draftgo-cli 4.0.22 → 4.0.24

package/README.md

@@ -134,7 +134,7 @@ draftgo test custom-services <id> --source draft --handler route:POST:/path --in
 
 `commit custom-services` 会自动完成提交、验证和发布，并输出明确的 published 提示；`validate`、`test`、`publish` 仍可作为单独的兼容入口。`test` 只运行 cloud draft，不调用线上版本；发布后如需再试运行，先修改并提交形成新草稿。默认拒绝外部副作用；外部调用用 `--side-effect-policy mock` 模拟，只有明确需要真实副作用时才组合 `--side-effect-policy live --test-write`。数据库等写操作也必须显式加 `--test-write`。
 
-`--source` 支持 `draft`（默认）、`auto`、`published`。Selector 支持 `route:METHOD:/path`、`event:name`、`scheduled:name` 或 handler 名；`--input`、`--headers`、`--user` 都读取 UTF-8 JSON object。普通 SDK 调用继承已验证的 `platform` 或 `space` 上下文；可信服务可对单次操作显式使用 `ctx.Admin.*`，该提升会审计且不会泄漏到后续调用。余额扣款、权益、支付和订阅使用 `ctx.Billing` / `ctx.Admin.Billing`，精确签名查看 checkout 后只读的 `.draftgo-sdk/billing.go`。完整字段与规则见[自定义服务方法指南](resources/skill/references/custom-services.md)。
+`--source` 支持 `draft`（默认）、`auto`、`published`。Selector 支持 `route:METHOD:/path`、`event:name`、`scheduled:name` 或 handler 名；`--input`、`--headers`、`--user` 都读取 UTF-8 JSON object。普通 SDK 调用继承已验证的 `platform` 或 `space` 上下文；自定义服务可对单次操作显式使用 `ctx.Admin.*`，该次调用按系统内置 `*:*:all` 全权限执行、进入审计且不会泄漏到后续调用。余额扣款、权益、支付和订阅使用 `ctx.Billing` / `ctx.Admin.Billing`，精确签名查看 checkout 后只读的 `.draftgo-sdk/billing.go`。完整字段与规则见[自定义服务方法指南](resources/skill/references/custom-services.md)。
 
 ### MCP/API
 
@@ -172,7 +172,7 @@ draftgo data-range list
 `role` 管理无作用域的 Role 模板；授权使用 `grant` 创建带 `platform` 或 `space` 范围的 AccessGrant。工作区成员关系不直接授予权限。资源归属由服务端持久化 ResourceOwnership 决定，DB 的 DataRange
 只在该范围内应用 `none`、`owner` 或 `all` 记录策略。交互式 CLI、MCP 和普通 HTTP API 均使用当前用户的
 API Key，并始终按该用户的 AccessGrant 授权；API Key 不能创建或伪造服务身份。CI、定时任务和共享服务等
-无人值守自动化使用平台提供的独立服务凭据通道及服务主体 AccessGrant，不复用个人 API Key。
+无人值守自动化由运行时使用 system 身份；定时和事件处理器没有调用者，必须在代码中显式使用 `ctx.Admin.*`，不创建服务主体 AccessGrant，也不复用个人 API Key。
 
 ### 交付与记录
 

package/bin/draftgo.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-'use strict';
-
-Promise.resolve(require('../src/index.js').run(process.argv.slice(2)))
-  .then((code) => { process.exitCode = Number(code) || 0; })
-  .catch((err) => {
-    console.error(err && err.stack ? err.stack : String(err));
-    process.exitCode = 1;
-  });
+'use strict';
+
+Promise.resolve(require('../src/index.js').run(process.argv.slice(2)))
+  .then((code) => { process.exitCode = Number(code) || 0; })
+  .catch((err) => {
+    console.error(err && err.stack ? err.stack : String(err));
+    process.exitCode = 1;
+  });

package/package.json

@@ -1,72 +1,72 @@
-{
-  "name": "draftgo-cli",
-  "version": "4.0.22",
-  "description": "Install and manage the DraftGo skill across AI coding agents (Claude Code, Codex, Cursor, Windsurf, Antigravity, Copilot, Gemini, Kiro, Pi).",
-  "bin": {
-    "draftgo": "bin/draftgo.js"
-  },
-  "main": "src/index.js",
-  "engines": {
-    "node": ">=20.19"
-  },
-  "files": [
-    "bin/",
-    "src/",
-    "resources/",
-    "!resources/**/__pycache__/**",
-    "!resources/**/*.py[cod]",
-    "LICENSE",
-    "README.md"
-  ],
-  "keywords": [
-    "draftgo",
-    "skill",
-    "cli",
-    "claude-code",
-    "codex",
-    "cursor",
-    "windsurf",
-    "antigravity",
-    "copilot",
-    "gemini",
-    "kiro",
-    "pi"
-  ],
-  "author": "draftgo <cabinai@163.com> (https://github.com/draftgo)",
-  "license": "MIT",
-  "homepage": "https://github.com/draftgo/draftgo-cli#readme",
-  "bugs": {
-    "url": "https://github.com/draftgo/draftgo-cli/issues"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/draftgo/draftgo-cli.git"
-  },
-  "scripts": {
-    "lint": "node scripts/check-syntax.js",
-    "validate:skill": "node scripts/validate-skill.js",
-    "sync:custom-service-sdk": "node scripts/sync-custom-service-sdk.js",
-    "build:release": "node scripts/build-release.js",
-    "verify:package": "node scripts/verify-package.js",
-    "test": "npm run lint && npm run validate:skill && npm run verify:package && npm run test:unit && npm run test:components && npm run test:capabilities && npm run test:workflow && npm run test:worklog && npm run test:mcp && npm run test:worktree && npm run test:integration && npm run test:local && npm run test:e2e",
-    "test:unit": "node tests/unit.js",
-    "test:components": "node --test tests/components.test.js",
-    "test:capabilities": "node --test tests/capabilities.test.js",
-    "test:workflow": "node tests/workflow.test.js",
-    "test:worklog": "node tests/worklog.test.js",
-    "test:mcp": "node tests/mcp.test.js",
-    "test:worktree": "node tests/worktree.test.js",
-    "test:integration": "node tests/integration.test.js",
-    "test:local": "node tests/local-runtime.js",
-    "test:e2e": "node tests/e2e.js"
-  },
-  "dependencies": {
-    "@grpc/grpc-js": "1.14.1",
-    "adm-zip": "0.5.16",
-    "parse5": "6.0.1",
-    "playwright-core": "1.61.1"
-  },
-  "directories": {
-    "test": "tests"
-  }
-}
+{
+  "name": "draftgo-cli",
+  "version": "4.0.24",
+  "description": "Install and manage the DraftGo skill across AI coding agents (Claude Code, Codex, Cursor, Windsurf, Antigravity, Copilot, Gemini, Kiro, Pi).",
+  "bin": {
+    "draftgo": "bin/draftgo.js"
+  },
+  "main": "src/index.js",
+  "engines": {
+    "node": ">=20.19"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "resources/",
+    "!resources/**/__pycache__/**",
+    "!resources/**/*.py[cod]",
+    "LICENSE",
+    "README.md"
+  ],
+  "keywords": [
+    "draftgo",
+    "skill",
+    "cli",
+    "claude-code",
+    "codex",
+    "cursor",
+    "windsurf",
+    "antigravity",
+    "copilot",
+    "gemini",
+    "kiro",
+    "pi"
+  ],
+  "author": "draftgo <cabinai@163.com> (https://github.com/draftgo)",
+  "license": "MIT",
+  "homepage": "https://github.com/draftgo/draftgo-cli#readme",
+  "bugs": {
+    "url": "https://github.com/draftgo/draftgo-cli/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/draftgo/draftgo-cli.git"
+  },
+  "scripts": {
+    "lint": "node scripts/check-syntax.js",
+    "validate:skill": "node scripts/validate-skill.js",
+    "sync:custom-service-sdk": "node scripts/sync-custom-service-sdk.js",
+    "build:release": "node scripts/build-release.js",
+    "verify:package": "node scripts/verify-package.js",
+    "test": "npm run lint && npm run validate:skill && npm run verify:package && npm run test:unit && npm run test:components && npm run test:capabilities && npm run test:workflow && npm run test:worklog && npm run test:mcp && npm run test:worktree && npm run test:integration && npm run test:local && npm run test:e2e",
+    "test:unit": "node tests/unit.js",
+    "test:components": "node --test tests/components.test.js",
+    "test:capabilities": "node --test tests/capabilities.test.js",
+    "test:workflow": "node tests/workflow.test.js",
+    "test:worklog": "node tests/worklog.test.js",
+    "test:mcp": "node tests/mcp.test.js",
+    "test:worktree": "node tests/worktree.test.js",
+    "test:integration": "node tests/integration.test.js",
+    "test:local": "node tests/local-runtime.js",
+    "test:e2e": "node tests/e2e.js"
+  },
+  "dependencies": {
+    "@grpc/grpc-js": "1.14.1",
+    "adm-zip": "0.5.16",
+    "parse5": "6.0.1",
+    "playwright-core": "1.61.1"
+  },
+  "directories": {
+    "test": "tests"
+  }
+}

package/resources/custom-service-sdk/auth_test.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+type authRecordingClient struct {
+	operation string
+	args      map[string]any
+	err       error
+}
+
+func (client *authRecordingClient) Call(_ context.Context, operation string, args any) (any, error) {
+	client.operation = operation
+	client.args, _ = args.(map[string]any)
+	return true, client.err
+}
+
+func TestAuthAssertionsUseHostAuthorization(t *testing.T) {
+	client := &authRecordingClient{}
+	draftgo := NewContext(context.Background(), nil, map[string]any{
+		"id": float64(7), "is_admin": false, "role_code": "member",
+	}, nil, client)
+
+	if err := draftgo.Auth.RequireAdmin(); err != nil {
+		t.Fatal(err)
+	}
+	if client.operation != "auth.require_admin" {
+		t.Fatalf("operation = %q", client.operation)
+	}
+	if err := draftgo.Auth.RequireRole(" workspace_owner "); err != nil {
+		t.Fatal(err)
+	}
+	if client.operation != "auth.require_role" || client.args["role"] != "workspace_owner" {
+		t.Fatalf("operation=%q args=%#v", client.operation, client.args)
+	}
+
+	client.err = errors.New("denied by host")
+	if err := draftgo.Auth.RequireAdmin(); err == nil || err.Error() != "require_admin failed: denied by host" {
+		t.Fatalf("host denial was not returned: %v", err)
+	}
+}
+
+func TestAdminAuthCallCarriesScopedElevation(t *testing.T) {
+	client := &authRecordingClient{}
+	draftgo := NewContext(context.Background(), nil, nil, nil, client)
+
+	if err := draftgo.Admin.Auth.RequireAdmin(); err != nil {
+		t.Fatal(err)
+	}
+	if client.operation != "auth.require_admin" || client.args["__draftgo_admin"] != true {
+		t.Fatalf("operation=%q args=%#v", client.operation, client.args)
+	}
+}

package/resources/custom-service-sdk/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "module": "draftgo/sdk",
-  "fingerprint": "c750610f8d4b1652da259ea436d47d9856104261c9af1b0e3753c073d36d4693",
+  "fingerprint": "4d0fc5d9b9dd8e0f3332fc1f61c544579d1d0bd1c96b39bc1a25006bb172bcc3",
   "files": [
     {
       "path": "ai.go",
@@ -13,6 +13,11 @@
       "sha256": "d5a906ea3d9d0451f116d2acac54bfb83669e5e471d1d5ada7c0e1fdabef13b6",
       "bytes": 6531
     },
+    {
+      "path": "auth_test.go",
+      "sha256": "2905126322a678df82289ebf13c15f6595fb8def2f98cbd5bb53c406bf5ac31c",
+      "bytes": 1626
+    },
     {
       "path": "billing.go",
       "sha256": "9ce87c80885aa8b8996710622ec0f14cc7a74d3ca78e5ed4168b6c135994d583",
@@ -30,8 +35,8 @@
     },
     {
       "path": "platform.go",
-      "sha256": "ec0d8621a8bb677578001d029fe191af58df9d275204eced5e8061b339ad085b",
-      "bytes": 12373
+      "sha256": "cc696f69c3a8efe093968ea4f6bfea1f257944ebcd83591b5ffd75ae85a8b583",
+      "bytes": 12182
     },
     {
       "path": "platform_logger_test.go",
@@ -45,8 +50,8 @@
     },
     {
       "path": "resources.go",
-      "sha256": "e633aa1431beddd25b2c999370a770f77c3de7a2d7123687eca75c9ed0d3838f",
-      "bytes": 9708
+      "sha256": "78f465a598ace6dc2858fea4a448488d195a5d1a8dd3452465d73ce9727b6a72",
+      "bytes": 9761
     },
     {
       "path": "resources_billing_test.go",
@@ -60,13 +65,13 @@
     },
     {
       "path": "resources_scope_test.go",
-      "sha256": "bba3243f348e9418888f37ee2d5b487fc26a31e4a646e75bef46d5d807938cee",
-      "bytes": 3592
+      "sha256": "f9b19b592c0b2ddc0564715828fd840c974216f8e99e9690af43f2cf4a0d7fb5",
+      "bytes": 3870
     },
     {
       "path": "sdk.go",
-      "sha256": "95ffcc335416ac842e06ea51b75e6739a04ddd5573a946e4175d6c5f8c110a67",
-      "bytes": 8167
+      "sha256": "18872d1f8535cdba53ddb3f487792cf74f10035f22a3023ec5cff3c3e597a8c0",
+      "bytes": 8342
     }
   ]
 }

package/resources/custom-service-sdk/platform.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 )
@@ -320,41 +321,32 @@ func asInt(value any) int {
 	}
 }
 
-type authClient struct{ user map[string]any }
+type authClient struct {
+	platformClient
+	user map[string]any
+}
 
 func (a authClient) CurrentUser() map[string]any { return a.user }
 func (a authClient) RequireLogin() error {
-	if a.user == nil {
-		return errors.New("require_login failed: user is not authenticated")
-	}
-	return nil
+	_, err := a.call(a.context, "auth.require_login", map[string]any{})
+	return authAssertionError("require_login", err)
 }
 func (a authClient) RequireAdmin() error {
-	if err := a.RequireLogin(); err != nil {
-		return err
-	}
-	if a.user["is_admin"] == true || a.user["role_code"] == "admin" {
-		return nil
-	}
-	for _, role := range asSlice(a.user["roles"]) {
-		if item, ok := role.(map[string]any); ok && item["code"] == "admin" {
-			return nil
-		}
-	}
-	return errors.New("require_admin failed: user is not an administrator")
+	_, err := a.call(a.context, "auth.require_admin", map[string]any{})
+	return authAssertionError("require_admin", err)
 }
 func (a authClient) RequireRole(role string) error {
-	if err := a.RequireLogin(); err != nil {
-		return err
+	role = strings.TrimSpace(role)
+	if role == "" {
+		return errors.New("require_role failed: role is required")
 	}
-	if a.user["role_code"] == role {
+	_, err := a.call(a.context, "auth.require_role", map[string]any{"role": role})
+	return authAssertionError("require_role", err)
+}
+
+func authAssertionError(assertion string, err error) error {
+	if err == nil {
 		return nil
 	}
-	for _, raw := range asSlice(a.user["roles"]) {
-		if item, ok := raw.(map[string]any); ok && item["code"] == role {
-			return nil
-		}
-	}
-	return fmt.Errorf("require_role failed: missing role %q", role)
+	return fmt.Errorf("%s failed: %w", assertion, err)
 }
-func asSlice(value any) []any { items, _ := value.([]any); return items }

package/resources/custom-service-sdk/resources.go

@@ -94,6 +94,7 @@ type ResourceContext struct {
 	ScopeType   string `json:"scope_type"`
 	WorkspaceID int64  `json:"workspace_id,omitempty"`
 	SpaceID     int64  `json:"space_id,omitempty"`
+	OwnerUserID int64  `json:"owner_user_id,omitempty"`
 }
 
 // ResourceOwnership identifies the persisted authorization boundary of a

package/resources/custom-service-sdk/resources_scope_test.go

@@ -16,7 +16,7 @@ func (client *scopeRecordingClient) Call(_ context.Context, operation string, ar
 	case "resource.context.current":
 		return map[string]any{"scope_type": ScopeSpace, "workspace_id": float64(2), "space_id": float64(8)}, nil
 	case "scope.principal.current":
-		return map[string]any{"subject_type": "service", "subject_id": "service:42", "username": "publisher", "is_admin": true}, nil
+		return map[string]any{"subject_type": "system", "subject_id": "0", "username": "System", "is_admin": true}, nil
 	default:
 		return map[string]any{"ok": true}, nil
 	}
@@ -38,7 +38,7 @@ func TestScopeClientUsesResourceAndPermissionOperations(t *testing.T) {
 	if err != nil || recorder.operation != "scope.principal.current" {
 		t.Fatalf("principal operation=%q err=%v", recorder.operation, err)
 	}
-	if principal.SubjectType != "service" || principal.SubjectID != "service:42" || principal.Username != "publisher" || !principal.IsAdmin {
+	if principal.SubjectType != "system" || principal.SubjectID != "0" || principal.Username != "System" || !principal.IsAdmin {
 		t.Fatalf("principal=%#v", principal)
 	}
 
@@ -75,13 +75,18 @@ func TestContextCarriesPersistedResourceAndPrincipal(t *testing.T) {
 	recorder := &scopeRecordingClient{}
 	ctx := NewContextWithResource(context.Background(), nil, nil, nil, recorder,
 		ResourceContext{ScopeType: ScopeSpace, WorkspaceID: 11, SpaceID: 13},
-		ScopePrincipal{SubjectType: "service", SubjectID: "custom-service:7", Username: "Service-Script"})
-	if ctx.Platform || ctx.WorkspaceID != 11 || ctx.SpaceID != 13 || ctx.Principal.SubjectID != "custom-service:7" {
+		ScopePrincipal{SubjectType: "system", SubjectID: "0", Username: "System"})
+	if ctx.Platform || ctx.WorkspaceID != 11 || ctx.SpaceID != 13 || ctx.Principal.SubjectID != "0" {
 		t.Fatalf("runtime context = %+v", ctx)
 	}
 	platform := NewContextWithResource(context.Background(), nil, nil, nil, recorder,
-		ResourceContext{ScopeType: ScopePlatform}, ScopePrincipal{SubjectType: "service", SubjectID: "custom-service:8"})
+		ResourceContext{ScopeType: ScopePlatform}, ScopePrincipal{SubjectType: "system", SubjectID: "0"})
 	if !platform.Platform || platform.WorkspaceID != 0 || platform.SpaceID != 0 {
 		t.Fatalf("platform runtime context = %+v", platform)
 	}
+	personal := NewContextWithResource(context.Background(), nil, nil, nil, recorder,
+		ResourceContext{ScopeType: "user", OwnerUserID: 17}, ScopePrincipal{SubjectType: "system", SubjectID: "0"})
+	if personal.Platform || personal.OwnerUserID != 17 || personal.WorkspaceID != 0 || personal.SpaceID != 0 {
+		t.Fatalf("personal runtime context = %+v", personal)
+	}
 }

package/resources/custom-service-sdk/sdk.go

@@ -106,6 +106,7 @@ type Context struct {
 	Platform    bool           `json:"platform"`
 	WorkspaceID int64          `json:"workspace_id,omitempty"`
 	SpaceID     int64          `json:"space_id,omitempty"`
+	OwnerUserID int64          `json:"owner_user_id,omitempty"`
 	Principal   ScopePrincipal `json:"principal"`
 
 	DB        Database   `json:"-"`
@@ -137,7 +138,7 @@ func NewContext(draftgo context.Context, input, user map[string]any, headers htt
 }
 
 // NewContextWithResource constructs a handler context with persisted resource
-// ownership and the service principal supplied by DraftGo. Custom services
+// ownership and the verified caller/system principal supplied by DraftGo. Custom services
 // cannot override these values through Input or request headers.
 func NewContextWithResource(draftgo context.Context, input, user map[string]any, headers http.Header, client Client, resource ResourceContext, principal ScopePrincipal) *Context {
 	if draftgo == nil {
@@ -150,12 +151,12 @@ func NewContextWithResource(draftgo context.Context, input, user map[string]any,
 	adminPlatform := platformClient{client: client, context: draftgo, admin: true}
 	return &Context{
 		Input: input, User: user, Headers: headers, context: draftgo,
-		Platform: resource.ScopeType == ScopePlatform, WorkspaceID: resource.WorkspaceID, SpaceID: resource.SpaceID, Principal: principal,
-		DB: dbClient{platform}, Users: usersClient{platform}, Auth: authClient{user: user}, Notify: notifierClient{platform},
+		Platform: resource.ScopeType == ScopePlatform, WorkspaceID: resource.WorkspaceID, SpaceID: resource.SpaceID, OwnerUserID: resource.OwnerUserID, Principal: principal,
+		DB: dbClient{platform}, Users: usersClient{platform}, Auth: authClient{platformClient: platform, user: user}, Notify: notifierClient{platform},
 		HTTP: httpClient{platform}, Cache: cacheClient{platform}, Config: configClient{platform}, AIHub: aiHubClient{platform},
 		Knowledge: knowledgeClient{platform}, Memory: memoryClient{platform}, Files: fileStoreClient{platform}, Scope: scopeClient{platform}, Billing: billingClient{platform},
 		Admin: Admin{
-			DB: dbClient{adminPlatform}, Users: usersClient{adminPlatform}, Auth: authClient{user: user}, Notify: notifierClient{adminPlatform},
+			DB: dbClient{adminPlatform}, Users: usersClient{adminPlatform}, Auth: authClient{platformClient: adminPlatform, user: user}, Notify: notifierClient{adminPlatform},
 			HTTP: httpClient{adminPlatform}, Cache: cacheClient{adminPlatform}, Config: configClient{adminPlatform}, AIHub: aiHubClient{adminPlatform},
 			Knowledge: knowledgeClient{adminPlatform}, Memory: memoryClient{adminPlatform},
 			Files: fileStoreClient{adminPlatform}, Scope: scopeClient{adminPlatform}, Billing: billingClient{adminPlatform},
@@ -165,7 +166,7 @@ func NewContextWithResource(draftgo context.Context, input, user map[string]any,
 }
 
 // Admin exposes explicitly elevated platform capabilities to trusted custom
-// services. The runtime preserves the service subject, scopes elevation to one
+// services. The runtime uses a system principal (actor_id=0), scopes elevation to one
 // audited RPC call, and never exposes platform credentials.
 type Admin struct {
 	DB        Database

package/resources/skill/SKILL.md

@@ -47,7 +47,7 @@ description: Use this skill to inspect, develop, debug, or deliver a DraftGo app
 - 同一文件或 DraftGo 资源全程只能由一个 Agent 修改；不同资源、operation 和 owner 不冲突的单元可以并发，不设置客户端并发上限；同一资源的依赖步骤保持串行。主 Agent 负责 owner 分配、汇总、验证、交付和 worklog 状态。
 - 用户 API Key 只保存在 `.draftgo/config.json`，不得进入宿主配置、命令参数、Skill、日志、manifest 或错误消息。宿主 MCP 配置只运行 `draftgo mcp serve`。
 - 页面优先使用可信本地资源；禁止境外 CDN。净化不可信 HTML，关键状态不能只靠颜色或动效表达。页面通过 `window.parent.App` 使用认证、权限、反馈和主题；详细规则见前端与运行时 Reference。
-- 普通自定义服务 SDK 调用继承调用者、服务归属和 AccessGrant；`ctx.Admin.*` 是可信服务显式选择的单次管理提升，允许跨用户/空间操作且必须进入审计，不会泄漏到后续调用。高风险 MCP operation 仅在用户意图明确且影响范围已核对时设置 `confirm=true`。
+- Route 普通自定义服务 SDK 调用继承真实调用者和服务归属；Event/Scheduled 没有调用者，普通 `ctx.xxx` 返回 403，必须显式使用 `ctx.Admin.*`。Admin RPC 使用 system actor_id=0，按 `*:*:all` 单次执行并进入审计，不创建服务主体 AccessGrant，也不会泄漏到后续调用。
 - `.draftgo/tmp/` 可清理；先运行 `draftgo clean --dry-run`，再在需要时使用 `--yes`。用户可查验的证据放入已注册的 `.draftgo/artifacts/`。
 
 ## 完成条件

package/resources/skill/manifest.json

@@ -2,7 +2,7 @@
   "schema_version": "1.0",
   "id": "draftgo",
   "name": "DraftGo 开发助手",
-  "version": "4.0.22",
+  "version": "4.0.24",
   "entry": "SKILL.md",
   "description": "以 Skill/reference 任务路由、MCP 实时发现、长正文 checkout/commit、统一验证和完成日志为边界的 DraftGo 工作流。",
   "license": "MIT",