cli-aimlock 1.0.2 → 5.0.0

package/README.md

@@ -5,7 +5,7 @@ Aimlock — 智能目标 skill（CLI.Tax 发布）。
 - 把需求锁成可执行目标，阻止思考漂移、执行漂移、范围膨胀
 - Lock / Probe / Swarm 三档：小改不调蜂群；大改才派单
 - 改前文件快照，禁止创建 git 分支
-- 按目标调用 Blueprint、Swarm、Calctool；需要出图时调用 Image，让智能体生成图片
+- 按目标调用 Blueprint、Swarm、Calctool；需要出图时调用 Images（`npx cli-images@latest install`，禁止安装 `cli-image`）
 
 安装：`npx cli-aimlock@latest install`
 

package/cli.mjs

@@ -1,16 +1,7 @@
 #!/usr/bin/env node
-import { copyFile, mkdir, writeFile } from 'node:fs/promises'
-import { createInterface } from 'node:readline/promises'
-import { stdin, stdout } from 'node:process'
-import { dirname, join, resolve } from 'node:path'
+import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { existsSync, readFileSync } from 'node:fs'
-
-const ENDPOINT = 'https://cli.tax/R3mQ8kWpXn'
-const SCHEMA_VERSION = 'aimlock.skill.request/1.0'
-const PACKAGE_SKILL_DIR = join(dirname(fileURLToPath(import.meta.url)), 'skill')
-const INSTALL_META = 'install-meta.json'
-const LATEST_ENDPOINT = 'https://cli.tax/api/public/skills/R3mQ8kWpXn'
+import { dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
 
 const INTAKE_QUESTIONS = [
   { id: 'goal', required: true, prompt: 'What must be true when this finishes, and what must never change?', example: '只改税率常量一行，不改其它计税逻辑' },
@@ -22,164 +13,14 @@ const INTAKE_QUESTIONS = [
   { id: 'deliveryDoc', required: true, prompt: 'After success, summarize a local delivery document? yes or no.', example: 'no' },
 ]
 
-function usage() {
-  return [
-    'cli-aimlock — install and run the Aimlock skill from CLI.Tax',
-    '',
-    'Usage:',
-    '  npx cli-aimlock@latest install [directory]',
-    '      Install Aimlock for the current IDE (Codex skills directory by default).',
-    '  npx cli-aimlock@latest check [directory]',
-    '      Check whether the installed skill has a newer version on cli.tax.',
-    '  npx cli-aimlock@latest run',
-    '      Handshake: capabilities, intake questions, save AIMLOCK-REQUIREMENTS.json.',
-    '',
-    `Endpoint: ${ENDPOINT}`,
-  ].join('\n')
-}
-
-function readMeta(dir) {
-  const path = join(dir, INSTALL_META)
-  if (!existsSync(path)) return null
-  try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return null }
-}
-
-async function fetchLatestVersion() {
-  try {
-    const response = await fetch(LATEST_ENDPOINT)
-    if (!response.ok) return null
-    const data = await response.json()
-    return { version: data.version ?? '', displayName: data.displayName ?? 'aimlock' }
-  } catch {
-    return null
-  }
-}
-
-async function postRequest(operation, requestId) {
-  const response = await fetch(ENDPOINT, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      input: { schemaVersion: SCHEMA_VERSION, requestId, operation, input: {} },
-    }),
-  })
-  let payload
-  try {
-    payload = await response.json()
-  } catch {
-    throw new Error(`aimlock ${operation} failed: non-JSON response (HTTP ${response.status}). Check ${ENDPOINT}.`)
-  }
-  if (!response.ok || payload?.ok !== true) {
-    const message = payload?.error?.message ?? payload?.error ?? `HTTP ${response.status}`
-    throw new Error(`aimlock ${operation} failed: ${message}`)
-  }
-  return payload
-}
-
-function installTarget(explicit) {
-  if (explicit) return resolve(explicit)
-  const codexHome = process.env.CODEX_HOME?.trim()
-  if (codexHome) return join(codexHome, 'skills', 'aimlock')
-  return join(process.cwd(), '.codex', 'skills', 'aimlock')
-}
-
-async function install(explicit) {
-  const target = installTarget(explicit)
-  await mkdir(target, { recursive: true })
-  const previous = readMeta(target)
-  await copyFile(join(PACKAGE_SKILL_DIR, 'SKILL.md'), join(target, 'SKILL.md'))
-  await copyFile(join(PACKAGE_SKILL_DIR, 'skill.json'), join(target, 'skill.json'))
-  const latest = await fetchLatestVersion()
-  await writeFile(join(target, INSTALL_META), `${JSON.stringify({
-    source: 'R3mQ8kWpXn',
-    slug: 'aimlock',
-    version: latest?.version ?? '',
-    endpoint: ENDPOINT,
-    installedAt: new Date().toISOString(),
-  }, null, 2)}\n`)
-  if (previous?.version && latest?.version && previous.version !== latest.version) {
-    console.log(`aimlock skill updated: ${target}`)
-    console.log(`  ⤴ ${previous.version} → ${latest.version}`)
-  } else {
-    console.log(`aimlock skill installed: ${target}${latest?.version ? ` (${latest.version})` : ''}`)
-  }
-  if (latest?.version) console.log(`Latest version on cli.tax: ${latest.version}`)
-  console.log('Next: return to your IDE and describe the aim. Do not edit code until Aimlock classifies and gates mutate.')
-}
-
-async function check(explicit) {
-  const target = installTarget(explicit)
-  const local = readMeta(target)
-  const latest = await fetchLatestVersion()
-  if (!latest) {
-    console.log('aimlock: cannot reach cli.tax to check updates.')
-    process.exitCode = 1
-    return
-  }
-  if (!local?.version) {
-    console.log(`aimlock: no version record in ${target}. Latest on cli.tax: ${latest.version}.`)
-    process.exitCode = 1
-    return
-  }
-  if (local.version === latest.version) {
-    console.log(`aimlock is up to date (${latest.version}) at ${target}`)
-    return
-  }
-  console.log(`aimlock update available: ${local.version} → ${latest.version}`)
-  console.log('Run: npx cli-aimlock@latest install')
-  process.exitCode = 1
-}
-
-async function askOne(question, readline) {
-  const requiredMark = question.required ? ' (required)' : ''
-  console.log(`\n${question.prompt}${requiredMark}`)
-  console.log(`Example: ${question.example}`)
-  for (;;) {
-    const answer = (await readline.question('> ')).trim()
-    if (answer || !question.required) return answer || ''
-    console.log('This question is required. Please answer before continuing.')
-  }
-}
-
-async function run() {
-  const capabilities = await postRequest('capabilities', 'cli-1')
-  const skill = capabilities.output?.skill ?? {}
-  const notice = capabilities.output?.firstUseNotice?.zh
-  console.log(`aimlock ${skill.version ?? ''} — lock the aim, then fire`)
-  if (notice) console.log(notice)
-  const readline = createInterface({ input: stdin, output: stdout })
-  const answers = []
-  try {
-    for (const question of INTAKE_QUESTIONS) {
-      answers.push({ id: question.id, prompt: question.prompt, answer: await askOne(question, readline) })
-    }
-  } finally {
-    readline.close()
-  }
-  const target = join(process.cwd(), 'AIMLOCK-REQUIREMENTS.json')
-  await writeFile(target, `${JSON.stringify({
-    schemaVersion: SCHEMA_VERSION,
-    endpoint: ENDPOINT,
-    createdAt: new Date().toISOString(),
-    answers,
-  }, null, 2)}\n`)
-  console.log(`\nRequirements saved: ${target}`)
-  console.log('Next: continue in your IDE agent with this file. Do not mutate until classify + mutate-gate.')
-}
-
-const command = process.argv[2] ?? 'help'
-const argument = process.argv[3] ?? ''
-try {
-  if (command === 'install') await install(argument)
-  else if (command === 'check') await check(argument)
-  else if (command === 'run') await run()
-  else if (command === '--help' || command === '-h' || command === 'help') console.log(usage())
-  else {
-    console.error(`Unknown command: ${command}\n`)
-    console.log(usage())
-    process.exitCode = 1
-  }
-} catch (error) {
-  console.error(error instanceof Error ? error.message : error)
-  process.exitCode = 1
-}
+await dispatchOfficialSkillCli({
+  packageRoot: dirname(fileURLToPath(import.meta.url)),
+  runCommand: (context) => runIntakeHandshake(context, {
+    questions: INTAKE_QUESTIONS,
+    outputFile: 'AIMLOCK-REQUIREMENTS.json',
+    afterCapabilities(output) {
+      const notice = output.firstUseNotice?.zh
+      if (typeof notice === 'string' && notice.trim()) console.log(notice)
+    },
+  }),
+})

package/installer.mjs

@@ -0,0 +1,251 @@
+/**
+ * 五个官方技能共用这一份安装器。packages/*/installer.mjs 必须与本文件字节一致。
+ * 禁止第二套超时、第二套版本来源、第二套 bin 名。
+ */
+import { copyFile, mkdir, writeFile } from 'node:fs/promises'
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { stdin, stdout } from 'node:process'
+import { createInterface } from 'node:readline/promises'
+import { fileURLToPath } from 'node:url'
+
+export const LOOKUP_TIMEOUT_MS = 8000
+export const CALL_TIMEOUT_MS = 120_000
+const INSTALL_META = 'install-meta.json'
+
+function asObject(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`)
+  }
+  return value
+}
+
+function requiredString(value, label) {
+  const text = typeof value === 'string' ? value.trim() : ''
+  if (!text) throw new Error(`${label} is required`)
+  return text
+}
+
+export function loadOfficialSkillContext(packageRoot) {
+  const pkg = asObject(JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8')), 'package.json')
+  const skill = asObject(JSON.parse(readFileSync(join(packageRoot, 'skill/skill.json'), 'utf8')), 'skill.json')
+  const npmName = requiredString(pkg.name, 'package.json name')
+  const packageVersion = requiredString(pkg.version, 'package.json version')
+  const displayName = requiredString(skill.displayName, 'skill.json displayName')
+  const skillName = requiredString(skill.name, 'skill.json name')
+  const schemaVersion = requiredString(skill.schemaVersion, 'skill.json schemaVersion')
+  const endpoint = requiredString(skill.endpoint, 'skill.json endpoint')
+  const skillVersion = requiredString(skill.version, 'skill.json version')
+  const runtimeCode = requiredString(endpoint.replace(/^https:\/\/cli\.tax\//, ''), 'runtime code')
+  if (!/^[A-Za-z0-9]{10}$/.test(runtimeCode)) {
+    throw new Error(`skill.json endpoint must be https://cli.tax/{10-char-code}: ${endpoint}`)
+  }
+  if (skillVersion.replace(/^v/i, '') !== packageVersion.replace(/^v/i, '')) {
+    throw new Error(`skill.json ${skillVersion} must match package.json ${packageVersion}`)
+  }
+  return {
+    packageRoot,
+    npmName,
+    packageVersion,
+    displayName,
+    skillName,
+    schemaVersion,
+    endpoint,
+    skillVersion,
+    runtimeCode,
+    latestEndpoint: `https://cli.tax/api/public/skills/${runtimeCode}`,
+    skillDir: join(packageRoot, 'skill'),
+  }
+}
+
+export function readInstallMeta(target) {
+  const path = join(target, INSTALL_META)
+  if (!existsSync(path)) return null
+  return asObject(JSON.parse(readFileSync(path, 'utf8')), INSTALL_META)
+}
+
+export function installTarget(skillName, explicit) {
+  if (explicit) return resolve(explicit)
+  const codexHome = process.env.CODEX_HOME?.trim()
+  if (codexHome) return join(codexHome, 'skills', skillName)
+  return join(process.cwd(), '.codex', 'skills', skillName)
+}
+
+export async function fetchLatestVersion(context) {
+  const response = await fetch(context.latestEndpoint, { signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) })
+  if (!response.ok) throw new Error(`cli.tax skill lookup failed: HTTP ${response.status}`)
+  const data = asObject(await response.json(), 'cli.tax skill lookup')
+  return {
+    version: requiredString(data.version, 'cli.tax skill lookup version'),
+    displayName: requiredString(data.displayName, 'cli.tax skill lookup displayName'),
+  }
+}
+
+export async function callOfficialSkill(context, operation, input) {
+  const requestId = `${context.npmName}-${Date.now()}`
+  const response = await fetch(context.endpoint, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      input: {
+        schemaVersion: context.schemaVersion,
+        requestId,
+        operation,
+        input,
+      },
+    }),
+    signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+  })
+  let payload
+  try {
+    payload = await response.json()
+  } catch {
+    throw new Error(`${context.displayName} ${operation} failed: non-JSON response (HTTP ${response.status}). Check ${context.endpoint}.`)
+  }
+  if (!response.ok || payload?.ok !== true) {
+    const message = payload?.error?.message
+    if (typeof message !== 'string' || !message.trim()) {
+      throw new Error(`${context.displayName} ${operation} failed: HTTP ${response.status}`)
+    }
+    throw new Error(`${context.displayName} ${operation} failed: ${message}`)
+  }
+  return payload
+}
+
+export async function installOfficialSkill(context, explicit) {
+  const target = installTarget(context.skillName, explicit)
+  await mkdir(target, { recursive: true })
+  const previous = readInstallMeta(target)
+  await copyFile(join(context.skillDir, 'SKILL.md'), join(target, 'SKILL.md'))
+  await copyFile(join(context.skillDir, 'skill.json'), join(target, 'skill.json'))
+  const installed = asObject(JSON.parse(readFileSync(join(target, 'skill.json'), 'utf8')), 'installed skill.json')
+  const installedVersion = requiredString(installed.version, 'installed skill.json version')
+  await writeFile(join(target, INSTALL_META), `${JSON.stringify({
+    source: context.runtimeCode,
+    slug: context.skillName,
+    version: installedVersion,
+    packageVersion: context.packageVersion,
+    endpoint: context.endpoint,
+    installedAt: new Date().toISOString(),
+  }, null, 2)}\n`)
+  if (previous?.version && previous.version !== installedVersion) {
+    console.log(`${context.displayName} skill updated: ${target}`)
+    console.log(`  ${previous.version} → ${installedVersion}`)
+  } else {
+    console.log(`${context.displayName} skill installed: ${target} (${installedVersion})`)
+  }
+  if (context.npmName === 'cli-images') {
+    console.log('npm package: cli-images. Never install cli-image (third-party terminal viewer, not CLI.Tax).')
+  }
+  console.log('Next: return to your IDE and state the goal. The agent reads the installed SKILL.md.')
+}
+
+export async function checkOfficialSkill(context, explicit) {
+  const target = installTarget(context.skillName, explicit)
+  const current = readInstallMeta(target)
+  if (!current) {
+    console.log(`${context.displayName} skill is not installed. Run: npx ${context.npmName}@latest install`)
+    process.exitCode = 1
+    return
+  }
+  const installedVersion = requiredString(current.version, 'install-meta.json version')
+  const packageVersion = requiredString(current.packageVersion, 'install-meta.json packageVersion')
+  console.log(`Installed: ${installedVersion} (package ${packageVersion})`)
+  const latest = await fetchLatestVersion(context)
+  console.log(`Latest on cli.tax: ${latest.version}`)
+  if (installedVersion === latest.version) {
+    console.log('Up to date.')
+    return
+  }
+  console.log(`Update available: ${installedVersion} → ${latest.version}`)
+  console.log(`Run: npx ${context.npmName}@latest install`)
+  process.exitCode = 1
+}
+
+export function defaultUsage(context, extraLines) {
+  const lines = [
+    `${context.npmName} — install and run the ${context.displayName} skill from CLI.Tax`,
+    '',
+    'Usage:',
+    `  npx ${context.npmName}@latest install [directory]`,
+    `      Install the ${context.displayName} skill for the current IDE.`,
+    `  npx ${context.npmName}@latest check [directory]`,
+    '      Check whether the installed skill has a newer version.',
+    `  npx ${context.npmName}@latest run`,
+    '      Run the skill handshake: discover capabilities and collect intake answers.',
+    '',
+    `Endpoint: ${context.endpoint}`,
+  ]
+  if (context.npmName === 'cli-images') {
+    lines.push(
+      '',
+      'The npm package name is cli-images (plural).',
+      'Never install cli-image: that is a third-party terminal image viewer, not CLI.Tax.',
+    )
+  }
+  if (extraLines?.length) lines.push('', ...extraLines)
+  return lines.join('\n')
+}
+
+export async function runIntakeHandshake(context, spec) {
+  const capabilities = await callOfficialSkill(context, 'capabilities', {})
+  const output = capabilities.output && typeof capabilities.output === 'object' ? capabilities.output : {}
+  const skill = output.skill && typeof output.skill === 'object' ? output.skill : {}
+  const version = typeof skill.version === 'string' && skill.version.trim()
+    ? skill.version.trim()
+    : context.skillVersion
+  console.log(`${context.displayName} ${version}`)
+  if (typeof spec.afterCapabilities === 'function') spec.afterCapabilities(output)
+  const readline = createInterface({ input: stdin, output: stdout })
+  const answers = []
+  try {
+    for (const question of spec.questions) {
+      const requiredMark = question.required ? ' (required)' : ''
+      console.log(`\n${question.prompt}${requiredMark}`)
+      console.log(`Example: ${question.example}`)
+      for (;;) {
+        const answer = (await readline.question('> ')).trim()
+        if (answer) {
+          answers.push({ id: question.id, prompt: question.prompt, answer })
+          break
+        }
+        if (!question.required) break
+        console.log('This question is required. Please answer before continuing.')
+      }
+    }
+  } finally {
+    readline.close()
+  }
+  const target = join(process.cwd(), spec.outputFile)
+  await writeFile(target, `${JSON.stringify({
+    schemaVersion: context.schemaVersion,
+    endpoint: context.endpoint,
+    createdAt: new Date().toISOString(),
+    answers,
+  }, null, 2)}\n`)
+  console.log(`\nRequirements saved: ${target}`)
+  console.log('Next: continue in your IDE agent with this file.')
+}
+
+export async function dispatchOfficialSkillCli(options) {
+  const packageRoot = options.packageRoot ?? dirname(fileURLToPath(options.importMetaUrl))
+  const context = loadOfficialSkillContext(packageRoot)
+  const args = process.argv.slice(2)
+  const command = args[0] ?? 'help'
+  const argument = args[1]
+  try {
+    if (command === 'install') await installOfficialSkill(context, argument)
+    else if (command === 'check') await checkOfficialSkill(context, argument)
+    else if (command === 'run') await options.runCommand(context)
+    else if (command === 'help' || command === '--help' || command === '-h') {
+      console.log(options.usage ? options.usage(context) : defaultUsage(context, options.extraUsageLines))
+    } else {
+      console.error(`Unknown command: ${command}`)
+      console.log(options.usage ? options.usage(context) : defaultUsage(context, options.extraUsageLines))
+      process.exitCode = 1
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error)
+    process.exitCode = 1
+  }
+}

package/package.json

@@ -1,29 +1,22 @@
 {
-  "name": "cli-aimlock",
-  "version": "1.0.2",
-  "description": "Aimlock skill installer for CLI.Tax: lock a user request into an executable aim and route Blueprint, Swarm, Calctool, and Image.",
-  "type": "module",
   "bin": {
     "cli-aimlock": "./cli.mjs"
   },
+  "description": "Aimlock skill installer for CLI.Tax: lock a user request into an executable aim and route Blueprint, Swarm, Calctool, and Images.",
   "files": [
     "cli.mjs",
+    "installer.mjs",
     "README.md",
     "skill/SKILL.md",
     "skill/skill.json"
   ],
-  "engines": {
-    "node": ">=18"
-  },
+  "license": "UNLICENSED",
+  "name": "cli-aimlock",
+  "private": false,
   "repository": {
     "type": "git",
     "url": "https://github.com/88208555/aimlock-clitax.git"
   },
-  "license": "UNLICENSED",
-  "keywords": [
-    "cli.tax",
-    "skill",
-    "installer",
-    "agent"
-  ]
+  "type": "module",
+  "version": "5.0.0"
 }

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: aimlock
-description: "Aimlock 把用户需求锁成可执行的智能目标，阻止思考漂移、执行漂移和范围膨胀。主智能体先读本规范，禁止立刻改代码：先拆 JSON 任务，按范围合同分成 Lock / Probe / Swarm。Lock 档单文件小改由主脑快照后改写；Probe 档只读分析修改节点，确认后再写；Swarm 档才调用蜂群。Blueprint 编规划合同，Swarm 派单执行，Calctool 生成计算工具，Image 让智能体生成图片。改前文件快照，禁止创建 git 分支。插话先判关联再更新任务；强制停止立即停止。目标未完成交出控制权时每 90 秒发送「智能目标持续执行中，请勿关闭！」。交付文档需用户确认。调用前必须 capabilities，再按 nextStep 前进。Locks a user request into an executable aim to stop thought-drift, execution-drift, and scope blow-ups. Read this skill first; do not edit code yet. Split JSON tasks; classify Lock / Probe / Swarm. Blueprint for contracts, Swarm for dispatch, Calctool for calculators, Image so the agent can generate pictures. Snapshot files before mutate; never create git branches. Interrupt: correlate first. Keep-alive every 90s while the aim is open. Delivery docs only if the user confirms. Always call capabilities first. Фиксирует запрос в исполняемую цель, чтобы остановить дрейф мысли, дрейф исполнения и раздувание объёма. Сначала эта спецификация, код не трогать. JSON-задачи, режимы Lock / Probe / Swarm. Blueprint — контракт, Swarm — раздача, Calctool — калькулятор, Image — генерация картинок агентом. Снимок файлов до правки, без git-веток. Сначала capabilities."
+description: "Aimlock 把用户需求锁成可执行的智能目标，阻止思考漂移、执行漂移和范围膨胀。主智能体先读本规范，禁止立刻改代码：先拆 JSON 任务，按范围合同分成 Lock / Probe / Swarm。Lock 档单文件小改由主脑快照后改写；Probe 档只读分析修改节点，确认后再写；Swarm 档才调用蜂群。Blueprint 编规划合同，Swarm 派单执行，Calctool 生成计算工具，Images 让智能体生成图片。改前文件快照，禁止创建 git 分支。插话先判关联再更新任务；强制停止立即停止。目标未完成交出控制权时每 90 秒发送「智能目标持续执行中，请勿关闭！」。交付文档需用户确认。调用前必须 capabilities，再按 nextStep 前进。Locks a user request into an executable aim to stop thought-drift, execution-drift, and scope blow-ups. Read this skill first; do not edit code yet. Split JSON tasks; classify Lock / Probe / Swarm. Blueprint for contracts, Swarm for dispatch, Calctool for calculators, Images so the agent can generate pictures. Snapshot files before mutate; never create git branches. Interrupt: correlate first. Keep-alive every 90s while the aim is open. Delivery docs only if the user confirms. Always call capabilities first. Фиксирует запрос в исполняемую цель, чтобы остановить дрейф мысли, дрейф исполнения и раздувание объёма. Сначала эта спецификация, код не трогать. JSON-задачи, режимы Lock / Probe / Swarm. Blueprint — контракт, Swarm — раздача, Calctool — калькулятор, Images — генерация картинок агентом. Снимок файлов до правки, без git-веток. Сначала capabilities."
 ---
 
 # Aimlock Skill
@@ -9,7 +9,7 @@ Endpoint: https://cli.tax/R3mQ8kWpXn
 Request schema: aimlock.skill.request/1.0
 Response schema: aimlock.skill.response/1.0
 
-Aimlock is a policy layer. It does not replace Blueprint, Swarm, or Calctool. Image is a **capability** the agent uses to generate pictures, not a product line. Aimlock decides **when to fire, how wide, and how to stop drift**.
+Aimlock is a policy layer. It does not replace Blueprint, Swarm, or Calctool. Images is a **capability** the agent uses to generate pictures, not a product line. Aimlock decides **when to fire, how wide, and how to stop drift**.
 
 ## Request envelope
 
@@ -33,7 +33,7 @@ POST JSON to the endpoint with an `input` wrapper:
 - `intake`: questions the IDE must ask before classify. One at a time.
 - `classify`: choose `lock` | `probe` | `swarm` from explicit facts. Missing facts → `blocked`.
 - `scope-contract`: allowed paths, forbidden paths, max changed lines, new-file / delete flags.
-- `skill-route`: whether to call Blueprint, Swarm, Calctool; call Image only so the agent can generate pictures.
+- `skill-route`: whether to call Blueprint, Swarm, Calctool; call Images only so the agent can generate pictures.
 - `propose-nodes`: validate read-only modification nodes against the contract.
 - `accept-nodes`: auto-accept in-scope nodes; escalate worker conflicts.
 - `snapshot-plan`: file-copy snapshot. Git branches and worktrees are forbidden.
@@ -77,7 +77,7 @@ Call a hop only when `call` is true. That means the hop's capability matches thi
 - Do not call self-extended or marketplace extras.
 - Extra skills enter the candidate list only when the user names them (`userSpecifiedSkills`). Then call that skill's `capabilities` and invoke only if its capability matches the demand.
 
-Do not call Image for ordinary code edits. Do not call Calctool unless the aim is a calculator tool.
+Do not call Images for ordinary code edits. Do not call Calctool unless the aim is a calculator tool. Images npm package is `cli-images`. Quick start: `npx cli-images@latest install`. Never install `cli-image`: that is a third-party terminal image viewer, unrelated to CLI.Tax.
 
 ### Interrupt
 
@@ -120,8 +120,8 @@ User: 修支付回调的状态机，可能有上下游.
 
 `classify` → `probe`. Worker returns nodes. If a node points outside `allowedPaths`, `propose-nodes` is `blocked`. After accept + snapshot, mutate.
 
-### Image capability
+### Images capability
 
 User: 根据这个商品说明生成三张主图.
 
-`goalKind`: `image`. `skill-route` returns Image with `call: true`. The agent uses the Image skill to generate pictures. Aimlock still owns the aim, keep-alive, and interrupt rules.
+`goalKind`: `image`. `skill-route` returns Images with `call: true`. The agent uses the Images skill to generate pictures. Install Images with `npx cli-images@latest install`. Never install `cli-image`. Aimlock still owns the aim, keep-alive, and interrupt rules.

package/skill/skill.json

@@ -1,10 +1,10 @@
 {
-  "name": "aimlock",
+  "description": "Aimlock 把用户需求锁成可执行的智能目标，专门阻止思考漂移、执行漂移和范围膨胀。主智能体载入本技能后禁止立刻改代码，必须先把需求拆成 JSON 任务，并用范围合同分成 Lock、Probe、Swarm 三档。Lock 只覆盖单文件且变更预算明确的小改，主脑快照后改写并对账。Probe 先只读分析修改节点与上下游，确认一致后再写。Swarm 才调用蜂群派单认领。规划合同交给 Blueprint，计算工具交给 Calctool，需要出图时交给 Images 让智能体生成图片，执行编排交给 Swarm；Aimlock 只负责瞄准、闸门、插话融合与无分支快照。每次改前必须备份目标文件，禁止创建 git 分支，禁止用 worktree 冒充隔离。用户中途插入新需求时，主脑先判断是否与在跑任务关联：无关则另派临时智能体，有关则发信号更新 JSON 后继续；用户强制停止则立即停止。IDE 在目标未完成并即将交出控制权时，按九十秒间隔发送固定文案「智能目标持续执行中，请勿关闭！」。交付文档不是默认产物，必须由用户确认后才汇总。调用顺序为 capabilities、intake、classify、scope-contract：缺必填项不得进入下一操作。密钥与凭据不得写入公开页面或任务 JSON。本技能面向真实交付：每一步都有输入、规则与失败面，禁止把加载中、超时或未知状态当成空成功。用户可见说明只讲能力与对话配置方式，不出现外链。调用前必须先走 capabilities，再按 nextStep 前进；必填项未回答不得进入下一操作。日志只保存必要元数据，密钥不得写入公开页面。",
   "displayName": "Aimlock",
-  "description": "智能目标：把需求锁成可执行目标，按 Lock / Probe / Swarm 分档，先分析再改代码，文件快照禁止 git 分支；可调用 Blueprint、Swarm、Calctool，以及 Image 让智能体生成图片。",
-  "schemaVersion": "aimlock.skill.request/1.0",
   "endpoint": "https://cli.tax/R3mQ8kWpXn",
   "method": "POST",
-  "version": "v1.0.1",
-  "type": "Skill"
+  "name": "aimlock",
+  "schemaVersion": "aimlock.skill.request/1.0",
+  "type": "Skill",
+  "version": "v5.0.0"
 }