@limecloud/cli 0.11.0 → 0.13.0

package/README.md

@@ -51,7 +51,9 @@ limecloud-cli doctor --offline
 limecloud-cli schema
 ```
 
-安装失败会返回 `installation_failed`，检查 npm 网络和目标目录权限后重试同一命令。安装与配置不创建平台应用、不授予业务权限；CLI 不安装全局 Agent Skills。
+更新后的安装器固定默认及 `@limecloud` scoped registry 为 `https://registry.npmjs.org`，使用精确三段版本及 `--ignore-scripts` 禁用 npm 生命周期脚本。启动 npm 前检查当前运行包，结束后按路径、大小及 SHA-256 核对全部随包 CLI 文件，并在 POSIX 核对可执行入口实际指向；成功才继续配置和登录。预演的 `installation.verification.status=planned` 不代表已检查安装内容，实际成功返回 `matched` 和比较文件数。Windows 仅核对包装入口存在，明确返回 `exists-unverified-wrapper`。
+
+`installation_source_invalid` 表示尚未启动 npm：源码运行先构建，或从受信渠道取得完整包。`installation_failed` 须按错误说明处理，npm 可能已改写目标目录，先检查再运行安装副本；内容核对失败不会继续配置或登录，也不回滚 npm 已有改动。此比较继承当前运行 CLI 的信任，`provenance`、`dependency_contents` 继续为 `not-evaluated`，不能证明独立发布来源或依赖内容。首次 npx 取得包发生在安装器启动前，亦须使用受信来源。安装与配置不创建平台应用、不授予业务权限；CLI 不安装全局 Agent Skills。
 
 ## 从仓库运行与分发
 
@@ -96,6 +98,17 @@ limecloud-cli docs platform-knowledge
 
 实际Management写入会在每次显式提交前无凭据核对当前动作，只有`matched`才发送正式Bearer请求。CLI自动携带自身合同计算的`Lime-Action-Contract`，不能手动覆盖；服务端执行时再核对，缺失/多个头返回428、动作变化返回409，均不调用本次领域动作。不同/缺项/未知在本地返回`action_contract_different/absent/unknown`和`write_sent:false`；不会自动升级、登录或重试。`--dry-run`仍离线，显示本地请求头不等于在线准备或确认。单成员组已接通冻结准备/精确确认及原ID恢复，见26第10.11节；其他动作、两个真实任务发行版间恢复、Skills实际更新/加载及完整宿主任务仍待交付。此前超时请求是否提交须沿原Owner核对，不能从这一次合同拒绝推断。详细协议见[26第10.10节](../../docs/26-开放文档与CLI.md#1010-当前management写入合同门禁)。
 
+## 只检查 CLI 更新
+
+```sh
+limecloud-cli update --check --format table
+limecloud-cli update --check --json
+```
+
+显式向固定 npmjs 源读取一次 `@limecloud/cli/latest`，仅接受本项目三段精确版本，按数值比较为 `available/current/ahead`。latest 声明弃用为 `unavailable`，网络/响应未知为 `unknown`，均不自动更新、降级、换源或重试。不读 CLI/npm 设置或凭据，不下载包、不扫描宿主、不改 Skills 或原任务；普通命令不附带检查。
+
+有新版时 `candidate.review_argv` 只列固定版本 npx 安装预览；另行运行会先取得并执行该包，`--dry-run` 只预览后续安装。实际升级先确认原安装 Owner 和前缀，不能据此覆盖未知安装。版本相同、latest 推荐或没有弃用标记不证明来源、未被撤回或本次动作兼容；宿主方法另由其唯一 Owner 更新，加载仍需核验。完整合同见[26第10.20节](../../docs/26-开放文档与CLI.md#1020-cli-版本更新的显式检查)。
+
 ## 只读登录配置诊断
 
 ```sh
@@ -357,6 +370,8 @@ limecloud-cli task group resolve --space-id "YOUR_SPACE_ID" --preparation-id "OR
 
 原准备读取遇到断网、403、响应不兼容或原绑定变化时，错误仍附带已核对本地引用的`error.recovery`，保留原操作ID、Issuer/API/Client/企业及原执行合同，只提供get/receipt/resolve参数数组；不自动执行、改写引用或清除尝试标记。提示不是成功、当前授权或安全重试的证明；读取/终结仍可能失败。没有有效原引用时不从无效响应或未知引用格式生成提示，保持原文件并报告待核对，不自动迁移或重新准备。
 
+已有有效原引用时，`receipt`/显式`resolve`直接访问原回执/终结动作，不额外依赖准备GET；服务端仍重验当前身份、权限和原调用范围，CLI核对原键、确认绑定、目标组及企业。恢复失败保持原引用和尝试状态，不自动回退get或execute。引用缺失时仍须读取并核验原准备；get/execute继续回读原准备，执行的精确确认和一次尝试门禁保持有效。
+
 
 ## 可选公开方法候选
 
@@ -367,14 +382,24 @@ limecloud-cli skills list
 limecloud-cli skills inspect limecloud-login-diagnosis --host codex
 limecloud-cli skills inspect limecloud-login-diagnosis --host skill
 limecloud-cli skills inspect limecloud-member-group --host codex
+# 明确指定一个副本，不扫描宿主缓存或覆盖本地改写
+limecloud-cli skills inspect limecloud-login-diagnosis --host codex --installed-dir "./selected-plugin"
 # 核对完整文件、版本、来源及所选包装的精确摘要后导出到新普通目录
 limecloud-cli skills export limecloud-login-diagnosis --host codex --output-dir ./review-candidate --digest "EXACT_SHA256_DIGEST"
 ```
 
-Codex候选包含根plugin.json及单个Skill；通用包装只含方法与当前全部语言步骤。导出拒绝既有目的目录、符号链接祖先及Agent发现/配置位置，不执行制品脚本。它不安装/启用/更新或加载插件，普通CLI升级也不替换已安装方法。实际原生插件由宿主管理器更新，手动导入的更新Owner需独立确定。上述离线输出明确线上兼容/授权/撤回未评估、独立provenance未评估及会话加载未知；摘要匹配只能证明与当前安装CLI内的候选一致。
+Codex候选包含根plugin.json及单个Skill；通用包装含方法与当前全部语言步骤。两种包装均包含构建生成的references/action-contracts.json，记录原动作合同与其余方法文件摘要；Codex中位于skills/方法ID/下。导出拒绝既有目的目录、符号链接祖先及Agent发现/配置位置，不执行制品脚本。它不安装/启用/更新或加载插件，普通CLI升级也不替换已安装方法。实际原生插件由宿主管理器更新，手动导入的更新Owner需独立确定。上述离线输出明确线上兼容/授权/撤回未评估、独立provenance未评估及会话加载未知；摘要匹配只能证明与当前安装CLI内的候选一致。
 
 研发及产品方法源码只在仓库.agents/skills维护，products.json明确分类和公开文件。dist/skills.json仅携带公开候选，不包含部署/UI研发方法、受限SOP、脚本或凭据；制品发布与真实宿主加载尚待验收。
 
+`inspect --installed-dir`只比较明确指定的单方法目录与随包候选，返回每个声明文件的相同/变化/缺失、完整原文和摘要，额外条目只列路径/类型，不读取正文。codex指定插件根目录，skill指定含SKILL.md的目录。错误身份/包装、链接、特殊文件、无效文本及超限拒绝，观察到检查期间变化也拒绝；不自动判断该覆盖哪份。相同版本仍按实际字节核对，不修改任何方法文件。
+
+当前未发布候选的bundle及动作声明为格式2，从同次正式合同记录`access_requirements`。离线`update_review`列旧到新工具及权限要求的新增/移除/变化、读写前后值、所需Scope及认证方案；认证备选的OR/同项AND关系保持独立。格式1、缺失或不支持的旧声明保持unknown，不能据当前候选补造旧权限。unchanged只表示声明相同，文件仍可能不同；这些要求不证明当前已获授权、实际方法行为、数据外发、来源/撤回或宿主加载。
+
+`directory_comparison`表示本地字节，顶层`compatibility`表示新候选线上合同。叠加`--online`另以`directory_comparison.action_contracts.compatibility`比较指定副本的有效原声明；保留旧摘要及已退役动作，不借新Schema重释，候选与旧声明各自汇总。候选matched时旧声明仍可different；缺失/损坏/未知格式声明保持unknown。`method_files`单独报告原文件绑定，额外正文不读，声明不能扩大读取清单或选择网络目标。
+
+声明属于self-reported，即使文件绑定与合同均matched，也不证明正文遵循声明、可信来源、撤回、当前权或宿主登记/加载。实际更新交给唯一宿主/导入Owner；Codex CLI插件通过`/plugins`管理，安装后需新会话，本地Skill的变更检测另按宿主规则。此入口不安装、覆盖、启用策略或重放未知业务操作。完整结果合同见[26第10.12.1节](../../docs/26-开放文档与CLI.md#10121-指定旧副本的原动作声明与兼容比较)。
+
 候选的effect由正式HTTP动作推导：登录诊断为read，成员组为write，完整操作清单及修订绑定制品摘要。该标识只供审阅，不授予权限，也不证明已获确认。成员组方法通过task group在宿主内完成选择、字段修正、完整准备核对、用户对具体准备的明确确认与原结果恢复；存在发送尝试或未知结果后保留原ID，只查询/显式终结，不换键、新准备或改用低层API重试。成员增删、角色和批量不在该方法范围；读取/检查/导出均不自动准备或执行。
 
 需要比较目标部署时，显式执行：

package/dist/identity.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Lime Identity API",
-    "version": "0.11.0",
+    "version": "0.13.0",
     "description": "Implemented public OAuth 2.0 and OpenID Connect endpoints. Plain protocol responses; separate from authenticated management BFF APIs."
   },
   "servers": [
@@ -47,8 +47,17 @@
         "operationId": "identity_authorize",
         "summary": "Authorize a user",
         "x-lime-summary-zh-CN": "用户授权",
-        "description": "Navigate the user's browser here. Register the client and exact redirect URI first. Production clients must be activated against a published version; installation authorization requires both installation_id and space_id. User consent remains separate from installation approval. The callback contains code+state or error+state; never accept it without checking the bound state.",
-        "x-lime-zh-CN": "将用户浏览器导航至此。先登记客户端和精确回调。生产客户端须基于已发布版本启用；安装授权须同时提供 installation_id 和 space_id。个人同意与安装批准分别判定。回调包含 code+state 或 error+state，必须校验绑定的 state 后再处理。",
+        "description": "Navigate the user's browser here using the environment's App ID or a separately registered user-client ID and an exact registered callback. Production credentials require a published version. For identity-only Web OIDC sign-in with the production App ID, installation_id and space_id may be omitted: after sign-in, one eligible existing partner or official installation is bound and shown on consent. When there is no eligible installation and a trusted Console is configured, an approved listed application may continue the original request through explicit installation in the user's personal space, including the existing strong-authentication requirement. Installation approval does not replace consent or extend the original ten-minute deadline. Multiple eligible installations require explicit selectors. Independent clients, device requests, organization installation and business audiences do not use this first-installation continuation. Business-audience requests require both selectors at authorization start. The frozen context cannot be replaced during token exchange. Validate the original bound state on both successful and error callbacks.",
+        "x-lime-zh-CN": "将用户浏览器导航至此，使用对应环境 App ID 或独立登记的用户客户端 ID，以及精确登记的回调。正式凭据要求应用已发布。正式 App ID 接入仅身份 Scope 的 Web OIDC 登录时，可省略 installation_id 与 space_id：用户登录后，仅有一个符合条件的合作或官方应用已有安装时，平台绑定该安装并在同意页明示。没有符合条件的安装且平台已配置受控 Console 时，已审核上架应用可经本人个人空间显式安装后接续原请求，仍须满足现行强认证要求。安装批准不代替本人同意，不延长原十分钟期限。多个符合条件的安装须显式选择。独立 Client、设备请求、组织安装与业务 Audience 不适用此首次接入路径。业务 Audience 请求须在发起时提供两个安装选择字段。换码不能替换已固定上下文，成功及错误回调均须校验原事务绑定的 state。",
+        "x-lime-action-revision": "app-id-installation-onboarding-v1",
+        "x-lime-localizations": {
+          "en": {
+            "description": "Navigate the user's browser here using the environment's App ID or a separately registered user-client ID and an exact registered callback. Production credentials require a published version. For identity-only Web OIDC sign-in with the production App ID, installation_id and space_id may be omitted: after sign-in, one eligible existing partner or official installation is bound and shown on consent. When there is no eligible installation and a trusted Console is configured, an approved listed application may continue the original request through explicit installation in the user's personal space, including the existing strong-authentication requirement. Installation approval does not replace consent or extend the original ten-minute deadline. Multiple eligible installations require explicit selectors. Independent clients, device requests, organization installation and business audiences do not use this first-installation continuation. Business-audience requests require both selectors at authorization start. The frozen context cannot be replaced during token exchange. Validate the original bound state on both successful and error callbacks."
+          },
+          "zh-CN": {
+            "description": "将用户浏览器导航至此，使用对应环境 App ID 或独立登记的用户客户端 ID，以及精确登记的回调。正式凭据要求应用已发布。正式 App ID 接入仅身份 Scope 的 Web OIDC 登录时，可省略 installation_id 与 space_id：用户登录后，仅有一个符合条件的合作或官方应用已有安装时，平台绑定该安装并在同意页明示。没有符合条件的安装且平台已配置受控 Console 时，已审核上架应用可经本人个人空间显式安装后接续原请求，仍须满足现行强认证要求。安装批准不代替本人同意，不延长原十分钟期限。多个符合条件的安装须显式选择。独立 Client、设备请求、组织安装与业务 Audience 不适用此首次接入路径。业务 Audience 请求须在发起时提供两个安装选择字段。换码不能替换已固定上下文，成功及错误回调均须校验原事务绑定的 state。"
+          }
+        },
         "tags": [
           "Identity"
         ],
@@ -67,8 +76,16 @@
             "name": "client_id",
             "in": "query",
             "required": true,
-            "description": "Public or confidential user-client ID. Always send it in this query; never send a client secret to the authorization endpoint.",
-            "x-lime-zh-CN": "公共或机密用户客户端 ID。所有用户客户端均在此查询参数中提供 ID，不得向授权端点发送 Secret。",
+            "description": "The selected environment's application App ID, or a separately registered public or confidential user-client ID. The production App ID equals the Application ID; sandbox uses a separate App ID. Always send the ID in this query and keep the secret off the authorization endpoint.",
+            "x-lime-zh-CN": "所选环境的应用 App ID，或独立登记的公共、机密用户客户端 ID。正式 App ID 与 Application ID 相同，沙箱使用独立 App ID。始终在此查询参数中提交 ID，不向授权端点发送 Secret。",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The selected environment's application App ID, or a separately registered public or confidential user-client ID. The production App ID equals the Application ID; sandbox uses a separate App ID. Always send the ID in this query and keep the secret off the authorization endpoint."
+              },
+              "zh-CN": {
+                "description": "所选环境的应用 App ID，或独立登记的公共、机密用户客户端 ID。正式 App ID 与 Application ID 相同，沙箱使用独立 App ID。始终在此查询参数中提交 ID，不向授权端点发送 Secret。"
+              }
+            },
             "schema": {
               "type": "string"
             }
@@ -95,8 +112,33 @@
             "name": "scope",
             "in": "query",
             "required": false,
-            "description": "Space-separated scopes registered on this client. openid is required for sign-in; profile, email and offline_access are optional.",
-            "x-lime-zh-CN": "客户端已登记的权限，以空格分隔。登录须含 openid，可选 profile、email、offline_access。",
+            "description": "Space-separated scopes. Sign-in requires openid; profile, email and offline_access are optional. User business authorization requires openid and the approved business scopes frozen in the selected installation for the single API audience.",
+            "x-lime-zh-CN": "以空格分隔的权限。登录须含 openid，可选 profile、email、offline_access。本人业务授权须含 openid 及所选安装对单一 API Audience 已批准冻结的业务权限。",
+            "schema": {
+              "type": "string"
+            },
+            "x-lime-localizations": {
+              "en": {
+                "description": "Space-separated scopes. Sign-in requires openid; profile, email and offline_access are optional. User business authorization requires openid and the approved business scopes frozen in the selected installation for the single API audience."
+              },
+              "zh-CN": {
+                "description": "以空格分隔的权限。登录须含 openid，可选 profile、email、offline_access。本人业务授权须含 openid 及所选安装对单一 API Audience 已批准冻结的业务权限。"
+              }
+            }
+          },
+          {
+            "name": "audience",
+            "in": "query",
+            "required": false,
+            "description": "For user business authorization, send exactly one approved API audience in the form urn:lime:api:{providerApplicationID}:production:{apiServiceID}, together with installation_id and space_id. Request openid and the installed business scopes. An ordinary OpenID token does not authorize business APIs. A resource parameter or multiple business audiences are rejected.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "For user business authorization, send exactly one approved API audience in the form urn:lime:api:{providerApplicationID}:production:{apiServiceID}, together with installation_id and space_id. Request openid and the installed business scopes. An ordinary OpenID token does not authorize business APIs. A resource parameter or multiple business audiences are rejected."
+              },
+              "zh-CN": {
+                "description": "申请本人业务授权时，提交一个已批准 API 的 Audience，格式为 urn:lime:api:{providerApplicationID}:production:{apiServiceID}，并同时提供 installation_id 与 space_id。Scope 须含 openid 及已安装的业务权限。普通 OpenID 令牌不能调用业务 API；不接受 resource 参数或多个业务 Audience。"
+              }
+            },
             "schema": {
               "type": "string"
             }
@@ -196,8 +238,16 @@
             "name": "installation_id",
             "in": "query",
             "required": false,
-            "description": "Production installation ID. Supply together with space_id when authorizing an enterprise installation.",
-            "x-lime-zh-CN": "生产安装 ID。授权企业安装时须与 space_id 同时传入。",
+            "description": "Production installation ID, supplied together with space_id when selecting explicitly. Both may be omitted only for identity-only production App ID Web OIDC sign-in that resolves exactly one existing eligible partner or official installation. Other installation-bound client and business-audience requests retain explicit selection.",
+            "x-lime-zh-CN": "正式安装 ID，显式选择时须与 space_id 同时传入。仅请求身份权限的正式 App ID Web OIDC 登录，且可确定唯一已有可用合作或官方应用安装时，可同时省略这两个字段。其他安装绑定客户端及业务 Audience 请求仍须显式选择。",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Production installation ID, supplied together with space_id when selecting explicitly. Both may be omitted only for identity-only production App ID Web OIDC sign-in that resolves exactly one existing eligible partner or official installation. Other installation-bound client and business-audience requests retain explicit selection."
+              },
+              "zh-CN": {
+                "description": "正式安装 ID，显式选择时须与 space_id 同时传入。仅请求身份权限的正式 App ID Web OIDC 登录，且可确定唯一已有可用合作或官方应用安装时，可同时省略这两个字段。其他安装绑定客户端及业务 Audience 请求仍须显式选择。"
+              }
+            },
             "schema": {
               "type": "string",
               "maxLength": 40
@@ -207,8 +257,16 @@
             "name": "space_id",
             "in": "query",
             "required": false,
-            "description": "Workspace containing the installation. This does not select a global current workspace.",
-            "x-lime-zh-CN": "安装所属的工作空间，不用于选择全局当前空间。",
+            "description": "Workspace containing the explicitly selected installation; provide together with installation_id. Both may be omitted under the production App ID identity-only Web sign-in rule. This field does not select a global current workspace.",
+            "x-lime-zh-CN": "显式选择的安装所属空间，须与 installation_id 同时传入。符合正式 App ID 纯身份 Web 登录条件时，可同时省略两个字段；此字段不用于选择全局当前空间。",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Workspace containing the explicitly selected installation; provide together with installation_id. Both may be omitted under the production App ID identity-only Web sign-in rule. This field does not select a global current workspace."
+              },
+              "zh-CN": {
+                "description": "显式选择的安装所属空间，须与 installation_id 同时传入。符合正式 App ID 纯身份 Web 登录条件时，可同时省略两个字段；此字段不用于选择全局当前空间。"
+              }
+            },
             "schema": {
               "type": "string",
               "maxLength": 40