socialdatax-skills 0.2.45 → 0.2.47

package/README.md

@@ -89,11 +89,11 @@ Common search phrases for this skill package:
 - Reserved future SocialDataX namespace names for existing platform listings without draft files yet: `com.socialdatax/kuaishou-insights`, `com.socialdatax/bilibili-insights`, `com.socialdatax/weibo-insights`, `com.socialdatax/wechat-channels-insights`, `com.socialdatax/zhihu-insights`, `com.socialdatax/instagram-insights`, `com.socialdatax/x-insights`, `com.socialdatax/youtube-insights`, and `com.socialdatax/tiktok-insights`.
 - Hosted endpoint without a repo-tracked standalone listing: Sensitive Words Check.
 - Unified MCP registry name: none; this package installs skills and calls explicit hosted MCP entries.
-- Current public capability version: `0.2.45`
+- Current public capability version: `0.2.47`
 
 ## XHS 蒲公英 / Pugongying commercial note details
 
-Version `0.2.45` adds `xhs pgy-detail` and the matching `media-detail` Skill routing:
+Version `0.2.47` adds npm metadata-based Skill update checks. Version `0.2.45` added `xhs pgy-detail` and the matching `media-detail` Skill routing:
 
 ```bash
 npx -y socialdatax-skills@latest xhs pgy-detail --note-id "<note_id>" --pretty
@@ -127,6 +127,8 @@ npx -y socialdatax-skills@latest xhs download-media --url "<xhs_media_url>" --ou
 npx -y socialdatax-skills@latest douyin hot-search --pretty
 npx -y socialdatax-skills@latest douyin search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest douyin detail --aweme-id "<aweme_id>" --pretty
+npx -y socialdatax-skills@latest douyin share-link --aweme-id "<aweme_id>" --pretty
+npx -y socialdatax-skills@latest douyin share-link --url "<work_url_or_share_text>" --pretty
 npx -y socialdatax-skills@latest douyin comments --aweme-id "<aweme_id>" --pretty
 npx -y socialdatax-skills@latest douyin comments --aweme-id "<aweme_id>" --all --include-replies --pretty
 npx -y socialdatax-skills@latest douyin replies --aweme-id "<aweme_id>" --comment-id "<comment_id>" --pretty
@@ -652,6 +654,8 @@ Current Sensitive Words Check workflows include:
 | `douyin_search_users` | Search Douyin creators/accounts by keyword with optional `page_token` continuation and filters; do not pass `page`. |
 | `douyin_get_video_detail_by_aweme_id` | Fetch structured Douyin work details when the caller already has an aweme_id. |
 | `douyin_get_video_detail_by_url` | Resolve a Douyin content page link, short link, or share text into structured Douyin work details. |
+| `douyin_get_video_share_link_by_aweme_id` | Generate a work share short link and copyable share text by aweme_id. |
+| `douyin_get_video_share_link_by_url` | Generate a share short link and copyable share text from a work page link, short link, or share text. |
 | `douyin_get_video_comments_by_aweme_id` | Fetch paginated first-level comments when the caller already has an aweme_id. |
 | `douyin_get_video_comments_by_url` | Fetch paginated first-level comments directly from a Douyin content page URL, short link, or share text. |
 | `douyin_get_video_comment_replies_by_comment_id` | Fetch paginated replies under a first-level Douyin comment; pass both aweme_id and comment_id, and use page_token to continue pagination. |

package/cli.mjs

@@ -3,8 +3,11 @@
 import { existsSync, realpathSync } from "node:fs";
 import {
   cp,
+  lstat,
   mkdir,
+  mkdtemp,
   readFile,
+  rename,
   rm,
   stat,
 } from "node:fs/promises";
@@ -22,7 +25,7 @@ import { decryptWechatMediaCommand } from "./lib/media/wechat-decrypt.mjs";
 export { decryptWechatMediaCommand };
 
 const PACKAGE_NAME = "socialdatax-skills";
-const PACKAGE_VERSION = "0.2.45";
+const PACKAGE_VERSION = "0.2.47";
 const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
 const LOG_PREFIX = `[${PACKAGE_NAME}]`;
 const MIN_NODE_VERSION = "20.18.1";
@@ -231,6 +234,7 @@ const DOUYIN_DIRECT_ACTION_OPTIONS = {
     "pretty",
   ],
   detail: ["awemeId", "url", "pretty"],
+  "share-link": ["awemeId", "url", "pretty"],
   comments: [
     "awemeId",
     "url",
@@ -985,6 +989,14 @@ const PLATFORMS = {
         name: "douyin_get_video_detail_by_url",
         description: "Resolve a Douyin content page link, short link, or share text into structured details.",
       },
+      {
+        name: "douyin_get_video_share_link_by_url",
+        description: "Generate a Douyin work share short link and copyable share text from a work page link, short link, or share text. Use the ID tool when aweme_id is known. To read work content, use a detail tool.",
+      },
+      {
+        name: "douyin_get_video_share_link_by_aweme_id",
+        description: "Generate a Douyin work share short link and copyable share text by aweme_id. Use a user-provided ID directly; no prior search or detail request is needed. To read work content, use a detail tool.",
+      },
       {
         name: "douyin_get_video_comments_by_aweme_id",
         description: "Fetch paginated first-level comments by aweme_id.",
@@ -2658,13 +2670,14 @@ async function validateInstallPlan({ skillName, destination, force }) {
     );
   }
 
-  if (existsSync(destination) && !force) {
+  const destinationExists = await pathExists(destination);
+  if (destinationExists && !force) {
     throw new Error(
       `Skill already exists at ${destination}. Re-run with --force to replace it.`
     );
   }
 
-  if (existsSync(destination) && force) {
+  if (destinationExists && force) {
     await ensureSafeToReplaceSkill(destination, skillName);
   }
 }
@@ -2682,22 +2695,82 @@ async function installOneSkill({
     );
   }
 
-  if (existsSync(destination) && !force) {
+  const destinationExists = await pathExists(destination);
+  if (destinationExists && !force) {
     throw new Error(
       `Skill already exists at ${destination}. Re-run with --force to replace it.`
     );
   }
 
-  if (existsSync(destination) && force) {
+  if (destinationExists && force) {
     await ensureSafeToReplaceSkill(destination, skillName);
-    await rm(destination, { recursive: true, force: true });
   }
 
   await mkdir(dirname(destination), { recursive: true });
-  await cp(sourceDir, destination, { recursive: true });
+  const stagingRoot = await mkdtemp(
+    join(dirname(destination), `.${skillName}-install-`)
+  );
+  const stagedDestination = join(stagingRoot, "next");
+  let preserveStagingRoot = false;
+
+  try {
+    await cp(sourceDir, stagedDestination, { recursive: true });
+
+    if (!(await pathExists(destination))) {
+      await rename(stagedDestination, destination);
+      return;
+    }
+
+    if (!force) {
+      throw new Error(
+        `Skill already exists at ${destination}. Re-run with --force to replace it.`
+      );
+    }
+
+    await ensureSafeToReplaceSkill(destination, skillName);
+    const backupDestination = join(stagingRoot, "previous");
+    await rename(destination, backupDestination);
+
+    try {
+      await rename(stagedDestination, destination);
+    } catch (installError) {
+      try {
+        await rename(backupDestination, destination);
+      } catch (restoreError) {
+        preserveStagingRoot = true;
+        throw new Error(
+          `Skill replacement failed: ${installError.message}. The previous Skill remains at ${backupDestination} because restore failed: ${restoreError.message}`
+        );
+      }
+      throw installError;
+    }
+  } finally {
+    if (!preserveStagingRoot) {
+      await rm(stagingRoot, { recursive: true, force: true }).catch(() => {});
+    }
+  }
+}
+
+async function pathExists(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
 }
 
 async function ensureSafeToReplaceSkill(destination, skillName) {
+  const destinationLinkStats = await lstat(destination);
+  if (destinationLinkStats.isSymbolicLink()) {
+    throw new Error(
+      `Refusing to replace ${destination}: existing path is a symbolic link. Choose the actual Skill directory instead.`
+    );
+  }
+
   const destinationStats = await stat(destination);
   if (!destinationStats.isDirectory()) {
     throw new Error(
@@ -2907,6 +2980,10 @@ function printHelp() {
   console.log(`  npx -y ${PACKAGE_SPEC} douyin search --keyword "露营" --pretty`);
   console.log("      Call the Douyin work search tool directly and print JSON.");
   console.log("");
+  console.log(`  npx -y ${PACKAGE_SPEC} douyin share-link --aweme-id "<aweme_id>" --pretty`);
+  console.log(`  npx -y ${PACKAGE_SPEC} douyin share-link --url "<work_url_or_share_text>" --pretty`);
+  console.log("      Generate a share short link and copyable share text for a Douyin work.");
+  console.log("");
   console.log(`  npx -y ${PACKAGE_SPEC} douyin detail --aweme-id "<aweme_id>" --pretty`);
   console.log("      Call the Douyin work detail tool directly and print JSON.");
   console.log("");
@@ -4055,6 +4132,21 @@ function buildDouyinOperation(action, options) {
         }),
         PLATFORMS.douyin
       );
+    case "share-link":
+      return buildDirectOperation(
+        "share-link",
+        buildOneOfCall(options, {
+          idOption: "awemeId",
+          urlOption: "url",
+          idTool: "douyin_get_video_share_link_by_aweme_id",
+          urlTool: "douyin_get_video_share_link_by_url",
+          idArgument: "aweme_id",
+          urlArgument: "url",
+          idDisplay: "--aweme-id",
+          urlDisplay: "--url",
+        }),
+        PLATFORMS.douyin
+      );
     case "comments":
       return buildDirectOperation(
         "comments",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socialdatax-skills",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "description": "SocialDataX / 社媒数据助手 skill installer and direct CLI helper for hosted MCP services.",
   "license": "MIT",
   "type": "module",

package/skills/media-comments/SKILL.md

@@ -45,6 +45,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/media-detail/SKILL.md

@@ -47,6 +47,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/media-search/SKILL.md

@@ -45,6 +45,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/media-transcript/SKILL.md

@@ -45,6 +45,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/media-user-info/SKILL.md

@@ -46,6 +46,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/media-user-posts/SKILL.md

@@ -46,6 +46,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/sensitive-check/SKILL.md

@@ -35,6 +35,20 @@ Current context support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration:

package/skills/socialdatax-content-research-assistant/SKILL.md

@@ -98,6 +98,20 @@ Current platform support:
 Use `SOCIALDATAX_API_KEY` for SocialDataX requests. The only official website for requesting or managing API access is <https://socialdatax.com/ai?from=npm>. If a user asks where to get a key, provide only this URL; do not infer alternate domains.
 获取或管理 API Key：访问 <https://socialdatax.com/ai?from=npm>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。
 
+## Skill Updates
+
+Before each SocialDataX data operation, check the published npm version metadata:
+
+```bash
+npm view socialdatax-skills@latest version --json
+```
+
+- Compare the JSON version with this installed Skill version: `0.2.47`. Compare `MAJOR.MINOR.PATCH` fields as integers from left to right, not as strings. Treat other published values as invalid.
+- If the published semantic version is higher, ask the user: `检测到 SocialDataX Skill 新版本，是否现在升级？` Do not expose targets, local paths, or shell commands unless the user asks for technical details.
+- Only after the user confirms, use the current AI client's Skill installation flow with overwrite enabled to replace this exact Skill from `socialdatax-skills@latest`; for the direct CLI, pass this Skill's slug, add `--force`, and keep the current client's target and `--scope`. If it was installed with `--path`, reuse this Skill's own directory, not the parent directory, so other Skills are not installed. Then report the result. Never update automatically without confirmation.
+- If the version is unchanged, invalid, or unavailable, do not mention updates and continue the current request.
+- Do not ask the user to identify a target, local path, or installation command. Do not guess one. If the current AI client cannot safely complete the replacement, report that result.
+
 ## Preferred Direct CLI
 
 Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration: