@actionway/cli 0.18.4 → 0.18.6

package/README.md

@@ -25,14 +25,28 @@ actionway init
 `doctor` 只输出脱敏后的 Node/npm、registry、global PATH、配置目录、loopback
 和 OAuth discovery 检查；它不会修改 npm、代理、CA、PATH 或 PowerShell policy。
 
+### Development 通道
+
+成功合并并部署 `dev` 后，workflow 从同一 bundle 生成独立公共包 `@actionway/cli-dev`。它只暴露 `actionway-dev`，固定连接 `https://dev.actionway.ai`，使用 `${HOME}/.actionway-dev` 和 `actionway-dev` Skill；不会安装或覆盖正式 `actionway`：
+
+```bash
+npm install --global @actionway/cli-dev@latest
+actionway-dev doctor
+actionway-dev init
+actionway-dev status
+```
+
+`actionway-dev update` 只读取和更新 `@actionway/cli-dev@latest`。每个 dev npm 版本包含不可变 source SHA 与 Actions run metadata；同一 tarball 也保存在私有 GitHub prerelease，后者仅用于内部审计和精确回滚，普通安装不需要 GitHub 账号。
+
 - **auth 唯一途径：Clerk OAuth（PKCE）**。issuer / client_id 运行时从
   `{public origin}/api/auth/cli-config` 发现；浏览器授权走随机 `127.0.0.1` 回调端口；
   凭据存 `~/.actionway/credentials.json`（POSIX 上为 0600 owner-only 文件；
   Windows 上 chmod 无效，保密性依赖 `%USERPROFILE%` 的继承 ACL——不要把
   `ACTIONWAY_CONFIG_DIR` 指到共享目录）。CLI 从不打印或存储 OAuth client secret。
-- **命令面 = 明码写出的注册表**（无 profile flag、无运行期分叉）：
+- **命令面 = 明码写出的注册表**（无 capability profile flag；production/development 只切换包、命令、状态、Skill、更新源与 Gateway）：
   - `tools search / inspect / call` 是长尾 capability 的规范发现与执行面；
   - 高频 typed command 继续提供参数与文件 UX，但投影到同一个 Tool Call；
+  - `account invitation` 获取或首次创建当前账户的永久邀请码、链接和服务端本地化分享文案；
   - `account usage / wallet / transactions` 只读 Actionway Business 数据；
   - 本壳另有 `init` / `doctor` / `update` / `login` / `logout` / `whoami`，cli-core
   继续提供 wait/poll 与已冻结的共享 typed commands。
@@ -63,6 +77,7 @@ pnpm cli logout          # 删除本机凭据；重复执行也是成功的幂
 pnpm cli update --check  # 查新版（24h 缓存）
 pnpm cli -- tools search "generate a product image"
 pnpm cli -- tools inspect media.image.generate
+pnpm cli -- account invitation --locale zh-cn
 pnpm cli -- account usage
 pnpm cli -- account usage --from 2026-08-01 --to 2026-09-01 --service generate-image
 pnpm cli -- account transactions --from 2026-08-01 --kind top_up

package/assets/dev/actionway-dev-entry.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+process.env.ACTIONWAY_CLI_CHANNEL = "development";
+process.env.ACTIONWAY_CONFIG_DIR ||= join(homedir(), ".actionway-dev");
+process.env.ACTIONWAY_GATEWAY_URL ||= "https://dev.actionway.ai";
+
+const executable = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "dist", "index.js");
+const result = spawnSync(process.execPath, [executable, ...process.argv.slice(2)], {
+  stdio: "inherit",
+  env: process.env,
+  windowsHide: true,
+});
+if (result.error) throw result.error;
+process.exit(result.status || 0);

package/assets/dev/actionway-dev-launcher.mjs

@@ -0,0 +1,370 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+const repository = (process.env.ACTIONWAY_DEV_REPOSITORY || "PawLogic/actionway").trim();
+const packageName = "@actionway/cli-dev";
+const devHome = resolve(process.env.ACTIONWAY_DEV_HOME || join(homedir(), ".actionway-dev"));
+const metadataPath = join(devHome, "current-cli.json");
+const updateIntervalMs = Number(process.env.ACTIONWAY_DEV_UPDATE_INTERVAL_MS || 300_000);
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+
+export function commandInvocation(command, args, platform = process.platform, env = process.env) {
+  if (platform === "win32" && /\.(?:cmd|bat)$/i.test(command)) {
+    const commandProcessor = (env.ComSpec ?? env.COMSPEC ?? "cmd.exe").trim().replace(/^"|"$/g, "") || "cmd.exe";
+    return {
+      command: commandProcessor,
+      args: ["/d", "/s", "/c", command, ...args],
+    };
+  }
+  return { command, args: [...args] };
+}
+
+function run(command, args, { capture = false, env = process.env } = {}) {
+  const invocation = commandInvocation(command, args, process.platform, env);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env,
+    stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    if (capture && result.stderr) process.stderr.write(result.stderr);
+    const error = new Error(`${command} exited with status ${result.status}`);
+    error.exitCode = result.status || 1;
+    throw error;
+  }
+  return capture ? result.stdout.trim() : "";
+}
+
+function readMetadata() {
+  if (!existsSync(metadataPath)) return null;
+  return JSON.parse(readFileSync(metadataPath, "utf8"));
+}
+
+function writeMetadata(metadata) {
+  mkdirSync(devHome, { recursive: true, mode: 0o700 });
+  writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`, { mode: 0o600 });
+}
+
+export function validateReleaseManifest(manifest, expectedRepository = repository) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new Error("Development release manifest must be a JSON object.");
+  }
+  if (
+    manifest.schema_version !== 1 ||
+    manifest.channel !== "development" ||
+    manifest.distribution !== "github_release"
+  ) {
+    throw new Error("Development release manifest has an unsupported schema, channel, or distribution.");
+  }
+  if (manifest.repository !== expectedRepository) {
+    throw new Error("Development release manifest uses an unexpected repository.");
+  }
+  if (typeof manifest.source_sha !== "string" || !/^[0-9a-f]{40}$/.test(manifest.source_sha)) {
+    throw new Error("Development release manifest has an invalid source_sha.");
+  }
+  if (manifest.release_tag !== `actionway-dev-${manifest.source_sha}`) {
+    throw new Error("Development release manifest tag does not match source_sha.");
+  }
+  if (manifest.gateway_url !== "https://dev.actionway.ai") {
+    throw new Error("Development release manifest does not target the development Gateway.");
+  }
+  if (!manifest.archive || typeof manifest.archive !== "object" || Array.isArray(manifest.archive)) {
+    throw new Error("Development release manifest is missing archive metadata.");
+  }
+  if (typeof manifest.archive.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(manifest.archive.sha256)) {
+    throw new Error("Development release manifest has an invalid archive sha256.");
+  }
+  if (
+    manifest.archive.asset_name !==
+    `actionway-cli-${manifest.source_sha}-${manifest.archive.sha256}.tgz`
+  ) {
+    throw new Error("Development release archive asset does not match source_sha and sha256.");
+  }
+  if (!Number.isSafeInteger(manifest.archive.size_bytes) || manifest.archive.size_bytes <= 0) {
+    throw new Error("Development release manifest has an invalid archive size.");
+  }
+  if (!Number.isSafeInteger(manifest.run_id) || manifest.run_id <= 0) {
+    throw new Error("Development release manifest has an invalid run_id.");
+  }
+  if (
+    manifest.run_url !==
+    `https://github.com/${manifest.repository}/actions/runs/${manifest.run_id}`
+  ) {
+    throw new Error("Development release manifest has an invalid run_url.");
+  }
+  if (manifest.artifact_name !== `actionway-cli-dev-${manifest.source_sha}`) {
+    throw new Error("Development release manifest has an invalid artifact_name.");
+  }
+  if (typeof manifest.published_at !== "string" || !Number.isFinite(Date.parse(manifest.published_at))) {
+    throw new Error("Development release manifest has an invalid published_at timestamp.");
+  }
+
+  return {
+    headSha: manifest.source_sha,
+    runId: manifest.run_id,
+    runUrl: manifest.run_url,
+    artifact: manifest.artifact_name,
+    releaseTag: manifest.release_tag,
+    archiveAsset: manifest.archive.asset_name,
+    archiveSha256: manifest.archive.sha256,
+    archiveSize: manifest.archive.size_bytes,
+    archivePath: null,
+  };
+}
+
+function resolveLatestRelease() {
+  const localArchive = process.env.ACTIONWAY_DEV_ARCHIVE?.trim();
+  if (localArchive) {
+    return {
+      headSha: (process.env.ACTIONWAY_DEV_SOURCE_SHA || "local-development").trim(),
+      runId: null,
+      runUrl: null,
+      artifact: null,
+      releaseTag: null,
+      archiveAsset: null,
+      archiveSha256: null,
+      archiveSize: null,
+      archivePath: resolve(localArchive),
+    };
+  }
+
+  const manifest = JSON.parse(run(npmCommand, ["view", `${packageName}@latest`, "--json"], { capture: true }));
+  if (manifest?.name !== packageName || typeof manifest.version !== "string") {
+    throw new Error(`npm did not return a valid ${packageName}@latest manifest.`);
+  }
+  const metadata = manifest.actionway;
+  if (
+    metadata?.channel !== "development" ||
+    !/^[0-9a-f]{40}$/.test(metadata.source_sha || "") ||
+    !Number.isSafeInteger(metadata.run_id) ||
+    metadata.run_id <= 0 ||
+    metadata.run_url !== `https://github.com/${repository}/actions/runs/${metadata.run_id}` ||
+    metadata.gateway_url !== "https://dev.actionway.ai"
+  ) {
+    throw new Error(`The published ${packageName}@${manifest.version} metadata is invalid.`);
+  }
+  if (typeof manifest.dist?.integrity !== "string" || !manifest.dist.integrity.startsWith("sha512-")) {
+    throw new Error(`The published ${packageName}@${manifest.version} integrity is missing.`);
+  }
+  return {
+    headSha: metadata.source_sha,
+    runId: metadata.run_id,
+    runUrl: metadata.run_url,
+    artifact: `actionway-cli-dev-${metadata.source_sha}`,
+    releaseTag: `actionway-dev-${metadata.source_sha}`,
+    archiveAsset: null,
+    archiveSha256: null,
+    archiveSize: null,
+    archivePath: null,
+    packageVersion: manifest.version,
+    npmIntegrity: manifest.dist.integrity,
+  };
+}
+
+function installSkill(packageRoot) {
+  const source = join(packageRoot, "assets", "skill", "actionway-dev");
+  if (!existsSync(source)) throw new Error("The development CLI artifact is missing its actionway-dev Skill.");
+  const explicitTarget = process.env.ACTIONWAY_DEV_SKILL_DIR?.trim();
+  const officialRoot = join(homedir(), ".agents", "skills");
+  const legacyRoot = join(homedir(), ".codex", "skills");
+  const skillRoot = process.env.CODEX_HOME?.trim()
+    ? join(resolve(process.env.CODEX_HOME), "skills")
+    : existsSync(legacyRoot) && !existsSync(officialRoot)
+      ? legacyRoot
+      : officialRoot;
+  const target = explicitTarget ? resolve(explicitTarget) : join(skillRoot, "actionway-dev");
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  rmSync(target, { recursive: true, force: true });
+  cpSync(source, target, { recursive: true });
+  return target;
+}
+
+function refreshInstalledAssets(metadata) {
+  const packageRoot = join(metadata.runtime_dir, "node_modules", "@actionway", "cli-dev");
+  if (!existsSync(packageRoot)) throw new Error("The installed Actionway development CLI package is missing.");
+  const skillDir = installSkill(packageRoot);
+  const packagedLauncher = join(packageRoot, "assets", "dev", "actionway-dev-launcher.mjs");
+  const installedLauncher = join(devHome, "bin", "actionway-dev-launcher.mjs");
+  if (existsSync(packagedLauncher)) {
+    mkdirSync(dirname(installedLauncher), { recursive: true, mode: 0o700 });
+    cpSync(packagedLauncher, installedLauncher, { force: true });
+  }
+  return { ...metadata, skill_dir: skillDir };
+}
+
+export function verifyArchiveBytes(bytes, expectedSize, expectedSha256) {
+  const archive = Buffer.from(bytes);
+  if (archive.byteLength !== expectedSize) {
+    throw new Error(
+      `Development archive size mismatch: expected ${expectedSize}, received ${archive.byteLength}.`,
+    );
+  }
+  const actualSha256 = createHash("sha256").update(archive).digest("hex");
+  if (actualSha256 !== expectedSha256) throw new Error("Development archive checksum mismatch.");
+  return archive;
+}
+
+function installRelease(release) {
+  const downloadDir = mkdtempSync(join(tmpdir(), "actionway-dev-cli-"));
+  try {
+    let archivePath = release.archivePath;
+    if (!archivePath) {
+      const packed = JSON.parse(
+        run(npmCommand, ["pack", `${packageName}@${release.packageVersion}`, "--pack-destination", downloadDir, "--json"], {
+          capture: true,
+        }),
+      );
+      const filename = packed?.[0]?.filename;
+      if (typeof filename !== "string") throw new Error(`npm pack did not return ${packageName}@${release.packageVersion}.`);
+      archivePath = join(downloadDir, filename);
+      const actualIntegrity = `sha512-${createHash("sha512").update(readFileSync(archivePath)).digest("base64")}`;
+      if (actualIntegrity !== release.npmIntegrity) throw new Error("Development npm archive integrity mismatch.");
+    }
+    if (!existsSync(archivePath)) throw new Error(`Actionway development CLI archive not found: ${archivePath}`);
+
+    const runtimeDir = join(devHome, "runtimes", release.headSha);
+    mkdirSync(runtimeDir, { recursive: true, mode: 0o700 });
+    run(npmCommand, [
+      "install",
+      "--ignore-scripts",
+      "--no-audit",
+      "--no-fund",
+      "--prefix",
+      runtimeDir,
+      archivePath,
+    ]);
+
+    const packageRoot = join(runtimeDir, "node_modules", "@actionway", "cli-dev");
+    const executable = join(runtimeDir, "node_modules", ".bin", process.platform === "win32" ? "actionway-dev.cmd" : "actionway-dev");
+    if (!existsSync(executable)) throw new Error("The development CLI artifact did not install an actionway-dev executable.");
+    const skillDir = installSkill(packageRoot);
+
+    const packagedLauncher = join(packageRoot, "assets", "dev", "actionway-dev-launcher.mjs");
+    const installedLauncher = join(devHome, "bin", "actionway-dev-launcher.mjs");
+    if (existsSync(packagedLauncher)) {
+      mkdirSync(dirname(installedLauncher), { recursive: true, mode: 0o700 });
+      cpSync(packagedLauncher, installedLauncher, { force: true });
+    }
+
+    const now = new Date().toISOString();
+    const metadata = {
+      version: 1,
+      source_sha: release.headSha,
+      run_id: release.runId,
+      run_url: release.runUrl,
+      artifact: release.artifact,
+      release_tag: release.releaseTag,
+      archive_asset: release.archiveAsset,
+      archive_sha256: release.archiveSha256,
+      package: packageName,
+      package_version: release.packageVersion ?? null,
+      npm_integrity: release.npmIntegrity ?? null,
+      runtime_dir: runtimeDir,
+      skill_dir: skillDir,
+      gateway_url: "https://dev.actionway.ai",
+      installed_at: now,
+      last_checked_at: now,
+    };
+    writeMetadata(metadata);
+    return metadata;
+  } finally {
+    rmSync(downloadDir, { recursive: true, force: true });
+  }
+}
+
+function checkForUpdate({ install, skipInterval = false } = {}) {
+  const current = readMetadata();
+  if (!skipInterval && current?.last_checked_at) {
+    const age = Date.now() - Date.parse(current.last_checked_at);
+    if (Number.isFinite(age) && age >= 0 && age < updateIntervalMs) return current;
+  }
+
+  const latest = resolveLatestRelease();
+  const updateAvailable = current?.source_sha !== latest.headSha;
+  if (!install) {
+    process.stdout.write(
+      `${JSON.stringify({
+        ok: true,
+        update_available: updateAvailable,
+        installed_source_sha: current?.source_sha || null,
+        latest_source_sha: latest.headSha,
+      })}\n`,
+    );
+    return current;
+  }
+  if (!updateAvailable) {
+    const refreshed = refreshInstalledAssets(current);
+    refreshed.last_checked_at = new Date().toISOString();
+    writeMetadata(refreshed);
+    return refreshed;
+  }
+  return installRelease(latest);
+}
+
+function executableFor(metadata) {
+  return join(
+    metadata.runtime_dir,
+    "node_modules",
+    ".bin",
+    process.platform === "win32" ? "actionway-dev.cmd" : "actionway-dev",
+  );
+}
+
+function main(args = process.argv.slice(2)) {
+  if (args[0] === "status") {
+    process.stdout.write(`${JSON.stringify({ ok: true, channel: "development", ...readMetadata() }, null, 2)}\n`);
+    return 0;
+  }
+  if (args[0] === "update") {
+    const checkOnly = args.includes("--check");
+    const metadata = checkForUpdate({ install: !checkOnly, skipInterval: true });
+    if (!checkOnly && metadata) {
+      process.stdout.write(`Actionway development CLI is current at ${metadata.source_sha}.\n`);
+    }
+    return 0;
+  }
+
+  let metadata = readMetadata();
+  try {
+    metadata = checkForUpdate({ install: true }) || metadata;
+  } catch (error) {
+    if (!metadata) throw error;
+    process.stderr.write(`Actionway development update check failed; using ${metadata.source_sha}: ${error.message}\n`);
+  }
+  if (!metadata) throw new Error("Actionway development CLI is not installed. Run the installer first.");
+
+  const executable = executableFor(metadata);
+  if (!existsSync(executable)) throw new Error("The installed Actionway development CLI runtime is missing.");
+  const childEnv = {
+    ...process.env,
+    ACTIONWAY_CONFIG_DIR: devHome,
+    ACTIONWAY_GATEWAY_URL: "https://dev.actionway.ai",
+  };
+  const invocation = commandInvocation(executable, args.length > 0 ? args : ["--help"], process.platform, childEnv);
+  const result = spawnSync(invocation.command, invocation.args, {
+    stdio: "inherit",
+    env: childEnv,
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  return result.status || 0;
+}
+
+if (process.env.ACTIONWAY_DEV_ASSET_IMPORT_ONLY !== "1") {
+  process.exit(main());
+}

package/assets/dev/install-actionway-dev.mjs

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  chmodSync,
+  constants,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const repository = (process.env.ACTIONWAY_DEV_REPOSITORY || "PawLogic/actionway").trim();
+const bootstrapRef = (process.env.ACTIONWAY_DEV_BOOTSTRAP_REF || "dev").trim();
+const devHome = resolve(process.env.ACTIONWAY_DEV_HOME || join(homedir(), ".actionway-dev"));
+const installedLauncher = join(devHome, "bin", "actionway-dev-launcher.mjs");
+const marker = "Actionway managed development launcher";
+
+export function commandInvocation(command, args, platform = process.platform, env = process.env) {
+  if (platform === "win32" && /\.(?:cmd|bat)$/i.test(command)) {
+    const commandProcessor = (env.ComSpec ?? env.COMSPEC ?? "cmd.exe").trim().replace(/^"|"$/g, "") || "cmd.exe";
+    return {
+      command: commandProcessor,
+      args: ["/d", "/s", "/c", command, ...args],
+    };
+  }
+  return { command, args: [...args] };
+}
+
+function run(command, args, { capture = false } = {}) {
+  const invocation = commandInvocation(command, args);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: process.env,
+    stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    if (capture && result.stderr) process.stderr.write(result.stderr);
+    throw new Error(`${command} exited with status ${result.status || 1}`);
+  }
+  return capture ? result.stdout : "";
+}
+
+function requireNode20() {
+  const major = Number(process.versions.node.split(".")[0]);
+  if (!Number.isInteger(major) || major < 20) {
+    throw new Error(`Actionway development requires Node.js 20 or newer; found ${process.version}.`);
+  }
+}
+
+function pathEntries() {
+  return (process.env.PATH || "")
+    .split(delimiter)
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => resolve(entry));
+}
+
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+
+function isOnPath(directory) {
+  const target = resolve(directory);
+  return pathEntries().some((entry) => samePath(entry, target));
+}
+
+function ensureWritable(directory) {
+  try {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    accessSync(directory, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function existingActionwayBin() {
+  const executableNames = process.platform === "win32" ? ["actionway.cmd", "actionway.exe", "actionway"] : ["actionway"];
+  for (const directory of pathEntries()) {
+    if (executableNames.some((name) => existsSync(join(directory, name))) && ensureWritable(directory)) return directory;
+  }
+  return null;
+}
+
+function npmGlobalBin() {
+  try {
+    const prefix = run(process.platform === "win32" ? "npm.cmd" : "npm", ["prefix", "--global"], {
+      capture: true,
+    }).trim();
+    if (!prefix) return null;
+    const directory = process.platform === "win32" ? resolve(prefix) : resolve(prefix, "bin");
+    return isOnPath(directory) && ensureWritable(directory) ? directory : null;
+  } catch {
+    return null;
+  }
+}
+
+function resolveBinDir() {
+  if (process.env.ACTIONWAY_DEV_BIN_DIR?.trim()) {
+    const explicit = resolve(process.env.ACTIONWAY_DEV_BIN_DIR.trim());
+    if (!ensureWritable(explicit)) throw new Error(`Development CLI bin directory is not writable: ${explicit}`);
+    return explicit;
+  }
+  return existingActionwayBin() || npmGlobalBin() || join(homedir(), ".local", "bin");
+}
+
+function localLauncherSource() {
+  const candidates = [
+    process.env.ACTIONWAY_DEV_LAUNCHER?.trim(),
+    join(dirname(fileURLToPath(import.meta.url)), "actionway-dev-launcher.mjs"),
+    join(process.cwd(), "packages", "cli", "assets", "dev", "actionway-dev-launcher.mjs"),
+  ].filter(Boolean);
+  return candidates.find((candidate) => existsSync(resolve(candidate))) || null;
+}
+
+function fetchLauncher() {
+  const endpoint = `repos/${repository}/contents/packages/cli/assets/dev/actionway-dev-launcher.mjs?ref=${encodeURIComponent(bootstrapRef)}`;
+  const source = run(
+    "gh",
+    ["api", "-H", "Accept: application/vnd.github.raw+json", endpoint],
+    { capture: true },
+  );
+  if (!source.startsWith("#!/usr/bin/env node")) {
+    throw new Error(`GitHub did not return the Actionway development launcher from ${repository}@${bootstrapRef}.`);
+  }
+  return source;
+}
+
+function installLauncher() {
+  mkdirSync(dirname(installedLauncher), { recursive: true, mode: 0o700 });
+  const localSource = localLauncherSource();
+  if (localSource) copyFileSync(resolve(localSource), installedLauncher);
+  else writeFileSync(installedLauncher, fetchLauncher(), { mode: 0o600 });
+  run(process.execPath, ["--check", installedLauncher], { capture: true });
+}
+
+function installShim(binDir) {
+  if (!ensureWritable(binDir)) throw new Error(`Development CLI bin directory is not writable: ${binDir}`);
+  const shimPath = join(binDir, process.platform === "win32" ? "actionway-dev.cmd" : "actionway-dev");
+  if (existsSync(shimPath) && !readFileSync(shimPath, "utf8").includes(marker)) {
+    throw new Error(`Refusing to overwrite unmanaged executable: ${shimPath}`);
+  }
+  const shim =
+    process.platform === "win32"
+      ? `@echo off\r\nrem ${marker}\r\nnode "${installedLauncher}" %*\r\n`
+      : `#!/usr/bin/env node\n// ${marker}\nimport(${JSON.stringify(pathToFileURL(installedLauncher).href)});\n`;
+  writeFileSync(shimPath, shim, { mode: 0o755 });
+  if (process.platform !== "win32") chmodSync(shimPath, 0o755);
+  return shimPath;
+}
+
+function main() {
+  requireNode20();
+  run(process.platform === "win32" ? "npm.cmd" : "npm", ["--version"], { capture: true });
+  if (!process.env.ACTIONWAY_DEV_ARCHIVE?.trim()) {
+    run("gh", ["auth", "status", "--hostname", "github.com"], { capture: true });
+  }
+  installLauncher();
+  const binDir = resolveBinDir();
+  const shimPath = installShim(binDir);
+  run(process.execPath, [installedLauncher, "update"]);
+
+  process.stdout.write(`Installed ${shimPath}.\n`);
+  if (!isOnPath(binDir)) {
+    process.stdout.write(`Add ${binDir} to PATH, then open a new terminal.\n`);
+  }
+  process.stdout.write("Stable command: actionway\nDevelopment command: actionway-dev\n");
+}
+
+if (process.env.ACTIONWAY_DEV_ASSET_IMPORT_ONLY !== "1") {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(`Actionway development installation failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+  }
+}

package/assets/skill/actionway/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: actionway
-description: Use the local Actionway CLI to discover, inspect, price, and call Actionway capabilities; continue asynchronous jobs or confirmed calls; read Actionway account usage, wallet, and transactions; authenticate; or update the CLI. Trigger when a local Agent can complete a task through `actionway`, when a `job_ref` or `call_ref` must be continued, or when the user asks about Actionway tools or account data.
+description: Use the local Actionway CLI to discover, inspect, price, and call Actionway capabilities; continue asynchronous jobs or confirmed calls; get the signed-in user's Actionway invitation, account usage, wallet, and transactions; authenticate; or update the CLI. Trigger when a local Agent can complete a task through `actionway`, when a `job_ref` or `call_ref` must be continued, or when the user asks about Actionway tools or account data.
 metadata:
   version: "0.0.0-dev"
 ---
@@ -23,7 +23,8 @@ Use the installed `actionway` CLI and its server-backed Capability Registry as t
 - If Search returns `clarification_required`, ask its bounded question. If it returns candidates, choose only a supported `tool_ref` and run `actionway tools inspect <tool_ref>` before the generic call. Inspect is the authority for the current input Schema, variants, effects, guidance, and Actionway USD price.
 - `actionway search` is the Web Search business capability. Capability discovery is always `actionway tools search`.
 - Use a high-frequency typed command only when `actionway --help` exposes an exact fit. Read `actionway <command> --help` and, when available, `--print-schema`; typed commands are parameter/file conveniences over the same Tool Call, confirmation, billing, and Job path.
-- For account questions, use only the requested read command: `actionway account usage`, `actionway account wallet`, or `actionway account transactions`.
+- When the signed-in user asks to generate, show, copy, or share their invitation, run `actionway account invitation --locale <zh-cn|zh-tw|en|ja>` using the conversation language. Return the server-provided `code`, `url`, and `message`; do not invent reward amounts or rewrite promotion terms. The first request creates one permanent code and later requests return that same code.
+- For other account questions, use only the requested read command: `actionway account usage`, `actionway account wallet`, or `actionway account transactions`.
 
 ## Inspect and call
 

package/assets/skill/actionway-dev/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: actionway-dev
+description: Use the installed Actionway development channel to discover, inspect, price, and call capabilities against dev.actionway.ai; test confirmed calls and async jobs; or inspect the deployed dev CLI source SHA without touching the stable Actionway installation. Trigger for Actionway dev environment, staging verification, a newly merged dev deployment, or pre-production Codex testing.
+---
+
+# Actionway Dev
+
+Use only the `actionway-dev` executable. Never substitute the stable `actionway` command.
+
+## Prepare
+
+1. Run `actionway-dev update` once per Agent session. It follows public `@actionway/cli-dev@latest` from the latest successful `dev` deployment and never updates the stable `@actionway/cli` package.
+2. Run `actionway-dev status` when the user asks which source SHA is installed.
+3. Run `actionway-dev whoami`. On `E_NOT_AUTHENTICATED`, run `actionway-dev init` and ask the user only to approve browser login. Never request or expose credentials.
+
+## Discover and call
+
+1. For long-tail capabilities run `actionway-dev tools search "<intent>"`, then inspect exactly one supported result with `actionway-dev tools inspect <tool_ref>`.
+2. Match the inspected Schema exactly and call with `actionway-dev tools call <tool_ref> --input-json '<object>'`.
+3. On `confirmation_required`, present the server plan and quote. Resume only after approval with `actionway-dev tools call --resume <call_ref>`.
+4. On `accepted`, immediately run `actionway-dev wait --job-ref=<uuid>`. Reuse the same reference until terminal state; never resubmit a pending call.
+
+Use typed commands only when `actionway-dev --help` exposes an exact fit. Read command help and `--print-schema`, then run `--dry-run` before a real typed call.
+
+## Boundaries
+
+- Treat the development Gateway as the authority for Schema, price, confirmation, and results.
+- Development calls can consume development credits and real upstream vendor cost.
+- Do not run the stable CLI's updater, publish npm packages, or change production configuration.

package/assets/skill/actionway-dev/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Actionway Dev"
+  short_description: "Use the isolated Actionway development channel"
+  default_prompt: "Use $actionway-dev to test a capability against the latest Actionway development deployment."

package/dist/index.js

@@ -12152,13 +12152,36 @@ import { chmodSync, existsSync, mkdirSync, readFileSync as readFileSync2, writeF
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+// src/distribution.ts
+var PRODUCTION_DISTRIBUTION = {
+  channel: "production",
+  packageName: "@actionway/cli",
+  distTag: "latest",
+  commandName: "actionway",
+  configDirectoryName: ".actionway",
+  skillName: "actionway",
+  gatewayUrl: "https://actionway.ai"
+};
+var DEVELOPMENT_DISTRIBUTION = {
+  channel: "development",
+  packageName: "@actionway/cli-dev",
+  distTag: "latest",
+  commandName: "actionway-dev",
+  configDirectoryName: ".actionway-dev",
+  skillName: "actionway-dev",
+  gatewayUrl: "https://dev.actionway.ai"
+};
+function cliDistribution(env = process.env) {
+  return env.ACTIONWAY_CLI_CHANNEL === "development" ? DEVELOPMENT_DISTRIBUTION : PRODUCTION_DISTRIBUTION;
+}
+
 // src/version.ts
 import { readFileSync } from "node:fs";
 import { dirname as dirname2, resolve } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var PACKAGE_NAME = "@actionway/cli";
-function readOwnVersion(moduleUrl = import.meta.url) {
+function readOwnPackage(moduleUrl = import.meta.url, env = process.env) {
   const here = dirname2(fileURLToPath2(moduleUrl));
+  const expectedPackage = cliDistribution(env).packageName;
   for (const path of [
     resolve(here, "package.json"),
     resolve(here, "../package.json"),
@@ -12168,13 +12191,27 @@ function readOwnVersion(moduleUrl = import.meta.url) {
       const parsed = JSON.parse(readFileSync(path, "utf8"));
       if (typeof parsed !== "object" || parsed === null) continue;
       const manifest = parsed;
-      if (manifest.name === PACKAGE_NAME && typeof manifest.version === "string" && manifest.version.trim()) {
-        return manifest.version.trim();
+      if (manifest.name === expectedPackage && typeof manifest.version === "string" && manifest.version.trim()) {
+        const result = {
+          name: expectedPackage,
+          version: manifest.version.trim(),
+          ...typeof manifest.actionway === "object" && manifest.actionway !== null ? { actionway: manifest.actionway } : {}
+        };
+        if (expectedPackage === "@actionway/cli-dev") {
+          const metadata = result.actionway;
+          if (metadata?.channel !== "development" || !/^[0-9a-f]{40}$/.test(metadata.source_sha ?? "") || !Number.isSafeInteger(metadata.run_id) || (metadata.run_id ?? 0) <= 0 || metadata.run_url !== `https://github.com/PawLogic/actionway/actions/runs/${metadata.run_id}` || metadata.gateway_url !== "https://dev.actionway.ai") {
+            throw new Error("the installed @actionway/cli-dev package metadata is invalid");
+          }
+        }
+        return result;
       }
     } catch {
     }
   }
-  throw new Error(`cannot determine the installed ${PACKAGE_NAME} version`);
+  throw new Error(`cannot determine the installed ${expectedPackage} version`);
+}
+function readOwnVersion(moduleUrl = import.meta.url, env = process.env) {
+  return readOwnPackage(moduleUrl, env).version;
 }
 
 // src/lib/npm-runner.ts
@@ -12275,14 +12312,14 @@ function runNpmText(args, operation, options = {}) {
 }
 
 // src/lib/update-state.ts
-var PACKAGE_NAME2 = "@actionway/cli";
 var UPDATE_STATE_BASENAME = "update.json";
 var UPDATE_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var DEVELOPMENT_VERSION_PATTERN = /^0\.0\.0-dev\.[1-9]\d*\.[0-9a-f]{12}$/;
 function actionwayConfigDir(env = process.env) {
   const override = (env.ACTIONWAY_CONFIG_DIR ?? "").trim();
   if (override) return override;
   const home = (env.HOME ?? "").trim() || homedir();
-  return join(home, ".actionway");
+  return join(home, cliDistribution(env).configDirectoryName);
 }
 function updateStatePath(env = process.env) {
   return join(actionwayConfigDir(env), UPDATE_STATE_BASENAME);
@@ -12331,7 +12368,15 @@ function loadState(env) {
   if (existsSync(path)) {
     try {
       const parsed = parseState(readFileSync2(path, "utf8"));
-      if (parsed) return parsed;
+      if (parsed) {
+        if (cliDistribution(env).channel === "development") {
+          if (parsed.latest_version && !DEVELOPMENT_VERSION_PATTERN.test(parsed.latest_version)) {
+            return emptyState();
+          }
+          return { ...parsed, min_version: null };
+        }
+        return parsed;
+      }
     } catch {
     }
   }
@@ -12353,6 +12398,7 @@ function readVersionState(env = process.env) {
   return { latest_version: state.latest_version, min_version: state.min_version, checked_at: state.checked_at };
 }
 function recordVersionSignal(signal, env = process.env, now = /* @__PURE__ */ new Date()) {
+  if (cliDistribution(env).channel === "development") return;
   const latest = (signal.latest ?? "").trim();
   const min = (signal.min ?? "").trim();
   const validLatest = latest && isValidVersion(latest) ? latest : null;
@@ -12375,19 +12421,28 @@ function recordVersionSignal(signal, env = process.env, now = /* @__PURE__ */ ne
   );
 }
 function fetchLatestVersionFromNpm(env) {
+  const distribution = cliDistribution(env);
   const output = runNpmText(
-    ["view", `${PACKAGE_NAME2}@latest`, "version"],
-    `npm registry check for ${PACKAGE_NAME2}@latest`,
+    ["view", `${distribution.packageName}@${distribution.distTag}`, "version"],
+    `npm registry check for ${distribution.packageName}@${distribution.distTag}`,
     { env, timeoutMs: 15e3 }
   );
   const version = output.split(/\r?\n/).at(-1)?.trim() ?? "";
-  if (!version) throw new Error(`npm returned no version for ${PACKAGE_NAME2}@latest`);
+  if (!version) throw new Error(`npm returned no version for ${distribution.packageName}@${distribution.distTag}`);
   return version;
 }
 function installFromNpm(env) {
+  const distribution = cliDistribution(env);
   runNpmText(
-    ["install", "--global", "--no-audit", "--no-fund", "--no-update-notifier", `${PACKAGE_NAME2}@latest`],
-    `npm global update for ${PACKAGE_NAME2}`,
+    [
+      "install",
+      "--global",
+      "--no-audit",
+      "--no-fund",
+      "--no-update-notifier",
+      `${distribution.packageName}@${distribution.distTag}`
+    ],
+    `npm global update for ${distribution.packageName}`,
     { env, timeoutMs: 12e4 }
   );
 }
@@ -12396,12 +12451,13 @@ function isFresh(state, now) {
   const checkedAt = Date.parse(state.checked_at);
   return Number.isFinite(checkedAt) && now.getTime() - checkedAt >= 0 && now.getTime() - checkedAt < UPDATE_CACHE_TTL_MS;
 }
-function statusFrom(currentVersion, latestVersion, checkedAt, fromCache) {
+function statusFrom(currentVersion, latestVersion, checkedAt, fromCache, env) {
+  const distribution = cliDistribution(env);
   return {
-    package: PACKAGE_NAME2,
+    package: distribution.packageName,
     current_version: currentVersion,
     latest_version: latestVersion,
-    update_available: isValidVersion(latestVersion) && compareVersions(latestVersion, currentVersion) > 0,
+    update_available: isValidVersion(latestVersion) && (distribution.channel === "development" ? latestVersion !== currentVersion : compareVersions(latestVersion, currentVersion) > 0),
     checked_at: checkedAt,
     from_cache: fromCache
   };
@@ -12412,12 +12468,12 @@ function getUpdateStatus(options = {}) {
   const currentVersion = options.currentVersion ?? readOwnVersion();
   const state = loadState(env);
   if (!options.refresh && isFresh(state, now) && state.latest_version) {
-    return statusFrom(currentVersion, state.latest_version, state.checked_at ?? now.toISOString(), true);
+    return statusFrom(currentVersion, state.latest_version, state.checked_at ?? now.toISOString(), true, env);
   }
   const latestVersion = (options.fetchLatestVersion ?? fetchLatestVersionFromNpm)(env);
   const checkedAt = now.toISOString();
   saveState({ version: 2, checked_at: checkedAt, latest_version: latestVersion, min_version: state.min_version }, env);
-  return statusFrom(currentVersion, latestVersion, checkedAt, false);
+  return statusFrom(currentVersion, latestVersion, checkedAt, false, env);
 }
 function runUpdate(options = {}) {
   const env = options.env ?? process.env;
@@ -13015,6 +13071,10 @@ function failAccount(error) {
   }
   fail({ code: "E_BACKEND", message: error instanceof Error ? error.message : String(error) });
 }
+function invitationEndpoint(locale = "en") {
+  const parameters = new URLSearchParams({ locale });
+  return `v1/account/invitation?${parameters.toString()}`;
+}
 function accountEndpoint(path, options) {
   const parameters = new URLSearchParams();
   for (const [name, value] of [
@@ -13040,7 +13100,8 @@ async function read(endpoint, getTransport3) {
   }
 }
 function registerAccountCommands(program2, getTransport3) {
-  const account = program2.command("account").description("Read your Actionway USD wallet, service usage, and wallet transactions.");
+  const account = program2.command("account").description("Access your Actionway invitation, USD wallet, service usage, and wallet transactions.");
+  account.command("invitation").description("Get or create your permanent invitation code, link, and localized share message.").option("--locale <locale>", "Share-message locale: zh-cn, zh-tw, en, or ja.", "en").action((options) => read(invitationEndpoint(options.locale), getTransport3));
   account.command("usage").description("Query held, charged, released, and free capability calls.").option("--limit <count>", "Maximum records in this page (1-100).").option("--cursor <cursor>", "Opaque nextCursor returned by the previous page.").option("--from <date>", "Inclusive ISO date or timestamp (UTC for date-only values).").option("--to <date>", "Exclusive ISO date or timestamp (UTC for date-only values).").option("--status <status>", "held, settled, or expired.").option("--service <service-id>", "Exact public serviceId.").option("--pricing-kind <kind>", "priced or free.").action((options) => read(accountEndpoint("usage", options), getTransport3));
   account.command("wallet").description("Show the current available and held Actionway USD wallet balance.").action(() => read("v1/account/wallet", getTransport3));
   account.command("transactions").description("Query wallet top-ups, charges, promotions, refunds, and other fund movements.").option("--limit <count>", "Maximum records in this page (1-50).").option("--cursor <cursor>", "Opaque nextCursor returned by the previous page.").option("--from <date>", "Inclusive ISO date or timestamp (UTC for date-only values).").option("--to <date>", "Exclusive ISO date or timestamp (UTC for date-only values).").option("--status <status>", "pending, succeeded, or failed.").option("--kind <kind>", "top_up, charge, refund, dispute, or promotion kind.").action((options) => read(accountEndpoint("transactions", options), getTransport3));
@@ -13052,7 +13113,6 @@ import { existsSync as existsSync2, rmSync as rmSync2, statSync, writeFileSync a
 import { createServer as createServer2 } from "node:http";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { dirname as dirname3, join as join3, posix, win32 } from "node:path";
-var PACKAGE_NAME3 = "@actionway/cli";
 function pass(id, message) {
   return { id, status: "pass", message };
 }
@@ -13141,6 +13201,7 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   const readPolicy = dependencies.readPowerShellPolicy ?? powerShellPolicy;
   const resolveCommand = dependencies.resolveCommand ?? defaultResolveCommand;
   const checks = [];
+  const distribution = cliDistribution(env);
   const configDir = actionwayConfigDir(env);
   const nodeMajor = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
   checks.push(
@@ -13172,7 +13233,7 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
       safe.startsWith("https://registry.npmjs.org/") ? pass("scope_registry", `@actionway packages use ${safe}.`) : warn(
         "scope_registry",
         `@actionway packages are mapped to ${safe}.`,
-        "make sure that registry mirrors public @actionway/cli, or install from the public npm registry when policy permits"
+        `make sure that registry mirrors public ${distribution.packageName}, or install from the public npm registry when policy permits`
       )
     );
   } else if (scopeResult.error || scopeResult.status !== 0) {
@@ -13188,14 +13249,21 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   } else {
     const api = pathApi(platform);
     const binDir = platform === "win32" ? prefix : api.join(prefix, "bin");
-    const binName = platform === "win32" ? "actionway.cmd" : "actionway";
+    const binName = platform === "win32" ? `${distribution.commandName}.cmd` : distribution.commandName;
     let resolvedCache;
-    const resolved = () => resolvedCache !== void 0 ? resolvedCache : resolvedCache = resolveCommand("actionway");
+    const resolved = () => resolvedCache !== void 0 ? resolvedCache : resolvedCache = resolveCommand(distribution.commandName);
     checks.push(
-      pathContains(binDir, env, platform) ? pass("global_path", `npm global executable directory is in PATH: ${binDir}`) : resolved() ? pass("global_path", `actionway resolves from PATH at ${resolved()} (outside the npm global prefix ${binDir}).`) : fail2("global_path", `npm global executable directory is not in PATH: ${binDir}`, "add it to the user PATH and open a new terminal")
+      pathContains(binDir, env, platform) ? pass("global_path", `npm global executable directory is in PATH: ${binDir}`) : resolved() ? pass(
+        "global_path",
+        `${distribution.commandName} resolves from PATH at ${resolved()} (outside the npm global prefix ${binDir}).`
+      ) : fail2("global_path", `npm global executable directory is not in PATH: ${binDir}`, "add it to the user PATH and open a new terminal")
     );
     checks.push(
-      pathExists(api.join(binDir, binName)) ? pass("command", `${binName} is installed in the npm global prefix.`) : resolved() ? pass("command", `actionway command resolves at ${resolved()}.`) : fail2("command", `${binName} was not found in the npm global prefix.`, "reinstall @actionway/cli@latest in the same Node/npm environment")
+      pathExists(api.join(binDir, binName)) ? pass("command", `${binName} is installed in the npm global prefix.`) : resolved() ? pass("command", `${distribution.commandName} command resolves at ${resolved()}.`) : fail2(
+        "command",
+        `${binName} was not found in the npm global prefix.`,
+        `reinstall ${distribution.packageName}@${distribution.distTag} in the same Node/npm environment`
+      )
     );
   }
   if (platform === "win32") {
@@ -13203,9 +13271,12 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
     checks.push(
       policy && ["Restricted", "AllSigned"].includes(policy) ? warn(
         "powershell_policy",
-        `PowerShell execution policy is ${policy}; npm's actionway.ps1 shim may be blocked.`,
-        "use actionway.cmd; do not weaken organization policy without approval"
-      ) : pass("powershell_policy", `PowerShell execution policy is ${policy || "not available"}; actionway.cmd remains the stable entrypoint.`)
+        `PowerShell execution policy is ${policy}; npm's ${distribution.commandName}.ps1 shim may be blocked.`,
+        `use ${distribution.commandName}.cmd; do not weaken organization policy without approval`
+      ) : pass(
+        "powershell_policy",
+        `PowerShell execution policy is ${policy || "not available"}; ${distribution.commandName}.cmd remains the entrypoint.`
+      )
     );
   }
   try {
@@ -13224,13 +13295,19 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
     checks.push({ id: "npm_registry", status: "skip", message: "npm registry check was skipped." });
     checks.push({ id: "actionway_oauth", status: "skip", message: "Actionway OAuth discovery check was skipped." });
   } else {
-    const packageResult = npm(["view", `${PACKAGE_NAME3}@latest`, "version"], { env, platform, timeoutMs: 15e3 });
+    const packageResult = npm(
+      ["view", `${distribution.packageName}@${distribution.distTag}`, "version"],
+      { env, platform, timeoutMs: 15e3 }
+    );
     checks.push(
       npmCheck(
         "npm_registry",
         packageResult,
         "Actionway package lookup",
-        (version) => pass("npm_registry", `${PACKAGE_NAME3}@latest is reachable (${version.split(/\r?\n/).at(-1)}).`)
+        (version) => pass(
+          "npm_registry",
+          `${distribution.packageName}@${distribution.distTag} is reachable (${version.split(/\r?\n/).at(-1)}).`
+        )
       )
     );
     try {
@@ -13256,9 +13333,10 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   };
 }
 function registerDoctorCommand(program2) {
+  const distribution = cliDistribution();
   program2.command("doctor").description("Diagnose Node, npm, PATH, registry, configuration, and local OAuth callback readiness.").option("--no-network", "skip npm registry and Actionway OAuth discovery checks").action(async (options) => {
     const report = await diagnoseActionway({ network: options.network !== false });
-    const command = process.platform === "win32" ? "actionway.cmd" : "actionway";
+    const command = process.platform === "win32" ? `${distribution.commandName}.cmd` : distribution.commandName;
     ok({
       ...report,
       hint: report.ready ? `Actionway CLI prerequisites are ready. Run \`${command} init\`.` : `Resolve the failed checks, then run \`${command} doctor\` again.`
@@ -13282,15 +13360,21 @@ var InitError = class extends Error {
   }
 };
 var ACTIONWAY_SKILL_INSTRUCTION = "Install this skill from `source` into your agent's skill directory and make sure it loads in future sessions. If a skill named `actionway` already exists there, replace it only when it is an earlier Actionway skill (check its frontmatter metadata.version); otherwise ask the user first.";
-function resolveBundledSkill(moduleUrl = import.meta.url) {
+var ACTIONWAY_DEV_SKILL_INSTRUCTION = "Install this skill from `source` into your agent's skill directory and make sure it loads in future sessions. If a skill named `actionway-dev` already exists there, replace it only when it is an earlier Actionway development skill (check its frontmatter metadata.version); otherwise ask the user first. Never replace the stable `actionway` Skill.";
+function resolveBundledSkill(moduleUrl = import.meta.url, env = process.env) {
   const here = dirname4(fileURLToPath3(moduleUrl));
-  for (const candidate of [resolve2(here, "../assets/skill/actionway"), resolve2(here, "../../assets/skill/actionway")]) {
+  const skillName = cliDistribution(env).skillName;
+  for (const candidate of [resolve2(here, `../assets/skill/${skillName}`), resolve2(here, `../../assets/skill/${skillName}`)]) {
     if (existsSync3(join4(candidate, "SKILL.md"))) return realpathSync2(candidate);
   }
-  throw new InitError("the bundled Actionway Skill is missing", "reinstall @actionway/cli, then run `actionway init` again");
+  const distribution = cliDistribution(env);
+  throw new InitError(
+    "the bundled Actionway Skill is missing",
+    `reinstall ${distribution.packageName}@${distribution.distTag}, then run \`${distribution.commandName} init\` again`
+  );
 }
 function skillSourcePath(env = process.env) {
-  return join4(actionwayConfigDir(env), "skill", "actionway");
+  return join4(actionwayConfigDir(env), "skill", cliDistribution(env).skillName);
 }
 function stampSkillVersion(skillMarkdown, version) {
   const newline = skillMarkdown.includes("\r\n") ? "\r\n" : "\n";
@@ -13329,18 +13413,26 @@ function stampSkillVersion(skillMarkdown, version) {
 }
 function materializeSkill(options = {}) {
   const env = options.env ?? process.env;
-  const source = options.source ? realpathSync2(options.source) : resolveBundledSkill();
+  const distribution = cliDistribution(env);
+  const source = options.source ? realpathSync2(options.source) : resolveBundledSkill(import.meta.url, env);
   if (!existsSync3(join4(source, "SKILL.md"))) {
-    throw new InitError("the Actionway Skill source is invalid", "reinstall @actionway/cli and retry init");
+    throw new InitError(
+      "the Actionway Skill source is invalid",
+      `reinstall ${distribution.packageName}@${distribution.distTag} and retry init`
+    );
   }
-  const version = options.version ?? readOwnVersion();
+  const version = options.version ?? readOwnVersion(import.meta.url, env);
   const target = skillSourcePath(env);
   mkdirSync3(dirname4(target), { recursive: true, mode: 448 });
   rmSync3(target, { recursive: true, force: true });
   cpSync(source, target, { recursive: true });
   const skillPath = join4(target, "SKILL.md");
   writeFileSync4(skillPath, stampSkillVersion(readFileSync4(skillPath, "utf8"), version));
-  return { source: target, version, instruction: ACTIONWAY_SKILL_INSTRUCTION };
+  return {
+    source: target,
+    version,
+    instruction: distribution.channel === "development" ? ACTIONWAY_DEV_SKILL_INSTRUCTION : ACTIONWAY_SKILL_INSTRUCTION
+  };
 }
 
 // src/lib/install-session.ts
@@ -13461,6 +13553,7 @@ function failFromError3(err) {
   fail({ code: "E_BACKEND", message: err instanceof Error ? err.message : String(err) });
 }
 function registerInitCommand(program2) {
+  const distribution = cliDistribution();
   program2.command("init").description(
     "Complete browser authentication and stage the Actionway Skill for your agent to install. The CLI never writes into an agent's own configuration directory."
   ).option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id)").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--install-session-id <uuid>", "onboarding install session id").option("--no-browser", "print the authorize URL instead of opening a browser").addOption(new Option("--skill-only").hideHelp()).action(async (opts) => {
@@ -13502,7 +13595,7 @@ function registerInitCommand(program2) {
         skill,
         workspace_id: account.workspaceId,
         ...snapshot?.user ? { user: snapshot.user } : {},
-        hint: "Actionway is ready. Install the skill from `skill.source` into your agent's skill directory, then run `actionway --help` to discover supported capabilities."
+        hint: `Actionway is ready. Install the skill from \`skill.source\` into your agent's skill directory, then run \`${distribution.commandName} --help\` to discover supported capabilities.`
       });
     } catch (error) {
       failFromError3(error);
@@ -13510,6 +13603,26 @@ function registerInitCommand(program2) {
   });
 }
 
+// src/commands/status.ts
+function registerDevelopmentStatusCommand(program2) {
+  const distribution = cliDistribution();
+  if (distribution.channel !== "development") return;
+  program2.command("status").description("Show the installed Actionway development channel and immutable source revision.").action(() => {
+    const manifest = readOwnPackage();
+    const metadata = manifest.actionway;
+    ok({
+      channel: "development",
+      package: manifest.name,
+      version: manifest.version,
+      source_sha: metadata?.source_sha ?? null,
+      run_id: metadata?.run_id ?? null,
+      run_url: metadata?.run_url ?? null,
+      gateway_url: metadata?.gateway_url ?? distribution.gatewayUrl,
+      config_dir: process.env.ACTIONWAY_CONFIG_DIR ?? null
+    });
+  });
+}
+
 // src/commands/update.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 function refreshSkillWithNewBinary() {
@@ -13530,7 +13643,8 @@ function refreshSkillWithNewBinary() {
   }
 }
 function registerUpdateCommand(program2) {
-  program2.command("update").description("Check for or install the latest @actionway/cli version from npm.").option("--check", "check for a newer version without installing").option("--refresh", "ignore the 24-hour update-check cache").action((opts) => {
+  const distribution = cliDistribution();
+  program2.command("update").description(`Check for or install the latest ${distribution.packageName} version from npm.`).option("--check", "check for a newer version without installing").option("--refresh", "ignore the 24-hour update-check cache").action((opts) => {
     try {
       if (opts.check) {
         ok({ ...getUpdateStatus({ ...opts.refresh ? { refresh: true } : {} }) });
@@ -13553,7 +13667,7 @@ function registerUpdateCommand(program2) {
       fail({
         code: "E_UPDATE_FAILED",
         message: error instanceof Error ? error.message : String(error),
-        hint: "retry later or reinstall @actionway/cli@latest"
+        hint: `retry later or reinstall ${distribution.packageName}@${distribution.distTag}`
       });
     }
   });
@@ -13563,6 +13677,7 @@ function registerUpdateCommand(program2) {
 function withVersionMetadata(payload, deps = {}) {
   const env = deps.env ?? process.env;
   const cliVersion2 = deps.currentVersion ?? getCliVersion();
+  const distribution = cliDistribution(env);
   const skillSource = skillSourcePath(env);
   const isUpdateCommandOutput = "update_available" in payload;
   const notes = [];
@@ -13570,12 +13685,12 @@ function withVersionMetadata(payload, deps = {}) {
     const state = readVersionState(env);
     if (!isUpdateCommandOutput && state.latest_version && isValidVersion(state.latest_version) && compareVersions(state.latest_version, cliVersion2) > 0) {
       notes.push(
-        `Update available: ${cliVersion2} -> ${state.latest_version}. Run \`actionway update\` at the next session boundary, then refresh the installed skill from ${skillSource}.`
+        `Update available: ${cliVersion2} -> ${state.latest_version}. Run \`${distribution.commandName} update\` at the next session boundary, then refresh the installed skill from ${skillSource}.`
       );
     }
     if (state.min_version && isValidVersion(state.min_version) && compareVersions(cliVersion2, state.min_version) < 0) {
       notes.push(
-        `This CLI version (${cliVersion2}) is below the minimum supported version (${state.min_version}). Run \`actionway update\` now, then refresh the installed skill from ${skillSource}.`
+        `This CLI version (${cliVersion2}) is below the minimum supported version (${state.min_version}). Run \`${distribution.commandName} update\` now, then refresh the installed skill from ${skillSource}.`
       );
     }
   } catch {
@@ -13794,14 +13909,16 @@ function getTransport2() {
 }
 var actionDeps = { getTransport: getTransport2, projectToolCall: projectTypedToolCall };
 function buildProgram() {
+  const distribution = cliDistribution();
   const version = readOwnVersion();
   setCliVersion(version);
-  const program2 = new Command("actionway");
+  const program2 = new Command(distribution.commandName);
   program2.version(version);
   program2.description("Actionway CLI: run Actionway media and research capabilities from your local agent.");
   registerInitCommand(program2);
   registerDoctorCommand(program2);
   registerUpdateCommand(program2);
+  registerDevelopmentStatusCommand(program2);
   registerAuthCommands(program2);
   registerAccountCommands(program2, getTransport2);
   registerToolsCommands(program2, getTransport2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actionway/cli",
-  "version": "0.18.4",
+  "version": "0.18.6",
   "description": "actionway CLI 的本地端壳：Clerk OAuth 鉴权 + cli-core 共享命令面 + init / update / skill 物化 / 版本三链路（终端用户本地 Codex / Claude Code 使用）",
   "type": "module",
   "bin": {