gaoding-cli 1.0.0-alpha.5

package/CHANGELOG.md

@@ -0,0 +1,88 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/),
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [1.0.0-alpha.5] - 2026-07-16
+
+### Added
+
+- 新增单一静态 `gd-cli` Agent Skill package，canonical 安装位置为 `~/.agents/skills/gd-cli`。
+- 新增显式的 `skills install/status/update/uninstall` lifecycle，并为 Agent target 创建 symlink/junction。
+- 新增隔离 npm artifact 集成测试，覆盖零安装副作用和完整 Skill lifecycle。
+
+### Changed
+
+- 公开创意流程从 `apps call` 调整为 `workflows run`，不保留 compatibility alias。
+- 全局 CLI 更新会拒绝 linked、project-local 和 `npx` 运行，仅刷新已经安装的 canonical Skill。
+- npm artifact 只内置 production endpoint，并使用包含 integrity metadata 的官方 registry lockfile。
+- 官方安装方式调整为 `npm install -g gaoding-cli`，Agent Skill 由用户显式安装。
+
+### Removed
+
+- 删除 domain Skill discovery/call 命令、重复的 `connect` lifecycle 和旧 multi-Skill packages。
+- 删除 npm `postinstall` 的 Agent 目录写入和动态 EJS Skill generator。
+
+## [1.0.0-alpha.4] - 2026-06-15
+
+### Added
+
+- Hidden `usage` command for Agent-side稿豆 balance checks.
+- Agent Skill guidance for answering entitlement and remaining-usage questions from structured JSON.
+- Research notes from the Amazon multi-category seller follow-up interview.
+
+### Changed
+
+- Image and video generation now use platform-returned model order for auto fallback selection.
+- Model-selection copy now describes Web/platform ordering instead of package-local defaults.
+
+## [1.0.0-alpha.3] - 2026-06-09
+
+### Added
+
+- OpenClaw / Slock natural-language Agent test guide.
+
+### Changed
+
+- Refined Agent Skill guidance for entitlement failures and user-facing error replies.
+- Entitlement pricing URLs now follow the active environment, with override support.
+- Diagnostic entitlement context is hidden unless verbose or debug output is enabled.
+
+## [1.0.0-alpha.2] - 2026-06-09
+
+### Added
+
+- `skills` command exposed in the published npm package.
+- Expanded agent skill installer, connect flow, and postinstall setup guidance.
+- Dev home workflow and install script improvements from `5ec08f6`.
+
+### Changed
+
+- Agent contracts, entitlement checks, and JSON envelope handling updated for skill setup flows.
+- Install scripts under `docs/install/` aligned with `gaoding-cli` package naming.
+
+## [1.0.0-alpha.1] - 2026-06-02
+
+### Added
+
+- `gd-cli` command with `auth`, `org`, `tools`, `apps`, `dam`, `manifest`, `examples`, and `update`.
+- JSON-friendly output via `-f json` for script, CI, and Agent usage.
+- Direct Tools registry for asset upload, text, image, video, and DAM-oriented workflows.
+- App workflows for ecommerce hero images, listing packs, home launch material, product video, and ecommerce batch dry-run.
+- Agent-readable manifests and schemas for exposing GD CLI tools and apps through shell execution.
+
+### Changed
+
+- npm package name is `gaoding-cli`; install with `npm install -g gaoding-cli`.
+- README now documents the standard CLI workflow instead of environment setup notes.
+- Environment configuration remains behind an opt-in development command.
+- Builds only include the production endpoint preset; non-production endpoints must be configured explicitly.
+- Research archives and generated outputs are treated as working material, not release content.
+
+## [0.1.0] - 2025-04-07
+
+### Added
+
+- Early prototype of registry-driven command execution, skill packaging, and browser authorization.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-present GDHub Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,136 @@
+# gaoding-cli
+
+GD CLI 是稿定设计能力的命令行入口，为用户、脚本、CI 和 Agent 提供登录、组织切换、单项 AI Tool、多步骤 Workflow 和 DAM 素材管理能力。
+
+## Requirements
+
+- Node.js `>=20`
+- 有效的稿定账号与可用组织权限
+
+## Installation
+
+默认使用全局安装：
+
+```bash
+npm install -g gaoding-cli
+gd-cli skills install
+gd-cli auth login
+```
+
+Agent 的安装与接入规则以[官方 Agent 安装文档](https://www.gaoding.com/cli/install.md)为准。
+
+非交互 Agent 或 CI 需要显式指定目标并完成确认：
+
+```bash
+gd-cli skills install --agent codex --yes --format json
+gd-cli auth login --no-browser --format json
+```
+
+`npm install -g gaoding-cli` 只安装 CLI，不会修改任何 Agent 目录。只有显式执行 `gd-cli skills install` 才会安装 Agent Skill。
+
+## Quick Start
+
+```bash
+gd-cli auth status
+
+gd-cli org list
+gd-cli org switch --org <org-id>
+
+gd-cli tools ls
+gd-cli tools call image.cutout --image ./product.jpg --mode product
+gd-cli tools call text.title --brief "夏季运动鞋，轻量缓震，适合通勤"
+
+gd-cli workflows ls
+gd-cli workflows run listing-gallery \
+  --image ./product.jpg \
+  --brief "夏季运动鞋，轻量缓震，适合通勤"
+
+gd-cli dam upload ./product.jpg
+```
+
+## Commands
+
+| Command | Purpose |
+| --- | --- |
+| `auth` | 登录、退出和查看本地认证状态 |
+| `org` | 查看和切换当前组织 |
+| `tools` | 调用单项 AI 创意能力 |
+| `workflows` | 运行多步骤创意生产流程 |
+| `skills` | 安装和管理 `gd-cli` Agent Skill |
+| `dam` | 上传、查询和删除 DAM 素材 |
+| `update` | 检查和升级全局 CLI |
+| `manifest` | 输出 Agent 可解析的能力清单 |
+| `examples` | 查看常用命令示例 |
+
+## Agent And Script Usage
+
+核心命令支持 `--format json`，便于脚本和 Agent 解析。Agent 自身有语言模型时，标题、正文、标签和 prompt 草稿可优先由 Agent 生成；`gd-cli` 负责上传、抠图、生图、生视频、高清化和完整 Workflow 交付。
+
+单项能力使用 `tools call`：
+
+```bash
+gd-cli tools call image.generate \
+  --prompt "电商主图，白底，突出轻量缓震" \
+  --image ./product.jpg \
+  --ratio 1:1 \
+  --format json
+```
+
+多步骤交付使用 `workflows run`：
+
+```bash
+gd-cli workflows run listing-gallery \
+  --image ./product.jpg \
+  --brief "运动鞋上架素材包" \
+  --output-dir ./output \
+  --format json
+```
+
+## Agent Skill
+
+`gd-cli skills install` 将静态 Skill 安装到 `~/.agents/skills/gd-cli`，再为选中的 Agent 创建 link。常用维护命令：
+
+```bash
+gd-cli skills status --format json
+gd-cli skills update
+gd-cli skills uninstall --all --yes
+```
+
+CLI 全局升级后，只在 canonical Skill 已安装时自动刷新它；本地项目安装、`npm link` 和 `npx` 运行不会修改全局 CLI。
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test
+npm run start -- --help
+```
+
+本地开发使用独立的 `gd-cli-dev`：
+
+```bash
+npm run dev:setup
+npm run dev
+gd-cli-dev --help
+```
+
+默认 smoke test 不登录、不调用付费生成能力：
+
+```bash
+npm run smoke:cli
+```
+
+真实接口测试会使用本机登录凭证，并可能消耗额度：
+
+```bash
+gd-cli auth login
+npm run smoke:cli:live
+```
+
+## Documentation
+
+- [官方 Agent 安装文档](https://www.gaoding.com/cli/install.md)
+- [安全说明](SECURITY.md)
+- [首版发版检查](docs/gd-cli-v1-release-checklist.md)
+- [电商 Workflow 实现与验收](docs/ecommerce-workflows.md)

package/SECURITY.md

@@ -0,0 +1,34 @@
+# Security
+
+## Supported Versions
+
+Security fixes are maintained for the latest published `gaoding-cli` version. Older versions should be upgraded before reporting issues unless the maintainer asks for a targeted reproduction.
+
+## Credential Storage
+
+`gd-cli auth login` stores local credentials under `~/.gd`. The CLI creates `~/.gd` with `0700` permissions and stores credential-like files with `0600` permissions on POSIX systems. Do not commit or share files from this directory.
+
+The CLI does not require users to paste raw Token, Cookie, AK/SK, upload tokens, or signed authorization URLs into project files. Logs and error output are redacted by default, but users should still avoid sharing verbose logs without review.
+
+## Local File And URL Boundaries
+
+By default, uploads reject hidden files and sensitive paths such as `.ssh`, `.env`, `.git`, `.gd`, `.kube`, `.docker`, `.aws`, and `credentials.json`. Passing `--allow-sensitive-path` is treated as explicit user confirmation.
+
+User-supplied media and deliverable download URLs must use `http` or `https`. Localhost, private networks, link-local addresses, metadata services, embedded credentials, and `file://` URLs are rejected by default.
+
+The CLI is not a server-side permission boundary. The service must independently validate organization membership, quota, tool availability, model access, asset ownership, DAM repository/folder permissions, and URL safety.
+
+## Reporting Vulnerabilities
+
+Report suspected vulnerabilities to `security@gaoding.com` with:
+
+- affected `gaoding-cli` version and Node.js version
+- command and arguments needed to reproduce
+- expected and actual behavior
+- redacted logs or screenshots
+
+Do not include real AK/SK, Cookie, Bearer token, `auth_key`, upload token, authorization code, or signed URL values in reports.
+
+## Release Safety
+
+Before publishing, maintainers should run the repository checks, inspect `npm pack --dry-run --json`, and verify the package contains no generated outputs or non-production endpoint material. Add provenance only after npm trusted publishing or another OIDC flow has been configured and verified.

package/dist/bin/gd-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/gd-cli.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { createProgram } from "../src/program.js";
+async function main() {
+    const program = await createProgram();
+    await program.parseAsync(process.argv);
+}
+main().catch((err) => {
+    console.error(err.message);
+    process.exit(1);
+});

package/dist/src/api/app-runner.d.ts

@@ -0,0 +1,33 @@
+import { HubClient } from "./hub-client.js";
+import type { TaskResult } from "./task-poller.js";
+interface RunOptions {
+    async?: boolean;
+    timeout?: number;
+    outputDir?: string;
+    concurrency?: number;
+    onStepStart?: (step: AppStepPublicRecord) => void;
+    onStepComplete?: (step: AppStepPublicRecord, result?: TaskResult) => void;
+}
+interface AppStepPublicRecord {
+    step_order: number;
+    step_id: string;
+    step_name: string;
+    tool: string;
+    status: "running" | "completed" | "failed";
+}
+export declare class AppRunner {
+    private invoker;
+    constructor(client?: HubClient);
+    run(appId: string, params: Record<string, unknown>, options?: RunOptions): Promise<TaskResult>;
+    private runListingGallery;
+    private runPdpAPlus;
+    private runSocialSeedingPack;
+    private runCampaignKvPack;
+    private generateImageJobs;
+    private prepareProduct;
+    private optimizePrompt;
+    private generateImage;
+    private invokeGenerateImage;
+    private generateTitle;
+}
+export {};