moluoxixi-ai-rules 0.2.2 → 0.2.3

package/dist/scripts/lib/role-packages.js

@@ -0,0 +1,180 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { isPathInside } from './canonical-path.js';
+import { requireRoleName } from './role-assets.js';
+import { resolveRoleManifestPath } from './roles.js';
+import { loadVendorManifest } from './vendors.js';
+const semverPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+const roleReleaseTagPattern = /^([a-z0-9][a-z0-9-]{0,62})-v(.+)$/u;
+export function parseRoleReleaseTag(tagValue) {
+    const tag = tagValue.replace(/^refs\/tags\//u, '');
+    const match = tag.match(roleReleaseTagPattern);
+    if (!match || !semverPattern.test(match[2]))
+        throw new Error(`Role release tag must match <role>-v<semver>: ${tagValue}`);
+    return {
+        role: requireRoleName(match[1]),
+        version: match[2],
+    };
+}
+export function npmDistTag(version) {
+    if (!semverPattern.test(version))
+        throw new Error(`Invalid package semver: ${version}`);
+    const prerelease = version.split('-', 2)[1]?.split('.', 1)[0];
+    return prerelease && /[A-Za-z]/u.test(prerelease)
+        ? prerelease.toLowerCase()
+        : prerelease
+            ? 'next'
+            : 'latest';
+}
+function comparePrerelease(left, right) {
+    if (left === right)
+        return 0;
+    if (left === undefined)
+        return 1;
+    if (right === undefined)
+        return -1;
+    const leftParts = left.split('.');
+    const rightParts = right.split('.');
+    for (let index = 0; index < Math.max(leftParts.length, rightParts.length); index += 1) {
+        const leftPart = leftParts[index];
+        const rightPart = rightParts[index];
+        if (leftPart === rightPart)
+            continue;
+        if (leftPart === undefined)
+            return -1;
+        if (rightPart === undefined)
+            return 1;
+        const leftNumeric = /^\d+$/u.test(leftPart);
+        const rightNumeric = /^\d+$/u.test(rightPart);
+        if (leftNumeric && rightNumeric)
+            return Number(leftPart) - Number(rightPart);
+        if (leftNumeric !== rightNumeric)
+            return leftNumeric ? -1 : 1;
+        return leftPart.localeCompare(rightPart);
+    }
+    return 0;
+}
+export function compareSemver(left, right) {
+    if (!semverPattern.test(left) || !semverPattern.test(right))
+        throw new Error(`Cannot compare invalid semver values: ${left}, ${right}`);
+    const [leftCore, leftPrerelease] = left.split('+', 1)[0].split('-', 2);
+    const [rightCore, rightPrerelease] = right.split('+', 1)[0].split('-', 2);
+    const leftNumbers = leftCore.split('.').map(Number);
+    const rightNumbers = rightCore.split('.').map(Number);
+    for (let index = 0; index < 3; index += 1) {
+        if (leftNumbers[index] !== rightNumbers[index])
+            return leftNumbers[index] - rightNumbers[index];
+    }
+    return comparePrerelease(leftPrerelease, rightPrerelease);
+}
+function readPackageJson(packageJsonPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Cannot read role package manifest ${packageJsonPath}: ${String(error)}`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new TypeError(`Role package manifest must contain a JSON object: ${packageJsonPath}`);
+    return parsed;
+}
+function validatePublicationOrder(packages) {
+    const order = new Map(packages.map((rolePackage, index) => [rolePackage.name, index]));
+    for (const [index, rolePackage] of packages.entries()) {
+        const dependencies = {
+            ...rolePackage.packageJson.peerDependencies,
+            ...rolePackage.packageJson.optionalDependencies,
+            ...rolePackage.packageJson.dependencies,
+        };
+        for (const dependencyName of Object.keys(dependencies)) {
+            const dependencyIndex = order.get(dependencyName);
+            if (dependencyIndex !== undefined && dependencyIndex >= index) {
+                throw new Error(`Role package publication order is invalid: ${dependencyName} must appear before ${rolePackage.name}`);
+            }
+        }
+    }
+}
+export async function loadRolePackageWorkspace(repoRoot, roleValue) {
+    const role = requireRoleName(roleValue);
+    const manifestPath = resolveRoleManifestPath(repoRoot, role);
+    const roleRoot = fs.realpathSync(path.resolve(manifestPath, '..', '..'));
+    const manifest = await loadVendorManifest(manifestPath);
+    if (!manifest.packages || manifest.packages.length === 0)
+        throw new Error(`AIRules role "${role}" does not declare publishable packages`);
+    const packages = manifest.packages.map((config) => {
+        const requestedDirectory = path.resolve(roleRoot, config.path);
+        if (!fs.existsSync(requestedDirectory))
+            throw new Error(`Role package directory does not exist: roles/${role}/${config.path}`);
+        const directory = fs.realpathSync(requestedDirectory);
+        if (!isPathInside(roleRoot, directory))
+            throw new Error(`Role package directory escapes roles/${role}: ${config.path}`);
+        const packageJsonPath = path.join(directory, 'package.json');
+        if (!fs.existsSync(packageJsonPath) || !fs.statSync(packageJsonPath).isFile())
+            throw new Error(`Role package is missing package.json: roles/${role}/${config.path}`);
+        const packageJson = readPackageJson(packageJsonPath);
+        if (packageJson.name !== config.name) {
+            throw new Error(`Role package name mismatch at roles/${role}/${config.path}: configured ${config.name}, found ${String(packageJson.name)}`);
+        }
+        if (typeof packageJson.version !== 'string' || !semverPattern.test(packageJson.version))
+            throw new Error(`Role package ${config.name} must declare a valid semver version`);
+        if (packageJson.private === true)
+            throw new Error(`Role package ${config.name} is private and cannot be published`);
+        if (packageJson.publishConfig?.access !== 'public')
+            throw new Error(`Role package ${config.name} must set publishConfig.access to "public"`);
+        return {
+            directory,
+            name: config.name,
+            packageJson,
+            relativePath: config.path,
+            version: packageJson.version,
+        };
+    });
+    const versions = new Set(packages.map(rolePackage => rolePackage.version));
+    if (versions.size !== 1)
+        throw new Error(`Role package versions must match: ${packages.map(item => `${item.name}@${item.version}`).join(', ')}`);
+    validatePublicationOrder(packages);
+    return {
+        packages,
+        role,
+        roleRoot,
+        version: packages[0].version,
+    };
+}
+export async function discoverRolePackageWorkspaces(repoRoot) {
+    const rolesRoot = path.join(fs.realpathSync(path.resolve(repoRoot)), 'roles');
+    if (!fs.existsSync(rolesRoot))
+        return [];
+    const workspaces = [];
+    const roleNames = fs.readdirSync(rolesRoot, { withFileTypes: true })
+        .filter(entry => entry.isDirectory())
+        .map(entry => entry.name)
+        .sort();
+    for (const roleName of roleNames) {
+        const manifestPath = path.join(rolesRoot, roleName, 'constants', 'skills.ts');
+        const javascriptManifestPath = path.join(rolesRoot, roleName, 'constants', 'skills.js');
+        if (!fs.existsSync(manifestPath) && !fs.existsSync(javascriptManifestPath))
+            continue;
+        const manifest = await loadVendorManifest(fs.existsSync(manifestPath) ? manifestPath : javascriptManifestPath);
+        if ((manifest.packages?.length ?? 0) > 0)
+            workspaces.push(await loadRolePackageWorkspace(repoRoot, roleName));
+    }
+    const packageOwners = new Map();
+    for (const workspace of workspaces) {
+        for (const rolePackage of workspace.packages) {
+            const owner = packageOwners.get(rolePackage.name);
+            if (owner) {
+                throw new Error(`Role package name "${rolePackage.name}" is declared by both "${owner}" and "${workspace.role}"`);
+            }
+            packageOwners.set(rolePackage.name, workspace.role);
+        }
+    }
+    return workspaces;
+}
+export function requireReleaseMatchesWorkspace(release, workspace) {
+    if (release.role !== workspace.role)
+        throw new Error(`Release tag role "${release.role}" does not match workspace role "${workspace.role}"`);
+    if (release.version !== workspace.version) {
+        throw new Error(`Release tag version "${release.version}" does not match ${workspace.role} package version "${workspace.version}"`);
+    }
+}

package/dist/scripts/lib/roles.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { isPathInside } from './canonical-path.js';
 import { requireRoleName } from './role-assets.js';
 export const DEFAULT_ROLE = '';
 export const COMMON_ROLE = '';
@@ -118,8 +119,7 @@ function buildRolePaths(role, roleRoot) {
     };
 }
 function requireInsideRoot(root, target, field, rootLabel) {
-    const relative = path.relative(root, target);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    if (!isPathInside(root, target)) {
         throw new Error(`AIRules ${field} resolves outside ${rootLabel}: ${target}`);
     }
 }

package/dist/scripts/lib/tool.js

@@ -53,7 +53,7 @@ async function syncVendorsIfNeeded(paths, skipVendors, manifest) {
         for (const vendor of Object.values(manifest.vendors)) {
             ensureVendorRepo(paths.moluoHome, vendor);
         }
-        runSkillSetupCommands(manifest);
+        runSkillSetupCommands(manifest, paths.moluoHome);
     }
     else {
         for (const vendor of Object.values(manifest.vendors)) {
@@ -99,7 +99,7 @@ export async function syncToHosts(options) {
         }
         projectedHosts.push(host);
         if (options.verify) {
-            const verified = await verifyHost(host, paths.moluoHome, paths.userHome);
+            const verified = await verifyHost(host, paths.moluoHome, paths.userHome, paths.role);
             if (!verified) {
                 failedHosts.push(host);
             }
@@ -123,7 +123,7 @@ export async function verifyHosts(options) {
     if (!await verifyGlobalAgentSkills(paths.moluoHome, paths.userHome))
         throw new Error('Mandatory global Agent skills verification failed');
     for (const host of targets) {
-        const verified = await verifyHost(host, paths.moluoHome, paths.userHome);
+        const verified = await verifyHost(host, paths.moluoHome, paths.userHome, paths.role);
         if (!verified) {
             failedHosts.push(host);
         }

package/dist/scripts/lib/vendor-staging.js

@@ -2,6 +2,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { parseDocument } from 'yaml';
+import { isPathInside } from './canonical-path.js';
+import { loadMcpCatalog } from './mcp-catalog.js';
 import { requireRoleName } from './role-assets.js';
 import { collectFlattenedSkillSources } from './skill-projection.js';
 import { loadVendorManifest } from './vendors.js';
@@ -11,20 +13,16 @@ const defaultCanonicalRoleAssetRoots = {
 function portablePath(value) {
     return value.replace(/[\\/]+/gu, path.sep);
 }
-function isInsideRoot(root, target) {
-    const relative = path.relative(root, target);
-    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
-}
 function requireSource(checkoutRoot, configuredPath, kind, vendorId) {
     const requested = path.resolve(checkoutRoot, portablePath(configuredPath));
-    if (!isInsideRoot(checkoutRoot, requested)) {
+    if (!isPathInside(checkoutRoot, requested)) {
         throw new Error(`Vendor "${vendorId}" source resolves outside its checkout: ${configuredPath}`);
     }
     if (!fs.existsSync(requested)) {
         throw new Error(`Vendor "${vendorId}" is missing configured source: ${configuredPath}`);
     }
     const resolved = fs.realpathSync(requested);
-    if (!isInsideRoot(checkoutRoot, resolved)) {
+    if (!isPathInside(checkoutRoot, resolved)) {
         throw new Error(`Vendor "${vendorId}" source resolves outside its checkout: ${configuredPath}`);
     }
     const stats = fs.statSync(resolved);
@@ -36,7 +34,7 @@ function requireSource(checkoutRoot, configuredPath, kind, vendorId) {
 }
 function validateSourceTree(source, checkoutRoot, vendorId, ancestors) {
     const resolved = fs.realpathSync(source);
-    if (!isInsideRoot(checkoutRoot, resolved)) {
+    if (!isPathInside(checkoutRoot, resolved)) {
         throw new Error(`Vendor "${vendorId}" source symlink escapes outside its checkout: ${source}`);
     }
     const stats = fs.statSync(resolved);
@@ -87,7 +85,7 @@ function validateRoleSourceTree(source, roleRoot, vendorId) {
         throw new Error(`Vendor "${vendorId}" role source must not contain symbolic links: ${source}`);
     }
     const resolved = fs.realpathSync(source);
-    if (!isInsideRoot(roleRoot, resolved)) {
+    if (!isPathInside(roleRoot, resolved)) {
         throw new Error(`Vendor "${vendorId}" role source resolves outside the selected role: ${source}`);
     }
     if (stats.isFile()) {
@@ -163,9 +161,12 @@ function requireManagedTarget(homeDir, kind, configuredTarget) {
     const vendorRoot = path.resolve(homeDir, 'vendor');
     const target = path.resolve(homeDir, portablePath(configuredTarget));
     const skillsRoot = path.join(vendorRoot, 'skills');
-    const valid = (kind === 'skill' || kind === 'namespace-dir')
-        && isInsideRoot(skillsRoot, target)
-        && target !== skillsRoot;
+    const mcpsRoot = path.join(vendorRoot, 'mcps');
+    const validSkillTarget = (kind === 'skill' || kind === 'namespace-dir')
+        && isPathInside(skillsRoot, target) && target !== skillsRoot;
+    const validMcpTarget = kind === 'mcp-file'
+        && isPathInside(mcpsRoot, target) && target !== mcpsRoot && path.basename(target) === 'mcp.json';
+    const valid = validSkillTarget || validMcpTarget;
     if (!valid) {
         throw new Error(`Vendor target resolves outside its managed staging root: ${configuredTarget}`);
     }
@@ -207,6 +208,14 @@ function expandOrdinaryLink(homeDir, vendorId, link) {
     if (link.kind === 'role-assets-dir') {
         throw new Error('role-assets must be expanded through the canonical role staging path');
     }
+    if (link.kind === 'mcp-file') {
+        return [{
+                vendorId,
+                kind: link.kind,
+                source: requireSource(checkoutRoot, link.source, 'file', vendorId),
+                target: requireManagedTarget(homeDir, link.kind, link.target),
+            }];
+    }
     const source = requireSource(checkoutRoot, link.source, 'directory', vendorId);
     requireSkill(source, checkoutRoot, vendorId);
     return [{
@@ -239,7 +248,7 @@ function resolveRoleChild(roleRoot, relativePath, kind) {
         return undefined;
     }
     const resolved = fs.realpathSync(requested);
-    if (!isInsideRoot(roleRoot, resolved)) {
+    if (!isPathInside(roleRoot, resolved)) {
         throw new Error(`Role asset resolves outside the selected role: ${relativePath}`);
     }
     const stats = fs.statSync(resolved);
@@ -303,12 +312,17 @@ function buildStagingPlan(manifest, homeDir, role) {
         roleVendorId: roleDeclaration?.vendorId,
     };
 }
-function copyPlannedAsset(stagingRoot, asset, replace) {
+function copyPlannedAsset(stagingRoot, asset, replace, mcpCatalog) {
     const target = path.join(stagingRoot, asset.target);
     if (replace) {
         fs.rmSync(target, { recursive: true, force: true });
     }
     fs.mkdirSync(path.dirname(target), { recursive: true });
+    if (asset.kind === 'mcp-file') {
+        const catalog = mcpCatalog ?? loadMcpCatalog(asset.source);
+        fs.writeFileSync(target, `${JSON.stringify({ mcpServers: catalog.servers }, null, 2)}\n`, 'utf8');
+        return;
+    }
     fs.cpSync(asset.source, target, { recursive: true, dereference: true });
 }
 function materializePlan(plan, role) {
@@ -316,8 +330,17 @@ function materializePlan(plan, role) {
     const stagingRoot = path.join(buildRoot, 'vendor');
     fs.mkdirSync(stagingRoot);
     try {
+        const mcpServerOwners = new Map();
         for (const asset of plan.ordinary) {
-            copyPlannedAsset(stagingRoot, asset, false);
+            const mcpCatalog = asset.kind === 'mcp-file' ? loadMcpCatalog(asset.source) : undefined;
+            for (const serverName of Object.keys(mcpCatalog?.servers ?? {})) {
+                const previous = mcpServerOwners.get(serverName);
+                if (previous) {
+                    throw new Error(`Shared MCP server "${serverName}" is declared by both ${previous.vendorId} (${previous.source}) and ${asset.vendorId} (${asset.source})`);
+                }
+                mcpServerOwners.set(serverName, asset);
+            }
+            copyPlannedAsset(stagingRoot, asset, false, mcpCatalog);
         }
         let roleStagingRoot;
         if (plan.roleSource !== undefined && plan.roleVendorId !== undefined) {
@@ -380,7 +403,7 @@ function validateInventory(stagingRoot, finalVendorRoot, role, roleStagingRoot)
         skills,
     };
 }
-const managedEntryNames = ['skills'];
+const managedEntryNames = ['skills', 'mcps'];
 function requirePlainDirectoryOrMissing(target, label) {
     const stats = fs.lstatSync(target, { throwIfNoEntry: false });
     if (stats && (!stats.isDirectory() || stats.isSymbolicLink())) {

package/dist/scripts/lib/vendors.d.ts

@@ -12,6 +12,20 @@ export interface SetupCommand {
      */
     skipIfCommandAvailable?: string;
 }
+/** A published role package may optionally provide a global CLI for role setup. */
+export interface RolePackageInstall {
+    kind: 'npm-global';
+    /** npm version or dist-tag. Defaults to `latest`. */
+    version?: string;
+}
+/** Role-owned npm package declaration. Array order is the publication order. */
+export interface RolePackageConfig {
+    name: string;
+    /** Package directory relative to `roles/<role>`. */
+    path: string;
+    /** Packages without this field are published but not globally installed. */
+    install?: RolePackageInstall;
+}
 /**
  * 单个 skill 的详细配置（适用于需要重命名或前置安装命令的场景）。
  */
@@ -51,6 +65,12 @@ export type VendorProjection = {
     kind: 'role-assets';
     /** 远程仓库内所选角色根目录，如 roles/example-development。 */
     sourceDir: string;
+} | {
+    kind: 'mcp';
+    /** 仓库内单个 MCP 清单文件路径，如 mcps/code/mcps.json。文件格式包含 mcp 配置和 setup 命令。 */
+    sourceFile: string;
+    /** 投影到 vendor/ 下的目标路径，如 mcps/code/mcp.json。会从 sourceFile 提取 mcp 配置并生成标准 MCP 格式。 */
+    output: string;
 };
 /**
  * 代表一个必须通过 Git remote checkout 获取的供应商仓库。
@@ -81,10 +101,10 @@ export type VendorNode = VendorRepo | {
 export type VendorsConfig = VendorNode[];
 export declare function normalizePath(value: string): string;
 export interface VendorLink {
-    kind: 'namespace-dir' | 'skill' | 'role-assets-dir';
+    kind: 'namespace-dir' | 'skill' | 'role-assets-dir' | 'mcp-file';
     source: string;
     target: string;
-    /** 该 skill 的安装前置命令（来自 SkillConfig.setup） */
+    /** 该 skill 或 MCP 的安装前置命令 */
     setup?: SetupCommand[];
 }
 export interface Vendor {
@@ -96,9 +116,11 @@ export interface Vendor {
 }
 export interface VendorManifest {
     hosts?: string[];
+    packages?: RolePackageConfig[];
     version: number;
     vendors: Record<string, Vendor>;
 }
+export declare function rolePackageSetupCommands(packages?: RolePackageConfig[]): SetupCommand[];
 /**
  * 递归遍历供应商定义树，支持混合数组和对象结构
  * @param node 当前处理的节点 (VendorRepo | Record | Array)

package/dist/scripts/lib/vendors.js

@@ -3,12 +3,25 @@ import { fileURLToPath, pathToFileURL, URL } from 'node:url';
 import { HOST_IDS } from '../../constants/hosts.js';
 import { flattenedSkillName, flattenedVendorSkillTarget } from './skill-projection.js';
 const vendorNamePattern = /^[A-Za-z0-9][\w-]*$/u;
+const npmPackageNamePattern = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+const npmInstallVersionPattern = /^(?:(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?|[a-z][a-z0-9._-]*)$/u;
 const gitCommitPattern = /^[a-f0-9]{40}$/u;
 const remoteGitProtocols = new Set(['https:', 'http:', 'ssh:', 'git:', 'git+ssh:']);
 const scpStyleRemotePattern = /^[^@\s/:]+@[^@\s/:]+:\S+$/u;
 export function normalizePath(value) {
     return value.replace(/\\/g, '/');
 }
+export function rolePackageSetupCommands(packages = []) {
+    return packages.flatMap((rolePackage) => {
+        if (!rolePackage.install)
+            return [];
+        const version = rolePackage.install.version ?? 'latest';
+        return [{
+                command: 'npm',
+                args: ['install', '--global', `${rolePackage.name}@${version}`],
+            }];
+    });
+}
 /**
  * 判断是否为有效的 VendorRepo 定义
  */
@@ -115,6 +128,13 @@ function buildLinksForEntry(entry) {
                     target: 'vendor',
                 }];
         }
+        if (projection.kind === 'mcp') {
+            return [{
+                    kind: 'mcp-file',
+                    source: projection.sourceFile,
+                    target: path.posix.join('vendor', projection.output),
+                }];
+        }
         throw new Error(`供应商 "${entry.name}" 存在未知 projection 类型: ${projection.kind}`);
     });
 }
@@ -191,12 +211,62 @@ export async function loadVendorManifest(manifestPath) {
     const vendors = {};
     walkVendorTree(vendorTree, [], vendors);
     const hosts = normalizeRoleHosts(module.hosts ?? module.default?.hosts, manifestPath);
+    const packages = normalizeRolePackages(module.packages ?? module.default?.packages, manifestPath);
     return {
         ...(hosts === undefined ? {} : { hosts }),
+        packages,
         version: 1,
         vendors,
     };
 }
+function normalizeRolePackages(value, manifestPath) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new TypeError(`Vendor manifest "${manifestPath}" export "packages" must be an array`);
+    const packageNames = new Set();
+    const packagePaths = new Set();
+    return value.map((entry, index) => {
+        const location = `Vendor manifest "${manifestPath}" package at index ${index}`;
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            throw new TypeError(`${location} must be an object`);
+        const candidate = entry;
+        if (typeof candidate.name !== 'string' || !npmPackageNamePattern.test(candidate.name))
+            throw new Error(`${location} has invalid npm package name "${String(candidate.name)}"`);
+        if (packageNames.has(candidate.name))
+            throw new Error(`Vendor manifest "${manifestPath}" contains duplicate package "${candidate.name}"`);
+        packageNames.add(candidate.name);
+        if (typeof candidate.path !== 'string' || candidate.path.length === 0)
+            throw new Error(`${location} must declare a non-empty relative path`);
+        const packagePath = normalizePath(candidate.path);
+        const pathParts = packagePath.split('/');
+        if (path.posix.isAbsolute(packagePath)
+            || path.win32.isAbsolute(packagePath)
+            || pathParts.some(part => part === '' || part === '.' || part === '..')) {
+            throw new Error(`${location} path must stay inside the role directory: ${candidate.path}`);
+        }
+        if (packagePaths.has(packagePath))
+            throw new Error(`Vendor manifest "${manifestPath}" contains duplicate package path "${packagePath}"`);
+        packagePaths.add(packagePath);
+        if (candidate.install === undefined)
+            return { name: candidate.name, path: packagePath };
+        if (!candidate.install || typeof candidate.install !== 'object' || Array.isArray(candidate.install))
+            throw new TypeError(`${location} install must be an object`);
+        const install = candidate.install;
+        if (install.kind !== 'npm-global')
+            throw new Error(`${location} install.kind must be "npm-global"`);
+        if (install.version !== undefined && (typeof install.version !== 'string' || !npmInstallVersionPattern.test(install.version)))
+            throw new Error(`${location} install.version must be an exact semver or safe npm dist-tag`);
+        return {
+            name: candidate.name,
+            path: packagePath,
+            install: {
+                kind: 'npm-global',
+                ...(install.version === undefined ? {} : { version: install.version }),
+            },
+        };
+    });
+}
 function normalizeRoleHosts(value, manifestPath) {
     if (value === undefined)
         return undefined;

package/dist/scripts/lib/verify.d.ts

@@ -1,4 +1,4 @@
 /** Verify the mandatory canonical skills layer shared by every role and host. */
 export declare function verifyGlobalAgentSkills(moluoHome: string, userHome?: string): Promise<boolean>;
 /** Verify only the skills managed by AIRules. Host-native assets belong to project initializers. */
-export declare function verifyHost(host: string, moluoHome: string, userHome?: string): Promise<boolean>;
+export declare function verifyHost(host: string, moluoHome: string, userHome?: string, role?: string): Promise<boolean>;

package/dist/scripts/lib/verify.js

@@ -1,8 +1,10 @@
-import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import kleur from 'kleur';
 import { findHostConfig, resolveGlobalAgentSkillsPath, resolveHostPaths } from '../../constants/hosts.js';
+import { applyMcpServerProjection, readInstalledMcpServers, readTomlMcpServerNames } from './install.js';
+import { DEFAULT_ROLE } from './roles.js';
 /** Verify the mandatory canonical skills layer shared by every role and host. */
 export async function verifyGlobalAgentSkills(moluoHome, userHome = os.homedir()) {
     console.log('\n--- 正在验证公共 Agent skills 层 ---');
@@ -14,27 +16,74 @@ export async function verifyGlobalAgentSkills(moluoHome, userHome = os.homedir()
     return verifyProjectedSkills('公共 Agent skills 层', moluoHome, targetSkillsDir, []);
 }
 /** Verify only the skills managed by AIRules. Host-native assets belong to project initializers. */
-export async function verifyHost(host, moluoHome, userHome = os.homedir()) {
+export async function verifyHost(host, moluoHome, userHome = os.homedir(), role = DEFAULT_ROLE) {
     console.log(`\n--- 正在验证宿主: ${host} ---`);
     const config = findHostConfig(host);
     if (!config)
         return false;
-    const { hostHome, skillsDirName, excludedSkills, projectSkills } = resolveHostPaths(config, userHome);
+    const { hostHome, skillsDirName, excludedSkills, projectSkills, mcpHome, mcp } = resolveHostPaths(config, userHome);
     const resolvedHostHome = path.resolve(hostHome);
-    if (!existsSync(resolvedHostHome)) {
+    const hasHostHome = existsSync(resolvedHostHome);
+    const hasMcpHome = Boolean(mcp
+        && existsSync(path.resolve(mcpHome))
+        && (mcp.requireHostHome !== true || hasHostHome));
+    if (!hasHostHome && !hasMcpHome) {
         console.warn(`[SKIP] 宿主目录不存在: ${resolvedHostHome}`);
         return true;
     }
-    if (!projectSkills) {
+    let skillsValid = true;
+    if (projectSkills && hasHostHome) {
+        const targetSkillsDir = path.join(resolvedHostHome, skillsDirName);
+        if (!existsSync(targetSkillsDir)) {
+            console.error(`[FAIL] 技能目录缺失: ${targetSkillsDir}`);
+            skillsValid = false;
+        }
+        else {
+            skillsValid = verifyProjectedSkills(host, moluoHome, targetSkillsDir, excludedSkills);
+        }
+    }
+    else {
         console.log('[info] 宿主未启用 skills 投影，跳过 skills 链接校验');
+    }
+    const mcpValid = hasMcpHome && mcp ? verifyProjectedMcp(host, moluoHome, role, mcpHome, mcp) : true;
+    return skillsValid && mcpValid;
+}
+function verifyProjectedMcp(host, moluoHome, role, mcpHome, mcp) {
+    const installed = readInstalledMcpServers(moluoHome, role);
+    if (!installed)
+        return true;
+    const expected = applyMcpServerProjection(installed, mcp);
+    const targetDir = mcp.relDir === '.' ? mcpHome : path.join(mcpHome, mcp.relDir);
+    const targetFile = path.join(targetDir, mcp.fileName);
+    if (!existsSync(targetFile)) {
+        console.error(`[FAIL] MCP 配置缺失: ${targetFile}`);
+        return false;
+    }
+    try {
+        const content = readFileSync(targetFile, 'utf8').replace(/^\uFEFF/u, '');
+        let actualNames;
+        if (mcp.format === 'json') {
+            const parsed = JSON.parse(content);
+            const servers = parsed[mcp.serversKey];
+            if (servers === null || typeof servers !== 'object' || Array.isArray(servers))
+                throw new Error(`missing "${mcp.serversKey}" object`);
+            actualNames = new Set(Object.keys(servers));
+        }
+        else {
+            actualNames = readTomlMcpServerNames(content, mcp.serversKey);
+        }
+        const missing = Object.keys(expected).filter(name => !actualNames.has(name));
+        if (missing.length > 0) {
+            console.error(`[FAIL] 缺失 MCP server: ${missing.join(', ')}`);
+            return false;
+        }
+        console.log(`[info] ${host} MCP servers 验证通过: ${Object.keys(expected).length}`);
         return true;
     }
-    const targetSkillsDir = path.join(resolvedHostHome, skillsDirName);
-    if (!existsSync(targetSkillsDir)) {
-        console.error(`[FAIL] 技能目录缺失: ${targetSkillsDir}`);
+    catch (error) {
+        console.error(`[FAIL] MCP 配置无效: ${targetFile}\n${String(error)}`);
         return false;
     }
-    return verifyProjectedSkills(host, moluoHome, targetSkillsDir, excludedSkills);
 }
 function verifyProjectedSkills(label, moluoHome, targetSkillsDir, excludedSkills) {
     const vendorSkillsDir = path.join(moluoHome, 'vendor', 'skills');

package/dist/scripts/role-packages.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import type { ResolvedRolePackage, RolePackageWorkspace } from './lib/role-packages.js';
+export interface RolePackagePublishOperations {
+    npmViewVersion: (specifier: string) => string | undefined;
+    run: (command: 'npm' | 'pnpm', args: string[], cwd?: string) => string;
+    waitForRegistry: (rolePackage: ResolvedRolePackage) => Promise<void>;
+}
+export declare function publishWorkspace(workspace: RolePackageWorkspace, operations?: RolePackagePublishOperations): Promise<void>;