@ybbapp/push-cli 0.0.1-alpha.0

package/README.md

@@ -0,0 +1,77 @@
+# push-cli
+
+`push-cli` 是供 Agent 低成本接入 Lark 群聊机器人的单向消息推送参考实现。它只通过自定义机器人 webhook 发送消息，不接收事件、不提供回调、消息读取或其他 Lark API 能力。
+
+仓库根目录是 Go CLI 参考实现；`skills/lark-push/` 是可单独安装的 Agent Skill，包含操作说明和示例。CLI 仅调用群聊自定义机器人 webhook 推送消息，不提供其他 Lark API。
+
+可用 GitHub CLI 安装：
+
+```sh
+gh skill install ybbapp/push-cli lark-push
+```
+
+也可以把 `skills/lark-push/` 复制到 Agent 支持的 skills 目录。Skill 提供操作说明和示例；`push-cli` 可执行文件及本地 webhook 配置需要另行准备。构建命令：
+
+```sh
+go build -o push-cli ./cmd
+```
+
+## 分发和安装
+
+发布 tag 会构建并分发 npm 包、GitHub Release 二进制和 GHCR Docker 镜像。npm 包是推荐入口；它第一次运行时会按当前 OS/CPU 下载对应 Release 二进制并校验 SHA-256。
+
+alpha 版本：
+
+```sh
+npx --yes @ybbapp/push-cli@alpha --version
+```
+
+直接下载 Release 二进制：
+
+```sh
+gh release download alpha-0.0.1 \
+  --repo ybbapp/push-cli \
+  --pattern 'push-cli-alpha-0.0.1-*-*.tar.gz'
+```
+
+Docker 镜像支持 Linux 多架构：
+
+```sh
+docker run --rm --env LARK_WEBHOOK_URL \
+  ghcr.io/ybbapp/push-cli:alpha \
+  lark send --title '每日市场报告' --markdown '报告正文'
+```
+
+首次引导：npm 要求包先存在，才能配置 Trusted Publisher。仓库公开后，先推送 `alpha-0.0.1` 生成公开 Release，再从该版本源码目录手动运行一次 `npm publish --access public --tag alpha`（使用 npm 交互式登录；该版本是 `0.0.1-alpha.0`）。包存在后，在 npm 包的 **Settings → Trusted publishing** 绑定 GitHub Actions：owner `ybbapp`、repository `push-cli`、workflow filename `release.yml`，并允许 `npm publish`。之后每次推送 `alpha-*` 或 `v*` tag，workflow 使用 OIDC 发布，不需要保存 npm token。包尚未创建时，workflow 会跳过 npm job，但仍会发布 GitHub Release 和 GHCR 镜像。
+
+首次向 GHCR 发布后，需要在 GitHub Packages 的 `push-cli` 镜像设置中将可见性改为 Public，公开后 Docker 用户才能匿名拉取。
+
+## 配置和使用
+
+推荐通过环境变量注入 webhook。也可以在当前工作目录放置 `.env`，或使用 `--env` 指定文件。`.env` 不应提交到仓库。
+
+```sh
+export LARK_WEBHOOK_URL='https://open.larksuite.com/open-apis/bot/v2/hook/REPLACE_WITH_YOUR_TOKEN'
+```
+
+发送 Markdown：
+
+```sh
+push-cli lark send --title '每日市场报告' --file report.md
+cat report.md | push-cli lark send --title '每日市场报告'
+```
+
+附带图表发送示例（在仓库根目录运行）：
+
+```sh
+push-cli lark send \
+  --title 'NVDA 行情' \
+  --markdown 'NVDA 收盘价走势' \
+  --chart-file skills/lark-push/examples/nvda-line-chart.json
+```
+
+## 版本和平台
+
+首个 Git tag `alpha-0.0.1` 对应 npm SemVer `0.0.1-alpha.0`，发布到 npm 的 `alpha` dist-tag；GitHub Release 与 Docker tag 保留 `alpha-0.0.1`，并更新 Docker `alpha` tag。
+
+原生二进制支持 macOS amd64/arm64、Linux amd64/arm64/riscv64、Windows amd64/arm64。Docker 镜像支持 Linux amd64/arm64/riscv64。

package/bin/push-cli.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require("node:child_process");
+const { ensureBinary } = require("../scripts/install");
+
+async function main() {
+  try {
+    const executable = await ensureBinary();
+    const result = spawnSync(executable, process.argv.slice(2), { stdio: "inherit" });
+    if (result.error) throw result.error;
+    process.exitCode = result.status === null ? 1 : result.status;
+  } catch (error) {
+    console.error(`push-cli: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+main();

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@ybbapp/push-cli",
+  "version": "0.0.1-alpha.0",
+  "description": "Small Lark group-bot push CLI for agents",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ybbapp/push-cli.git"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "push-cli": "bin/push-cli.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/",
+    "README.md"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/scripts/install.js

@@ -0,0 +1,107 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const OWNER = "ybbapp";
+const REPOSITORY = "push-cli";
+const PACKAGE_VERSION = require("../package.json").version;
+const VENDOR_DIR = path.join(__dirname, "..", "vendor");
+const BINARY_NAME = process.platform === "win32" ? "push-cli.exe" : "push-cli";
+const BINARY_PATH = path.join(VENDOR_DIR, BINARY_NAME);
+const REDIRECT_HOSTS = new Set([
+  "github.com",
+  "objects.githubusercontent.com",
+  "release-assets.githubusercontent.com",
+]);
+
+function target() {
+  const platform = { darwin: "darwin", linux: "linux", win32: "windows" }[process.platform];
+  const arch = { x64: "amd64", arm64: "arm64", riscv64: "riscv64" }[process.arch];
+  if (!platform || !arch) {
+    throw new Error(`unsupported platform: ${process.platform}-${process.arch}`);
+  }
+  return { platform, arch };
+}
+
+function releaseTag() {
+  const alpha = PACKAGE_VERSION.match(/^(\d+\.\d+\.\d+)-alpha\.\d+$/);
+  if (alpha) return `alpha-${alpha[1]}`;
+  if (/^\d+\.\d+\.\d+$/.test(PACKAGE_VERSION)) return `v${PACKAGE_VERSION}`;
+  throw new Error(`cannot map npm version ${PACKAGE_VERSION} to a GitHub release`);
+}
+
+function assetName(tag, platform, arch) {
+  const extension = platform === "windows" ? "zip" : "tar.gz";
+  return `push-cli-${tag}-${platform}-${arch}.${extension}`;
+}
+
+async function get(url, redirects = 0) {
+  const parsed = new URL(url);
+  if (!REDIRECT_HOSTS.has(parsed.hostname)) throw new Error(`unexpected download host: ${parsed.hostname}`);
+  const response = await fetch(url, { redirect: "manual" });
+  if ([301, 302, 303, 307, 308].includes(response.status)) {
+    if (redirects >= 3) throw new Error("too many redirects while downloading the release");
+    const location = response.headers.get("location");
+    if (!location) throw new Error("release download redirect has no location");
+    return get(new URL(location, url).toString(), redirects + 1);
+  }
+  if (!response.ok) throw new Error(`download failed (${response.status}): ${url}`);
+  const finalHost = new URL(response.url).hostname;
+  if (!REDIRECT_HOSTS.has(finalHost)) throw new Error(`unexpected download host: ${finalHost}`);
+  return Buffer.from(await response.arrayBuffer());
+}
+
+function extract(archive, directory, platform) {
+  if (platform === "windows") {
+    const command = "$ErrorActionPreference='Stop'; Expand-Archive -LiteralPath $env:PUSH_CLI_ARCHIVE -DestinationPath $env:PUSH_CLI_DEST -Force";
+    const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], {
+      stdio: "inherit",
+      env: { ...process.env, PUSH_CLI_ARCHIVE: archive, PUSH_CLI_DEST: directory },
+    });
+    if (result.error) throw result.error;
+    if (result.status !== 0) throw new Error("could not extract the Windows release archive");
+    return;
+  }
+  const result = spawnSync("tar", ["-xzf", archive, "-C", directory], { stdio: "inherit" });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error("could not extract the release archive; install tar and retry");
+}
+
+async function ensureBinary() {
+  if (fs.existsSync(BINARY_PATH)) return BINARY_PATH;
+
+  const { platform, arch } = target();
+  const tag = releaseTag();
+  const asset = assetName(tag, platform, arch);
+  const base = `https://github.com/${OWNER}/${REPOSITORY}/releases/download/${encodeURIComponent(tag)}`;
+  const [archiveData, checksums] = await Promise.all([
+    get(`${base}/${asset}`),
+    get(`${base}/checksums.txt`),
+  ]);
+  const checksumLine = checksums.toString("utf8").split(/\r?\n/).find((line) => line.trim().endsWith(`  ${asset}`));
+  if (!checksumLine) throw new Error(`release checksums do not include ${asset}`);
+  const expected = checksumLine.trim().split(/\s+/)[0].toLowerCase();
+  const actual = crypto.createHash("sha256").update(archiveData).digest("hex");
+  if (!/^[a-f0-9]{64}$/.test(expected) || actual !== expected) {
+    throw new Error(`SHA-256 verification failed for ${asset}`);
+  }
+
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "push-cli-"));
+  try {
+    const archivePath = path.join(temporary, asset);
+    fs.writeFileSync(archivePath, archiveData, { mode: 0o600 });
+    extract(archivePath, temporary, platform);
+    const extracted = path.join(temporary, BINARY_NAME);
+    if (!fs.existsSync(extracted)) throw new Error(`release archive does not contain ${BINARY_NAME}`);
+    fs.mkdirSync(VENDOR_DIR, { recursive: true });
+    fs.copyFileSync(extracted, BINARY_PATH);
+    fs.chmodSync(BINARY_PATH, 0o755);
+    return BINARY_PATH;
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
+}
+
+module.exports = { ensureBinary, releaseTag, target, assetName };