@fnnas-labs/fnos-cli 0.0.0-stage → 0.2.0

package/skill/build-provenance.json

@@ -0,0 +1,44 @@
+{
+  "schema": 1,
+  "version": "0.2.0",
+  "commit": "847034326e2a48518a69a3f0e46bd47adcdb9f7b",
+  "sourceSha256": "eafe5fd9f54061032ba8f3d3eebdf023ad0bb6b8ca5e6652ef0327e0db4d4b70",
+  "binaries": {
+    "darwin-arm64": {
+      "target": "aarch64-apple-darwin",
+      "file": "bin/trim-cli-darwin-arm64",
+      "version": "0.2.0",
+      "sha256": "0fa8a006bf49e8a548cc83ad0962953613c1c212745b7117a44f7e0f4756ad50"
+    },
+    "darwin-x64": {
+      "target": "x86_64-apple-darwin",
+      "file": "bin/trim-cli-darwin-x64",
+      "version": "0.2.0",
+      "sha256": "f0909085e64644f60737b862ba0272df3e96664e004815d4350d906c1c05f807"
+    },
+    "linux-arm64": {
+      "target": "aarch64-unknown-linux-gnu",
+      "file": "bin/trim-cli-linux-arm64",
+      "version": "0.2.0",
+      "sha256": "c83bf57f871df5930944d098841372a2f52af031fbc54d825f8920d0741dfb1c"
+    },
+    "linux-x64": {
+      "target": "x86_64-unknown-linux-gnu",
+      "file": "bin/trim-cli-linux-x64",
+      "version": "0.2.0",
+      "sha256": "941f0d53434a2d02410f2759b81866b0b13e6a6750d919cd56aed8950abf5261"
+    },
+    "windows-arm64": {
+      "target": "aarch64-pc-windows-gnullvm",
+      "file": "bin/trim-cli-windows-arm64.exe",
+      "version": "0.2.0",
+      "sha256": "77b2445261afbbc3549572e4093107cae51b395e2bb3742cab1a0623a9b8c811"
+    },
+    "windows-x64": {
+      "target": "x86_64-pc-windows-gnullvm",
+      "file": "bin/trim-cli-windows-x64.exe",
+      "version": "0.2.0",
+      "sha256": "c3254dbd4a64853064cffbf3a03f75579f830fa8dac5ba0e645ef47ecbb9b4f5"
+    }
+  }
+}

package/skill/entries/trim-app.md

@@ -0,0 +1,63 @@
+---
+name: trim-app
+description: Manage installed applications, App Center installation, FPK packages, updates, application entries and lifecycle operations.
+---
+
+# App Center
+
+Manage fnOS apps: list, inspect, install, install FPKs, update, start,
+stop and uninstall. See `../reference/app-center.md` for endpoints and fields;
+use `trim-shared.md` for connection or session failures.
+
+## Rules
+
+- Writes, including installation, updates and lifecycle changes, require explicit `--yes`.
+- Only flows without UI decisions run automatically. License approval requires
+  `--accept-license`; dependency changes and running dependent apps require App
+  Center UI. Supply explicit `--custom-parameters` for custom wizard input.
+- `app install` / `app update` create and poll a download task, then start and
+  wait for the installation/update task. `--dry-run` only downloads/parses the
+  package, reads info and runs safety guards; it does not start installation.
+- Preflight local FPKs with `app install-fpk <file> --volume-id <id> --dry-run --yes`.
+  This uploads/parses the FPK and checks guards without installing it.
+- NAS FPKs use `--remote-path /vol.../demo.fpk`: a concrete NAS FPK path, at most 10GB.
+- Upload error `20001` means unavailable storage; check that `--volume-id` exists,
+  is mounted and healthy.
+- Supply `--source-id` for a new app when known; updates resolve `sourceID` from
+  the installed list.
+- Prefer explicit `--volume-id`. Otherwise the CLI uses App Center's default
+  download/install volume, and refuses when no usable default exists.
+- `--custom-parameters '<jsonArray>'` maps to `customParameters`;
+  `--api-scope '<jsonObject>'` maps to `systemParameters.apiScope`. Missing required
+  custom wizard input stops the command and directs the user to App Center UI.
+- `--cancel-on-failure` attempts the matching cancel endpoint on task failure and
+  includes its result in the error.
+- `app openapi ...` manages application user authorization paths; additions need
+  `--yes` and concrete `/vol...` paths.
+- `app entry list`, `app desktop list` and `app sac app-store-list` use
+  `appcgi.sac.entry.v1.*` WebSocket CGI, not legacy entry REST.
+- Desktop entry writes without named commands use `raw` with explicit `--yes`.
+- `app config set-sys` rejects invalid default volumes, update windows, cloud
+  policies and boolean settings before sending. `autoCreateDesktopIcon` is sent
+  only with `--allow-desktop-icon-field` after backend compatibility is confirmed.
+- Apps start after installation by default; use `--no-start` to leave them stopped.
+
+## Commands
+
+```bash
+fnos-cli --host <host> --port <port> app list
+fnos-cli --host <host> --port <port> app status <appName>
+fnos-cli app entry list
+fnos-cli app desktop list
+fnos-cli app sac app-store-list
+fnos-cli app install <appName> --version <version> --source-id <sourceID> --volume-id <volumeId> --dry-run --yes
+fnos-cli app install <appName> --version <version> --volume-id <volumeId> --custom-parameters '[{"key":"port","value":8080}]' --api-scope '{"API.User.FileAccess":true}' --yes
+fnos-cli app install <appName> --version <version> --volume-id <volumeId> --accept-license --cancel-on-failure --yes
+fnos-cli app install-fpk <localFile.fpk> --volume-id <volumeId> --dry-run --yes
+fnos-cli app install-fpk --remote-path /vol1/1000/demo.fpk --volume-id <volumeId> --dry-run --yes
+fnos-cli app update <appName> --version <version> --volume-id <volumeId> --dry-run --yes
+fnos-cli app openapi add-user-auth-path <appName> /vol1/1000/docs --yes
+fnos-cli app start <appName> --yes
+fnos-cli app stop <appName> --yes
+fnos-cli app uninstall <appName> --yes
+```

package/skill/entries/trim-baidu-netdisk.md

@@ -0,0 +1,42 @@
+---
+name: trim-baidu-netdisk
+description: Check Baidu Netdisk authorization, quota, cloud files, saved shares, NAS transfers and scheduled synchronization.
+---
+
+# Baidu Netdisk
+
+Use for cloud file browsing/search/metadata, file changes, saving shares to NAS,
+upload/download tasks, and scheduled sync. Read `../reference/baidu-netdisk.md`
+for full commands, fields and errors; `trim-shared.md` covers fnOS profiles.
+
+## Rules
+
+- Run `baidu-netdisk status` first. If unauthorized, the user completes authorization
+  in the NAS Baidu Netdisk app. The CLI does not perform Baidu OAuth.
+- Cloud paths start with `/`; NAS paths are concrete `/vol{n}/...` paths. Keep them distinct.
+- File, transfer and sync changes require explicit `--yes`.
+- Successful `upload` means task submission only; `data: null` is normal. Check
+  `task list --state running`, then `--state completed` for the final result.
+- `status=6`, `failCode=42610` means insufficient cloud space. Free or expand space before retrying.
+- `info --dlink` returns a sensitive temporary URL; CLI output redacts `dlink`.
+- The final `move` / `copy` argument is the destination directory; earlier arguments are sources.
+- Prefer `share-save --all`. To select known share IDs, repeat `--fsid` instead;
+  `--all` and `--fsid` are mutually exclusive.
+- Share extraction codes are detected automatically or supplied with `--password`.
+  Keep share shortcodes, extraction codes, `spwd` and intermediate task IDs out of replies and logs.
+
+## Commands
+
+```bash
+fnos-cli baidu-netdisk status
+fnos-cli baidu-netdisk quota
+fnos-cli baidu-netdisk ls / --limit 80
+fnos-cli baidu-netdisk search <keyword> --dir / --recursive
+fnos-cli baidu-netdisk info <fsid...>
+fnos-cli baidu-netdisk mkdir /backup --yes
+fnos-cli baidu-netdisk upload /backup /vol1/1000/data --yes
+fnos-cli baidu-netdisk download /vol1/1000/downloads <fsid...> --yes
+fnos-cli baidu-netdisk share-save '<shareUrlWithPassword>' /vol1/1000/downloads --all --yes
+fnos-cli baidu-netdisk task list --transfer download
+fnos-cli baidu-netdisk sync list
+```

package/skill/entries/trim-docker.md

@@ -0,0 +1,35 @@
+---
+name: trim-docker
+description: Inspect and manage Docker images, containers, Compose projects and long-running lifecycle operations.
+---
+
+# Docker
+
+Read `../reference/dockermgr.md` for the API contract. Observe with `docker stats`,
+`image ls` and `container ls` before making changes.
+
+## Rules
+
+- `container ls` lists running containers only. Use `--all` or `container inspect <id>`
+  to check stopped/created containers or whether a container still exists.
+- `container top` requires a running container; inspect `State.Running=true` first.
+- Pulling images and stopping/restarting containers can take longer than read requests.
+- `image pull` and `container create/update/start/stop/restart/kill` require `--yes`.
+  Agent/noninteractive deletion also passes `--yes`; `--force` does not replace it.
+- `container update` may return a new ID; older firmware requires follow-up resource
+  and network checks. Use the ID returned by the command for later operations.
+- Image references and container IDs are different identifiers.
+- Unwrapped `appcgi.dockermgr.*` endpoints use `docker request` with explicit
+  `--yes`. Probe read-only state before system/network/Compose writes.
+
+## Commands
+
+```bash
+fnos-cli docker stats
+fnos-cli docker image ls
+fnos-cli docker image pull <imageRef> --yes
+fnos-cli docker container ls
+fnos-cli docker container ls --all
+fnos-cli docker compose ls
+fnos-cli docker request appcgi.dockermgr.networkList --json '{}' --yes
+```

package/skill/entries/trim-download.md

@@ -0,0 +1,38 @@
+---
+name: trim-download
+description: List, search, create and control download tasks; inspect task files, statistics and state transitions.
+---
+
+# Downloads
+
+Read `../reference/download.md` for command signatures and endpoint fields.
+Use for URI, magnet and torrent tasks, save directories, priorities and task retries.
+
+## Rules
+
+- Creating tasks uses `download add-uri <uri> <saveDir>` or
+  `download add-path <path> <saveDir>`; save directories are concrete `/vol{n}/...` paths.
+- `download stat` reports aggregate statistics, not one file's metadata.
+- `download pause|resume|retry|rm <id...>` affects existing tasks and does not infer paths.
+- Task creation and control require explicit `--yes`.
+- Paths in `download info` / `download files` directly reflect fnOS volume
+  definitions; use the returned paths rather than deriving replacements.
+- Unwrapped `appcgi.downloadcenter.*` endpoints use `download request`; omit
+  `req` and `reqid` from JSON.
+
+## Commands
+
+```bash
+fnos-cli download ls
+fnos-cli download ls installer
+fnos-cli download info <id>
+fnos-cli download files <id>
+fnos-cli download add-uri https://example.com/file.iso /vol1/download --yes
+fnos-cli download add-path /vol1/source.torrent /vol1/download --yes
+fnos-cli download pause <id...> --yes
+fnos-cli download resume <id...> --yes
+fnos-cli download retry <id...> --yes
+fnos-cli download rm <id...> --yes
+fnos-cli download stat
+fnos-cli download request appcgi.downloadcenter.tracker.query --json '{}' --yes
+```

package/skill/entries/trim-file.md

@@ -0,0 +1,30 @@
+---
+name: trim-file
+description: List and search files, upload local files, inspect shared directories and ACLs, or determine current-user and NAS path semantics.
+---
+
+# Files
+
+Read `../reference/workflows/file-routing.md` to choose the command, then
+`../reference/file.md` for endpoint fields.
+
+## Rules
+
+- Both `file ls` and `file ls /` omit the request's `path`.
+- Writes require a concrete `/vol{n}/...` path by default.
+- `file share.*` manages shared directories, not share links.
+- `file search-others` searches files shared with the current user; it is not a shared-directory listing.
+- `file upload` takes a remote directory; the CLI appends the local filename.
+- `file check-upload` may allocate a temporary placeholder; both upload and preflight require `--yes`.
+- `file fav add/del` changes the current user's favorites and requires `--yes`.
+
+## Commands
+
+```bash
+fnos-cli file ls
+fnos-cli file ls /vol1/downloads
+fnos-cli file search <key>
+fnos-cli file upload /vol1/1000/uploads ./local-file.txt --overwrite rename --yes
+fnos-cli file share list
+fnos-cli file acl get /vol1/1000/docs
+```

package/skill/entries/trim-log.md

@@ -0,0 +1,32 @@
+---
+name: trim-log
+description: Browse and filter logs, enumerate modules, clear or export logs, configure archives, and copy or cancel diagnostic logs.
+---
+
+# Logs
+
+Read `../reference/log.md` for log structures and command parameters.
+
+## Rules
+
+- Choose explicit `level`, `module` and `locale` values for filtering and export.
+- Legacy `log.*` and `appcgi.eventlogger.common.*` (`logger`) coexist; keep their results separate.
+- `logger export` can be large; confirm writable output storage.
+  `logger archive set` changes policy; confirm the intended configuration first.
+- `diagnostic-log export --output-dir` is a mounted device-side path, such as
+  `/vol1/<dir>` or `/vol00/<mount>/<dir>`.
+- Inspect state with paged `logger list` before clearing or changing archives.
+- Clearing, exporting, archive settings and diagnostic task control require explicit `--yes`.
+
+## Commands
+
+```bash
+fnos-cli logger list --page <n> --page-size <n> --level <n> --module <n> --locale <locale>
+fnos-cli logger modules --locale <locale>
+fnos-cli logger clear --level <level> --module <module> --yes
+fnos-cli logger export --level <level> --module <module> --locale <locale> --yes
+fnos-cli logger archive set --switch <0|1> --file-path <path> --size-gt <n> --date-unit <n> --date-before <n> --yes
+fnos-cli logger archive query
+fnos-cli diagnostic-log export --output-dir /vol1/<dir> --srv-type 0,1,2 --yes
+fnos-cli diagnostic-log stop --task-id <taskId> --yes
+```

package/skill/entries/trim-monitor.md

@@ -0,0 +1,41 @@
+---
+name: trim-monitor
+description: Inspect runtime CPU, memory, network, disk, process, service, battery, fan, GPU/NPU and alarm-beeper metrics.
+---
+
+# Monitoring
+
+Read `../reference/resmon.md`. Runtime metrics use `monitor`; static system
+identity, model and configuration use `trim-system.md`.
+
+## Rules
+
+- `monitor cpu` / `monitor memory` return time-series samples. Explain the returned
+  `usage`, `cores` and related fields in context.
+- `monitor gen --item` accepts comma-separated or repeated values, limited to
+  `storeSpeed`, `netSpeed`, `cpuBusy` and `memPercent`.
+- `monitor proc-info --pids` accepts positive integer PIDs, separated by commas.
+- Most commands are read-only; `monitor mute-beeper` and `monitor request`
+  require confirmation or explicit `--yes`.
+- `monitor request` allows only `appcgi.resmon.*`; omit `req` and `reqid` from JSON.
+
+## Commands
+
+```bash
+fnos-cli monitor cpu
+fnos-cli monitor memory
+fnos-cli monitor net
+fnos-cli monitor disk
+fnos-cli monitor gen --item storeSpeed,netSpeed --item cpuBusy
+fnos-cli monitor proc-list
+fnos-cli monitor proc-info --pids 123,456
+fnos-cli monitor proc-srv
+fnos-cli monitor sys-warn
+fnos-cli monitor battery
+fnos-cli monitor sys-fan
+fnos-cli monitor beep-supported
+fnos-cli monitor beep-events
+fnos-cli monitor beep-reasons
+fnos-cli monitor mute-beeper --yes
+fnos-cli monitor request appcgi.resmon.gen --json '{"item":["cpuBusy"]}' --yes
+```

package/skill/entries/trim-network.md

@@ -0,0 +1,22 @@
+---
+name: trim-network
+description: Manage network service switches, including enabling or disabling SSH, and check write confirmation requirements.
+---
+
+# Networking
+
+Read `../reference/network.md` for fields and `trim-shared.md` for connections
+and sessions.
+
+## Rules
+
+- Enabling SSH is security-sensitive and requires explicit user authorization.
+- After confirming authorization, Agent commands pass `--yes` explicitly.
+- Exactly one of `--enable` and `--disable` is required.
+
+## Commands
+
+```bash
+fnos-cli network ssh switch --enable --yes
+fnos-cli network ssh switch --disable --yes
+```

package/skill/entries/trim-photos.md

@@ -0,0 +1,32 @@
+---
+name: trim-photos
+description: Browse photo folders, search photos, inspect details, and obtain thumbnail or original preview links.
+---
+
+# Photos
+
+Photos reuses the current profile's system OAuth session through the native
+Photos HTTP API proxy. Read `../reference/photos.md` for fields and
+`../reference/workflows/photos-routing.md` for statistics, AI search and sampled previews.
+
+## Rules
+
+- Complete OAuth `login` first; Photos needs no separate app login or signature.
+- `--filter` and `--exclude-filter` take repeatable `name=value` arguments.
+- Preview sizes are `xxs`, `xs`, `s`, `m` and `o` (original).
+- Preview URLs are absolute, but the browser usually still needs a signed-in fnOS cookie.
+- Natural-language AI search uses `magic-search`, not an alias of `photos search`.
+  Without a stable `total`, report only the returned result count.
+- Unwrapped endpoints use `photos request`; non-GET requests require confirmation by default.
+- Inspect both `httpStatus` and `response.code`, not only the CLI exit code.
+
+## Commands
+
+```bash
+fnos-cli photos folders
+fnos-cli photos search IMG --limit 20
+fnos-cli photos search Beijing --filter file_type=photo
+fnos-cli photos info <photoId>
+fnos-cli photos preview <photoId> --size m
+fnos-cli photos preview <photoId> --size o --open
+```

package/skill/entries/trim-shared.md

@@ -0,0 +1,54 @@
+---
+name: trim-shared
+description: Sign in, select connection targets or profiles, troubleshoot sessions and connections, validate devices, and apply common safety rules.
+---
+
+# Connections and authentication
+
+Start with `../SKILL.md` and `../reference/_index.md`.
+Device validation follows `../reference/workflows/device-validation.md`.
+
+## Rules
+
+- The default loopback target is `http://localhost:5666`.
+- Global `--profile <name>` selects an independent session profile.
+- With `--scheme auto` and no explicit port, loopback defaults to `http:5666`,
+  remote IPs to `https:5667`, and remote domains to `https:443`.
+- An explicit `--port` takes precedence; the CLI then resolves only the scheme.
+- Omitted connection options reuse the saved host, port, scheme and TLS settings.
+  Profile fallback, login writes and logout cleanup affect only the selected profile.
+- Self-signed HTTPS may need explicit `--tls-insecure`; remote plain HTTP needs
+  explicit `--allow-insecure-http`.
+- Sessions default to platform secure storage. Use `TRIM_CLI_SESSION_STORAGE=file`
+  only for isolated tests or CI. `TRIM_CLI_SESSION_STORAGE=ask-file` explicitly
+  asks the user before a lower-trust file fallback after secure-storage failure.
+- OAuth PKCE is the login flow. The user handles credentials and 2FA in the browser.
+- Production login is a single interactive `login`: the user opens the link,
+  signs in, authorizes, and pastes the one-time code into the CLI. The Agent does
+  not enter credentials, approve access or read browser codes.
+- For DSH, log in on the same Host, system user and configuration environment,
+  with the same `--profile`. Sessions do not automatically transfer to remote
+  browsers, SSH shells or containers. macOS background Keychain access may need approval.
+- Access tokens refresh near expiry; `login --refresh` can request refresh.
+- Refresh checks writable session storage first; failed preflight preserves the
+  old session and sends no refresh. Concurrent processes reuse newer profile
+  sessions rather than overwriting rotated tokens.
+- Connection failures should identify the attempted `host:port`.
+- Profile names are nonempty and contain only ASCII letters, digits, `_`, `-`, `.`.
+- Input guards reject control characters, empty values and excessive lengths instead of silently rewriting them.
+- `raw` omits `--yes` only for built-in audited read-only endpoints. Other and
+  unknown endpoints require it; endpoint names alone do not establish read-only behavior.
+
+## Commands
+
+The user runs login in their own interactive terminal:
+
+```bash
+fnos-cli --profile home --host <host> --port <port> login
+fnos-cli --profile home --host <host> --port <port> login --no-open
+fnos-cli --host <host> --scheme https --tls-insecure login
+fnos-cli --profile home system info
+fnos-cli --profile home raw appcgi.system.getInfo --json '{"language":"zh-CN"}'
+fnos-cli --profile home raw appcgi.network.ssh.switch --json '{"enable":true}' --yes
+fnos-cli --profile home logout
+```

package/skill/entries/trim-storage.md

@@ -0,0 +1,34 @@
+---
+name: trim-storage
+description: Inspect storage pools, disks and SMART data, or perform mounting, expansion, disk replacement, formatting and other high-risk storage writes.
+---
+
+# Storage
+
+Read `../reference/workflows/storage-dangerous-ops.md` before writes, and
+`../reference/stor.md` for the API contract.
+
+## Rules
+
+- Pools use UUIDs or `trim_*` identifiers; disks use plain device names such as
+  `sda` or `nvme0n1`.
+- Before high-risk writes, run `storage pools` and `storage disks`.
+- Before creating a pool, run `storage free-disks`. For free space on the system
+  disk, use the returned `part`, not the whole-disk name.
+- Stop when a required password is unavailable; do not assume a default.
+- Prefer named commands. `storage request` rejects endpoints already covered by named commands.
+
+## Commands
+
+```bash
+fnos-cli storage overview
+fnos-cli storage pools
+fnos-cli storage disks
+fnos-cli storage free-disks
+fnos-cli storage disk-info <disk>
+fnos-cli storage disk-mount <disk> --yes
+fnos-cli storage disk-umount <disk> --yes
+fnos-cli storage smart <disk>
+fnos-cli storage health <disk>
+fnos-cli storage request stor.getConf --json '{"uuid":"trim_pool"}' --yes
+```

package/skill/entries/trim-system.md

@@ -0,0 +1,59 @@
+---
+name: trim-system
+description: Inspect static system identity, model, versions, volumes, hardware and power schedules, or reboot and power off a device.
+---
+
+# System and power
+
+Read `../reference/sysinfo.md` and `../reference/power.md`. Query the matching
+`system` commands individually for hardware, volumes and power plans.
+
+## Rules
+
+- Static identity/configuration belongs here; CPU and memory runtime metrics use `trim-monitor.md`.
+- Named `system` commands are read-only; generic `system request` requires
+  confirmation or explicit `--yes` by default.
+- `power reboot` / `power poweroff` interrupt services. Confirm the target and
+  user authorization before passing `--yes`.
+- `system request` allows only `appcgi.sysinfo.*`; omit `req` and `reqid` from JSON.
+- Generic requests authenticate with the saved session; sign in to the target first.
+- Machine type and version fields vary with CLI/firmware. Treat current
+  `system info` output as authoritative; report unexpected or empty fields as
+  possible version differences rather than inventing values.
+
+## Commands
+
+```bash
+fnos-cli system info
+fnos-cli system trim-version
+fnos-cli system kernel-version
+fnos-cli system host-name
+fnos-cli system machine-id
+fnos-cli system uptime
+fnos-cli system all-vols
+fnos-cli system vols
+fnos-cli system docker
+fnos-cli system unix-time
+fnos-cli system boot-on-power
+fnos-cli system hardware
+fnos-cli system reserved-partition
+fnos-cli system is-trim-machine
+fnos-cli system trim-feature
+fnos-cli system fan-mode
+fnos-cli system trim-disk
+fnos-cli system time-setting --lang en-US
+fnos-cli system timezone-list --lang en-US
+fnos-cli system power-plan
+fnos-cli system next-power-off-time
+fnos-cli system power-plan-status
+fnos-cli system power-on-seconds
+fnos-cli system inited-timestamp
+fnos-cli system request appcgi.sysinfo.getTrimVersion --yes
+```
+
+## Power operations
+
+```bash
+fnos-cli power reboot --yes
+fnos-cli power poweroff --yes
+```

package/skill/entries/trim-user.md

@@ -0,0 +1,28 @@
+---
+name: trim-user
+description: Inspect users, groups, signed-in devices and current permissions, manage users, or choose the correct authenticated profile.
+---
+
+# Users and permissions
+
+Read `../reference/user.md` and `../reference/workflows/device-validation.md`.
+
+## Rules
+
+- Most device operations require a signed-in session.
+- Device validation uses only the current profile's OAuth session. Select a
+  different profile explicitly when switching identities.
+- OAuth PKCE login leaves credentials and 2FA to the user; never construct
+  password, 2FA or manual access-token login commands.
+- Production login is interactive: the user signs in and authorizes in the
+  browser, then pastes the one-time code into the CLI prompt.
+- Unwrapped `user.*` endpoints use `user request`. User and signed-in-device
+  writes require confirmation by default; Agent writes explicitly pass `--yes`.
+
+## Commands
+
+```bash
+fnos-cli --host <host> --port <port> login
+fnos-cli logout
+fnos-cli user request user.checkNewUser --json '{"user":"<new-user>"}' --yes
+```

package/skill/manifest.json

@@ -0,0 +1,43 @@
+{
+  "name": "fnos-cli",
+  "version": "0.2.0",
+  "description": "Use fnos-cli to sign in to and manage fnOS devices, including files, photos, applications, Docker, downloads, logs, monitoring, networking, storage, users, and Baidu Netdisk. Use when the user mentions fnOS, Feiniu OS, or a mainland China device. Excludes Media APIs and international-edition devices.",
+  "entry": "SKILL.md",
+  "bin": {
+    "darwin-arm64": "bin/trim-cli-darwin-arm64",
+    "darwin-x64": "bin/trim-cli-darwin-x64",
+    "linux-arm64": "bin/trim-cli-linux-arm64",
+    "linux-x64": "bin/trim-cli-linux-x64",
+    "windows-arm64": "bin/trim-cli-windows-arm64.exe",
+    "windows-x64": "bin/trim-cli-windows-x64.exe"
+  },
+  "reference": "reference/",
+  "entriesDir": "entries/",
+  "entries": [
+    "entries/trim-app.md",
+    "entries/trim-baidu-netdisk.md",
+    "entries/trim-docker.md",
+    "entries/trim-download.md",
+    "entries/trim-file.md",
+    "entries/trim-log.md",
+    "entries/trim-monitor.md",
+    "entries/trim-network.md",
+    "entries/trim-photos.md",
+    "entries/trim-shared.md",
+    "entries/trim-storage.md",
+    "entries/trim-system.md",
+    "entries/trim-user.md"
+  ],
+  "capabilities": [
+    "authentication",
+    "file-management",
+    "storage-management",
+    "docker-management",
+    "download-tasks",
+    "system-monitoring",
+    "network-management",
+    "user-management",
+    "photo-library",
+    "baidu-netdisk"
+  ]
+}