refactor: 移除 @clawd/auth-runtime npm 依赖，改用 CLI subprocess 调用

通过内置 auth-cli.ts 薄 wrapper 调用 auth-runtime CLI，
消除 npm git 依赖带来的缓存和更新问题。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

install.sh

@@ -2,6 +2,11 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-# Always fetch latest git dependencies
-rm -rf node_modules/@clawd
+# Prerequisite: auth-runtime must be cloned at ~/clawd/skills/auth-runtime
+if [ ! -d "$HOME/clawd/skills/auth-runtime/src" ]; then
+  echo "ERROR: auth-runtime not found at ~/clawd/skills/auth-runtime"
+  echo "Run: git clone http://192.168.0.108:3030/agent-skills/auth-runtime.git ~/clawd/skills/auth-runtime"
+  exit 1
+fi
+
 npm install

package.json

@@ -18,7 +18,5 @@
   "peerDependencies": {
     "typescript": "^5.0.0"
   },
-  "dependencies": {
-    "@clawd/auth-runtime": "git+http://192.168.0.108:3030/agent-skills/auth-runtime.git"
-  }
+  "dependencies": {}
 }

src/auth-cli.ts

@@ -0,0 +1,111 @@
+/**
+ * Thin CLI wrapper for auth-runtime.
+ *
+ * Copy this file into your skill's src/ directory. It spawns
+ * `bun run <auth-runtime>/src/cli.ts` as a subprocess, so the
+ * skill has zero npm dependency on @clawd/auth-runtime.
+ *
+ * Usage:
+ *   import { createSkillClient } from './auth-cli.ts';
+ *   const client = createSkillClient();
+ *   const res = await client.post('/ecom/tasks/scrape', { url: '...' });
+ */
+
+import { spawnSync } from 'child_process';
+import * as path from 'path';
+import * as os from 'os';
+
+const AUTH_RUNTIME_DIR = process.env.AUTH_RUNTIME_DIR
+  || path.join(os.homedir(), 'clawd', 'skills', 'auth-runtime');
+const CLI_ENTRY = path.join(AUTH_RUNTIME_DIR, 'src', 'cli.ts');
+
+export interface ApiResponse {
+  status: number;
+  body: string;
+}
+
+export interface SessionResponse {
+  accessToken: string;
+  expiresIn: number;
+  ownerSessionToken?: string;
+  hookUrl?: string;
+  hookToken?: string;
+}
+
+export interface SkillClientOptions {
+  apiBase?: string;
+  dryRun?: boolean;
+}
+
+function runCli(...args: string[]): string {
+  // Use the same bun binary that's running this process
+  const bun = process.execPath;
+  const result = spawnSync(bun, ['run', CLI_ENTRY, ...args], {
+    cwd: AUTH_RUNTIME_DIR,
+    encoding: 'utf-8',
+    timeout: 60_000,
+  });
+
+  if (result.error) {
+    throw new Error(`auth-cli spawn failed: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`auth-cli failed (exit ${result.status}): ${(result.stderr || '').trim()}`);
+  }
+  return (result.stdout || '').trim();
+}
+
+export class SkillClient {
+  private readonly apiBase?: string;
+  private readonly dryRun: boolean;
+
+  constructor(options: SkillClientOptions = {}) {
+    this.apiBase = options.apiBase;
+    this.dryRun = options.dryRun ?? false;
+  }
+
+  async session(): Promise<SessionResponse> {
+    if (this.dryRun) {
+      return { accessToken: '<dry-run-token>', expiresIn: 900 };
+    }
+    return JSON.parse(runCli('session'));
+  }
+
+  async get(urlPath: string): Promise<ApiResponse> {
+    return this.request('GET', urlPath);
+  }
+
+  async post(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('POST', urlPath, body);
+  }
+
+  async put(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('PUT', urlPath, body);
+  }
+
+  async patch(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('PATCH', urlPath, body);
+  }
+
+  async delete(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('DELETE', urlPath, body);
+  }
+
+  private async request(method: string, urlPath: string, body?: unknown): Promise<ApiResponse> {
+    if (this.dryRun) {
+      return { status: 200, body: JSON.stringify({ dryRun: true, method, path: urlPath }) };
+    }
+    const args = ['request', method, urlPath];
+    if (body != null) {
+      args.push('--body', JSON.stringify(body));
+    }
+    if (this.apiBase) {
+      args.push('--api-base', this.apiBase);
+    }
+    return JSON.parse(runCli(...args));
+  }
+}
+
+export function createSkillClient(options?: SkillClientOptions): SkillClient {
+  return new SkillClient(options);
+}

src/index.ts

@@ -1,5 +1,5 @@
 import type { OutputResult } from './types.js';
-import { createSkillClient } from '@clawd/auth-runtime';
+import { createSkillClient } from './auth-cli.ts';
 import { normalizeQuery, resolveExpansion } from './expansion.js';
 import { startWorkflow } from './workflow.js';
 

src/workflow.ts

@@ -1,4 +1,4 @@
-import type { SkillClient } from '@clawd/auth-runtime';
+import type { SkillClient } from './auth-cli.ts';
 import { WorkflowStartResponse } from './types.js';
 
 /**