@actiondock/cli 2.4.0 → 2.5.0

package/README.md

@@ -126,7 +126,7 @@ ad pack
 | `ad export skill` | 导出 Agent Skill 技能包（支持 `--mode source` 与 `--mode node`） |
 | `ad link` / `unlink` | 注册或注销工作区全局路由与符号链接 |
 | `ad profile` | 管理远程执行节点凭证与环境配置 |
-| `ad serve` | 启动远程 HTTP 执行调度微服务 |
+| `ad serve` | 启动远程 HTTP/HTTPS 执行调度微服务（原生支持 `--https` 自签名与生产证书） |
 | `ad mcp` | 以 STDIO 或 HTTP 协议启动 MCP 服务 |
 
 ---

package/dist/commands/config/delete.js

@@ -1,7 +1,7 @@
 import { loadProjectConfig, resolvePackageRoot, } from "@actiondock/core";
 import { ArgumentError } from "../../errors.js";
 import { writeStdout } from "../../renderer.js";
-import { getEffectiveOptions, withTarget } from "../../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, withTarget } from "../../utils/index.js";
 /**
  * 注册 config delete 子命令：删除配置项。
  *
@@ -9,15 +9,12 @@ import { getEffectiveOptions, withTarget } from "../../utils/index.js";
  * @param context 命令行上下文
  */
 export function registerConfigDeleteCommand(configCmd, context) {
-    configCmd
+    applyTargetOptions(configCmd
         .command("delete <key>")
         .alias("rm")
         .description("Delete configuration entry")
         .option("-P, --package <id>", "Target package ID or path")
-        .option("-g, --global", "Delete from global configuration")
-        .option("-p, --profile <name>", "Delete on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-g, --global", "Delete from global configuration"))
         .option("--data-dir <path>", "Custom database storage directory")
         .action(async (key, rawOptions, cmd) => {
         const options = getEffectiveOptions(rawOptions, cmd);

package/dist/commands/config/env.js

@@ -1,7 +1,7 @@
 import { fetchRemoteConfigEnv, isSecretConfigKey, loadProjectConfig, resolveEnvValue, resolvePackageRoot, resolveTarget, } from "@actiondock/core";
 import { ArgumentError } from "../../errors.js";
 import { renderConfigEnv, renderResult } from "../../renderer.js";
-import { getEffectiveOptions } from "../../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions } from "../../utils/index.js";
 /**
  * 注册 config env 子命令：诊断环境变量对声明配置的满足率。
  *
@@ -9,13 +9,10 @@ import { getEffectiveOptions } from "../../utils/index.js";
  * @param context 命令行上下文
  */
 export function registerConfigEnvCommand(configCmd, context) {
-    configCmd
+    applyTargetOptions(configCmd
         .command("env [identifier]")
         .description("Diagnose environment variable satisfaction for declared configuration")
-        .option("-P, --package <id>", "Target package ID or path")
-        .option("-p, --profile <name>", "Query on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-P, --package <id>", "Target package ID or path"))
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
         .action(async (identifier, rawOptions, cmd) => {
@@ -26,9 +23,14 @@ export function registerConfigEnvCommand(configCmd, context) {
             profile: options.profile,
             server: options.server,
             token: options.token,
+            insecure: options.insecure,
+            allowInsecureHttp: options.allowInsecureHttp,
         }, context?.customHome);
         if (target.type === "remote") {
-            const res = await fetchRemoteConfigEnv(target.serverUrl, target.token, targetPkg);
+            const res = await fetchRemoteConfigEnv(target.serverUrl, target.token, targetPkg, {
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: target.insecure,
+            });
             renderResult(res, {
                 json: options.json,
                 envelope: options.envelope,

package/dist/commands/config/get.js

@@ -1,7 +1,7 @@
 import { fetchRemoteConfig, isSecretConfigKey, loadProjectConfig, maskSecretValue, resolveEnvValue, resolvePackageRoot, resolveTarget, } from "@actiondock/core";
 import { ArgumentError } from "../../errors.js";
 import { renderResult } from "../../renderer.js";
-import { getEffectiveOptions, withTarget } from "../../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, withTarget } from "../../utils/index.js";
 /**
  * 解析远端目标拓扑信息（仅信息解析，不创建 Target 实例）。
  */
@@ -10,6 +10,8 @@ function resolveRemoteTargetInfo(options, context) {
         profile: options.profile,
         server: options.server,
         token: options.token,
+        insecure: options.insecure,
+        allowInsecureHttp: options.allowInsecureHttp,
     }, context?.customHome);
 }
 /**
@@ -19,14 +21,11 @@ function resolveRemoteTargetInfo(options, context) {
  * @param context 命令行上下文
  */
 export function registerConfigGetCommand(configCmd, context) {
-    configCmd
+    applyTargetOptions(configCmd
         .command("get <key>")
         .description("Get configuration value for key")
         .option("-P, --package <id>", "Target package ID or path")
-        .option("-g, --global", "Get from global configuration")
-        .option("-p, --profile <name>", "Query config on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-g, --global", "Get from global configuration"))
         .option("--reveal, --show-secrets", "Reveal plain text values for secrets")
         .option("--data-dir <path>", "Custom database storage directory")
         .option("--json", "Output as JSON")
@@ -40,7 +39,10 @@ export function registerConfigGetCommand(configCmd, context) {
         // 远端服务分支不经过 Target 门面，直接查询远端配置接口
         const target = resolveRemoteTargetInfo(options, context);
         if (target.type === "remote") {
-            const res = await fetchRemoteConfig(target.serverUrl, target.token, options.package);
+            const res = await fetchRemoteConfig(target.serverUrl, target.token, options.package, {
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: target.insecure,
+            });
             const val = res.values?.[key];
             const isSecret = isSecretConfigKey(key, res.declared?.[key]);
             const displayValue = !reveal && isSecret && val !== undefined ? maskSecretValue(val) : val;

package/dist/commands/config/list.js

@@ -1,7 +1,7 @@
 import { fetchRemoteConfig, filterWithFallbackInfo, findProjectRoot, isSecretConfigKey, loadProjectConfig, maskSecretValue, resolveEnvValue, resolvePackageRoot, resolveTarget, } from "@actiondock/core";
 import { ArgumentError } from "../../errors.js";
 import { renderConfigList, renderResult } from "../../renderer.js";
-import { getEffectiveOptions, resolveIntent, withTarget } from "../../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveIntent, withTarget } from "../../utils/index.js";
 /**
  * 构造单条配置项的展示视图（含掩码决策，reveal 为假且为敏感键时打码）。
  * 掩码决策收敛于命令层，renderer 仅负责值的字符串格式化。
@@ -23,14 +23,11 @@ function toDisplayEntry(key, rawValue, source, isSecret, reveal, description) {
  * @param context 命令行上下文
  */
 export function registerConfigListCommand(configCmd, context) {
-    configCmd
+    applyTargetOptions(configCmd
         .command("list [patterns...]")
         .description("List configuration entries (Global & Project)")
         .option("-P, --package <id>", "Target package ID or path")
-        .option("-g, --global", "Show only global configurations")
-        .option("-p, --profile <name>", "Query config on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-g, --global", "Show only global configurations"))
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter; falls back to full list when no match")
         .option("--reveal, --show-secrets", "Reveal plain text values for secrets")
         .option("--no-fallback", "Disable fallback to full list when no items match intent")
@@ -43,9 +40,18 @@ export function registerConfigListCommand(configCmd, context) {
         const shouldFallback = options.fallback !== false;
         const reveal = Boolean(options.reveal || options.showSecrets);
         // 远端服务分支不经过 Target 门面，直接查询远端配置接口
-        const remoteTargetInfo = resolveTarget({ profile: options.profile, server: options.server, token: options.token }, context?.customHome);
+        const remoteTargetInfo = resolveTarget({
+            profile: options.profile,
+            server: options.server,
+            token: options.token,
+            insecure: options.insecure,
+            allowInsecureHttp: options.allowInsecureHttp,
+        }, context?.customHome);
         if (remoteTargetInfo.type === "remote") {
-            const res = await fetchRemoteConfig(remoteTargetInfo.serverUrl, remoteTargetInfo.token, options.package);
+            const res = await fetchRemoteConfig(remoteTargetInfo.serverUrl, remoteTargetInfo.token, options.package, {
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: remoteTargetInfo.insecure,
+            });
             const entries = Object.entries(res.values || {}).map(([k, v]) => toDisplayEntry(k, v, "remote", isSecretConfigKey(k, res.declared?.[k]), reveal, res.declared?.[k]?.description || ""));
             renderResult(entries, {
                 json: options.json,

package/dist/commands/config/set.js

@@ -1,7 +1,7 @@
 import { isSecretConfigKey, loadProjectConfig, resolvePackageRoot, } from "@actiondock/core";
 import { ArgumentError } from "../../errors.js";
 import { writeStdout } from "../../renderer.js";
-import { getEffectiveOptions, withTarget } from "../../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, withTarget } from "../../utils/index.js";
 import { resolveConfigValueInput } from "../../prompt.js";
 /**
  * 注册 config set 子命令：写入配置值（支持标准输入与安全提示）。
@@ -10,14 +10,11 @@ import { resolveConfigValueInput } from "../../prompt.js";
  * @param context 命令行上下文
  */
 export function registerConfigSetCommand(configCmd, context) {
-    configCmd
+    applyTargetOptions(configCmd
         .command("set <key> [value]")
         .description("Set configuration value (supports stdin and secure prompt)")
         .option("-P, --package <id>", "Target package ID or path")
-        .option("-g, --global", "Set in global configuration")
-        .option("-p, --profile <name>", "Configure on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-g, --global", "Set in global configuration"))
         .option("--stdin", "Read value from standard input")
         .option("--data-dir <path>", "Custom database storage directory")
         .action(async (key, rawVal, rawOptions, cmd) => {

package/dist/commands/describe.js

@@ -1,6 +1,6 @@
 import { ArgumentError, ExecutionError } from "../errors.js";
 import { renderActionDetail, renderResult } from "../renderer.js";
-import { getEffectiveOptions, resolveLocalPackageRoot, withTarget, } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveLocalPackageRoot, withTarget, } from "../utils/index.js";
 /**
  * 挂载 describe 子命令至指定 Commander 节点。
  *
@@ -8,14 +8,12 @@ import { getEffectiveOptions, resolveLocalPackageRoot, withTarget, } from "../ut
  * @param context 命令行上下文
  */
 export function attachDescribeCommand(parent, context) {
-    return parent
+    const cmd = parent
         .command("describe <id>")
         .alias("show")
         .description("Show action definition, schema, and description")
-        .option("-P, --package <id>", "Target package ID or path")
-        .option("-p, --profile <name>", "Query against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-P, --package <id>", "Target package ID or path");
+    return applyTargetOptions(cmd)
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
         .option("--data-dir <path>", "Custom database storage directory")

package/dist/commands/doctor.js

@@ -1,15 +1,13 @@
 import { fetchRemoteDoctor, resolveTarget, runDoctorChecks } from "@actiondock/core";
 import { ExecutionError } from "../errors.js";
 import { renderResult } from "../renderer.js";
-import { getEffectiveOptions } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions } from "../utils/index.js";
 export function registerDoctorCommand(program, context) {
-    program
+    const cmd = program
         .command("doctor")
         .description("Check ActionDock environment, registry health, and project diagnostics")
-        .option("-P, --package <id|path>", "Target package ID or directory path for project diagnostics")
-        .option("-p, --profile <name>", "Query doctor diagnostics on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-P, --package <id|path>", "Target package ID or directory path for project diagnostics");
+    applyTargetOptions(cmd)
         .option("--json", "Output diagnostics report in JSON format")
         .option("--envelope", "Wrap JSON output in standard envelope")
         .action(async (rawOptions, cmd) => {
@@ -19,10 +17,14 @@ export function registerDoctorCommand(program, context) {
                 profile: options.profile,
                 server: options.server,
                 token: options.token,
+                insecure: options.insecure,
             }, context?.customHome);
             let report;
             if (target.type === "remote") {
-                const remoteRes = await fetchRemoteDoctor(target.serverUrl, target.token, options.package);
+                const remoteRes = await fetchRemoteDoctor(target.serverUrl, target.token, options.package, {
+                    allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                    insecure: target.insecure,
+                });
                 report = remoteRes.report || remoteRes;
             }
             else {

package/dist/commands/info.js

@@ -2,7 +2,7 @@ import { fetchRemoteInfo, filterWithFallbackInfo, getRegistryStatus, resolvePack
 import { ArgumentError, ExecutionError } from "../errors.js";
 import { projectDetailToJson, renderAggregatedPackages, renderProjectDetail, renderRegistryTree, renderResult, } from "../renderer.js";
 import { getProjectDetailInfo, scanLocalAggregatedPackages } from "../services/index.js";
-import { getEffectiveOptions, resolveFallbackStrategy, resolveIntent } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveFallbackStrategy, resolveIntent } from "../utils/index.js";
 /**
  * 将远端信息响应归一为本地工程详情视图。
  */
@@ -41,15 +41,13 @@ function renderProjectDetailOutput(detail, options) {
  * @param context 命令行上下文
  */
 export function registerInfoCommand(program, context) {
-    program
+    const cmd = program
         .command("info [patterns...]")
         .description("Display information about current project, linked package, or remote target")
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter; falls back to full list when no match")
         .option("-P, --package <id>", "Target package ID or path")
-        .option("--tree", "Display packages in hierarchical tree view grouped by workspace")
-        .option("-p, --profile <name>", "Query against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("--tree", "Display packages in hierarchical tree view grouped by workspace");
+    applyTargetOptions(cmd)
         .option("--fallback", "Enable fallback to full list when no items match intent")
         .option("--no-fallback", "Disable fallback to full list when no items match intent")
         .option("--json", "Output information as JSON")
@@ -65,12 +63,15 @@ export function registerInfoCommand(program, context) {
             profile: options.profile,
             server: options.server,
             token: options.token,
+            insecure: options.insecure,
         }, context?.customHome);
         if (target.type === "remote") {
             const remoteInfo = await fetchRemoteInfo(target.serverUrl, target.token, {
                 intent: effectiveIntent,
                 package: options.package,
                 tree: Boolean(options.tree),
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: target.insecure,
             });
             if (isMachine) {
                 renderResult(remoteInfo, outOpts);

package/dist/commands/list.js

@@ -1,7 +1,7 @@
 import { filterWithFallbackInfo } from "@actiondock/core";
 import { ArgumentError } from "../errors.js";
 import { renderActionList, renderResult } from "../renderer.js";
-import { getEffectiveOptions, resolveFallbackStrategy, resolveIntent, resolveLocalPackageRoot, withTarget } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveFallbackStrategy, resolveIntent, resolveLocalPackageRoot, withTarget, } from "../utils/index.js";
 /**
  * 挂载 list 子命令至指定 Commander 节点。
  *
@@ -9,14 +9,12 @@ import { getEffectiveOptions, resolveFallbackStrategy, resolveIntent, resolveLoc
  * @param context 命令行上下文
  */
 export function attachListCommand(parent, context) {
-    return parent
+    const cmd = parent
         .command("list [patterns...]")
         .description("List actions in current project, linked packages, or remote profile")
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter; falls back to full list when no match")
-        .option("-P, --package <id>", "Target package ID or path")
-        .option("-p, --profile <name>", "Query against a specific execution profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-P, --package <id>", "Target package ID or path");
+    return applyTargetOptions(cmd)
         .option("--fallback", "Enable fallback to full list when no items match intent")
         .option("--no-fallback", "Disable fallback to full list when no items match intent")
         .option("--json", "Output as JSON")

package/dist/commands/playbook.js

@@ -3,7 +3,7 @@ import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { assertPathWithinRoot, fetchRemotePlaybooks, fetchRemotePlaybookShow, filterWithFallbackInfo, findProjectRoot, listLinkedPackages, loadActions, loadManifest, loadPlaybooks, loadProjectConfig, resolveActionProject, resolvePackageRoot, resolvePlaybookProject, resolveTarget, saveManifest, } from "@actiondock/core";
 import { ArgumentError, CliError, ExecutionError } from "../errors.js";
 import { renderPlaybookDetail, renderPlaybookList, renderResult, writeStdout, } from "../renderer.js";
-import { getEffectiveOptions, resolveIntent } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveIntent } from "../utils/index.js";
 /**
  * 注册 Playbook 命令集合（list, show, validate, create）。
  *
@@ -15,14 +15,11 @@ export function registerPlaybookCommands(program, context) {
         .command("playbook")
         .description("Manage task Playbooks (Task SOPs for AI Agents)");
     // playbook list
-    pbCmd
+    applyTargetOptions(pbCmd
         .command("list [patterns...]")
         .description("List playbooks in current project or linked packages")
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter; falls back to full list when no match")
-        .option("-P, --package <id>", "Target package ID or path")
-        .option("-p, --profile <name>", "Query against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-P, --package <id>", "Target package ID or path"))
         .option("--no-fallback", "Disable fallback to full list when no items match intent")
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
@@ -36,11 +33,15 @@ export function registerPlaybookCommands(program, context) {
             profile: options.profile,
             server: options.server,
             token: options.token,
+            insecure: options.insecure,
+            allowInsecureHttp: options.allowInsecureHttp,
         }, context?.customHome);
         if (target.type === "remote") {
             const remotePbs = await fetchRemotePlaybooks(target.serverUrl, target.token, {
                 intent: effectiveIntent,
                 package: options.package,
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: target.insecure,
             });
             renderResult(remotePbs, {
                 json: options.json,
@@ -162,13 +163,10 @@ export function registerPlaybookCommands(program, context) {
         });
     });
     // playbook show <id>
-    pbCmd
+    applyTargetOptions(pbCmd
         .command("show <id>")
         .description("Show playbook content and metadata")
-        .option("-P, --package <id>", "Target package ID or path")
-        .option("-p, --profile <name>", "Query against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-P, --package <id>", "Target package ID or path"))
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
         .action(async (id, rawOptions, cmd) => {
@@ -181,9 +179,14 @@ export function registerPlaybookCommands(program, context) {
             profile: options.profile,
             server: options.server,
             token: options.token,
+            insecure: options.insecure,
+            allowInsecureHttp: options.allowInsecureHttp,
         }, context?.customHome);
         if (target.type === "remote") {
-            const detail = await fetchRemotePlaybookShow(target.serverUrl, id, target.token);
+            const detail = await fetchRemotePlaybookShow(target.serverUrl, id, target.token, {
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: target.insecure,
+            });
             renderResult(detail, {
                 json: options.json,
                 envelope: options.envelope,

package/dist/commands/profile.js

@@ -1,4 +1,4 @@
-import { addProfile, checkRemoteHealth, filterWithFallbackInfo, getProfile, listProfiles, loadProfiles, maskSecretValue, removeProfile, resolveProfileToken, resolveTarget, toSnakeUpperCase, useProfile, } from "@actiondock/core";
+import { addProfile, checkRemoteHealth, filterWithFallbackInfo, getProfile, listProfiles, loadProfiles, maskSecretValue, removeProfile, resolveProfileToken, resolveTarget, toSnakeUpperCase, updateProfile, useProfile, } from "@actiondock/core";
 import { ArgumentError, CliError, ExecutionError, } from "../errors.js";
 import { renderResult, writeStdout } from "../renderer.js";
 import { getEffectiveOptions, resolveFallbackStrategy, resolveIntent } from "../utils/index.js";
@@ -34,9 +34,10 @@ export function registerProfileCommands(program) {
                     tokenConfigured: resolved.source !== "none",
                     tokenSource: resolved.source,
                     token: reveal ? resolved.token : (resolved.token ? maskSecretValue(resolved.token) : undefined),
+                    insecure: Boolean(p.entry.insecure),
                 };
             });
-            const filterRes = filterWithFallbackInfo(enriched, effectiveIntent, [(p) => p.name, (p) => p.serverUrl, (p) => p.description, (p) => p.tokenSource], shouldFallback);
+            const filterRes = filterWithFallbackInfo(enriched, effectiveIntent, [(p) => p.name, (p) => p.serverUrl, (p) => p.description, (p) => p.tokenSource, (p) => (p.insecure ? "insecure" : "")], shouldFallback);
             if (filterRes.isFallback && isMachine) {
                 renderResult({ items: filterRes.items, isFallback: true, matchedCount: 0 }, { json: options.json, envelope: options.envelope });
                 return;
@@ -67,8 +68,9 @@ export function registerProfileCommands(program) {
                         if (reveal && item.token) {
                             tokenInfo += ` = ${item.token}`;
                         }
+                        const insecureTag = item.insecure ? " [insecure]" : "";
                         const desc = item.description ? ` - ${item.description}` : "";
-                        lines.push(`${currentMarker}${item.name.padEnd(20)} ${item.serverUrl}${tokenInfo}${desc}`);
+                        lines.push(`${currentMarker}${item.name.padEnd(20)} ${item.serverUrl}${tokenInfo}${insecureTag}${desc}`);
                     }
                     lines.push("\nUse 'ad profile use <name>' to switch or 'ad run <action> --profile <name>' to execute on a specific target.");
                     return lines.join("\n");
@@ -89,6 +91,7 @@ export function registerProfileCommands(program) {
         .option("-t, --token <token>", "Authentication token for the remote server (deprecated; prefer --token-env)")
         .option("--token-env <env>", "Environment variable name containing the authentication token")
         .option("-d, --desc <description>", "Description of this profile/machine")
+        .option("-k, --insecure", "Allow insecure server connections (skip TLS certificate validation)")
         .action((name, options) => {
         try {
             if (options.token) {
@@ -99,8 +102,44 @@ export function registerProfileCommands(program) {
                 token: options.token,
                 tokenEnv: options.tokenEnv,
                 description: options.desc,
+                insecure: options.insecure ? true : undefined,
             });
-            writeStdout(`[OK] Profile '${name}' configured for server: ${options.server}`);
+            writeStdout(`[OK] Profile '${name}' configured for server: ${options.server}${options.insecure ? " (insecure: true)" : ""}`);
+        }
+        catch (err) {
+            throw new ExecutionError(err.message);
+        }
+    });
+    // ad profile update <name>
+    profileCmd
+        .command("update <name>")
+        .description("Update an existing remote execution profile")
+        .option("-s, --server <url>", "Remote ActionDock server URL (e.g. http://1.2.3.4:5177)")
+        .option("-t, --token <token>", "Authentication token for the remote server (deprecated; prefer --token-env)")
+        .option("--token-env <env>", "Environment variable name containing the authentication token")
+        .option("-d, --desc <description>", "Description of this profile/machine")
+        .option("-k, --insecure", "Allow insecure server connections (skip TLS certificate validation)")
+        .option("--no-insecure", "Enforce strict TLS certificate validation")
+        .action((name, options) => {
+        try {
+            if (options.token) {
+                console.warn("Warning: storing tokens directly in profiles.json is deprecated. Use --token-env or standard environment variables (e.g. ACTIONDOCK_<PROFILE>_TOKEN) instead.");
+            }
+            let insecure;
+            if (options.insecure === true) {
+                insecure = true;
+            }
+            else if (options.insecure === false) {
+                insecure = false;
+            }
+            updateProfile(name, {
+                serverUrl: options.server,
+                token: options.token,
+                tokenEnv: options.tokenEnv,
+                description: options.desc,
+                insecure,
+            });
+            writeStdout(`[OK] Profile '${name}' updated`);
         }
         catch (err) {
             throw new ExecutionError(err.message);
@@ -148,6 +187,7 @@ export function registerProfileCommands(program) {
                 tokenSource: resolved.source,
                 tokenEnv: entry?.tokenEnv,
                 token: displayToken,
+                insecure: Boolean(entry?.insecure),
                 description: entry?.description || "",
             };
             renderResult(data, {
@@ -174,6 +214,9 @@ export function registerProfileCommands(program) {
                     if (data.tokenConfigured) {
                         lines.push(`Token Value:  ${data.token}`);
                     }
+                    if (data.serverUrl !== "local") {
+                        lines.push(`TLS Verify:   ${data.insecure ? "Disabled (Insecure)" : "Strict (Default)"}`);
+                    }
                     if (data.description) {
                         lines.push(`Description:  ${data.description}`);
                     }
@@ -215,12 +258,18 @@ export function registerProfileCommands(program) {
     profileCmd
         .command("test [name]")
         .description("Test connection latency and health of a profile")
+        .option("-k, --insecure", "Allow insecure TLS connections (skip TLS certificate validation)")
+        .option("--allow-insecure-http", "Allow insecure HTTP connections with auth token")
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
         .action(async (name, rawOptions, cmd) => {
         try {
             const options = getEffectiveOptions(rawOptions, cmd);
-            const target = resolveTarget({ profile: name });
+            const target = resolveTarget({
+                profile: name,
+                insecure: options.insecure !== undefined ? Boolean(options.insecure) : undefined,
+                allowInsecureHttp: options.allowInsecureHttp,
+            });
             if (target.type === "local") {
                 renderResult({ ok: true, type: "local", message: "Local execution" }, {
                     json: options.json,
@@ -229,7 +278,10 @@ export function registerProfileCommands(program) {
                 });
                 return;
             }
-            const health = await checkRemoteHealth(target.serverUrl, target.token);
+            const health = await checkRemoteHealth(target.serverUrl, target.token, 5000, {
+                allowInsecureHttp: Boolean(options.allowInsecureHttp),
+                insecure: target.insecure,
+            });
             renderResult(health, {
                 json: options.json,
                 envelope: options.envelope,

package/dist/commands/run.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { parseDuration, resolveTarget } from "@actiondock/core";
 import { ArgumentError, ExecutionError, SigintError } from "../errors.js";
 import { writeStdout } from "../renderer.js";
-import { getEffectiveOptions, resolveLocalPackageRoot, withTarget } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveLocalPackageRoot, withTarget, } from "../utils/index.js";
 /**
  * 统一执行 Action 核心逻辑（使用 ActionDockTarget 门面）。
  */
@@ -58,6 +58,7 @@ export async function executeAction(id, options, context) {
             profile: options.profile,
             server: options.server,
             token: options.token,
+            insecure: options.insecure,
         }, context?.customHome);
         if (resolvedTopology.type === "local" && options.async) {
             throw new ExecutionError("Async execution requires a long-running ActionDock server.\nUse --profile, --server, or start 'ad serve'.");
@@ -123,16 +124,14 @@ export async function executeAction(id, options, context) {
  * @param context 命令行上下文
  */
 export function attachRunCommand(parent, context) {
-    return parent
+    const cmd = parent
         .command("run <id>")
         .description("Execute an action (from current project, linked packages, or remote profile)")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-i, --input <json>", "Input as JSON string")
         .option("-f, --input-file <path>", "Input from JSON file")
-        .option("-c, --config <key=value...>", "Temporary config override (repeatable)")
-        .option("-p, --profile <name>", "Execute against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-c, --config <key=value...>", "Temporary config override (repeatable)");
+    return applyTargetOptions(cmd)
         .option("--timeout <duration>", "Execution timeout (e.g. 30s, 5m, 500ms)")
         .option("--request-id <id>", "Idempotency request ID for deduplication")
         .option("--async", "Execute asynchronously in background (requires remote server or profile)")