aixlab-skills 0.1.2 → 1.0.0

package/README.md

@@ -1,12 +1,23 @@
 # aixlab-skills
 
-AixLab 自有数字资产平台的 Agent Skill 安装器。它通过浏览器设备授权取得最小权限令牌，下载用户已拥有的私有 ZIP，校验 SHA-256 与 `SKILL.md` 名称后，再调用固定版本的通用 `skills` CLI 完成全局复制安装。
+先在 AixLab 领取或购买 Skill 并下载完整 ZIP，再从本地安装。安装器不登录平台、不打开设备授权页面、不保存账号令牌，也不代替用户领取或下载资产。
+
+需要 Node.js 20+。将下载的 ZIP 放在当前目录或用户的 Downloads 目录，再执行：
 
 ```bash
-npx aixlab-skills add xhs-creator -g -y
+npx --yes aixlab-skills@1.0.0 add ppdesign-h3 -g -y
 ```
 
-本地联调可设置 `AIXLAB_SKILLS_HOST=http://localhost:8180`。生产环境默认连接 `https://www.aixc4d.com`。
+文件名可以是 `ppdesign-h3.zip`、`ppdesign-h3-1.0.0.zip` 或浏览器添加序号的同名文件。如果有多个版本，或 ZIP 放在其他目录，请明确指定：
+
+```bash
+npx --yes aixlab-skills@1.0.0 add ppdesign-h3 -g -y --file "C:/Users/你的用户名/Downloads/ppdesign-h3-1.0.0.zip"
+```
+
+可用 AIXLAB_SKILLS_DOWNLOAD_DIR 指定下载目录；安装器只检查当前目录和该下载目录，不递归扫描用户文件。
+
+安装前会校验 ZIP 路径、文件类型、解压大小和唯一 SKILL.md 的名称，然后调用固定版本 skills@1.5.22 完成全局复制安装。Skill 的所有配套资源会随目录一起安装。首次获取通用安装器需要访问 npm，但不需要 AixLab 二次授权。
+
+也可直接解压完整 Skill 目录并放入兼容 Agent 的 Skills 目录，无需运行本安装器。更新已有 Skill 前应保留用户自己的修改。
 
-该安装器已作为公开 npm 包发布。账户、版本、发布、验证和交接流程见
-[`docs/agent/runbooks/AixLab-Skills-npm发布与交接手册.md`](../../../docs/agent/runbooks/AixLab-Skills-npm发布与交接手册.md)。
+npm 只包含公开安装器代码；付费 Skill、素材、私有下载地址和用户凭据均不在 npm 包中。平台领取与下载继续按原有权益规则执行。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aixlab-skills",
-  "version": "0.1.2",
-  "description": "Secure installer for owned AixLab agent Skills",
+  "version": "1.0.0",
+  "description": "Install downloaded AixLab Skill ZIPs locally without account authorization",
   "type": "module",
   "bin": {
     "aixlab-skills": "bin/aixlab-skills.js"

package/src/index.js

@@ -1,13 +1,11 @@
-import { createHash } from "node:crypto";
 import { createWriteStream } from "node:fs";
-import { chmod, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, rm } from "node:fs/promises";
 import { homedir, platform, tmpdir } from "node:os";
-import { dirname, join, win32 as win32Path } from "node:path";
+import { dirname, isAbsolute, join, resolve, win32 as win32Path } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { spawn } from "node:child_process";
 import yauzl from "yauzl";
 
-const DEFAULT_HOST = "https://www.aixc4d.com";
 const GENERIC_INSTALLER_VERSION = "1.5.22";
 const MAX_PACKAGE_BYTES = 100 * 1024 * 1024;
 const MAX_ARCHIVE_ENTRIES = 2000;
@@ -16,7 +14,7 @@ export function parseArguments(args) {
     const values = [...args];
 
     if (values.shift() !== "add") {
-        throw new Error("用法：aixlab-skills add <skill-name> -g -y");
+        throw new Error("用法：aixlab-skills add <skill-name> -g -y [--file <已下载的 ZIP 路径>]");
     }
 
     const skillName = values.shift() ?? "";
@@ -26,31 +24,23 @@ export function parseArguments(args) {
     }
 
     const accepted = new Set(["-g", "--global", "-y", "--yes"]);
+    let packageFile;
 
-    if (values.some(value => ! accepted.has(value))) {
-        throw new Error("包含不支持的安装参数。");
-    }
-
-    return { skillName };
-}
+    while (values.length) {
+        const value = values.shift();
 
-export function normalizeHost(rawHost) {
-    const url = new URL(rawHost || DEFAULT_HOST);
-    const localHttp = url.protocol === "http:"
-        && ["localhost", "127.0.0.1", "::1"].includes(url.hostname);
+        if (value === "--file" && packageFile === undefined) {
+            packageFile = values.shift();
 
-    if ((url.protocol !== "https:" && ! localHttp)
-        || url.username
-        || url.password
-        || url.search
-        || url.hash
-    ) {
-        throw new Error("AIXLAB_SKILLS_HOST 必须是 HTTPS 地址；仅本机调试允许 HTTP。");
+            if (typeof packageFile !== "string" || ! packageFile.trim() || packageFile.startsWith("-")) {
+                throw new Error("--file 后需要填写已下载的 ZIP 路径。");
+            }
+        } else if (! accepted.has(value)) {
+            throw new Error("包含不支持的安装参数。");
+        }
     }
 
-    url.pathname = url.pathname.replace(/\/?$/, "/");
-
-    return url;
+    return { skillName, ...(packageFile === undefined ? {} : { packageFile }) };
 }
 
 export function skillNameFromMarkdown(markdown) {
@@ -61,183 +51,43 @@ export function skillNameFromMarkdown(markdown) {
     return match?.[2] ?? "";
 }
 
-function configPath() {
-    return join(homedir(), ".config", "aixlab-skills", "config.json");
-}
-
-async function loadToken(host) {
-    const environmentToken = process.env.AIXLAB_SKILLS_TOKEN?.trim();
-
-    if (environmentToken) return environmentToken;
-
-    try {
-        const stored = JSON.parse(await readFile(configPath(), "utf8"));
-
-        return stored.host === host.origin && typeof stored.access_token === "string"
-            ? stored.access_token
-            : null;
-    } catch {
-        return null;
-    }
-}
-
-async function saveToken(host, token) {
-    const target = configPath();
-    const temporary = `${target}.${process.pid}.tmp`;
-    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
-    await writeFile(temporary, `${JSON.stringify({ host: host.origin, access_token: token })}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    await chmod(temporary, 0o600);
-    await rename(temporary, target);
-}
-
-async function requestJson(host, path, { method = "GET", token, body, statuses = [200] } = {}) {
-    const url = new URL(path.replace(/^\//, ""), host);
-    const response = await fetch(url, {
-        method,
-        redirect: "manual",
-        headers: {
-            Accept: "application/json",
-            ...(body ? { "Content-Type": "application/json" } : {}),
-            ...(token ? { Authorization: `Bearer ${token}` } : {}),
-        },
-        ...(body ? { body: JSON.stringify(body) } : {}),
-    });
-    let payload = {};
-
-    try {
-        payload = await response.json();
-    } catch {
-        // The status remains the source of truth for malformed error responses.
-    }
-
-    if (! statuses.includes(response.status)) {
-        const error = new Error(payload.message || payload.error || `平台请求失败（HTTP ${response.status}）。`);
-        error.status = response.status;
-        throw error;
-    }
-
-    return { status: response.status, payload };
-}
-
-export function openBrowser(url, {
-    platformName = platform(),
-    spawnProcess = spawn,
+export async function resolvePackage(skillName, packageFile, {
+    cwd = process.cwd(),
+    downloadsDirectory = process.env.AIXLAB_SKILLS_DOWNLOAD_DIR || join(homedir(), "Downloads"),
 } = {}) {
-    const command = platformName === "win32"
-        ? ["explorer.exe", [url]]
-        : platformName === "darwin"
-            ? ["open", [url]]
-            : ["xdg-open", [url]];
-
-    try {
-        const child = spawnProcess(command[0], command[1], { detached: true, stdio: "ignore" });
-        child.once("error", () => {
-            // Printing the URL is sufficient when the desktop opener is unavailable.
-        });
-        child.unref();
-    } catch {
-        // Printing the URL is sufficient when the desktop opener is unavailable.
-    }
-}
-
-async function authorizeDevice(host) {
-    const { payload } = await requestJson(host, "marketplace-cli/device-codes", { method: "POST" });
-    const expiresIn = Number(payload.expires_in);
-    const interval = Number(payload.interval);
+    if (packageFile !== undefined) {
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(packageFile) || ! /\.zip$/i.test(packageFile)) {
+            throw new Error("--file 只接受本地 ZIP 文件，不接受下载网址。");
+        }
 
-    if (typeof payload.device_code !== "string"
-        || typeof payload.user_code !== "string"
-        || typeof payload.verification_uri_complete !== "string"
-        || ! Number.isFinite(expiresIn)
-        || ! Number.isFinite(interval)
-    ) {
-        throw new Error("平台返回了无效的设备授权信息。");
+        return isAbsolute(packageFile) ? packageFile : resolve(cwd, packageFile);
     }
 
-    process.stderr.write(`请在浏览器中确认 AixLab 安装授权：\n${payload.verification_uri_complete}\n授权码：${payload.user_code}\n`);
-    openBrowser(payload.verification_uri_complete);
-    const deadline = Date.now() + (expiresIn * 1000);
-
-    while (Date.now() < deadline) {
-        await new Promise(resolve => setTimeout(resolve, Math.max(2, interval) * 1000));
-        const result = await requestJson(host, "marketplace-cli/device-token", {
-            method: "POST",
-            body: { device_code: payload.device_code },
-            statuses: [200, 202, 410],
-        });
+    const filename = new RegExp("^" + skillName + "(?:-[0-9][0-9A-Za-z.+_-]*)?(?: \\(\\d+\\))?\\.zip$", "i");
 
-        if (result.status === 202) continue;
-        if (result.status === 410) break;
+    for (const directory of new Set([cwd, downloadsDirectory])) {
+        let entries;
 
-        if (typeof result.payload.access_token !== "string" || result.payload.token_type !== "Bearer") {
-            throw new Error("平台返回了无效的访问令牌。");
+        try {
+            entries = await readdir(directory, { withFileTypes: true });
+        } catch (error) {
+            if (error.code === "ENOENT") continue;
+            throw error;
         }
 
-        await saveToken(host, result.payload.access_token);
-
-        return result.payload.access_token;
-    }
-
-    throw new Error("安装授权已过期，请重新执行原命令。");
-}
-
-function validateManifest(payload, skillName, host) {
-    const packageData = payload?.package;
-
-    if (payload?.skill_name !== skillName
-        || typeof payload.version !== "string"
-        || ! packageData
-        || typeof packageData.url !== "string"
-        || typeof packageData.sha256 !== "string"
-        || ! /^[0-9a-f]{64}$/.test(packageData.sha256)
-        || ! Number.isSafeInteger(packageData.size_bytes)
-        || packageData.size_bytes < 0
-        || packageData.size_bytes > MAX_PACKAGE_BYTES
-    ) {
-        throw new Error("平台返回了无效的 Skill 安装清单。");
-    }
+        const matches = entries.filter(entry => entry.isFile() && filename.test(entry.name));
 
-    const packageUrl = new URL(packageData.url);
+        if (matches.length > 1) {
+            throw new Error("找到多个同名 Skill 压缩包，请使用 --file 指定要安装的 ZIP 路径。");
+        }
 
-    if (packageUrl.origin !== host.origin || packageUrl.protocol !== host.protocol) {
-        throw new Error("平台返回的下载地址不属于当前 AixLab 站点。");
+        if (matches.length === 1) return join(directory, matches[0].name);
     }
 
-    return { ...payload, package: { ...packageData, url: packageUrl } };
-}
-
-async function issuePackage(host, token, skillName) {
-    const { payload } = await requestJson(
-        host,
-        `marketplace-cli/skills/${encodeURIComponent(skillName)}/package-access`,
-        { method: "POST", token },
+    throw new Error(
+        "未找到已下载的 Skill ZIP。请先在资产平台领取并下载，将 ZIP 放到当前目录或 Downloads，"
+        + "也可在命令后添加 --file \"ZIP 文件路径\"。安装过程无需账号或设备授权。",
     );
-
-    return validateManifest(payload, skillName, host);
-}
-
-async function downloadPackage(manifest, token, target) {
-    const response = await fetch(manifest.package.url, {
-        headers: { Authorization: `Bearer ${token}`, Accept: "application/zip" },
-        redirect: "manual",
-    });
-
-    if (response.status !== 200) {
-        throw new Error(`Skill 下载失败（HTTP ${response.status}）。`);
-    }
-
-    const bytes = Buffer.from(await response.arrayBuffer());
-
-    if (bytes.length !== manifest.package.size_bytes
-        || createHash("sha256").update(bytes).digest("hex") !== manifest.package.sha256
-    ) {
-        throw new Error("Skill 包完整性校验失败。");
-    }
-
-    await writeFile(target, bytes, { flag: "wx", mode: 0o600 });
 }
 
 function validatedEntryName(name) {
@@ -432,26 +282,25 @@ async function installSkill(skillRoot) {
     }
 }
 
-async function execute(skillName) {
+async function execute({ skillName, packageFile }, options) {
     const major = Number(process.versions.node.split(".")[0]);
 
     if (! Number.isInteger(major) || major < 20) {
         throw new Error("aixlab-skills 需要 Node.js 20 或更高版本。");
     }
 
-    const host = normalizeHost(process.env.AIXLAB_SKILLS_HOST || DEFAULT_HOST);
-    let token = await loadToken(host);
-
-    if (! token) token = await authorizeDevice(host);
-
-    let manifest;
+    const source = await resolvePackage(skillName, packageFile, options);
+    let sourceInfo;
 
     try {
-        manifest = await issuePackage(host, token, skillName);
+        sourceInfo = await lstat(source);
     } catch (error) {
-        if (error.status !== 401) throw error;
-        token = await authorizeDevice(host);
-        manifest = await issuePackage(host, token, skillName);
+        if (error.code !== "ENOENT") throw error;
+        throw new Error("指定的 ZIP 文件不存在，请检查 --file 路径。");
+    }
+
+    if (! sourceInfo.isFile() || sourceInfo.size === 0 || sourceInfo.size > MAX_PACKAGE_BYTES) {
+        throw new Error("请选择有效的本地 ZIP 文件，压缩包最大 100 MiB。");
     }
 
     const working = await mkdtemp(join(tmpdir(), "aixlab-skills-"));
@@ -459,30 +308,30 @@ async function execute(skillName) {
     try {
         const archive = join(working, "package.zip");
         const extracted = join(working, "extracted");
-        await downloadPackage(manifest, token, archive);
+        await copyFile(source, archive);
         await extractPackage(archive, extracted);
         const skillRoot = await validateExtractedSkill(extracted, skillName);
-        await installSkill(skillRoot);
+        await (options.install ?? installSkill)(skillRoot);
 
         return {
             skill_name: skillName,
             success: true,
-            version: manifest.version,
             verified: true,
-            message: "Skill 已通过 AixLab 权益校验、完整性校验并完成全局安装。",
+            message: "已验证本地 ZIP 结构与 Skill 名称并完成全局安装，无需二次授权。",
         };
     } finally {
         await rm(working, { recursive: true, force: true });
     }
 }
 
-export async function run(args) {
+export async function run(args, options = {}) {
     let skillName = "";
 
     try {
-        ({ skillName } = parseArguments(args));
+        const parsed = parseArguments(args);
+        skillName = parsed.skillName;
 
-        return await execute(skillName);
+        return await execute(parsed, options);
     } catch (error) {
         return {
             skill_name: skillName,