@kin-tio/cli 0.6.2 → 0.7.1

package/.env.example

@@ -28,8 +28,10 @@ WECOM_AUTH_CONFIRMATION=Code accepted. You can continue the conversation.
 # WECOM_MCP_OBSERVE_MS=5000
 # SHUTDOWN_TIMEOUT_MS=10000
 
-# Optional Weixin iLink channel. Generate a 32-byte base64url key and keep it in
-# the deployment secret store; Bot and context tokens are encrypted with it.
+# Enable Weixin iLink inside the combined `kintio start` runtime. Standalone
+# `kintio ilink login` and `kintio ilink start` do not require this flag.
+# Generate a 32-byte base64url key and keep it in the deployment secret store;
+# Bot and context tokens are encrypted with it.
 ILINK_ENABLED=false
 # Prefer a deployment-secret value. If omitted, the service creates a private
 # 0600 key file beside SQLite; never register that key with a chat Agent.

package/CHANGELOG.md

@@ -4,6 +4,40 @@ This file records important user-visible changes after the first public release.
 
 ## Unreleased
 
+## 0.7.1
+
+- Made `kintio ilink start` use the managed background daemon by default while
+  retaining `--foreground` for external service managers, simplified
+  `kintio ilink list` to reusable provider account IDs, rejected Node.js below
+  24 before application startup, and added sanitized Codex request diagnostics
+  ([#65](https://github.com/Gkxie/kintio/issues/65)).
+
+## 0.7.0
+
+- Added `kintio ilink login`, which reuses the iLink enrollment state machine
+  while rendering its five-minute QR code directly in an interactive terminal;
+  no WeChat KF conversation or Agent turn is required. Accounts
+  enrolled locally receive host-level Agent access and inherit the host runtime
+  configuration, while remotely offered iLink accounts remain restricted
+  ([#54](https://github.com/Gkxie/kintio/issues/54)).
+- Added an explicit `--qr-output <file>` view for `kintio ilink login`, allowing
+  graphical and non-terminal callers to consume a temporary raw PNG directly
+  from the QR payload without parsing ANSI terminal output. The file is created
+  exclusively and removed when the login attempt ends
+  ([#57](https://github.com/Gkxie/kintio/issues/57)).
+- Made iLink a standalone lifecycle: `kintio ilink login` now initializes and
+  persists an account without setup, an environment file, Hono, or a running
+  Worker, while safely delegating to a running instance when present;
+  `kintio ilink start` starts polling and the host Agent in the foreground without
+  a public HTTP listener. The iLink Runtime configuration no longer contains a
+  synthetic WeChat KF adapter
+  ([#59](https://github.com/Gkxie/kintio/issues/59)).
+- Added per-account `kintio ilink list`, `start`, `stop`, and confirmed `delete`
+  lifecycle commands. One Runtime can reconcile multiple selected listeners;
+  complete deletion atomically purges the selected account and all Kintio data
+  scoped to it while preserving unrelated accounts and channels
+  ([#60](https://github.com/Gkxie/kintio/issues/60)).
+
 ## 0.6.2
 
 - Added a custom Kintio wordmark and its circular-safe TIO avatar to the English

package/README.md

@@ -67,33 +67,68 @@ Prerequisites:
 
 ```bash
 npm install --global @kin-tio/cli
-kintio setup
 codex login status
 ```
 
-`kintio setup` creates a private instance under `~/.kintio`, installs the bundled Agent
-skill, and writes the channel configuration template. POSIX systems use mode `0600`;
-Windows keeps the instance inside the current user's profile. No adapter is enabled
-by default. Follow the [setup guide](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)
-and edit `~/.kintio/.env` to configure one adapter:
+For an iLink-only instance, no setup file or public HTTP listener is required:
 
-- For WeChat KF API, set its callback token, EncodingAESKey, CorpID, and secret. A temporary
-  `WECOM_AUTH_TRIGGER` can authorize the first user without knowing their
-  `external_userid` in advance.
-- For an existing Weixin iLink binding, set `ILINK_ENABLED=true`. Creating a new binding
-  currently starts from an authorized WeChat KF conversation.
+```bash
+kintio ilink login
+kintio ilink start
+```
 
-Start Kintio:
+`ilink login` performs one encrypted enrollment, starts no listener, and exits. `ilink start` then runs provider
+polling and the host Agent through the background daemon without Hono or a TCP listener.
+Use `--foreground` only when a service manager needs to own the process. Both commands
+use `~/.kintio` by default and accept `--home`. With multiple accounts, use `ilink list`
+and pass the displayed provider ID or account key through `--account`. Repeated `start`
+commands add accounts to the live runtime; `stop` removes one.
+
+For a callback-based adapter, create and edit the deployment configuration instead:
 
 ```bash
+kintio setup
 kintio start
 kintio status
 kintio logs --lines 100
 ```
 
-After startup, confirm that `kintio logs` contains `Hono server is listening on port 8888`.
-Complete the callback or binding checks described in the setup guide before sending traffic.
-Use `kintio run` when a foreground process is preferable to the native daemon.
+`kintio setup` creates a private instance under `~/.kintio`, installs the managed Agent
+skill, and writes the channel configuration template. Follow the
+[setup guide](https://github.com/Gkxie/kintio/blob/master/docs/setup.md):
+
+- For WeChat KF API, set its callback token, EncodingAESKey, CorpID, and secret. A temporary
+  `WECOM_AUTH_TRIGGER` can authorize the first user without knowing their
+  `external_userid` in advance.
+- A combined callback + iLink deployment may additionally set `ILINK_ENABLED=true`.
+
+For a graphical or non-terminal caller, select a temporary raw PNG instead of ANSI blocks:
+
+```bash
+kintio ilink login --qr-output ~/.kintio/ilink-login.png
+```
+
+The target must be directly inside the selected Kintio instance directory and must not
+already exist. Kintio removes the PNG when login succeeds, expires, is cancelled, or fails;
+the QR payload is never printed. Without `--qr-output`, the command
+requires an interactive terminal. Both forms stop waiting after five minutes and never
+start an Agent turn. The resulting iLink identity represents
+the local operator and inherits the host Agent configuration without Kintio's untrusted-
+channel capability restrictions. Show this QR code only to someone authorized to control
+the host Agent. Run `kintio ilink start` after enrollment to process messages without Hono.
+
+To permanently remove an account and every Kintio record scoped to it, use:
+
+```bash
+kintio ilink delete --account <provider-id-or-account-key> --yes
+```
+
+The explicit confirmation is mandatory. Credentials, conversations, messages, media,
+delivery records, and enrollment audit rows for that account are deleted atomically.
+
+For callback deployments, confirm that `kintio logs` contains
+`Hono server is listening on port 8888`. Use `kintio run` when a foreground process is
+preferable to the native daemon.
 Existing source-based deployments can keep their current state after the one-time
 process-manager migration described in the setup guide.
 
@@ -111,6 +146,9 @@ Source builds and contributor setup are documented in
   Hono route; every action still requires a short-lived conversation capability.
 - Project-level Agent capability restrictions are not an operating-system sandbox. Use a
   dedicated system account and additional isolation appropriate to the Agent's real powers.
+- An iLink account enrolled by `kintio ilink login` is explicitly host-authorized; its owner
+  receives the capabilities allowed by the host Agent configuration. Accounts enrolled from
+  a remote adapter remain restricted, and chat input cannot change this persisted trust level.
 - A provider accepting an outbound request does not prove that a client displayed it;
   uncertain outcomes remain explicit to avoid duplicate delivery.
 

package/README.zh-CN.md

@@ -43,25 +43,50 @@
 
 ```bash
 npm install --global @kin-tio/cli
-kintio setup
 codex login status
 ```
 
-`kintio setup` 会在 `~/.kintio` 创建私有实例目录、安装内置 Agent Skill，并生成渠道配置
-模板 `.env`。macOS/Linux 使用 `0600`，Windows 则限定在当前用户目录的 ACL
-边界内。默认不启用任何适配器；请按英文
-[部署指南](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)配置 WeChat KF API，或为已有 Weixin iLink 绑定设置
-`ILINK_ENABLED=true`。
+iLink 可以完全独立使用，不需要 `setup`、`.env` 或公网 HTTP：
 
 ```bash
+kintio ilink login
+kintio ilink start
+```
+
+`ilink login` 完成一次扫码、加密保存凭据后退出，不会自行启动监听；`ilink start` 不启动 Hono 或 TCP 端口，
+而是通过后台守护进程运行 iLink 长轮询和宿主 Agent。由外部进程管理器托管时可显式使用
+`--foreground`。两者默认使用 `~/.kintio`。
+存在多个账号时，先用 `kintio ilink list` 查看账号，再通过 `--account` 指定
+`start`、`stop` 或 `delete` 的目标；正在运行时可继续执行 `start` 增加监听账号。
+
+需要部署公网回调渠道时，再使用：
+
+```bash
+kintio setup
 kintio start
 kintio status
 kintio logs --lines 100
 ```
 
-启动后应确认 `kintio logs` 包含 `Hono server is listening on port 8888`；投入使用前仍需按
-部署指南完成回调或绑定验证。需要前台进程时使用 `kintio run`；现有源码目录部署可以在完成
-部署指南中的一次性进程管理器迁移后，继续使用原数据库和配置。
+具体配置见英文[部署指南](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)。
+
+图形界面或非交互调用方可以显式选择临时的原始 PNG，而不是解析终端字符：
+
+```bash
+kintio ilink login --qr-output ~/.kintio/ilink-login.png
+```
+
+目标文件必须直接位于所选 Kintio 实例目录中且不能预先存在；登录成功、过期、取消或失败后，Kintio 会自动删除该文件，并且
+不会打印二维码原始内容。二维码五分钟后过期；该命令不会唤醒 Agent。通过本机命令建立的 iLink 身份代表宿主机
+所有者的明确授权，后续对话直接继承宿主 Agent 配置，不再套用不可信渠道的能力限制。
+只应让获准控制宿主 Agent 的人扫描该二维码。登录后运行 `kintio ilink start` 即可在不
+启动 Hono 的情况下处理消息。
+
+`kintio ilink delete --account <账号> --yes` 会不可恢复地删除该账号及其在 Kintio
+中的凭据、会话、消息、媒体、发送记录和登录审计；`--yes` 为强制确认参数。
+
+公网回调部署启动后，应确认 `kintio logs` 包含
+`Hono server is listening on port 8888`。
 源码构建与贡献者开发环境见英文
 [贡献指南](https://github.com/Gkxie/kintio/blob/master/CONTRIBUTING.md)。
 

package/bin/kintio.js

@@ -1,3 +1,13 @@
 #!/usr/bin/env node
 
-await import('../dist/cli.js');
+const currentNode = process.versions.node;
+const nodeMajor = Number.parseInt(currentNode.split('.')[0] || '', 10);
+if (!Number.isSafeInteger(nodeMajor) || nodeMajor < 24) {
+  process.stderr.write(
+    `Kintio requires Node.js 24 or newer; current runtime is v${currentNode}.\n` +
+    'Install Node.js 24+, then reinstall @kin-tio/cli in that Node environment.\n',
+  );
+  process.exitCode = 1;
+} else {
+  await import('../dist/cli.js');
+}

package/dist/daemon.js

@@ -4,13 +4,18 @@ import { resolveProjectRoot } from './src/config.js';
 import { runNativeDaemon } from './src/runtime/native-daemon.js';
 const home = process.env.KINTIO_HOME;
 const configFile = process.env.KINTIO_CONFIG_FILE;
+const mode = process.env.KINTIO_DAEMON_MODE || 'service';
 if (!home || !configFile) {
     throw new Error('KINTIO_HOME and KINTIO_CONFIG_FILE are required for daemon mode');
 }
+if (mode !== 'service' && mode !== 'ilink') {
+    throw new Error(`Unsupported Kintio daemon mode: ${mode}`);
+}
 try {
     await runNativeDaemon({
         home: path.resolve(home),
         configFile: path.resolve(configFile),
+        mode,
         packageRoot: resolveProjectRoot(import.meta.url),
     });
 }

package/dist/ilink.js

@@ -0,0 +1,53 @@
+import { KINTIO_PACKAGE_ROOT, loadIlinkRuntimeConfig, } from './src/config.js';
+import { startIlinkCliRuntime } from './src/ilink/cli-start.js';
+import { installManagedSkill } from './src/runtime/managed-skill.js';
+const config = loadIlinkRuntimeConfig();
+installManagedSkill({
+    packageRoot: KINTIO_PACKAGE_ROOT,
+    workingDirectory: config.codex.workingDirectory,
+});
+const controller = new AbortController();
+let resolveParentShutdown;
+const parentShutdown = new Promise((resolve) => { resolveParentShutdown = resolve; });
+const shutdown = () => {
+    controller.abort();
+    resolveParentShutdown();
+};
+process.once('SIGINT', shutdown);
+process.once('SIGTERM', shutdown);
+const handleMessage = (message) => {
+    if (message === 'shutdown')
+        shutdown();
+};
+process.on('message', handleMessage);
+process.once('disconnect', shutdown);
+if (process.env.KINTIO_MANAGED_WORKER === '1' && !process.connected)
+    shutdown();
+try {
+    const result = await startIlinkCliRuntime({
+        background: true,
+        config,
+        signal: controller.signal,
+        stdout: (text) => process.stdout.write(text),
+        onStarted() {
+            process.send?.({ type: 'ready', pid: process.pid });
+        },
+    });
+    if (result === 0 && process.connected) {
+        process.send?.({ type: 'shutdown-request', pid: process.pid });
+        await parentShutdown;
+    }
+    process.exitCode = result === 130 ? 0 : result;
+}
+catch (error) {
+    console.error('[ilink] process failed', error);
+    process.exitCode = 1;
+}
+finally {
+    process.off('SIGINT', shutdown);
+    process.off('SIGTERM', shutdown);
+    process.off('disconnect', shutdown);
+    process.off('message', handleMessage);
+    if (process.connected)
+        process.disconnect();
+}