@hcmai/cli 0.3.2 → 0.3.4

package/dist/index.js

@@ -2034,6 +2034,11 @@ async function readStdin() {
   for await (const chunk of process.stdin) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf-8").trim();
 }
+async function readSecretFromStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf-8").replace(/\r?\n$/, "");
+}
 async function promptConfirm(question) {
   const ans = await promptText(question);
   return /^y(es)?$/i.test(ans.trim());
@@ -2281,9 +2286,9 @@ async function loginCommand(args) {
   } catch (e) {
     const err = e;
     if (err.isAxiosError) {
-      const { fromAxiosError: fromAxiosError17 } = await import("@hcmai/sdk");
+      const { fromAxiosError: fromAxiosError18 } = await import("@hcmai/sdk");
       exitWithError(
-        fromAxiosError17(
+        fromAxiosError18(
           e,
           envName
         )
@@ -2498,13 +2503,13 @@ async function envRemove(name, args) {
       }
     }
     const ids = await listIdentities(name);
-    const failed = [];
+    const failed2 = [];
     for (const id of ids) {
       try {
         await TokenStore2.forIdentity(id).clear();
         await deleteIdentity(id);
       } catch (err) {
-        failed.push(id);
+        failed2.push(id);
         process.stderr.write(
           `[hcm] event=identity_cleanup_failed identity=${id} reason=${JSON.stringify(String(err.message))}
 `
@@ -2517,9 +2522,9 @@ async function envRemove(name, args) {
       g.activeEnv = "default";
       await saveGlobalConfig2(g);
     }
-    const removedCount = ids.length - failed.length;
+    const removedCount = ids.length - failed2.length;
     const noun = (n) => n === 1 ? "identity" : "identities";
-    const failPart = failed.length > 0 ? `, ${failed.length} ${noun(failed.length)} failed: ${failed.join(", ")}` : "";
+    const failPart = failed2.length > 0 ? `, ${failed2.length} ${noun(failed2.length)} failed: ${failed2.join(", ")}` : "";
     exitOk(`\u2705 env '${name}' removed (${removedCount} ${noun(removedCount)} removed${failPart})`);
   } catch (e) {
     exitWithError(e);
@@ -7563,9 +7568,15 @@ async function identityRemove(name) {
   }
 }
 
+// src/commands/delivery-action-policy.ts
+init_auth_guard();
+import {
+  HcmClient as HcmClient17,
+  formatObject as formatObject17
+} from "@hcmai/sdk";
+
 // src/commands/delivery.ts
 import { createHash as createHash5 } from "crypto";
-import { formatObject as formatObject17 } from "@hcmai/sdk";
 var APPROVAL_BYPASS_FLAGS = /* @__PURE__ */ new Set(["-y", "--yes", "--force", "--auto-approve"]);
 var CREDENTIAL_FLAGS = /* @__PURE__ */ new Set([
   "--password",
@@ -7581,18 +7592,22 @@ var GUARDED_EXECUTOR_REASON_CODES = /* @__PURE__ */ new Set([
   "record-create",
   "record-update",
   "cache-mutation",
-  "setting-write"
+  "setting-write",
+  "credential-reset",
+  "action-write"
 ]);
-function assessDeliveryCommand(inputArgv) {
+function assessDeliveryCommand(inputArgv, options = {}) {
   const argv = inputArgv[0] === "--" ? inputArgv.slice(1) : [...inputArgv];
   const commandSha256 = sha2565(JSON.stringify(argv));
   const name = argv[0] ?? "";
   const subcommand = argv[1] && !argv[1].startsWith("-") ? argv[1] : void 0;
   const envAlias = flagValue(argv, "--env");
   const identityAlias = flagValue(argv, "--as");
-  const sensitiveFlags = [...new Set(PAYLOAD_FLAGS.filter((flag) => hasFlag(argv, flag)))];
-  const target = summarizeTarget(argv);
-  let classification = classify(argv);
+  const sensitiveFlags = [
+    ...new Set([...PAYLOAD_FLAGS, ...CREDENTIAL_FLAGS].filter((flag) => hasFlag(argv, flag)))
+  ];
+  const target = summarizeTarget(argv, options.actionResolution);
+  let classification = classify(argv, options.actionResolution);
   const invalidPayload = payloadError(argv);
   if (invalidPayload) {
     classification = forbidden("invalid-input", "JSON payload \u65E0\u6548\uFF0C\u4E0D\u80FD\u8FDB\u5165\u4EFB\u4F55\u6267\u884C\u8DEF\u5F84\u3002");
@@ -7613,8 +7628,8 @@ function assessDeliveryCommand(inputArgv) {
   const allowed = classification.risk === "R0" || classification.risk === "R1";
   return {
     schemaVersion: 1,
-    contractVersion: "2026-08-28",
-    assessmentId: sha2565(`2026-08-28
+    contractVersion: "2026-08-29",
+    assessmentId: sha2565(`2026-08-29
 ${commandSha256}`).slice(0, 24),
     commandSha256,
     command: { name: name || "(empty)", ...subcommand ? { subcommand } : {} },
@@ -7634,16 +7649,25 @@ ${commandSha256}`).slice(0, 24),
     }
   };
 }
-function deliveryAssessCommand(argv, args) {
-  const assessment = assessDeliveryCommand(argv);
-  process.stdout.write(formatObject17(assessment, { format: args.output ?? "json" }) + "\n");
-}
-function classify(argv) {
+function classify(argv, actionResolution) {
   const name = argv[0] ?? "";
   const subcommand = argv[1] ?? "";
   if (argv.some((arg) => APPROVAL_BYPASS_FLAGS.has(flagName(arg)))) {
     return forbidden("approval-bypass", "\u547D\u4EE4\u5305\u542B\u8DF3\u8FC7\u786E\u8BA4\u7684\u65D7\u6807\uFF0C\u987E\u95EE\u4EA4\u4ED8\u9762\u4E0D\u6267\u884C\u3002");
   }
+  if (name === "user" && subcommand === "reset-password") {
+    const nonStdinCredential = argv.some((arg) => {
+      const flag = flagName(arg);
+      return CREDENTIAL_FLAGS.has(flag) && flag !== "--password-stdin";
+    });
+    if (nonStdinCredential || !argv.includes("--password-stdin")) {
+      return forbidden(
+        "credential-governance",
+        "\u7528\u6237\u5BC6\u7801\u91CD\u7F6E\u53EA\u80FD\u901A\u8FC7 --password-stdin \u8FDB\u5165\u53D7\u63A7\u51ED\u636E\u6D41\u7A0B\u3002"
+      );
+    }
+    return guarded("credential-write", "credential-reset");
+  }
   if (argv.some((arg) => CREDENTIAL_FLAGS.has(flagName(arg)))) {
     return forbidden("credential-governance", "\u547D\u4EE4\u643A\u5E26\u8EAB\u4EFD\u51ED\u636E\u53C2\u6570\uFF0C\u5FC5\u987B\u8F6C\u4EA4\u8EAB\u4EFD\u6CBB\u7406\u6D41\u7A0B\u3002");
   }
@@ -7726,9 +7750,15 @@ function classify(argv) {
   if (name === "upload") return guarded("tenant-write", "document-upload");
   if (name === "download") return direct("R1", "managed-local-write", "document-download");
   if (name === "action") {
+    if (actionResolution?.status === "resolved") {
+      return classifyAction(actionResolution.policy);
+    }
+    if (actionResolution?.status === "failed") {
+      return forbidden(actionResolution.reasonCode, actionResolution.reason);
+    }
     return forbidden(
       "action-effect-unclassified",
-      "Action \u5C1A\u65E0\u7EDF\u4E00 destructive/publish \u8BED\u4E49\uFF0C\u9996\u7248\u4E0D\u80FD\u6309\u540D\u79F0\u731C\u6D4B\u540E\u653E\u884C\u3002"
+      "\u5C1A\u672A\u8BFB\u53D6 Core Action \u98CE\u63A7\u58F0\u660E\uFF0C\u4E0D\u80FD\u6309\u540D\u79F0\u731C\u6D4B\u540E\u653E\u884C\u3002"
     );
   }
   if (name === "delete" || name === "meta" && subcommand === "delete") {
@@ -7745,14 +7775,19 @@ function classify(argv) {
   }
   return forbidden("unknown-command", "\u672A\u77E5\u547D\u4EE4\u6309\u6700\u9AD8\u98CE\u9669\u5173\u95ED\u3002");
 }
-function summarizeTarget(argv) {
+function summarizeTarget(argv, actionResolution) {
   const name = argv[0] ?? "";
   const subcommand = argv[1] ?? "";
   const target = {};
   if (["query", "describe", "create", "update", "delete"].includes(name) && subcommand) {
     target.model = subcommand;
   }
-  if (name === "action" && subcommand) target.action = subcommand;
+  if (name === "action" && subcommand) {
+    target.action = subcommand;
+    if (actionResolution?.status === "resolved") {
+      target.actionPolicy = { ...actionResolution.policy };
+    }
+  }
   if (name === "skills" && argv[2] && !argv[2].startsWith("-")) target.skill = argv[2];
   if (name === "meta" && argv[2] && !argv[2].startsWith("-")) target.path = argv[2];
   if (name === "cache" && argv[2] && !argv[2].startsWith("-")) {
@@ -7765,7 +7800,14 @@ function summarizeTarget(argv) {
     if (settingKeys.length > 0) target.settingKeys = settingKeys;
   }
   const id = flagValue(argv, "--id");
-  if (id) target.recordIdSha256 = sha2565(id);
+  if (name === "user" && subcommand === "reset-password") {
+    if (id) target.userIdSha256 = sha2565(id);
+    const username = flagValue(argv, "--username");
+    if (username) target.usernameSha256 = sha2565(username);
+    target.forceChangeOnNextLogin = !hasFlag(argv, "--no-force-change");
+  } else if (id) {
+    target.recordIdSha256 = sha2565(id);
+  }
   for (const flag of PAYLOAD_FLAGS) {
     const raw = flagValue(argv, flag);
     if (!raw) continue;
@@ -7809,6 +7851,18 @@ function guarded(effect, reasonCode) {
     reason: "\u666E\u901A\u526F\u4F5C\u7528\u64CD\u4F5C\uFF1B\u53EA\u5141\u8BB8\u5728 controlled \u9879\u76EE\u4E2D\u901A\u8FC7 delivery prepare + delivery execute \u5355\u6B21\u53D7\u63A7\u6267\u884C\u3002"
   };
 }
+function classifyAction(policy) {
+  if (policy.readOnly) {
+    return {
+      risk: "R1",
+      execution: "direct",
+      effect: "remote-read",
+      reasonCode: "action-read-only",
+      reason: "Core \u58F0\u660E\u8BE5 Action \u4E3A\u53EA\u8BFB\uFF0C\u4E0E Moirai \u7684\u53EA\u8BFB Action \u8DEF\u5F84\u4E00\u81F4\uFF0C\u53EF\u76F4\u63A5\u6267\u884C\u3002"
+    };
+  }
+  return guarded("tenant-write", "action-write");
+}
 function forbidden(reasonCode, reason) {
   return { risk: "R3", execution: "forbidden", effect: reasonCode, reasonCode, reason };
 }
@@ -7861,6 +7915,104 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/commands/delivery-action-policy.ts
+async function assessEffectiveDeliveryCommand(inputArgv, dependencies = {}) {
+  const local = assessDeliveryCommand(inputArgv);
+  if (local.reasonCode !== "action-effect-unclassified") return local;
+  const request = parseActionRequest(inputArgv);
+  if ("status" in request) {
+    return assessDeliveryCommand(inputArgv, { actionResolution: request });
+  }
+  const resolution = await (dependencies.resolveAction ?? resolveCoreAction)(request);
+  return assessDeliveryCommand(inputArgv, { actionResolution: resolution });
+}
+async function deliveryAssessCommand(argv, args) {
+  const assessment = await assessEffectiveDeliveryCommand(argv);
+  process.stdout.write(formatObject17(assessment, { format: args.output ?? "json" }) + "\n");
+}
+async function resolveCoreAction(request) {
+  try {
+    const auth = await getActiveAuthContextFromCli({
+      env: request.env,
+      as: request.identity,
+      profile: request.profile
+    });
+    const description = await HcmClient17.fromAuthContext(auth).describe(request.model);
+    const matches = description.actions.filter((action2) => matchesRequest(action2, request));
+    if (matches.length === 0) {
+      return failed(
+        "action-metadata-not-found",
+        "Core \u5143\u6570\u636E\u4E2D\u6CA1\u6709\u4E0E\u672C\u6B21 method/scope \u7CBE\u786E\u5339\u914D\u7684 Action\uFF0C\u62D2\u7EDD\u6267\u884C\u3002"
+      );
+    }
+    if (matches.length > 1) {
+      return failed(
+        "action-metadata-ambiguous",
+        "Core \u5143\u6570\u636E\u5B58\u5728\u591A\u4E2A\u4E0E\u672C\u6B21 method/scope \u5339\u914D\u7684 Action\uFF0C\u65E0\u6CD5\u552F\u4E00\u5224\u5B9A\uFF0C\u62D2\u7EDD\u6267\u884C\u3002"
+      );
+    }
+    const action = matches[0];
+    if (typeof action.readOnly !== "boolean") {
+      return failed(
+        "action-readonly-unclassified",
+        "Core \u672A\u8FD4\u56DE Action \u7684 readOnly \u58F0\u660E\uFF0C\u6309\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD\u6267\u884C\u3002"
+      );
+    }
+    return {
+      status: "resolved",
+      policy: {
+        scope: action.scope,
+        httpMethod: action.httpMethod.toUpperCase(),
+        readOnly: action.readOnly,
+        ...action.source ? { source: action.source } : {}
+      }
+    };
+  } catch {
+    return failed(
+      "action-metadata-unavailable",
+      "\u65E0\u6CD5\u8BFB\u53D6 Core Action \u5143\u6570\u636E\uFF0C\u6309\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD\u6267\u884C\u3002"
+    );
+  }
+}
+function matchesRequest(action, request) {
+  return action.name === request.action && action.httpMethod?.toUpperCase() === request.httpMethod && action.scope?.toLowerCase() === request.scope;
+}
+function parseActionRequest(inputArgv) {
+  const argv = inputArgv[0] === "--" ? inputArgv.slice(1) : [...inputArgv];
+  const spec = argv[1] ?? "";
+  const separator = spec.indexOf(".");
+  if (separator <= 0 || separator === spec.length - 1) {
+    return failed("invalid-action-spec", "Action \u5FC5\u987B\u4F7F\u7528 <Model>.<Action> \u683C\u5F0F\u3002");
+  }
+  const httpMethod = (flagValue2(argv, "--method") ?? "POST").toUpperCase();
+  if (!["GET", "POST", "PUT", "DELETE"].includes(httpMethod)) {
+    return failed("invalid-action-method", "Action method \u5FC5\u987B\u662F GET\u3001POST\u3001PUT \u6216 DELETE\u3002");
+  }
+  const explicitScope = flagValue2(argv, "--scope");
+  const scope = explicitScope ?? (flagValue2(argv, "--id") ? "object" : "class");
+  if (scope !== "class" && scope !== "object") {
+    return failed("invalid-action-scope", "Action scope \u5FC5\u987B\u662F class \u6216 object\u3002");
+  }
+  return {
+    model: spec.slice(0, separator),
+    action: spec.slice(separator + 1),
+    httpMethod,
+    scope,
+    env: flagValue2(argv, "--env"),
+    identity: flagValue2(argv, "--as"),
+    profile: flagValue2(argv, "--profile")
+  };
+}
+function failed(reasonCode, reason) {
+  return { status: "failed", reasonCode, reason };
+}
+function flagValue2(argv, flag) {
+  const equals = argv.find((arg) => arg.startsWith(`${flag}=`));
+  if (equals) return equals.slice(flag.length + 1);
+  const index = argv.indexOf(flag);
+  return index >= 0 ? argv[index + 1] : void 0;
+}
+
 // src/commands/delivery-execution.ts
 import { createHash as createHash6, randomBytes as secureRandomBytes } from "crypto";
 import { spawn } from "child_process";
@@ -7876,7 +8028,7 @@ var PLAN_ID_PATTERN = /^[a-f0-9]{24}$/;
 async function prepareDeliveryExecution(input) {
   const project = await realProject(input.project);
   await readProjectMode(project);
-  const assessment = assessDeliveryCommand(input.argv);
+  const assessment = await (input.assessCommand ?? assessEffectiveDeliveryCommand)(input.argv);
   assertGuardedAssessment(assessment, input.argv);
   const ttlSeconds = input.ttlSeconds ?? DEFAULT_TTL_SECONDS;
   if (!Number.isInteger(ttlSeconds) || ttlSeconds < MIN_TTL_SECONDS || ttlSeconds > MAX_TTL_SECONDS) {
@@ -7939,7 +8091,7 @@ async function executeDeliveryPlan(input) {
   }
   if (now.getTime() < createdAt - 5e3) throw invalid4("\u5F53\u524D\u65F6\u95F4\u65E9\u4E8E\u8BA1\u5212\u521B\u5EFA\u65F6\u95F4");
   if (now.getTime() > expiresAt) throw invalid4("\u6267\u884C\u8BA1\u5212\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0 prepare");
-  const assessment = assessDeliveryCommand(input.argv);
+  const assessment = await (input.assessCommand ?? assessEffectiveDeliveryCommand)(input.argv);
   assertGuardedAssessment(assessment, input.argv);
   if (canonicalJson(assessment) !== canonicalJson(plan.assessment)) {
     throw invalid4("\u5B9E\u9645 argv \u4E0E\u6267\u884C\u8BA1\u5212\u7684\u547D\u4EE4\u6458\u8981\u6216\u98CE\u9669\u4E8B\u5B9E\u4E0D\u4E00\u81F4");
@@ -8116,6 +8268,32 @@ function assertGuardedAssessment(assessment, argv) {
   validateSupportedCommandShape(assessment.reasonCode, argv);
 }
 function validateSupportedCommandShape(reasonCode, argv) {
+  if (reasonCode === "credential-reset") {
+    if (argv[0] !== "user" || argv[1] !== "reset-password") {
+      throw invalid4("credential-reset \u53EA\u652F\u6301 user reset-password");
+    }
+    const userId = optionalFlagValue(argv, "--id");
+    const username = optionalFlagValue(argv, "--username");
+    if (Boolean(userId) === Boolean(username)) {
+      throw invalid4("user reset-password \u5FC5\u987B\u4E14\u53EA\u80FD\u5305\u542B --id \u6216 --username");
+    }
+    if (!argv.includes("--password-stdin")) {
+      throw invalid4("user reset-password \u5FC5\u987B\u5305\u542B\u72EC\u7ACB\u7684 --password-stdin");
+    }
+    if (argv.some(
+      (value) => [
+        "--password",
+        "--new-password",
+        "--client-secret",
+        "--pat",
+        "--new-password-stdin",
+        "--pat-stdin"
+      ].includes(value.split("=", 1)[0] ?? "")
+    ) || argv.some((value) => value.startsWith("--password-stdin="))) {
+      throw invalid4("user reset-password \u4E0D\u5141\u8BB8\u5728 argv \u4E2D\u643A\u5E26\u660E\u6587\u51ED\u636E");
+    }
+    return;
+  }
   if (reasonCode === "record-create") {
     requireFlagValue(argv, "--data", "create \u5FC5\u987B\u5305\u542B --data <JSON>");
     return;
@@ -8140,6 +8318,19 @@ function validateSupportedCommandShape(reasonCode, argv) {
     }
   }
 }
+function optionalFlagValue(argv, flag) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === flag) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("-") ? next : void 0;
+    }
+    if (value?.startsWith(`${flag}=`) && value.length > flag.length + 1) {
+      return value.slice(flag.length + 1);
+    }
+  }
+  return void 0;
+}
 function requireFlagValue(argv, flag, message) {
   for (let index = 0; index < argv.length; index += 1) {
     const value = argv[index];
@@ -8318,6 +8509,65 @@ function invalid4(message, cause) {
   return new CliError20({ code: CliErrorCode19.INVALID_ARGUMENT, message, cause });
 }
 
+// src/commands/user.ts
+init_auth_guard();
+init_exit();
+import {
+  HcmClient as HcmClient18,
+  adminResetPassword,
+  formatObject as formatObject19,
+  fromAxiosError as fromAxiosError17,
+  CliError as CliError21,
+  CliErrorCode as CliErrorCode20
+} from "@hcmai/sdk";
+function buildAdminResetPasswordRequest(args, password) {
+  const hasId = Boolean(args.id);
+  const hasUsername = Boolean(args.username);
+  if (hasId === hasUsername) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "--id <uuid> \u4E0E --username <user> \u5FC5\u987B\u4E14\u53EA\u80FD\u63D0\u4F9B\u4E00\u4E2A"
+    });
+  }
+  if (!password) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "\u65B0\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A"
+    });
+  }
+  return {
+    ...args.id ? { userId: args.id } : {},
+    ...args.username ? { username: args.username } : {},
+    newPassword: password,
+    confirmPassword: password,
+    forceChangeOnNextLogin: args.forceChange !== false
+  };
+}
+async function userResetPasswordCommand(args) {
+  try {
+    const password = args.passwordStdin ? await readSecretFromStdin() : await promptPasswordTwice();
+    const request = buildAdminResetPasswordRequest(args, password);
+    const client3 = HcmClient18.fromAuthContext(await getActiveAuthContextFromCli(args));
+    const result2 = await adminResetPassword(client3.raw(), request);
+    process.stdout.write(formatObject19(result2, { format: args.output ?? "json" }) + "\n");
+  } catch (cause) {
+    const err = cause;
+    if (err?.isAxiosError) exitWithError(fromAxiosError17(err, args.env));
+    exitWithError(cause);
+  }
+}
+async function promptPasswordTwice() {
+  const password = await promptSecret("\u65B0\u5BC6\u7801: ");
+  const confirmation = await promptSecret("\u518D\u6B21\u8F93\u5165\u65B0\u5BC6\u7801: ");
+  if (password !== confirmation) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "\u4E24\u6B21\u8F93\u5165\u7684\u65B0\u5BC6\u7801\u4E0D\u4E00\u81F4"
+    });
+  }
+  return password;
+}
+
 // src/startup.ts
 function needsLegacyProfileMigration(argv) {
   const args = argv.slice(2);
@@ -8355,8 +8605,10 @@ var identity = program.command("identity").description("\u7BA1\u7406 HCM \u8EAB\
 identity.command("list").description("\u5217\u51FA identity\uFF08\u9ED8\u8BA4\u5217\u5F53\u524D env\uFF0C--env all \u5217\u5168\u90E8\uFF09").option("--env <name>", '\u8FC7\u6EE4 env\uFF1B\u4F20 "all" \u5217\u5168\u90E8', void 0).action((opts) => identityList(opts));
 identity.command("use <name>").description("\u628A identity \u8BBE\u4E3A\u5176 env \u7684 default identity").action((name) => identityUse(name));
 identity.command("remove <name>").description("\u5220\u9664 identity\uFF08\u6E05 token + \u82E5\u662F env default \u5219\u6E05\u7A7A\uFF09").action((name) => identityRemove(name));
+var user = program.command("user").description("\u7BA1\u7406\u79DF\u6237\u7528\u6237\u7684\u4E13\u7528\u51ED\u636E\u6D41\u7A0B");
+user.command("reset-password").description("\u7531 admin.system \u5B89\u5168\u91CD\u7F6E\u7528\u6237\u5BC6\u7801\uFF0C\u5E76\u4F7F\u65E2\u6709\u4F1A\u8BDD\u5931\u6548").option("--id <uuid>", "\u76EE\u6807\u7528\u6237 ID\uFF08\u4E0E --username \u4E8C\u9009\u4E00\uFF09").option("--username <user>", "\u76EE\u6807\u7528\u6237\u540D\uFF08\u4E0E --id \u4E8C\u9009\u4E00\uFF09").option("--password-stdin", "\u4ECE\u6807\u51C6\u8F93\u5165\u8BFB\u53D6\u65B0\u5BC6\u7801\uFF08Agent/\u53D7\u63A7\u4EA4\u4ED8\u5FC5\u987B\u4F7F\u7528\uFF09").option("--no-force-change", "\u4E0B\u6B21\u767B\u5F55\u4E0D\u5F3A\u5236\u6539\u5BC6\uFF08\u4EC5\u9650\u5DF2\u6279\u51C6\u7684\u9694\u79BB\u6D4B\u8BD5\u73AF\u5883\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u5FC5\u987B\u5177\u5907 admin.system\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => userResetPasswordCommand(opts));
 var delivery = program.command("delivery").description("\u987E\u95EE\u4EA4\u4ED8\u547D\u4EE4\u7684\u98CE\u9669\u8BC4\u4F30\u4E0E\u4E00\u6B21\u6027\u53D7\u63A7\u6267\u884C\u5408\u540C");
-delivery.command("assess").description("\u7EAF\u672C\u5730\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1B\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
+delivery.command("assess").description("\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1BAction \u98CE\u63A7\u58F0\u660E\u8BFB\u53D6\u81EA\u76EE\u6807 Core\uFF0C\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
 delivery.command("prepare").description("\u628A\u53D7\u652F\u6301\u7684 R2 argv \u4E0E\u9501\u3001\u8FD0\u884C\u65F6\u548C\u53D8\u66F4/\u56DE\u6EDA\u8BF4\u660E\u7ED1\u5B9A\u4E3A\u77ED\u65F6\u6267\u884C\u8BA1\u5212").requiredOption("--change-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u53D8\u66F4\u8BF4\u660E").requiredOption("--rollback-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u56DE\u6EDA\u8BF4\u660E").requiredOption("--evidence-dir <dir>", "\u9879\u76EE evidence/ \u4E0B\u7684\u6536\u636E\u76EE\u5F55").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--ttl-seconds <n>", "\u6709\u6548\u671F\u79D2\u6570\uFF0860-3600\uFF09", "900").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u7ED1\u5B9A\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryPrepareCommand(command, opts));
 delivery.command("execute <planId>").description("\u9010\u6B21\u6279\u51C6\u540E\u6D88\u8D39\u77ED\u65F6\u8BA1\u5212\uFF0C\u5E76\u6267\u884C\u4E00\u6B21\u4E0E\u8BA1\u5212\u5B8C\u5168\u76F8\u540C\u7684 R2 argv").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--output <fmt>", "\u6536\u636E\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u4E0E prepare \u5B8C\u5168\u76F8\u540C\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570").action((planId, command, opts) => deliveryExecuteCommand(planId, command, opts));
 program.command("query <Model>").description("\u67E5\u8BE2 Model \u5217\u8868\u6570\u636E\uFF08\u901A\u8FC7 ModelQueryDsl JSON \u8868\u8FBE\u8FC7\u6EE4/\u6392\u5E8F/\u5206\u9875\uFF09").option(