/\//i.test(text) ? text : '';
+}
+
+function isTransportError(error) {
+  const message = error instanceof Error ? `${error.name || ''} ${error.message || ''}` : String(error || '');
+  return /abort|timeout|fetch failed|network|enotfound|eai_again|econnrefused|econnreset|etimedout|unable to verify|certificate/i.test(message);
+}
+
+const LOCAL_ENV_DEFAULTS = loadLocalEnvDefaults();
+const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.22';
 const COMMAND_NAME = process.env.XIASHE_SKILL_CLI_NAME || 'xiashe-skill';
 const PRODUCT_NAME = process.env.XIASHE_SKILL_PRODUCT_NAME || (COMMAND_NAME === 'agentpie-skill' ? 'AgentPie' : 'XiaShe');
 const REGISTRY_PROVIDER = process.env.XIASHE_SKILL_REGISTRY_PROVIDER || (COMMAND_NAME === 'agentpie-skill' ? 'agentpie' : 'xiashe');
+const LOCAL_AGENTPIE_BASE_URL = normalizeBaseUrl(
+  process.env.AGENTPIE_SKILL_DEFAULT_BASE_URL ||
+    LOCAL_ENV_DEFAULTS.AGENTPIE_SKILL_DEFAULT_BASE_URL ||
+    process.env.AGENTPIE_SKILL_REGISTRY_PUBLIC_URL ||
+    LOCAL_ENV_DEFAULTS.AGENTPIE_SKILL_REGISTRY_PUBLIC_URL ||
+    process.env.AGENTPIE_ACTIONS_URL ||
+    LOCAL_ENV_DEFAULTS.AGENTPIE_ACTIONS_URL ||
+    process.env.CREATOR_SKILL_REGISTRY_PUBLIC_URL ||
+    LOCAL_ENV_DEFAULTS.CREATOR_SKILL_REGISTRY_PUBLIC_URL ||
+    process.env.AGENTPIE_MCP_PUBLIC_URL ||
+    LOCAL_ENV_DEFAULTS.AGENTPIE_MCP_PUBLIC_URL ||
+    process.env.PUBLIC_CONVEX_SITE_URL ||
+    LOCAL_ENV_DEFAULTS.PUBLIC_CONVEX_SITE_URL ||
+    process.env.CONVEX_SITE_URL ||
+    LOCAL_ENV_DEFAULTS.CONVEX_SITE_URL ||
+    process.env.EXPO_PUBLIC_CONVEX_SITE_URL ||
+    LOCAL_ENV_DEFAULTS.EXPO_PUBLIC_CONVEX_SITE_URL
+);
 const DEFAULT_BASE_URL = process.env.XIASHE_SKILL_DEFAULT_BASE_URL || (COMMAND_NAME === 'agentpie-skill'
-  ? 'https://actions.agentpie.app'
+  ? LOCAL_AGENTPIE_BASE_URL || 'https://agentpie.app'
   : 'https://actions.xiashe.chat');
 const MANIFEST_FILE = process.env.XIASHE_SKILL_MANIFEST_FILE || (COMMAND_NAME === 'agentpie-skill'
   ? 'agentpie.skill.json'
@@ -32,10 +110,11 @@ const EVENT_SCHEMA_VERSION = process.env.XIASHE_SKILL_EVENT_SCHEMA_VERSION || (R
 const RUNTIME_SCHEMA_VERSION = process.env.XIASHE_SKILL_RUNTIME_SCHEMA_VERSION || (REGISTRY_PROVIDER === 'agentpie'
   ? 'agentpie.skill.runtime.v1'
   : 'xiashe.skill.runtime.v1');
-const SUPPORTED_HUBS = ['xiashe', 'red', 'clawhub', 'skillhub', 'claude', 'codex', 'cursor', 'workbuddy', 'dify', 'coze', 'generic'];
-const DEFAULT_SETUP_HUBS = ['xiashe', 'red'];
+const FIRST_PARTY_HUB = REGISTRY_PROVIDER === 'agentpie' ? 'agentpie' : 'xiashe';
+const SUPPORTED_HUBS = ['agentpie', 'xiashe', 'red', 'clawhub', 'skillhub', 'claude', 'codex', 'cursor', 'workbuddy', 'dify', 'coze', 'generic'];
+const DEFAULT_SETUP_HUBS = [FIRST_PARTY_HUB, 'red'];
 const ACK_EVENTS = ['installed', 'used', 'completed', 'failed'];
-const RUNTIME_DISTRIBUTION_PLATFORMS = ['xiaohongshu-redskill', 'xiashe', 'coze-store', 'local', 'unknown'];
+const RUNTIME_DISTRIBUTION_PLATFORMS = ['xiaohongshu-redskill', 'agentpie', 'xiashe', 'coze-store', 'local', 'unknown'];
 const RUNTIME_AGENTS = ['codex', 'workbuddy', 'coze', 'claude', 'cursor', 'dify', 'custom-agent', 'unknown'];
 const RUNTIME_HOSTS = ['codex-desktop', 'coze-app', 'web-chat', 'desktop', 'web', 'server', 'mobile', 'unknown'];
 const RUNTIME_SOURCE_SURFACES = ['install', 'first-use-backfill', 'chat-use', 'manual-test', 'creator-card', 'dashboard', 'unknown'];
@@ -79,6 +158,16 @@ const FORBIDDEN_ACK_FIELDS = [
   'privateResearchMaterial'
 ];
 const PLATFORM_REVIEW_PROFILES = {
+  agentpie: {
+    label: 'AgentPie Registry',
+    packageMode: 'full_skill_package',
+    manifestPolicy: 'upload_allowed',
+    disclosurePlacement: ['Skill public page', 'README', `${WORK_DIR}/REGISTRY_DISCLOSURE.md`],
+    runtimeDataPolicy: 'runtime_capable',
+    defaultDataSource: 'runtime',
+    allowedFilePolicy: 'Upload the complete reviewed Skill package, including the local registry manifest.',
+    forbiddenPublicFiles: ['.env', 'credentials', 'node_modules', 'dist', 'build', 'browser profiles', 'SSH keys']
+  },
   xiashe: {
     label: 'XiaShe Store',
     packageMode: 'full_skill_package',
@@ -224,14 +313,14 @@ function usage() {
 
 Usage:
   ${COMMAND_NAME} inspect [skill-dir] [--json]
-  ${COMMAND_NAME} publish [skill-dir] --code <dynamic-code> [--to xiashe,red]
-  ${COMMAND_NAME} setup [skill-dir] --code <dynamic-code> [--hub all|xiashe|red]
-  ${COMMAND_NAME} setup [skill-dir] --public-token <token> --skill-id <id> [--hub all|xiashe|red]
+  ${COMMAND_NAME} publish [skill-dir] --code <dynamic-code> [--to ${FIRST_PARTY_HUB},red]
+  ${COMMAND_NAME} setup [skill-dir] --code <dynamic-code> [--hub all|${FIRST_PARTY_HUB}|red]
+  ${COMMAND_NAME} setup [skill-dir] --public-token <token> --skill-id <id> [--hub all|${FIRST_PARTY_HUB}|red]
   ${COMMAND_NAME} doctor [skill-dir] [--json]
   ${COMMAND_NAME} verify [skill-dir] [--hub <hub>] [--scenario <label>] [--dry-run]
   ${COMMAND_NAME} attach [skill-dir] --code <dynamic-code> [--name <name>]
   ${COMMAND_NAME} attach [skill-dir] --public-token <token> [--skill-id <id>] [--name <name>]
-  ${COMMAND_NAME} prompt [skill-dir] --hub <xiashe|red> [--source-url <url>] [--out <file>]
+  ${COMMAND_NAME} prompt [skill-dir] --hub <${FIRST_PARTY_HUB}|red> [--source-url <url>] [--out <file>]
   ${COMMAND_NAME} snippet [skill-dir] [--target js|curl] [--out <file>]
   ${COMMAND_NAME} track [skill-dir] --event <event> [--hub <hub>] [--installation-id <id>] [--invocation-id <id>]
 
@@ -244,7 +333,7 @@ Options:
   --agent-ack-url <url>       No-secret Agent Ack endpoint written to the local manifest.
   --name <name>               Skill display name override.
   --description <text>        Skill description override.
-  --hub <hub>                 Target Skill hub prompt style. setup defaults to xiashe,red.
+  --hub <hub>                 Target Skill hub prompt style. setup defaults to ${DEFAULT_SETUP_HUBS.join(',')}.
   --to <hub[,hub]>            High-level publish targets. Alias for --hub in publish mode.
   --event <event>             Runtime event to submit for testing.
   --installation-id <id>      Stable anonymous install id for runtime analytics.
@@ -271,7 +360,7 @@ Options:
   --package-artifact-url <url> Package artifact attach endpoint. Defaults to ${DEFAULT_PACKAGE_ARTIFACT_URL}
   --out <path>                Output prompt or snippet file.
   --out-dir <path>            Output directory for setup artifacts. Defaults to ${WORK_DIR}/.
-  --no-xiashe-package-upload  Skip automatic ${PRODUCT_NAME} complete package upload.
+  --no-package-upload         Skip automatic ${PRODUCT_NAME} complete package upload.
   --embed-skill-md            Also write a clearly marked registry section into SKILL.md.
   --no-skill-md               Do not write registry text into SKILL.md. Red hub embeds by default.
   --no-snippet                Setup should skip writing the runtime analytics snippet.
@@ -290,7 +379,7 @@ function fail(message, code = 1) {
 
 function parseArgs(argv) {
   const args = { _: [], json: false, dryRun: false };
-  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track', 'no-xiashe-package-upload']);
+  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track', 'no-package-upload', 'no-xiashe-package-upload']);
   for (let i = 0; i < argv.length; i += 1) {
     const value = argv[i];
     if (value === '--help' || value === '-h') {
@@ -487,6 +576,9 @@ function normalizeHub(value) {
   if (hub === 'xiashechat' || hub === 'xia-she' || hub === 'xiashe-store') {
     return 'xiashe';
   }
+  if (hub === 'agent-pie' || hub === 'agentpieapp' || hub === 'agentpie-registry' || hub === 'agentpieregistry') {
+    return 'agentpie';
+  }
   if (hub === 'claudecode' || hub === 'claude-code') {
     return 'claude';
   }
@@ -742,6 +834,12 @@ async function postJson(url, body, timeoutMs = 20_000) {
       throw new Error(payload.error || payload.message || `HTTP ${response.status}`);
     }
     return payload;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error || 'unknown error');
+    if (!isTransportError(error)) {
+      throw error;
+    }
+    throw new Error(`Network request failed for ${url}: ${message}`);
   } finally {
     clearTimeout(timer);
   }
@@ -896,10 +994,10 @@ async function buildXiashePackageArtifact(root, inspected, flags = {}) {
   const skillMarkdownPresent = files.some((file) => /^SKILL(\.[a-z0-9]+)?$/i.test(file.relative));
   const manifestPresent = files.some((file) => file.relative === manifestRelative);
   if (!skillMarkdownPresent) {
-    throw new Error('SKILL.md is required before uploading the XiaShe complete package.');
+    throw new Error(`SKILL.md is required before uploading the ${PRODUCT_NAME} complete package.`);
   }
   if (!manifestPresent) {
-    throw new Error(`${manifestRelative} is required before uploading the XiaShe complete package.`);
+    throw new Error(`${manifestRelative} is required before uploading the ${PRODUCT_NAME} complete package.`);
   }
   const artifact = await createTarGz(files);
   const artifactDir = path.resolve(flags['package-out-dir'] || path.join(absoluteRoot, WORK_DIR, 'package-artifact'));
@@ -947,13 +1045,19 @@ async function uploadBytesToStorage(uploadUrl, bytes, contentType, timeoutMs = 6
       throw new Error('Upload response did not include storageId.');
     }
     return { ...payload, storageId };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error || 'unknown error');
+    if (!isTransportError(error)) {
+      throw error;
+    }
+    throw new Error(`Package upload failed for ${uploadUrl}: ${message}`);
   } finally {
     clearTimeout(timer);
   }
 }
 
 async function uploadXiashePackageArtifact(root, flags, manifestResult) {
-  if (flags.dryRun || flags['no-xiashe-package-upload']) {
+  if (flags.dryRun || flags['no-package-upload'] || flags['no-xiashe-package-upload']) {
     return {
       ok: true,
       skipped: true,
@@ -964,7 +1068,7 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
   const registry = manifestResult.manifest?.registry || inspected.registry || {};
   const publicToken = normalizeText(registry.publicToken, 512);
   if (!publicToken) {
-    throw new Error('Cannot upload XiaShe package without registry publicToken.');
+    throw new Error(`Cannot upload ${PRODUCT_NAME} package without registry publicToken.`);
   }
   const artifact = await buildXiashePackageArtifact(root, inspected, flags);
   const registrySourceSha256 =
@@ -1004,7 +1108,7 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
       manifestPresent: artifact.manifestPresent,
       skillMarkdownPresent: artifact.skillMarkdownPresent,
       creatorCardUrl: normalizeText(registry.creatorCardUrl, 800) || undefined,
-      platformSource: 'xiashe',
+      platformSource: REGISTRY_PROVIDER,
       source: `${REGISTRY_PROVIDER}_skill_cli`
     },
     Number(flags['timeout-ms'] || 20_000)
@@ -1183,6 +1287,9 @@ async function writeManifest(root, flags) {
 }
 
 function hubInstruction(hub) {
+  if (hub === 'agentpie') {
+    return 'AgentPie Registry publish is the full Skill package and registry manifest flow. Keep public disclosure, attribution, and runtime analytics callbacks; if the local manifest has a registry public token or a creator-authenticated CLI/API session exists, create or reuse the AgentPie registry draft.';
+  }
   if (hub === 'xiashe') {
     return '虾舍商店发布是完整 Skill 包和 registry manifest 的主流程。请保留公开披露、归因和 runtime analytics 回传能力；如果本地 manifest 有 registry public token 或已有创作者认证 CLI/API 会话，就创建或复用虾舍商店草稿。';
   }
@@ -1217,6 +1324,9 @@ function hubInstruction(hub) {
 }
 
 function platformPromptPlaceholder(hub) {
+  if (hub === 'agentpie') {
+    return 'If the user is publishing to AgentPie Registry and the current environment has a creator-authenticated CLI/API session, create the AgentPie registry draft first; otherwise finish registry setup, disclosure, platform profile, and handoff files. Do not apply third-party marketplace limits to the AgentPie complete Skill package.';
+  }
   if (hub === 'xiashe') {
     return '如果用户要发布到虾舍商店，并且当前环境已有创作者认证 CLI/API 会话，请优先创建虾舍商店草稿；如果没有认证会话，请完成 registry setup、披露、平台 profile 和 handoff 文件，不要要求 Agent 宿主登录或索取账号凭证。不要把第三方平台限制套用到虾舍完整 Skill 包。';
   }
@@ -1252,6 +1362,14 @@ function platformPromptPlaceholder(hub) {
 
 function uploadCompatibilityLines(hub, manifestFile) {
   const localManifest = `${WORK_DIR}/${manifestFile}`;
+  if (hub === 'agentpie') {
+    return [
+      'AgentPie Registry compatibility requirements:',
+      `- AgentPie Registry can receive the complete Skill package and ${localManifest} registry manifest.`,
+      '- Keep public disclosure text, attribution links, and runtime event callbacks; do not remove the registry manifest.',
+      '- Before submitting a draft, still exclude .env, keys, node_modules, dist/build, and unrelated local files.'
+    ];
+  }
   if (hub === 'xiashe') {
     return [
       '虾舍商店兼容性要求：',
@@ -1542,6 +1660,7 @@ function yamlStringList(values, indent = 6) {
 function runtimeDistributionPlatformForHub(hub) {
   const normalized = normalizeHub(hub) || 'unknown';
   if (normalized === 'red') return 'xiaohongshu-redskill';
+  if (normalized === 'agentpie') return 'agentpie';
   if (normalized === 'xiashe') return 'xiashe';
   if (normalized === 'coze') return 'coze-store';
   if (normalized === 'codex' || normalized === 'claude' || normalized === 'cursor' || normalized === 'workbuddy') return 'local';
@@ -2650,12 +2769,13 @@ async function setupAgentWorkflow(root, flags) {
     promptResults,
     packagePlans
   });
-  const xiashePackageArtifact = hubs.includes('xiashe') && REGISTRY_PROVIDER === 'xiashe'
+  const firstPartyPackageHubSelected = hubs.includes(FIRST_PARTY_HUB);
+  const firstPartyPackageArtifact = firstPartyPackageHubSelected && (REGISTRY_PROVIDER === 'xiashe' || REGISTRY_PROVIDER === 'agentpie')
     ? await uploadXiashePackageArtifact(absoluteRoot, flags, manifestResult)
     : {
         ok: true,
         skipped: true,
-        reason: hubs.includes('xiashe') ? 'non_xiashe_provider' : 'xiashe_not_selected'
+        reason: firstPartyPackageHubSelected ? 'unsupported_registry_provider' : 'first_party_registry_not_selected'
       };
 
   const warnings = [];
@@ -2691,14 +2811,14 @@ async function setupAgentWorkflow(root, flags) {
     agentAckPath,
     disclosurePath,
     snippetPath: snippetResult ? snippetResult.outPath : null,
-    xiashePackageArtifact,
+    firstPartyPackageArtifact,
     promptEvents,
     warnings,
     publicProtocol,
     next: [
-      xiashePackageArtifact?.skipped
-        ? `XiaShe complete package upload was skipped (${xiashePackageArtifact.reason}).`
-        : `XiaShe complete package uploaded: ${path.relative(absoluteRoot, xiashePackageArtifact.artifactPath)} (${xiashePackageArtifact.publishStatus || 'queued'}).`,
+      firstPartyPackageArtifact?.skipped
+        ? `${PRODUCT_NAME} complete package upload was skipped (${firstPartyPackageArtifact.reason}).`
+        : `${PRODUCT_NAME} complete package uploaded: ${path.relative(absoluteRoot, firstPartyPackageArtifact.artifactPath)} (${firstPartyPackageArtifact.publishStatus || 'queued'}).`,
       `Use ${path.relative(absoluteRoot, handoffPath)} as the single Agent handoff. The Agent should not ask the user to manually pick registry files.`,
       `Use ${path.relative(absoluteRoot, profilesPath)} and package-<hub>.json as the platform review profiles and upload allowlists.`,
       publicProtocol
@@ -2756,7 +2876,7 @@ async function main() {
     if (command === 'publish') {
       const result = await setupAgentWorkflow(root, flags);
       if (flags.json) {
-        print({ ok: true, mode: 'xiashe-publish', ...result }, true);
+        print({ ok: true, mode: `${REGISTRY_PROVIDER}-publish`, ...result }, true);
       } else {
         const lines = [
           `${PRODUCT_NAME} publish handoff prepared.`,
@@ -2767,8 +2887,8 @@ async function main() {
           ...result.packagePlanPaths.map((item) => `Package plan (${item.hub}): ${item.planPath}`),
           result.skillMdPath ? `Updated: ${result.skillMdPath}` : null,
           result.publicProtocol ? `Public Red protocol: ${result.publicProtocol.runtimePath}, ${result.publicProtocol.agentAckPath}, ${result.publicProtocol.disclosurePath}` : null,
-          result.xiashePackageArtifact && !result.xiashePackageArtifact.skipped
-            ? `XiaShe package: ${result.xiashePackageArtifact.artifactPath} (${result.xiashePackageArtifact.publishStatus || 'queued'})`
+          result.firstPartyPackageArtifact && !result.firstPartyPackageArtifact.skipped
+            ? `${PRODUCT_NAME} package: ${result.firstPartyPackageArtifact.artifactPath} (${result.firstPartyPackageArtifact.publishStatus || 'queued'})`
             : null,
           `Disclosure: ${result.disclosurePath}`,
           result.snippetPath ? `Runtime snippet: ${result.snippetPath}` : null,
@@ -2776,8 +2896,8 @@ async function main() {
           '',
           'Next:',
           '- Treat the target platform official upload flow as authoritative.',
-          '- Use the handoff file as the only XiaShe registry checklist.',
-          '- XiaShe complete package upload is already handled by this command when the xiashe target is selected.',
+          `- Use the handoff file as the only ${PRODUCT_NAME} registry checklist.`,
+          `- ${PRODUCT_NAME} complete package upload is already handled by this command when the first-party registry target is selected.`,
           '- Before uploading to third-party targets, check whether this Skill already has a draft, submitted review, or published listing for the selected target; skip duplicate uploads and verify/update the existing record when possible.',
           '- Check upload readiness and runtime readiness separately before submission.',
           '- Only ask for creator CLI login if a separate store-management command is needed and the registry public token is missing or rejected.',
@@ -2802,8 +2922,8 @@ async function main() {
           result.publicProtocol ? `Wrote ${result.publicProtocol.runtimePath}` : null,
           result.publicProtocol ? `Wrote ${result.publicProtocol.agentAckPath}` : null,
           result.publicProtocol ? `Wrote ${result.publicProtocol.disclosurePath}` : null,
-          result.xiashePackageArtifact && !result.xiashePackageArtifact.skipped
-            ? `Uploaded XiaShe package ${result.xiashePackageArtifact.artifactPath} (${result.xiashePackageArtifact.publishStatus || 'queued'})`
+          result.firstPartyPackageArtifact && !result.firstPartyPackageArtifact.skipped
+            ? `Uploaded ${PRODUCT_NAME} package ${result.firstPartyPackageArtifact.artifactPath} (${result.firstPartyPackageArtifact.publishStatus || 'queued'})`
             : null,
           `Wrote ${result.disclosurePath}`,
           result.snippetPath ? `Wrote ${result.snippetPath}` : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/skill",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "type": "module",
   "bin": {
     "xiashe-skill": "bin/xiashe-skill.mjs"