@yixinkj/priority-buyer-alert-cli 0.1.0

package/index.js

@@ -0,0 +1,905 @@
+#!/usr/bin/env node
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const packageJson = require('./package.json');
+const registry = require('./skills.json');
+
+const VERSION = packageJson.version;
+const SKILL_VERSION = registry.skill.version || VERSION;
+const SKILL_ID = registry.skill.id;
+const SKILL_DISPLAY_NAME = registry.skill.name;
+const RUNTIME_VERSION = registry.runtimeVersion || VERSION;
+const OSS_RELEASE_BASE_URL =
+  `https://broswer-plugs1.oss-cn-beijing.aliyuncs.com/releases/${SKILL_ID}/v${RUNTIME_VERSION}`;
+const R2_RELEASE_BASE_URL =
+  `https://pub-60851fbb424a46c9a15b0ffce2ffea86.r2.dev/releases/${SKILL_ID}/v${RUNTIME_VERSION}`;
+const RUNTIME_MANIFEST_SCHEMA = 'priority_buyer_alert_runtime_manifest_v1';
+const PACKAGE_ROOT = path.dirname(fileURLToPath(import.meta.url));
+// 已发布的包里 `skill/SKILL.md` 由 prepack 生成；直接在源码仓库里跑 index.js 时它不存在，
+// 此时回退到仓库内的 Skill 源文件，避免联调必须先手工执行一次同步脚本。
+// 发布产物中不存在仓库路径，因此这个回退不会让线上包读到仓库副本。
+const PACKED_SKILL_PATH = path.join(PACKAGE_ROOT, 'skill', 'SKILL.md');
+const REPOSITORY_SKILL_PATH = path.join(
+  PACKAGE_ROOT,
+  '..',
+  '..',
+  'skills',
+  'priority-buyer-alert',
+  'SKILL.md'
+);
+const BUNDLED_SKILL_PATH = fs.existsSync(PACKED_SKILL_PATH)
+  ? PACKED_SKILL_PATH
+  : REPOSITORY_SKILL_PATH;
+const SKILL_VERSION_MARKER = `.${SKILL_ID}-version.json`;
+const SKILL_ROOT = path.join(os.homedir(), '.yixin', SKILL_ID);
+const RUNTIME_ROOT = path.join(SKILL_ROOT, 'runtime');
+const VERSION_ROOT = path.join(RUNTIME_ROOT, 'versions', `v${RUNTIME_VERSION}`);
+const BIN_DIR = path.join(VERSION_ROOT, 'bin');
+const INSTALL_MARKER = path.join(VERSION_ROOT, 'installed.json');
+
+function fail(message) {
+  console.error(`[${SKILL_ID}] ${message}`);
+  process.exit(1);
+}
+
+function emitStatus(status, message, details = {}) {
+  console.log(
+    JSON.stringify({ status, message, skill_version: SKILL_VERSION, ...details }, null, 2)
+  );
+}
+
+function parseSkillMetadata(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  if (!match) return {};
+  const metadata = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    const field = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/);
+    if (!field) continue;
+    let value = field[2].trim();
+    if (
+      value.length >= 2 &&
+      ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'")))
+    ) {
+      value = value.slice(1, -1);
+    }
+    metadata[field[1]] = value;
+  }
+  return metadata;
+}
+
+function parseSemver(version) {
+  const match = String(version || '').trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function compareVersions(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a && !b) return 0;
+  if (!a) return -1;
+  if (!b) return 1;
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] < b[index] ? -1 : 1;
+  }
+  return 0;
+}
+
+function extractSkillPath(args) {
+  let skillPath = null;
+  const forwardedArgs = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === '--skill-path') {
+      if (!args[index + 1]) throw new Error('--skill-path 缺少 SKILL.md 路径');
+      skillPath = args[index + 1];
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith('--skill-path=')) {
+      skillPath = arg.slice('--skill-path='.length);
+      continue;
+    }
+    forwardedArgs.push(arg);
+  }
+  return { skillPath, forwardedArgs };
+}
+
+function isHelpRequest(args) {
+  return args.length === 0 || args.some((arg) => arg === '--help' || arg === '-h');
+}
+
+function printHelp() {
+  process.stdout.write(`${SKILL_DISPLAY_NAME} ${SKILL_VERSION}（Runtime ${RUNTIME_VERSION}）
+
+用法：
+  ${SKILL_ID} --skill-path <SKILL.md> --start [扫描选项]
+  ${SKILL_ID} --skill-path <SKILL.md> --poll-run <RUN_ID>
+  ${SKILL_ID} --skill-path <SKILL.md> --run-status <RUN_ID>
+  ${SKILL_ID} --skill-path <SKILL.md> --cancel-run <RUN_ID>
+
+通用：
+  --skill-path <PATH>       本次实际读取的 SKILL.md 绝对路径
+  --version                 显示版本
+  --help                    显示本帮助
+
+扫描选项（仅与 --start 一起使用）：
+  --minutes <N>             回复时限（SLA），默认 30
+  --lookback-hours <N>      只看最近 N 小时内有过消息的询盘，默认 24；0 表示不限
+  --max-pages <N>           翻页上限，每页 100 条，默认 3
+  --levels <LEVELS>         重点买家等级白名单，默认 L1+,L2,L3,L4,L5,L6
+  --re-alert <N>            升级重提间隔；不给则只提醒一次
+  --assignee <NAME>         只看某个负责人
+  --no-strict-bot           关闭机器人核验
+  --verify-all-replied      对全部已回复的重点买家做详情核验
+  --mark                    推进提醒水位；只有心跳式调用才应使用
+
+环境变量：
+  PRIORITY_BUYER_ALERT_DETAIL_CONCURRENCY   详情核验并发度，默认 3，范围 1-8
+
+本 Skill 只读：只提醒，不发送消息、不修改任何页面状态。
+`);
+}
+
+function normalizePath(filePath) {
+  const resolved = path.resolve(filePath);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function stripJsonComments(content) {
+  let output = '';
+  let inString = false;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < content.length; index += 1) {
+    const char = content[index];
+    const next = content[index + 1];
+    if (lineComment) {
+      if (char === '\n') {
+        lineComment = false;
+        output += char;
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (char === '*' && next === '/') {
+        blockComment = false;
+        index += 1;
+      }
+      continue;
+    }
+    if (inString) {
+      output += char;
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      output += char;
+      continue;
+    }
+    if (char === '/' && next === '/') {
+      lineComment = true;
+      index += 1;
+      continue;
+    }
+    if (char === '/' && next === '*') {
+      blockComment = true;
+      index += 1;
+      continue;
+    }
+    output += char;
+  }
+  return output.replace(/,\s*([}\]])/g, '$1');
+}
+
+function readSkillsRegistry(registryPath) {
+  return JSON.parse(stripJsonComments(fs.readFileSync(registryPath, 'utf8')));
+}
+
+function findRegistryEntry(data, skillDir) {
+  const target = normalizePath(skillDir);
+  return data.skills?.find(
+    (entry) => entry.installPath && normalizePath(entry.installPath) === target
+  );
+}
+
+function registryUpdatePreview(skillPath, metadata) {
+  const skillDir = path.dirname(skillPath);
+  const registryPath = path.join(skillDir, '..', 'skills.jsonc');
+  if (!fs.existsSync(registryPath)) {
+    return { registryPath: null, currentVersion: null, changed: false, content: null };
+  }
+  const data = readSkillsRegistry(registryPath);
+  const entry = findRegistryEntry(data, skillDir);
+  if (!entry) {
+    throw new Error(`skills.jsonc 未找到 installPath 对应项：${skillDir}`);
+  }
+  const before = JSON.stringify(entry);
+  const currentVersion = entry.version || null;
+  entry.name = metadata.name;
+  entry.description = metadata.description;
+  entry.version = SKILL_VERSION;
+  return {
+    registryPath,
+    currentVersion,
+    changed: before !== JSON.stringify(entry),
+    content: `${JSON.stringify(data, null, 2)}\n`
+  };
+}
+
+function snapshotFile(filePath) {
+  return fs.existsSync(filePath)
+    ? { exists: true, content: fs.readFileSync(filePath) }
+    : { exists: false, content: null };
+}
+
+function restoreFile(filePath, snapshot) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  if (snapshot.exists) fs.writeFileSync(filePath, snapshot.content);
+  else fs.rmSync(filePath, { force: true });
+}
+
+function readInstalledSkillVersion(skillDir, registryVersion) {
+  const markerPath = path.join(skillDir, SKILL_VERSION_MARKER);
+  try {
+    const marker = JSON.parse(fs.readFileSync(markerPath, 'utf8'));
+    return marker.version || registryVersion || null;
+  } catch {
+    return registryVersion || null;
+  }
+}
+
+/**
+ * 把 npm 包内置的 SKILL.md 同步到当前智能体实际使用的安装位置。
+ * 本地版本更高时拒绝降级；任一校验失败时整体回滚，不留下半个新版 Skill。
+ * @param {string} skillPath 本次实际读取的 SKILL.md 绝对路径。
+ * @param {object} [options] 测试注入的内置文件路径。
+ * @returns {object} 同步结论与版本信息。
+ */
+function syncSkillInstallation(skillPath, { bundledSkillPath = BUNDLED_SKILL_PATH } = {}) {
+  const resolvedSkillPath = path.resolve(skillPath);
+  if (path.basename(resolvedSkillPath).toLowerCase() !== 'skill.md') {
+    throw new Error('--skill-path 必须指向 SKILL.md');
+  }
+  if (!fs.existsSync(resolvedSkillPath)) {
+    throw new Error(`SKILL.md 不存在：${resolvedSkillPath}`);
+  }
+  if (!fs.existsSync(bundledSkillPath)) {
+    throw new Error('npm 包缺少内置 SKILL.md，请重新安装当前版本');
+  }
+
+  const bundledSkill = fs.readFileSync(bundledSkillPath, 'utf8');
+  const bundledMetadata = parseSkillMetadata(bundledSkill);
+  if (!bundledMetadata.name || !bundledMetadata.description) {
+    throw new Error('内置 SKILL.md 缺少 name 或 description');
+  }
+  if (bundledMetadata.name !== SKILL_ID) {
+    throw new Error('内置 SKILL.md 名称不匹配');
+  }
+
+  const currentSkill = fs.readFileSync(resolvedSkillPath, 'utf8');
+  if (parseSkillMetadata(currentSkill).name !== SKILL_ID) {
+    throw new Error(`--skill-path 指向的不是${SKILL_DISPLAY_NAME} Skill，已拒绝覆盖`);
+  }
+
+  const skillDir = path.dirname(resolvedSkillPath);
+  const registryPreview = registryUpdatePreview(resolvedSkillPath, bundledMetadata);
+  const currentVersion = readInstalledSkillVersion(skillDir, registryPreview.currentVersion);
+  if (compareVersions(currentVersion, SKILL_VERSION) > 0) {
+    return {
+      action: 'local_newer',
+      skillPath: resolvedSkillPath,
+      currentVersion,
+      targetVersion: SKILL_VERSION
+    };
+  }
+
+  const markerPath = path.join(skillDir, SKILL_VERSION_MARKER);
+  const markerContent = `${JSON.stringify({ version: SKILL_VERSION }, null, 2)}\n`;
+  const skillChanged = Buffer.from(currentSkill).compare(Buffer.from(bundledSkill)) !== 0;
+  const markerChanged =
+    !fs.existsSync(markerPath) || fs.readFileSync(markerPath, 'utf8') !== markerContent;
+
+  if (!skillChanged && !markerChanged && !registryPreview.changed) {
+    return {
+      action: 'current',
+      skillPath: resolvedSkillPath,
+      currentVersion,
+      targetVersion: SKILL_VERSION,
+      registryPath: registryPreview.registryPath
+    };
+  }
+
+  const snapshots = new Map([
+    [resolvedSkillPath, snapshotFile(resolvedSkillPath)],
+    [markerPath, snapshotFile(markerPath)]
+  ]);
+  if (registryPreview.registryPath) {
+    snapshots.set(registryPreview.registryPath, snapshotFile(registryPreview.registryPath));
+  }
+  try {
+    if (skillChanged) fs.writeFileSync(resolvedSkillPath, bundledSkill);
+    if (markerChanged) fs.writeFileSync(markerPath, markerContent);
+    if (registryPreview.changed) {
+      fs.writeFileSync(registryPreview.registryPath, registryPreview.content);
+    }
+    const writtenMetadata = parseSkillMetadata(fs.readFileSync(resolvedSkillPath, 'utf8'));
+    if (writtenMetadata.name !== bundledMetadata.name) {
+      throw new Error('写入后的 SKILL.md 名称校验失败');
+    }
+    if (JSON.parse(fs.readFileSync(markerPath, 'utf8')).version !== SKILL_VERSION) {
+      throw new Error('写入后的 Skill 版本标记校验失败');
+    }
+    if (registryPreview.registryPath) {
+      const writtenEntry = findRegistryEntry(
+        readSkillsRegistry(registryPreview.registryPath),
+        skillDir
+      );
+      if (
+        !writtenEntry ||
+        writtenEntry.version !== SKILL_VERSION ||
+        writtenEntry.name !== bundledMetadata.name ||
+        writtenEntry.description !== bundledMetadata.description
+      ) {
+        throw new Error('写入后的 skills.jsonc 校验失败');
+      }
+    }
+  } catch (error) {
+    for (const [filePath, snapshot] of snapshots) restoreFile(filePath, snapshot);
+    throw error;
+  }
+
+  return {
+    action: skillChanged ? 'updated' : 'registry_updated',
+    skillPath: resolvedSkillPath,
+    currentVersion,
+    targetVersion: SKILL_VERSION,
+    registryPath: registryPreview.registryPath
+  };
+}
+
+function discoverLegacySkillPaths(homeDir = os.homedir()) {
+  const accountsRoot = path.join(homeDir, '.accio', 'accounts');
+  if (!fs.existsSync(accountsRoot)) return [];
+  const candidates = [];
+  for (const account of fs.readdirSync(accountsRoot, { withFileTypes: true })) {
+    if (!account.isDirectory()) continue;
+    const agentsRoot = path.join(accountsRoot, account.name, 'agents');
+    if (!fs.existsSync(agentsRoot)) continue;
+    for (const agent of fs.readdirSync(agentsRoot, { withFileTypes: true })) {
+      if (!agent.isDirectory()) continue;
+      const registryPath = path.join(
+        agentsRoot,
+        agent.name,
+        'agent-core',
+        'skills',
+        'skills.jsonc'
+      );
+      if (!fs.existsSync(registryPath)) continue;
+      let data;
+      try {
+        data = readSkillsRegistry(registryPath);
+      } catch {
+        continue;
+      }
+      for (const entry of data.skills || []) {
+        if (!entry.installPath) continue;
+        const skillPath = path.join(entry.installPath, 'SKILL.md');
+        if (!fs.existsSync(skillPath)) continue;
+        let content;
+        try {
+          content = fs.readFileSync(skillPath, 'utf8');
+        } catch {
+          continue;
+        }
+        if (
+          content.includes(`@yixinkj/${SKILL_ID}-cli`) ||
+          new RegExp(`^name:\\s*${SKILL_ID}\\s*$`, 'm').test(content)
+        ) {
+          candidates.push(path.resolve(skillPath));
+        }
+      }
+    }
+  }
+  return [...new Set(candidates.map(normalizePath))];
+}
+
+function resolveSkillGate(skillPath, { homeDir = os.homedir(), syncOptions = {} } = {}) {
+  if (skillPath) {
+    const sync = syncSkillInstallation(skillPath, syncOptions);
+    return { allowRun: sync.action === 'current', sync };
+  }
+  const candidates = discoverLegacySkillPaths(homeDir);
+  if (candidates.length !== 1) {
+    return { allowRun: false, sync: { action: 'skill_path_required', candidates } };
+  }
+  const sync = syncSkillInstallation(candidates[0], syncOptions);
+  return {
+    allowRun: false,
+    sync: {
+      ...sync,
+      action: sync.action === 'local_newer' ? 'local_newer' : 'restart_required'
+    }
+  };
+}
+
+function detectTarget() {
+  const platform = registry.platforms[`${process.platform}-${process.arch}`];
+  if (!platform) {
+    const supported = Object.values(registry.platforms)
+      .map((entry) => entry.id)
+      .join('、');
+    throw new Error(
+      `暂不支持当前平台：${process.platform}/${process.arch}。已支持：${supported}。`
+    );
+  }
+  return { ...platform, binaries: [`${registry.skill.bin}-${platform.id}${platform.exe || ''}`] };
+}
+
+/**
+ * 生成业务运行时下载源，固定保持 OSS 主源优先、R2 备用源在后。
+ * @returns {string[]} 已清理、去重并保持优先级的下载根地址。
+ */
+function releaseBaseUrls() {
+  const primary = process.env.PRIORITY_BUYER_ALERT_RELEASE_BASE_URL || OSS_RELEASE_BASE_URL;
+  const fallbacks = process.env.PRIORITY_BUYER_ALERT_FALLBACK_BASE_URLS
+    ? process.env.PRIORITY_BUYER_ALERT_FALLBACK_BASE_URLS.split(',')
+    : process.env.PRIORITY_BUYER_ALERT_RELEASE_BASE_URL
+      ? []
+      : [R2_RELEASE_BASE_URL];
+  return [
+    ...new Set(
+      [primary, ...fallbacks]
+        .filter(Boolean)
+        .map((value) => String(value).trim().replace(/\/$/, ''))
+    )
+  ];
+}
+
+function releaseUrls(target) {
+  return releaseBaseUrls().map((baseUrl) => `${baseUrl}/${target.archive}`);
+}
+
+function runtimeManifestUrls() {
+  return releaseBaseUrls().map((baseUrl) => `${baseUrl}/runtime-manifest.json`);
+}
+
+function runtimeManifestUrl() {
+  return runtimeManifestUrls()[0];
+}
+
+function sha256(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+}
+
+function isInstalled(target) {
+  try {
+    const marker = JSON.parse(fs.readFileSync(INSTALL_MARKER, 'utf8'));
+    return (
+      marker.version === RUNTIME_VERSION &&
+      marker.platform === target.id &&
+      target.binaries.every((name) => {
+        const expected = marker.files?.[name];
+        const filePath = path.join(BIN_DIR, name);
+        return (
+          expected &&
+          fs.existsSync(filePath) &&
+          fs.statSync(filePath).size === expected.size &&
+          sha256(filePath) === expected.sha256
+        );
+      })
+    );
+  } catch {
+    return false;
+  }
+}
+
+function download(url, outputPath, redirects = 5) {
+  return new Promise((resolve, reject) => {
+    const client = url.startsWith('http:') ? http : https;
+    const request = client.get(
+      url,
+      { headers: { 'User-Agent': `@yixinkj/${SKILL_ID}-cli` } },
+      (response) => {
+        if ([301, 302, 303, 307, 308].includes(response.statusCode)) {
+          response.resume();
+          if (!response.headers.location || redirects === 0) {
+            reject(new Error(`下载重定向过多：${url}`));
+            return;
+          }
+          download(
+            new URL(response.headers.location, url).toString(),
+            outputPath,
+            redirects - 1
+          ).then(resolve, reject);
+          return;
+        }
+        if (response.statusCode !== 200) {
+          response.resume();
+          reject(new Error(`下载失败：HTTP ${response.statusCode} ${url}`));
+          return;
+        }
+        const file = fs.createWriteStream(outputPath);
+        response.pipe(file);
+        response.on('aborted', () => {
+          file.destroy();
+          reject(new Error(`下载连接意外中断：${url}`));
+        });
+        response.on('error', (error) => file.destroy(error));
+        file.on('finish', () => file.close(resolve));
+        file.on('error', reject);
+      }
+    );
+    request.setTimeout(60000, () => request.destroy(new Error(`下载超时：${url}`)));
+    request.on('error', reject);
+  });
+}
+
+/**
+ * 从同一个来源成对下载清单和压缩包，并在切换来源前完成版本、平台和 SHA256 校验。
+ * 清单与文件必须同源处理，避免主源清单与备用源文件版本漂移时被错误组合。
+ * @param {object} target 当前平台的归档名称和标识。
+ * @param {string} releaseManifestPath 临时清单文件路径。
+ * @param {string} archivePath 临时运行时归档路径。
+ * @param {object} [options] 下载源和测试注入选项。
+ * @returns {Promise<object>} 与归档同源且已通过校验的运行时清单。
+ */
+async function downloadVerifiedRelease(
+  target,
+  releaseManifestPath,
+  archivePath,
+  { baseUrls = releaseBaseUrls(), downloadFile = download } = {}
+) {
+  const failures = [];
+  for (const baseUrl of baseUrls) {
+    const root = String(baseUrl).trim().replace(/\/$/, '');
+    try {
+      fs.rmSync(releaseManifestPath, { force: true });
+      fs.rmSync(archivePath, { force: true });
+      await downloadFile(`${root}/runtime-manifest.json`, releaseManifestPath);
+      const manifest = JSON.parse(fs.readFileSync(releaseManifestPath, 'utf8'));
+      await downloadFile(`${root}/${target.archive}`, archivePath);
+      verifyReleaseArchive(manifest, target, archivePath);
+      return manifest;
+    } catch (error) {
+      fs.rmSync(releaseManifestPath, { force: true });
+      fs.rmSync(archivePath, { force: true });
+      failures.push(`${root}: ${error.message}`);
+    }
+  }
+  throw new Error(`所有下载源均未通过运行时校验：\n${failures.join('\n')}`);
+}
+
+function verifyReleaseArchive(manifest, target, archivePath) {
+  if (
+    manifest?.schema !== RUNTIME_MANIFEST_SCHEMA ||
+    manifest.runtime_version !== RUNTIME_VERSION
+  ) {
+    throw new Error('公共运行时清单版本与当前启动器不一致');
+  }
+  const expected = manifest.platforms?.[target.id];
+  if (!expected || expected.archive !== target.archive) {
+    throw new Error(`公共运行时清单缺少平台 ${target.id}`);
+  }
+  const stat = fs.statSync(archivePath);
+  if (stat.size !== expected.size || sha256(archivePath) !== expected.sha256) {
+    throw new Error(`公共运行时压缩包校验失败：${target.archive}`);
+  }
+}
+
+function runCommand(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = [result.stderr, result.stdout].filter(Boolean).join('\n').trim();
+    throw new Error(detail || `${command} 退出码为 ${result.status}`);
+  }
+}
+
+function extractArchive(archivePath, destination) {
+  fs.mkdirSync(destination, { recursive: true });
+  if (archivePath.endsWith('.tar.gz')) {
+    runCommand('tar', ['-xzf', archivePath, '-C', destination]);
+    return;
+  }
+  if (archivePath.endsWith('.zip')) {
+    if (process.platform === 'win32') {
+      runCommand('powershell.exe', [
+        '-NoProfile',
+        '-ExecutionPolicy',
+        'Bypass',
+        '-Command',
+        `Expand-Archive -LiteralPath ${JSON.stringify(archivePath)} -DestinationPath ${JSON.stringify(destination)} -Force`
+      ]);
+      return;
+    }
+    runCommand('unzip', ['-q', archivePath, '-d', destination]);
+    return;
+  }
+  throw new Error(`暂不支持的压缩包类型：${archivePath}`);
+}
+
+function verifyExtracted(extractedDir, target) {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(extractedDir, 'checksums.json'), 'utf8')
+  );
+  if (manifest.version !== RUNTIME_VERSION || manifest.platform !== target.id) {
+    throw new Error('下载包版本或平台与当前启动器不一致');
+  }
+  for (const name of target.binaries) {
+    const expected = manifest.files?.[name];
+    const filePath = path.join(extractedDir, name);
+    if (
+      !expected ||
+      !fs.existsSync(filePath) ||
+      fs.statSync(filePath).size !== expected.size ||
+      sha256(filePath) !== expected.sha256
+    ) {
+      throw new Error(`下载包校验失败：${name}`);
+    }
+  }
+  return manifest.files;
+}
+
+function prepareMacBinaries(target) {
+  if (process.platform !== 'darwin') return;
+  for (const name of target.binaries) {
+    const filePath = path.join(BIN_DIR, name);
+    spawnSync('xattr', ['-dr', 'com.apple.quarantine', filePath], { stdio: 'ignore' });
+    runCommand('chmod', ['+x', filePath]);
+  }
+}
+
+async function ensureInstalled(target) {
+  if (isInstalled(target)) {
+    prepareMacBinaries(target);
+    return;
+  }
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), `${SKILL_ID}-install-`));
+  const archivePath = path.join(tempRoot, target.archive);
+  const releaseManifestPath = path.join(tempRoot, 'runtime-manifest.json');
+  const extractedDir = path.join(tempRoot, 'extracted');
+  const stagingRoot = `${VERSION_ROOT}.staging-${process.pid}`;
+  try {
+    await downloadVerifiedRelease(target, releaseManifestPath, archivePath);
+    extractArchive(archivePath, extractedDir);
+    const files = verifyExtracted(extractedDir, target);
+
+    fs.mkdirSync(path.dirname(VERSION_ROOT), { recursive: true });
+    fs.rmSync(stagingRoot, { recursive: true, force: true });
+    fs.mkdirSync(path.join(stagingRoot, 'bin'), { recursive: true });
+    for (const name of target.binaries) {
+      fs.copyFileSync(path.join(extractedDir, name), path.join(stagingRoot, 'bin', name));
+    }
+    fs.writeFileSync(
+      path.join(stagingRoot, 'installed.json'),
+      `${JSON.stringify({ version: RUNTIME_VERSION, platform: target.id, files }, null, 2)}\n`
+    );
+
+    fs.rmSync(VERSION_ROOT, { recursive: true, force: true });
+    fs.renameSync(stagingRoot, VERSION_ROOT);
+    prepareMacBinaries(target);
+  } finally {
+    fs.rmSync(stagingRoot, { recursive: true, force: true });
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+async function ensureSharedBridge() {
+  let manager;
+  try {
+    manager = await import('@yixinkj/yixin-bridge-cli');
+  } catch (error) {
+    throw new Error(`缺少共享译心桥管理器 @yixinkj/yixin-bridge-cli：${error.message}`);
+  }
+  const result = await manager.ensureBridgeRuntime({ minVersion: registry.bridge.minVersion });
+  if (!result?.bridge_path || !fs.existsSync(result.bridge_path)) {
+    throw new Error('共享译心桥安装完成后未返回有效运行路径');
+  }
+  validateBridgeCapabilities(result, registry.bridge.requiredCapabilities || []);
+  return result;
+}
+
+/**
+ * 校验当前共享桥是否具备本 Skill 的硬依赖能力。
+ * @param {object} result 共享桥管理器返回的运行时信息。
+ * @param {string[]} requiredCapabilities 本 Skill 声明的能力白名单。
+ * @returns {object} 校验通过后的原始运行时信息。
+ */
+function validateBridgeCapabilities(result, requiredCapabilities) {
+  const missing = requiredCapabilities.filter(
+    (capability) => !result.capabilities?.includes(capability)
+  );
+  if (missing.length > 0) {
+    // 具体 Skill 只校验自己声明的能力，避免无关运行时能力成为全局硬依赖。
+    throw new Error(`共享译心桥缺少必要能力：${missing.join(', ')}`);
+  }
+  return result;
+}
+
+/**
+ * 把共享管理器的底层插件状态转换为用户可理解的有限提示。
+ * @param {object | null} sharedBridge 共享桥管理器返回的安装和插件状态。
+ * @returns {object | null} 需要展示的提示结构；无需提示时返回空值。
+ */
+function browserExtensionNotice(sharedBridge) {
+  if (!sharedBridge) return null;
+  const reloadStatus = sharedBridge.extension_reload?.status || 'not_requested';
+  const details = {
+    extension_version: sharedBridge.extension_version || null,
+    extension_path: sharedBridge.extension_path || null,
+    reload_status: reloadStatus
+  };
+  if (sharedBridge.extension_updated) {
+    return reloadStatus === 'reloaded'
+      ? {
+          ...details,
+          status: 'updated_reloaded',
+          message: `浏览器插件已更新至 ${details.extension_version || '最新版'}，并已自动重新加载。`
+        }
+      : {
+          ...details,
+          status: 'manual_reload_required',
+          message: `浏览器插件已更新至 ${details.extension_version || '最新版'}，但未能自动重新加载。请在 Chrome 扩展管理页手动重新加载。`
+        };
+  }
+  if (reloadStatus === 'active_tasks_present') {
+    return {
+      ...details,
+      status: 'update_deferred',
+      message: '检测到浏览器插件更新，但当前仍有采集任务，已暂缓更新。任务结束后请重新运行。'
+    };
+  }
+  if (reloadStatus === 'daemon_status_unavailable') {
+    return {
+      ...details,
+      status: 'update_deferred',
+      message: '检测到浏览器插件更新，但暂时无法确认浏览器任务状态，未自动替换。请稍后重新运行。'
+    };
+  }
+  return null;
+}
+
+function emitBrowserExtensionNotice(sharedBridge) {
+  const notice = browserExtensionNotice(sharedBridge);
+  if (!notice) return;
+  // 原生 CLI 的 stdout 是机器解析的 JSON，因此提示只能写 stderr。
+  console.error(`[${SKILL_ID}] ${notice.message}`);
+  if (notice.extension_path) {
+    console.error(`[${SKILL_ID}] 浏览器插件本地路径：${notice.extension_path}`);
+  }
+}
+
+async function main() {
+  const rawArgs = process.argv.slice(2);
+  if (isHelpRequest(rawArgs)) {
+    printHelp();
+    return;
+  }
+  const { skillPath, forwardedArgs } = extractSkillPath(rawArgs);
+  if (forwardedArgs.length === 1 && ['--version', '-V', '-v'].includes(forwardedArgs[0])) {
+    console.log(`${SKILL_ID} ${SKILL_VERSION} (runtime ${RUNTIME_VERSION})`);
+    return;
+  }
+
+  console.error(`[${SKILL_ID}] ${SKILL_DISPLAY_NAME} ${SKILL_VERSION}`);
+  const gate = resolveSkillGate(skillPath);
+  if (!gate.allowRun) {
+    if (gate.sync.action === 'local_newer') {
+      emitStatus(
+        'skill_version_conflict',
+        `当前 Skill 版本 ${gate.sync.currentVersion} 高于 npm 版本 ${SKILL_VERSION}，已停止运行，未执行降级。`,
+        { skill_path: gate.sync.skillPath }
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (gate.sync.action === 'skill_path_required') {
+      emitStatus(
+        'skill_path_required',
+        '无法唯一确定当前智能体的 SKILL.md。请使用本次读取的 SKILL.md 绝对路径重新运行；本次未执行扫描。',
+        { candidates: gate.sync.candidates }
+      );
+      return;
+    }
+    emitStatus(
+      'skill_updated',
+      `${SKILL_DISPLAY_NAME}已更新至 ${SKILL_VERSION}。请重新试一次，本次不执行扫描。`,
+      {
+        skill_path: gate.sync.skillPath,
+        previous_version: gate.sync.currentVersion || null,
+        skills_registry: gate.sync.registryPath || null,
+        restart_required: true
+      }
+    );
+    return;
+  }
+
+  const runtimeOverride = process.env.PRIORITY_BUYER_ALERT_RUNTIME_BINARY;
+  if (runtimeOverride) {
+    const binary = path.resolve(runtimeOverride);
+    if (!fs.existsSync(binary)) throw new Error(`开发运行时不存在：${binary}`);
+    const result = spawnSync(binary, forwardedArgs, {
+      stdio: 'inherit',
+      windowsHide: true,
+      env: process.env
+    });
+    if (result.error) throw result.error;
+    process.exitCode = result.status ?? 1;
+    return;
+  }
+
+  const target = detectTarget();
+  const [sharedBridge] = await Promise.all([ensureSharedBridge(), ensureInstalled(target)]);
+  emitBrowserExtensionNotice(sharedBridge);
+  const result = spawnSync(path.join(BIN_DIR, target.binaries[0]), forwardedArgs, {
+    stdio: 'inherit',
+    windowsHide: true,
+    env: { ...process.env, YIXIN_BRIDGE_BIN: sharedBridge.bridge_path }
+  });
+  if (result.error) throw result.error;
+  process.exitCode = result.status ?? 1;
+}
+
+function isDirectExecution() {
+  if (!process.argv[1]) return false;
+  let invoked = path.resolve(process.argv[1]);
+  let current = fileURLToPath(import.meta.url);
+  try {
+    invoked = fs.realpathSync(invoked);
+    current = fs.realpathSync(current);
+  } catch {
+    // 某些文件系统无法解析符号链接时使用绝对路径比较。
+  }
+  return process.platform === 'win32'
+    ? invoked.toLowerCase() === current.toLowerCase()
+    : invoked === current;
+}
+
+if (isDirectExecution()) {
+  main().catch((error) => fail(error.message));
+}
+
+export {
+  BIN_DIR,
+  BUNDLED_SKILL_PATH,
+  RUNTIME_VERSION,
+  RUNTIME_ROOT,
+  SKILL_ROOT,
+  SKILL_VERSION,
+  VERSION_ROOT,
+  browserExtensionNotice,
+  compareVersions,
+  detectTarget,
+  discoverLegacySkillPaths,
+  downloadVerifiedRelease,
+  extractSkillPath,
+  isHelpRequest,
+  isInstalled,
+  parseSkillMetadata,
+  releaseUrls,
+  resolveSkillGate,
+  runtimeManifestUrl,
+  runtimeManifestUrls,
+  syncSkillInstallation,
+  validateBridgeCapabilities,
+  verifyReleaseArchive
+};

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@yixinkj/priority-buyer-alert-cli",
+  "version": "0.1.0",
+  "description": "重点买家未回复预警独立启动器，只读扫描询盘并提醒，不发送任何消息。",
+  "type": "module",
+  "bin": {
+    "priority-buyer-alert": "index.js"
+  },
+  "scripts": {
+    "test": "node --test index.test.js",
+    "prepack": "node scripts/sync-skill-assets.mjs",
+    "postpack": "node scripts/clean-skill-assets.mjs"
+  },
+  "files": [
+    "index.js",
+    "skills.json",
+    "skill"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@yixinkj/yixin-bridge-cli": "^1.0.6"
+  },
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/skill/SKILL.md

@@ -0,0 +1,112 @@
+---
+name: priority-buyer-alert
+description: 重点买家未回复预警。只读扫描阿里国际站询盘列表，挑出 L2 及以上（出口通店铺为 L1+）的重点买家，判断买家最后一句是否超过 SLA 仍没有真人业务员回复，并输出中文预警清单；机器人自动接待不算人工回复。Use when 用户要求检查重点买家有没有超时未回复、查询盘超时提醒、看 L3/L4 有没有快凉的，或要求运行重点买家预警。
+version: "0.1.0"
+---
+
+# 重点买家预警
+
+## 必须遵守
+
+- 本 Skill 只读：只提醒，永不替人发消息、不改负责人、不改询盘状态、不提交任何表单。
+- 只使用下方 npm CLI、统一授权和共享译心桥；不调用其他浏览器代理，不扫描工作区。
+- 预警成立的唯一口径由 CLI 判定，模型不得自行改写：买家最后一句之后没有真人业务员回复，且等待时间严格超过 SLA。
+- 机器人自动接待和系统通知都不算人工回复。
+- 缺买家等级的询盘不算重点、不冒泡，只计入数据提醒。
+- 计数、排序和等待分钟数全部使用 CLI 产物，禁止模型自行统计或估算。
+- 没有预警时必须明确说明当前范围内没有超时未回复的重点买家，不得编造。
+
+## 运行入口
+
+```bash
+npx -y @yixinkj/priority-buyer-alert-cli@latest \
+  --skill-path "本次实际读取的 SKILL.md 绝对路径" \
+  --start
+```
+
+启动成功后立即记录返回的 `run_id`，此后只用同一个 `run_id` 轮询，不要再次执行 `--start`。
+
+常用参数（都只能与 `--start` 一起使用）：
+
+- `--minutes 30`：SLA，超过多少分钟没有人工回复算超时。默认 30，严格大于才触发。
+- `--lookback-hours 24`：只看最近多少小时内有过消息的询盘。默认 24。询盘列表按最近联系时间倒序，因此翻到某页最旧一行早于窗口就可以安全停止，心跳通常只读一页。传 0 表示不按时间停止翻页。
+- `--max-pages 3`：翻页上限，每页 100 条，给忙店铺兜底。
+- `--levels "L2,L3,L4"`：收紧重点等级。不传时默认 `L1+,L2,L3,L4,L5,L6`，即「等级存在且高于 L1」，金品店铺和出口通店铺都适用。
+- `--assignee "业务员名"`：只看某个负责人。
+- `--re-alert 30`：仍未回复时每隔多少分钟升级重提。不传表示同一轮等待只提醒一次。
+- `--mark`：推进提醒水位与升级计数。只有无人值守的心跳式调用才使用；人工查看不要带。
+- `--verify-all-replied`：对全部「末条是我方发出」的重点买家都做详情核验，更慢更全。
+
+### 关于买家等级
+
+- 金品店铺可以看到真实档 L1–L6。
+- 出口通店铺被阿里统一脱敏，L1 以上一律显示为整体值 `L1+`，采集端无法还原真实档。
+- 默认白名单同时包含 `L1+` 和 L2–L6，因此不需要先判断店铺套餐。显式传 `--levels` 时按值精确匹配，`L1+` 必须原样带引号传入。
+
+## 轮询
+
+按返回的 `poll_after_seconds` 静默轮询，不逐条播报进度：
+
+```bash
+npx -y @yixinkj/priority-buyer-alert-cli@latest \
+  --skill-path "本次实际读取的 SKILL.md 绝对路径" \
+  --poll-run "run_id"
+```
+
+- `scanning`、`verifying`：继续轮询同一个 `run_id`。
+- exit 124 或前台超时：继续轮询同一个 `run_id`，不要重启任务。
+- `completed`：读取 `artifacts.digest` 交付。
+
+查看但不推进：`--run-status "run_id"`。用户明确要求停止时：`--cancel-run "run_id"`。
+
+## 交付
+
+读取 `artifacts.digest` 指向的 Markdown 文件，按其内容向用户转述：
+
+- 没有预警时只说明本轮扫描范围和「没有超时未回复的重点买家」。
+- 有预警时按文件已有顺序逐条转述：谁的（负责人）、哪个买家和国家、哪一档等级、已等待多久、买家最后那句话。顺序已按等级和等待时长排好，不要重排。
+- 语气是「这条重点客户该接了」，不是追责。`提醒次数` 达到 3 次以上时可以建议同步主管。
+- 每条可以顺带提议起草回复，但只建议、不替发。
+- 文件末尾的「数据提醒」如实转述，不要把没抓到等级的询盘当成重点买家。其中「没能取回买家资料」和「因超过单轮核验上限没有核验」都意味着本轮结论没有覆盖这些询盘，不能说成「已确认没有风险」。
+- 「盲区大小」那一条是当前等级口径没有覆盖的等待买家数量。如实转述，但不要据此自行把它们当作预警冒泡。
+- 不输出原始 JSON、绝对路径、买家邮箱电话或任何 token。
+
+## 定时与推送
+
+本 Skill 不自建定时任务，也不自己发消息到任何群。无人值守时由你按固定间隔（建议取 SLA 的三分之一到二分之一，例如 SLA 30 分钟就每 10–15 分钟一次）执行下面这条心跳命令：
+
+```bash
+npx -y @yixinkj/priority-buyer-alert-cli@latest \
+  --skill-path "本次实际读取的 SKILL.md 绝对路径" \
+  --start --minutes 30 --re-alert 30 --mark
+```
+
+心跳必须带 `--mark`，否则同一条会每轮重复提醒。轮询到 `completed` 后：
+
+- `summary.alerts_reported == 0`：本轮没有需要冒泡的重点买家，**静默结束，不要推送任何消息**，也不要向用户汇报「本次没有预警」。
+- `summary.alerts_reported > 0`：读取 `artifacts.digest`，把预警明细整理成一条中文消息推送到钉钉或飞书群。
+
+推送消息的要求：
+
+- 一条消息里按 digest 已有顺序列全，不要拆成多条刷屏、不要重排。
+- 每条包含负责人、买家和国家、等级、已等待分钟数、买家最后那句话。
+- 提醒次数 ≥ 3 的单独标出并建议同步主管。
+- 不要把 `数据提醒` 里的采集问题推给业务群；那属于运维信息，只在用户主动询问时说明。
+- 推送失败时如实报告失败，不要重复推送同一批预警；水位已经推进过，重复触发只会造成漏报错觉。
+
+## 异常
+
+- `authorization_failed`：停止并提示用户先完成译心授权。
+- `bridge_offline`：停止并提示用户打开浏览器、确认译心插件已连接后重试。
+- `login_required`：停止本轮，提示用户在浏览器重新登录后重跑；不得读取旧产物反推结论。
+- `account_risk_detected`：停止并提示用户先在页面完成安全校验。
+- `browser_profile_ambiguous`：请用户只保留目标 Profile 已连接，或只在目标 Profile 打开消息中心后重试。
+- `browser_profile_unavailable`、`browser_tab_closed`：请用户打开阿里国际站消息中心页面后重试。
+- `account_switched`：硬停止，禁止跨账号继续。
+- `schema_changed`：停止，不猜字段、不改用其他入口，如实告知页面结构已变化。
+- `run_schema_outdated`：该 `run_id` 是旧版本 CLI 创建的，不能继续推进。重新执行一次 `--start` 取得新的 `run_id`，不要修改或删除本地任何状态文件。
+- 浏览器插件已更新但需要手动加载时，把 CLI 返回的 `extension_path` 渲染为 `[打开浏览器插件目录](<绝对路径>)` 可点击链接。
+- `skill_updated`：只回复「重点买家预警已更新，请重新试一次。」并结束。
+- npm 返回 `ETARGET` 或 `No matching version found` 时，只执行一次 `npm view @yixinkj/priority-buyer-alert-cli dist-tags versions --json --prefer-online`，再用原参数重跑一次；仍失败则停止，不猜版本、不降级。
+- 其他失败只转述 CLI 的 `error_code` 和 `message`，不自行寻找替代入口。
+- 心跳模式下发生任何错误：停止本轮并如实上报，不要退化成推送旧结果，也不要把失败当成「没有预警」。

package/skills.json

@@ -0,0 +1,31 @@
+{
+  "runtimeVersion": "0.1.0",
+  "platforms": {
+    "darwin-arm64": {
+      "id": "mac-arm64",
+      "archive": "priority-buyer-alert-mac-arm64.tar.gz",
+      "exe": ""
+    },
+    "darwin-x64": {
+      "id": "mac-x64",
+      "archive": "priority-buyer-alert-mac-x64.tar.gz",
+      "exe": ""
+    },
+    "win32-x64": {
+      "id": "win32-x64",
+      "archive": "priority-buyer-alert-win32-x64.zip",
+      "exe": ".exe"
+    }
+  },
+  "bridge": {
+    "package": "@yixinkj/yixin-bridge-cli",
+    "minVersion": "1.0.6",
+    "requiredCapabilities": ["frame_url_v1"]
+  },
+  "skill": {
+    "name": "重点买家预警",
+    "id": "priority-buyer-alert",
+    "version": "0.1.0",
+    "bin": "priority-buyer-alert-cli"
+  }
+}