oh-my-opencode 4.12.1 → 4.14.0

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/agent-reach/social.md

@@ -0,0 +1,207 @@
+# 社交媒体 & 社区
+
+小红书、抖音、Twitter/X、微博、B站、V2EX、Reddit。
+
+## 小红书 / XiaoHongShu (xhs-cli)
+
+### 稳定可用的命令
+
+```bash
+# 搜索笔记（推荐入口）
+xhs search "query"
+
+# 阅读笔记详情（必须用搜索结果中的 URL 或 ID，不能裸 note_id）
+xhs read NOTE_ID_OR_URL
+
+# 查看评论
+xhs comments NOTE_ID_OR_URL
+
+# 浏览热门
+xhs hot
+
+# 推荐 feed
+xhs feed
+```
+
+### 已知不稳定的命令（v0.6.4）
+
+```bash
+# 以下命令当前可能返回 API error，谨慎使用：
+xhs user USER_ID          # 可能返回 {code: -1}
+xhs user-posts USER_ID    # 可能返回 {code: -1}
+xhs favorites              # 可能返回 API error
+```
+
+### 重要注意事项
+
+> **安装**: `pipx install xiaohongshu-cli`，然后 `xhs login`（自动从浏览器提取 Cookie）。
+>
+> **签名令牌限制**: 小红书强制每个 note 携带一个签名令牌，**不能直接用裸 note_id 去读**。正确流程是：先 `xhs search` 或 `xhs feed` 获取结果，再用结果中的 URL/ID 去 `xhs read`。直接构造 note_id 会被拦截。
+>
+> **频率控制**: 高频请求（批量搜索、深翻评论）会触发验证码，这是平台限制无法绕过。建议每次操作间隔 2-3 秒。
+>
+> **POST 操作风险**: 发帖(post)、评论(comment)、点赞(like) 等写操作在 v0.6.x 可能因签名问题返回 406。如需使用，建议降级到 v0.3.5 (`pipx install xiaohongshu-cli==0.3.5`)。
+
+## 抖音 / Douyin
+
+```bash
+# 解析视频信息
+mcporter call 'douyin.parse_douyin_video_info(share_link: "https://v.douyin.com/xxx/")'
+
+# 获取无水印下载链接
+mcporter call 'douyin.get_douyin_download_link(share_link: "https://v.douyin.com/xxx/")'
+
+# 提取视频文案
+mcporter call 'douyin.extract_douyin_text(share_link: "https://v.douyin.com/xxx/")'
+```
+
+> **无需登录**
+
+## Twitter/X (twitter-cli)
+
+### 稳定命令
+
+```bash
+# 首页时间线（最稳定）
+twitter feed -n 20
+
+# 读取单条推文（含回复）
+twitter tweet URL_OR_ID
+
+# 读取长文 / X Article
+twitter article URL_OR_ID
+
+# 用户时间线
+twitter user-posts @username -n 20
+
+# 用户资料
+twitter user @username
+```
+
+### 可能不稳定的命令
+
+```bash
+# 搜索推文（Twitter 频繁改 GraphQL 端点，可能 404）
+twitter search "query" -n 10
+# 如果 search 返回 404，升级 twitter-cli：pipx upgrade twitter-cli
+
+# likes（2024 年后只能看自己的，平台限制）
+twitter likes
+```
+
+### 重要注意事项
+
+> **安装**: `pipx install twitter-cli`（确保 v0.8.5+）
+>
+> **认证**: 如果你有访问权限，导出 Twitter 会话 Cookie 后，把 auth-token 与 ct0 两个值设置为 twitter-cli 文档所要求的认证环境变量。自动提取在 SSH/Docker/无头环境不可用。
+>
+> **IP 风控**: 不要在 VPS/数据中心 IP 上频繁调用，尤其是 followers/following，有封号风险。使用住宅代理或本地环境。
+>
+> **search 可能失效**: Twitter 频繁修改 GraphQL API，search 命令可能随时返回 404。如遇到，先 `pipx upgrade twitter-cli`。如果最新版仍不行，说明上游还没跟上 Twitter 的改动，用 `twitter feed` 替代。
+>
+> **输出格式**: 建议用 `--yaml` 或 `--json` 获得结构化输出，对 AI agent 更友好。
+
+## 微博 / Weibo
+
+```bash
+# 使用 Jina Reader 读取
+curl -s "https://r.jina.ai/https://weibo.com/USER_ID/POST_ID"
+```
+
+> 微博主要通过网页抓取，推荐使用通用网页读取方式。
+
+## B站 / Bilibili
+
+```bash
+# 获取视频元数据
+yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
+
+# 下载字幕
+yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"
+```
+
+> **注意**: 服务器 IP 可能遇到 412 错误。使用 `--cookies-from-browser chrome` 或配置代理。
+
+## V2EX (公开 API)
+
+无需认证，直接调用公开 API。
+
+### 热门主题
+
+```bash
+curl -s "https://www.v2ex.com/api/topics/hot.json" -H "User-Agent: agent-reach/1.0"
+```
+
+### 节点主题
+
+```bash
+# node_name 如: python, tech, jobs, qna, programmers
+curl -s "https://www.v2ex.com/api/topics/show.json?node_name=python&page=1" -H "User-Agent: agent-reach/1.0"
+```
+
+### 主题详情
+
+```bash
+# topic_id 从 URL 获取，如 https://www.v2ex.com/t/1234567
+curl -s "https://www.v2ex.com/api/topics/show.json?id=TOPIC_ID" -H "User-Agent: agent-reach/1.0"
+```
+
+### 主题回复
+
+```bash
+curl -s "https://www.v2ex.com/api/replies/show.json?topic_id=TOPIC_ID&page=1" -H "User-Agent: agent-reach/1.0"
+```
+
+### 用户信息
+
+```bash
+curl -s "https://www.v2ex.com/api/members/show.json?username=USERNAME" -H "User-Agent: agent-reach/1.0"
+```
+
+### Python 调用示例
+
+```python
+from agent_reach.channels.v2ex import V2EXChannel
+
+ch = V2EXChannel()
+
+# 获取热门帖子
+topics = ch.get_hot_topics(limit=10)
+for t in topics:
+    print(f"[{t['node_title']}] {t['title']} ({t['replies']} 回复)")
+
+# 获取节点帖子
+node_topics = ch.get_node_topics("python", limit=5)
+
+# 获取帖子详情 + 回复
+topic = ch.get_topic(1234567)
+print(topic["title"], "—", topic["author"])
+
+# 获取用户信息
+user = ch.get_user("Livid")
+```
+
+> **节点列表**: https://www.v2ex.com/planes
+
+## Reddit (rdt-cli)
+
+```bash
+# 搜索帖子
+rdt search "query" --limit 10
+
+# 读帖子全文 + 评论
+rdt read POST_ID
+
+# 浏览 subreddit
+rdt sub python --limit 20
+
+# 浏览热门
+rdt popular --limit 10
+
+# 浏览 /r/all
+rdt all --limit 10
+```
+
+> **安装**: `pipx install rdt-cli`（确保 v0.4.2+）。无需登录即可搜索和阅读。
+> 需要登录的功能：`rdt feed --subs-only`（订阅列表）、`rdt saved`（收藏）。
+> 建议使用 `--yaml` 输出，对 AI agent 更友好。

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/agent-reach/video.md

@@ -0,0 +1,115 @@
+# 视频/播客
+
+YouTube、B站、小宇宙播客的字幕和转录。
+
+## YouTube (yt-dlp)
+
+### 获取视频元数据
+
+```bash
+yt-dlp --dump-json "URL"
+```
+
+### 下载字幕
+
+```bash
+# 下载字幕 (不下载视频)
+yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --skip-download -o "/tmp/%(id)s" "URL"
+
+# 然后读取 .vtt 文件
+cat /tmp/VIDEO_ID.*.vtt
+```
+
+### 获取评论
+
+```bash
+# 提取评论（best-effort，不保证完整）
+yt-dlp --write-comments --skip-download --write-info-json \
+  --extractor-args "youtube:max_comments=20" \
+  -o "/tmp/%(id)s" "URL"
+# 评论在 .info.json 的 comments 字段中
+```
+
+### 搜索视频
+
+```bash
+yt-dlp --dump-json "ytsearch5:query"
+```
+
+> **字幕注意**: 手动上传的字幕提取可靠；自动生成字幕可能存在行间重复，需后处理。
+> **评论注意**: `--write-comments` 基于网页抓取（非 YouTube Data API），部分评论可能丢失。
+
+## B站 / Bilibili (yt-dlp + bili-cli)
+
+### 视频元数据 (yt-dlp)
+
+```bash
+yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
+```
+
+### 字幕 (yt-dlp)
+
+```bash
+yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"
+```
+
+### 搜索/热门/排行 (bili-cli)
+
+```bash
+# 搜索视频
+bili search "query" --type video -n 5
+
+# 热门视频
+bili hot -n 10
+
+# 排行榜
+bili rank -n 10
+```
+
+> **412 风控**: 海外 IP 必须提供 Cookie（`--cookies-from-browser chrome` 或 `--cookies /path/to/cookies.txt`），国内 IP 一般不受影响。
+> **安装 bili-cli**: `pipx install bilibili-cli`，然后 `bili login` 扫码登录。
+
+## 小宇宙播客 / Xiaoyuzhou Podcast
+
+### 转录单集播客
+
+```bash
+# 输出 Markdown 文件到 /tmp/ (transcribe via the agent-reach xiaoyuzhou tool)
+agent-reach run xiaoyuzhou transcribe "https://www.xiaoyuzhoufm.com/episode/EPISODE_ID"
+```
+
+### 前置要求
+
+1. **ffmpeg**: `brew install ffmpeg`
+2. **Groq API Key** (免费): https://console.groq.com/keys
+3. **配置 Key**: `agent-reach configure groq-key YOUR_KEY`
+4. **首次运行**: `agent-reach install --env=auto` 安装工具
+
+### 检查状态
+
+```bash
+agent-reach doctor
+```
+
+> 输出 Markdown 文件默认保存到 `/tmp/`。
+
+## 抖音视频解析
+
+```bash
+# 解析视频信息
+mcporter call 'douyin.parse_douyin_video_info(share_link: "https://v.douyin.com/xxx/")'
+
+# 获取无水印下载链接
+mcporter call 'douyin.get_douyin_download_link(share_link: "https://v.douyin.com/xxx/")'
+```
+
+> 详见 [social.md](social.md#抖音--douyin)
+
+## 选择指南
+
+| 场景 | 推荐工具 |
+|-----|---------|
+| YouTube 字幕 | yt-dlp |
+| B站字幕 | yt-dlp |
+| 播客转录 | 小宇宙 transcribe.sh |
+| 抖音视频解析 | douyin MCP |

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/agent-reach/web.md

@@ -0,0 +1,76 @@
+# 网页阅读
+
+通用网页、微信公众号、RSS。
+
+## 通用网页 (Jina Reader)
+
+```bash
+# 读取任意网页内容
+curl -s "https://r.jina.ai/URL"
+
+# 示例
+curl -s "https://r.jina.ai/https://example.com/article"
+```
+
+**适用场景**: 大多数网页可以直接用 Jina Reader 读取。
+
+## Web Reader (MCP)
+
+```bash
+# 读取网页内容 (Markdown 格式)
+mcporter call 'web-reader.webReader(url: "https://example.com")'
+
+# 保留图片
+mcporter call 'web-reader.webReader(url: "https://example.com", retain_images: true)'
+
+# 纯文本格式
+mcporter call 'web-reader.webReader(url: "https://example.com", return_format: "text")'
+```
+
+**适用场景**: 需要更精确控制输出格式时使用。
+
+## 微信公众号 / WeChat Articles
+
+### 搜索公众号文章（通过 Exa）
+
+```bash
+# 搜索微信公众号文章
+mcporter call 'exa.web_search_exa(query: "搜索关键词", numResults: 5, includeDomains: ["mp.weixin.qq.com"])'
+```
+
+### 阅读公众号文章全文（通过 Exa）
+
+```bash
+# 抓取文章全文
+mcporter call 'exa.crawling_exa(urls: ["https://mp.weixin.qq.com/s/ARTICLE_ID"], maxCharacters: 10000)'
+```
+
+### 可选：Camoufox 阅读（反爬更强）
+
+```bash
+agent-reach run wechat-article "https://mp.weixin.qq.com/s/ARTICLE_ID"   # Camoufox-backed WeChat reader
+```
+
+> **注意**: Jina Reader 无法读取微信文章（被 CAPTCHA 拦截），推荐用 Exa。
+
+## RSS (feedparser)
+
+```python
+python3 -c "
+import feedparser
+for e in feedparser.parse('FEED_URL').entries[:5]:
+    print(f'{e.title} — {e.link}')
+"
+```
+
+**适用场景**: 订阅博客、新闻源、播客等 RSS feed。
+
+## 选择指南
+
+| 场景 | 推荐工具 |
+|-----|---------|
+| 通用网页 | Jina Reader (`curl r.jina.ai`) |
+| 需要图片/格式控制 | web-reader MCP |
+| 微信公众号 | Exa (搜索+阅读) / Camoufox (可选阅读) |
+| RSS 订阅 | feedparser |
+| 微博/知乎等 | Jina Reader |

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/chrome-stealth.md

@@ -0,0 +1,120 @@
+# Tier 2 — Chrome stealth (CloakBrowser + agent-browser)
+
+Real interaction (clicks, forms, screenshots, video, persistent login) for pages that defeat Tier 1/1.5. Two runtime tools, both installed on demand — neither is vendored in this skill:
+
+- **CloakBrowser** (`pip`) — stealth Chromium with source-level C++ fingerprint patches. The Python wrapper source is MIT; the downloaded Chromium binary is covered by CloakBrowser's separate binary license and is not redistributed by this package. Passes Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detectors. Pin **0.4.0**.
+- **agent-browser** (`npm`, Apache-2.0) — native CDP automation CLI that drives CloakBrowser. AX-tree snapshots, `@eN` refs, click/fill/type/scroll, screenshots, video, cookie/state/session management. Pin **0.29.1**.
+
+```
+CloakBrowser (stealth Chromium) <- CDP port 9242 -> agent-browser CLI
+  - 57 C++ fingerprint patches                  - AX-tree snapshots, @eN refs
+  - Canvas/WebGL consistency                    - click / fill / type / scroll
+  - navigator.webdriver = false at C++ source   - screenshot, video record
+  - Humanize mode (mouse curves, timing)        - cookie / state / session mgmt
+```
+
+## Install (one-time)
+
+CloakBrowser runs in a dedicated Python venv. Cross-platform: macOS, Linux, and Windows all supported by both tools (use the venv path convention for your OS).
+
+```bash
+# CloakBrowser (MIT wrapper source; separate binary license, pin 0.4.0):
+uv venv .cloak-venv --python 3.13
+# macOS/Linux: source .cloak-venv/bin/activate    Windows: .cloak-venv\Scripts\activate
+uv pip install "cloakbrowser==0.4.0"
+python -c "import cloakbrowser; cloakbrowser.ensure_binary()"   # downloads stealth Chromium on first import
+
+# agent-browser (Apache-2.0, pin 0.29.1):
+npm i -g agent-browser@0.29.1 && agent-browser install
+agent-browser --version   # 0.29.1
+```
+
+Verify CloakBrowser:
+
+```bash
+python -c "import cloakbrowser; print(cloakbrowser.__version__, cloakbrowser.CHROMIUM_VERSION, cloakbrowser.binary_info()['installed'])"
+# -> 0.4.0  <chromium-version>  True
+```
+
+## Launch + drive
+
+```bash
+# 1. Launch CloakBrowser with CDP on :9242 (background). With the venv active:
+python -c "import asyncio,cloakbrowser; asyncio.run(cloakbrowser.launch_async(headless=False, stealth_args=True, args=['--remote-debugging-port=9242']))" &
+
+# 2. CloakBrowser launches tabless -> agent-browser would say "No page found".
+#    Open the first tab via CDP before any agent-browser command:
+curl -s -X PUT "http://127.0.0.1:9242/json/new?https://example.com"
+
+# 3. Connect agent-browser. CloakBrowser already patches navigator.webdriver=false at the
+#    C++ source, so NO --init-script is required — only --user-agent to hide HeadlessChrome:
+agent-browser --cdp 9242 \
+  --user-agent "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.177 Safari/537.36" \
+  open https://example.com
+
+# 4. Interact:
+agent-browser --cdp 9242 snapshot -i        # interactive elements (@eN refs)
+agent-browser --cdp 9242 click @e3
+agent-browser --cdp 9242 screenshot out.png
+
+# 5. Close when done:
+agent-browser --cdp 9242 close
+```
+
+agent-browser ships its own always-version-matched usage guide — load it instead of guessing flags:
+
+```bash
+agent-browser skills get core            # core workflows, patterns, troubleshooting
+agent-browser skills get core --full     # + full command reference and templates
+agent-browser skills get electron        # Electron apps (VS Code, Slack, Discord, Figma, ...)
+agent-browser skills list                # everything available on the installed version
+```
+
+## Verify stealth
+
+```bash
+agent-browser --cdp 9242 eval 'navigator.webdriver'   # must print false
+```
+
+Tested May 2026: bot.sannysoft.com all-green, browserscan.net "Normal" (15/15), nowsecure.nl Turnstile bypassed.
+
+## Cookie login (cross-platform)
+
+`scripts/extract_cookies.py` reads cookies from a local browser profile and optionally injects them into the running CDP session. Profile-path resolution and value decryption are per-OS:
+
+| OS | Profile location | Cookie value decryption |
+|----|------------------|--------------------------|
+| macOS | `~/Library/Application Support/<app>/` | Keychain (AES-128-CBC, PBKDF2 salt `saltysalt`) |
+| Linux | `~/.config/<app>/` (Chromium), `~/.mozilla/firefox/` (Firefox) | libsecret/SecretService, then PBKDF2 + AES-128-CBC |
+| Windows | `%LOCALAPPDATA%\<app>\User Data\` | DPAPI (`CryptUnprotectData`) + AES-256-GCM (`os_crypt` key) |
+
+```bash
+# Extract to a file:
+mkdir -p ~/.local/state/omo-cookies
+python3 ../scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
+# Extract and inject into the running CDP session:
+python3 ../scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
+```
+
+Cookie export files are written with owner-only `0600` permissions. Do not place live auth cookies in shared temp directories or commit them to a repo. Cookie injection sends values to CDP over stdin rather than argv, so live cookie values do not appear in process listings. Cookies apply on next navigation — reload after injecting. Google services use fingerprint-bound tokens (SIDTS) that may not transfer across browser profiles. Firefox-family profiles store cookies unencrypted; Chromium-family profiles trigger a one-time OS-keyring prompt on macOS/Linux.
+
+## Anti-patterns
+
+- Do NOT launch CloakBrowser for plain text extraction — use Tier 1.
+- Do NOT pass an `--init-script` for the webdriver flag — CloakBrowser already patches it at source; the only required override is `--user-agent`.
+- Do NOT run agent-browser before creating the first tab via `curl -X PUT .../json/new` — CloakBrowser launches tabless.
+- Do NOT use vanilla Chrome when stealth is needed — always CloakBrowser.
+- Do NOT forget to `close` the session when done.
+- Do NOT inject cookies without reloading the page.
+
+## Troubleshooting
+
+```bash
+# Port 9242 already in use (macOS/Linux):
+lsof -ti:9242 | xargs kill -9
+# agent-browser can't connect:
+curl -s http://127.0.0.1:9242/json/version | head -5   # empty -> CloakBrowser not running
+# Update either tool:
+uv pip install --upgrade "cloakbrowser==0.4.0" && python -c "import cloakbrowser; cloakbrowser.ensure_binary()"
+npm i -g agent-browser@0.29.1
+```