weaver-work-cli 0.1.5 → 0.1.7

package/dist/internal/e10/auth/xiaoe.js

@@ -1,7 +1,11 @@
+import { execFile } from 'node:child_process';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { CliError, ExitCode } from '../../../core/errors.js';
 import { buildE10CookieHeader, E10AuthSession, profileNameFromUrl, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
 export const DEFAULT_E10_BASE_URL = 'https://www.e-cology.com.cn';
-export const XIAOE_AGENT_TYPE = 'Xiao.E';
+export const XIAOE_AGENT_TYPE = 'XiaoE';
 const XIAOE_UNIFIED_LOGIN_MAP_ENV_KEYS = [
     'XIAOE_E10_AUTH_MAP',
     'XIAOE_E10_DOMAIN_ETEAMSID_MAP',
@@ -27,6 +31,13 @@ const XIAOE_SINGLE_ETEAMSID_ENV_KEYS = [
     'XIAOE_E10_ETEAMSID',
     'XIAOE_E10_ETEAM_ID',
 ];
+const XIAOE_TOKEN_SCRIPT_ENV_KEY = 'XIAOE_TOKEN_SCRIPT_PATH';
+const XIAOE_TOKEN_SCRIPT_PYTHON_ENV_KEY = 'XIAOE_TOKEN_SCRIPT_PYTHON';
+const XIAOE_TOKEN_SCRIPT_TIMEOUT_MS = 15_000;
+const XIAOE_CLIENT_TOKEN_TIMEOUT_MS = 15_000;
+export const XIAOE_SKILL_ETEAMID_API_PATH = '/spec-apps/api/app/rpachat/skill/extend/eteamId';
+export const XIAOE_CLIENT_SETTINGS_SOURCE = 'XiaoE/Robots/user_settings.json';
+export const XIAOE_USER_TOKEN_SOURCE = 'XIAOE_USER_TOKEN';
 function envString(env, ...keys) {
     for (const key of keys) {
         const value = env[key];
@@ -41,6 +52,29 @@ function hasEnvPrefix(env, prefix) {
 export function hasXiaoEEnv(env = process.env) {
     return hasEnvPrefix(env, 'XIAOE');
 }
+export function describeXiaoECredentialSource(source) {
+    if (source === 'xiaoeUserData/tokens.py') {
+        return {
+            credentialSourceStep: 1,
+            credentialSourceType: 'token_script',
+            credentialSourceLabel: 'xiaoeUserData/tokens.py',
+        };
+    }
+    if (source === XIAOE_CLIENT_SETTINGS_SOURCE || source === XIAOE_USER_TOKEN_SOURCE) {
+        return {
+            credentialSourceStep: 2,
+            credentialSourceType: 'xiaoe_client',
+            credentialSourceLabel: source === XIAOE_USER_TOKEN_SOURCE
+                ? 'XiaoE client user token'
+                : 'XiaoE client settings',
+        };
+    }
+    return {
+        credentialSourceStep: 3,
+        credentialSourceType: 'xiaoe_env',
+        credentialSourceLabel: 'XIAOE_* environment variables',
+    };
+}
 function normalizeUrl(value) {
     return value.replace(/\/+$/, '');
 }
@@ -54,6 +88,36 @@ function readString(data, ...keys) {
     }
     return '';
 }
+function cookieString(value) {
+    if (!value)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'object' && !Array.isArray(value)) {
+        return Object.entries(value)
+            .filter(([, cookieValue]) => cookieValue !== undefined && cookieValue !== null && cookieValue !== '')
+            .map(([name, cookieValue]) => `${name}=${String(cookieValue)}`)
+            .join('; ');
+    }
+    return '';
+}
+function cookieValue(rawCookie, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = rawCookie.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+    return match?.[1] || '';
+}
+function recordCandidates(value) {
+    return [
+        value,
+        value.data,
+        value.result,
+        value.auth,
+        value.session,
+        value.e10,
+        value.e10Auth,
+        value.e10_auth,
+    ].filter((entry) => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry));
+}
 function normalizeDomainKey(value) {
     const raw = normalizeUrl(value.trim());
     if (!raw)
@@ -84,11 +148,22 @@ function domainMatches(baseUrl, candidate) {
         || Boolean(base.host && target.host && base.host === target.host);
 }
 function readXiaoECredentialRecord(value, source, fallbackBaseUrl = '') {
-    const baseUrl = readString(value, 'domain', 'baseUrl', 'base_url', 'url', 'host') || fallbackBaseUrl;
-    const eteamsId = readString(value, 'eteamsId', 'eteamsid', 'ETEAMSID', 'eteamId', 'eteam_id', 'eTeamId');
+    const candidates = recordCandidates(value);
+    const baseUrl = candidates
+        .map((entry) => readString(entry, 'domain', 'baseUrl', 'base_url', 'url', 'host', 'e10BaseUrl', 'e10_base_url'))
+        .find(Boolean)
+        || fallbackBaseUrl;
+    const rawCookie = candidates
+        .map((entry) => cookieString(entry.cookies || entry.cookie || entry.rawCookie || entry.raw_cookie))
+        .find(Boolean)
+        || '';
+    const eteamsId = candidates
+        .map((entry) => readString(entry, 'eteamsId', 'eteamsid', 'ETEAMSID', 'eteamId', 'eteam_id', 'eTeamId', 'eteamID', 'eteam_id'))
+        .find(Boolean)
+        || cookieValue(rawCookie, 'ETEAMSID');
     if (!baseUrl || !eteamsId)
         return null;
-    return { baseUrl: normalizeUrl(baseUrl), eteamsId, source };
+    return { baseUrl: normalizeUrl(baseUrl), eteamsId, source, rawCookie };
 }
 function parseXiaoEUnifiedLoginMap(raw, source) {
     const value = raw.trim();
@@ -172,6 +247,235 @@ export function resolveXiaoEDefaultBaseUrl(env = process.env) {
         return normalizeUrl(firstCredential.baseUrl);
     return hasXiaoEEnv(env) ? DEFAULT_E10_BASE_URL : '';
 }
+function uniqueStrings(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (!value || seen.has(value))
+            continue;
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
+function xiaoETokenScriptCandidatePaths(env = process.env) {
+    const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY);
+    if (explicit)
+        return [explicit];
+    if (process.platform === 'win32') {
+        const localAppData = envString(env, 'LOCALAPPDATA');
+        const userProfile = envString(env, 'USERPROFILE');
+        return uniqueStrings([
+            localAppData ? join(localAppData, 'xiaoeUserData', 'tokens.py') : '',
+            userProfile ? join(userProfile, 'AppData', 'Local', 'xiaoeUserData', 'tokens.py') : '',
+        ]);
+    }
+    const envHome = envString(env, 'HOME');
+    const nodeHome = homedir();
+    return uniqueStrings([
+        envHome ? join(envHome, 'Library', 'Application Support', 'xiaoeUserData', 'tokens.py') : '',
+        nodeHome ? join(nodeHome, 'Library', 'Application Support', 'xiaoeUserData', 'tokens.py') : '',
+    ]);
+}
+function xiaoETokenScriptPath(env = process.env) {
+    return xiaoETokenScriptCandidatePaths(env).find((path) => existsSync(path)) || '';
+}
+export function hasXiaoETokenScript(env = process.env) {
+    const explicit = envString(env, XIAOE_TOKEN_SCRIPT_ENV_KEY);
+    if (explicit)
+        return existsSync(explicit);
+    const scriptPath = xiaoETokenScriptPath(env);
+    return Boolean(scriptPath && existsSync(scriptPath));
+}
+function xiaoETokenScriptPythonCandidates(env = process.env) {
+    const explicit = envString(env, XIAOE_TOKEN_SCRIPT_PYTHON_ENV_KEY);
+    if (explicit)
+        return [explicit];
+    return uniqueStrings(process.platform === 'win32'
+        ? ['python', 'python3', 'py']
+        : ['python3', '/usr/bin/python3', 'python']);
+}
+function isXiaoETokenScriptEnvFailure(message) {
+    return /No module named|ModuleNotFoundError|ENOENT|command not found|not recognized as an internal|cannot find the file/i
+        .test(message);
+}
+async function runXiaoETokenScriptOnce(pythonCommand, scriptPath, env) {
+    const wrapper = [
+        'import ast,contextlib,io,json,runpy,sys',
+        `path = ${JSON.stringify(scriptPath)}`,
+        'buf = io.StringIO()',
+        'data = None',
+        'with contextlib.redirect_stdout(buf):',
+        '    runpy.run_path(path, run_name="__main__")',
+        'text = buf.getvalue().strip()',
+        'if text:',
+        '    lines = [line.strip() for line in text.splitlines() if line.strip()]',
+        '    candidates = [text] + (lines[-1:] if lines else [])',
+        '    last_error = None',
+        '    for candidate in candidates:',
+        '        try:',
+        '            data = json.loads(candidate)',
+        '            break',
+        '        except Exception as exc:',
+        '            last_error = exc',
+        '        try:',
+        '            data = ast.literal_eval(candidate)',
+        '            break',
+        '        except Exception as exc:',
+        '            last_error = exc',
+        '    if data is None:',
+        '        raise SystemExit("tokens.py stdout is not valid JSON object")',
+        'else:',
+        '    raise SystemExit("tokens.py produced empty stdout")',
+        'print(json.dumps(data, ensure_ascii=False))',
+    ].join('\n');
+    return await new Promise((resolve, reject) => {
+        execFile(pythonCommand, ['-c', wrapper], {
+            env,
+            timeout: XIAOE_TOKEN_SCRIPT_TIMEOUT_MS,
+            maxBuffer: 1024 * 1024,
+        }, (error, stdout, stderr) => {
+            if (error) {
+                const detail = (stderr || error.message || 'unknown error').trim().split('\n').slice(-1)[0];
+                reject(new CliError('XiaoE token script failed: ' + detail, ExitCode.AuthError));
+                return;
+            }
+            const text = stdout.trim();
+            if (!text) {
+                reject(new CliError('XiaoE token script returned empty stdout.', ExitCode.AuthError));
+                return;
+            }
+            try {
+                const parsed = JSON.parse(text);
+                resolve(parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null);
+            }
+            catch {
+                reject(new CliError('XiaoE token script stdout is not valid JSON.', ExitCode.AuthError));
+            }
+        });
+    });
+}
+async function runXiaoETokenScript(env = process.env) {
+    const scriptPath = xiaoETokenScriptPath(env);
+    if (!scriptPath || !existsSync(scriptPath))
+        return null;
+    let lastError = null;
+    for (const pythonCommand of xiaoETokenScriptPythonCandidates(env)) {
+        try {
+            return await runXiaoETokenScriptOnce(pythonCommand, scriptPath, env);
+        }
+        catch (error) {
+            lastError = error;
+            const message = error instanceof Error ? error.message : String(error);
+            // Only keep probing other interpreters when this one could not even load
+            // the script's dependencies; a real script error would repeat everywhere.
+            if (!isXiaoETokenScriptEnvFailure(message))
+                break;
+        }
+    }
+    throw lastError instanceof Error ? lastError : new CliError('XiaoE token script failed.', ExitCode.AuthError);
+}
+async function resolveXiaoETokenScriptCredential(baseUrl, env = process.env) {
+    const tokenData = await runXiaoETokenScript(env);
+    if (!tokenData)
+        return null;
+    return readXiaoECredentialRecord(tokenData, 'xiaoeUserData/tokens.py', baseUrl);
+}
+export function xiaoEClientRobotsRoot(env = process.env) {
+    if (process.platform === 'win32') {
+        const localAppData = envString(env, 'LOCALAPPDATA');
+        return localAppData ? join(localAppData, 'XiaoE', 'Robots') : '';
+    }
+    const home = envString(env, 'HOME') || homedir();
+    return home ? join(home, 'Library', 'Application Support', 'XiaoE', 'Robots') : '';
+}
+export function findXiaoEClientSettingsFile(env = process.env) {
+    const root = xiaoEClientRobotsRoot(env);
+    if (!root || !existsSync(root))
+        return '';
+    let entries = [];
+    try {
+        entries = readdirSync(root);
+    }
+    catch {
+        return '';
+    }
+    const files = entries
+        .map((name) => join(root, name, 'user_settings.json'))
+        .filter((path) => {
+        try {
+            return statSync(path).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (files.length === 0)
+        return '';
+    return files.sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs)[0];
+}
+/**
+ * Mirror of the host `xiaoeUserData/tokens.py` credential chain, implemented in
+ * Node so the CLI does not depend on a Python runtime that has `requests`.
+ */
+export function readXiaoEClientCredential(env = process.env) {
+    const envToken = envString(env, 'XIAOE_USER_TOKEN');
+    if (envToken) {
+        const erpaUrl = normalizeUrl(envString(env, 'XIAOE_ERP', 'XIAOE_ERPA', 'XIAOE_ERP_URL', 'XIAOE_DOMAIN'));
+        if (/^https?:\/\//i.test(erpaUrl)) {
+            return { authToken: envToken, erpaUrl, source: XIAOE_USER_TOKEN_SOURCE };
+        }
+    }
+    const settingsFile = findXiaoEClientSettingsFile(env);
+    if (!settingsFile)
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(settingsFile, 'utf8'));
+        const authToken = readString(parsed, 'session_id', 'sessionId');
+        const erpaUrl = normalizeUrl(readString(parsed, 'erpa', 'erpa_url', 'erpaUrl'));
+        if (!authToken || !erpaUrl)
+            return null;
+        return { authToken, erpaUrl, source: XIAOE_CLIENT_SETTINGS_SOURCE };
+    }
+    catch {
+        return null;
+    }
+}
+export function hasXiaoEClientCredential(env = process.env) {
+    return Boolean(envString(env, 'XIAOE_USER_TOKEN')) || Boolean(findXiaoEClientSettingsFile(env));
+}
+async function fetchXiaoEClientEteamId(credential, domain) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), XIAOE_CLIENT_TOKEN_TIMEOUT_MS);
+    try {
+        const resp = await fetch(`${credential.erpaUrl}${XIAOE_SKILL_ETEAMID_API_PATH}`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                authorization: credential.authToken,
+            },
+            body: JSON.stringify({ domain: domain || DEFAULT_E10_BASE_URL }),
+            redirect: 'manual',
+            signal: controller.signal,
+        });
+        if (!resp.ok) {
+            throw new CliError(`XiaoE client token endpoint returned HTTP ${resp.status}.`, ExitCode.AuthError);
+        }
+        const data = await resp.json().catch(() => null);
+        return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function resolveXiaoEClientCredential(baseUrl, env = process.env) {
+    const clientCredential = readXiaoEClientCredential(env);
+    if (!clientCredential)
+        return null;
+    const targetBaseUrl = baseUrl || DEFAULT_E10_BASE_URL;
+    const payload = await fetchXiaoEClientEteamId(clientCredential, targetBaseUrl);
+    return readXiaoECredentialRecord(payload, clientCredential.source, targetBaseUrl);
+}
 export function resolveXiaoEPreferredBaseUrl(options) {
     const env = options.env || process.env;
     const explicit = normalizeUrl(options.explicitBaseUrl || '');
@@ -200,15 +504,18 @@ async function resolveUserInfo(baseUrl, eteamsId, rawCookie = '', agentType = ''
 }
 async function saveXiaoEUnifiedLogin(input) {
     const baseUrl = normalizeUrl(input.baseUrl);
-    const userInfo = await resolveUserInfo(baseUrl, input.eteamsId, '', XIAOE_AGENT_TYPE);
+    const userInfo = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || '', XIAOE_AGENT_TYPE);
     if (!userInfo.userId) {
         throw new CliError('Could not resolve userId. Check whether XiaoE unified login is valid for this E10 domain.', ExitCode.AuthError);
     }
     const tenantKey = userInfo.tenantKey || input.tenantKeyFallback || '';
     const profile = input.profileHint || profileNameFromUrl(baseUrl);
     setActiveProfile(profile);
+    const cookies = { ETEAMSID: input.eteamsId };
+    if (input.rawCookie)
+        cookies.raw = input.rawCookie;
     const authData = {
-        cookies: { ETEAMSID: input.eteamsId },
+        cookies,
         userId: userInfo.userId,
         tenantKey,
         tenantName: userInfo.tenantName,
@@ -221,6 +528,9 @@ async function saveXiaoEUnifiedLogin(input) {
         passportUrl: baseUrl,
         cookieSavedAt: Date.now(),
         loginSource: 'xiaoe-unified',
+        credentialSourceStep: input.credentialSource.credentialSourceStep,
+        credentialSourceType: input.credentialSource.credentialSourceType,
+        credentialSourceLabel: input.credentialSource.credentialSourceLabel,
     };
     const authFile = saveAuthFile(authData, profile);
     saveProfileConfig(baseUrl, baseUrl, profile, tenantKey);
@@ -237,32 +547,74 @@ async function saveXiaoEUnifiedLogin(input) {
             authFile,
             agentType: XIAOE_AGENT_TYPE,
             version: '',
+            loginSource: 'xiaoe-unified',
+            ...input.credentialSource,
         },
     };
 }
 export async function tryXiaoEUnifiedLogin(options = {}) {
     const env = options.env || process.env;
+    const explicitBaseUrl = normalizeUrl(options.baseUrl || '');
     const baseUrl = resolveXiaoEPreferredBaseUrl({
-        explicitBaseUrl: options.baseUrl,
+        explicitBaseUrl,
         env,
     });
-    if (!baseUrl)
+    const mayUseTokenScript = options.allowTokenScript || hasXiaoEEnv(env);
+    if (!baseUrl && !mayUseTokenScript)
         return null;
-    const credential = resolveXiaoEUnifiedLoginCredential(baseUrl, env);
+    let credential = null;
+    if (mayUseTokenScript) {
+        const tokenScriptPath = xiaoETokenScriptPath(env);
+        if (!tokenScriptPath) {
+            options.logger?.warn('XiaoE token script not found. Expected xiaoeUserData/tokens.py; will try the built-in XiaoE client credential next.');
+        }
+        else {
+            options.logger?.info('Trying XiaoE token script credential...');
+            try {
+                credential = await resolveXiaoETokenScriptCredential(explicitBaseUrl || DEFAULT_E10_BASE_URL, env);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                options.logger?.warn('XiaoE token script failed. ' + message);
+            }
+            if (!credential) {
+                options.logger?.warn('XiaoE token script did not return usable ETEAMSID; will try the built-in XiaoE client credential next.');
+            }
+        }
+        // Built-in Node equivalent of tokens.py: reads the local XiaoE client
+        // session and exchanges it for an eteamId, so a Python runtime without
+        // `requests` no longer blocks unified login.
+        if (!credential && hasXiaoEClientCredential(env)) {
+            try {
+                credential = await resolveXiaoEClientCredential(explicitBaseUrl || DEFAULT_E10_BASE_URL, env);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                options.logger?.warn('Built-in XiaoE client credential failed. ' + message);
+            }
+            if (!credential) {
+                options.logger?.warn('Built-in XiaoE client credential did not return usable ETEAMSID; will try XIAOE_* credentials next.');
+            }
+        }
+    }
+    if (!credential && baseUrl)
+        credential = resolveXiaoEUnifiedLoginCredential(baseUrl, env);
     if (!credential)
         return null;
     options.logger?.info('Detected XiaoE unified login for this E10 domain. Trying XiaoE auth...');
     try {
         return await saveXiaoEUnifiedLogin({
-            baseUrl,
+            baseUrl: credential.baseUrl || baseUrl || DEFAULT_E10_BASE_URL,
             eteamsId: credential.eteamsId,
+            rawCookie: credential.rawCookie,
             tenantKeyFallback: options.tenantKeyFallback,
             profileHint: options.profileHint,
+            credentialSource: describeXiaoECredentialSource(credential.source),
         });
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        options.logger?.warn('XiaoE unified login failed; falling back to standard E10 auth. ' + message);
+        options.logger?.warn('XiaoE unified login failed. ' + message);
         return null;
     }
 }

package/dist/internal/e10/context.js

@@ -1,9 +1,9 @@
 import { CliError, ExitCode } from '../../core/errors.js';
 import { E10AuthSession } from './auth/session.js';
-import { hasXiaoEEnv, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
+import { hasXiaoEEnv, hasXiaoETokenScript, tryXiaoEUnifiedLogin } from './auth/xiaoe.js';
 import { E10ApiClient } from './client.js';
 function shouldPreferXiaoEUnifiedLogin(options, env) {
-    return hasXiaoEEnv(env) && !options.auth && !options.profile;
+    return !options.auth && !options.profile && (hasXiaoEEnv(env) || hasXiaoETokenScript(env));
 }
 export async function getE10Session(ctx) {
     const options = ctx.getGlobalOptions();
@@ -11,10 +11,12 @@ export async function getE10Session(ctx) {
         const xiaoELogin = await tryXiaoEUnifiedLogin({
             env: ctx.env,
             baseUrl: options.baseUrl,
+            allowTokenScript: true,
             logger: ctx.logger,
         });
         if (xiaoELogin)
             return xiaoELogin.session;
+        return null;
     }
     return E10AuthSession.fromOptions(options, ctx.cwd);
 }

package/dist/internal/skills/detector.js

@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { CliError, ExitCode } from '../../core/errors.js';
+export const PACKAGED_DETECTOR_VERSION = '1.0.13';
+export const PACKAGED_DETECTOR_NAME = `weaver-skill-detector-${PACKAGED_DETECTOR_VERSION}`;
+export function packagedDetectorDir() {
+    return fileURLToPath(new URL(`../../../tools/${PACKAGED_DETECTOR_NAME}/`, import.meta.url));
+}
+function detectorScriptPath(detectorDir) {
+    return join(detectorDir, 'scripts', 'validate_skill.py');
+}
+function legacySiblingDetectorDir() {
+    return resolve(packagedDetectorDir(), '..', '..', '..', PACKAGED_DETECTOR_NAME);
+}
+function detectorVersion(detectorDir) {
+    let version = PACKAGED_DETECTOR_VERSION;
+    const metaPath = join(detectorDir, '_meta.json');
+    if (existsSync(metaPath)) {
+        try {
+            const meta = JSON.parse(readFileSync(metaPath, 'utf8'));
+            if (typeof meta.version === 'string' && meta.version)
+                version = meta.version;
+        }
+        catch {
+            version = PACKAGED_DETECTOR_VERSION;
+        }
+    }
+    return version;
+}
+export function resolveDetectorInfo(detectorDir) {
+    const candidates = detectorDir
+        ? [resolve(detectorDir)]
+        : [packagedDetectorDir(), legacySiblingDetectorDir()].map((candidate) => resolve(candidate));
+    for (const candidate of candidates) {
+        const scriptPath = detectorScriptPath(candidate);
+        if (existsSync(scriptPath)) {
+            return { detectorDir: candidate, scriptPath, version: detectorVersion(candidate) };
+        }
+    }
+    throw new CliError(`weaver skill detector is not available; checked: ${candidates.map(detectorScriptPath).join(', ')}`, ExitCode.UsageError);
+}

package/dist/internal/skills/install.js

@@ -63,6 +63,7 @@ export function installPackagedSkills(sourceRoot, targetRoot, requested = 'all')
     const resolvedSourceRoot = resolve(sourceRoot);
     const resolvedTargetRoot = resolve(targetRoot);
     const skillNames = resolvePackagedSkillNames(resolvedSourceRoot, requested);
+    const productContent = productMetadataContent(resolvedSourceRoot);
     mkdirSync(resolvedTargetRoot, { recursive: true, mode: 0o700 });
     const installed = skillNames.flatMap((name) => {
         const source = resolveInside(resolvedSourceRoot, name);
@@ -71,8 +72,9 @@ export function installPackagedSkills(sourceRoot, targetRoot, requested = 'all')
         cpSync(source, target, {
             recursive: true,
             force: true,
-            filter: (entry) => shouldCopy(entry, source),
+            filter: (entry) => shouldCopy(entry, source, Boolean(productContent)),
         });
+        writeProductMetadata(target, productContent);
         const current = {
             name,
             source,
@@ -86,9 +88,10 @@ export function installPackagedSkills(sourceRoot, targetRoot, requested = 'all')
         cpSync(source, legacyTarget, {
             recursive: true,
             force: true,
-            filter: (entry) => shouldCopy(entry, source),
+            filter: (entry) => shouldCopy(entry, source, Boolean(productContent)),
         });
         rewriteSkillName(resolve(legacyTarget, 'SKILL.md'), LEGACY_SHARED_SKILL_NAME);
+        writeProductMetadata(legacyTarget, productContent);
         return [current, {
                 name: LEGACY_SHARED_SKILL_NAME,
                 source,
@@ -107,11 +110,55 @@ function rewriteSkillName(skillPath, name) {
     const content = readFileSync(skillPath, 'utf8');
     writeFileSync(skillPath, content.replace(/^name:\s*weaver-e10-shared\s*$/mu, `name: ${name}`), 'utf8');
 }
-function shouldCopy(entry, sourceRoot) {
+function productMetadataContent(sourceRoot) {
+    const productPath = productMetadataPath(sourceRoot);
+    if (!existsSync(productPath))
+        return null;
+    const product = JSON.parse(readFileSync(productPath, 'utf8'));
+    const packageInfo = readPackageInfo(resolve(sourceRoot, '..', 'package.json'));
+    const metadata = {
+        schemaVersion: typeof product.schemaVersion === 'number' ? product.schemaVersion : 1,
+        product: stringOrEmpty(product.product),
+        productVersion: stringOrEmpty(packageInfo?.version) || stringOrEmpty(product.productVersion),
+        packageName: stringOrEmpty(packageInfo?.name) || stringOrEmpty(product.packageName),
+        command: stringOrEmpty(product.command),
+        nodeEngine: stringOrEmpty(packageInfo?.engines?.node) || stringOrEmpty(product.nodeEngine),
+    };
+    if (metadata.product !== 'weaver-work-cli' ||
+        metadata.packageName !== 'weaver-work-cli' ||
+        metadata.command !== 'weaver-work-cli' ||
+        !metadata.productVersion ||
+        !metadata.nodeEngine) {
+        throw new Error('skill-template/product.json or package.json is invalid for weaver-work-cli skills');
+    }
+    return `${JSON.stringify(metadata, null, 2)}\n`;
+}
+function productMetadataPath(sourceRoot) {
+    const templatePath = resolve(sourceRoot, '..', 'skill-template', 'product.json');
+    if (existsSync(templatePath))
+        return templatePath;
+    return resolve(sourceRoot, 'product.json');
+}
+function readPackageInfo(packagePath) {
+    if (!existsSync(packagePath))
+        return null;
+    return JSON.parse(readFileSync(packagePath, 'utf8'));
+}
+function stringOrEmpty(value) {
+    return typeof value === 'string' ? value : '';
+}
+function writeProductMetadata(target, productContent) {
+    if (!productContent)
+        return;
+    writeFileSync(resolve(target, 'product.json'), productContent, 'utf8');
+}
+function shouldCopy(entry, sourceRoot, skipSkillProduct) {
     const relativePath = relative(sourceRoot, entry);
     const name = basename(entry);
     if (!relativePath)
         return true;
+    if (skipSkillProduct && relativePath === 'product.json')
+        return false;
     if (name === '.DS_Store' || name.startsWith('.'))
         return false;
     const parts = relativePath.split(sep);

package/dist/shortcuts/archive/render/search-format.js

@@ -195,7 +195,16 @@ export function formatSearchText(rows, meta = undefined) {
  *
  *      全宗：xxx　分类：xxx　文件形成时间：2026-01-23                      ← 第三段
  * 注意：三段间必须空行，单换行在 Markdown 是软换行会被折叠成空格。
+ * 第二、三段必须缩进 3 空格（对齐 `1. ` 后的内容列）：不缩进会被判定为列表外段落，
+ * 渲染器会把下一条当作新列表起点，导致所有条目的序号都显示为 1。
  * ------------------------------------------------------------------ */
+/** 卡片第二、三段缩进 3 空格，保持属于同一条有序列表项；不缩进会被渲染器重排成新列表（序号全变 1）。 */
+function indentContinuation(text) {
+    return text
+        .split('\n')
+        .map((line) => (line.trim() ? `   ${line}` : ''))
+        .join('\n');
+}
 export function formatSearchCard(rows, options = {}) {
     const baseUrl = String(options.baseUrl ?? '').trim().replace(/\/+$/, '');
     const items = rows.map((row) => {
@@ -214,10 +223,10 @@ export function formatSearchCard(rows, options = {}) {
         const highlight = markdownHighlight(highlightSourceOf(raw, view));
         if (highlight) {
             parts.push('');
-            parts.push(highlight);
+            parts.push(indentContinuation(highlight));
         }
         parts.push('');
-        parts.push(textMetaItems(view).join('　'));
+        parts.push(indentContinuation(textMetaItems(view).join('　')));
         blocks.push(parts.join('\n'));
     });
     return blocks.join('\n\n');
@@ -261,7 +270,7 @@ h1{font-size:20px;margin-bottom:4px}
 .trow{display:flex;align-items:baseline;gap:10px;flex-wrap:wrap}
 .idx{color:#94a3b8;font-weight:600}
 .lvl{flex:none;background:#eef4ff;color:#2563eb;border:1px solid #bfdbfe;border-radius:4px;padding:0 8px;font-size:12px}
-.tlink{font-size:15px;font-weight:600;color:#0f2c5c;text-decoration:none;word-break:break-all}
+.tlink{font-size:15px;font-weight:600;color:#0f2c5c;text-decoration:none;word-wrap:break-word;overflow-wrap:break-word}
 .tlink:hover{color:#1d6ae5;text-decoration:underline}
 .tlink.plain{cursor:default}
 .hl{margin:8px 0 6px;color:#475569;display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;overflow:hidden;font-size:13px}