cli-confirm-protocol 7.0.19 → 7.0.28

package/README.md

@@ -1,9 +1,25 @@
-# Confirm Protocol CLI
+# 确认协议 / Confirm Protocol / Протокол подтверждения
 
-Official CLI.Tax installer for the structured confirmation protocol skill.
+CLI.Tax 结构化确认协议官方安装包：统一确认、单选、多选与输入交互，返回经过校验的答案、聊天兼容文本和审计记录。
+
+Official CLI.Tax installer for structured confirmation, single-choice, multi-choice, and input interactions with validated answers, chat-compatible rendering, and audit records.
+
+Официальный установщик CLI.Tax для структурированных подтверждений, одиночного и множественного выбора и ввода с проверенными ответами, текстом для чата и аудитом.
 
 ```bash
 npx cli-confirm-protocol@latest install
 ```
 
 Source: https://github.com/88208555/confirm-protocol-clitax.git
+
+## 受限调用与自动评价 / Restricted invocation and automatic evaluation / Ограниченный вызов и автооценка
+
+IDE 通过 `invoke` 或 JSON-stdin `broker` 调用。broker 本身只需要 Brain Client HTTPS、受限身份文件和显式传入路径，不需要完整磁盘访问。要保证 IDE 看不到令牌，必须把 broker 作为独立低权限账户或沙箱服务运行并只暴露受限 IPC；同一账户下的 `0600` 不能隔离 IDE 与 broker。服务端在同一次 runtime 请求中事务提交权威评价并返回回执，broker 只验证回执，不发起第二次评价写入。
+
+Use `npx cli-confirm-protocol@latest invoke <operation> '<JSON object>'`, or send JSON stdin to `npx cli-confirm-protocol@latest broker`. The broker itself needs only Brain Client HTTPS, its restricted identity file, and explicitly supplied paths; it does not need full-disk access. To keep the token inaccessible to the IDE, run the broker under a separate least-privilege account or sandbox service and expose only restricted IPC. Mode `0600` does not isolate two processes running as the same account.
+
+IDE вызывает пакет через `invoke` или JSON-stdin `broker`. Самому broker нужны только HTTPS Brain Client, ограниченный файл идентификации и явно переданные пути; полный доступ к диску не нужен. Чтобы IDE не мог прочитать токен, broker должен работать под отдельной малопривилегированной учётной записью или в sandbox-сервисе с ограниченным IPC. Режим `0600` не изолирует процессы одной учётной записи.
+
+The Brain Client server binds the real response and atomically persists the authoritative score and comment within the same runtime request, then returns a committed receipt. The broker verifies `feedbackReceiptId`, `feedbackInvocationId`, and the authoritative digest; it makes no second evaluation write and never creates a score or comment. Not-reported or incomplete validation, P0/P1 findings, blocked, and failed results cannot be positive. Missing credentials or receipts, digest mismatches, invalid responses, and HTTP failures fail explicitly.
+
+The local CLI has no command for manually submitting a score or evaluation comment. Humans cannot choose a skill score or write skill evaluation content. Daily chat is outside the evaluation protocol.

package/broker.mjs

@@ -0,0 +1,301 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { constants } from 'node:fs'
+import { lstat, open } from 'node:fs/promises'
+import { resolve, win32 } from 'node:path'
+
+export const LOOKUP_TIMEOUT_MS = 8000
+export const CALL_TIMEOUT_MS = 120_000
+const FEEDBACK_API_PATH = '/api/v1/telemetry/skill-usage'
+const TOKEN_FILE_ENV = 'CLITAX_BRAIN_CLIENT_TOKEN_FILE'
+const TOKEN_FILE_VERSION = 'member-brain.client-token-file/1.0'
+const AUTH_SCHEME = 'BrainClient'
+const TOKEN_FILE_MAX_BYTES = 16_384
+const POSIX_TOKEN_FILE_MODE = 0o600
+const WINDOWS_BROKER_DIRECTORY = ['CLI.Tax', 'broker']
+const FEEDBACK_COMMENT_MAX = 500
+const EVALUATION_DURATION_MAX = 86_400_000
+const SCORE_MIN = 0
+const SCORE_MAX = 100
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/
+const INVOCATION_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+const DIGEST_PATTERN = /^[0-9a-f]{64}$/
+const PROTOCOL_STATUSES = new Set(['succeeded', 'blocked', 'failed'])
+const VALIDATION_STATES = new Set(['passed', 'failed', 'incomplete'])
+const EVALUATION_SCHEMA = 'skill-automatic-evaluation/1.0'
+const IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
+const REQUEST_SCHEMA_PATTERN = /^([A-Za-z0-9.-]+\.skill)\.request\/([0-9]+\.[0-9]+)$/
+
+function asObject(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`)
+  }
+  return value
+}
+
+function requiredString(value, label) {
+  const text = typeof value === 'string' ? value.trim() : ''
+  if (!text) throw new Error(`${label} is required`)
+  return text
+}
+
+function boundedInteger(value, label) {
+  if (!Number.isFinite(value) || value < 0 || !Number.isSafeInteger(value)) {
+    throw new Error(`${label} must be a non-negative safe integer`)
+  }
+  return value
+}
+
+function insideWindowsDirectory(candidate, directory) {
+  const relative = win32.relative(directory, candidate)
+  return relative === '' || (!relative.startsWith('..\\') && relative !== '..' && !win32.isAbsolute(relative))
+}
+
+export function brainClientTokenPath(environment, platform = process.platform) {
+  const configured = requiredString(environment[TOKEN_FILE_ENV], TOKEN_FILE_ENV)
+  if (platform !== 'win32') return resolve(configured)
+  if (!win32.isAbsolute(configured)) {
+    throw new Error('Windows Brain Client token file path must be absolute')
+  }
+  const localAppData = requiredString(environment.LOCALAPPDATA, 'LOCALAPPDATA')
+  const brokerDirectory = win32.resolve(localAppData, ...WINDOWS_BROKER_DIRECTORY)
+  const candidate = win32.resolve(configured)
+  if (!insideWindowsDirectory(candidate, brokerDirectory)) {
+    throw new Error(`Windows Brain Client token file must be inside ${brokerDirectory}`)
+  }
+  return candidate
+}
+
+function assertTokenFileStatus(status, platform, currentUserId) {
+  if (!status.isFile() || status.size < 1 || status.size > TOKEN_FILE_MAX_BYTES) {
+    throw new Error('Brain Client token file must be a non-empty restricted file')
+  }
+  if (platform === 'win32') return
+  if (!Number.isInteger(currentUserId)) {
+    throw new Error('Brain Client token file ownership cannot be verified')
+  }
+  if (status.uid !== currentUserId || (status.mode & 0o777) !== POSIX_TOKEN_FILE_MODE) {
+    throw new Error('Brain Client token file must be owned by the current user with mode 0600')
+  }
+}
+
+function parseTokenFile(source) {
+  let tokenFile
+  try {
+    tokenFile = asObject(JSON.parse(source), 'Brain Client token file')
+  } catch {
+    throw new Error('Brain Client token file must contain valid JSON')
+  }
+  const expectedKeys = ['authorizationScheme', 'endpoint', 'schemaVersion', 'token']
+  if (Object.keys(tokenFile).sort().join('\n') !== expectedKeys.join('\n')) {
+    throw new Error('Brain Client token file contains unknown or missing fields')
+  }
+  return tokenFile
+}
+
+export async function brainClientAuthorization(context, environment, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform
+  const tokenFilePath = brainClientTokenPath(environment, platform)
+  const inspectPath = dependencies.lstat ?? lstat
+  const openPath = dependencies.open ?? open
+  const currentUserId = platform === 'win32'
+    ? null
+    : (dependencies.getuid ?? process.getuid)?.()
+  const linkStatus = await inspectPath(tokenFilePath)
+  if (linkStatus.isSymbolicLink()) throw new Error('Brain Client token file cannot be a symlink')
+  const noFollow = platform === 'win32' ? 0 : (constants.O_NOFOLLOW ?? 0)
+  const handle = await openPath(tokenFilePath, constants.O_RDONLY | noFollow)
+  try {
+    const status = await handle.stat()
+    assertTokenFileStatus(status, platform, currentUserId)
+    const tokenFile = parseTokenFile(await handle.readFile('utf8'))
+    const endpoint = new URL(requiredString(tokenFile.endpoint, 'Brain Client endpoint'))
+    if (tokenFile.schemaVersion !== TOKEN_FILE_VERSION
+      || tokenFile.authorizationScheme !== AUTH_SCHEME
+      || endpoint.origin !== new URL(context.endpoint).origin
+      || endpoint.pathname !== FEEDBACK_API_PATH || endpoint.search || endpoint.hash
+      || endpoint.username || endpoint.password
+      || !TOKEN_PATTERN.test(tokenFile.token)) {
+      throw new Error('Brain Client token file authority is invalid')
+    }
+    return `${AUTH_SCHEME} ${tokenFile.token}`
+  } finally {
+    await handle.close()
+  }
+}
+
+function canonicalJson(value) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') {
+    return JSON.stringify(value)
+  }
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) throw new Error('automatic evaluation contains a non-finite number')
+    return JSON.stringify(value)
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`
+  const record = asObject(value, 'automatic evaluation')
+  return `{${Object.keys(record).sort().map((key) => (
+    `${JSON.stringify(key)}:${canonicalJson(record[key])}`
+  )).join(',')}}`
+}
+
+function expectedResponseSchema(requestSchema) {
+  const matched = requiredString(requestSchema, 'skill request schemaVersion')
+    .match(REQUEST_SCHEMA_PATTERN)
+  if (!matched) throw new Error('skill request schemaVersion is invalid')
+  return `${matched[1]}.response/${matched[2]}`
+}
+
+function protocolResponse(protocolValue, requestEnvelope) {
+  const protocol = asObject(protocolValue, 'skill protocol response')
+  const responseSchema = expectedResponseSchema(requestEnvelope.schemaVersion)
+  if (protocol.schemaVersion !== responseSchema) {
+    throw new Error('skill protocol response schemaVersion does not match the request')
+  }
+  if (protocol.requestId !== requestEnvelope.requestId) {
+    throw new Error('skill protocol response requestId does not match the request')
+  }
+  const status = requiredString(protocol.status, 'skill protocol status')
+  if (!PROTOCOL_STATUSES.has(status)) {
+    throw new Error('skill protocol status must be succeeded, blocked, or failed')
+  }
+  return { protocol, responseSchema, status }
+}
+
+export function authoritativeEvaluation(value, expected) {
+  const evaluation = asObject(value, 'server automatic evaluation')
+  const expectedKeys = [
+    'digest', 'durationMs', 'findingCount', 'operation', 'p0Count', 'p1Count', 'p2Count',
+    'requestId', 'responseSchemaVersion', 'schemaVersion', 'score', 'status', 'userComment',
+    'validation',
+  ]
+  if (Object.keys(evaluation).sort().join('\n') !== expectedKeys.join('\n')) {
+    throw new Error('server automatic evaluation contains unknown or missing fields')
+  }
+  if (evaluation.schemaVersion !== EVALUATION_SCHEMA
+    || evaluation.operation !== expected.operation
+    || evaluation.requestId !== expected.requestId
+    || evaluation.responseSchemaVersion !== expected.responseSchema
+    || evaluation.status !== expected.status
+    || !VALIDATION_STATES.has(evaluation.validation)
+    || typeof evaluation.userComment !== 'string' || !evaluation.userComment.trim()
+    || Buffer.byteLength(evaluation.userComment, 'utf8') > FEEDBACK_COMMENT_MAX
+    || typeof evaluation.digest !== 'string' || !DIGEST_PATTERN.test(evaluation.digest)) {
+    throw new Error('server automatic evaluation authority is invalid')
+  }
+  for (const field of ['durationMs', 'findingCount', 'p0Count', 'p1Count', 'p2Count', 'score']) {
+    boundedInteger(evaluation[field], `server automatic evaluation ${field}`)
+  }
+  if (evaluation.score < SCORE_MIN || evaluation.score > SCORE_MAX
+    || evaluation.durationMs > EVALUATION_DURATION_MAX
+    || evaluation.findingCount < evaluation.p0Count + evaluation.p1Count + evaluation.p2Count) {
+    throw new Error('server automatic evaluation bounds are invalid')
+  }
+  if ((evaluation.status !== 'succeeded' || evaluation.validation !== 'passed'
+    || evaluation.p0Count > 0 || evaluation.p1Count > 0) && evaluation.score >= 60) {
+    throw new Error('server automatic evaluation cannot report a positive score')
+  }
+  const { digest, ...core } = evaluation
+  const actualDigest = createHash('sha256').update(canonicalJson(core)).digest('hex')
+  if (digest !== actualDigest) throw new Error('server automatic evaluation digest is invalid')
+  return evaluation
+}
+
+async function responsePayload(response, label) {
+  try {
+    return asObject(await response.json(), label)
+  } catch {
+    throw new Error(`${label} is not valid JSON (HTTP ${response.status})`)
+  }
+}
+
+function invocationRequest(context, operation, input) {
+  const normalizedOperation = requiredString(operation, 'skill operation')
+  if (!IDENTIFIER_PATTERN.test(normalizedOperation)) {
+    throw new Error('skill operation is invalid')
+  }
+  expectedResponseSchema(context.schemaVersion)
+  return {
+    schemaVersion: context.schemaVersion,
+    requestId: `${context.runtimeCode}-${randomUUID()}`,
+    operation: normalizedOperation,
+    input: asObject(input, 'skill operation input'),
+  }
+}
+
+export async function invokeOfficialSkill(context, operation, input, dependencies) {
+  const environment = asObject(dependencies.environment, 'broker environment')
+  if (typeof dependencies.request !== 'function') {
+    throw new Error('broker request dependency is required')
+  }
+  const authorization = await brainClientAuthorization(context, environment, dependencies.credentialAccess)
+  const requestEnvelope = invocationRequest(context, operation, input)
+  let response
+  try {
+    response = await dependencies.request(context.endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: authorization },
+      body: JSON.stringify({ input: requestEnvelope }),
+      signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+    })
+  } catch {
+    throw new Error(`${context.displayName} ${operation} invocation failed`)
+  }
+  const payload = await responsePayload(response, `${context.displayName} ${operation} response`)
+  if (!response.ok || payload.ok !== true) {
+    throw new Error(`${context.displayName} ${operation} failed: HTTP ${response.status}`)
+  }
+  const invocationId = payload.feedbackInvocationId
+  if (typeof invocationId !== 'string' || !INVOCATION_PATTERN.test(invocationId)) {
+    throw new Error(`${context.displayName} ${operation} response is missing a valid feedbackInvocationId`)
+  }
+  const feedbackReceiptId = payload.feedbackReceiptId
+  const feedbackRequestId = payload.feedbackRequestId
+  if (typeof feedbackReceiptId !== 'string' || !INVOCATION_PATTERN.test(feedbackReceiptId)
+    || feedbackRequestId !== `automatic-${invocationId}`) {
+    throw new Error(`${context.displayName} ${operation} response is missing a committed feedback receipt`)
+  }
+  const protocolAuthority = protocolResponse(payload.output, requestEnvelope)
+  const evaluation = authoritativeEvaluation(payload.feedbackEvaluation, {
+    operation: requestEnvelope.operation,
+    requestId: requestEnvelope.requestId,
+    responseSchema: protocolAuthority.responseSchema,
+    status: protocolAuthority.status,
+  })
+  const feedback = {
+    id: feedbackReceiptId,
+    requestId: feedbackRequestId,
+    duplicated: false,
+  }
+  return { response: payload, invocationId, evaluation, feedback }
+}
+
+export async function callOfficialSkill(context, operation, input, dependencies) {
+  return (await invokeOfficialSkill(context, operation, input, dependencies)).response
+}
+
+export function invokeCommandInput(args) {
+  const operation = requiredString(args[1], 'skill operation')
+  const source = args.slice(2).join(' ').trim()
+  if (!source) return { operation, input: {} }
+  try {
+    return { operation, input: asObject(JSON.parse(source), 'skill operation input') }
+  } catch {
+    throw new Error('skill operation input must be a JSON object')
+  }
+}
+
+export function brokerCommandInput(source) {
+  let parsed
+  try {
+    parsed = asObject(JSON.parse(source), 'broker request')
+  } catch {
+    throw new Error('broker request must be a JSON object')
+  }
+  if (Object.keys(parsed).some((key) => !['operation', 'input'].includes(key))) {
+    throw new Error('broker request contains unknown fields')
+  }
+  return {
+    operation: requiredString(parsed.operation, 'skill operation'),
+    input: asObject(parsed.input, 'skill operation input'),
+  }
+}

package/installer.mjs

@@ -2,29 +2,33 @@
  * 八个官方技能共用这一份安装器。packages/*-cli/installer.mjs 必须与本文件字节一致。
  * 禁止第二套超时、第二套版本来源、第二套 bin 名。
  */
-import { randomUUID } from 'node:crypto'
-import { constants, existsSync, readFileSync } from 'node:fs'
-import { cp, lstat, mkdir, open, rm, writeFile } from 'node:fs/promises'
+import { existsSync, readFileSync } from 'node:fs'
+import { cp, mkdir, rm, writeFile } from 'node:fs/promises'
 import { dirname, join, resolve } from 'node:path'
 import { stdin, stdout } from 'node:process'
 import { createInterface } from 'node:readline/promises'
 import { fileURLToPath } from 'node:url'
+import {
+  LOOKUP_TIMEOUT_MS,
+  brokerCommandInput,
+  invokeCommandInput,
+  invokeOfficialSkill,
+} from './broker.mjs'
+
+export {
+  CALL_TIMEOUT_MS,
+  LOOKUP_TIMEOUT_MS,
+  authoritativeEvaluation,
+  brainClientAuthorization,
+  brainClientTokenPath,
+  brokerCommandInput,
+  callOfficialSkill,
+  invokeCommandInput,
+  invokeOfficialSkill,
+} from './broker.mjs'
 
-export const LOOKUP_TIMEOUT_MS = 8000
-export const CALL_TIMEOUT_MS = 120_000
 const INSTALL_META = 'install-meta.json'
-const FEEDBACK_API_PATH = '/api/v1/telemetry/skill-usage'
-const BRAIN_CLIENT_TOKEN_FILE_ENV = 'CLITAX_BRAIN_CLIENT_TOKEN_FILE'
-const BRAIN_CLIENT_TOKEN_FILE_VERSION = 'member-brain.client-token-file/1.0'
-const BRAIN_CLIENT_AUTH_SCHEME = 'BrainClient'
-const BRAIN_CLIENT_TOKEN_FILE_MAX_BYTES = 16_384
-const BRAIN_CLIENT_TOKEN_FILE_MODE = 0o600
-const FEEDBACK_COMMENT_MAX = 500
-const FEEDBACK_SCORE_MIN = 0
-const FEEDBACK_SCORE_MAX = 100
-const BRAIN_CLIENT_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/
-const FEEDBACK_INVOCATION_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-const FEEDBACK_SCORE_PATTERN = /^(?:0|[1-9]\d{0,2})$/
+const BROKER_STDIN_MAX_BYTES = 1_048_576
 
 function asObject(value, label) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -94,138 +98,6 @@ export async function fetchLatestVersion(context) {
   }
 }
 
-export async function callOfficialSkill(context, operation, input) {
-  const requestId = `${context.npmName}-${Date.now()}`
-  const response = await fetch(context.endpoint, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      input: {
-        schemaVersion: context.schemaVersion,
-        requestId,
-        operation,
-        input,
-      },
-    }),
-    signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
-  })
-  let payload
-  try {
-    payload = await response.json()
-  } catch {
-    throw new Error(`${context.displayName} ${operation} failed: non-JSON response (HTTP ${response.status}). Check ${context.endpoint}.`)
-  }
-  if (!response.ok || payload?.ok !== true) {
-    const message = payload?.error?.message
-    if (typeof message !== 'string' || !message.trim()) {
-      throw new Error(`${context.displayName} ${operation} failed: HTTP ${response.status}`)
-    }
-    throw new Error(`${context.displayName} ${operation} failed: ${message}`)
-  }
-  return payload
-}
-
-export function feedbackCommandInput(args) {
-  const invocationId = requiredString(args[1], 'feedback invocation id')
-  if (!FEEDBACK_INVOCATION_PATTERN.test(invocationId)) {
-    throw new Error('feedback invocation id must be the UUID returned by a real skill response')
-  }
-  const scoreText = requiredString(args[2], 'feedback score')
-  if (!FEEDBACK_SCORE_PATTERN.test(scoreText)) {
-    throw new Error(`feedback score must be an integer between ${FEEDBACK_SCORE_MIN} and ${FEEDBACK_SCORE_MAX}`)
-  }
-  const score = Number(scoreText)
-  if (!Number.isInteger(score) || score < FEEDBACK_SCORE_MIN || score > FEEDBACK_SCORE_MAX) {
-    throw new Error(`feedback score must be between ${FEEDBACK_SCORE_MIN} and ${FEEDBACK_SCORE_MAX}`)
-  }
-  const userComment = args.slice(3).join(' ').trim()
-  if (!userComment) throw new Error('feedback comment is required')
-  if (userComment.length > FEEDBACK_COMMENT_MAX) {
-    throw new Error(`feedback comment must be at most ${FEEDBACK_COMMENT_MAX} characters`)
-  }
-  return { invocationId, score, userComment }
-}
-
-async function brainClientAuthorization(context, environment) {
-  const configuredPath = typeof environment[BRAIN_CLIENT_TOKEN_FILE_ENV] === 'string'
-    ? environment[BRAIN_CLIENT_TOKEN_FILE_ENV].trim() : ''
-  if (!configuredPath) throw new Error(`${BRAIN_CLIENT_TOKEN_FILE_ENV} is required`)
-  if (process.platform === 'win32' || typeof process.getuid !== 'function') {
-    throw new Error('Brain Client token file ownership cannot be verified')
-  }
-  const tokenFilePath = resolve(configuredPath)
-  const linkStatus = await lstat(tokenFilePath)
-  if (linkStatus.isSymbolicLink()) throw new Error('Brain Client token file cannot be a symlink')
-  const handle = await open(tokenFilePath, constants.O_RDONLY | constants.O_NOFOLLOW)
-  try {
-    const status = await handle.stat()
-    if (!status.isFile() || status.uid !== process.getuid()
-      || (status.mode & 0o777) !== BRAIN_CLIENT_TOKEN_FILE_MODE
-      || status.size < 1 || status.size > BRAIN_CLIENT_TOKEN_FILE_MAX_BYTES) {
-      throw new Error('Brain Client token file must be owned by the current user with mode 0600')
-    }
-    const tokenFile = asObject(JSON.parse(await handle.readFile('utf8')), 'Brain Client token file')
-    const expectedKeys = ['authorizationScheme', 'endpoint', 'schemaVersion', 'token']
-    if (Object.keys(tokenFile).sort().join('\n') !== expectedKeys.join('\n')) {
-      throw new Error('Brain Client token file contains unknown or missing fields')
-    }
-    const endpoint = new URL(requiredString(tokenFile.endpoint, 'Brain Client endpoint'))
-    if (tokenFile.schemaVersion !== BRAIN_CLIENT_TOKEN_FILE_VERSION
-      || tokenFile.authorizationScheme !== BRAIN_CLIENT_AUTH_SCHEME
-      || endpoint.origin !== new URL(context.endpoint).origin
-      || endpoint.pathname !== FEEDBACK_API_PATH || endpoint.search || endpoint.hash
-      || endpoint.username || endpoint.password
-      || !BRAIN_CLIENT_TOKEN_PATTERN.test(tokenFile.token)) {
-      throw new Error('Brain Client token file authority is invalid')
-    }
-    return `${BRAIN_CLIENT_AUTH_SCHEME} ${tokenFile.token}`
-  } finally {
-    await handle.close()
-  }
-}
-
-export async function submitOfficialSkillFeedback(context, args, environment, request) {
-  const input = feedbackCommandInput(args)
-  const authorization = await brainClientAuthorization(context, environment)
-  const requestId = `${context.runtimeCode}-${randomUUID()}`
-  let response
-  try {
-    response = await request(new URL(FEEDBACK_API_PATH, context.endpoint), {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: authorization,
-      },
-      body: JSON.stringify({
-        requestId,
-        skillId: context.runtimeCode,
-        invocationId: input.invocationId,
-        score: input.score,
-        userComment: input.userComment,
-      }),
-      signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS),
-    })
-  } catch {
-    throw new Error('cli.tax feedback request failed')
-  }
-  let payload
-  try {
-    payload = asObject(await response.json(), 'cli.tax feedback response')
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith('cli.tax feedback response')) throw error
-    throw new Error(`cli.tax feedback failed: non-JSON response (HTTP ${response.status})`)
-  }
-  if (!response.ok || payload.ok !== true) {
-    throw new Error(`cli.tax feedback failed: HTTP ${response.status}`)
-  }
-  if (payload.requestId !== requestId || typeof payload.id !== 'string'
-    || !FEEDBACK_INVOCATION_PATTERN.test(payload.id)
-    || typeof payload.duplicated !== 'boolean') {
-    throw new Error('cli.tax feedback response authority is invalid')
-  }
-  return { id: payload.id, requestId, duplicated: payload.duplicated }
-}
-
 export async function installOfficialSkill(context, explicit) {
   const target = installTarget(context.skillName, explicit)
   await mkdir(target, { recursive: true })
@@ -283,21 +155,52 @@ export function defaultUsage(context, extraLines) {
     `  npx ${context.npmName}@latest check [directory]`,
     '      Check whether the installed skill has a newer version.',
     `  npx ${context.npmName}@latest run`,
-    '      Run the skill handshake: discover capabilities and collect intake answers.',
+    "      Run this skill's applicability or onboarding flow; only a real HTTP invocation can trigger automatic evaluation.",
+    `  npx ${context.npmName}@latest invoke <operation> <JSON-object>`,
+    '      Invoke through the restricted local broker; a valid real HTTP invocation submits one authority-bound evaluation.',
+    `  npx ${context.npmName}@latest broker`,
+    '      Read one {"operation":"...","input":{...}} request from JSON stdin.',
+    'Credential: CLITAX_BRAIN_CLIENT_TOKEN_FILE (the broker reads it; never pass the token).',
     `Endpoint: ${context.endpoint}`,
   ]
   if (extraLines?.length) lines.push('', ...extraLines)
   return lines.join('\n')
 }
 
+function brokerDependencies() {
+  return { environment: process.env, request: fetch }
+}
+
+async function readBrokerSource(input) {
+  let source = ''
+  for await (const chunk of input) {
+    source += chunk
+    if (Buffer.byteLength(source, 'utf8') > BROKER_STDIN_MAX_BYTES) {
+      throw new Error(`broker request must be at most ${BROKER_STDIN_MAX_BYTES} bytes`)
+    }
+  }
+  if (!source.trim()) throw new Error('broker request is required on stdin')
+  return source
+}
+
+async function runBrokerInvocation(context, commandInput) {
+  const invocation = await invokeOfficialSkill(
+    context, commandInput.operation, commandInput.input, brokerDependencies(),
+  )
+  console.log(JSON.stringify(invocation))
+  return invocation
+}
+
 export async function runIntakeHandshake(context, spec) {
-  const capabilities = await callOfficialSkill(context, 'capabilities', {})
+  const invocation = await invokeOfficialSkill(context, 'capabilities', {}, brokerDependencies())
+  const capabilities = invocation.response
   const output = capabilities.output && typeof capabilities.output === 'object' ? capabilities.output : {}
   const skill = output.skill && typeof output.skill === 'object' ? output.skill : {}
   const version = typeof skill.version === 'string' && skill.version.trim()
     ? skill.version.trim()
     : context.skillVersion
   console.log(`${context.displayName} ${version}`)
+  console.log(`Automatic feedback accepted: ${invocation.feedback.id}`)
   if (typeof spec.afterCapabilities === 'function') spec.afterCapabilities(output)
   const readline = createInterface({ input: stdin, output: stdout })
   const answers = []
@@ -340,9 +243,9 @@ export async function dispatchOfficialSkillCli(options) {
     if (command === 'install') await installOfficialSkill(context, argument)
     else if (command === 'check') await checkOfficialSkill(context, argument)
     else if (command === 'run') await options.runCommand(context)
-    else if (command === 'feedback') {
-      const receipt = await submitOfficialSkillFeedback(context, args, process.env, fetch)
-      console.log(`${context.displayName} feedback accepted: ${receipt.id}`)
+    else if (command === 'invoke') await runBrokerInvocation(context, invokeCommandInput(args))
+    else if (command === 'broker') {
+      await runBrokerInvocation(context, brokerCommandInput(await readBrokerSource(stdin)))
     }
     else if (command === 'help' || command === '--help' || command === '-h') {
       console.log(options.usage ? options.usage(context) : defaultUsage(context, options.extraUsageLines))

package/package.json

@@ -6,6 +6,7 @@
   "files": [
     "cli.mjs",
     "installer.mjs",
+    "broker.mjs",
     "README.md",
     "skill/SKILL.md",
     "skill/skill.json"
@@ -17,5 +18,5 @@
     "url": "https://github.com/88208555/confirm-protocol-clitax.git"
   },
   "type": "module",
-  "version": "7.0.19"
+  "version": "7.0.28"
 }

package/skill/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: confirm-protocol
-description: '把技能需要的用户确认转换为统一 interaction 协议，并返回结构化答案、聊天降级文本、低风险记忆状态、批次和审计记录。用于确认、单选、多选或输入交互；不用于普通聊天，也不代替客户端 UI。'
+description: '把技能需要的用户确认转换为统一 interaction 协议，并返回结构化答案、聊天兼容文本、低风险记忆状态、批次和审计记录；用于确认、单选、多选或输入交互，不用于普通聊天，也不代替客户端 UI。Convert skill-required confirmation into one interaction protocol with structured answers, chat-compatible text, low-risk memory state, batches, and audit records; use for confirm, choice, multi-choice, or input interactions, not ordinary chat or as a replacement for client UI. Преобразует требуемое навыком подтверждение в единый interaction-протокол со структурированными ответами, текстом для чата, низкорисковой памятью, пакетами и аудитом; применяется к подтверждению, выбору, множественному выбору и вводу, но не к обычному чату и не вместо UI клиента.'
 ---
 
-# Confirm Protocol
+# 确认协议 / Confirm Protocol / Протокол подтверждения
 
-Package version: v7.0.19
+Package version: v7.0.28
 
 Endpoint: https://cli.tax/Cf8Pr7Tm2Q
 
@@ -13,7 +13,13 @@ Request schema: `confirm-protocol.skill.request/1.0`
 
 Confirm Protocol 是技能链的统一确认交互层。它只定义协议并验证答案，不替代业务技能，也不把“等待用户”伪装成成功。
 
-## 强制流程
+中文：只有业务技能确实需要确认、单选、多选或文本输入时才调用。高风险请求必须逐项等待真人决定，永远不能记忆、批量或默认放行；没有原生界面时返回编号聊天内容，不伪称已经弹窗。
+
+English: Call this skill only when another skill genuinely needs confirmation, one choice, multiple choices, or typed input. High-risk requests always wait for an explicit human decision and can never be remembered, batched, or default-approved. Without a native UI, return the numbered chat rendering and never claim a dialog appeared.
+
+Русский: Навык вызывается только когда другому навыку действительно нужны подтверждение, одиночный или множественный выбор либо текстовый ввод. Запрос высокого риска всегда ждёт явного решения человека и никогда не запоминается, не объединяется в пакет и не одобряется по умолчанию. Без нативного UI возвращается нумерованный текст для чата; нельзя утверждать, что окно уже показано.
+
+## 强制流程 / Required sequence / Обязательная последовательность
 
 1. 调用 `capabilities`，读取全部 `operationSchemas` 与真实能力状态。
 2. 业务技能构造 `confirm.interaction/1.0`，调用 `interaction-request`。
@@ -21,7 +27,7 @@ Confirm Protocol 是技能链的统一确认交互层。它只定义协议并验
 4. 用户作答后调用 `interaction-answer`，得到不可歧义的 `callbackRequest` 和审计记录。
 5. 只有 `risk=low + rememberable=true` 才能调用 `memory-set`。高风险永远不可记忆、不可批量、不可默认超时放行。
 
-## 操作
+## 操作 / Operations / Операции
 
 - `capabilities` / `help`：能力、JSON Schema 与实现边界。
 - `interaction-request`：验证并返回 interaction 与聊天降级文本。
@@ -31,27 +37,34 @@ Confirm Protocol 是技能链的统一确认交互层。它只定义协议并验
 - `batch-request`：每批最多三个低风险确认；高风险始终独立。
 - `audit-query`：查询调用方提供的审计记录。
 
-## 风险规则
+## 风险规则 / Risk rules / Правила риска
 
-- `risk=high` 必须带非空风险说明、`rememberable=false`、`timeoutAction=wait`。
+- `risk=high` 必须带非空风险说明、`default=null`、`rememberable=false`、`timeoutAction=wait`。
 - `confirm` / `choice` 只能返回一个合法 option id；`multi` 返回去重后的 id 数组；`input` 返回非空文本。
+- interaction、option、callback、memory 与 audit 对象严格拒绝未声明字段和类型错配；超时必须为 `null` 或大于等于 1 的整数，默认值必须匹配交互类型与已有选项。
 - callback 的 operation 和原 payload 由请求方声明；答案只能追加到副本，不能篡改原 interaction。
-- 记忆与审计状态由已认证客户端或平台持久化。纯运行时是无状态协议层，不宣称已经写入数据库。
+- 记忆与审计状态由已认证客户端或平台持久化。调用方传回的每条状态都必须重新验证；纯运行时是无状态协议层，不宣称已经写入数据库。
 
-## 实现状态
+## 实现状态 / Implementation status / Состояние реализации
 
 | 能力 | 状态 | 边界 |
 |---|---|---|
 | interaction 请求/回答闭环 | 已实现 | 返回统一 callbackRequest 与 auditEntry |
 | C 档聊天渲染 | 已实现 | 同一协议生成编号文本 |
 | 低风险记忆/批量/审计 | 已实现（调用方持有） | 运行时返回更新后的状态，不伪造平台持久化 |
-| IDE 原生适配器 | local notifier required | 由具体 IDE 插件渲染 |
-| OS 原生 Confirm Notifier | local notifier required | 当前不宣称已弹出系统窗口 |
+| IDE 原生适配器 | 需本地通知器 / local notifier required / нужен локальный уведомитель | 由具体 IDE 插件渲染 |
+| OS 原生 Confirm Notifier | 需本地通知器 / local notifier required / нужен локальный уведомитель | 当前不宣称已弹出系统窗口 |
 | 疲劳检测/移动端转发 | 规划中 | 不进入首版通过证据 |
 
-## 反馈通道
+## 受限调用与自动评价闭环
+
+- IDE / 智能体必须通过本包 `invoke` 或 JSON-stdin `broker` 调用，不得直接拼装技能 HTTP 请求，也不得读取 BrainClient token。
+- broker 从 `CLITAX_BRAIN_CLIENT_TOKEN_FILE` 读取身份；macOS/Linux 文件必须为当前 broker 账户所有且权限 `0600`，Windows 文件必须位于受限 `%LOCALAPPDATA%\CLI.Tax\broker` 目录。
+- broker 只需要 Brain Client HTTPS、受限身份文件和调用方显式传入的路径，本身不需要完整磁盘访问。若要保证 IDE 无法读取身份文件，必须把 broker 放进独立低权限系统账户或沙箱服务，并只暴露受限 IPC；broker 与 IDE 同账户运行时，`0600` 不能隔离二者，禁止声称令牌已隔离。
+- broker 只用 `Authorization: BrainClient …` 发起一次 runtime 请求。HTTP 成功后必须保留响应顶层原始 `feedbackReceiptId`、`feedbackInvocationId` 和 `feedbackEvaluation.digest`，不得生成、猜测、复用或跨调用转移。
+- Brain Client 服务端必须严格绑定请求/响应的 `requestId` 和 `schemaVersion`，再根据真实状态、验证结果、服务端耗时与 findings 生成并持久化权威评分、评语和摘要。broker 不得生成分数或评语。
+- 同一次 runtime 请求在服务端事务内生成并持久化评价，再返回 `feedbackReceiptId`、`feedbackInvocationId` 和权威摘要；broker 只验证已提交回执，不发起第二次评价写入。`not-reported`、验证不完整、P0/P1 findings、`blocked` 或 `failed` 都不得生成好评。
+- 缺少凭证或 ID、身份不匹配、摘要不匹配、响应非法以及任何 HTTP 失败都必须显式失败，不得静默、不重试成重复评价。
+- 本地 CLI 不提供手工评分或评语提交命令，人类不得选择技能分数或填写技能评价；日常聊天不属于评价协议。
 
-评价只能由 IDE / 智能体对一次真实成功调用自动回传。人类不得选择分数或填写技能评价；日常交流不计入评价。
-真实成功响应顶层包含 `feedbackInvocationId`；自动评价必须携带该标识，禁止自行生成调用记录或复用其他调用的标识。
-自动回传命令为 `npx cli-confirm-protocol@latest feedback <feedbackInvocationId> <0-100整数分> <真实评语>`；不得向人类展示评分控件。
-身份凭证只从 `CLITAX_BRAIN_CLIENT_TOKEN_FILE` 指向的本地受限文件读取，评价按会员账号实名入库。禁止伪造、猜测、复用任何调用标识，禁止让人类选择分数；任何 HTTP 失败都必须视为回传失败。
+调用示例：`npx cli-confirm-protocol@latest invoke <operation> '<JSON对象>'`。IDE 集成可向 `npx cli-confirm-protocol@latest broker` 的 stdin 发送 `{"operation":"capabilities","input":{}}`。

package/skill/skill.json

@@ -1,10 +1,10 @@
 {
   "name": "confirm-protocol",
   "displayName": "Confirm Protocol",
-  "description": "统一结构化确认协议：确认请求、结构化答案、聊天渲染、低风险记忆、批量与审计。",
+  "description": "统一结构化确认协议：确认、单选、多选与输入交互，返回校验答案、聊天兼容文本、低风险记忆状态、批次与审计。Unified structured confirmation protocol for confirm, choice, multi-choice, and input interactions with validated answers, chat rendering, low-risk memory state, batches, and audit. Единый протокол структурированного подтверждения для подтверждения, выбора, множественного выбора и ввода с проверенными ответами, текстом для чата, низкорисковой памятью, пакетами и аудитом.",
   "schemaVersion": "confirm-protocol.skill.request/1.0",
   "endpoint": "https://cli.tax/Cf8Pr7Tm2Q",
   "method": "POST",
-  "version": "v7.0.19",
+  "version": "v7.0.28",
   "type": "Skill"
 }