@lobehub/cli 0.0.64 → 0.0.65

package/dist/index.js

@@ -292909,18 +292909,35 @@ async function runCommand$1({ command, cwd, description, env: extraEnv, run_in_b
 
 //#endregion
 //#region src/auth/apiKey.ts
+var ApiKeyValidationError = class extends Error {
+	constructor(message, retryable) {
+		super(message);
+		this.retryable = retryable;
+		this.name = "ApiKeyValidationError";
+	}
+};
 async function getUserIdFromApiKey(apiKey, serverUrl) {
 	const normalizedServerUrl = normalizeUrl(serverUrl) || resolveServerUrl();
-	const response = await fetch(`${normalizedServerUrl}/api/v1/users/me?includeCount=0`, { headers: { Authorization: `Bearer ${apiKey}` } });
+	let response;
+	try {
+		response = await fetch(`${normalizedServerUrl}/api/v1/users/me?includeCount=0`, { headers: { Authorization: `Bearer ${apiKey}` } });
+	} catch (error) {
+		throw new ApiKeyValidationError(error instanceof Error ? error.message : String(error), true);
+	}
+	const retryableStatus = response.status >= 500 || [
+		408,
+		425,
+		429
+	].includes(response.status);
 	let body;
 	try {
 		body = await response.json();
 	} catch {
-		throw new Error(`Failed to parse response from ${normalizedServerUrl}/api/v1/users/me?includeCount=0.`);
+		throw new ApiKeyValidationError(`Failed to parse response from ${normalizedServerUrl}/api/v1/users/me?includeCount=0.`, response.ok || retryableStatus);
 	}
-	if (!response.ok || body?.success === false) throw new Error(body?.error || body?.message || `Request failed with status ${response.status}.`);
+	if (!response.ok || body?.success === false) throw new ApiKeyValidationError(body?.error || body?.message || `Request failed with status ${response.status}.`, retryableStatus);
 	const userId = body?.data?.id || body?.data?.userId;
-	if (!userId) throw new Error("Current user response did not include a user id.");
+	if (!userId) throw new ApiKeyValidationError("Current user response did not include a user id.", true);
 	return userId;
 }
 
@@ -292998,7 +293015,7 @@ async function resolveToken(options) {
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			log$13.error(`Failed to validate ${source.origin}: ${message}`);
-			process.exit(1);
+			process.exit(error instanceof ApiKeyValidationError && error.retryable ? options.unavailableExitCode ?? 1 : 1);
 		}
 	}
 	const result = await getValidToken();
@@ -293020,7 +293037,7 @@ async function resolveToken(options) {
 	}
 	const report = describeTokenLookup(result);
 	log$13.error(report ? `${report.detail} ${report.fix}` : `No authentication found. Run '${"lh"} login' first, or set ${CLI_API_KEY_ENV}, or provide --token.`);
-	process.exit(1);
+	process.exit(result.status === "unavailable" ? options.unavailableExitCode ?? 1 : 1);
 }
 
 //#endregion
@@ -296378,6 +296395,23 @@ var TerminalSessionManager = class {
 const SERVICE_NAME = CLI_CONNECT_SERVICE_NAME;
 const ENV_NAME_PATTERN = /^[A-Z_]\w*$/i;
 const SERVICE_ENV_FILE_NAME = "connect-service.env";
+/**
+* Exit code for workspace failures worth retrying (EX_TEMPFAIL). It sits outside the
+* unit's `SuccessExitStatus`, so `Restart=on-failure` restarts the service child.
+*/
+const CONNECT_RETRYABLE_EXIT_CODE = 75;
+const PERMANENT_TRPC_ERROR_CODES = new Set([
+	"BAD_REQUEST",
+	"CONFLICT",
+	"FORBIDDEN",
+	"NOT_FOUND",
+	"UNAUTHORIZED"
+]);
+/** Exit code for a failed workspace operation (token mint, refresh, device registration): 1 for refusals, 75 otherwise. */
+function getWorkspaceFailureExitCode(error) {
+	const code = error?.data?.code;
+	return code && PERMANENT_TRPC_ERROR_CODES.has(code) ? 1 : 75;
+}
 function systemctl(args, stdio = "pipe") {
 	const output = execFileSync("systemctl", ["--user", ...args], {
 		encoding: "utf8",
@@ -296403,7 +296437,13 @@ function getExecErrorMessage(error) {
 	if (stderr) return stderr;
 	return error instanceof Error ? error.message : String(error);
 }
-function renderUnit() {
+function buildServiceConnectArgs(options) {
+	const args = ["connect", "--service-child"];
+	if (options.workspace) args.push("--workspace", options.workspace);
+	if (options.public) args.push("--public");
+	return args;
+}
+function renderUnit(options) {
 	const quoteSystemdValue = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`;
 	const escapeSystemdEnvValue = (value) => value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
 	const homeDir = os.homedir();
@@ -296414,16 +296454,14 @@ function renderUnit() {
 	const execStart = [
 		process.execPath,
 		scriptPath,
-		"connect",
-		"--service-child"
+		...buildServiceConnectArgs(options)
 	].map(quoteSystemdValue).join(" ");
 	return [
 		"[Unit]",
 		`Description=${CLI_DISPLAY_NAME} connect service`,
 		"After=network-online.target",
 		"Wants=network-online.target",
-		"StartLimitIntervalSec=60",
-		"StartLimitBurst=10",
+		"StartLimitIntervalSec=0",
 		"",
 		"[Service]",
 		"Type=simple",
@@ -296436,7 +296474,7 @@ function renderUnit() {
 		`StandardError=append:${logPath}`,
 		"Restart=on-failure",
 		"SuccessExitStatus=0 1 2",
-		"RestartSec=1",
+		"RestartSec=5",
 		"TimeoutStopSec=20",
 		"",
 		"[Install]",
@@ -296493,7 +296531,8 @@ function assertConnectServiceAuthAvailable() {
 	if (process.env.LOBEHUB_JWT || readCliApiKeyEnv() || loadCredentials()) return;
 	throw new Error(`No authentication found. Run '${"lh"} login' first, or set ${CLI_API_KEY_ENV} before starting the connect service.`);
 }
-function installConnectService() {
+function installConnectService(options = {}) {
+	if (options.public && !options.workspace) throw new Error("--public requires --workspace.");
 	requireLinuxSystemd();
 	assertNoConnectDaemonRunning();
 	assertConnectServiceAuthAvailable();
@@ -296502,13 +296541,10 @@ function installConnectService() {
 		mode: 448,
 		recursive: true
 	});
-	fs.writeFileSync(path.join(getUserServiceDir(), SERVICE_NAME), renderUnit(), { mode: 420 });
+	fs.writeFileSync(path.join(getUserServiceDir(), SERVICE_NAME), renderUnit(options), { mode: 420 });
 	systemctl(["daemon-reload"], "inherit");
-	systemctl([
-		"enable",
-		"--now",
-		SERVICE_NAME
-	], "inherit");
+	systemctl(["enable", SERVICE_NAME], "inherit");
+	systemctl(["restart", SERVICE_NAME], "inherit");
 }
 function uninstallConnectService() {
 	const unitPath = path.join(getUserServiceDir(), SERVICE_NAME);
@@ -508017,7 +508053,7 @@ const sweepLocalTraces = async () => {
 const SHUTDOWN_METRICS_FLUSH_MS = 3e3;
 const CONNECT_SERVICE_NAME = CLI_CONNECT_SERVICE_NAME;
 function registerConnectCommand(program) {
-	const connectCmd = program.command("connect").description("Connect to the device gateway and listen for tool calls").option("--token <jwt>", "JWT access token").option("--gateway <url>", "Device gateway URL").option("--device-id <id>", "Device ID (auto-generated if not provided)").option("--workspace <id>", "Enroll as a device of this workspace (admin only)").option("--public", "With --workspace: enroll into the shared pool visible to every member (default: private, visible only to you)").option("-v, --verbose", "Enable verbose logging").option("-d, --daemon", "Run as a background daemon process").option("--daemon-child", "Internal: runs as the daemon child process").option("--service-child", "Internal: runs as the system service child process").action(async (options) => {
+	const connectCmd = program.command("connect").description("Connect to the device gateway and listen for tool calls").option("--token <jwt>", "JWT access token").option("--gateway <url>", "Device gateway URL").option("--device-id <id>", "Device ID (auto-generated if not provided)").option("--workspace <id>", "Enroll as a device of this workspace (workspace members)").option("--public", "With --workspace: enroll into the shared pool visible to every member (default: private, visible only to you)").option("-v, --verbose", "Enable verbose logging").option("-d, --daemon", "Run as a background daemon process").option("--daemon-child", "Internal: runs as the daemon child process").option("--service-child", "Internal: runs as the system service child process").action(async (options) => {
 		if (options.verbose) setVerbose(true);
 		if (options.daemon) return handleDaemonStart(options);
 		const isServiceChild = options.serviceChild || process.env.LOBEHUB_CONNECT_SERVICE === "1";
@@ -508063,9 +508099,12 @@ function registerConnectCommand(program) {
 		});
 	});
 	const serviceCmd = connectCmd.command("service").description("Manage the Linux user systemd connect service");
-	serviceCmd.command("install").description("Install and start the Linux user systemd connect service").action(() => {
-		installConnectService();
-		log$13.info(`Installed and started ${CONNECT_SERVICE_NAME}.`);
+	serviceCmd.command("install").description("Install and start the Linux user systemd connect service").option("--workspace <id>", "Enroll as a device of this workspace (workspace members)").option("--public", "With --workspace: enroll into the shared pool visible to every member (default: private, visible only to you)").action((options) => {
+		installConnectService({
+			public: options.public,
+			workspace: options.workspace
+		});
+		log$13.info(options.workspace ? `Installed and started ${CONNECT_SERVICE_NAME} for workspace ${options.workspace}.` : `Installed and started ${CONNECT_SERVICE_NAME}.`);
 		log$13.info("Run 'lh connect service status' to inspect the service.");
 	});
 	serviceCmd.command("uninstall").description("Remove the Linux user systemd connect service").action(() => {
@@ -508136,7 +508175,11 @@ function buildDaemonArgs(options) {
 	return args;
 }
 async function runConnect(options, isDaemonChild) {
-	let auth = await resolveToken(options);
+	const unavailableExitCode = options.workspace ? 75 : void 0;
+	let auth = await resolveToken({
+		...options,
+		unavailableExitCode
+	});
 	const settings = loadSettings();
 	const gatewayUrl = normalizeUrl(options.gateway) || settings?.gatewayUrl;
 	if (!gatewayUrl && settings?.serverUrl) {
@@ -508154,11 +508197,17 @@ async function runConnect(options, isDaemonChild) {
 	let connectToken = auth.token;
 	let connectTokenType = auth.tokenType;
 	if (workspaceId) {
-		connectToken = (await mintWorkspaceConnectToken(auth, workspaceId)).token;
+		try {
+			connectToken = (await mintWorkspaceConnectToken(auth, workspaceId)).token;
+		} catch (err) {
+			log$13.error(`Workspace connect token mint failed: ${err.message}`);
+			process.exit(getWorkspaceFailureExitCode(err));
+			throw new Error("process.exit", { cause: err });
+		}
 		connectTokenType = "jwt";
 	}
 	const refreshConnectToken = async () => {
-		const refreshed = await resolveToken({});
+		const refreshed = await resolveToken({ unavailableExitCode });
 		if (!refreshed) return void 0;
 		auth = refreshed;
 		if (workspaceId) {
@@ -508397,6 +508446,7 @@ async function runConnect(options, isDaemonChild) {
 	let cancelRefreshTimer = startProactiveRefresh();
 	let authFailedRefreshAttempted = false;
 	client.on("auth_failed", async (reason) => {
+		let exitCode = 1;
 		if (connectTokenType === "jwt" && !authFailedRefreshAttempted) {
 			authFailedRefreshAttempted = true;
 			info(`Authentication failed (${reason}). Attempting token refresh...`);
@@ -508411,16 +508461,20 @@ async function runConnect(options, isDaemonChild) {
 					await client.reconnect();
 					return;
 				}
-			} catch {}
+			} catch (err) {
+				error(`Token refresh failed: ${err.message}`);
+				if (workspaceId) exitCode = getWorkspaceFailureExitCode(err);
+			}
 		}
 		error(`Authentication failed: ${reason}`);
 		error(`Run '${"lh"} login', or set ${CLI_API_KEY_ENV} and run '${"lh"} login --server <url>' to configure API key authentication.`);
 		cleanup();
-		process.exit(1);
+		process.exit(exitCode);
 	});
 	client.on("auth_expired", async () => {
 		if (connectTokenType === "apiKey") return;
 		info("Authentication expired. Attempting to refresh token...");
+		let exitCode = 1;
 		try {
 			const newToken = await refreshConnectToken();
 			if (newToken) {
@@ -508430,10 +508484,13 @@ async function runConnect(options, isDaemonChild) {
 				await client.reconnect();
 				return;
 			}
-		} catch {}
+		} catch (err) {
+			error(`Token refresh failed: ${err.message}`);
+			if (workspaceId) exitCode = getWorkspaceFailureExitCode(err);
+		}
 		error("Could not refresh token. Run 'lh login' to re-authenticate.");
 		cleanup();
-		process.exit(1);
+		process.exit(exitCode);
 	});
 	client.on("replaced", () => {
 		error(`Another '${"lh"} connect' on this machine took over this device's gateway connection. Only one can be connected at a time; stopping this one.`);
@@ -508468,7 +508525,7 @@ async function runConnect(options, isDaemonChild) {
 		if (workspaceId) {
 			error(`Workspace device registration failed: ${err.message}`);
 			cleanup();
-			process.exit(1);
+			process.exit(getWorkspaceFailureExitCode(err));
 		}
 		error(`Device registration failed (non-fatal): ${err.message}`);
 	}
@@ -522856,7 +522913,7 @@ const EMPTY_COMPLETION_RESULT = { completion: {
 } };
 
 //#endregion
-//#region node_modules/.pnpm/@hono+node-server@2.1.4_hono@4.13.13/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
+//#region node_modules/.pnpm/@hono+node-server@2.1.5_hono@4.13.13/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
 const X_ALREADY_SENT = "x-hono-already-sent";
 
 //#endregion
@@ -522885,7 +522942,7 @@ const defineWebSocketHelper = (handler) => {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@hono+node-server@2.1.4_hono@4.13.13/node_modules/@hono/node-server/dist/index.mjs
+//#region node_modules/.pnpm/@hono+node-server@2.1.5_hono@4.13.13/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -523707,7 +523764,7 @@ const makeCloseHandler = (req, incoming, outgoing, needsBodyCleanup) => () => {
 	if (incoming.errored) {
 		recordBodyBufferedBeforeDisconnect(incoming);
 		req[abortRequest](incoming.errored.toString());
-	} else if (!outgoing.writableFinished) {
+	} else if (!outgoing.writableFinished || incoming instanceof Http2ServerRequest && incoming.aborted) {
 		recordBodyBufferedBeforeDisconnect(incoming);
 		req[abortRequest]("Client connection prematurely closed.");
 	}
@@ -535153,6 +535210,345 @@ async function uploadReportEvidence(client, params) {
 	};
 }
 
+//#endregion
+//#region src/commands/acceptanceLanguage.ts
+const HAN = {
+	languageName: "Chinese",
+	pattern: /\p{Script=Han}/u
+};
+const CYRILLIC = {
+	languageName: "Cyrillic script",
+	pattern: /\p{Script=Cyrillic}/u
+};
+const ARABIC = {
+	languageName: "Arabic script",
+	pattern: /\p{Script=Arabic}/u
+};
+/** Keyed by the primary language subtag of `responseLanguage` (`zh-CN` → `zh`). */
+const SCRIPT_RULES = {
+	ar: {
+		...ARABIC,
+		languageName: "Arabic"
+	},
+	be: CYRILLIC,
+	bg: {
+		...CYRILLIC,
+		languageName: "Bulgarian"
+	},
+	el: {
+		languageName: "Greek",
+		pattern: /\p{Script=Greek}/u
+	},
+	fa: {
+		...ARABIC,
+		languageName: "Persian"
+	},
+	he: {
+		languageName: "Hebrew",
+		pattern: /\p{Script=Hebrew}/u
+	},
+	hi: {
+		languageName: "Hindi",
+		pattern: /\p{Script=Devanagari}/u
+	},
+	ja: {
+		languageName: "Japanese",
+		pattern: /[\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Han}]/u
+	},
+	kk: CYRILLIC,
+	ko: {
+		languageName: "Korean",
+		pattern: /\p{Script=Hangul}/u
+	},
+	mn: CYRILLIC,
+	ru: {
+		...CYRILLIC,
+		languageName: "Russian"
+	},
+	sr: CYRILLIC,
+	th: {
+		languageName: "Thai",
+		pattern: /\p{Script=Thai}/u
+	},
+	uk: {
+		...CYRILLIC,
+		languageName: "Ukrainian"
+	},
+	zh: HAN
+};
+const responseLanguageSettingsUrl = () => {
+	const url = new URL("/settings/appearance", resolveServerUrl());
+	url.username = "";
+	url.password = "";
+	return url.toString();
+};
+function reportLanguageFor(responseLanguage) {
+	const locale = responseLanguage?.trim();
+	if (!locale) return { status: "unset" };
+	const rule = SCRIPT_RULES[locale.split(/[-_]/)[0].toLowerCase()];
+	return rule ? {
+		locale,
+		rule,
+		status: "enforced"
+	} : {
+		locale,
+		status: "unchecked"
+	};
+}
+async function resolveReportLanguage(client) {
+	const value = (await client.user.getUserState.query())?.settings?.general?.responseLanguage;
+	return reportLanguageFor(typeof value === "string" ? value : void 0);
+}
+/**
+* Code, links and paths are legitimately English inside any report; strip them
+* so "修复了 `useFoo` 的问题" passes and a bare `npm test` field is judged on
+* nothing rather than on the identifier.
+*/
+const stripNonProse = (text) => text.replaceAll(/(`{3,}|~{3,})[\s\S]*?\1/g, " ").replaceAll(/`[^`\n]*`/g, " ").replaceAll(/!?\[[^\]]*\]\([^)]*\)/g, (match) => match.replace(/\([^)]*\)$/, "")).replaceAll(/https?:\/\/[^\s<>"'`，。！？、；：（）【】「」《》]+/g, " ");
+/**
+* A field fails when it contains letters but none in the target script — the
+* whole field is in another language. Mixed text with identifiers passes.
+*/
+function findLanguageViolations(fields, rule) {
+	return fields.flatMap((field) => {
+		if (typeof field.text !== "string") return [];
+		const prose = stripNonProse(field.text);
+		if (!/\p{L}/u.test(prose) || rule.pattern.test(prose)) return [];
+		return [{
+			path: field.path,
+			text: field.text
+		}];
+	});
+}
+/** Prose in a check definition: its outcome, preconditions and step wording. */
+function checkDefinitionFields(at, definition) {
+	const value = definition ?? {};
+	const preconditions = Array.isArray(value.preconditions) ? value.preconditions : [];
+	const steps = Array.isArray(value.steps) ? value.steps : [];
+	return [
+		{
+			path: `${at}.expected`,
+			text: value.expected
+		},
+		...preconditions.map((text, index) => ({
+			path: `${at}.preconditions[${index}]`,
+			text
+		})),
+		...steps.flatMap((step) => [{
+			path: `${at}.steps[${String(step?.id)}].instruction`,
+			text: step?.instruction
+		}, {
+			path: `${at}.steps[${String(step?.id)}].expected`,
+			text: step?.expected
+		}])
+	];
+}
+/**
+* Video step/claim captions and the before/after caption band. Shared by
+* `ingest` and `evidence upload --metadata`, which persist the same shape.
+*/
+function evidenceCaptionFields(at, metadata) {
+	const value = metadata ?? {};
+	return [...(Array.isArray(value.chapters) ? value.chapters : []).flatMap((chapter, i) => [{
+		path: `${at}.chapters[${i}].label`,
+		text: chapter?.label
+	}, {
+		path: `${at}.chapters[${i}].note`,
+		text: chapter?.note
+	}]), {
+		path: `${at}.comparison.label`,
+		text: value.comparison?.label
+	}];
+}
+/** Every `ingest` field that renders as prose on the acceptance page. */
+function ingestLanguageFields(input) {
+	const fields = [
+		{
+			path: "title",
+			text: input.title
+		},
+		{
+			path: "focus",
+			text: input.goal
+		},
+		{
+			path: "requirement",
+			text: input.requirement
+		},
+		{
+			path: "summary.conclusion",
+			text: input.conclusion
+		},
+		{
+			path: "report.md",
+			text: input.report
+		},
+		{
+			path: "proposal.md",
+			text: input.proposal
+		}
+	];
+	for (const item of input.plan ?? []) {
+		const config = item.verifierConfig ?? {};
+		const evidenceSpecs = Array.isArray(config.requiredEvidence) ? config.requiredEvidence : [];
+		fields.push({
+			path: `plan[${item.id}].title`,
+			text: item.title
+		}, {
+			path: `plan[${item.id}].category`,
+			text: item.category
+		}, {
+			path: `plan[${item.id}].method`,
+			text: config.method
+		}, {
+			path: `plan[${item.id}].expected`,
+			text: config.expected
+		}, {
+			path: `plan[${item.id}].description`,
+			text: item.description
+		}, ...checkDefinitionFields(`plan[${item.id}].definition`, item.definition), ...evidenceSpecs.map((spec, index) => ({
+			path: `plan[${item.id}].requiredEvidence[${index}].hint`,
+			text: spec?.hint
+		})));
+	}
+	for (const { case: c, checkItemId } of input.cases) {
+		fields.push({
+			path: `cases[${checkItemId}].name`,
+			text: c.name ?? c.case ?? c.title
+		}, {
+			path: `cases[${checkItemId}].observation`,
+			text: c.keyObservation ?? c.observation ?? c.note
+		}, {
+			path: `cases[${checkItemId}].suggestion`,
+			text: c.suggestion
+		});
+		(Array.isArray(c.evidence) ? c.evidence : [c.evidence]).forEach((entry, index) => {
+			if (!entry || typeof entry !== "object") return;
+			const at = `cases[${checkItemId}].evidence[${index}]`;
+			fields.push({
+				path: `${at}.description`,
+				text: entry.description ?? entry.desc
+			}, ...evidenceCaptionFields(at, entry));
+		});
+		fields.push(...visualizationFields(`cases[${checkItemId}]`, c));
+	}
+	return fields;
+}
+/**
+* Visualization prose: titles, context and axis/series labels. Categories and
+* table cells are data (model names, file names, ids) and legitimately Latin,
+* so they are not checked — a false rejection has no bypass.
+*/
+function visualizationFields(at, c) {
+	const datasets = Array.isArray(c.datasets) ? c.datasets : [];
+	const views = Array.isArray(c.visualizations) ? c.visualizations : [];
+	return [...datasets.flatMap((dataset, d) => (Array.isArray(dataset?.fields) ? dataset.fields : []).map((field, f) => ({
+		path: `${at}.datasets[${d}].fields[${f}].label`,
+		text: field?.label
+	}))), ...views.flatMap((view, v) => {
+		const series = Array.isArray(view?.encoding?.series) ? view.encoding.series : [];
+		return [
+			{
+				path: `${at}.visualizations[${v}].title`,
+				text: view?.title
+			},
+			{
+				path: `${at}.visualizations[${v}].context`,
+				text: view?.context
+			},
+			...[
+				"xLabel",
+				"yLabel",
+				"valueLabel"
+			].map((key) => ({
+				path: `${at}.visualizations[${v}].encoding.${key}`,
+				text: view?.encoding?.[key]
+			})),
+			...series.map((entry, i) => ({
+				path: `${at}.visualizations[${v}].encoding.series[${i}].label`,
+				text: entry?.label
+			}))
+		];
+	})];
+}
+const preview = (text) => {
+	const line = text.replaceAll(/\s+/g, " ").trim();
+	return line.length > 80 ? `${line.slice(0, 77)}...` : line;
+};
+var ReportLanguageError = class extends Error {
+	constructor(locale, violations, languageName) {
+		super([
+			`Report language check failed: your account's response language (settings.general.responseLanguage) is "${locale}", so every human-readable field must be written in ${languageName}.`,
+			`These ${violations.length} field(s) contain no ${languageName} text:`,
+			...violations.map((v) => `  - ${v.path}: "${preview(v.text)}"`),
+			`Rewrite them in ${languageName} and retry. If "${locale}" is not the language you read, change Response Language at ${responseLanguageSettingsUrl()} first.`
+		].join("\n"));
+		this.locale = locale;
+		this.violations = violations;
+		this.name = "ReportLanguageError";
+	}
+};
+const unsetLanguageWarning = () => `Report language not checked: your account has no response language set (Response Language is "Follow System" at ${responseLanguageSettingsUrl()}). Set it so acceptance text is checked against the language you read.`;
+/**
+* Throws `ReportLanguageError` before any remote write when a field is in the
+* wrong script. There is intentionally no bypass flag: an agent that hits the
+* error would just add it.
+*/
+async function assertReportLanguage(client, fields, language) {
+	const resolved = language ?? await resolveReportLanguage(client);
+	if (resolved.status === "unset") {
+		log$13.warn(unsetLanguageWarning());
+		return resolved;
+	}
+	if (resolved.status !== "enforced") return resolved;
+	const violations = findLanguageViolations(fields, resolved.rule);
+	if (violations.length > 0) throw new ReportLanguageError(resolved.locale, violations, resolved.rule.languageName);
+	return resolved;
+}
+/** JSON-safe view of the resolved language for `--json` output. */
+const languageSummary = (language) => ({
+	enforced: language.status === "enforced",
+	locale: language.status === "unset" ? null : language.locale,
+	...language.status === "enforced" ? { languageName: language.rule.languageName } : {},
+	status: language.status
+});
+/**
+* Prose in a flow definition: its title, every inline check's wording, and
+* edge triggers/conditions, which render as graph labels.
+*/
+function flowLanguageFields(definition) {
+	const flow = definition ?? {};
+	const fields = [{
+		path: "definition.title",
+		text: flow.title
+	}];
+	const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+	for (const node of nodes) {
+		const check = node?.check;
+		if (!check || typeof check !== "object") continue;
+		const at = `nodes[${String(check.id ?? node.id)}].check`;
+		fields.push({
+			path: `${at}.title`,
+			text: check.title
+		}, {
+			path: `${at}.description`,
+			text: check.description
+		}, ...checkDefinitionFields(`${at}.definition`, check.definition));
+	}
+	const edges = Array.isArray(flow.edges) ? flow.edges : [];
+	for (const edge of edges) {
+		const value = edge ?? {};
+		fields.push({
+			path: `edges[${String(value.id)}].trigger`,
+			text: value.trigger
+		}, {
+			path: `edges[${String(value.id)}].condition`,
+			text: value.condition
+		});
+	}
+	return fields;
+}
+
 //#endregion
 //#region src/commands/acceptanceRun.ts
 const listMaterializedFiles = (directory) => {
@@ -535237,7 +535633,15 @@ function printWiring(links) {
 	}
 }
 async function runCreateAction(options) {
-	const created = await (await getTrpcClient()).verify.createRun.mutate({
+	const client = await getTrpcClient();
+	await assertReportLanguage(client, [{
+		path: "--title",
+		text: options.title
+	}, {
+		path: "--goal",
+		text: options.goal
+	}]);
+	const created = await client.verify.createRun.mutate({
 		goal: options.goal,
 		operationId: options.operation,
 		source: options.source,
@@ -535294,7 +535698,22 @@ async function runDeleteAction(runId, options) {
 	console.log(`${import_picocolors.default.green("✓")} Deleted run ${import_picocolors.default.bold(result.id)}`);
 }
 async function resultIngestAction(options) {
-	const created = await (await getTrpcClient()).verify.ingestResult.mutate({
+	const client = await getTrpcClient();
+	await assertReportLanguage(client, [
+		{
+			path: "--title",
+			text: options.title
+		},
+		{
+			path: "--evidence",
+			text: options.evidence
+		},
+		{
+			path: "--suggestion",
+			text: options.suggestion
+		}
+	]);
+	const created = await client.verify.ingestResult.mutate({
 		checkItemId: options.check,
 		checkItemIndex: options.index ? Number.parseInt(options.index, 10) : void 0,
 		checkItemTitle: options.title,
@@ -535345,6 +535764,13 @@ async function submitAction(options) {
 		process.exit(1);
 	}
 	const client = await getTrpcClient();
+	await assertReportLanguage(client, [{
+		path: "--title",
+		text: options.title
+	}, {
+		path: "--desc",
+		text: options.desc
+	}]);
 	let fileId;
 	let inlineContent = options.content;
 	if (options.file) {
@@ -535408,6 +535834,10 @@ async function evidenceUploadAction(options) {
 	}
 	const metadata = options.metadata ? JSON.parse(options.metadata) : void 0;
 	const client = await getTrpcClient();
+	await assertReportLanguage(client, [{
+		path: "--desc",
+		text: options.desc
+	}, ...evidenceCaptionFields("--metadata", metadata)]);
 	let fileId = options.fileId;
 	let inlineContent = options.content;
 	if (options.file) {
@@ -535464,7 +535894,15 @@ async function evidenceDeleteAction(evidenceId, options) {
 }
 async function reportUpsertAction(options) {
 	const num = (s) => s === void 0 ? void 0 : Number.parseInt(s, 10);
-	const created = await (await getTrpcClient()).verify.upsertReport.mutate({
+	const client = await getTrpcClient();
+	await assertReportLanguage(client, [{
+		path: "--summary",
+		text: options.summary
+	}, {
+		path: "--content",
+		text: options.content
+	}]);
+	const created = await client.verify.upsertReport.mutate({
 		content: options.content,
 		failedChecks: num(options.failed),
 		passedChecks: num(options.passed),
@@ -535582,6 +536020,30 @@ async function ingestReportAction(reportDir, options) {
 	const requirement = options.requirement ?? subject?.requirement;
 	const conclusion = typeof summary.conclusion === "string" ? summary.conclusion : typeof summary.note === "string" ? summary.note : void 0;
 	const client = await getTrpcClient();
+	const language = await assertReportLanguage(client, ingestLanguageFields({
+		cases,
+		conclusion,
+		goal,
+		plan,
+		proposal,
+		report: content,
+		requirement,
+		title
+	}));
+	if (options.dryRun) {
+		const checked = language.status === "enforced" ? `report language ${language.locale} ✓` : language.status === "unchecked" ? `report language ${language.locale} (not script-checked)` : "report language not set";
+		if (options.json !== void 0) {
+			outputJson({
+				cases: cases.length,
+				dryRun: true,
+				language: languageSummary(language),
+				planItems: plan?.length ?? 0
+			}, typeof options.json === "string" ? options.json : void 0);
+			return;
+		}
+		console.log(`${import_picocolors.default.green("✓ Dry run passed")} — ${cases.length} case(s), ${plan?.length ?? 0} plan item(s), ${checked}. Nothing was published.`);
+		return;
+	}
 	let acceptance;
 	let bundle;
 	if (requestedAcceptanceId) {
@@ -535846,7 +536308,7 @@ function withReportUpsertOptions(cmd) {
 	return cmd.requiredOption("--run <verifyRunId>", "Target session id").option("--verdict <verdict>", "passed|failed|uncertain").option("--summary <text>", "Short summary").option("--content <markdown>", "Full markdown body").option("--total <n>", "Total checks").option("--passed <n>", "Passed checks").option("--failed <n>", "Failed checks").option("--uncertain <n>", "Uncertain checks").option("--json [fields]", "Output JSON");
 }
 function withIngestReportOptions(cmd) {
-	return cmd.option("--source <source>", "agent | agent-testing", "agent-testing").option("--operation <id>", "Link the session to an existing Agent Run").option("--acceptance <id>", "Append this round to an existing acceptance").option("--title <title>", "Override the session title").option("--goal <goal>", "The goal/task being verified").option("--subject <type:id>", "Attach to a task/topic/document (defaults to the current topic; otherwise standalone)").option("--requirement <text>", "Acceptance requirement recorded when the aggregate is first created").option("--open", "Print the in-app URL to open the report").option("--json [fields]", "Output JSON");
+	return cmd.option("--source <source>", "agent | agent-testing", "agent-testing").option("--operation <id>", "Link the session to an existing Agent Run").option("--acceptance <id>", "Append this round to an existing acceptance").option("--title <title>", "Override the session title").option("--goal <goal>", "The goal/task being verified").option("--subject <type:id>", "Attach to a task/topic/document (defaults to the current topic; otherwise standalone)").option("--requirement <text>", "Acceptance requirement recorded when the aggregate is first created").option("--open", "Print the in-app URL to open the report").option("--dry-run", "Validate the report (including its language) without publishing; works on a plan-only result.json").option("--json [fields]", "Output JSON");
 }
 /**
 * The run-scoped acceptance commands. A run is one immutable round of a
@@ -535960,6 +536422,7 @@ function attachAcceptanceFlowCommands(acceptance) {
 	flow.command("publish <acceptanceId>").requiredOption("--file <path>", "JSON: definition and optional flowId").action(async (id, options) => {
 		const client = await getTrpcClient();
 		const input = JSON.parse(await readFile(options.file, "utf8"));
+		await assertReportLanguage(client, flowLanguageFields(input.definition));
 		outputJson(await client.acceptance.publishFlow.mutate({
 			...input,
 			id
@@ -535994,6 +536457,10 @@ function attachAcceptanceFlowCommands(acceptance) {
 	flow.command("record <acceptanceId>").requiredOption("--file <path>", "JSON: verifyRunId, checkItemId, verdict, observation").action(async (id, options) => {
 		const client = await getTrpcClient();
 		const input = JSON.parse(await readFile(options.file, "utf8"));
+		await assertReportLanguage(client, [{
+			path: "observation",
+			text: input.observation
+		}]);
 		outputJson(await client.acceptance.recordFlowStep.mutate({
 			...input,
 			id
@@ -536055,6 +536522,23 @@ const userGlyph = (userReview) => {
 function registerAcceptanceCommands(parent, options) {
 	const acceptance = parent.command("acceptance").description(options?.deprecated ? "Deprecated alias — use `lh acceptance`" : "Delivery acceptances: the cross-round review loop (checks, feedback, decision)");
 	attachAcceptanceFlowCommands(acceptance);
+	acceptance.command("preflight").description("Check that the CLI is authenticated and print the language every acceptance text must be written in. Run it before authoring anything, and pass the language to any subagent you delegate to.").option("--json [fields]", "Output JSON").action(async (options) => {
+		const language = await resolveReportLanguage(await getTrpcClient());
+		const instruction = language.status === "unset" ? "No response language is set on this account, so the language is not checked. Write in the language the user converses in." : `Write every human-readable acceptance field (title, plan, case names and observations, evidence descriptions, conclusion, report.md, proposal.md) in ${language.locale}${language.status === "enforced" ? `, i.e. ${language.rule.languageName}` : ""}. Pass this language explicitly to any subagent you delegate to.`;
+		if (options.json !== void 0) {
+			outputJson({
+				authenticated: true,
+				instruction,
+				language: languageSummary(language),
+				settingsUrl: responseLanguageSettingsUrl()
+			}, typeof options.json === "string" ? options.json : void 0);
+			return;
+		}
+		if (language.status === "unset") log$13.warn(unsetLanguageWarning());
+		console.log(`${import_picocolors.default.green("✓")} Authenticated`);
+		console.log(`${import_picocolors.default.bold("report language")}: ${language.status === "unset" ? import_picocolors.default.yellow("not set") : language.locale}${language.status === "unchecked" ? import_picocolors.default.dim(" (not script-checked)") : ""}`);
+		console.log(instruction);
+	});
 	acceptance.command("create").summary("Create or reuse an acceptance without creating a verification round or results").description("Create or reuse an acceptance record. This does not create checks, verification rounds, results, reports, or evidence.\n\nBefore creating, agents should load and read the acceptance skill (.agents/skills/acceptance/SKILL.md) and follow its workflow. If the skill is missing, run `lh acceptance install`, then read it.\n\nUse create for flow-first planning. If a completed local report already exists, use `lh acceptance run ingest <reportDir>` to publish it; a separate create call is unnecessary. An acceptance URL alone does not mean verification is complete: publish results and required evidence, then read back coverage before handing off a completed acceptance.").requiredOption("--requirement <text>", "Durable business goal (preserved when reusing a subject)").option("-t, --title <text>", "Display title for a standalone acceptance").option("--subject <type:id>", "Reuse or create for task/topic/document/standalone; omit for a new standalone acceptance").option("--json [fields]", "Output JSON, optionally select fields (acceptanceId, acceptanceUrl, requirement, status, subject)").action(async (options) => {
 		const requirement = options.requirement.trim();
 		const title = options.title?.trim();
@@ -536065,7 +536549,15 @@ function registerAcceptanceCommands(parent, options) {
 			subjectType: "standalone"
 		} : parseSubjectRef(options.subject);
 		if (!subject) throw new InvalidArgumentError(`--subject must be one of ${acceptanceSubjectTypes.map((type) => `${type}:<id>`).join(" | ")}`);
-		const result = await (await getTrpcClient()).acceptance.ensure.mutate({
+		const client = await getTrpcClient();
+		await assertReportLanguage(client, [{
+			path: "--requirement",
+			text: requirement
+		}, {
+			path: "--title",
+			text: title
+		}]);
+		const result = await client.acceptance.ensure.mutate({
 			...subject,
 			requirement,
 			title

package/man/man1/lh.1

@@ -1,6 +1,6 @@
 .\" Code generated by `npm run man:generate`; DO NOT EDIT.
 .\" Manual command details come from the Commander command tree.
-.TH LH 1 "" "@lobehub/cli 0.0.64" "User Commands"
+.TH LH 1 "" "@lobehub/cli 0.0.65" "User Commands"
 .SH NAME
 lh \- LobeHub CLI \- manage and connect to LobeHub services
 .SH SYNOPSIS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/cli",
-  "version": "0.0.64",
+  "version": "0.0.65",
   "type": "module",
   "bin": {
     "lh": "dist/index.js",
@@ -16,11 +16,36 @@
     "dist",
     "man"
   ],
+  "scripts": {
+    "build": "bun scripts/ensureWorkspaceLinks.ts && tsdown && tsdown src/daemon/maintenanceWorker.ts --no-config --no-clean --format esm --target node22",
+    "cli:link": "bun link",
+    "cli:unlink": "bun unlink",
+    "dev": "LOBEHUB_CLI_HOME=.lobehub-dev bun src/index.ts",
+    "man:generate": "bun src/man/generate.ts",
+    "prepublishOnly": "npm run build && npm run man:generate",
+    "test": "bunx vitest run --config vitest.config.mts --silent='passed-only'",
+    "test:coverage": "bunx vitest run --config vitest.config.mts --coverage",
+    "test:e2e": "bunx vitest run --config vitest.e2e.config.mts --silent='passed-only'",
+    "type-check": "tsc --noEmit"
+  },
   "dependencies": {
     "@lydell/node-pty": "1.2.0-beta.15",
     "ws": "^8.21.0"
   },
   "devDependencies": {
+    "@lobechat/agent-gateway-client": "workspace:*",
+    "@lobechat/agent-tracing": "workspace:*",
+    "@lobechat/const": "workspace:*",
+    "@lobechat/device-control": "workspace:*",
+    "@lobechat/device-gateway-client": "workspace:*",
+    "@lobechat/device-identity": "workspace:*",
+    "@lobechat/eval-rubric": "workspace:*",
+    "@lobechat/heterogeneous-agents": "workspace:*",
+    "@lobechat/html-artifact": "workspace:*",
+    "@lobechat/local-file-shell": "workspace:*",
+    "@lobechat/tool-runtime": "workspace:*",
+    "@lobechat/types": "workspace:*",
+    "@lobechat/utils": "workspace:*",
     "@trpc/client": "^11.18.0",
     "@types/node": "^24.13.2",
     "@types/semver": "^7.7.1",
@@ -39,20 +64,7 @@
     "tsdown": "^0.21.10",
     "typescript": "^6.0.3",
     "url-join": "^5.0.0",
-    "vitest": "5.0.0",
-    "@lobechat/const": "1.0.0",
-    "@lobechat/agent-gateway-client": "1.0.0",
-    "@lobechat/agent-tracing": "1.0.0",
-    "@lobechat/device-gateway-client": "1.0.0",
-    "@lobechat/device-identity": "1.0.0",
-    "@lobechat/eval-rubric": "1.0.0",
-    "@lobechat/device-control": "1.0.0",
-    "@lobechat/heterogeneous-agents": "1.0.0",
-    "@lobechat/html-artifact": "1.0.0",
-    "@lobechat/local-file-shell": "1.0.0",
-    "@lobechat/tool-runtime": "1.0.0",
-    "@lobechat/utils": "1.0.0",
-    "@lobechat/types": "1.0.0"
+    "vitest": "5.0.0"
   },
   "engines": {
     "node": ">=22.15"
@@ -60,16 +72,5 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
-  },
-  "scripts": {
-    "build": "bun scripts/ensureWorkspaceLinks.ts && tsdown && tsdown src/daemon/maintenanceWorker.ts --no-config --no-clean --format esm --target node22",
-    "cli:link": "bun link",
-    "cli:unlink": "bun unlink",
-    "dev": "LOBEHUB_CLI_HOME=.lobehub-dev bun src/index.ts",
-    "man:generate": "bun src/man/generate.ts",
-    "test": "bunx vitest run --config vitest.config.mts --silent='passed-only'",
-    "test:coverage": "bunx vitest run --config vitest.config.mts --coverage",
-    "test:e2e": "bunx vitest run --config vitest.e2e.config.mts --silent='passed-only'",
-    "type-check": "tsc --noEmit"
   }
-}
+}