@delta-infra/cli 1.1.16 → 1.1.18

package/skills/delta-science/references/xrd.md

@@ -1,186 +1,197 @@
-# XRD Cloud Compute 详细规则
-
-`xrd` 是通过 Science 工具代理访问 XRD cloud compute 的真实工具。所有调用必须经由
-`delta-cli`，禁止使用 broker URL、`curl`、`requests`、`httpx`、浏览器或本地 XRD
-科学库绕过 CLI。本文是 `delta-science` 的工具 reference，不是第二套 HTTP 客户端。
-
-## 工具与 endpoint
-
-执行前使用实时目录确认当前环境中的 canonical 名称和启用状态：
-
-```text
-delta-cli science list
-delta-cli science endpoints list xrd
-```
-
-`xrd` endpoint 名称必须逐字取自第二条命令的结果。当前 reference 覆盖以下稳定契约：
-
-| endpoint | 方法/用途 | 请求类型 |
-| --- | --- | --- |
-| `healthz`、`readyz`、`capabilities`、`xmatcher-status` | 就绪、能力和数据库状态 | 只读 JSON |
-| `xmatcher-artifacts` | 上传观测曲线、模型输入、CIF 或仪器参数 | `invoke --file` |
-| `xmatcher-artifact`、`xmatcher-artifact-content` | 查询/读取 artifact | `invoke --path-params` |
-| `xqueryer-predictions` | XQueryer 单相候选预测 | JSON |
-| `xmatcher-detect-peaks`、`xmatcher-match` | 峰检测和单相匹配 | JSON |
-| `xmatcher-multiphase-match`、`xdecomposer-predictions` | 多相匹配和相分解 | JSON |
-| `xmatcher-cif-xrd`、`xmatcher-pdf-peaks-xlsx` | CIF 模拟及 PDF 峰表导出 | JSON/二进制 |
-| `xmatcher-refinement-patterns` | 生成精修输入和 provenance manifest | JSON |
-| `refinement-fullprof`、`refinement-gsasii`、`refinement-wpem` | 提交对应后端精修作业 | JSON + header |
-| `refinement-job`、`refinement-job-events`、`refinement-job-artifacts` | 查询精修作业 | `invoke --path-params` |
-| `refinement-job-cancel` | 请求取消精修作业 | `invoke --path-params` |
-| `mp500-cif-exports` | MP500 结构导出为 CIF | JSON |
-
-目录是最终权威。若 endpoint 不在实时目录中，停止并报告配置问题，不改名重试。
-
-## CLI 参数映射
-
-```text
---data          上游 JSON body
---params        上游 URL query 参数
---path-params   替换 endpoint path 中的 {artifact_id}/{job_id}
---headers       额外上游请求头，例如 Idempotency-Key
---file          将本地文件通过 file_base64 传给工具代理
---content-type  file 的原始 MIME 类型
-```
-
-`--params` 不能替代 `--path-params`。不要把本地路径、base64、路径参数或幂等键塞进
-普通业务 `--data`。`science file` 是 QE/Materials Design 等独立文件接口；XRD 的
-`xmatcher-artifacts` 属于工具代理 endpoint，应使用 `science invoke --file`。
-
-## 调用顺序
-
-1. 用户明确要求诊断或执行时，先读取 `healthz`；需要选择后端时再读取
-   `capabilities`。
-2. 通过 `xmatcher-artifacts` 上传真实文件，保存返回的 `artifact_id` 和 `sha256`。
-3. 观测数据使用 `xmatcher-match`、`xmatcher-multiphase-match` 或
-   `xdecomposer-predictions`；XQueryer 使用 `model_input_pattern`。
-4. CIF 模拟使用 `xmatcher-cif-xrd`；精修先调用 `xmatcher-refinement-patterns`，再选择
-   与 `data.backends` 一致的 refinement endpoint。
-5. 精修提交后用 `refinement-job`、`refinement-job-events` 和
-   `refinement-job-artifacts` 读取状态和产物。
-
-不要把服务返回的 queued、scheduler completed 或 backend success 直接描述成科学结论。
-精修至少分开报告传输/作业终态、后端执行状态和科学接受状态。
-
-## 就绪检查
-
-```text
-delta-cli science invoke --tool xrd --endpoint healthz
-delta-cli science invoke --tool xrd --endpoint capabilities
-```
-
-只有需要诊断或用户明确要求时才额外调用 readiness/status。能力结果中的每个所需组件
-都必须满足 `available`；生产任务还应检查 `asset_release_approved`、checksum 字段和
-warnings。`auto` 不代表实际使用 GPU，只有结果明确返回 GPU backend 才能这样报告。
-
-## Artifact 上传与身份
-
-上传观测曲线：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xmatcher-artifacts `
-  --file observed.csv `
-  --params '{"filename":"observed.csv","kind":"observed_pattern","media_type":"text/csv"}' `
-  --content-type application/octet-stream
-```
-
-允许的 `kind` 为：`observed_pattern`、`model_input_pattern`、`cif`、
-`instrument_parameters`。成功响应中的 `artifact_id` 和 `sha256` 必须成对保存并原样
-传给下游。模式文件会在服务端标准化，返回的 digest 是标准化 artifact 的 digest，
-不是一定等于本地上传字节的 digest。
-
-查询 artifact 时使用路径参数：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xmatcher-artifact `
-  --path-params '{"artifact_id":"art_<returned-id>"}'
-```
-
-二进制内容响应可能返回 `data._binary=true`、`content_base64`、`media_type` 和
-`content_length`。只有用户要求保存或工作流需要时才解码，并按服务返回的 SHA-256
-校验；不要凭文件名猜测格式。
-
-## 相识别与匹配
-
-XQueryer 的 `model_input_pattern` 必须正好包含 3500 个样本，覆盖 10 到 90 度 2theta，
-强度不超过服务能力限制：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xqueryer-predictions `
-  --data '{"schema_version":1,"pattern":{"artifact_id":"art_<model>","sha256":"<sha>"},"top_k":10,"radiation_profile":"CuKa"}'
-```
-
-XMatcher 观测曲线：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xmatcher-match `
-  --data '{"schema_version":1,"pattern":{"artifact_id":"art_<observed>","sha256":"<sha>"},"top_n":10,"element_filter_mode":"contains"}'
-```
-
-多相匹配：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xmatcher-multiphase-match `
-  --data '{"schema_version":1,"pattern":{"artifact_id":"art_<observed>","sha256":"<sha>"},"max_phases":3,"candidate_pool":8}'
-```
-
-`xqueryer-predictions` 的 `score` 是 softmax probability；XMatcher 的 `score` 是
-`raw_score / 100`。两者不可直接平均或当作同一校准概率。
-
-## CIF 模拟与峰表
-
-`cifs` 中的每个 artifact 都必须同时提供 `artifact_id` 和 `sha256`：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xmatcher-cif-xrd `
-  --data '{"schema_version":1,"cifs":[{"artifact":{"artifact_id":"art_<cif>","sha256":"<sha>"},"name":"phase"}],"two_theta_range":[5.0,90.0],"wavelength":"CuKa"}'
-```
-
-`xmatcher-pdf-peaks-xlsx` 返回二进制 XLSX；只有用户要求导出时才读取和保存它。
-
-## 精修作业
-
-先生成校正曲线和 provenance manifest：
-
-```text
-delta-cli science invoke --tool xrd --endpoint xmatcher-refinement-patterns `
-  --data '{"schema_version":1,"source_pattern":{"artifact_id":"art_<observed>","sha256":"<sha>"}}'
-```
-
-然后使用与 `data.backends` 匹配的 endpoint。示例结构如下，所有 artifact 身份必须来自
-当前调用链：
-
-```text
-delta-cli science invoke --tool xrd --endpoint refinement-gsasii `
-  --data '{"schema_version":1,"radiation_profile":"CuKa","refinement_pattern":{"observed_pattern":{"artifact_id":"art_<obs>","sha256":"<sha>"},"corrected_pattern":{"artifact_id":"art_<corrected>","sha256":"<sha>"},"provenance_manifest":{"artifact_id":"art_<manifest>","sha256":"<sha>"}},"phases":[{"phase_index":0,"name":"phase","cif":{"artifact_id":"art_<cif>","sha256":"<sha>"}}],"wavelengths_angstrom":[1.540593,1.544414],"backends":["gsasii"]}' `
-  --headers '{"Idempotency-Key":"<stable-unique-key>"}'
-```
-
-`refinement-fullprof`、`refinement-gsasii`、`refinement-wpem` 选择计费/后端入口；不要
-因为它们映射到同一路径就互换 endpoint 名或 `backends`。提交、取消、重试和审核是
-远端变更，必须得到用户明确授权；超时或连接中断时不要盲目重试，先查询是否已经创建
-作业。
-
-查询作业时：
-
-```text
-delta-cli science invoke --tool xrd --endpoint refinement-job `
-  --path-params '{"job_id":"refjob_<returned-id>"}'
-
-delta-cli science invoke --tool xrd --endpoint refinement-job-events `
-  --path-params '{"job_id":"refjob_<returned-id>"}'
-```
-
-## 结果与错误
-
-- 只有 CLI 退出码为 0 且顶层 JSON `ok` 为 `true` 才算调用成功。
-- 原样保留服务返回的 `data`、warnings、错误 detail 和稳定错误码。
-- `202`、`queued` 或 `running` 只代表作业接收/执行状态，不代表 solver 收敛或科学接受。
-- `TIER_CONCURRENCY_EXCEEDED`、`Endpoint is disabled`、`ARTIFACT_MISSING`、
-  `MP500_IDENTITY_MISMATCH` 等错误应停止当前调用链并报告原始 detail；不要换 endpoint、
-  改名、猜参数或用本地算法替代。
-- 付费 endpoint 的价格和可用状态以实时目录为准；执行前确认用户确实要求该业务调用。
-
-证据边界：仅限当前 Delta CLI `data` 中的业务结果。
-调用链：`delta-cli`。
-禁止补充未返回内容：是。
+# XRD Cloud Compute reference
+
+`xrd` is a real tool for accessing XRD cloud compute through the Science tool proxy. Route every
+call through `delta-cli`; do not bypass the CLI with broker URLs, `curl`, `requests`, `httpx`, a
+browser or local XRD libraries. This is a tool reference for `delta-science`, not a second HTTP
+client.
+
+## Tool and endpoints
+
+Before execution, use the live catalogue to confirm the canonical names and enabled status in the
+current environment:
+
+```text
+delta-cli science list
+delta-cli science endpoints list xrd
+```
+
+Copy `xrd` endpoint names exactly from the output of the second command. This reference covers
+the following stable contracts:
+
+| endpoint | Method/purpose | Request type |
+| --- | --- | --- |
+| `healthz`, `readyz`, `capabilities`, `xmatcher-status` | Readiness, capabilities and database status | Read-only JSON |
+| `xmatcher-artifacts` | Upload an observed pattern, model input, CIF or instrument parameters | `invoke --file` |
+| `xmatcher-artifact`, `xmatcher-artifact-content` | Query/read an artifact | `invoke --path-params` |
+| `xqueryer-predictions` | XQueryer single-phase candidate prediction | JSON |
+| `xmatcher-detect-peaks`, `xmatcher-match` | Peak detection and single-phase matching | JSON |
+| `xmatcher-multiphase-match`, `xdecomposer-predictions` | Multiphase matching and phase decomposition | JSON |
+| `xmatcher-cif-xrd`, `xmatcher-pdf-peaks-xlsx` | CIF simulation and PDF peak-table export | JSON/binary |
+| `xmatcher-refinement-patterns` | Generate refinement inputs and a provenance manifest | JSON |
+| `refinement-fullprof`, `refinement-gsasii`, `refinement-wpem` | Submit a refinement job to the corresponding backend | JSON + header |
+| `refinement-job`, `refinement-job-events`, `refinement-job-artifacts` | Query a refinement job | `invoke --path-params` |
+| `refinement-job-cancel` | Request refinement-job cancellation | `invoke --path-params` |
+| `mp500-cif-exports` | Export an MP500 structure as CIF | JSON |
+
+The live catalogue is authoritative. If an endpoint is absent from it, stop and report a
+configuration issue; do not retry under a different name.
+
+## CLI argument mapping
+
+```text
+--data          Upstream JSON body
+--params        Upstream URL query parameters
+--path-params   Replace {artifact_id}/{job_id} in the endpoint path
+--headers       Additional upstream headers, such as Idempotency-Key
+--file          Send a local file to the tool proxy via file_base64
+--content-type  The file's original MIME type
+```
+
+`--params` cannot replace `--path-params`. Do not put local paths, base64, path parameters or
+idempotency keys in ordinary business `--data`. `science file` is a separate file interface for
+tools such as QE and Materials Design. XRD's `xmatcher-artifacts` is a tool-proxy endpoint; use
+`science invoke --file` for it.
+
+## Call sequence
+
+1. When the user explicitly asks for a diagnosis or execution, read `healthz` first; read
+   `capabilities` only when you need to select a backend.
+2. Upload real files through `xmatcher-artifacts` and save the returned `artifact_id` and `sha256`.
+3. Use `xmatcher-match`, `xmatcher-multiphase-match` or `xdecomposer-predictions` for observed
+   data; XQueryer uses `model_input_pattern`.
+4. Use `xmatcher-cif-xrd` for CIF simulation. For refinement, call
+   `xmatcher-refinement-patterns` first, then choose a refinement endpoint matching
+   `data.backends`.
+5. After submitting a refinement job, read its status and artifacts with `refinement-job`,
+   `refinement-job-events` and `refinement-job-artifacts`.
+
+Do not present a returned `queued` state, scheduler completion or backend success as a scientific
+conclusion. For refinement, report the transport/job final state, backend execution state and
+scientific acceptance state separately.
+
+## Readiness checks
+
+```text
+delta-cli science invoke --tool xrd --endpoint healthz
+delta-cli science invoke --tool xrd --endpoint capabilities
+```
+
+Call readiness/status additionally only when diagnosis requires it or the user explicitly asks.
+Every required component in the capabilities result must have `available` status. For production
+jobs, also check `asset_release_approved`, checksum fields and warnings. `auto` does not prove GPU
+use; report GPU use only when the result explicitly returns a GPU backend.
+
+## Artifact upload and identity
+
+Upload an observed pattern:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xmatcher-artifacts `
+  --file observed.csv `
+  --params '{"filename":"observed.csv","kind":"observed_pattern","media_type":"text/csv"}' `
+  --content-type application/octet-stream
+```
+
+Allowed `kind` values are `observed_pattern`, `model_input_pattern`, `cif` and
+`instrument_parameters`. Save the successful response's `artifact_id` and `sha256` together and
+pass them to downstream calls unchanged. Pattern files are normalised by the server, so the
+returned digest identifies the normalised artifact and may differ from the digest of the local
+upload bytes.
+
+Use path parameters to query an artifact:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xmatcher-artifact `
+  --path-params '{"artifact_id":"art_<returned-id>"}'
+```
+
+Binary-content responses may return `data._binary=true`, `content_base64`, `media_type` and
+`content_length`. Decode only when the user asks to save the content or the workflow requires it,
+and verify it against the SHA-256 returned by the service. Do not infer the format from the filename.
+
+## Phase identification and matching
+
+XQueryer's `model_input_pattern` must contain exactly 3,500 samples over 10 to 90 degrees 2theta,
+with intensities within the service's capability limits:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xqueryer-predictions `
+  --data '{"schema_version":1,"pattern":{"artifact_id":"art_<model>","sha256":"<sha>"},"top_k":10,"radiation_profile":"CuKa"}'
+```
+
+XMatcher observed pattern:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xmatcher-match `
+  --data '{"schema_version":1,"pattern":{"artifact_id":"art_<observed>","sha256":"<sha>"},"top_n":10,"element_filter_mode":"contains"}'
+```
+
+Multiphase matching:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xmatcher-multiphase-match `
+  --data '{"schema_version":1,"pattern":{"artifact_id":"art_<observed>","sha256":"<sha>"},"max_phases":3,"candidate_pool":8}'
+```
+
+The `score` from `xqueryer-predictions` is a softmax probability; the XMatcher `score` is
+`raw_score / 100`. Do not average them directly or treat them as the same calibrated probability.
+
+## CIF simulation and peak tables
+
+Each artifact in `cifs` must provide both `artifact_id` and `sha256`:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xmatcher-cif-xrd `
+  --data '{"schema_version":1,"cifs":[{"artifact":{"artifact_id":"art_<cif>","sha256":"<sha>"},"name":"phase"}],"two_theta_range":[5.0,90.0],"wavelength":"CuKa"}'
+```
+
+`xmatcher-pdf-peaks-xlsx` returns a binary XLSX file; read and save it only when the user asks for an export.
+
+## Refinement jobs
+
+First generate the corrected pattern and provenance manifest:
+
+```text
+delta-cli science invoke --tool xrd --endpoint xmatcher-refinement-patterns `
+  --data '{"schema_version":1,"source_pattern":{"artifact_id":"art_<observed>","sha256":"<sha>"}}'
+```
+
+Then use the endpoint matching `data.backends`. The example below shows the structure; every
+artifact identity must come from the current call chain:
+
+```text
+delta-cli science invoke --tool xrd --endpoint refinement-gsasii `
+  --data '{"schema_version":1,"radiation_profile":"CuKa","refinement_pattern":{"observed_pattern":{"artifact_id":"art_<obs>","sha256":"<sha>"},"corrected_pattern":{"artifact_id":"art_<corrected>","sha256":"<sha>"},"provenance_manifest":{"artifact_id":"art_<manifest>","sha256":"<sha>"}},"phases":[{"phase_index":0,"name":"phase","cif":{"artifact_id":"art_<cif>","sha256":"<sha>"}}],"wavelengths_angstrom":[1.540593,1.544414],"backends":["gsasii"]}' `
+  --headers '{"Idempotency-Key":"<stable-unique-key>"}'
+```
+
+`refinement-fullprof`, `refinement-gsasii` and `refinement-wpem` select the billing/backend
+entry point. Do not interchange endpoint names or `backends` merely because they map to the same
+path. Submission, cancellation, retry and review are remote mutations and require the user's
+explicit authorisation. After a timeout or disconnection, do not retry blindly; first check
+whether a job has already been created.
+
+To query a job:
+
+```text
+delta-cli science invoke --tool xrd --endpoint refinement-job `
+  --path-params '{"job_id":"refjob_<returned-id>"}'
+
+delta-cli science invoke --tool xrd --endpoint refinement-job-events `
+  --path-params '{"job_id":"refjob_<returned-id>"}'
+```
+
+## Results and errors
+
+- A call succeeds only when the CLI exits with code 0 and the top-level JSON `ok` is `true`.
+- Preserve the returned `data`, warnings, error detail and stable error codes exactly as returned.
+- `202`, `queued` and `running` describe job acceptance/execution state only; they do not mean the solver converged or the result was scientifically accepted.
+- `TIER_CONCURRENCY_EXCEEDED`, `Endpoint is disabled`, `ARTIFACT_MISSING`,
+  `MP500_IDENTITY_MISMATCH` and similar errors should stop the current call chain; report the
+  original detail and do not switch endpoints, rename them, guess parameters or substitute a
+  local algorithm.
+- Use the live catalogue as the authority for paid endpoint prices and availability; before execution, confirm that the user actually requested the business call.
+
+Evidence boundary: business results in the current Delta CLI `data` only.
+Call chain: `delta-cli`.
+Do not add information absent from the response: yes.

package/skills/delta-shared/SKILL.md

@@ -1,111 +1,113 @@
 ---
 name: delta-shared
-description: "delta-cli 全局共享规则：配置/认证检查、安全红线、错误处理、sandbox 销毁。"
+description: "delta-cli shared global rules: configuration and authentication checks, security boundaries, error handling, and sandbox destruction."
 ---
 
-# delta-cli 共享规则
+# delta-cli Shared Rules
 
-指导 AI 使用 `delta-cli` 的通用规则。核心原则：**只检查、不猜测、不泄露密钥**。
+General guidance for AI agents using `delta-cli`. Core principles: **check, do not guess or expose credentials**.
 
-## 执行任何操作之前
+## Before any operation
 
-1. 确认服务端地址：
+1. Verify the server address:
    ```bash
    delta-cli config show
    ```
-2. 确认认证状态：
+2. Inspect the local authentication configuration:
    ```bash
    delta-cli auth status
    ```
 
-- 若 `auth status` 显示 `method: token`，**直接执行目标命令**，不要重复登录或初始化配置。
-- 若显示 `method: none`，或操作返回 `error.type: auth` / `permission`，才进入下面的“补全配置”流程。
+- If `auth status` reports `method: token` or `method: apikey`, a credential is configured locally; **run the requested command directly without logging in or initialising configuration again**.
+- `auth status` reads local configuration and environment overrides; it does not validate the credential with the remote server. If it reports `method: none`, follow “Complete configuration” below. If a requested command returns `error.type: auth` or `permission`, follow the matching recovery action below.
 
-## 补全配置
+## Complete configuration
 
-缺少服务端地址或凭证时，**向用户询问一次**，然后用 flag 初始化：
+If the server address or credentials are missing, **ask the user once**, then initialise with the flag that matches the credential type:
 
 ```bash
 delta-cli config init --base-url <server-url> --token <token>
+# For an API key:
+delta-cli config init --base-url <server-url> --apikey <api-key>
 ```
 
-不要用交互式 `config init`（无 flag），避免在 stdin 不可用时卡住。
+Do not use interactive `config init` (without flags), as it may hang when stdin is unavailable.
 
-### 信息来源优先级
+### Priority of information sources
 
-1. 环境变量：`DELTA_INFRA_BASE_URL`、`DELTA_INFRA_TOKEN`
-2. `~/.delta-infra/config.json` 中的 `base_url` / `token`
-3. 默认值：仅 `base_url` 有内部默认值
-4. 以上都缺失时，**必须询问用户**，禁止虚构
+1. Environment variables: `DELTA_INFRA_BASE_URL`, `DELTA_INFRA_TOKEN`, `DELTA_INFRA_API_KEY`
+2. `base_url`, `token`, and `apikey` in `~/.delta-infra/config.json` (environment values override file values)
+3. Default value: only `base_url` has an internal default
+4. If none of the above are available, **you must ask the user**; do not make anything up
 
-### 运行时凭证
+### Runtime credentials
 
-CLI 使用 `token` 发送请求头 `Authorization: Bearer <token>`，并自动从 JWT 中提取 `uid` 作为 `X-User-Uid`。
+The CLI sends the effective credential in the `Authorization: Bearer <credential>` header; an API key takes precedence over a token when both are configured. It adds `X-User-Uid` when it can parse a `uid` from the credential as an unverified JWT.
 
-## 查询用户信息与剩余额度
+## Querying user information and remaining credits
 
 ```bash
 delta-cli usage
 ```
 
-返回当前用户信息与剩余额度（走网关 `/infra/api/users/me`，鉴权由 CLI 自动携带配置的凭证）。只保留三个字段：
+This returns the current user's information and remaining credits (through the gateway `/infra/api/users/me`; the CLI automatically attaches the configured credentials). Keep only these three fields in the output:
 
-- `data.display_name`：显示名（缺失时回退 `user_id`）
-- `data.user_id`：用户 ID
-- `data.resources.credit`：剩余额度（credits）
+- `data.display_name`: display name (fall back to `user_id` if missing)
+- `data.user_id`: user ID
+- `data.resources.credit`: remaining balance in credits
 
-`username`/`id`/`email`/`role`/`quota`/`group`/`tier`/`status`/`created_at`/`is_admin`、`stats` 及其中的 `total_consumed_credits`（数据库原始 quota 单位）均为内部字段，不对外输出。
+`username`/`id`/`email`/`role`/`quota`/`group`/`tier`/`status`/`created_at`/`is_admin`, `stats` and its `total_consumed_credits` (in the database's original quota units) are internal fields and must not be exposed externally.
 
-## 安全红线
+## Security rules
 
-- **禁止输出密钥**：`token` 不得出现在日志、消息、终端。
-- **禁止自己拼 URL / 构造 HTTP 请求**：所有请求都走 `delta-cli`。
-- **不要主动安装 CLI**：如果用户说没装，建议他去 README 或 install.sh，不要自己选安装方式。
-- **写入/删除操作前确认意图**：`sandbox kill`、`sandbox finish`、`sandbox write` 等必须告诉用户影响。
-- `~/.delta-infra/config.json` 权限为 `0600`，不要手动放宽。
-- **sandbox 必须销毁**：调用 `sandbox create` 后，当前任务结束前必须调用 `sandbox kill`。server 端无自动清理，不销毁 = 永久占用 GPU；即使出错也不得跳过。
+- **Never output credentials**: token and API key values must not appear in logs, messages or the terminal.
+- **Never construct URLs or make HTTP requests yourself**: route all requests through `delta-cli`.
+- **Do not install the CLI proactively**: if the user says it is not installed, direct them to the README or `install.sh`; do not choose an installation method yourself.
+- **Confirm intent before write or delete operations**: tell the user what commands such as `sandbox kill`, `sandbox finish` and `sandbox write` will affect.
+- `~/.delta-infra/config.json` must have `0600` permissions; do not loosen them manually.
+- **The sandbox must be destroyed**: after calling `sandbox create`, call `sandbox kill` before the current task ends. The server does not clean up automatically; failure to destroy a sandbox leaves GPU resources occupied indefinitely. Do not skip this, even if an error occurs.
 
-## JSON 输出约定
+## JSON output conventions
 
 ```json
 {"ok":true,"data":{...}}
 {"ok":false,"error":{"type":"auth","message":"...","hint":"..."}}
 ```
 
-AI Agent 解析规则：
-- 始终检查 `ok`，不要只看 exit code。
-- `error.type` 是稳定分支字段：`auth`, `permission`, `not_found`, `validation`, `network`, `api`, `command_failed`, `internal`。
-- `error.hint` 可展示给用户。
+AI agent parsing rules:
+- Always check `ok`; do not rely on the exit code alone.
+- `error.type` is the stable field for branching on: `auth`, `permission`, `not_found`, `validation`, `network`, `api`, `command_failed`, `internal`.
+- `error.hint` may be shown to the user.
 
-## 退出码约定
+## Exit code conventions
 
-| Type | Exit Code | 场景 |
-|------|-----------|------|
-| validation | 2 | flag / 参数错误 |
-| auth | 3 | 未认证或认证失败 |
-| permission | 4 | 权限不足 |
-| not_found | 5 | sandbox/file 不存在 |
-| network | 6 | DNS、超时、连接失败 |
-| api | 7 | 服务端非 2xx |
-| command_failed | 8 | sandbox 内命令执行失败（非零 exit_code 或报错）；SSE 路径在 complete 帧后追加该 error 信封，**message 附 stderr 尾部**便于快速扫读 |
-| internal | 10 | 客户端内部错误 |
+| Type | Exit Code | Scenario |
+|------|-----------|----------|
+| validation | 2 | Invalid flag or argument |
+| auth | 3 | Not authenticated or authentication failed |
+| permission | 4 | Insufficient permissions |
+| not_found | 5 | Sandbox or file does not exist |
+| network | 6 | DNS, timeout or connection failure |
+| api | 7 | Server returned a non-2xx response |
+| command_failed | 8 | Command failed inside the sandbox (non-zero `exit_code` or an error); on the SSE path, an error envelope is appended after the `complete` frame, with the stderr tail in `message` for quick reference |
+| internal | 10 | Internal client error |
 
-## 升级检查
+## Upgrade check
 
-完成用户请求后，如果 JSON 中有 `_notice.update`，可建议：
+After completing the user's request, if the JSON contains `_notice.update`, you may recommend:
 
 ```bash
 delta-cli upgrade
 ```
 
-## 常见恢复
+## Common recovery actions
 
-| 错误 / 现象 | 恢复动作 |
+| Error / symptom | Recovery action |
 |-------------|----------|
-| `error.type: auth` / `method: none` | 询问用户后执行 `config init --base-url <url> --token <token>` |
-| `error.type: permission` | 确认当前认证是否有权限；必要时换 token |
-| `error.type: not_found` | 检查 `sandbox_id` / path |
-| `error.type: network` | 检查 `base_url` 和网络连通性 |
-| `error.type: validation` | 检查必填 flag 和参数格式 |
-| `error.type: command_failed` | sandbox 内命令失败：信封 `message` 已带 stderr 尾部，可快速定位；完整 `stderr`/`result_summary` 在 complete 帧里，重试或修正命令 |
-| 配置文件解析失败 | 检查 `~/.delta-infra/config.json` 是否为有效 JSON |
+| `error.type: auth` / `method: none` | Check the server address and local credential configuration. If no credential is configured or the server rejects it, ask the user once for a credential; use `--apikey` for an API key or `--token` for a bearer token, or set the matching `DELTA_INFRA_API_KEY` / `DELTA_INFRA_TOKEN` environment variable. |
+| `error.type: permission` | Check whether the current credential has sufficient permissions; if needed, ask for a credential with the required permissions. |
+| `error.type: not_found` | Check `sandbox_id` / path |
+| `error.type: network` | Check `base_url` and network connectivity |
+| `error.type: validation` | Check required flags and argument formats |
+| `error.type: command_failed` | Command failed inside the sandbox: the envelope's `message` already includes the stderr tail to help locate the issue quickly; the full `stderr` / `result_summary` are in the `complete` frame. Retry or correct the command |
+| Configuration file parsing failed | Check that `~/.delta-infra/config.json` contains valid JSON |

package/skills/delta-shared/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
-  display_name: "Delta CLI 共享规则"
-  short_description: "处理 Delta CLI 的配置、认证、错误与安全边界"
-  default_prompt: "使用 $delta-shared 检查并处理 Delta CLI 的配置或认证问题。"
+  display_name: "Delta CLI Shared Rules"
+  short_description: "Handle Delta CLI configuration, authentication, errors and security boundaries"
+  default_prompt: "Use $delta-shared to check and resolve Delta CLI configuration or authentication issues."