@delta-infra/cli 1.0.6 → 1.0.7

package/README.md

@@ -10,28 +10,71 @@ Delta Infra 的命令行工具。
 
 ```bash
 # macOS (Apple Silicon)
-curl -L https://github.com/yzailab/delta-infra-cli/releases/latest/download/delta-cli-darwin-arm64.tar.gz | tar -xz
+curl -L -o delta-cli.tar.gz https://github.com/yzailab/delta-infra-cli/releases/latest/download/delta-cli-darwin-arm64.tar.gz
+tar -xzf delta-cli.tar.gz
 sudo mv delta-cli-darwin-arm64 /usr/local/bin/delta-cli
+rm delta-cli.tar.gz
 
 # Linux (AMD64)
-curl -L https://github.com/yzailab/delta-infra-cli/releases/latest/download/delta-cli-linux-amd64.tar.gz | tar -xz
+curl -L -o delta-cli.tar.gz https://github.com/yzailab/delta-infra-cli/releases/latest/download/delta-cli-linux-amd64.tar.gz
+tar -xzf delta-cli.tar.gz
 chmod +x delta-cli-linux-amd64
 sudo mv delta-cli-linux-amd64 /usr/local/bin/delta-cli
+rm delta-cli.tar.gz
+
+# Windows (AMD64，PowerShell)
+Invoke-WebRequest -Uri https://github.com/yzailab/delta-infra-cli/releases/latest/download/delta-cli-windows-amd64.zip -OutFile delta-cli.zip
+Expand-Archive -Path delta-cli.zip -DestinationPath . -Force
+Move-Item -Path delta-cli-windows-amd64.exe -Destination delta-cli.exe
+Remove-Item -Path delta-cli.zip
+# 将 delta-cli.exe 放到 PATH 中的目录
+```
+
+### 方式二：一键安装脚本（国内用户推荐）
+
+安装脚本会自动尝试国内 npm 镜像（npmmirror），失败后再回退到 npm 官方源：
+
+```bash
+# Linux / macOS
+curl -L https://raw.githubusercontent.com/yzailab/delta-infra-cli/main/install.sh | bash
 
-# Windows (AMD64)
-# 下载 https://github.com/yzailab/delta-infra-cli/releases/latest/download/delta-cli-windows-amd64.zip
-# 解压后将 delta-cli-windows-amd64.exe 重命名为 delta-cli.exe，并放到 PATH 目录下
+# Windows (PowerShell)
+Invoke-RestMethod -Uri https://raw.githubusercontent.com/yzailab/delta-infra-cli/main/install.ps1 | Invoke-Expression
 ```
 
-### 方式二：npm
+### 方式三：npm
 
 ```bash
 npm install -g @delta-infra/cli
 ```
 
-安装时会自动从 GitHub Release 下载当前平台的二进制文件并解压到本地。
+`postinstall` 会按以下顺序尝试下载当前平台的二进制：
 
-### 方式三：Go Install
+1. `DELTA_CLI_MIRROR` 环境变量（如果设置）
+2. 国内加速镜像 `https://gh-proxy.com/https://github.com/...`
+3. GitHub 源站 `https://github.com/yzailab/delta-infra-cli/releases/download/...`
+
+如果安装时下载失败，可以：
+
+- 直接运行一次 `delta-cli`，它会自动重新尝试下载。
+- 或者在安装前设置本地压缩包路径：
+
+```bash
+DELTA_CLI_ARCHIVE=/path/to/delta-cli-linux-amd64.tar.gz npm install -g @delta-infra/cli
+```
+
+常用环境变量：
+
+| 变量 | 说明 |
+|------|------|
+| `DELTA_CLI_MIRROR` | 下载镜像，例如 `https://gh-proxy.com/https://github.com`。只接受 HTTPS 且需在白名单内。 |
+| `DELTA_CLI_MIRROR_ALLOWLIST` | 额外允许的主机列表，逗号分隔。 |
+| `DELTA_CLI_ARCHIVE` | 指向预先下载好的 `.tar.gz` / `.zip` 本地路径，跳过网络下载。 |
+| `DELTA_CLI_SKIP_POSTINSTALL` | 设置为 `1` 跳过安装时的二进制下载，之后由 `delta-cli` 运行时兜底。 |
+| `DELTA_CLI_FATAL_ON_ERROR` | 安装失败时退出码非 0（默认警告，用于调试）。 |
+| `DELTA_CLI_DOWNLOAD_TIMEOUT` | 单个下载源最大等待时间（毫秒，默认 120000）。 |
+
+### 方式四：Go Install
 
 ```bash
 go install github.com/delta-infra/delta-infra-cli/cmd/delta-cli@latest
@@ -45,12 +88,25 @@ go install github.com/delta-infra/delta-infra-cli/cmd/delta-cli@latest
 delta-cli config init
 ```
 
-配置文件保存在 `~/.delta-infra/config.json`（权限 0600），通过 `delta-cli config set base_url <url>` 配置服务端地址。也可通过环境变量覆盖：
+执行时会交互式提示输入服务端地址（默认：`http://172.17.152.6:8000/api/v1`）以及 API Key / Bearer Token（可选，也可后续用 `auth login` 配置）。
+
+非交互式环境（如 CI）会直接使用默认值，也可以通过 flag 或环境变量一次性指定：
 
 ```bash
-export DELTA_INFRA_BASE_URL=<url>
+# 通过 flag
+delta-cli config init \
+  --base-url http://your-server/api/v1 \
+  --api-key your-api-key
+
+# 通过环境变量
+export DELTA_INFRA_BASE_URL=http://your-server/api/v1
+export DELTA_SANDBOX_API_KEY=your-api-key
+export DELTA_SANDBOX_TOKEN=your-token
+delta-cli config init
 ```
 
+配置文件保存在 `~/.delta-infra/config.json`（权限 0600）。
+
 ### 2. 认证
 
 支持 API Key 或 Bearer Token：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delta-infra/cli",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Delta Sandbox CLI",
   "bin": {
     "delta-cli": "scripts/run.js"
@@ -9,6 +9,7 @@
     "postinstall": "node scripts/install.js"
   },
   "files": [
+    "checksums.txt",
     "scripts/install.js",
     "scripts/run.js",
     "skills/delta-sandbox/SKILL.md",
@@ -16,6 +17,15 @@
     "skills/delta-shared/SKILL.md",
     "skills/delta-shared/references/"
   ],
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
   "keywords": [
     "delta",
     "sandbox",

package/scripts/install.js

@@ -3,19 +3,23 @@ const fs = require('fs');
 const path = require('path');
 const https = require('https');
 const crypto = require('crypto');
-const { execSync } = require('child_process');
+const { execSync, spawn } = require('child_process');
 
 const BINARY_NAME = 'delta-cli';
 const VERSION = require('../package.json').version;
-const RELEASE_BASE_URL = 'https://github.com/yzailab/delta-infra-cli/releases/download';
 
-function releaseAssetUrl(version, assetName) {
-  const mirror = process.env.DELTA_CLI_MIRROR || '';
-  if (mirror) {
-    return `${mirror.replace(/\/$/, '')}/yzailab/delta-infra-cli/releases/download/v${version}/${assetName}`;
-  }
-  return `${RELEASE_BASE_URL}/v${version}/${assetName}`;
-}
+const DEFAULT_ALLOWED_HOSTS = [
+  'github.com',
+  'gh-proxy.com',
+  'objects.githubusercontent.com',
+  'release-assets.githubusercontent.com',
+  'github-releases.githubusercontent.com',
+  'raw.githubusercontent.com',
+];
+const DEFAULT_ALLOWED_HOST_PREFIXES = [
+  'github-production-release-asset-',
+];
+const MAX_REDIRECTS = 5;
 
 const platformMap = {
   darwin: 'darwin',
@@ -28,6 +32,20 @@ const archMap = {
   arm64: 'arm64',
 };
 
+const RELEASE_SOURCE_BASE = 'https://github.com/yzailab/delta-infra-cli/releases/download';
+const RELEASE_DOMESTIC_BASE = 'https://gh-proxy.com/https://github.com/yzailab/delta-infra-cli/releases/download';
+
+function releaseAssetUrls(version, assetName) {
+  const urls = [];
+  const mirror = process.env.DELTA_CLI_MIRROR || '';
+  if (mirror) {
+    urls.push(`${mirror.replace(/\/$/, '')}/yzailab/delta-infra-cli/releases/download/v${version}/${assetName}`);
+  }
+  urls.push(`${RELEASE_DOMESTIC_BASE}/v${version}/${assetName}`);
+  urls.push(`${RELEASE_SOURCE_BASE}/v${version}/${assetName}`);
+  return urls;
+}
+
 function resolveUrl(base, location) {
   if (!location) return base;
   if (location.startsWith('http://') || location.startsWith('https://')) {
@@ -37,55 +55,239 @@ function resolveUrl(base, location) {
   return new URL(location, baseUrl).href;
 }
 
-function download(url, dest) {
+function loadChecksums() {
+  const checksumPath = path.join(__dirname, '..', 'checksums.txt');
+  if (!fs.existsSync(checksumPath)) {
+    return null;
+  }
+  const content = fs.readFileSync(checksumPath, 'utf8');
+  const map = new Map();
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const idx = trimmed.indexOf('  ');
+    let hash, filename;
+    if (idx === -1) {
+      const parts = trimmed.split(/\s+/);
+      if (parts.length < 2) continue;
+      hash = parts[0];
+      filename = parts[1];
+    } else {
+      hash = trimmed.slice(0, idx);
+      filename = trimmed.slice(idx + 2);
+    }
+    map.set(filename, hash.toLowerCase());
+  }
+  return map;
+}
+
+function fileSha256(filePath) {
   return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+    stream.on('error', reject);
+  });
+}
+
+function isAllowListedUrl(urlStr) {
+  let url;
+  try {
+    url = new URL(urlStr);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== 'https:') {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  const allowlist = new Set(DEFAULT_ALLOWED_HOSTS);
+  (process.env.DELTA_CLI_MIRROR_ALLOWLIST || '')
+    .split(',')
+    .map((h) => h.trim().toLowerCase())
+    .filter(Boolean)
+    .forEach((h) => allowlist.add(h));
+  for (const allowed of allowlist) {
+    if (host === allowed || host.endsWith('.' + allowed)) {
+      return true;
+    }
+  }
+  for (const prefix of DEFAULT_ALLOWED_HOST_PREFIXES) {
+    if (host.startsWith(prefix)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function getHttpProxy() {
+  return (
+    process.env.HTTPS_PROXY ||
+    process.env.https_proxy ||
+    process.env.HTTP_PROXY ||
+    process.env.http_proxy ||
+    ''
+  );
+}
+
+const DOWNLOAD_TIMEOUT_MS = parseInt(process.env.DELTA_CLI_DOWNLOAD_TIMEOUT, 10) || 120000;
+
+function nodeDownload(url, dest, redirectCount = 0) {
+  return new Promise((resolve, reject) => {
+    if (!isAllowListedUrl(url)) {
+      reject(new Error(`Download URL is not allow-listed: ${url}`));
+      return;
+    }
+    if (redirectCount > MAX_REDIRECTS) {
+      reject(new Error('Too many redirects while downloading'));
+      return;
+    }
+
     const file = fs.createWriteStream(dest);
     const hash = crypto.createHash('sha256');
+    let finished = false;
+    const maxTimer = setTimeout(() => {
+      cleanup(new Error(`Download did not complete within ${DOWNLOAD_TIMEOUT_MS}ms`));
+    }, DOWNLOAD_TIMEOUT_MS);
 
-    const cleanup = () => {
-      try { fs.unlinkSync(dest); } catch {}
+    const cleanup = (err) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(maxTimer);
+      try {
+        file.destroy();
+        fs.unlinkSync(dest);
+      } catch {}
+      reject(err);
     };
 
-    https.get(url, { timeout: 60000 }, (response) => {
-      if (response.statusCode >= 301 && response.statusCode <= 308 && response.headers.location) {
-        file.destroy();
-        cleanup();
-        download(resolveUrl(url, response.headers.location), dest).then(resolve).catch(reject);
-        return;
-      }
-      if (response.statusCode !== 200) {
-        file.destroy();
-        cleanup();
-        reject(new Error(`Download failed: ${response.statusCode}`));
+    https
+      .get(url, { timeout: 60000 }, (response) => {
+        if (response.statusCode >= 301 && response.statusCode <= 308 && response.headers.location) {
+          const nextUrl = resolveUrl(url, response.headers.location);
+          if (!isAllowListedUrl(nextUrl)) {
+            cleanup(new Error(`Redirect URL is not allow-listed: ${nextUrl}`));
+            return;
+          }
+          file.destroy();
+          try {
+            fs.unlinkSync(dest);
+          } catch {}
+          nodeDownload(nextUrl, dest, redirectCount + 1).then(resolve).catch(reject);
+          return;
+        }
+        if (response.statusCode !== 200) {
+          cleanup(new Error(`Download failed: HTTP ${response.statusCode}`));
+          return;
+        }
+        response.pipe(file);
+        response.on('data', (chunk) => hash.update(chunk));
+        file.on('finish', () => {
+          file.close((err) => {
+            if (finished) return;
+            if (err) {
+              cleanup(err);
+              return;
+            }
+            finished = true;
+            clearTimeout(maxTimer);
+            resolve(hash.digest('hex'));
+          });
+        });
+        file.on('error', cleanup);
+      })
+      .on('error', cleanup)
+      .on('timeout', () => {
+        cleanup(new Error('Download timed out'));
+      });
+  });
+}
+
+function curlDownload(url, dest, proxy) {
+  return new Promise((resolve, reject) => {
+    const maxSeconds = Math.ceil(DOWNLOAD_TIMEOUT_MS / 1000);
+    const args = ['-L', '--fail', '--show-error', '--silent', '--max-time', String(maxSeconds), '-o', dest];
+    if (proxy) {
+      args.push('--proxy', proxy);
+    }
+    args.push(url);
+    const child = spawn('curl', args, { stdio: ['ignore', 'inherit', 'inherit'] });
+    child.on('error', (err) => {
+      reject(new Error(`curl not available or failed to start: ${err.message}`));
+    });
+    child.on('close', (code) => {
+      if (code !== 0) {
+        reject(new Error(`curl download failed (exit ${code})`));
         return;
       }
-      response.pipe(file);
-      response.on('data', (chunk) => hash.update(chunk));
-      file.on('finish', () => {
-        file.close(() => resolve(hash.digest('hex')));
-      });
-    }).on('error', (err) => {
-      file.destroy();
-      cleanup();
-      reject(err);
+      fileSha256(dest).then(resolve).catch(reject);
     });
   });
 }
 
+async function download(url, dest) {
+  const proxy = getHttpProxy();
+  const preferCurl =
+    process.env.DELTA_CLI_USE_CURL === '1' || (!!proxy && process.env.DELTA_CLI_USE_CURL !== '0');
+
+  if (preferCurl) {
+    try {
+      return await curlDownload(url, dest, proxy);
+    } catch (err) {
+      if (process.env.DELTA_CLI_USE_CURL === '1') {
+        throw err;
+      }
+      console.warn(`[delta-cli] curl download failed (${err.message}), falling back to Node https.`);
+    }
+  }
+
+  return nodeDownload(url, dest);
+}
+
+function verifyAsset(assetName, filePath, checksums) {
+  if (!checksums) {
+    console.warn('[delta-cli] checksums.txt not found; skipping checksum verification.');
+    return;
+  }
+  const expected = checksums.get(assetName);
+  if (!expected) {
+    throw new Error(`No checksum found for ${assetName} in checksums.txt`);
+  }
+  const actual = crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+  if (actual !== expected) {
+    throw new Error(`Checksum mismatch for ${assetName}: expected ${expected}, got ${actual}`);
+  }
+  console.log(`[delta-cli] Checksum OK for ${assetName}.`);
+}
+
 function extract(archivePath, destDir, platform) {
+  fs.mkdirSync(destDir, { recursive: true });
   if (platform === 'windows') {
-    execSync(`unzip -o "${archivePath}" -d "${destDir}"`, { stdio: 'inherit' });
+    const escapedArchive = archivePath.replace(/'/g, "''");
+    const escapedDest = destDir.replace(/'/g, "''");
+    execSync(
+      `powershell.exe -NoProfile -Command "Expand-Archive -Path '${escapedArchive}' -DestinationPath '${escapedDest}' -Force"`,
+      { stdio: 'inherit' }
+    );
   } else {
     execSync(`tar -xzf "${archivePath}" -C "${destDir}"`, { stdio: 'inherit' });
   }
 }
 
-async function main() {
+async function install(options = {}) {
+  const fatal = options.fatal === true;
+  const allowSkip = options.allowSkip !== false;
+
+  if (allowSkip && (process.env.CI === 'true' || process.env.CI === '1' || process.env.DELTA_CLI_SKIP_POSTINSTALL)) {
+    console.log('[delta-cli] postinstall skipped (CI or DELTA_CLI_SKIP_POSTINSTALL).');
+    return;
+  }
+
   const platform = platformMap[process.platform];
   const arch = archMap[process.arch];
   if (!platform || !arch) {
-    console.error(`Unsupported platform: ${process.platform} ${process.arch}`);
-    process.exit(1);
+    throw new Error(`Unsupported platform: ${process.platform} ${process.arch}`);
   }
 
   const isWin = platform === 'windows';
@@ -98,25 +300,69 @@ async function main() {
 
   fs.mkdirSync(binDir, { recursive: true });
 
-  const url = releaseAssetUrl(VERSION, assetName);
-  console.log(`Downloading ${assetName} from ${process.env.DELTA_CLI_MIRROR ? 'mirror' : 'GitHub'}...`);
-
-  try {
-    const checksum = await download(url, archivePath);
-    console.log(`Downloaded archive, SHA256: ${checksum}`);
-    console.log(`Extracting to ${binDir}...`);
-    extract(archivePath, binDir, platform);
-    const extractedBinary = path.join(binDir, `${BINARY_NAME}-${platform}-${arch}${binaryExt}`);
-    if (fs.existsSync(extractedBinary) && extractedBinary !== binaryPath) {
-      fs.renameSync(extractedBinary, binaryPath);
+  const localArchive = process.env.DELTA_CLI_ARCHIVE;
+  if (localArchive) {
+    if (!fs.existsSync(localArchive)) {
+      throw new Error(`DELTA_CLI_ARCHIVE file not found: ${localArchive}`);
+    }
+    fs.copyFileSync(localArchive, archivePath);
+  } else {
+    const urls = releaseAssetUrls(VERSION, assetName);
+    let lastErr;
+    let checksum;
+    for (const url of urls) {
+      console.log(`[delta-cli] Downloading ${assetName} from ${new URL(url).hostname}...`);
+      try {
+        checksum = await download(url, archivePath);
+        break;
+      } catch (err) {
+        console.warn(`[delta-cli] Download failed from ${url}: ${err.message}`);
+        lastErr = err;
+      }
     }
+    if (checksum === undefined) {
+      throw lastErr || new Error('All download sources failed');
+    }
+  }
+
+  const checksums = loadChecksums();
+  verifyAsset(assetName, archivePath, checksums);
+
+  console.log(`[delta-cli] Extracting to ${binDir}...`);
+  extract(archivePath, binDir, platform);
+  fs.unlinkSync(archivePath);
+
+  const extractedBinary = path.join(binDir, `${BINARY_NAME}-${platform}-${arch}${binaryExt}`);
+  if (fs.existsSync(extractedBinary) && extractedBinary !== binaryPath) {
+    fs.renameSync(extractedBinary, binaryPath);
+  }
+
+  if (!fs.existsSync(binaryPath)) {
+    throw new Error(`Binary not found after extraction: ${binaryPath}`);
+  }
+
+  if (platform !== 'windows') {
     fs.chmodSync(binaryPath, 0o755);
-    fs.unlinkSync(archivePath);
-    console.log(`Installed to ${binaryPath}`);
-  } catch (err) {
-    console.error('Install failed:', err.message);
+  }
+
+  console.log(`[delta-cli] Installed at ${binaryPath}.`);
+}
+
+function handleError(err) {
+  const fatal = process.env.DELTA_CLI_FATAL_ON_ERROR === '1';
+  const message = err && err.message ? err.message : String(err);
+  if (fatal) {
+    console.error('[delta-cli] install failed:', message);
     process.exit(1);
   }
+  console.error('[delta-cli] postinstall warning:', message);
+  console.error('The wrapper is installed, but the native binary may be missing.');
+  console.error('Run "delta-cli" once to retry, or set DELTA_CLI_ARCHIVE to a local archive path.');
+  process.exit(0);
+}
+
+if (require.main === module) {
+  install({ allowSkip: true }).catch(handleError);
 }
 
-main();
+module.exports = { install };

package/scripts/run.js

@@ -1,21 +1,60 @@
 #!/usr/bin/env node
+const fs = require('fs');
 const path = require('path');
 const { spawn } = require('child_process');
+const { install } = require('./install');
 
-const platform = process.platform === 'win32' ? 'windows' : process.platform;
-const ext = platform === 'windows' ? '.exe' : '';
-const binary = path.join(__dirname, '..', 'bin', `delta-cli${ext}`);
+const binary = path.join(
+  __dirname,
+  '..',
+  'bin',
+  process.platform === 'win32' ? 'delta-cli.exe' : 'delta-cli'
+);
 
-const child = spawn(binary, process.argv.slice(2), {
-  stdio: 'inherit',
-  windowsHide: true,
-});
+async function ensureBinary() {
+  if (fs.existsSync(binary)) {
+    return;
+  }
+  console.error('[delta-cli] Binary not found, attempting to install...');
+  await install({ allowSkip: false, fatal: true });
+  if (!fs.existsSync(binary)) {
+    throw new Error('Binary is still missing after install attempt.');
+  }
+}
 
-child.on('error', (err) => {
-  console.error('Failed to start delta-cli:', err.message);
-  process.exit(1);
-});
+async function main() {
+  try {
+    await ensureBinary();
+  } catch (err) {
+    console.error('[delta-cli] Could not install binary:', err.message);
+    console.error('Set DELTA_CLI_ARCHIVE to a local archive path, or reinstall the package.');
+    process.exit(1);
+  }
 
-child.on('exit', (code) => {
-  process.exit(code ?? 0);
-});
+  const child = spawn(binary, process.argv.slice(2), {
+    stdio: 'inherit',
+    windowsHide: true,
+  });
+
+  child.on('error', (err) => {
+    console.error('[delta-cli] Failed to start:', err.message);
+    process.exit(1);
+  });
+
+  child.on('close', (code, signal) => {
+    if (code !== null && code !== undefined) {
+      process.exit(code);
+    }
+    if (signal) {
+      try {
+        process.kill(process.pid, signal);
+      } catch {
+        process.exit(1);
+      }
+    } else {
+      process.exit(1);
+    }
+  });
+}
+
+main();

package/skills/delta-sandbox/SKILL.md

@@ -54,6 +54,7 @@ metadata:
 
 1. **查看可用镜像**：`delta-cli sandbox images` — 查询服务端支持的镜像列表（含标签、最低资源要求、支持 provider），根据用户需求匹配镜像
 2. **创建**：`delta-cli sandbox create --image <img> --cpu 4 --memory 16Gi --gpu 1 --gpu-mem 8000`（创建后 sandbox 立即可用，无需额外连接）。**同一次任务若已有 `sandbox_id`，禁止再次 create，必须优先复用。**
+   - 这是 `sandbox create` 支持的完整资源参数集合，不存在其它“更正确”的资源 flag，不要 invented 不存在的参数。
 3. **写入代码**：`delta-cli sandbox write <id> --path /workspace/train.py --data "..."`
 4. **运行**：`delta-cli sandbox run <id> --command "python /workspace/train.py" --timeout 3600`
 5. **读取结果**：`delta-cli sandbox read <id> --path /workspace/result.json`

package/skills/delta-sandbox/references/lifecycle.md

@@ -6,7 +6,7 @@
 
 1. **查看可用镜像** `delta-cli sandbox images` — 查询服务端支持的镜像列表，根据用户的 GPU/CPU 需求和标签匹配镜像
 2. **列出现有 sandbox（可选）** `delta-cli sandbox list` — 查看当前用户已创建的活跃 sandbox，避免重复创建
-3. **创建** `delta-cli sandbox create --image <image> --cpu 4 --memory 16Gi --gpu 1 --gpu-mem 8000`（创建后立即可用，无需连接）
+3. **创建** `delta-cli sandbox create --image <image> --cpu 4 --memory 16Gi --gpu 1 --gpu-mem 8000`（创建后立即可用，无需连接；这些是 `create` 全部资源参数，不要 invented 其它 flag）
 4. **写入代码/数据** `delta-cli sandbox write <id> --path /workspace/train.py --data "..."`
 5. **运行命令** `delta-cli sandbox run <id> --command "python /workspace/train.py"`
 6. **读取结果** `delta-cli sandbox read <id> --path /workspace/result.json`

package/skills/delta-shared/SKILL.md

@@ -8,25 +8,39 @@ description: "delta-cli 全局共享规则。使用于首次配置、认证登
 
 本技能指导你如何通过 delta-cli 操作 Delta Sandbox 及相关资源，以及所有命令域通用的注意事项。
 
-## 获取服务端地址（必须优先执行）
+## 获取服务端地址
 
-所有操作的前提是知道 delta-sandbox-server 的地址。按以下步骤获取：
+所有操作的前提是知道 delta-sandbox-server 的地址。按以下优先级获取：
 
-1. 执行 `echo $DELTA_INFRA_BASE_URL` 检查环境变量是否已设置
-2. 如果输出非空，说明已配置，直接使用，无需额外操作
-3. 如果为空，**向用户询问真实地址**，然后运行 `delta-cli config set base_url <url>` 保存
+1. 环境变量 `DELTA_INFRA_BASE_URL`（优先级最高）
+2. `~/.delta-infra/config.json` 中的 `base_url`
+3. 以上都为空时，**向用户询问真实地址**，再运行 `delta-cli config set base_url <url>` 保存
 
-**不要猜测或虚构地址。不确认地址就执行任何操作会导致 network 错误。**
+**不要猜测或虚构地址。** 已有配置文件时直接使用，只有配置文件不存在或操作报 `network` 错误时才需要重新确认。
 
 ## 配置初始化
 
-首次使用需运行 `delta-cli config init` 完成配置：
+如果 `~/.delta-infra/config.json` 已存在且包含有效的 `base_url` 与认证信息，则**无需执行** `config init`。
+
+仅在以下情况才运行初始化：
+
+- 配置文件不存在
+- 配置文件为空或解析失败
+- 用户明确要求重新初始化
+
+首次使用或有上述情况时运行：
 
 ```bash
 delta-cli config init
 ```
 
-这会创建 `~/.delta-infra/config.json`，需按实际部署设置 base_url（`delta-cli config set base_url <url>`），也可通过环境变量 `DELTA_INFRA_BASE_URL` 覆盖。
+在交互式终端上，它会提示输入服务端地址（直接回车使用默认值）以及可选的 API Key / Bearer Token；AI 工具或非交互场景应使用 flag/环境变量，避免在 stdin 不可用时卡住：
+
+```bash
+delta-cli config init --base-url <url> --api-key <key> --token <token>
+```
+
+配置还可以通过环境变量 `DELTA_INFRA_BASE_URL`、`DELTA_SANDBOX_API_KEY`、`DELTA_SANDBOX_TOKEN` 提供。
 
 ## 配置管理
 
@@ -51,7 +65,24 @@ delta-cli config remove token
 
 ## 认证
 
-delta-cli **不再内嵌默认凭证**，使用前必须配置认证。
+delta-cli **不再内嵌默认凭证**，使用前必须存在有效认证。
+
+### 优先检查，避免重复登录
+
+执行任何需要认证的操作前，先查状态：
+
+```bash
+# 1. 确认服务端地址
+delta-cli config show
+
+# 2. 确认认证是否已生效
+delta-cli auth status
+```
+
+- 如果 `auth status` 显示 `method: token` 或 `method: api_key`，说明配置文件已存在有效凭证，**直接执行目标操作**，不要重复 `auth login`。
+- 只有当 `auth status` 显示 `method: none`、token 已过期，或操作返回 `error.type: auth` / `permission` 时，才需要重新登录。
+
+### 认证方式
 
 支持两种认证方式，优先级从高到低：
 
@@ -62,21 +93,15 @@ delta-cli **不再内嵌默认凭证**，使用前必须配置认证。
 
 ### 默认认证说明
 
-- binary 中没有默认 token，第一次使用**必须**执行 `delta-cli auth login` 或设置环境变量。
+- binary 中没有默认 token。
+- 第一次使用或认证失效时，执行 `delta-cli auth login` 或设置对应环境变量。
 - 如需更换账号，重新执行 `delta-cli auth login --token <token>` 或 `delta-cli auth login --api-key <key>`。
-- 未配置时 `auth status` 会显示 `method: none`。
-
-### 查看认证状态
-
-```bash
-delta-cli auth status
-```
 
 ### 权限不足处理
 
 遇到认证/权限错误时（`error.type: auth` 或 `permission`）：
 
-1. 先执行 `delta-cli auth status` 确认当前认证状态
+1. 执行 `delta-cli auth status` 确认当前认证状态
 2. 如需更换认证，执行 `delta-cli auth login --token <token>` 或 `delta-cli auth login --api-key <key>`
 3. 如已认证但仍报错，检查 base_url 是否正确