@crabcloud/cli 0.1.1 → 0.1.3

package/dist/crab.js

@@ -5723,8 +5723,10 @@ function superRefine(fn, params) {
 // ../../packages/contracts/src/index.ts
 var accountDomain = "crabcloud.cc";
 var adminDomain = `admin.${accountDomain}`;
+var clientTypes = ["web", "agent", "miniapp", "native"];
 var scopes = [
   "account.read",
+  "credits.read",
   "mail.read",
   "mail.send",
   "mail.search",
@@ -5732,9 +5734,29 @@ var scopes = [
   "files.read",
   "files.write",
   "files.delete",
+  "media.read",
+  "media.write",
   "projects.read",
   "projects.write"
 ];
+var scopeGroups = [
+  { id: "account", scopes: ["account.read", "credits.read"] },
+  { id: "mail", scopes: ["mail.read", "mail.send", "mail.search", "mail.delete"] },
+  { id: "files", scopes: ["files.read", "files.write", "files.delete"] },
+  { id: "media", scopes: ["media.read", "media.write"] },
+  { id: "projects", scopes: ["projects.read", "projects.write"] }
+];
+function expandScopes(input) {
+  const expanded = input.flatMap((item) => {
+    const group = scopeGroups.find((g) => g.id === item);
+    return group ? [...group.scopes] : [item];
+  });
+  const unique = [...new Set(expanded)];
+  return {
+    scopes: unique.filter((scope) => scopes.includes(scope)),
+    invalid: unique.filter((scope) => !scopes.includes(scope))
+  };
+}
 var apiErrorSchema = object({
   code: _enum([
     "bad_request",
@@ -5745,6 +5767,8 @@ var apiErrorSchema = object({
     "conflict",
     "rate_limited",
     "expired",
+    "insufficient_credits",
+    "payload_too_large",
     "internal"
   ]),
   message: string2()
@@ -5780,6 +5804,22 @@ var passwordResetInput = object({
   code: string2().trim().regex(/^\d{6}$/),
   password: string2().min(8).max(256)
 });
+var profileUpdateInput = object({
+  displayName: string2().trim().min(1).max(80)
+});
+var passwordChangeInput = object({
+  currentPassword: string2().min(1).max(256),
+  newPassword: string2().min(8).max(256)
+});
+var sessionSummarySchema = object({
+  id: string2(),
+  current: boolean2(),
+  clientType: _enum(clientTypes),
+  userAgent: string2().nullable(),
+  createdAt: number2(),
+  lastActiveAt: number2().nullable(),
+  expiresAt: number2()
+});
 var deviceStartInput = object({
   name: string2().trim().min(1).max(80),
   scopes: array(_enum(scopes)).min(1).max(scopes.length)
@@ -5798,14 +5838,37 @@ var agentTokenSummarySchema = object({
   expiresAt: number2().nullable(),
   revoked: boolean2()
 });
-var oauthProviders = ["google", "github"];
+var oauthProviders = ["google", "reai", "github"];
 var oauthUnbindInput = object({ provider: _enum(oauthProviders) });
-var oauthOnboardingConfirmInput = object({ username: usernameSchema });
+var oauthOnboardingConfirmInput = object({
+  username: usernameSchema,
+  password: string2().min(8).max(256)
+});
 var oauthBindLoginInput = object({
   username: string2().trim().toLowerCase().min(3).max(254),
   password: string2().min(1).max(256)
 });
 var adminSettingsInput = object({ registrationOpen: boolean2() });
+var creditBuckets = ["granted", "topup"];
+var creditPackStatuses = ["draft", "live", "delisted"];
+var adminCreditAdjustInput = object({
+  delta: number2().int().refine((v) => v !== 0, "delta must be a non-zero integer"),
+  bucket: _enum(creditBuckets).default("topup"),
+  note: string2().trim().min(1).max(500)
+});
+var creditOrderCreateInput = object({
+  packId: string2().trim().min(1).max(64)
+});
+var adminCreditPackInput = object({
+  title: string2().trim().min(1).max(100),
+  credits: number2().int().positive().max(1e7),
+  priceCents: number2().int().positive(),
+  currency: string2().trim().length(3).default("CNY"),
+  sort: number2().int().min(0).max(1e4).default(0)
+});
+var adminCreditPackUpdateInput = adminCreditPackInput.partial().extend({
+  status: _enum(creditPackStatuses).optional()
+});
 var giftFulfillments = ["stock", "webhook"];
 var giftMerchantStatuses = ["active", "disabled"];
 var giftProductStatuses = ["draft", "live", "delisted"];
@@ -5816,7 +5879,6 @@ var giftCodePattern = /^[0-9A-HJ-NP-TV-Z]{16}$/;
 var giftCodeInput = string2().trim().min(16).max(32).transform(normalizeGiftCode).refine((code) => giftCodePattern.test(code));
 var giftOrderCreateInput = object({
   productId: string2().trim().min(1).max(64),
-  batchId: string2().trim().min(1).max(64).optional(),
   quantity: number2().int().min(1).max(10),
   email: backupEmailSchema
 });
@@ -5827,7 +5889,7 @@ var giftRedeemInput = object({
   externalUserId: string2().trim().max(128).optional()
 });
 var giftMerchantCreateInput = object({
-  id: string2().trim().toLowerCase().regex(/^[a-z][a-z0-9-]{1,31}$/),
+  id: string2().trim().toLowerCase().regex(/^[a-z0-9][a-z0-9_-]{0,63}$/),
   name: string2().trim().min(1).max(80),
   webhookUrl: string2().trim().url().max(500).optional(),
   note: string2().trim().max(500).optional()
@@ -5845,27 +5907,50 @@ var giftProductCreateInput = object({
   description: string2().trim().max(1000).optional(),
   metaJson: record(string2(), unknown()).optional(),
   emailNote: string2().trim().max(1000).optional(),
-  faceCents: number2().int().positive().optional(),
-  priceCents: number2().int().positive().optional()
-}).refine((input) => input.fulfillment !== "webhook" || input.faceCents !== undefined && input.priceCents !== undefined, {
-  message: "webhook products require faceCents and priceCents"
+  faceCents: number2().int().positive(),
+  priceCents: number2().int().positive(),
+  expiresAt: number2().int().positive(),
+  stockQuantity: number2().int().min(0).optional()
 });
 var giftProductPatchInput = object({
   title: string2().trim().min(1).max(120).optional(),
   description: union([string2().trim().max(1000), _null3()]).optional(),
   metaJson: record(string2(), unknown()).optional(),
   emailNote: union([string2().trim().max(1000), _null3()]).optional(),
-  status: _enum(giftProductStatuses).optional()
+  status: _enum(giftProductStatuses).optional(),
+  faceCents: number2().int().positive().optional(),
+  priceCents: number2().int().positive().optional(),
+  expiresAt: number2().int().positive().optional(),
+  stockQuantity: number2().int().min(0).optional()
 });
-var giftBatchCreateInput = object({
-  productId: string2().trim().min(1).max(64),
-  faceCents: number2().int().positive(),
-  priceCents: number2().int().positive(),
-  count: number2().int().min(1).max(500),
-  expiresAt: number2().int().positive(),
-  note: string2().trim().max(500).optional()
+var giftProductCodesGenerateInput = object({
+  count: number2().int().min(1).max(500)
+});
+var giftStockAdjustInput = object({
+  delta: number2().int().refine((n) => n !== 0, { message: "delta must be non-zero" })
 });
 var giftManualCodeInput = object({ code: string2().trim().min(4).max(64) });
+var mailAddressSchema = string2().trim().toLowerCase().email().max(254);
+var mailRecipientList = array(mailAddressSchema).max(10);
+var mailSendInput = object({
+  to: mailRecipientList.min(1),
+  cc: mailRecipientList.default([]),
+  subject: string2().trim().min(1).max(200),
+  body: string2().min(1).max(1e5),
+  inReplyTo: string2().max(998).optional()
+});
+var mailDraftInput = object({
+  to: mailRecipientList.default([]),
+  cc: mailRecipientList.default([]),
+  subject: string2().trim().max(200).default(""),
+  body: string2().max(1e5).default("")
+});
+var mailDevInboundInput = object({
+  from: mailAddressSchema,
+  to: mailAddressSchema,
+  subject: string2().trim().min(1).max(200),
+  body: string2().max(1e5)
+});
 
 // ../../packages/skills/src/install.ts
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -6053,6 +6138,7 @@ var EXIT_USAGE = 2;
 var EXIT_AUTH = 3;
 var EXIT_SCOPE = 4;
 var EXIT_NOT_FOUND = 5;
+var EXIT_QUOTA = 7;
 function packageVersion() {
   try {
     const pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
@@ -6095,6 +6181,10 @@ function exitCodeForApiError(body) {
       return EXIT_SCOPE;
     case "not_found":
       return EXIT_NOT_FOUND;
+    case "bad_request":
+      return EXIT_USAGE;
+    case "insufficient_credits":
+      return EXIT_QUOTA;
     default:
       return 1;
   }
@@ -6129,24 +6219,38 @@ function formatTime(ms) {
   return new Date(ms).toLocaleString("sv", { year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit" });
 }
 var usage = `crab — Crab Cloud CLI（Agent-first 入口）
+发布物经 npm 分发：npx @crabcloud/cli <command>（全局安装后短名 crab 等价）
 
 用法:
-  crab <command> [options]
+  npx @crabcloud/cli <command> [options]
 
 命令:
   init                 登录（未登录时）+ 安装 skills 到本机 agent
   login                浏览器授权登录（设备授权流），保存 Agent Token
-                       --scopes mail.read,files.write  自定义 scope（默认 ${DEFAULT_SCOPES.join(",")}）
-                       --no-open                      只打印链接，不自动打开浏览器
-                       --api <url>                    指定 API 地址
+                       --scopes <scope|组名,...>  自定义 scope，支持组名整组授权
+                                                  （默认 ${DEFAULT_SCOPES.join(",")}）
+                       --no-open                 只打印链接，不自动打开浏览器
+                       --api <url>               指定 API 地址
+
   whoami [--json]      显示当前授权身份
   tokens list [--json] 列出已授权的 Agent 令牌
   tokens revoke <id>   撤销某个令牌（高危，请先确认）
+  mail list [--folder inbox|sent|drafts|archive|trash] [--unread] [--limit N] [--json]
+                       列出邮件（cursor 分页契约与 Web 工作台一致）
+  mail read <id> [--json]            读取邮件正文（自动置已读）
+  mail search <query> [--json]       全文搜索（主题/发件人/收件人/正文）
+  mail send --to a@x.cc,b@y.cn [--cc c@z.io] --subject "..." --body "..." | --body-file <path>
+                       发送邮件：平台内（@crabcloud.cc）免费，外部出站 2 积分/封
+  mail archive|trash|delete <id>     移夹 / 废纸篓 / 彻底删除（delete 不可恢复）
   skills install|list|uninstall [--agent claude,zcode,codex,agents]
                        skills 管理（claude/zcode/agents 复制目录，codex 写 AGENTS.md 段）
   logout               撤销当前 Agent Token 并清除本地凭证
   version              显示版本
 
+scope 分组目录（--scopes 可混用单个 scope 与组名，组名展开为整组）:
+${scopeGroups.map((group) => `  ${group.id.padEnd(9)} ${group.scopes.join(", ")}`).join(`
+`)}
+
 环境:
   CRAB_API          API 地址（默认 ${DEFAULT_API}）
   CRAB_CREDENTIALS  凭证文件路径（默认 ~/.config/crabcloud/credentials.json）
@@ -6155,11 +6259,16 @@ var usage = `crab — Crab Cloud CLI（Agent-first 入口）
 `;
 async function login() {
   const apiBase = process.env.CRAB_API ?? readFlag("--api") ?? DEFAULT_API;
-  const requested = (readFlag("--scopes") ?? DEFAULT_SCOPES.join(",")).split(",").map((scope) => scope.trim()).filter(Boolean);
-  const invalid = requested.filter((scope) => !scopes.includes(scope));
+  const rawScopes = (readFlag("--scopes") ?? DEFAULT_SCOPES.join(",")).split(",").map((scope) => scope.trim()).filter(Boolean);
+  const { scopes: requested, invalid } = expandScopes(rawScopes);
   if (invalid.length > 0) {
-    console.error(`未知 scope：${invalid.join(", ")}
-可用 scope：${scopes.join(", ")}`);
+    console.error(`未知 scope 或组名：${invalid.join(", ")}
+可用 scope：${scopes.join(", ")}
+可用组名：${scopeGroups.map((group) => group.id).join(", ")}`);
+    return EXIT_USAGE;
+  }
+  if (requested.length === 0) {
+    console.error(`--scopes 展开后为空（输入：${rawScopes.join(", ")}）`);
     return EXIT_USAGE;
   }
   const openBrowser = !hasFlag("--no-open");
@@ -6226,14 +6335,18 @@ async function whoami() {
     console.log(JSON.stringify(me.body.data, null, 2));
     return 0;
   }
-  const { account, actor, scopes: grantedScopes, personalSpace, credits } = me.body.data;
+  const { account, actor, scopes: grantedScopes, personalSpace, subscription, credits, apps } = me.body.data;
   console.log(`${account.username}（${account.displayName}）`);
   console.log(`  身份: ${actor}`);
   console.log(`  scopes: ${(grantedScopes ?? []).join(", ") || "—"}`);
   if (personalSpace)
     console.log(`  个人空间: ${personalSpace.title}`);
+  if (subscription)
+    console.log(`  订阅: ${subscription.tier_name}`);
   if (credits !== undefined)
     console.log(`  积分余额: ${credits}`);
+  if (apps?.length)
+    console.log(`  已启用应用: ${apps.map((a) => a.title).join("、")}`);
   return 0;
 }
 async function tokensList() {
@@ -6279,6 +6392,177 @@ async function tokensRevoke(id) {
   console.log(`✓ 已撤销令牌 ${id}。`);
   return 0;
 }
+var MAIL_FOLDERS = ["inbox", "sent", "drafts", "archive", "trash"];
+function mailListItemName(mail) {
+  return mail.folder === "sent" ? `致 ${mail.to.join(", ")}` : mail.fromName || mail.fromAddr;
+}
+function printMailRow(mail) {
+  const flags = [
+    mail.isUnread ? "未读" : null,
+    mail.hasAttachments ? "附件" : null,
+    mail.platform ? "平台" : null,
+    mail.sendStatus && mail.sendStatus !== "sent" ? `发送:${mail.sendStatus}` : null
+  ].filter(Boolean);
+  console.log(`${mail.id}  ${mailListItemName(mail)}  ${mail.subject || "（无主题）"}  ${formatTime(mail.createdAt)}${flags.length > 0 ? `  [${flags.join(" · ")}]` : ""}`);
+}
+async function mailList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const folder = readFlag("--folder") ?? "inbox";
+  if (!MAIL_FOLDERS.includes(folder)) {
+    console.error(`未知文件夹：${folder}
+可用：${MAIL_FOLDERS.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const params = new URLSearchParams({ folder });
+  if (hasFlag("--unread"))
+    params.set("unreadOnly", "1");
+  const limit = readFlag("--limit");
+  if (limit)
+    params.set("limit", limit);
+  const cursor = readFlag("--cursor");
+  if (cursor)
+    params.set("cursor", cursor);
+  const res = await api2(credentials.apiBase, `/v1/mail/messages?${params}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取邮件列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(page, null, 2));
+    return 0;
+  }
+  if (page.items.length === 0) {
+    console.log("该文件夹暂时没有邮件。");
+    return 0;
+  }
+  for (const mail of page.items)
+    printMailRow(mail);
+  if (page.nextCursor)
+    console.log(`（还有更多：--cursor ${page.nextCursor}）`);
+  return 0;
+}
+async function mailRead(id) {
+  if (!id) {
+    console.error("用法：crab mail read <id>（id 见 crab mail list）");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, `/v1/mail/messages/${encodeURIComponent(id)}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "读取邮件失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const mail = res.body.data.message;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(mail, null, 2));
+    return 0;
+  }
+  console.log(`${mail.subject || "（无主题）"}`);
+  console.log(`  发件人: ${mail.fromName ? `${mail.fromName} <${mail.fromAddr}>` : mail.fromAddr}`);
+  console.log(`  收件人: ${mail.to.join(", ")}${mail.cc.length > 0 ? `
+  抄送: ${mail.cc.join(", ")}` : ""}`);
+  console.log(`  时间: ${formatTime(mail.createdAt)}`);
+  console.log("");
+  console.log(mail.bodyText);
+  if (mail.actors.length > 0) {
+    console.log("");
+    console.log("操作记录:");
+    for (const actor of mail.actors) {
+      console.log(`  ${actor.action}  ${actor.actorLabel ?? "—"}  ${formatTime(actor.createdAt)}`);
+    }
+  }
+  return 0;
+}
+async function mailSearch(query) {
+  if (!query || !query.trim()) {
+    console.error("用法：crab mail search <query>");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, `/v1/mail/search?q=${encodeURIComponent(query.trim())}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "搜索失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const items = res.body.data.items;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(items, null, 2));
+    return 0;
+  }
+  if (items.length === 0) {
+    console.log("没有匹配的邮件。");
+    return 0;
+  }
+  for (const mail of items)
+    printMailRow(mail);
+  return 0;
+}
+async function mailSend() {
+  const to = (readFlag("--to") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  const cc = (readFlag("--cc") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  const subject = readFlag("--subject") ?? "";
+  const bodyFlag = readFlag("--body");
+  const bodyFile = readFlag("--body-file");
+  if (to.length === 0 || !subject || !bodyFlag && !bodyFile) {
+    console.error('用法：crab mail send --to a@x.cc[,b@y.cn] [--cc c@z.io] --subject "..." --body "..." | --body-file <path>');
+    return EXIT_USAGE;
+  }
+  let body = bodyFlag ?? "";
+  if (bodyFile) {
+    try {
+      body = readFileSync2(bodyFile, "utf8");
+    } catch {
+      console.error(`读取正文文件失败：${bodyFile}`);
+      return EXIT_USAGE;
+    }
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/mail/messages", {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ to, cc, subject, body })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "发送失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const result = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(result, null, 2));
+    return 0;
+  }
+  console.log(`✓ 已发送（id ${result.message.id}）`);
+  if (result.chargedCredits > 0)
+    console.log(`  消耗积分：${result.chargedCredits}`);
+  if (result.failedExternal > 0)
+    console.log(`  ⚠ ${result.failedExternal} 个外部收件人发送失败，对应积分已退回`);
+  return 0;
+}
+async function mailMove(action, id) {
+  if (!id) {
+    console.error(`用法：crab mail ${action} <id>`);
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, `/v1/mail/messages/${encodeURIComponent(id)}${action === "delete" ? "" : `/${action}`}`, { method: action === "delete" ? "DELETE" : "POST", headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "操作失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  console.log(`✓ ${action === "archive" ? "已归档" : action === "trash" ? "已移入废纸篓" : "已彻底删除"}（${id}）`);
+  return 0;
+}
 async function init() {
   if (loadCredentials()) {
     console.log("已登录（crab whoami 查看身份）。");
@@ -6337,6 +6621,24 @@ switch (command) {
 `);
     process.exit(EXIT_USAGE);
   }
+  case "mail": {
+    const sub = args[1];
+    if (sub === "list")
+      process.exit(await mailList());
+    if (sub === "read")
+      process.exit(await mailRead(args[2]));
+    if (sub === "search")
+      process.exit(await mailSearch(args.slice(2).join(" ") || undefined));
+    if (sub === "send")
+      process.exit(await mailSend());
+    if (sub === "archive" || sub === "trash" || sub === "delete")
+      process.exit(await mailMove(sub, args[2]));
+    console.error(sub ? `未知子命令：mail ${sub}
+` : `缺少子命令：mail list | read | search | send | archive | trash | delete
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
   case "logout":
     process.exit(await logout());
   case "version":

package/dist/skills/crabcloud/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: crabcloud
-description: Manage the user's Crab Cloud personal cloud account and agent tokens through the `crab` CLI — check identity/subscription/credits, list and revoke authorized agent tokens, and re-authorize with specific scopes. Use this skill whenever the user asks about their Crab Cloud account ("我的账号信息", "who am I on crabcloud"), wants to see or clean up authorized agents/tokens ("看看我授权了哪些 agent", "revoke that old token", "撤销那个旧令牌"), or asks how to connect their coding agent to Crab Cloud — even if they never say "crab" or "Crab Cloud" explicitly. Mail, files and projects capabilities ship with their own skills (crabcloud-mail etc.) in later phases.
+description: Manage the user's Crab Cloud personal cloud account and agent tokens through the `crab` CLI — check identity/subscription/credits, list and revoke authorized agent tokens, and re-authorize with specific scopes. Use this skill whenever the user asks about their Crab Cloud account ("我的账号信息", "who am I on crabcloud"), wants to see or clean up authorized agents/tokens ("看看我授权了哪些 agent", "revoke that old token", "撤销那个旧令牌"), or asks how to connect their coding agent to Crab Cloud — even if they never say "crab" or "Crab Cloud" explicitly. Email lives in the crabcloud-mail skill (crab mail …); files and projects ship in later phases.
 ---
 
 # Crab Cloud（平台 / 账号域）
@@ -8,8 +8,8 @@ description: Manage the user's Crab Cloud personal cloud account and agent token
 Crab Cloud 是用户的个人云底座：账号、订阅与积分是平台层，邮箱 / 云文件 / 协作项目
 是独立应用。`crab` CLI 是 Agent 的稳定接口：凭证在用户本机
 （`~/.config/crabcloud/credentials.json`，0600），服务端只存令牌哈希、全程审计。
-本 skill 目前覆盖**平台与账号域**；邮箱（`crabcloud-mail`）、云文件、协作项目
-能力随各阶段上线——用户问到这些时如实说明尚未开放，**不要猜命令**。
+本 skill 覆盖**平台与账号域**；邮箱已上线，见 `crabcloud-mail` skill（`crab mail …`）；
+云文件、协作项目仍随后续阶段提供——用户问到这些时如实说明尚未开放，**不要猜命令**。
 
 ## 第一步：确认 CLI 可用
 
@@ -30,6 +30,7 @@ Crab Cloud 是用户的个人云底座：账号、订阅与积分是平台层，
 | 撤销某个令牌（高危，先确认） | `crab tokens revoke <id>` |
 | 重新授权 / 调整 scope | `crab login --scopes mail.read`（浏览器确认，你只发起） |
 | 登出并吊销当前令牌 | `crab logout` |
+| 管理登录设备 / 会话、修改密码 | 网页个人中心（crabcloud.cc/account）——CLI 有意不开放 |
 
 拿不准令牌 id 时先 `crab tokens list` 核对；`revoke` 只接受列表里的 id。
 
@@ -37,7 +38,7 @@ Crab Cloud 是用户的个人云底座：账号、订阅与积分是平台层，
 
 程序化消费时**始终加 `--json`**（`whoami --json` / `tokens list --json`）：
 
-- `whoami --json` → `{ actor, scopes, account: { username, displayName, … }, personalSpace, subscription, credits }`；
+- `whoami --json` → `{ actor, scopes, account: { username, displayName, … }, personalSpace, subscription, credits, apps }`；
 - `tokens list --json` → `[{ id, name, scopes, createdAt, lastUsedAt, expiresAt, revoked }]`：
   后续 `revoke` 用 `id`，向用户转述时用 `name` + `scopes`。
 
@@ -58,5 +59,9 @@ Crab Cloud 是用户的个人云底座：账号、订阅与积分是平台层，
   执行 `crab tokens revoke`；撤销立即生效，不可恢复（重新授权即可再建）。
 - **scope 最小化**：建议按需授权（只读场景 `crab login --scopes account.read`），
   不要怂恿用户一次性给全量 scope。
-- 如实转述能力边界：邮箱 / 云文件 / 协作项目尚未上线，相关请求引导用户关注
-  后续版本，不要编造命令或输出。
+- 如实转述能力边界：云文件 / 协作项目尚未上线，相关请求引导用户关注
+  后续版本，不要编造命令或输出；邮箱请求转交 `crabcloud-mail` skill。
+- 账号安全操作（修改密码、登录设备/会话的查看与吊销）**有意不开放给 agent
+  通道**：改密对令牌持有者是账号接管面，会话属于"人的浏览器会话"。用户让
+  agent 做这些时，如实说明并引导到网页个人中心（crabcloud.cc/account）操作，
+  不要猜命令、也不要试图直接调 API。

package/dist/skills/crabcloud-mail/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: crabcloud-mail
+description: Read, search and send the user's Crab Cloud platform email (username@crabcloud.cc) through the `crab` CLI — list folders, read messages, full-text search, send mail, archive/trash/delete. Use this skill when the user asks to check, read, find, draft or send email on Crab Cloud ("看看我的邮箱", "读一下这封邮件", "帮我回复", "发邮件给…", "crab mail"), or asks what their mailbox looks like — even if they never say "crab" or "Crab Cloud" explicitly.
+---
+
+# Crab Cloud 邮箱（crab mail）
+
+用户的 Crab Cloud 账号自带平台邮箱 `username@crabcloud.cc`（用户名即地址本地部分）。
+本 skill 覆盖邮箱域的 agent 通道；账号/令牌管理见 `crabcloud` skill，云文件、协作
+项目尚未开放——用户问到时如实说明，**不要猜命令**。
+
+## 第一步：确认可用
+
+- `crab --version` 确认已安装；未登录（退出码 3）引导用户 `crab login`。
+- 邮箱动作需要对应 scope：读 `mail.read`、搜索 `mail.search`、发信 `mail.send`、
+  删除 `mail.delete`。退出码 4 = scope 不足：如实转述缺哪个，引导用户
+  `crab login --scopes mail.read,...` 按需最小化重新授权（你只发起，不代批）。
+
+## 意图 → 命令映射
+
+| 用户意图 | 命令 |
+|---|---|
+| 看收件箱 / 各文件夹 | `crab mail list`（默认 inbox；`--folder sent\|drafts\|archive\|trash`） |
+| 只看未读 | `crab mail list --unread` |
+| 翻页 | `crab mail list --cursor <nextCursor>`（列表末尾会提示） |
+| 读某封邮件 | `crab mail read <id>`（自动置已读；正文 + 操作记录） |
+| 找邮件 | `crab mail search <关键词>`（主题/发件人/收件人/正文，不含废纸篓） |
+| 发邮件 | `crab mail send --to a@x.cc --subject "..." --body "..."`（长正文用 `--body-file`） |
+| 整理邮箱 | `crab mail archive <id>` / `crab mail trash <id>` / `crab mail delete <id>` |
+
+拿不准邮件 id 时先 `crab mail list` / `crab mail search` 核对再操作。
+
+## 计费口径（必须如实转述）
+
+- **平台内互发免费**：收件人也是 `@crabcloud.cc` 地址时不消耗积分。
+- **外部出站 2 积分/封**：发送前向用户复述收件人与计费；退出码 7 = 积分不足，
+  告知用户不要自动重试。
+- 发送结果会报告 `消耗积分` 与失败数；部分失败时失败部分的积分自动退回
+  （`发送:partial` 标记）。
+
+## 机器可读输出
+
+程序化消费**始终加 `--json`**：
+
+- `mail list --json` → `{ items: [...], nextCursor }`，条目含
+  `id/folder/fromAddr/to/subject/snippet/isUnread/hasAttachments/createdAt`；
+- `mail read --json` → 完整正文 + `actors`（谁读过/谁代发，审计源）；
+- `mail send --json` → `{ message, chargedCredits, failedExternal }`。
+
+## 纪律
+
+- **发邮件是外发动作**：发送前向用户复述收件人、主题与计费口径，确认后再执行；
+  不确定收件人身份时先搜索历史邮件核对，不要猜测地址。
+- **`mail delete` 是彻底删除**，不可恢复；用户没明说「彻底删除」时用
+  `mail trash`（可找回，废纸篓 30 天后自动清除）。
+- 草稿流程：先 `mail list --folder drafts` 查看草稿；本阶段 CLI 不直接改草稿，
+  确认发送请把草稿内容转述给用户后用 `mail send` 发出。
+- 附件：本阶段只标记 `hasAttachments`，附件内容尚未开放读取，如实说明。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crabcloud/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Crab Cloud CLI (crab) — agent-first entry to your personal cloud, with skills bundled for Claude Code / Codex / ZCode.",
   "bin": {