@hcmai/cli 0.3.1 → 0.3.3

package/dist/index.js

@@ -112,7 +112,7 @@ __export(attachment_args_exports, {
   extractInlineFilePaths: () => extractInlineFilePaths,
   isBareFilePath: () => isBareFilePath
 });
-import * as fs from "fs";
+import * as fs2 from "fs";
 import * as os from "os";
 import * as path from "path";
 function extractAtFileTokens(text) {
@@ -154,7 +154,7 @@ function expandHome(p) {
 }
 function isExistingFile(p) {
   try {
-    return fs.statSync(p).isFile();
+    return fs2.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -1303,7 +1303,7 @@ var init_types = __esm({
 
 // src/repl/App.tsx
 import { useCallback, useEffect as useEffect2, useMemo, useRef as useRef2, useState as useState2 } from "react";
-import * as fs2 from "fs/promises";
+import * as fs3 from "fs/promises";
 import { Box as Box3, Static, Text as Text3, useApp, useInput as useInput2 } from "ink";
 import TextInput from "ink-text-input";
 import SelectInput from "ink-select-input";
@@ -1350,7 +1350,7 @@ function ReplApp(props) {
   const histIdxRef = useRef2(-1);
   const draftRef = useRef2("");
   useEffect2(() => {
-    void fs2.readFile(replHistoryFile(props.env), "utf-8").then((c) => {
+    void fs3.readFile(replHistoryFile(props.env), "utf-8").then((c) => {
       historyRef.current = c.split("\n").filter(Boolean);
     }).catch(() => {
     });
@@ -1537,7 +1537,7 @@ function ReplApp(props) {
     }
     historyRef.current.push(line);
     histIdxRef.current = -1;
-    void fs2.appendFile(replHistoryFile(props.env), line.replace(/\n/g, " ") + "\n").catch(() => {
+    void fs3.appendFile(replHistoryFile(props.env), line.replace(/\n/g, " ") + "\n").catch(() => {
     });
     void (async () => {
       const at = extractAtFileTokens(line);
@@ -2034,6 +2034,11 @@ async function readStdin() {
   for await (const chunk of process.stdin) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf-8").trim();
 }
+async function readSecretFromStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf-8").replace(/\r?\n$/, "");
+}
 async function promptConfirm(question) {
   const ans = await promptText(question);
   return /^y(es)?$/i.test(ans.trim());
@@ -2281,9 +2286,9 @@ async function loginCommand(args) {
   } catch (e) {
     const err = e;
     if (err.isAxiosError) {
-      const { fromAxiosError: fromAxiosError17 } = await import("@hcmai/sdk");
+      const { fromAxiosError: fromAxiosError18 } = await import("@hcmai/sdk");
       exitWithError(
-        fromAxiosError17(
+        fromAxiosError18(
           e,
           envName
         )
@@ -2398,6 +2403,7 @@ async function envList() {
           active: name === g.activeEnv ? "*" : " ",
           name,
           endpoint: cfg.endpoint,
+          frontend: cfg.frontend ?? "(none)",
           tenant: cfg.tenantId ?? "1",
           identity: cfg.defaultIdentity ?? "(none)"
         };
@@ -2417,7 +2423,8 @@ async function envCurrent() {
       return;
     }
     const idName = cfg.defaultIdentity ?? "(none)";
-    exitOk(`\u2192 ${g.activeEnv}  ${cfg.endpoint}  tenant=${cfg.tenantId ?? "1"}  identity=${idName}`);
+    const frontend = cfg.frontend ? `  frontend=${cfg.frontend}` : "";
+    exitOk(`\u2192 ${g.activeEnv}  ${cfg.endpoint}${frontend}  tenant=${cfg.tenantId ?? "1"}  identity=${idName}`);
   } catch (e) {
     exitWithError(e);
   }
@@ -2437,7 +2444,11 @@ async function envAdd(name, args) {
         message: `env '${name}' already exists. Use --force to overwrite.`
       });
     }
-    await saveEnv2(name, { endpoint: args.endpoint, tenantId: args.tenant ?? "1" });
+    await saveEnv2(name, {
+      endpoint: args.endpoint,
+      frontend: args.frontend,
+      tenantId: args.tenant ?? "1"
+    });
     const allEnvs = await listEnvs();
     const g = await loadGlobalConfig2();
     const activeExists = allEnvs.includes(g.activeEnv);
@@ -2539,7 +2550,7 @@ async function envShow(args) {
 }
 async function envEdit(field, value, args) {
   try {
-    const ALLOWED = /* @__PURE__ */ new Set(["endpoint", "tenantId", "defaultIdentity", "defaultAgent"]);
+    const ALLOWED = /* @__PURE__ */ new Set(["endpoint", "frontend", "tenantId", "defaultIdentity", "defaultAgent"]);
     if (!ALLOWED.has(field)) {
       throw new CliError3({
         code: CliErrorCode2.INVALID_ARGUMENT,
@@ -2674,21 +2685,75 @@ import {
   HcmClient as HcmClient2,
   formatObject,
   fromAxiosError as fromAxiosError2,
-  CliError as CliError7,
-  CliErrorCode as CliErrorCode6
+  CliError as CliError8,
+  CliErrorCode as CliErrorCode7
 } from "@hcmai/sdk";
+
+// src/utils/json-input.ts
+import * as fs from "fs/promises";
+import { CliError as CliError7, CliErrorCode as CliErrorCode6 } from "@hcmai/sdk";
+async function readJsonObjectInput(options) {
+  const { inline, file, inlineFlag, fileFlag, required = true } = options;
+  if (inline && file) {
+    throw new CliError7({
+      code: CliErrorCode6.INVALID_ARGUMENT,
+      message: `${inlineFlag} \u4E0E ${fileFlag} \u4E0D\u80FD\u540C\u65F6\u4F7F\u7528`
+    });
+  }
+  if (!inline && !file) {
+    if (!required) return void 0;
+    throw new CliError7({
+      code: CliErrorCode6.MISSING_FLAG,
+      message: `${inlineFlag} <JSON> \u6216 ${fileFlag} <path> \u5FC5\u586B`
+    });
+  }
+  let raw;
+  let sourceFlag;
+  if (file) {
+    sourceFlag = fileFlag;
+    try {
+      raw = await fs.readFile(file, "utf-8");
+    } catch (error) {
+      throw new CliError7({
+        code: CliErrorCode6.INVALID_ARGUMENT,
+        message: `${fileFlag}: \u65E0\u6CD5\u8BFB\u53D6 ${file}: ${error.message}`
+      });
+    }
+  } else {
+    sourceFlag = inlineFlag;
+    raw = inline;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new CliError7({
+      code: CliErrorCode6.INVALID_JSON,
+      message: `${sourceFlag}: ${error.message}`
+    });
+  }
+  if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new CliError7({
+      code: CliErrorCode6.INVALID_JSON,
+      message: `${sourceFlag}: \u9876\u5C42\u5FC5\u987B\u662F JSON \u5BF9\u8C61`
+    });
+  }
+  return parsed;
+}
+
+// src/commands/action.ts
 async function actionCommand(spec, args) {
   try {
     const [model, action] = spec.split(".");
     if (!model || !action) {
-      throw new CliError7({
-        code: CliErrorCode6.INVALID_ARGUMENT,
+      throw new CliError8({
+        code: CliErrorCode7.INVALID_ARGUMENT,
         message: "expected <Model>.<Action> (e.g. Employee.regularize)"
       });
     }
     if (args.id && args.ids) {
-      throw new CliError7({
-        code: CliErrorCode6.INVALID_ARGUMENT,
+      throw new CliError8({
+        code: CliErrorCode7.INVALID_ARGUMENT,
         message: "--id and --ids are mutually exclusive"
       });
     }
@@ -2698,16 +2763,14 @@ async function actionCommand(spec, args) {
     if (scope) input.scope = scope;
     if (args.id) input.id = args.id;
     if (args.ids) input.ids = args.ids.split(",").map((s) => s.trim());
-    if (args.params) {
-      try {
-        input.params = JSON.parse(args.params);
-      } catch (e) {
-        throw new CliError7({
-          code: CliErrorCode6.INVALID_JSON,
-          message: `--params: ${e.message}`
-        });
-      }
-    }
+    const params = await readJsonObjectInput({
+      inline: args.params,
+      file: args.paramsFile,
+      inlineFlag: "--params",
+      fileFlag: "--params-file",
+      required: false
+    });
+    if (params) input.params = params;
     const client3 = HcmClient2.fromAuthContext(await getActiveAuthContextFromCli(args));
     const result2 = await client3.action(model, action, input);
     const fmt = args.output ?? "json";
@@ -2732,16 +2795,16 @@ async function actionCommand(spec, args) {
 function normalizeMethod(value) {
   const raw = (value ?? "POST").toUpperCase();
   if (raw === "GET" || raw === "POST" || raw === "PUT" || raw === "DELETE") return raw;
-  throw new CliError7({
-    code: CliErrorCode6.INVALID_ARGUMENT,
+  throw new CliError8({
+    code: CliErrorCode7.INVALID_ARGUMENT,
     message: `--method \u53D6\u503C GET | POST | PUT | DELETE\uFF0C\u6536\u5230 "${value}"`
   });
 }
 function normalizeScope(value) {
   if (value === void 0) return void 0;
   if (value === "class" || value === "object") return value;
-  throw new CliError7({
-    code: CliErrorCode6.INVALID_ARGUMENT,
+  throw new CliError8({
+    code: CliErrorCode7.INVALID_ARGUMENT,
     message: `--scope \u53D6\u503C class | object\uFF0C\u6536\u5230 "${value}"`
   });
 }
@@ -2749,28 +2812,19 @@ function normalizeScope(value) {
 // src/commands/create.ts
 init_exit();
 init_auth_guard();
-import {
-  HcmClient as HcmClient3,
-  formatObject as formatObject2,
-  fromAxiosError as fromAxiosError3,
-  CliError as CliError8,
-  CliErrorCode as CliErrorCode7
-} from "@hcmai/sdk";
+import { HcmClient as HcmClient3, formatObject as formatObject2, fromAxiosError as fromAxiosError3 } from "@hcmai/sdk";
 async function createCommand(model, args) {
   try {
-    if (!args.data) {
-      throw new CliError8({ code: CliErrorCode7.MISSING_FLAG, message: "--data <JSON> \u5FC5\u586B" });
-    }
-    let data;
-    try {
-      data = JSON.parse(args.data);
-    } catch (e) {
-      throw new CliError8({ code: CliErrorCode7.INVALID_JSON, message: `--data: ${e.message}` });
-    }
+    const data = await readJsonObjectInput({
+      inline: args.data,
+      file: args.dataFile,
+      inlineFlag: "--data",
+      fileFlag: "--data-file"
+    });
     const client3 = HcmClient3.fromAuthContext(await getActiveAuthContextFromCli(args));
     const res = await client3.create(model, data);
     const fmt = args.output ?? "json";
-    process.stdout.write("\u2705 created\n");
+    if (fmt !== "json") process.stdout.write("\u2705 created\n");
     process.stdout.write(formatObject2(res, { format: fmt }) + "\n");
     process.exit(0);
   } catch (e) {
@@ -2795,18 +2849,12 @@ async function updateCommand(model, args) {
     if (!args.id) {
       throw new CliError9({ code: CliErrorCode8.MISSING_FLAG, message: "--id <id> \u5FC5\u586B" });
     }
-    if (!args.data) {
-      throw new CliError9({ code: CliErrorCode8.MISSING_FLAG, message: "--data <JSON> \u5FC5\u586B" });
-    }
-    let data;
-    try {
-      data = JSON.parse(args.data);
-    } catch (e) {
-      throw new CliError9({
-        code: CliErrorCode8.INVALID_JSON,
-        message: `--data: ${e.message}`
-      });
-    }
+    const data = await readJsonObjectInput({
+      inline: args.data,
+      file: args.dataFile,
+      inlineFlag: "--data",
+      fileFlag: "--data-file"
+    });
     const client3 = HcmClient4.fromAuthContext(await getActiveAuthContextFromCli(args));
     const result2 = await client3.update(model, args.id, data);
     const fmt = args.output ?? "json";
@@ -2989,7 +3037,7 @@ async function deleteCommand(model, args) {
     const client3 = HcmClient6.fromAuthContext(await getActiveAuthContextFromCli(args));
     const res = await client3.remove(model, args.id);
     const fmt = args.output ?? "json";
-    process.stdout.write("\u2705 deleted\n");
+    if (fmt !== "json") process.stdout.write("\u2705 deleted\n");
     process.stdout.write(formatObject6(res, { format: fmt }) + "\n");
     process.exit(0);
   } catch (e) {
@@ -3061,7 +3109,11 @@ async function importCommand(path7, args) {
 // src/commands/describe.ts
 init_exit();
 init_auth_guard();
-import { HcmClient as HcmClient8, formatObject as formatObject8, fromAxiosError as fromAxiosError9 } from "@hcmai/sdk";
+import {
+  HcmClient as HcmClient8,
+  formatObject as formatObject8,
+  fromAxiosError as fromAxiosError9
+} from "@hcmai/sdk";
 async function describeCommand(model, args) {
   try {
     const client3 = HcmClient8.fromAuthContext(await getActiveAuthContextFromCli(args));
@@ -3071,25 +3123,7 @@ async function describeCommand(model, args) {
       process.stdout.write(formatObject8(desc, { format: fmt }) + "\n");
       process.exit(0);
     }
-    const lines = [`=== ${desc.model} ===`];
-    if (desc.labels.zh_CN) lines.push(`zh_CN: ${desc.labels.zh_CN}`);
-    if (desc.labels.en) lines.push(`en: ${desc.labels.en}`);
-    lines.push(`fields (${desc.fields.length}):`);
-    for (const f of desc.fields) {
-      const req = f.required ? "  required" : "          ";
-      const lbl = args.verbose ? `  ${f.label ?? ""}  ${f.description ?? ""}` : `  ${f.label ?? ""}`;
-      lines.push(`  ${f.name.padEnd(20)} ${f.type.padEnd(10)} ${req}${lbl}`);
-    }
-    lines.push(`actions (${desc.actions.length}):`);
-    for (const a of desc.actions) {
-      lines.push(`  ${a.name.padEnd(20)} ${a.label ?? ""}`);
-    }
-    if (desc.relations.length) {
-      lines.push(
-        `relations: ${desc.relations.map((r) => `${r.key}(via ${r.via})`).join(", ")}`
-      );
-    }
-    process.stdout.write(lines.join("\n") + "\n");
+    process.stdout.write(formatDescriptionTable(desc, !!args.verbose) + "\n");
     process.exit(0);
   } catch (e) {
     const err = e;
@@ -3099,6 +3133,28 @@ async function describeCommand(model, args) {
     exitWithError(e);
   }
 }
+function formatDescriptionTable(desc, verbose = false) {
+  const lines = [`=== ${desc.model} ===`];
+  if (desc.labels.zh_CN) lines.push(`zh_CN: ${desc.labels.zh_CN}`);
+  if (desc.labels.en) lines.push(`en: ${desc.labels.en}`);
+  lines.push(`fields (${desc.fields.length}):`);
+  for (const f of desc.fields) {
+    const req = f.required ? "  required" : "          ";
+    const lbl = verbose ? `  ${f.label ?? ""}  ${f.description ?? ""}` : `  ${f.label ?? ""}`;
+    lines.push(`  ${f.name.padEnd(20)} ${f.type.padEnd(10)} ${req}${lbl}`);
+  }
+  lines.push(`actions (${desc.actions.length}):`);
+  for (const a of desc.actions) {
+    const call = [a.scope, a.httpMethod].filter(Boolean).join(" ");
+    const params = a.params?.length ? `  params: ${a.params.map((p) => `${p.name}:${p.type}`).join(", ")}` : "";
+    const description = verbose && a.description ? `  ${a.description}` : "";
+    lines.push(`  ${a.name.padEnd(20)} ${call.padEnd(12)} ${a.label ?? ""}${params}${description}`);
+  }
+  if (desc.relations.length) {
+    lines.push(`relations: ${desc.relations.map((r) => `${r.key}(via ${r.via})`).join(", ")}`);
+  }
+  return lines.join("\n");
+}
 
 // src/commands/chat.ts
 init_exit();
@@ -3128,7 +3184,7 @@ import {
   buildSteer
 } from "@hcmai/sdk";
 import chalk2 from "chalk";
-import * as fs3 from "fs/promises";
+import * as fs4 from "fs/promises";
 function parseInjectOn(s) {
   const fail5 = (detail) => {
     throw new CliError13({
@@ -3404,7 +3460,7 @@ async function chatCommand(prompt, args) {
       return runInkRepl2(args);
     }
     if (args.promptFile) {
-      prompt = await fs3.readFile(args.promptFile, "utf-8");
+      prompt = await fs4.readFile(args.promptFile, "utf-8");
     }
     if (prompt === void 0 || !prompt && !regenerateMode) {
       throw new CliError13({
@@ -4254,7 +4310,7 @@ import {
 
 // src/commands/skills-sync.ts
 import { createHash } from "crypto";
-import { promises as fs4 } from "fs";
+import { promises as fs5 } from "fs";
 import path2 from "path";
 import {
   CliError as CliError14,
@@ -4424,8 +4480,8 @@ async function syncWorkBuddyProject(input) {
     return result(false, input, project, skillsDir, lockPath, [], []);
   }
   const obsolete = [...oldOwned].filter((file) => !desiredByFile.has(file));
-  await fs4.mkdir(metaDir, { recursive: true });
-  const staging = await fs4.mkdtemp(path2.join(metaDir, ".staging-"));
+  await fs5.mkdir(metaDir, { recursive: true });
+  const staging = await fs5.mkdtemp(path2.join(metaDir, ".staging-"));
   const stagedFiles = path2.join(staging, "new");
   const backups = path2.join(staging, "backup");
   const stagedLock = path2.join(staging, "chiron.lock.json");
@@ -4434,28 +4490,28 @@ async function syncWorkBuddyProject(input) {
   try {
     for (const [file, preparedFile2] of desiredByFile) {
       const staged = path2.join(stagedFiles, file);
-      await fs4.mkdir(path2.dirname(staged), { recursive: true });
-      await fs4.writeFile(
+      await fs5.mkdir(path2.dirname(staged), { recursive: true });
+      await fs5.writeFile(
         staged,
         preparedFile2.content,
         preparedFile2.mode === void 0 ? void 0 : { mode: preparedFile2.mode }
       );
     }
-    await fs4.writeFile(stagedLock, `${JSON.stringify(newLock, null, 2)}
+    await fs5.writeFile(stagedLock, `${JSON.stringify(newLock, null, 2)}
 `, "utf8");
     const affected = [.../* @__PURE__ */ new Set([...desiredFiles, ...obsolete])];
     for (const file of affected) {
       const target = path2.join(project, file);
       if (!await exists(target)) continue;
       const backup = path2.join(backups, file);
-      await fs4.mkdir(path2.dirname(backup), { recursive: true });
-      await fs4.copyFile(target, backup);
+      await fs5.mkdir(path2.dirname(backup), { recursive: true });
+      await fs5.copyFile(target, backup);
     }
     const oldLockExisted = await exists(lockPath);
     if (oldLockExisted) {
       const backupLock = path2.join(backups, ".hcm-delivery", "chiron.lock.json");
-      await fs4.mkdir(path2.dirname(backupLock), { recursive: true });
-      await fs4.copyFile(lockPath, backupLock);
+      await fs5.mkdir(path2.dirname(backupLock), { recursive: true });
+      await fs5.copyFile(lockPath, backupLock);
     }
     const journal = {
       schemaVersion: 1,
@@ -4463,25 +4519,25 @@ async function syncWorkBuddyProject(input) {
       affectedFiles: affected,
       oldLockExisted
     };
-    await fs4.writeFile(journalPath, `${JSON.stringify(journal, null, 2)}
+    await fs5.writeFile(journalPath, `${JSON.stringify(journal, null, 2)}
 `, "utf8");
     journalReady = true;
     for (const file of desiredFiles) {
       const target = path2.join(project, file);
-      await fs4.mkdir(path2.dirname(target), { recursive: true });
-      await fs4.rm(target, { force: true });
-      await fs4.rename(path2.join(stagedFiles, file), target);
-    }
-    for (const file of obsolete) await fs4.unlink(path2.join(project, file)).catch(ignoreMissing);
-    await fs4.rm(lockPath, { force: true });
-    await fs4.rename(stagedLock, lockPath);
-    await fs4.unlink(journalPath);
+      await fs5.mkdir(path2.dirname(target), { recursive: true });
+      await fs5.rm(target, { force: true });
+      await fs5.rename(path2.join(stagedFiles, file), target);
+    }
+    for (const file of obsolete) await fs5.unlink(path2.join(project, file)).catch(ignoreMissing);
+    await fs5.rm(lockPath, { force: true });
+    await fs5.rename(stagedLock, lockPath);
+    await fs5.unlink(journalPath);
     journalReady = false;
   } catch (cause) {
     if (journalReady) await recoverStaging(project, staging, lockPath);
     throw cause;
   } finally {
-    await fs4.rm(staging, { recursive: true, force: true });
+    await fs5.rm(staging, { recursive: true, force: true });
   }
   return result(
     true,
@@ -4496,7 +4552,7 @@ async function syncWorkBuddyProject(input) {
 async function recoverInterruptedSyncs(project, metaDir, lockPath) {
   let entries;
   try {
-    entries = await fs4.readdir(metaDir, { withFileTypes: true });
+    entries = await fs5.readdir(metaDir, { withFileTypes: true });
   } catch (cause) {
     if (cause.code === "ENOENT") return;
     throw cause;
@@ -4507,32 +4563,32 @@ async function recoverInterruptedSyncs(project, metaDir, lockPath) {
     if (await exists(path2.join(staging, "journal.json"))) {
       await recoverStaging(project, staging, lockPath);
     }
-    await fs4.rm(staging, { recursive: true, force: true });
+    await fs5.rm(staging, { recursive: true, force: true });
   }
 }
 async function recoverStaging(project, staging, lockPath) {
   const journalPath = path2.join(staging, "journal.json");
-  const journal = parseJournal(await fs4.readFile(journalPath, "utf8"), project);
+  const journal = parseJournal(await fs5.readFile(journalPath, "utf8"), project);
   const backups = path2.join(staging, "backup");
   for (const file of journal.affectedFiles) {
     const target = path2.join(project, file);
     const backup = path2.join(backups, file);
     if (await exists(backup)) {
-      await fs4.mkdir(path2.dirname(target), { recursive: true });
-      await fs4.rm(target, { force: true });
-      await fs4.rename(backup, target);
+      await fs5.mkdir(path2.dirname(target), { recursive: true });
+      await fs5.rm(target, { force: true });
+      await fs5.rename(backup, target);
     } else {
-      await fs4.rm(target, { force: true });
+      await fs5.rm(target, { force: true });
     }
   }
   const backupLock = path2.join(backups, ".hcm-delivery", "chiron.lock.json");
   if (journal.oldLockExisted) {
     if (!await exists(backupLock)) throw invalid(`\u540C\u6B65\u6062\u590D\u7F3A\u5C11\u65E7\u9501\u5907\u4EFD\uFF1A${backupLock}`);
-    await fs4.mkdir(path2.dirname(lockPath), { recursive: true });
-    await fs4.rm(lockPath, { force: true });
-    await fs4.rename(backupLock, lockPath);
+    await fs5.mkdir(path2.dirname(lockPath), { recursive: true });
+    await fs5.rm(lockPath, { force: true });
+    await fs5.rename(backupLock, lockPath);
   } else {
-    await fs4.rm(lockPath, { force: true });
+    await fs5.rm(lockPath, { force: true });
   }
 }
 function parseJournal(content, project) {
@@ -4775,7 +4831,7 @@ function stableJson2(value) {
 }
 async function readOptional(file) {
   try {
-    return await fs4.readFile(file, "utf8");
+    return await fs5.readFile(file, "utf8");
   } catch (cause) {
     if (cause.code === "ENOENT") return void 0;
     throw cause;
@@ -4783,7 +4839,7 @@ async function readOptional(file) {
 }
 async function readOptionalBytes(file) {
   try {
-    return await fs4.readFile(file);
+    return await fs5.readFile(file);
   } catch (cause) {
     if (cause.code === "ENOENT") return void 0;
     throw cause;
@@ -4791,7 +4847,7 @@ async function readOptionalBytes(file) {
 }
 async function exists(file) {
   try {
-    await fs4.access(file);
+    await fs5.access(file);
     return true;
   } catch (cause) {
     if (cause.code === "ENOENT") return false;
@@ -4816,7 +4872,7 @@ function lockDigests(lock) {
 }
 async function fileModeMatches(file, expected) {
   if (expected === void 0 || process.platform === "win32") return true;
-  const stat = await fs4.stat(file);
+  const stat = await fs5.stat(file);
   return (stat.mode & 511) === expected;
 }
 function validDigest(value) {
@@ -4832,7 +4888,7 @@ function invalid(message) {
 // src/commands/skills-runtime.ts
 import { execFile } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { createReadStream, promises as fs5 } from "fs";
+import { createReadStream, promises as fs6 } from "fs";
 import path3 from "path";
 import { promisify } from "util";
 import { CliError as CliError15, CliErrorCode as CliErrorCode14 } from "@hcmai/sdk";
@@ -4910,8 +4966,8 @@ async function resolveLaunch(candidate, nodeExecutable) {
 }
 async function realFile(file, label) {
   try {
-    const resolved = await fs5.realpath(file);
-    const stat = await fs5.stat(resolved);
+    const resolved = await fs6.realpath(file);
+    const stat = await fs6.stat(resolved);
     if (!stat.isFile()) throw new Error("not a regular file");
     return resolved;
   } catch (cause) {
@@ -4924,20 +4980,20 @@ async function realFile(file, label) {
 }
 async function comparablePath(file) {
   const absolute = path3.resolve(file);
-  return fs5.realpath(absolute).catch(() => absolute);
+  return fs6.realpath(absolute).catch(() => absolute);
 }
 async function launchIdentity(launch) {
   const files = launch.kind === "node-entry" ? [launch.executable, launch.entry] : [launch.executable];
   const identities = await Promise.all(
     files.map(async (file) => {
-      const stat = await fs5.stat(file, { bigint: true });
+      const stat = await fs6.stat(file, { bigint: true });
       return [file, stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].map(String).join("\0");
     })
   );
   return identities.join("\n");
 }
 async function readPrefix(file, bytes) {
-  const handle = await fs5.open(file, "r");
+  const handle = await fs6.open(file, "r");
   try {
     const buffer = Buffer.alloc(bytes);
     const result2 = await handle.read(buffer, 0, bytes, 0);
@@ -6158,7 +6214,7 @@ async function metaDeleteCommand(path7, args) {
 init_exit();
 init_auth_guard();
 import * as crypto from "crypto";
-import * as fs6 from "fs/promises";
+import * as fs7 from "fs/promises";
 import * as path5 from "path";
 import {
   buildMiniPreviewTargets,
@@ -6294,7 +6350,7 @@ async function workspaceBindCommand(workspaceKey, args) {
       tenantId: args.tenant ?? client3?.tenantId,
       endpoint: args.endpoint ?? client3?.endpoint
     });
-    await fs6.mkdir(rootDir, { recursive: true });
+    await fs7.mkdir(rootDir, { recursive: true });
     await writeWorkspaceContext(rootDir, context);
     writeWorkspaceBindResult(context, rootDir, args.output ?? "table");
     process.exit(0);
@@ -6329,7 +6385,7 @@ async function workspaceCreateCommand(workspaceKey, args) {
       tenantId: client3.tenantId,
       endpoint: client3.endpoint
     });
-    await fs6.mkdir(rootDir, { recursive: true });
+    await fs7.mkdir(rootDir, { recursive: true });
     await writeWorkspaceContext(rootDir, context);
     writeWorkspaceCreateResult(
       {
@@ -6366,7 +6422,7 @@ async function workspacePullCommand(args) {
       tenantId: client3.tenantId ?? existing?.tenantId,
       endpoint: client3.endpoint ?? existing?.endpoint
     });
-    await fs6.mkdir(rootDir, { recursive: true });
+    await fs7.mkdir(rootDir, { recursive: true });
     await writeWorkspaceContext(rootDir, context);
     const files = await listWorkspaceFiles(client3.raw(), workspaceKey, { pageSize: 5e3 });
     const miniApps = detectRemoteMiniApps(files.data);
@@ -6698,7 +6754,7 @@ function buildWorkspaceContext(args) {
 async function readWorkspaceContext(rootDir) {
   try {
     const parsed = JSON.parse(
-      await fs6.readFile(path5.join(rootDir, WORKSPACE_CONTEXT_FILE), "utf-8")
+      await fs7.readFile(path5.join(rootDir, WORKSPACE_CONTEXT_FILE), "utf-8")
     );
     if (parsed.kind !== WORKSPACE_CONTEXT_KIND || parsed.version !== WORKSPACE_CONTEXT_VERSION) {
       throw new Error(`${WORKSPACE_CONTEXT_FILE} is not an HCM workspace context`);
@@ -6727,25 +6783,25 @@ async function requireWorkspaceContext(rootDir) {
   return context;
 }
 async function writeWorkspaceContext(rootDir, context) {
-  await fs6.writeFile(
+  await fs7.writeFile(
     path5.join(rootDir, WORKSPACE_CONTEXT_FILE),
     JSON.stringify(context, null, 2) + "\n"
   );
 }
 async function writeTextFile(file, content, force) {
   try {
-    await fs6.access(file);
+    await fs7.access(file);
     if (!force) throw new Error(`${file} already exists; use --force to overwrite`);
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
-  await fs6.mkdir(path5.dirname(file), { recursive: true });
-  await fs6.writeFile(file, content);
+  await fs7.mkdir(path5.dirname(file), { recursive: true });
+  await fs7.writeFile(file, content);
 }
 async function readWorkspaceRawManifest(rootDir, context) {
   try {
     const parsed = JSON.parse(
-      await fs6.readFile(path5.join(rootDir, WORKSPACE_STATE_DIR, WORKSPACE_PULL_MANIFEST_FILE), "utf-8")
+      await fs7.readFile(path5.join(rootDir, WORKSPACE_STATE_DIR, WORKSPACE_PULL_MANIFEST_FILE), "utf-8")
     );
     if (parsed.version !== WORKSPACE_CONTEXT_VERSION || parsed.workspaceKey !== context.workspaceKey) {
       throw new Error(`${WORKSPACE_PULL_MANIFEST_FILE} does not match workspace ${context.workspaceKey}`);
@@ -6764,7 +6820,7 @@ async function readWorkspaceRawManifest(rootDir, context) {
 }
 async function writeWorkspaceRawState(rootDir, context, files, remoteByLocalPath) {
   const stateDir = path5.join(rootDir, WORKSPACE_STATE_DIR);
-  await fs6.mkdir(stateDir, { recursive: true });
+  await fs7.mkdir(stateDir, { recursive: true });
   const snapshots = files.map((file) => ({
     localPath: file.localPath,
     remotePath: file.localPath,
@@ -6773,7 +6829,7 @@ async function writeWorkspaceRawState(rootDir, context, files, remoteByLocalPath
     size: file.size,
     lastModified: remoteByLocalPath.get(file.localPath)?.lastModified
   }));
-  await fs6.writeFile(
+  await fs7.writeFile(
     path5.join(stateDir, WORKSPACE_PULL_MANIFEST_FILE),
     JSON.stringify(
       {
@@ -6799,7 +6855,7 @@ async function walkWorkspaceRawFiles(rootDir, relativeDir, files) {
   const absoluteDir = path5.join(rootDir, relativeDir);
   let entries;
   try {
-    entries = await fs6.readdir(absoluteDir, { withFileTypes: true });
+    entries = await fs7.readdir(absoluteDir, { withFileTypes: true });
   } catch (e) {
     if (e.code === "ENOENT") return;
     throw e;
@@ -6814,7 +6870,7 @@ async function walkWorkspaceRawFiles(rootDir, relativeDir, files) {
       continue;
     }
     if (!entry.isFile()) continue;
-    const content = await fs6.readFile(absolutePath, "utf-8");
+    const content = await fs7.readFile(absolutePath, "utf-8");
     files.push({
       localPath,
       absolutePath,
@@ -6991,7 +7047,7 @@ async function discoverMiniApps(rootDir) {
   const appsRoot = path5.join(rootDir, MINI_APPS_DIR);
   let entries;
   try {
-    entries = await fs6.readdir(appsRoot, { withFileTypes: true });
+    entries = await fs7.readdir(appsRoot, { withFileTypes: true });
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -7530,7 +7586,8 @@ var GUARDED_EXECUTOR_REASON_CODES = /* @__PURE__ */ new Set([
   "record-create",
   "record-update",
   "cache-mutation",
-  "setting-write"
+  "setting-write",
+  "credential-reset"
 ]);
 function assessDeliveryCommand(inputArgv) {
   const argv = inputArgv[0] === "--" ? inputArgv.slice(1) : [...inputArgv];
@@ -7539,7 +7596,9 @@ function assessDeliveryCommand(inputArgv) {
   const subcommand = argv[1] && !argv[1].startsWith("-") ? argv[1] : void 0;
   const envAlias = flagValue(argv, "--env");
   const identityAlias = flagValue(argv, "--as");
-  const sensitiveFlags = [...new Set(PAYLOAD_FLAGS.filter((flag) => hasFlag(argv, flag)))];
+  const sensitiveFlags = [
+    ...new Set([...PAYLOAD_FLAGS, ...CREDENTIAL_FLAGS].filter((flag) => hasFlag(argv, flag)))
+  ];
   const target = summarizeTarget(argv);
   let classification = classify(argv);
   const invalidPayload = payloadError(argv);
@@ -7593,6 +7652,19 @@ function classify(argv) {
   if (argv.some((arg) => APPROVAL_BYPASS_FLAGS.has(flagName(arg)))) {
     return forbidden("approval-bypass", "\u547D\u4EE4\u5305\u542B\u8DF3\u8FC7\u786E\u8BA4\u7684\u65D7\u6807\uFF0C\u987E\u95EE\u4EA4\u4ED8\u9762\u4E0D\u6267\u884C\u3002");
   }
+  if (name === "user" && subcommand === "reset-password") {
+    const nonStdinCredential = argv.some((arg) => {
+      const flag = flagName(arg);
+      return CREDENTIAL_FLAGS.has(flag) && flag !== "--password-stdin";
+    });
+    if (nonStdinCredential || !argv.includes("--password-stdin")) {
+      return forbidden(
+        "credential-governance",
+        "\u7528\u6237\u5BC6\u7801\u91CD\u7F6E\u53EA\u80FD\u901A\u8FC7 --password-stdin \u8FDB\u5165\u53D7\u63A7\u51ED\u636E\u6D41\u7A0B\u3002"
+      );
+    }
+    return guarded("credential-write", "credential-reset");
+  }
   if (argv.some((arg) => CREDENTIAL_FLAGS.has(flagName(arg)))) {
     return forbidden("credential-governance", "\u547D\u4EE4\u643A\u5E26\u8EAB\u4EFD\u51ED\u636E\u53C2\u6570\uFF0C\u5FC5\u987B\u8F6C\u4EA4\u8EAB\u4EFD\u6CBB\u7406\u6D41\u7A0B\u3002");
   }
@@ -7714,7 +7786,14 @@ function summarizeTarget(argv) {
     if (settingKeys.length > 0) target.settingKeys = settingKeys;
   }
   const id = flagValue(argv, "--id");
-  if (id) target.recordIdSha256 = sha2565(id);
+  if (name === "user" && subcommand === "reset-password") {
+    if (id) target.userIdSha256 = sha2565(id);
+    const username = flagValue(argv, "--username");
+    if (username) target.usernameSha256 = sha2565(username);
+    target.forceChangeOnNextLogin = !hasFlag(argv, "--no-force-change");
+  } else if (id) {
+    target.recordIdSha256 = sha2565(id);
+  }
   for (const flag of PAYLOAD_FLAGS) {
     const raw = flagValue(argv, flag);
     if (!raw) continue;
@@ -7813,7 +7892,7 @@ function isPlainObject(value) {
 // src/commands/delivery-execution.ts
 import { createHash as createHash6, randomBytes as secureRandomBytes } from "crypto";
 import { spawn } from "child_process";
-import { createReadStream as createReadStream2, promises as fs7 } from "fs";
+import { createReadStream as createReadStream2, promises as fs8 } from "fs";
 import path6 from "path";
 import { CliError as CliError20, CliErrorCode as CliErrorCode19, formatObject as formatObject18 } from "@hcmai/sdk";
 init_exit();
@@ -7857,7 +7936,7 @@ async function prepareDeliveryExecution(input) {
   await safeManagedDirectory(project, ".hcm-delivery/execution-plans", plansDir);
   const planFile = path6.join(plansDir, `${planId}.json`);
   try {
-    await fs7.writeFile(planFile, `${JSON.stringify(plan, null, 2)}
+    await fs8.writeFile(planFile, `${JSON.stringify(plan, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384,
@@ -7911,7 +7990,7 @@ async function executeDeliveryPlan(input) {
   await safeManagedDirectory(project, ".hcm-delivery/execution-claims", claimsDir);
   const claimFile = path6.join(claimsDir, `${plan.planId}.json`);
   try {
-    await fs7.writeFile(
+    await fs8.writeFile(
       claimFile,
       `${JSON.stringify({ schemaVersion: 1, planId: plan.planId, claimedAt: now.toISOString() }, null, 2)}
 `,
@@ -8031,7 +8110,7 @@ async function bindEvidenceDirectory(project, reference) {
   }
   const absolute = path6.join(project, relative2);
   await assertNoSymlinkComponents(project, relative2);
-  const stat = await fs7.stat(absolute).catch((cause) => {
+  const stat = await fs8.stat(absolute).catch((cause) => {
     throw invalid4(`evidence \u76EE\u5F55\u4E0D\u53EF\u7528\uFF1A${relative2}`, cause);
   });
   if (!stat.isDirectory()) throw invalid4(`evidence \u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55\uFF1A${relative2}`);
@@ -8065,6 +8144,32 @@ function assertGuardedAssessment(assessment, argv) {
   validateSupportedCommandShape(assessment.reasonCode, argv);
 }
 function validateSupportedCommandShape(reasonCode, argv) {
+  if (reasonCode === "credential-reset") {
+    if (argv[0] !== "user" || argv[1] !== "reset-password") {
+      throw invalid4("credential-reset \u53EA\u652F\u6301 user reset-password");
+    }
+    const userId = optionalFlagValue(argv, "--id");
+    const username = optionalFlagValue(argv, "--username");
+    if (Boolean(userId) === Boolean(username)) {
+      throw invalid4("user reset-password \u5FC5\u987B\u4E14\u53EA\u80FD\u5305\u542B --id \u6216 --username");
+    }
+    if (!argv.includes("--password-stdin")) {
+      throw invalid4("user reset-password \u5FC5\u987B\u5305\u542B\u72EC\u7ACB\u7684 --password-stdin");
+    }
+    if (argv.some(
+      (value) => [
+        "--password",
+        "--new-password",
+        "--client-secret",
+        "--pat",
+        "--new-password-stdin",
+        "--pat-stdin"
+      ].includes(value.split("=", 1)[0] ?? "")
+    ) || argv.some((value) => value.startsWith("--password-stdin="))) {
+      throw invalid4("user reset-password \u4E0D\u5141\u8BB8\u5728 argv \u4E2D\u643A\u5E26\u660E\u6587\u51ED\u636E");
+    }
+    return;
+  }
   if (reasonCode === "record-create") {
     requireFlagValue(argv, "--data", "create \u5FC5\u987B\u5305\u542B --data <JSON>");
     return;
@@ -8089,6 +8194,19 @@ function validateSupportedCommandShape(reasonCode, argv) {
     }
   }
 }
+function optionalFlagValue(argv, flag) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === flag) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("-") ? next : void 0;
+    }
+    if (value?.startsWith(`${flag}=`) && value.length > flag.length + 1) {
+      return value.slice(flag.length + 1);
+    }
+  }
+  return void 0;
+}
 function requireFlagValue(argv, flag, message) {
   for (let index = 0; index < argv.length; index += 1) {
     const value = argv[index];
@@ -8143,29 +8261,29 @@ async function runCurrentCliCommand(argv, cwd, streams) {
 async function writeReceiptExclusive(target, receipt) {
   const temp = `${target}.${process.pid}.${Date.now()}.tmp`;
   try {
-    await fs7.writeFile(temp, `${JSON.stringify(receipt, null, 2)}
+    await fs8.writeFile(temp, `${JSON.stringify(receipt, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384,
       flag: "wx"
     });
-    await fs7.link(temp, target);
+    await fs8.link(temp, target);
   } catch (cause) {
     throw invalid4(`\u6267\u884C\u6536\u636E\u5199\u5165\u5931\u8D25\u6216\u5DF2\u5B58\u5728\uFF1A${path6.basename(target)}`, cause);
   } finally {
-    await fs7.unlink(temp).catch(() => void 0);
+    await fs8.unlink(temp).catch(() => void 0);
   }
 }
 async function safeManagedDirectory(project, relative2, absolute) {
   await assertNoSymlinkComponents(project, path6.dirname(relative2));
-  const existing = await fs7.lstat(absolute).catch(() => void 0);
+  const existing = await fs8.lstat(absolute).catch(() => void 0);
   if (existing?.isSymbolicLink()) throw invalid4(`\u53D7\u7BA1\u76EE\u5F55\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\uFF1A${relative2}`);
   if (existing && !existing.isDirectory()) throw invalid4(`\u53D7\u7BA1\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55\uFF1A${relative2}`);
-  if (!existing) await fs7.mkdir(absolute, { mode: 448 });
-  await fs7.chmod(absolute, 448);
+  if (!existing) await fs8.mkdir(absolute, { mode: 448 });
+  await fs8.chmod(absolute, 448);
 }
 async function pathExists(file) {
-  return fs7.lstat(file).then(
+  return fs8.lstat(file).then(
     () => true,
     (cause) => {
       if (cause.code === "ENOENT") return false;
@@ -8180,20 +8298,20 @@ async function readSafeFile(project, file, label) {
   await assertNoSymlinkComponents(project, relative2);
   let stat;
   try {
-    stat = await fs7.lstat(file);
+    stat = await fs8.lstat(file);
   } catch (cause) {
     throw invalid4(`${label}\u4E0D\u53EF\u7528\uFF1A${relative2}`, cause);
   }
   if (stat.isSymbolicLink()) throw invalid4(`${label}\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\uFF1A${relative2}`);
   if (!stat.isFile()) throw invalid4(`${label}\u4E0D\u662F\u666E\u901A\u6587\u4EF6\uFF1A${relative2}`);
-  return fs7.readFile(file);
+  return fs8.readFile(file);
 }
 async function assertNoSymlinkComponents(project, relative2) {
   const parts = relative2.split("/").filter(Boolean);
   let current = project;
   for (const part of parts) {
     current = path6.join(current, part);
-    const stat = await fs7.lstat(current).catch(() => void 0);
+    const stat = await fs8.lstat(current).catch(() => void 0);
     if (stat?.isSymbolicLink()) throw invalid4(`\u8DEF\u5F84\u5305\u542B\u7B26\u53F7\u94FE\u63A5\uFF1A${relative2}`);
     if (!stat) break;
   }
@@ -8202,11 +8320,11 @@ async function realProject(requested) {
   const absolute = path6.resolve(requested);
   let project;
   try {
-    project = await fs7.realpath(absolute);
+    project = await fs8.realpath(absolute);
   } catch (cause) {
     throw invalid4(`\u9879\u76EE\u76EE\u5F55\u4E0D\u53EF\u7528\uFF1A${absolute}`, cause);
   }
-  const stat = await fs7.stat(project);
+  const stat = await fs8.stat(project);
   if (!stat.isDirectory()) throw invalid4(`\u9879\u76EE\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55\uFF1A${absolute}`);
   return project;
 }
@@ -8267,6 +8385,65 @@ function invalid4(message, cause) {
   return new CliError20({ code: CliErrorCode19.INVALID_ARGUMENT, message, cause });
 }
 
+// src/commands/user.ts
+init_auth_guard();
+init_exit();
+import {
+  HcmClient as HcmClient17,
+  adminResetPassword,
+  formatObject as formatObject19,
+  fromAxiosError as fromAxiosError17,
+  CliError as CliError21,
+  CliErrorCode as CliErrorCode20
+} from "@hcmai/sdk";
+function buildAdminResetPasswordRequest(args, password) {
+  const hasId = Boolean(args.id);
+  const hasUsername = Boolean(args.username);
+  if (hasId === hasUsername) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "--id <uuid> \u4E0E --username <user> \u5FC5\u987B\u4E14\u53EA\u80FD\u63D0\u4F9B\u4E00\u4E2A"
+    });
+  }
+  if (!password) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "\u65B0\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A"
+    });
+  }
+  return {
+    ...args.id ? { userId: args.id } : {},
+    ...args.username ? { username: args.username } : {},
+    newPassword: password,
+    confirmPassword: password,
+    forceChangeOnNextLogin: args.forceChange !== false
+  };
+}
+async function userResetPasswordCommand(args) {
+  try {
+    const password = args.passwordStdin ? await readSecretFromStdin() : await promptPasswordTwice();
+    const request = buildAdminResetPasswordRequest(args, password);
+    const client3 = HcmClient17.fromAuthContext(await getActiveAuthContextFromCli(args));
+    const result2 = await adminResetPassword(client3.raw(), request);
+    process.stdout.write(formatObject19(result2, { format: args.output ?? "json" }) + "\n");
+  } catch (cause) {
+    const err = cause;
+    if (err?.isAxiosError) exitWithError(fromAxiosError17(err, args.env));
+    exitWithError(cause);
+  }
+}
+async function promptPasswordTwice() {
+  const password = await promptSecret("\u65B0\u5BC6\u7801: ");
+  const confirmation = await promptSecret("\u518D\u6B21\u8F93\u5165\u65B0\u5BC6\u7801: ");
+  if (password !== confirmation) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "\u4E24\u6B21\u8F93\u5165\u7684\u65B0\u5BC6\u7801\u4E0D\u4E00\u81F4"
+    });
+  }
+  return password;
+}
+
 // src/startup.ts
 function needsLegacyProfileMigration(argv) {
   const args = argv.slice(2);
@@ -8295,15 +8472,17 @@ config.command("get <key>").description("\u8BFB\u53D6\u5168\u5C40 defaults").act
 var env = program.command("env").description("\u7BA1\u7406 HCM \u73AF\u5883\uFF08\u591A\u540E\u7AEF\u8FDE\u63A5\u914D\u7F6E\uFF09");
 env.command("list").description("\u5217\u51FA\u5168\u90E8 env").action(() => envList());
 env.command("current").description("\u663E\u793A\u5F53\u524D\u6FC0\u6D3B\u7684 env").action(() => envCurrent());
-env.command("add <name>").description("\u65B0\u589E env").option("--endpoint <url>", "HCM \u540E\u7AEF URL\uFF08\u5FC5\u586B\uFF09").option("--tenant <id>", "\u9ED8\u8BA4 tenant id", "1").option("--force", "\u8986\u76D6\u5DF2\u5B58\u5728\u7684\u540C\u540D env").action((name, opts) => envAdd(name, opts));
+env.command("add <name>").description("\u65B0\u589E env").option("--endpoint <url>", "HCM \u540E\u7AEF URL\uFF08\u5FC5\u586B\uFF09").option("--tenant <id>", "\u9ED8\u8BA4 tenant id", "1").option("--frontend <url>", "\u5BF9\u5E94\u524D\u7AEF URL\uFF0C\u4F8B\u5982 http://127.0.0.1:5176").option("--force", "\u8986\u76D6\u5DF2\u5B58\u5728\u7684\u540C\u540D env").action((name, opts) => envAdd(name, opts));
 env.command("use <name>").description("\u5207\u5230\u6307\u5B9A env").option("--no-ping", "\u8DF3\u8FC7 endpoint \u5065\u5EB7\u68C0\u67E5").action((name, opts) => envUse(name, opts));
 env.command("remove <name>").description("\u5220\u9664 env\uFF08\u7EA7\u8054\u6E05\u9664\u8BE5 env \u7684\u5168\u90E8 identity \u548C token\uFF09").option("--force", "\u8DF3\u8FC7\u786E\u8BA4\u63D0\u793A").action((name, opts) => envRemove(name, opts));
 env.command("show [name]").description("\u663E\u793A env \u8BE6\u60C5\uFF08\u542B\u8BE5 env \u4E0B\u7684 identity \u5217\u8868\uFF09").action((name) => envShow({ name }));
-env.command("edit <field> <value>").description("\u7F16\u8F91 env \u5B57\u6BB5\uFF08endpoint / tenantId / defaultIdentity / defaultAgent\uFF09").option("--env <name>", "\u76EE\u6807 env \u540D\uFF08\u9ED8\u8BA4\u5F53\u524D activeEnv\uFF09").action((field, value, opts) => envEdit(field, value, opts));
+env.command("edit <field> <value>").description("\u7F16\u8F91 env \u5B57\u6BB5\uFF08endpoint / frontend / tenantId / defaultIdentity / defaultAgent\uFF09").option("--env <name>", "\u76EE\u6807 env \u540D\uFF08\u9ED8\u8BA4\u5F53\u524D activeEnv\uFF09").action((field, value, opts) => envEdit(field, value, opts));
 var identity = program.command("identity").description("\u7BA1\u7406 HCM \u8EAB\u4EFD\u51ED\u636E\uFF08env \u4E0B\u7684 identity\uFF09");
 identity.command("list").description("\u5217\u51FA identity\uFF08\u9ED8\u8BA4\u5217\u5F53\u524D env\uFF0C--env all \u5217\u5168\u90E8\uFF09").option("--env <name>", '\u8FC7\u6EE4 env\uFF1B\u4F20 "all" \u5217\u5168\u90E8', void 0).action((opts) => identityList(opts));
 identity.command("use <name>").description("\u628A identity \u8BBE\u4E3A\u5176 env \u7684 default identity").action((name) => identityUse(name));
 identity.command("remove <name>").description("\u5220\u9664 identity\uFF08\u6E05 token + \u82E5\u662F env default \u5219\u6E05\u7A7A\uFF09").action((name) => identityRemove(name));
+var user = program.command("user").description("\u7BA1\u7406\u79DF\u6237\u7528\u6237\u7684\u4E13\u7528\u51ED\u636E\u6D41\u7A0B");
+user.command("reset-password").description("\u7531 admin.system \u5B89\u5168\u91CD\u7F6E\u7528\u6237\u5BC6\u7801\uFF0C\u5E76\u4F7F\u65E2\u6709\u4F1A\u8BDD\u5931\u6548").option("--id <uuid>", "\u76EE\u6807\u7528\u6237 ID\uFF08\u4E0E --username \u4E8C\u9009\u4E00\uFF09").option("--username <user>", "\u76EE\u6807\u7528\u6237\u540D\uFF08\u4E0E --id \u4E8C\u9009\u4E00\uFF09").option("--password-stdin", "\u4ECE\u6807\u51C6\u8F93\u5165\u8BFB\u53D6\u65B0\u5BC6\u7801\uFF08Agent/\u53D7\u63A7\u4EA4\u4ED8\u5FC5\u987B\u4F7F\u7528\uFF09").option("--no-force-change", "\u4E0B\u6B21\u767B\u5F55\u4E0D\u5F3A\u5236\u6539\u5BC6\uFF08\u4EC5\u9650\u5DF2\u6279\u51C6\u7684\u9694\u79BB\u6D4B\u8BD5\u73AF\u5883\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u5FC5\u987B\u5177\u5907 admin.system\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => userResetPasswordCommand(opts));
 var delivery = program.command("delivery").description("\u987E\u95EE\u4EA4\u4ED8\u547D\u4EE4\u7684\u98CE\u9669\u8BC4\u4F30\u4E0E\u4E00\u6B21\u6027\u53D7\u63A7\u6267\u884C\u5408\u540C");
 delivery.command("assess").description("\u7EAF\u672C\u5730\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1B\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
 delivery.command("prepare").description("\u628A\u53D7\u652F\u6301\u7684 R2 argv \u4E0E\u9501\u3001\u8FD0\u884C\u65F6\u548C\u53D8\u66F4/\u56DE\u6EDA\u8BF4\u660E\u7ED1\u5B9A\u4E3A\u77ED\u65F6\u6267\u884C\u8BA1\u5212").requiredOption("--change-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u53D8\u66F4\u8BF4\u660E").requiredOption("--rollback-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u56DE\u6EDA\u8BF4\u660E").requiredOption("--evidence-dir <dir>", "\u9879\u76EE evidence/ \u4E0B\u7684\u6536\u636E\u76EE\u5F55").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--ttl-seconds <n>", "\u6709\u6548\u671F\u79D2\u6570\uFF0860-3600\uFF09", "900").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u7ED1\u5B9A\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryPrepareCommand(command, opts));
@@ -8312,8 +8491,8 @@ program.command("query <Model>").description("\u67E5\u8BE2 Model \u5217\u8868\u6
   "--filter <JSON>",
   `\u8FC7\u6EE4 AST\uFF08ModelQueryDsl\uFF09\uFF1A\u53F6\u5B50 '{"field":"status","op":"eq","value":"ACTIVE"}'\uFF0C\u591A\u6761\u4EF6\u7528 '{"and":[\u53F6\u5B50,\u2026]}'\u3002\u26A0\uFE0F \u4E0D\u63A5\u53D7 {"\u5B57\u6BB5":"\u503C"} \u7B80\u5199\uFF0Cschema \u5C42\u4F1A\u62D2`
 ).option("--sort <JSON>", `\u6392\u5E8F\u6761\u4EF6 JSON\uFF0C\u4F8B\u5982 '[{"field":"hireDate","direction":"desc"}]'`).option("--fields <list>", "\u8FD4\u56DE\u5B57\u6BB5\u5217\u8868\uFF08\u9017\u53F7\u5206\u9694\uFF09\uFF0C\u4F8B\u5982 name,code,email").option("--keyword <text>", "\u5168\u6587\u68C0\u7D22\u5173\u952E\u5B57").option("--limit <n>", "\u6BCF\u9875\u5927\u5C0F", "20").option("--offset <n>", "\u504F\u79FB\u91CF\uFF08\u6309 limit \u81EA\u52A8\u6362\u7B97 page\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((m, opts) => queryCommand(m, opts));
-program.command("action <Model.Action>").description("\u8C03\u7528 Model \u4E0A\u7684 Action\uFF08\u4E1A\u52A1\u65B9\u6CD5\uFF09\uFF0C\u4F8B\u5982 Employee.regularize").option("--id <id>", "\u76EE\u6807\u5B9E\u4F53 ID\uFF08object Action \u5FC5\u586B\uFF09").option("--ids <csv>", "\u6279\u91CF ID\uFF08\u9017\u53F7\u5206\u9694\uFF0Cbulk Action \u7528\uFF09").option("--method <method>", "HTTP \u65B9\u6CD5\uFF1AGET | POST | PUT | DELETE", "POST").option("--scope <scope>", "\u5F3A\u5236 Action scope\uFF1Aclass | object\uFF08\u9ED8\u8BA4\uFF1A\u6709 --id \u4E3A object\uFF0C\u5426\u5219 class\uFF09").option("--params <JSON>", `Action \u5165\u53C2 JSON\uFF0C\u4F8B\u5982 '{"effectDate":"2026-06-01"}'`).option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((spec, opts) => actionCommand(spec, opts));
-program.command("create <Model>").description("\u521B\u5EFA\u4E00\u6761 Model \u8BB0\u5F55\uFF08\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF09").option("--data <JSON>", `\u8BB0\u5F55\u5B57\u6BB5 JSON\uFF0C\u4F8B\u5982 '{"code":"ORG_SALES","name":"\u9500\u552E\u90E8"}'`).option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((m, opts) => createCommand(m, opts));
+program.command("action <Model.Action>").description("\u8C03\u7528 Model \u4E0A\u7684 Action\uFF08\u4E1A\u52A1\u65B9\u6CD5\uFF09\uFF0C\u4F8B\u5982 Employee.regularize").option("--id <id>", "\u76EE\u6807\u5B9E\u4F53 ID\uFF08object Action \u5FC5\u586B\uFF09").option("--ids <csv>", "\u6279\u91CF ID\uFF08\u9017\u53F7\u5206\u9694\uFF0Cbulk Action \u7528\uFF09").option("--method <method>", "HTTP \u65B9\u6CD5\uFF1AGET | POST | PUT | DELETE", "POST").option("--scope <scope>", "\u5F3A\u5236 Action scope\uFF1Aclass | object\uFF08\u9ED8\u8BA4\uFF1A\u6709 --id \u4E3A object\uFF0C\u5426\u5219 class\uFF09").option("--params <JSON>", `Action \u5165\u53C2 JSON\uFF0C\u4F8B\u5982 '{"effectDate":"2026-06-01"}'`).option("--params-file <path>", "\u4ECE UTF-8 JSON \u6587\u4EF6\u8BFB\u53D6 Action \u5165\u53C2\uFF08\u4E0E --params \u4E92\u65A5\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((spec, opts) => actionCommand(spec, opts));
+program.command("create <Model>").description("\u521B\u5EFA\u4E00\u6761 Model \u8BB0\u5F55\uFF08\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF09").option("--data <JSON>", `\u8BB0\u5F55\u5B57\u6BB5 JSON\uFF0C\u4F8B\u5982 '{"code":"ORG_SALES","name":"\u9500\u552E\u90E8"}'`).option("--data-file <path>", "\u4ECE UTF-8 JSON \u6587\u4EF6\u8BFB\u53D6\u8BB0\u5F55\u5B57\u6BB5\uFF08\u4E0E --data \u4E92\u65A5\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((m, opts) => createCommand(m, opts));
 program.command("delete <Model>").description("\u5220\u9664\u4E00\u6761 Model \u8BB0\u5F55\uFF08\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF1B\u90E8\u5206 Model \u4F1A\u6267\u884C\u4E1A\u52A1\u64A4\u9500\uFF09").option("--id <id>", "\u76EE\u6807\u5B9E\u4F53 ID\uFF08\u5FC5\u586B\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((m, opts) => deleteCommand(m, opts));
 program.command("import <path>").description("\u6CE8\u5165 DataPackage YAML \u6570\u636E\u96C6\uFF08\u76EE\u5F55\u6216\u5355\u6587\u4EF6\uFF0C\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF09").option("--dry-run", "\u53EA\u8DD1\u5BA2\u6237\u7AEF\u9759\u6001\u6821\u9A8C\uFF0C\u4E0D\u843D\u5E93\uFF08\u89C1 spec \xA78 \u9650\u5236\uFF09").option("--update-only", "\u5DF2\u5B58\u5728\uFF08\u6309 key_field\uFF09\u5219 PUT \u66F4\u65B0\uFF0C\u5426\u5219 create").option("--on-error <mode>", "stop | continue\uFF08\u9ED8\u8BA4 continue\uFF09", "continue").option("--report <path>", "\u5199 JSON \u6CE8\u5165\u62A5\u544A\uFF08\u9010\u884C\u7ED3\u679C + key\u2192id \u6620\u5C04\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((p, opts) => importCommand(p, opts));
 program.command("describe <Model>").description("\u67E5\u770B Model \u5143\u6570\u636E\uFF08\u5B57\u6BB5\u3001\u5173\u7CFB\u3001Action \u5217\u8868\uFF09").option("-v, --verbose", "\u663E\u793A\u5B57\u6BB5\u63CF\u8FF0\u4E0E enum \u53D6\u503C").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--profile <name>", "[deprecated] \u7528 --env \u66FF\u4EE3").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((m, opts) => describeCommand(m, opts));
@@ -8373,7 +8552,7 @@ skills.command("show <id>").description("\u6253\u5370\u6280\u80FD\u539F\u6587\uF
 skills.command("install [id]").description("\u8FDE\u540C requires \u524D\u7F6E\u6280\u80FD\u4E0E\u53C2\u8003\u6587\u4EF6\u88C5\u5230 agent \u6280\u80FD\u76EE\u5F55\uFF1B--all \u88C5\u6574\u4E2A\u6280\u80FD\u5E93").option("--all", "\u88C5\u6574\u4E2A\u6280\u80FD\u5E93\uFF0C\u5E76\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D\uFF08\u5F80\u540E update \u4F1A\u81EA\u52A8\u8865\u4E0A\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\uFF09").option("--target <agent>", "\u88C5\u7ED9\u54EA\u4E2A agent\uFF1Aclaude\uFF08.claude/skills/\uFF09| codex\uFF08hcm-skills/ + AGENTS.md\uFF09| auto", "auto").option("--global", "\u88C5\u5230\u7528\u6237\u7EA7\u76EE\u5F55\u800C\u975E\u5F53\u524D\u9879\u76EE").option("--dir <path>", "\u88C5\u5230\u6307\u5B9A\u76EE\u5F55").option("--from <dir>", "\u4ECE\u672C\u5730\u76EE\u5F55\u88C5\uFF08\u73B0\u573A\u6539\u8FC7\u7684\u7248\u672C\uFF09\uFF0C\u4E0D\u8D70\u7F51\u7EDC").option("--force", "\u8986\u76D6\u5DF2\u5B58\u5728\u7684\u540C\u540D\u6280\u80FD").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((id, opts) => skillsInstallCommand(id, opts));
 skills.command("sync <id>").description("\u4ECE\u76EE\u6807\u5B9E\u4F8B\u540C\u6B65 Skill \u95ED\u5305\u5230 WorkBuddy \u9879\u76EE\u5E76\u5199 chiron.lock").requiredOption("--target <agent>", "\u76EE\u6807 Agent \u5BBF\u4E3B\uFF1B\u5F53\u524D\u652F\u6301 workbuddy").requiredOption("--project <path>", "WorkBuddy \u9879\u76EE\u6839\u76EE\u5F55").option("--cli <path>", "\u663E\u5F0F\u6307\u5B9A\u8981\u9501\u5B9A\u5230\u9879\u76EE\u7684 HCM CLI\uFF1B\u9ED8\u8BA4\u4F7F\u7528\u5F53\u524D\u8FD9\u4EFD CLI").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((id, opts) => skillsSyncCommand(id, opts));
 skills.command("update").description("\u628A\u88C5\u8FC7\u7684\u6280\u80FD\u5347\u5230\u76EE\u6807\u73AF\u5883\u8FD9\u4E00\u7248\uFF08\u4EA7\u54C1\u5347\u7EA7\u540E\u8DD1\u5B83\uFF09").option("--all", "\u8FDE\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\u4E00\u8D77\u88C5\u4E0A\uFF0C\u5E76\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D").option("--check", "\u53EA\u770B\u4F1A\u53D8\u4EC0\u4E48\uFF0C\u4E0D\u5199\u76D8").option("--target <agent>", "claude | codex | auto\uFF08\u9ED8\u8BA4\u6309\u5DF2\u5B89\u88C5\u76EE\u5F55\u63A2\uFF09", "auto").option("--global", "\u5347\u7EA7\u7528\u6237\u7EA7\u76EE\u5F55\u91CC\u7684\u6280\u80FD").option("--dir <path>", "\u5347\u7EA7\u6307\u5B9A\u76EE\u5F55\u91CC\u7684\u6280\u80FD").option("--force", "\u8FDE\u672C\u5730\u6539\u8FC7\u7684\u6280\u80FD\u4E00\u8D77\u8986\u76D6\u6210\u4EA7\u54C1\u8FD9\u4E00\u7248").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6\u5B89\u88C5\u65F6\u8BB0\u5F55\u7684\u5730\u5740\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((opts) => skillsUpdateCommand(opts));
-program.command("update <Model>").description("\u66F4\u65B0\u4E00\u6761 Model \u8BB0\u5F55\uFF08\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF09").requiredOption("--id <id>", "\u8BB0\u5F55 ID").requiredOption("--data <JSON>", `\u8981\u66F4\u65B0\u7684\u5B57\u6BB5 JSON\uFF0C\u4F8B\u5982 '{"name":"\u65B0\u540D\u79F0"}'`).option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((model, opts) => updateCommand(model, opts));
+program.command("update <Model>").description("\u66F4\u65B0\u4E00\u6761 Model \u8BB0\u5F55\uFF08\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF09").requiredOption("--id <id>", "\u8BB0\u5F55 ID").option("--data <JSON>", `\u8981\u66F4\u65B0\u7684\u5B57\u6BB5 JSON\uFF0C\u4F8B\u5982 '{"name":"\u65B0\u540D\u79F0"}'`).option("--data-file <path>", "\u4ECE UTF-8 JSON \u6587\u4EF6\u8BFB\u53D6\u66F4\u65B0\u5B57\u6BB5\uFF08\u4E0E --data \u4E92\u65A5\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((model, opts) => updateCommand(model, opts));
 program.command("version").description("\u67E5\u540E\u7AEF\u7248\u672C\uFF08commit / tag / \u6784\u5EFA\u65F6\u95F4\uFF09\u2014\u2014\u514D\u8BA4\u8BC1\uFF0C\u65E0\u9700\u5148 login").option("--endpoint <url>", "\u540E\u7AEF\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => versionCommand(opts));
 var setting = program.command("setting").description("\u79DF\u6237\u7CFB\u7EDF\u53C2\u6570\uFF08\u767B\u5F55\u7B56\u7565 / \u5BC6\u7801\u7B56\u7565 / \u529F\u80FD\u5F00\u5173 / \u96C6\u6210\u53C2\u6570\uFF09");
 setting.command("get <domain>").description("\u8BFB\u67D0\u57DF\u53C2\u6570\uFF08\u5B9A\u4E49 + \u79DF\u6237\u8986\u76D6\u503C\u5408\u5E76\uFF0C\u7F3A\u5931\u56DE\u843D\u9ED8\u8BA4\u503C\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((d, opts) => settingGetCommand(d, opts));