Highlights
- Host-neutral Agent Skill for Codex, Claude Code, OpenClaw, plain CLI, and operating-system schedulers.
- Unified primary CLI:
scripts/xianyu.py doctor|login|search|task|monitor|install. - Read-only preflight chooses installed Playwright Chromium or the exact local Chrome channel without redundant downloads.
- Dedicated visible login flow with a 30-minute default window, local browser confirmation, ordered save feedback, private atomic state persistence, and explicit evidence boundaries.
- One-shot Xianyu/Goofish search with exact endpoint capture, real pagination, local price/location filters, bounded retries, and stable JSON.
- Persistent monitor tasks with browser-channel persistence, baseline mode, 50,000-ID deduplication history, and post-commit delivery evidence.
- Minimal copy installation contains only the executable Skill runtime, Skill references/metadata, requirements, and MIT license.
Safety and compatibility
- External raw TCP CDP attachment is disabled; browser commands use Playwright-owned isolated contexts and never reuse the daily Chrome profile.
- Login-state output remains a candidate credential. It proves neither authentication nor identity; a real search must return
search_capability.status: passed-for-this-run. - Cookie, proxy, login-state, and task paths are handled as private data. The unused credential-shaped example state file has been removed.
- Python 3.10 and 3.12 are validated on Ubuntu and Windows; the workflow was also exercised on the maintainer's Mac with local Chrome.
- Legacy direct
scripts/*.pyentrypoints remain supported.
Quick start
python3 -m venv .venv
.venv/bin/python -m pip install -r requirements.txt
.venv/bin/python scripts/xianyu.py doctor
.venv/bin/python scripts/xianyu.py --helpFollow the doctor's next_action. When it returns ready-use-browser-channel, pass --browser-channel chrome to browser commands and persist it on monitor tasks.
Validation
- 450 tests passed; 1 platform-policy test skipped as designed.
- Ruff lint and format checks passed.
- Agent Skill validator passed.
- Fresh-user copy-install and foreign-working-directory forward tests passed without touching the real Home or reading account state.
- GitHub CI passed on Ubuntu and Windows with Python 3.10 and 3.12, both before and after merge.