refactor: 移除 @clawd/auth-runtime npm 依赖，改用 CLI subprocess 调用

通过内置 auth-cli.ts 薄 wrapper 调用 auth-runtime CLI，
消除 npm git 依赖带来的缓存和更新问题。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

install.sh

@@ -1,27 +1,20 @@
 #!/usr/bin/env bash
-# Install 1688-product-master to a target directory.
-# Bundles the skill + auth-runtime into a single self-contained file.
-#
-# Usage:
-#   ./install.sh                   # installs to ~/.openclaw/skills/
-#   ./install.sh /custom/path/
-
 set -euo pipefail
-
-SKILL_NAME="1688-product-master"
-DEST="${1:-$HOME/.openclaw/skills}"
-
 cd "$(dirname "$0")"
 
-# Always fetch latest git dependencies
-rm -rf node_modules/@clawd
-npm install
+# Prerequisite: auth-runtime must be cloned at ~/clawd/skills/auth-runtime
+if [ ! -d "$HOME/clawd/skills/auth-runtime/src" ]; then
+  echo "ERROR: auth-runtime not found at ~/clawd/skills/auth-runtime"
+  echo "Run: git clone http://192.168.0.108:3030/agent-skills/auth-runtime.git ~/clawd/skills/auth-runtime"
+  exit 1
+fi
 
-echo "Building $SKILL_NAME..."
+echo "Building 1688-product-master..."
 bun build scripts/run.ts --outfile dist/run.js --target bun
 
+DEST="${1:-$HOME/.openclaw/skills}"
+SKILL_NAME="1688-product-master"
 mkdir -p "$DEST/$SKILL_NAME"
 cp dist/run.js "$DEST/$SKILL_NAME/run.js"
 
 echo "Installed: $DEST/$SKILL_NAME/run.js"
-echo "Run with:  bun $DEST/$SKILL_NAME/run.js <command> [args...]"

package.json

@@ -7,7 +7,5 @@
     "build": "bun build scripts/run.ts --outfile dist/run.js --target bun",
     "package": "bun run build && cd .. && zip -r 1688-product-master.skill 1688-product-master/SKILL.md 1688-product-master/dist/run.js && echo 'Created: 1688-product-master.skill'"
   },
-  "dependencies": {
-    "@clawd/auth-runtime": "git+http://192.168.0.108:3030/agent-skills/auth-runtime.git"
-  }
+  "dependencies": {}
 }

src/auth-cli.ts

@@ -0,0 +1,111 @@
+/**
+ * Thin CLI wrapper for auth-runtime.
+ *
+ * Copy this file into your skill's src/ directory. It spawns
+ * `bun run <auth-runtime>/src/cli.ts` as a subprocess, so the
+ * skill has zero npm dependency on @clawd/auth-runtime.
+ *
+ * Usage:
+ *   import { createSkillClient } from './auth-cli.ts';
+ *   const client = createSkillClient();
+ *   const res = await client.post('/ecom/tasks/scrape', { url: '...' });
+ */
+
+import { spawnSync } from 'child_process';
+import * as path from 'path';
+import * as os from 'os';
+
+const AUTH_RUNTIME_DIR = process.env.AUTH_RUNTIME_DIR
+  || path.join(os.homedir(), 'clawd', 'skills', 'auth-runtime');
+const CLI_ENTRY = path.join(AUTH_RUNTIME_DIR, 'src', 'cli.ts');
+
+export interface ApiResponse {
+  status: number;
+  body: string;
+}
+
+export interface SessionResponse {
+  accessToken: string;
+  expiresIn: number;
+  ownerSessionToken?: string;
+  hookUrl?: string;
+  hookToken?: string;
+}
+
+export interface SkillClientOptions {
+  apiBase?: string;
+  dryRun?: boolean;
+}
+
+function runCli(...args: string[]): string {
+  // Use the same bun binary that's running this process
+  const bun = process.execPath;
+  const result = spawnSync(bun, ['run', CLI_ENTRY, ...args], {
+    cwd: AUTH_RUNTIME_DIR,
+    encoding: 'utf-8',
+    timeout: 60_000,
+  });
+
+  if (result.error) {
+    throw new Error(`auth-cli spawn failed: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`auth-cli failed (exit ${result.status}): ${(result.stderr || '').trim()}`);
+  }
+  return (result.stdout || '').trim();
+}
+
+export class SkillClient {
+  private readonly apiBase?: string;
+  private readonly dryRun: boolean;
+
+  constructor(options: SkillClientOptions = {}) {
+    this.apiBase = options.apiBase;
+    this.dryRun = options.dryRun ?? false;
+  }
+
+  async session(): Promise<SessionResponse> {
+    if (this.dryRun) {
+      return { accessToken: '<dry-run-token>', expiresIn: 900 };
+    }
+    return JSON.parse(runCli('session'));
+  }
+
+  async get(urlPath: string): Promise<ApiResponse> {
+    return this.request('GET', urlPath);
+  }
+
+  async post(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('POST', urlPath, body);
+  }
+
+  async put(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('PUT', urlPath, body);
+  }
+
+  async patch(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('PATCH', urlPath, body);
+  }
+
+  async delete(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('DELETE', urlPath, body);
+  }
+
+  private async request(method: string, urlPath: string, body?: unknown): Promise<ApiResponse> {
+    if (this.dryRun) {
+      return { status: 200, body: JSON.stringify({ dryRun: true, method, path: urlPath }) };
+    }
+    const args = ['request', method, urlPath];
+    if (body != null) {
+      args.push('--body', JSON.stringify(body));
+    }
+    if (this.apiBase) {
+      args.push('--api-base', this.apiBase);
+    }
+    return JSON.parse(runCli(...args));
+  }
+}
+
+export function createSkillClient(options?: SkillClientOptions): SkillClient {
+  return new SkillClient(options);
+}

src/index.ts

@@ -1,5 +1,5 @@
 import type { Command, OutputResult, ScrapePayload } from './types.js';
-import { createSkillClient } from '@clawd/auth-runtime';
+import { createSkillClient } from './auth-cli.ts';
 import { buildPayloadFromUrl, validatePayloadJson } from './scrape.js';
 
 export async function run1688(