@yottameta/yotta-dev-mcp 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## v0.2.3 (2026-10-01)
+
+- 安装器卫生批次：`bin/install.js` / `install.sh` 统一（未知参数报错 exit 2、`--help` / `--version`、残留清理白名单、嵌套载荷保留）；由模板单一真源渲染，接入漂移门禁。
+- `--global` 不再强制 `--yes`（统一安装器口径）；`--dry-run` 保留。
+
 ## v0.2.2 (2026-09-26)
 
 新增工具分组 `--tools core|full`（与元忆同口径），供需要把工具表常驻上下文的宿主使用。

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: yotta-dev-mcp
 description: 元开（yotta-dev-mcp）—— 本地、确定性的开发工具 MCP，把只读默认的开发能力暴露为 stdio MCP server：repo_map / system_model / architecture_review / impact_analysis / verify_change / self_test / run_adapter / find_code / compress_output / review_code / review_diff / mcp_doctor / scan_secrets / scan_dependencies / check_publish_readiness / run_checks / scaffold_skill / workflow_state。触发：让 AI 在陌生项目里先做结构盘点、构建系统模型或架构契约（.yotta/architecture.json）、按契约评审架构、分析改动影响锥与回归面、按验证阶梯产出证据账本、对元开自身做完整性 / 反证自测、探测或显式运行 import-linter / dependency-cruiser / Repomix 可选适配器、定位代码、评审改动、扫描密钥/依赖、检查发布就绪、运行白名单检查、生成脚手架或读取 .workflow 状态时；或用户说 元开 / 开发能力 MCP / yotta-dev-mcp / 代码库地图 / 系统模型 / 架构契约 / 架构评审 / 影响分析 / 验证账本 / 反证自测 / 代码评审 MCP / 适配器 等。边界：Python 3.8+ 标准库、离线默认；除 run_checks（显式 allow_execute）、verify_change 的 L2-L4 策略检查（显式 allow_execute）与 self_test 的测试子集（显式 allow_execute）、run_adapter 的 action=run（显式 allow_execute）、scaffold_skill / workflow_state 的显式 apply 外均为只读；不上传源码、不自动修改、不提交、不联网查询包是否存在、不自动安装或下载适配器。
-version: 0.2.2
+version: 0.2.3
 license: MIT
 ---
 

package/bin/install.js

@@ -1,46 +1,92 @@
 #!/usr/bin/env node
 /**
- * yotta-dev-mcp installer.
+ * yotta-dev-mcp 跨平台安装器（YottaSkills）
  *
- * Safe defaults:
- *   --agent <name>  install to one agent's user-level skill directory
- *   --dir <path>    install to an explicit skill directory
- *   --list          print the supported agent directory map
- *   --global        install to all known user-level directories, requires --yes
- *   --dry-run       print the target without writing
+ * 用法:
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install --agent <name>   # 按智能体默认用户级目录安装（推荐）
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install --dir <path>     # 装到指定目录（用户改了目录的智能体）
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install -g               # 安装到全部已知智能体用户级目录
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install                  # 安装到检测到的项目级目录
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install --list           # 列出智能体 -> 默认目录
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install --dry-run        # 只显示将写入的目标，不写文件
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install --version        # 显示版本
+ *   npx -y --package @yottameta/yotta-dev-mcp yotta-dev-mcp-install --help           # 显示帮助
+ *
+ * 退出码: 0 成功 / 1 安装失败 / 2 用法错误 / 4 目标错误
  */
 'use strict';
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
+const os = require('os');
 
 const SKILL_NAME = 'yotta-dev-mcp';
 const PKG_ROOT = path.join(__dirname, '..');
+
+// 顶层开发文件 / 目录：只在安装包顶层跳过；技能包内嵌套同名载荷必须保留。
+// 与 install.sh 同口径：开发件与运行时不相关目录一律不落目标。
+const TOP_SKIP = [
+  'package.json', 'package-lock.json', 'bin', 'lib', 'test',
+  '.github', '.git', '.gitignore', '.npmignore', '.gitattributes',
+  '.yotta', '.tmp', 'install.sh', 'node_modules',
+];
+const TOP_SKIP_SET = new Set(TOP_SKIP);
+// 缓存 / 编译产物：任意层级跳过，安装时同样清理。
+const CACHE_DIRS = new Set(['__pycache__', '.pytest_cache', '.mypy_cache']);
+
+class UsageError extends Error {}
+class TargetError extends Error {}
+class InstallError extends Error {}
+
+// 智能体 -> 用户级默认技能目录（dirs 按优先级排列；--agent 装到第一个）
+// 依据官方文档：.agents/skills 并非通用目录，被 OpenCode / Cursor / Cline / Amp /
+// Kimi / Gemini CLI / GitHub Copilot 等读取；Claude Code 与 Codex 默认不读 .agents。
 const AGENT_DIRS = {
-  claude: { label: 'Claude Code', dirs: ['.claude/skills'] },
-  cursor: { label: 'Cursor', dirs: ['.cursor/skills', '.agents/skills'] },
-  codex: { label: 'Codex', dirs: ['.codex/skills'] },
-  gemini: { label: 'Gemini CLI', dirs: ['.gemini/skills', '.agents/skills'] },
-  goose: { label: 'Goose', dirs: ['.config/goose/skills', '.agents/skills'] },
-  amp: { label: 'Amp', dirs: ['.config/agents/skills', '.agents/skills'] },
-  opencode: { label: 'OpenCode', dirs: ['.config/opencode/skills'] },
-  windsurf: { label: 'Windsurf', dirs: ['.codeium/windsurf/skills'] },
-  workbuddy: { label: 'WorkBuddy', dirs: ['.workbuddy/skills'] },
-  kiro: { label: 'Kiro', dirs: ['.kiro/skills'] },
-  trae: { label: 'Trae Code CLI', dirs: ['.traecli/skills'] },
-  'trae-cn': { label: 'Trae IDE', dirs: ['.trae-cn/skills'] },
-  qwen: { label: 'Qwen Code', dirs: ['.qwen/skills'] },
-  comate: { label: 'Comate', dirs: ['.comate/skills'] },
-  codebuddy: { label: 'CodeBuddy Code', dirs: ['.codebuddy/skills'] },
-  kimi: { label: 'Kimi Code CLI', dirs: ['.kimi/skills'] },
-  agents: { label: 'AGENTS.md', dirs: ['.agents/skills'] },
+  claude:    { label: 'Claude Code',      dirs: ['.claude/skills'] },
+  cursor:    { label: 'Cursor',           dirs: ['.cursor/skills', '.agents/skills'] },
+  codex:     { label: 'Codex',            dirs: ['.codex/skills'] }, // 特判：$CODEX_HOME/skills
+  gemini:    { label: 'Gemini CLI',       dirs: ['.gemini/skills', '.agents/skills'] },
+  goose:     { label: 'Goose',            dirs: ['.config/goose/skills', '.agents/skills'] },
+  amp:       { label: 'Amp',              dirs: ['.config/agents/skills', '.agents/skills'] },
+  opencode:  { label: 'OpenCode',         dirs: ['.config/opencode/skills'] }, // 特判：$XDG_CONFIG_HOME
+  windsurf:  { label: 'Windsurf',         dirs: ['.codeium/windsurf/skills'] },
+  workbuddy: { label: 'WorkBuddy',        dirs: ['.workbuddy/skills'] },
+  kiro:      { label: 'Kiro',             dirs: ['.kiro/skills'] },
+  trae:      { label: 'Trae Code CLI',    dirs: ['.traecli/skills'] },
+  'trae-cn': { label: 'Trae IDE（国内）',  dirs: ['.trae-cn/skills'] },
+  qwen:      { label: 'Qwen Code',        dirs: ['.qwen/skills'] },
+  comate:    { label: 'Comate 文心快码',   dirs: ['.comate/skills'] },
+  codebuddy: { label: 'CodeBuddy Code',   dirs: ['.codebuddy/skills'] },
+  kimi:      { label: 'Kimi Code CLI',    dirs: ['.kimi/skills'] },
+  agents:    { label: '通用 AGENTS.md',    dirs: ['.agents/skills'] },
 };
 
+const PROJECT_DIRS = [
+  '.claude/skills',
+  '.cursor/skills',
+  '.codex/skills',
+  '.config/goose/skills',
+  '.config/agents/skills',
+  '.opencode/skills',
+  '.codeium/windsurf/skills',
+  '.workbuddy/skills',
+  '.kiro/skills',
+  '.traecli/skills',
+  '.gemini/skills',
+  '.trae-cn/skills',
+  '.qwen/skills',
+  '.comate/skills',
+  '.codebuddy/skills',
+  '.kimi/skills',
+  '.agents/skills',
+];
+
+// Codex 用户级目录特判：优先 $CODEX_HOME/skills，否则 ~/.codex/skills
 function codexUserDir() {
   const base = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
   return path.join(base, 'skills');
 }
 
+// OpenCode 用户级目录特判：优先 $XDG_CONFIG_HOME/opencode/skills，否则 ~/.config/opencode/skills
 function opencodeUserDir() {
   const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
   return path.join(base, 'opencode', 'skills');
@@ -52,91 +98,239 @@ function resolveUserDir(rel) {
   return path.join(os.homedir(), rel);
 }
 
-function shouldSkip(name) {
-  return name === 'package.json' || name === 'bin' || name === 'node_modules' ||
-    name === '.git' || name === '__pycache__' || name.indexOf('test_') === 0 ||
-    name.endsWith('.pyc') || name.endsWith('.pyo');
+function displayDir(rel) {
+  if (process.platform === 'win32') return '%USERPROFILE%\\' + rel.replace(/\//g, '\\');
+  return '~/' + rel;
+}
+
+function skillVersion() {
+  try {
+    const data = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8'));
+    return data.version || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function usage() {
+  console.log(SKILL_NAME + ' 安装器（YottaSkills）');
+  console.log('');
+  console.log('用法:');
+  console.log('  node bin/install.js --agent <name>   按智能体默认用户级目录安装（推荐）');
+  console.log('  node bin/install.js --dir <path>     装到指定目录（用户改了目录的智能体）');
+  console.log('  node bin/install.js -g               安装到全部已知智能体用户级目录');
+  console.log('  node bin/install.js                  安装到检测到的项目级目录');
+  console.log('');
+  console.log('参数:');
+  console.log('  --agent <name>  智能体键名，见 --list');
+  console.log('  --dir <path>    自定义技能目录');
+  console.log('  -g, --global    安装到全部已知用户级目录');
+  console.log('  --list, -l      列出支持的智能体目录');
+  console.log('  --dry-run       只显示将写入的目标，不写文件');
+  console.log('  --version, -v   显示版本');
+  console.log('  --help, -h      显示帮助');
+  console.log('  --yes, -y       兼容参数（-g 不再强制要求）');
+  console.log('');
+  console.log('退出码: 0 成功 / 1 安装失败 / 2 用法错误 / 4 目标错误');
 }
 
-function copyDir(source, target) {
-  fs.mkdirSync(target, { recursive: true });
-  for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
-    if (shouldSkip(entry.name)) continue;
-    const sourcePath = path.join(source, entry.name);
-    const targetPath = path.join(target, entry.name);
+function parseArgs(argv) {
+  const opts = { help: false, version: false, list: false, global: false, dryRun: false, yes: false, dir: null, agent: null };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--help' || arg === '-h') opts.help = true;
+    else if (arg === '--version' || arg === '-v') opts.version = true;
+    else if (arg === '--list' || arg === '-l') opts.list = true;
+    else if (arg === '--global' || arg === '-g') opts.global = true;
+    else if (arg === '--dry-run') opts.dryRun = true;
+    else if (arg === '--yes' || arg === '-y') opts.yes = true;
+    else if (arg === '--dir') {
+      const value = argv[++i];
+      if (!value) throw new UsageError('--dir 需要一个非空路径');
+      opts.dir = value;
+    } else if (arg === '--agent') {
+      const value = argv[++i];
+      if (!value) throw new UsageError('--agent 需要一个非空名称');
+      opts.agent = String(value).toLowerCase();
+    } else {
+      throw new UsageError('未知参数: ' + arg);
+    }
+  }
+  if (!opts.help && !opts.version) {
+    const selected = [opts.dir, opts.agent, opts.global].filter(Boolean).length;
+    if (selected > 1) throw new UsageError('--dir / --agent / -g 只能选一个');
+  }
+  return opts;
+}
+
+function printList() {
+  console.log('智能体 -> 默认技能目录（--agent <name> 装到第一个，用户级）:');
+  for (const [key, value] of Object.entries(AGENT_DIRS)) {
+    const resolved = value.dirs.map(displayDir);
+    console.log('  ' + key.padEnd(10) + value.label.padEnd(18) + resolved.join('、'));
+  }
+  console.log('\n说明：Windows 用 %USERPROFILE%，Linux/macOS 用 ~；仅收录有官方默认目录的智能体。');
+  console.log('改了目录的请用 --dir <路径>，不要依赖默认位置；若设置了 CODEX_HOME / XDG_CONFIG_HOME，安装自动以该变量为准。');
+}
+
+function assertSafeTarget(target) {
+  const rel = path.relative(PKG_ROOT, target);
+  if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel))) {
+    throw new UsageError('目标目录不能在技能源目录内（防止自装自毁）');
+  }
+}
+
+function shouldSkipCache(name, isFile) {
+  if (CACHE_DIRS.has(name)) return true;
+  if (isFile && (name.endsWith('.pyc') || name.endsWith('.pyo'))) return true;
+  return false;
+}
+
+function copyDir(src, dst, topLevel) {
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    // 只跳过安装包顶层开发文件；template/ 等嵌套同名载荷必须保留。
+    if (topLevel && TOP_SKIP_SET.has(entry.name)) continue;
+    if (shouldSkipCache(entry.name, entry.isFile())) continue;
+    const s = path.join(src, entry.name);
+    const d = path.join(dst, entry.name);
     if (entry.isDirectory()) {
-      copyDir(sourcePath, targetPath);
+      fs.mkdirSync(d, { recursive: true });
+      copyDir(s, d, false);
     } else if (entry.isFile()) {
-      fs.copyFileSync(sourcePath, targetPath);
+      fs.copyFileSync(s, d);
     }
   }
 }
 
-function installTo(directory, dryRun) {
-  const target = path.join(directory, SKILL_NAME);
-  if (dryRun) {
-    console.log('[dry-run] install -> ' + target);
-    return;
+// 清理旧版安装残留（fail-closed 白名单）：
+// 仅在目标目录已存在且含 SKILL.md 时触发；只删顶层开发项 + 任意层级缓存；
+// 不整目录删除、不跟随符号链接。
+function cleanResidue(target) {
+  const removed = [];
+  let stat = null;
+  try { stat = fs.statSync(target); } catch (_) { return removed; }
+  if (!stat.isDirectory()) return removed;
+  if (!fs.existsSync(path.join(target, 'SKILL.md'))) return removed;
+  for (const name of TOP_SKIP) {
+    const p = path.join(target, name);
+    let entry = null;
+    try { entry = fs.lstatSync(p); } catch (_) { continue; }
+    if (entry.isSymbolicLink()) continue;
+    fs.rmSync(p, { recursive: true, force: true });
+    removed.push(name);
   }
-  copyDir(PKG_ROOT, target);
-  console.log('installed -> ' + target);
+  const walk = (dir) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const p = path.join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (CACHE_DIRS.has(entry.name)) {
+          fs.rmSync(p, { recursive: true, force: true });
+          removed.push(path.relative(target, p));
+        } else {
+          walk(p);
+        }
+      } else if (entry.isFile() && (entry.name.endsWith('.pyc') || entry.name.endsWith('.pyo'))) {
+        fs.unlinkSync(p);
+        removed.push(path.relative(target, p));
+      }
+    }
+  };
+  walk(target);
+  return removed;
 }
 
-function displayDir(rel) {
-  if (process.platform === 'win32') return '%USERPROFILE%\\' + rel.replace(/\//g, '\\');
-  return '~/' + rel;
+function installTo(dest, opts) {
+  if (!dest || typeof dest !== 'string') throw new UsageError('目标目录不能为空');
+  const target = path.resolve(dest, SKILL_NAME);
+  assertSafeTarget(target);
+  if (opts.dryRun) {
+    console.log('[dry-run] 将安装到 -> ' + target);
+    return target;
+  }
+  try {
+    for (const rel of cleanResidue(target)) console.log('已清理残留: ' + rel);
+    fs.mkdirSync(target, { recursive: true });
+    copyDir(PKG_ROOT, target, true);
+    if (!fs.existsSync(path.join(target, 'SKILL.md'))) {
+      throw new InstallError('安装结果缺少 SKILL.md');
+    }
+  } catch (err) {
+    if (err instanceof UsageError || err instanceof TargetError || err instanceof InstallError) throw err;
+    throw new InstallError('安装到 ' + target + ' 失败: ' + err.message);
+  }
+  console.log('installed -> ' + target);
+  return target;
 }
 
-function main() {
-  const args = process.argv.slice(2);
-  const dryRun = args.indexOf('--dry-run') !== -1;
-  const yes = args.indexOf('--yes') !== -1 || args.indexOf('-y') !== -1;
-  const list = args.indexOf('--list') !== -1 || args.indexOf('-l') !== -1;
-  const global = args.indexOf('-g') !== -1 || args.indexOf('--global') !== -1;
-  const dirIndex = args.indexOf('--dir');
-  const agentIndex = args.indexOf('--agent');
-  const explicitDir = dirIndex !== -1 ? args[dirIndex + 1] : null;
-  const agent = agentIndex !== -1 ? String(args[agentIndex + 1]).toLowerCase() : null;
-
-  if (list) {
-    for (const [key, value] of Object.entries(AGENT_DIRS)) {
-      console.log('  ' + key.padEnd(10) + value.label.padEnd(18) +
-        value.dirs.map(displayDir).join(', '));
+function run() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.help) { usage(); return; }
+  if (opts.version) {
+    const version = skillVersion();
+    if (!version) {
+      console.error(SKILL_NAME + ' 版本未知（未找到 package.json）');
+      process.exitCode = 1;
+      return;
     }
+    console.log(SKILL_NAME + ' v' + version);
     return;
   }
-  if (explicitDir) {
-    installTo(explicitDir, dryRun);
-    return;
-  }
-  if (agent) {
-    const info = AGENT_DIRS[agent];
+  if (opts.list) { printList(); return; }
+
+  if (opts.dir) { installTo(opts.dir, opts); return; }
+
+  if (opts.agent) {
+    const info = AGENT_DIRS[opts.agent];
     if (!info) {
-      console.error('Unknown agent: ' + agent + '. Use --dir <path>.');
-      process.exitCode = 2;
-      return;
+      throw new UsageError('未收录智能体: ' + opts.agent + '。可用: ' + Object.keys(AGENT_DIRS).join(', ') + '；自定义目录请用 --dir <路径>。');
     }
-    installTo(resolveUserDir(info.dirs[0]), dryRun);
+    installTo(resolveUserDir(info.dirs[0]), opts);
+    console.log('完成。');
     return;
   }
-  if (global) {
-    if (!yes) {
-      console.error('Refusing --global without --yes. Use --dry-run to preview.');
-      process.exitCode = 2;
-      return;
-    }
+
+  if (opts.global) {
     const seen = new Set();
     for (const value of Object.values(AGENT_DIRS)) {
       for (const rel of value.dirs) {
         if (seen.has(rel)) continue;
         seen.add(rel);
-        installTo(resolveUserDir(rel), dryRun);
+        installTo(resolveUserDir(rel), opts);
       }
     }
+    if (!opts.dryRun) console.log('完成。');
     return;
   }
-  console.error('Choose --agent <name>, --dir <path>, or --list. Use --global --yes explicitly.');
-  process.exitCode = 2;
+
+  const dirs = PROJECT_DIRS.filter((d) => fs.existsSync(d));
+  if (!dirs.length) {
+    throw new TargetError('未检测到项目级智能体目录。可用 --agent <name> 装到用户级，或用 --dir <路径> 指定目录。');
+  }
+  for (const dir of dirs) installTo(dir, opts);
+  if (!opts.dryRun) console.log('完成。');
+}
+
+function main() {
+  try {
+    run();
+  } catch (err) {
+    if (err instanceof UsageError) {
+      console.error('用法错误: ' + err.message);
+      usage();
+      process.exitCode = 2;
+    } else if (err instanceof TargetError) {
+      console.error('目标错误: ' + err.message);
+      process.exitCode = 4;
+    } else if (err instanceof InstallError) {
+      console.error('安装失败: ' + err.message);
+      console.error('修复建议: 检查目录权限与磁盘空间后重试，或用 --dir 换一个目录。');
+      process.exitCode = 1;
+    } else {
+      console.error('未知错误: ' + (err && err.message ? err.message : String(err)));
+      process.exitCode = 1;
+    }
+  }
 }
 
 main();

package/install.sh

@@ -1,9 +1,327 @@
 #!/usr/bin/env bash
+# yotta-dev-mcp 多智能体安装脚本（YottaSkills）
+# 用法:
+#   bash install.sh --agent <name>  # 按智能体默认用户级目录安装
+#   bash install.sh --dir <path>    # 装到指定目录（用户改过目录的智能体）
+#   bash install.sh -g              # 装到全部已知智能体用户级目录
+#   bash install.sh                 # 检测并安装到已存在的项目级目录
+#   bash install.sh --list          # 列出智能体 -> 默认目录
+#   bash install.sh --dry-run       # 只显示将写入的目标，不写文件
+#   bash install.sh --version       # 显示版本
+#   bash install.sh --help          # 显示帮助
+# 退出码: 0 成功 / 1 安装失败 / 2 用法错误 / 4 目标错误
 set -euo pipefail
 
+SKILL_NAME="yotta-dev-mcp"
 SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_IS_WINDOWS=0
 case "$(uname -s)" in
-  MINGW*|MSYS*) SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -W)" ;;
+  MINGW*|MSYS*)
+    SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -W)"
+    _IS_WINDOWS=1
+    ;;
+  CYGWIN*) _IS_WINDOWS=1 ;;
 esac
 
-exec node "$SOURCE_DIR/bin/install.js" "$@"
+# 智能体 -> 用户级默认目录（--agent 装到第一个）
+# .agents/skills 并非通用目录：OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot 读取。
+dirs_for() {
+  case "$1" in
+    claude)     echo ".claude/skills" ;;
+    cursor)     echo ".cursor/skills .agents/skills" ;;
+    codex)      echo "__CODEX__" ;;
+    gemini)     echo ".gemini/skills .agents/skills" ;;
+    goose)      echo ".config/goose/skills .agents/skills" ;;
+    amp)        echo ".config/agents/skills .agents/skills" ;;
+    opencode)   echo "__OPENCODE__" ;;
+    windsurf)   echo ".codeium/windsurf/skills" ;;
+    workbuddy)  echo ".workbuddy/skills" ;;
+    kiro)       echo ".kiro/skills" ;;
+    trae)       echo ".traecli/skills" ;;
+    trae-cn)    echo ".trae-cn/skills" ;;
+    qwen)       echo ".qwen/skills" ;;
+    comate)     echo ".comate/skills" ;;
+    codebuddy)  echo ".codebuddy/skills" ;;
+    kimi)       echo ".kimi/skills" ;;
+    agents)     echo ".agents/skills" ;;
+    *)          return 1 ;;
+  esac
+}
+
+codex_dir() {
+  if [ -n "${CODEX_HOME:-}" ]; then printf '%s' "$CODEX_HOME/skills"; else printf '%s' "$HOME/.codex/skills"; fi
+}
+opencode_dir() {
+  if [ -n "${XDG_CONFIG_HOME:-}" ]; then printf '%s' "$XDG_CONFIG_HOME/opencode/skills"; else printf '%s' "$HOME/.config/opencode/skills"; fi
+}
+resolve_user() {
+  case "$1" in
+    __CODEX__)    codex_dir ;;
+    __OPENCODE__) opencode_dir ;;
+    *)            printf '%s' "$HOME/$1" ;;
+  esac
+}
+
+skill_version() {
+  local pkg="$SOURCE_DIR/package.json" v=""
+  [ -f "$pkg" ] || return 0
+  if command -v awk >/dev/null 2>&1; then
+    v="$(awk -F'"' '{for (i=1;i<=NF;i++) if ($i=="version") {print $(i+2); exit}}' "$pkg" 2>/dev/null || true)"
+  fi
+  if [ -z "$v" ]; then
+    v="$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$pkg" 2>/dev/null | head -n 1 || true)"
+  fi
+  printf '%s' "$v"
+}
+
+usage() {
+  echo "$SKILL_NAME 安装脚本（YottaSkills）"
+  echo ""
+  echo "用法:"
+  echo "  bash install.sh --agent <name>   按智能体默认用户级目录安装（推荐）"
+  echo "  bash install.sh --dir <path>     装到指定目录（用户改了目录的智能体）"
+  echo "  bash install.sh -g               安装到全部已知智能体用户级目录"
+  echo "  bash install.sh                  安装到检测到的项目级目录"
+  echo ""
+  echo "参数:"
+  echo "  --agent <name>  智能体键名，见 --list"
+  echo "  --dir <path>    自定义技能目录"
+  echo "  -g, --global    安装到全部已知用户级目录"
+  echo "  --list, -l      列出支持的智能体目录"
+  echo "  --dry-run       只显示将写入的目标，不写文件"
+  echo "  --version, -v   显示版本"
+  echo "  --help, -h      显示帮助"
+  echo "  --yes, -y       兼容参数（-g 不再强制要求）"
+  echo ""
+  echo "退出码: 0 成功 / 1 安装失败 / 2 用法错误 / 4 目标错误"
+}
+
+resolve_path() {
+  # 与 SOURCE_DIR 同一风格（Windows Git Bash 用 pwd -W），供路径包含判断使用
+  local p="$1"
+  if [ "$_IS_WINDOWS" = "1" ]; then
+    (cd "$p" 2>/dev/null && pwd -W)
+  else
+    (cd "$p" 2>/dev/null && pwd -P)
+  fi
+}
+
+assert_safe_target() {
+  local dest="$1" src_real dest_real parent
+  src_real="$(resolve_path "$SOURCE_DIR")" || return 0
+  if [ -d "$dest" ]; then
+    dest_real="$(resolve_path "$dest")" || return 0
+  else
+    parent="$(dirname "$dest")"
+    dest_real="$(resolve_path "$parent")" || return 0
+    dest_real="$dest_real/$(basename "$dest")"
+  fi
+  case "$dest_real" in
+    "$src_real"|"$src_real"/*)
+      echo "安装失败：目标目录不能在技能源目录内（防止自装自毁）" >&2
+      return 1
+      ;;
+  esac
+  return 0
+}
+
+# 清理旧版安装残留（fail-closed 白名单）：仅在目标目录已存在且含 SKILL.md 时触发；
+# 只删顶层开发项 + 任意层级缓存；不整目录删除、不跟随符号链接。
+DEV_SKIP="package.json package-lock.json bin lib test .github .git .gitignore .npmignore .gitattributes .yotta .tmp install.sh node_modules"
+clean_residue() {
+  local dest="$1" name p
+  [ -d "$dest" ] || return 0
+  [ -f "$dest/SKILL.md" ] || return 0
+  for name in $DEV_SKIP; do
+    p="$dest/$name"
+    [ -L "$p" ] && continue
+    if [ -e "$p" ]; then
+      rm -rf -- "$p"
+      echo "已清理残留: $name"
+    fi
+  done
+  find "$dest" -type d \( -name '__pycache__' -o -name '.pytest_cache' -o -name '.mypy_cache' \) -prune -exec rm -rf -- {} + 2>/dev/null || true
+  find "$dest" -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete 2>/dev/null || true
+}
+
+# 复制技能本体：顶层跳过开发件与运行时不相关目录（嵌套同名保留）；
+# 任意层级跳过缓存（__pycache__ / .pytest_cache / .mypy_cache / *.pyc / *.pyo）。
+copy_tree() {
+  local src="$1" dst="$2" top="$3" entry base
+  mkdir -p "$dst"
+  for entry in "$src"/* "$src"/.[!.]* "$src"/..?*; do
+    [ -e "$entry" ] || [ -L "$entry" ] || continue
+    base="$(basename "$entry")"
+    case "$base" in
+      __pycache__|.pytest_cache|.mypy_cache) continue ;;
+    esac
+    if [ "$top" = "1" ]; then
+      case " $DEV_SKIP " in
+        *" $base "*) continue ;;
+      esac
+    fi
+    if [ -d "$entry" ] && [ ! -L "$entry" ]; then
+      copy_tree "$entry" "$dst/$base" 0 || return 1
+    else
+      case "$base" in
+        *.pyc|*.pyo) continue ;;
+      esac
+      cp -RP "$entry" "$dst/$base" || return 1
+    fi
+  done
+}
+
+install_to() {
+  local base="$1" dry="$2" dest
+  dest="$base/$SKILL_NAME"
+  if [ -L "$base" ]; then
+    echo "安装失败：目标目录是符号链接，拒绝跟随：$base" >&2
+    return 1
+  fi
+  if [ -e "$base" ] && [ ! -d "$base" ]; then
+    echo "安装失败：目标路径已存在且不是目录：$base" >&2
+    return 1
+  fi
+  if [ -L "$dest" ]; then
+    echo "安装失败：技能目录是符号链接，拒绝跟随：$dest" >&2
+    return 1
+  fi
+  if [ -e "$dest" ] && [ ! -d "$dest" ]; then
+    echo "安装失败：技能路径已存在且不是目录：$dest" >&2
+    return 1
+  fi
+  assert_safe_target "$dest" || return 1
+  if [ "$dry" = "1" ]; then
+    echo "[dry-run] 将安装到 -> $dest"
+    return 0
+  fi
+  clean_residue "$dest"
+  mkdir -p "$dest" || return 1
+  copy_tree "$SOURCE_DIR" "$dest" 1 || return 1
+  if [ ! -f "$dest/SKILL.md" ]; then
+    echo "安装失败：结果缺少 SKILL.md" >&2
+    return 1
+  fi
+  echo "installed -> $dest"
+}
+
+list() {
+  echo "智能体 -> 默认技能目录（--agent <name> 装到第一个，用户级）:"
+  local a dirs first
+  for a in claude cursor codex gemini goose amp opencode windsurf workbuddy kiro trae trae-cn qwen comate codebuddy kimi agents; do
+    dirs="$(dirs_for "$a")"
+    first="${dirs%% *}"
+    case "$first" in
+      __CODEX__)    first=".codex/skills" ;;
+      __OPENCODE__) first=".config/opencode/skills" ;;
+    esac
+    if [ "$_IS_WINDOWS" = "1" ]; then
+      first="%USERPROFILE%\\${first//\//\\}"
+    else
+      first="~/$first"
+    fi
+    printf '  %-10s %s\n' "$a" "$first"
+  done
+  echo '说明：Windows 用 %USERPROFILE%，Linux/macOS 用 ~；仅收录有官方默认目录的智能体。'
+  echo '改了目录的请用 --dir <路径>，不要依赖默认位置；若设置了 CODEX_HOME / XDG_CONFIG_HOME，安装自动以该变量为准。'
+}
+
+main() {
+  local agent="" dir="" global=0 show_list=0 show_help=0 show_version=0 dry=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --help|-h) show_help=1 ;;
+      --version|-v) show_version=1 ;;
+      --list|-l) show_list=1 ;;
+      -g|--global) global=1 ;;
+      --dry-run) dry=1 ;;
+      --yes|-y) : ;;
+      --agent)
+        shift
+        if [ $# -eq 0 ] || [ -z "${1:-}" ]; then
+          echo "用法错误: --agent 需要一个非空名称" >&2
+          exit 2
+        fi
+        agent="$1"
+        ;;
+      --dir)
+        shift
+        if [ $# -eq 0 ] || [ -z "${1:-}" ]; then
+          echo "用法错误: --dir 需要一个非空路径" >&2
+          exit 2
+        fi
+        dir="$1"
+        ;;
+      *) echo "未知参数: $1" >&2; exit 2 ;;
+    esac
+    shift
+  done
+
+  if [ "$show_help" = "1" ]; then usage; return 0; fi
+  if [ "$show_version" = "1" ]; then
+    local v
+    v="$(skill_version)"
+    if [ -z "$v" ]; then
+      echo "$SKILL_NAME 版本未知（未找到 package.json）" >&2
+      exit 1
+    fi
+    echo "$SKILL_NAME v$v"
+    return 0
+  fi
+  if [ "$show_list" = "1" ]; then list; return 0; fi
+
+  local selected=0
+  [ -n "$dir" ] && selected=$((selected + 1))
+  [ -n "$agent" ] && selected=$((selected + 1))
+  [ "$global" = "1" ] && selected=$((selected + 1))
+  if [ "$selected" -gt 1 ]; then
+    echo "用法错误: --dir / --agent / -g 只能选一个" >&2
+    exit 2
+  fi
+
+  if [ -n "$dir" ]; then
+    install_to "$dir" "$dry" || exit 1
+    [ "$dry" = "1" ] || echo "完成。"
+    return 0
+  fi
+  if [ -n "$agent" ]; then
+    local dirs first
+    if ! dirs="$(dirs_for "$agent")"; then
+      echo "未收录智能体: $agent。可用 --list 查看，或 --dir <路径> 指定。" >&2
+      exit 2
+    fi
+    first="${dirs%% *}"
+    install_to "$(resolve_user "$first")" "$dry" || exit 1
+    [ "$dry" = "1" ] || echo "完成。"
+    return 0
+  fi
+  if [ "$global" = "1" ]; then
+    local a dirs rel seen=" "
+    for a in claude cursor codex gemini goose amp opencode windsurf workbuddy kiro trae trae-cn qwen comate codebuddy kimi agents; do
+      dirs="$(dirs_for "$a")" || continue
+      for rel in $dirs; do
+        case "$seen" in
+          *" $rel "*) continue ;;
+        esac
+        seen="$seen$rel "
+        install_to "$(resolve_user "$rel")" "$dry" || exit 1
+      done
+    done
+    [ "$dry" = "1" ] || echo "完成。"
+    return 0
+  fi
+  local installed=0 d
+  for d in .claude/skills .cursor/skills .codex/skills .config/goose/skills .config/agents/skills .opencode/skills .codeium/windsurf/skills .workbuddy/skills .kiro/skills .traecli/skills .gemini/skills .trae-cn/skills .qwen/skills .comate/skills .codebuddy/skills .kimi/skills .agents/skills; do
+    if [ -d "$d" ]; then
+      install_to "$d" "$dry" || exit 1
+      installed=1
+    fi
+  done
+  if [ "$installed" = "0" ]; then
+    echo "目标错误: 未检测到项目级智能体目录。可用 --agent <name> 装到用户级，或用 --dir <路径> 指定目录。" >&2
+    exit 4
+  fi
+  [ "$dry" = "1" ] || echo "完成。"
+}
+
+main "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-dev-mcp",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "YuanKai (yotta-dev-mcp) - deterministic local development tools exposed over stdio MCP: repo_map, system_model, architecture_review, impact_analysis, verify_change, self_test, run_adapter, find_code, compress_output, review_code, review_diff, mcp_doctor, scan_secrets, scan_dependencies, check_publish_readiness, run_checks, scaffold_skill and workflow_state. Reads an optional .yotta/architecture.json contract plus .yotta/verification.json policy for architecture reviews, change impact cones and the L0-L5 evidence ledger. Optional explicit adapters integrate import-linter, dependency-cruiser and Repomix without auto-install or network access. Python 3.8+ standard library, offline by default; writes and command execution require explicit flags.",
   "license": "MIT",
   "keywords": [

package/scripts/dev_engine.py

@@ -41,7 +41,7 @@ from dev_model import (
 )
 from dev_rules import REVIEW_RULES
 
-VERSION = "0.2.2"
+VERSION = "0.2.3"
 
 
 

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/YottaMeta/yotta-dev-mcp",
     "source": "github"
   },
-  "version": "0.2.2",
+  "version": "0.2.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@yottameta/yotta-dev-mcp",
-      "version": "0.2.2",
+      "version": "0.2.3",
       "transport": {
         "type": "stdio"
       }