rainskills 0.1.0 → 0.1.2

package/install.sh

@@ -9,12 +9,21 @@
 # hand-write ~/.rainbond/mcp.env. See README.md "给 AI 助手的指引".
 set -euo pipefail
 
+RAINSKILLS_VERBOSE="${RAINSKILLS_VERBOSE:-0}"
+for rainskills_bootstrap_arg in "$@"; do
+  if [[ "$rainskills_bootstrap_arg" == "--verbose" ]]; then
+    RAINSKILLS_VERBOSE=1
+    break
+  fi
+done
+
 RAINBOND_SKILLS_HOME_DEFAULT="${RAINBOND_SKILLS_HOME:-$HOME/.rainbond/skills}"
 RAINBOND_SKILLS_OSS_TARBALL_URL="${RAINBOND_SKILLS_OSS_URL:-https://get.rainbond.com/rainskills/rainskills-latest.tar.gz}"
 RAINBOND_SKILLS_GITHUB_TARBALL_URL="https://github.com/goodrain/rainskills/archive/refs/heads/main.tar.gz"
 RAINBOND_SKILLS_TARBALL_URL_OVERRIDE="${RAINBOND_SKILLS_TARBALL_URL:-}"
 
 bootstrap_log() {
+  [[ "$RAINSKILLS_VERBOSE" == "1" ]] || return 0
   printf '%s\n' "$1"
 }
 
@@ -92,8 +101,10 @@ bootstrap_download_if_needed() {
   chmod +x "$target_script" 2>/dev/null || true
 
   bootstrap_log "切换到 $target_script 继续执行……"
-  if [[ -r /dev/tty ]]; then
-    exec bash "$target_script" "$@" </dev/tty
+  local controlling_tty=""
+  controlling_tty="$(tty 2>/dev/null || true)"
+  if [[ "$controlling_tty" == /dev/* && -r "$controlling_tty" ]]; then
+    exec bash "$target_script" "$@" <"$controlling_tty"
   else
     exec bash "$target_script" "$@"
   fi
@@ -114,8 +125,19 @@ should_skip_bootstrap_for_refresh() {
   return 1
 }
 
-if should_skip_bootstrap_for_refresh "$@"; then
-  SCRIPT_DIR=""
+is_runtime_connect_invocation() {
+  [[ "${1:-}" == "connect" ]]
+}
+
+if is_runtime_connect_invocation "$@"; then
+  [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]] \
+    && [[ "${RAINSKILLS_RUNTIME_OPERATION_ID:-}" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ ]] \
+    || bootstrap_die "runtime connect 必须通过 Rainskills Node 入口执行。"
+  SCRIPT_DIR="$(resolve_script_dir)"
+  [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/bin/rainskills.js" ]] \
+    || bootstrap_die "runtime connect 缺少受信任的 Rainskills Node 入口。"
+elif should_skip_bootstrap_for_refresh "$@"; then
+  SCRIPT_DIR="$(resolve_script_dir)"
 else
   bootstrap_download_if_needed "$@"
 fi
@@ -153,13 +175,15 @@ ACTIVE_SHELL_RC=""
 VALIDATED_TOKEN=""
 OBTAINED_RAINBOND_TOKEN=""
 RAINSKILLS_INSTALL_REPORT_URL="https://log.rainbond.com/api/rainskills/installations"
-RAINSKILLS_INSTALL_ATTEMPT_ID=""
+RAINSKILLS_LIFECYCLE_REPORT_URL="https://log.rainbond.com/api/rainskills/lifecycle-events"
+RAINSKILLS_INSTALL_ATTEMPT_ID="${RAINSKILLS_INSTALL_ATTEMPT_ID:-}"
 RAINSKILLS_INSTALL_EID=""
 RAINSKILLS_INSTALL_CLIENT="unknown"
 RAINSKILLS_INSTALL_ACTION="install"
 RAINSKILLS_INSTALL_FAILURE_STAGE="bootstrap"
 RAINSKILLS_INSTALL_FAILURE_CATEGORY="invalid_arguments"
 RAINSKILLS_INSTALL_TERMINAL_REPORTED=0
+RAINSKILLS_TELEMETRY_SEQUENCE=0
 RAINSKILLS_BROWSER_LOGIN_SERVER_PID=""
 RAINSKILLS_BROWSER_LOGIN_READER_PID=""
 RAINSKILLS_BROWSER_LOGIN_RESULT_FILE=""
@@ -197,6 +221,7 @@ Options:
                           remember to restart Claude Code / Codex afterwards)
   --dest PATH            Install skills to a custom directory only
   --force                Overwrite existing installed skills
+  --verbose              Show installation paths and copy diagnostics
   --skip-mcp             Skip Rainbond MCP setup
   --saas                 Use Rainbond Cloud (https://run.rainbond.com)
   --self-hosted          Use a self-hosted Rainbond Console (requires --rainbond-url)
@@ -223,10 +248,34 @@ log() {
   printf '%s\n' "$1"
 }
 
+install_detail_log() {
+  [[ "$RAINSKILLS_VERBOSE" == "1" ]] || return 0
+  log "$1"
+}
+
 warn() {
   printf '警告：%s\n' "$1" >&2
 }
 
+print_capability_summary() {
+  printf '[RAINSKILLS_USER_MESSAGE_BEGIN:install.completed]\n'
+  cat <<'EOF'
+Rainskills 安装完成，下一条消息即可直接使用。
+
+下一步可以直接说：
+
+- 帮我部署当前项目
+- 帮我部署一个 Git 仓库
+- 帮我通过镜像或安装包部署应用
+- 帮我安装一个应用模板
+- 帮我分析当前项目应该如何部署
+
+也可以直接告诉我你想部署什么应用。
+EOF
+  printf '[RAINSKILLS_USER_MESSAGE_END:install.completed]\n'
+  printf '[RAINSKILLS_AGENT_SUMMARY_REQUIRED:include-next-actions]\n'
+}
+
 new_rainskills_install_attempt_id() {
   if command -v python3 >/dev/null 2>&1; then
     python3 - <<'PY'
@@ -311,20 +360,169 @@ PY
   ) &
 }
 
+rainskills_telemetry_target() {
+  if [[ -n "${RAINSKILLS_TELEMETRY_TARGET:-}" ]]; then
+    printf '%s\n' "$RAINSKILLS_TELEMETRY_TARGET"
+  elif [[ "$(uname -s 2>/dev/null || true)" == "Darwin" ]]; then
+    printf 'local-macos\n'
+  else
+    printf 'local-linux\n'
+  fi
+}
+
+rainskills_telemetry_platform() {
+  case "$(uname -s 2>/dev/null || true)" in
+    Darwin) printf 'darwin\n' ;;
+    *) printf 'linux\n' ;;
+  esac
+}
+
+rainskills_telemetry_failure_phase() {
+  case "${RAINSKILLS_TELEMETRY_ERROR_STAGE:-bootstrap}" in
+    skill_installation|bootstrap) printf 'bootstrap\n' ;;
+    download) printf 'rootfs_download\n' ;;
+    authorization) printf 'authorize_legacy\n' ;;
+    verification) printf 'verify_console\n' ;;
+    configuration) printf 'configure_mcp\n' ;;
+    *) printf 'bootstrap\n' ;;
+  esac
+}
+
+rainskills_telemetry_error_code() {
+  case "${RAINSKILLS_INSTALL_FAILURE_CATEGORY:-unknown}" in
+    invalid_arguments) printf 'invalid_arguments\n' ;;
+    tarball_unavailable|download_failed) printf 'download_failed\n' ;;
+    authorization_failed) printf 'authorization_failed\n' ;;
+    mcp_verification_failed) printf 'mcp_verification_failed\n' ;;
+    mcp_configuration_failed|skill_installation_failed) printf 'configuration_failed\n' ;;
+    network_unreachable) printf 'network_unreachable\n' ;;
+    *) printf 'unknown\n' ;;
+  esac
+}
+
+report_rainskills_lifecycle_event() {
+  local lifecycle_phase="$1"
+  local step="$2"
+  local lifecycle_action="$3"
+  local lifecycle_status="$4"
+  local error_code="${5:-}"
+  local blocked_reason="${6:-}"
+  local auth_method="${7:-}"
+
+  [[ -n "$RAINSKILLS_INSTALL_ATTEMPT_ID" ]] || return 0
+  command -v python3 >/dev/null 2>&1 || return 0
+  RAINSKILLS_TELEMETRY_SEQUENCE=$((RAINSKILLS_TELEMETRY_SEQUENCE + 1))
+
+  local payload telemetry_dir
+  telemetry_dir="${RAINSKILLS_TELEMETRY_DIR:-${HOME:-/tmp}/.rainbond/rainskills/telemetry}"
+  payload="$({
+    python3 - \
+      "$RAINSKILLS_INSTALL_ATTEMPT_ID" \
+      "${RAINSKILLS_TELEMETRY_OPERATION_ID:-}" \
+      "${RAINSKILLS_TELEMETRY_INSTALLATION_ID:-}" \
+      "${RAINSKILLS_TELEMETRY_CLIENT:-$RAINSKILLS_INSTALL_CLIENT}" \
+      "${RAINSKILLS_TELEMETRY_CONTROL_MODE:-posix}" \
+      "$(rainskills_telemetry_target)" \
+      "$(rainskills_telemetry_platform)" \
+      "$RAINSKILLS_INSTALL_ACTION" \
+      "$RAINSKILLS_TELEMETRY_SEQUENCE" \
+      "$lifecycle_phase" \
+      "$step" \
+      "$lifecycle_action" \
+      "$lifecycle_status" \
+      "$error_code" \
+      "$blocked_reason" \
+      "$auth_method" \
+      "$RAINSKILLS_INSTALL_EID" \
+      "$RAINSKILLS_LIFECYCLE_REPORT_URL" \
+      "$telemetry_dir" <<'PY'
+import datetime
+import json
+import os
+import sys
+import uuid
+
+(attempt, operation, installation, client, control_mode, target, platform, action,
+ sequence, phase, step, lifecycle_action, status, error_code, blocked_reason,
+ auth_method, eid, report_url, telemetry_dir) = sys.argv[1:]
+event = {
+    "schema": "rainskills.lifecycle-event.v1",
+    "event_id": str(uuid.uuid4()),
+    "install_attempt_id": attempt,
+    "operation_id": operation or None,
+    "installation_id": installation or None,
+    "parent_event_id": None,
+    "sequence": int(sequence),
+    "attempt": 1,
+    "resumed_from": None,
+    "package_version": os.environ.get("RAINSKILLS_PACKAGE_VERSION") or None,
+    "platform": platform,
+    "control_mode": control_mode,
+    "target": target,
+    "client": client if client in {"codex", "claude_code", "both", "unknown"} else "unknown",
+    "eid": eid or None,
+    "phase": None,
+    "lifecycle_phase": phase,
+    "step": step,
+    "action": action if action in {"install", "refresh"} else "install",
+    "lifecycle_action": lifecycle_action or None,
+    "status": None,
+    "lifecycle_status": status,
+    "duration_ms": None,
+    "error_code": error_code or None,
+    "error_stage": phase if error_code else None,
+    "reason_code": error_code or None,
+    "blocked_reason": blocked_reason or None,
+    "interrupt_signal": None,
+    "transport": "ssh" if target == "remote-linux" else ("wsl" if control_mode == "wsl" else ("powershell" if control_mode == "windows-native" else "direct")),
+    "auth_method": auth_method or None,
+    "retryable": status in {"blocked", "started"},
+    "exit_code": None,
+    "http_status": None,
+    "created_at": datetime.datetime.utcnow().isoformat(timespec="milliseconds") + "Z",
+}
+try:
+    os.makedirs(telemetry_dir, mode=0o700, exist_ok=True)
+    os.chmod(telemetry_dir, 0o700)
+    event_path = os.path.join(telemetry_dir, "events.jsonl")
+    with open(event_path, "a", encoding="utf-8") as stream:
+        stream.write(json.dumps(event, separators=(",", ":")) + "\n")
+    os.chmod(event_path, 0o600)
+except Exception:
+    pass
+print(json.dumps(event, separators=(",", ":")))
+PY
+  } 2>/dev/null || true)"
+  [[ -n "$payload" ]] || return 0
+  (
+    curl --silent --show-error --connect-timeout 2 --max-time 3 \
+      -X POST "$RAINSKILLS_LIFECYCLE_REPORT_URL" \
+      -H 'Content-Type: application/json' \
+      -H "Idempotency-Key: $(python3 -c 'import json,sys; print(json.load(sys.stdin)["event_id"])' <<<"$payload")" \
+      --data-binary "$payload" >/dev/null 2>&1 || true
+  ) &
+}
+
 initialize_rainskills_installation_reporting() {
   local arg target=""
-  RAINSKILLS_INSTALL_ATTEMPT_ID="$(new_rainskills_install_attempt_id)"
+  if [[ -z "$RAINSKILLS_INSTALL_ATTEMPT_ID" ]]; then
+    RAINSKILLS_INSTALL_ATTEMPT_ID="$(new_rainskills_install_attempt_id)"
+  fi
   for arg in "$@"; do
     case "$arg" in
       refresh)
         RAINSKILLS_INSTALL_ACTION="refresh"
         ;;
+      connect)
+        RAINSKILLS_INSTALL_ACTION="connect"
+        ;;
       codex|claude|all)
         target="$arg"
         ;;
     esac
   done
   RAINSKILLS_INSTALL_CLIENT="$(rainskills_install_client_for_target "$target")"
+  report_rainskills_lifecycle_event "bootstrap" "resume" "resume" "started"
   report_rainskills_installation "started" "started"
 }
 
@@ -410,12 +608,14 @@ record_rainskills_authorization() {
   eid="$(resolve_rainskills_enterprise_id "$base_url" "$token" || true)"
   [[ -n "$eid" ]] || return 0
   RAINSKILLS_INSTALL_EID="$eid"
+  report_rainskills_lifecycle_event "authorize_legacy" "legacy_callback" "authorize" "completed" "" "" "browser_loopback"
   report_rainskills_installation "authorized" "success"
 }
 
 set_rainskills_failure_context() {
   RAINSKILLS_INSTALL_FAILURE_STAGE="$1"
   RAINSKILLS_INSTALL_FAILURE_CATEGORY="$2"
+  RAINSKILLS_TELEMETRY_ERROR_STAGE="$1"
 }
 
 report_unhandled_rainskills_installation_failure() {
@@ -424,6 +624,12 @@ report_unhandled_rainskills_installation_failure() {
         "${BASH_SUBSHELL:-0}" -eq 0 && \
         "$RAINSKILLS_INSTALL_TERMINAL_REPORTED" -eq 0 ]]; then
     RAINSKILLS_INSTALL_TERMINAL_REPORTED=1
+    report_rainskills_lifecycle_event \
+      "$(rainskills_telemetry_failure_phase)" \
+      "resume" \
+      "resume" \
+      "failed" \
+      "$(rainskills_telemetry_error_code)"
     report_rainskills_installation \
       "failed" \
       "failure" \
@@ -561,7 +767,7 @@ copy_skill() {
 
   if [[ ! -e "$dest" ]]; then
     cp -R "$src" "$dest"
-    log "[install] 已安装到 $dest"
+    install_detail_log "[install] 已安装到 $dest"
     INSTALL_COUNT_NEW=$((INSTALL_COUNT_NEW + 1))
     return 0
   fi
@@ -569,13 +775,13 @@ copy_skill() {
   if [[ "$FORCE" -eq 1 ]]; then
     rm -rf "$dest"
     cp -R "$src" "$dest"
-    log "[overwrite] 已强制覆盖 $dest"
+    install_detail_log "[overwrite] 已强制覆盖 $dest"
     INSTALL_COUNT_FORCED=$((INSTALL_COUNT_FORCED + 1))
     return 0
   fi
 
   if diff -rq "$src" "$dest" >/dev/null 2>&1; then
-    log "[skip] $dest 已是最新"
+    install_detail_log "[skip] $dest 已是最新"
     INSTALL_COUNT_UNCHANGED=$((INSTALL_COUNT_UNCHANGED + 1))
     return 0
   fi
@@ -585,7 +791,7 @@ copy_skill() {
   changed_files="$( { diff -rq "$src" "$dest" 2>/dev/null || true; } | wc -l | tr -d ' ')"
   rm -rf "$dest"
   cp -R "$src" "$dest"
-  log "[update] 已更新 ${dest}（${changed_files} 项变化，本地修改已被覆盖）"
+  install_detail_log "[update] 已更新 ${dest}（${changed_files} 项变化，本地修改已被覆盖）"
   INSTALL_COUNT_UPDATED=$((INSTALL_COUNT_UPDATED + 1))
 }
 
@@ -596,6 +802,10 @@ parse_args() {
         ACTION="refresh"
         shift
         ;;
+      connect)
+        ACTION="connect"
+        shift
+        ;;
       claude|codex|all)
         TARGET="$1"
         shift
@@ -612,6 +822,10 @@ parse_args() {
         FORCE=1
         shift
         ;;
+      --verbose)
+        RAINSKILLS_VERBOSE=1
+        shift
+        ;;
       --skip-mcp)
         SKIP_MCP=1
         shift
@@ -669,6 +883,109 @@ parse_args() {
   done
 }
 
+valid_runtime_operation_id() {
+  [[ "${1:-}" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ ]]
+}
+
+assert_internal_connect_entry() {
+  [[ "${1:-}" == "connect" ]] || return 0
+  if [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" != "1" ]] \
+    || ! valid_runtime_operation_id "${RAINSKILLS_RUNTIME_OPERATION_ID:-}"; then
+    printf '错误：runtime connect 必须通过 Rainskills Node 入口执行。\n' >&2
+    return 1
+  fi
+
+  shift
+  local target="" environment_kind="" console_origin="" mode=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      codex|claude|all)
+        [[ -z "$target" ]] || return 1
+        target="$1"
+        shift
+        ;;
+      --saas)
+        [[ -z "$mode" ]] || return 1
+        mode="saas"
+        environment_kind="saas"
+        console_origin="$SAAS_DEFAULT_URL"
+        shift
+        ;;
+      --self-hosted)
+        [[ -z "$mode" ]] || return 1
+        mode="self-hosted"
+        environment_kind="private"
+        shift
+        ;;
+      --rainbond-url)
+        [[ $# -ge 2 && -z "$console_origin" ]] || return 1
+        console_origin="$2"
+        shift 2
+        ;;
+      --allow-insecure-http)
+        shift
+        ;;
+      --non-interactive)
+        shift
+        ;;
+      *)
+        return 1
+        ;;
+    esac
+  done
+  [[ -n "$target" && -n "$environment_kind" && -n "$console_origin" ]] || return 1
+  if [[ "$mode" == "saas" ]]; then
+    [[ "$console_origin" == "$SAAS_DEFAULT_URL" ]] || return 1
+  else
+    assert_canonical_runtime_console_origin "$console_origin" || return 1
+  fi
+  node "$SCRIPT_DIR/bin/rainskills.js" runtime assert-connect \
+    --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID" \
+    --target "$target" \
+    --environment-kind "$environment_kind" \
+    --console-origin "$console_origin" >/dev/null 2>&1 \
+    || {
+      printf '错误：runtime connect 内部门禁验证失败。\n' >&2
+      return 1
+    }
+}
+
+assert_canonical_runtime_console_origin() {
+  local value="$1"
+  python3 - "$value" <<'PY' >/dev/null 2>&1
+import sys
+from urllib.parse import urlsplit
+
+value = sys.argv[1]
+if not value or value.strip() != value or len(value) > 2048:
+    raise SystemExit(1)
+try:
+    parsed = urlsplit(value)
+    port = parsed.port
+except Exception:
+    raise SystemExit(1)
+if (
+    parsed.scheme not in ("http", "https")
+    or not parsed.hostname
+    or parsed.username is not None
+    or parsed.password is not None
+    or parsed.path not in ("", "/")
+    or parsed.query
+    or parsed.fragment
+):
+    raise SystemExit(1)
+host = parsed.hostname.lower()
+if ":" in host:
+    host = "[{}]".format(host)
+default_port = 80 if parsed.scheme == "http" else 443
+origin = "{}://{}".format(parsed.scheme, host)
+if port is not None and port != default_port:
+    origin += ":{}".format(port)
+if value.rstrip("/") != origin:
+    raise SystemExit(1)
+PY
+}
+
 resolve_target() {
   if [[ -n "$CUSTOM_DEST" ]]; then
     return 0
@@ -1522,7 +1839,8 @@ device_flow_login_to_rainbond() {
   fi
   [[ "$request_status" -eq 0 ]] || return "$request_status"
 
-  printf '\nRainbond 设备授权\n' >&2
+  printf '\n[RAINSKILLS_USER_MESSAGE_BEGIN:runtime.device-authorization]\n' >&2
+  printf 'Rainbond 设备授权\n' >&2
   printf '授权码：%s\n' "$DEVICE_FLOW_USER_CODE" >&2
   printf '授权地址：%s\n' "$DEVICE_FLOW_VERIFICATION_URI_COMPLETE" >&2
   printf '终端正在等待授权结果，完成后会自动继续，Ctrl+C 可取消。\n' >&2
@@ -1532,6 +1850,7 @@ device_flow_login_to_rainbond() {
   else
     printf '请在任意能够访问该 Rainbond 平台的电脑上打开上面的地址并完成登录授权。\n' >&2
   fi
+  printf '[RAINSKILLS_USER_MESSAGE_END:runtime.device-authorization]\n' >&2
 
   if ! poll_device_authorization "$base_url"; then
     cleanup_device_flow
@@ -1772,6 +2091,51 @@ configure_shell_autoload() {
   log "[update] 已更新 $rc_file"
 }
 
+rainskills_package_spec() {
+  local package_version
+  package_version="$(node -p 'require(process.argv[1]).version' "$SCRIPT_DIR/package.json")"
+  [[ "$package_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] \
+    || die "Rainskills package version 无效"
+  printf 'rainskills@%s\n' "$package_version"
+}
+
+codex_local_mcp_matches() {
+  local package_spec="$1"
+  local config_file="$HOME/.codex/config.toml"
+  [[ -f "$config_file" ]] || return 1
+  python3 - "$config_file" "$package_spec" <<'PY' >/dev/null
+import re
+import sys
+
+content = open(sys.argv[1], encoding="utf-8").read()
+match = re.search(r'(?ms)^\[mcp_servers\.rainbond\]\s*(.*?)(?=^\[|\Z)', content)
+if not match:
+    raise SystemExit(1)
+block = match.group(1)
+expected = ["--yes", sys.argv[2], "mcp", "serve", "--client", "codex"]
+if re.search(r'^command\s*=\s*"npx"\s*$', block, re.M) and all(re.escape('"{}"'.format(v)) in block for v in expected):
+    raise SystemExit(0)
+raise SystemExit(1)
+PY
+}
+
+claude_local_mcp_matches() {
+  local package_spec="$1"
+  local config_file="$HOME/.claude.json"
+  [[ -f "$config_file" ]] || return 1
+  python3 - "$config_file" "$package_spec" <<'PY' >/dev/null
+import json
+import sys
+
+payload = json.load(open(sys.argv[1], encoding="utf-8"))
+server = ((payload.get("mcpServers") or {}).get("rainbond") or {})
+expected = ["--yes", sys.argv[2], "mcp", "serve", "--client", "claude"]
+if server.get("command") == "npx" and server.get("args") == expected:
+    raise SystemExit(0)
+raise SystemExit(1)
+PY
+}
+
 codex_config_matches() {
   local mcp_url="$1"
   local config_file="$HOME/.codex/config.toml"
@@ -1831,7 +2195,13 @@ PY
 }
 
 configure_codex_mcp() {
-  local mcp_url="$1"
+  local package_spec
+  package_spec="$(rainskills_package_spec)"
+
+  if codex_local_mcp_matches "$package_spec"; then
+    log "[configure] Codex 已连接 Rainskills 本地 MCP"
+    return 0
+  fi
 
   if ! command -v codex >/dev/null 2>&1; then
     warn "未找到 Codex CLI，跳过 Codex MCP 配置。"
@@ -1840,14 +2210,20 @@ configure_codex_mcp() {
 
   backup_file "$HOME/.codex/config.toml"
   codex mcp remove rainbond >/dev/null 2>&1 || true
-  if ! codex mcp add rainbond --url "$mcp_url" --bearer-token-env-var RAINBOND_JWT >/dev/null; then
+  if ! codex mcp add rainbond -- npx --yes "$package_spec" mcp serve --client codex >/dev/null; then
     return 1
   fi
   log "[configure] 已配置 Codex MCP"
 }
 
 configure_claude_mcp() {
-  local mcp_url="$1"
+  local package_spec
+  package_spec="$(rainskills_package_spec)"
+
+  if claude_local_mcp_matches "$package_spec"; then
+    log "[configure] Claude 已连接 Rainskills 本地 MCP"
+    return 0
+  fi
 
   if ! command -v claude >/dev/null 2>&1; then
     warn "未找到 Claude CLI，跳过 Claude MCP 配置。"
@@ -1856,7 +2232,7 @@ configure_claude_mcp() {
 
   backup_file "$HOME/.claude.json"
   claude mcp remove --scope user rainbond >/dev/null 2>&1 || true
-  if ! claude mcp add --scope user --transport http rainbond "$mcp_url" -H 'Authorization: GRJWT ${RAINBOND_JWT}' >/dev/null; then
+  if ! claude mcp add --scope user rainbond -- npx --yes "$package_spec" mcp serve --client claude >/dev/null; then
     return 1
   fi
   log "[configure] 已配置 Claude MCP"
@@ -1897,13 +2273,46 @@ validate_mcp_connectivity() {
   fi
 
   if [[ ! "$http_code" =~ ^2 ]]; then
-    cleanup_mcp_validation
     if [[ "$http_code" == "404" ]]; then
-      local mcp_path
-      mcp_path="${mcp_url#*://}"
-      mcp_path="/${mcp_path#*/}"
-      die "Rainbond MCP 校验失败：${mcp_url} 未暴露 ${mcp_path}。登录已成功，说明这个环境可达，但当前部署的 Rainbond Console 可能未包含 RainSkills MCP 接口，或你连接到了错误的 Rainbond 主机。"
+      if python3 - "$response_file" "$header_file" <<'PY' >/dev/null; then
+import json
+import sys
+
+body_path, header_path = sys.argv[1:]
+with open(body_path, "r", encoding="utf-8", errors="replace") as fh:
+    body = fh.read(65537)
+if len(body.encode("utf-8")) > 65536:
+    raise SystemExit(1)
+with open(header_path, "r", encoding="utf-8", errors="replace") as fh:
+    headers = fh.read().lower()
+
+content_type = ""
+for line in headers.splitlines():
+    if line.startswith("content-type:"):
+        content_type = line.split(":", 1)[1].strip()
+trimmed = body.strip()
+verified = False
+if "text/plain" in content_type:
+    verified = trimmed == "Not Found"
+elif "text/html" in content_type:
+    lower = trimmed.lower()
+    verified = "<title" in lower and "not found" in lower
+elif "json" in content_type:
+    try:
+        payload = json.loads(trimmed)
+    except Exception:
+        payload = None
+    if isinstance(payload, dict):
+        verified = any(payload.get(key) in (404, "404") for key in (
+            "code", "status", "status_code", "error_code"
+        ))
+raise SystemExit(0 if verified else 1)
+PY
+        cleanup_mcp_validation
+        return 2
+      fi
     fi
+    cleanup_mcp_validation
     die "Rainbond MCP 校验失败，HTTP 状态码 ${http_code}"
   fi
 
@@ -1971,11 +2380,43 @@ PY
   log "[verify] Rainbond MCP 可访问"
 }
 
+select_compatible_mcp_endpoint() {
+  local preferred_url="$1"
+  local generic_url="$2"
+  local token="$3"
+  local validation_status
+  SELECTED_MCP_URL=""
+
+  if validate_mcp_connectivity "$preferred_url" "$token"; then
+    SELECTED_MCP_URL="$preferred_url"
+    return 0
+  else
+    validation_status=$?
+  fi
+  if [[ "$validation_status" -ne 2 ]]; then
+    return "$validation_status"
+  fi
+
+  log "[compat] 当前 Rainbond 未提供 RainSkills 专用 MCP 地址，尝试兼容 MCP 地址。"
+  if validate_mcp_connectivity "$generic_url" "$token"; then
+    SELECTED_MCP_URL="$generic_url"
+    return 0
+  else
+    validation_status=$?
+  fi
+  if [[ "$validation_status" -eq 2 ]]; then
+    die "当前 Rainbond 未提供可用的 MCP 接口，请升级 Rainbond 后重试。"
+  fi
+  return "$validation_status"
+}
+
 migrate_codex_mcp_if_generic() {
   local generic_url="$1"
   local dedicated_url="$2"
   local config_file="$HOME/.codex/config.toml"
-  codex_config_matches "$generic_url" || return 0
+  if ! codex_config_matches "$generic_url" && ! codex_config_matches "$dedicated_url"; then
+    return 0
+  fi
 
   local backup="${config_file}.rainskills-backup"
   cp "$config_file" "$backup"
@@ -1985,14 +2426,16 @@ migrate_codex_mcp_if_generic() {
     warn "Codex MCP 迁移失败，已恢复原配置。"
     return 1
   fi
-  log "[migrate] Codex MCP 已切换到 RainSkills 专用地址"
+  log "[migrate] Codex MCP 已切换到 Rainskills 本地路由"
 }
 
 migrate_claude_mcp_if_generic() {
   local generic_url="$1"
   local dedicated_url="$2"
   local config_file="$HOME/.claude.json"
-  claude_config_matches "$generic_url" || return 0
+  if ! claude_config_matches "$generic_url" && ! claude_config_matches "$dedicated_url"; then
+    return 0
+  fi
 
   local backup="${config_file}.rainskills-backup"
   cp "$config_file" "$backup"
@@ -2002,7 +2445,7 @@ migrate_claude_mcp_if_generic() {
     warn "Claude MCP 迁移失败，已恢复原配置。"
     return 1
   fi
-  log "[migrate] Claude MCP 已切换到 RainSkills 专用地址"
+  log "[migrate] Claude MCP 已切换到 Rainskills 本地路由"
 }
 
 looks_like_jwt() {
@@ -2194,6 +2637,7 @@ read_cached_rainbond_url() {
 
 do_refresh() {
   set_rainskills_failure_context "authorization" "authorization_failed"
+  report_rainskills_lifecycle_event "authorize_legacy" "legacy_callback" "authorize" "started" "" "" "browser_loopback"
   ensure_python3
 
   # Refresh exists because the cached JWT is broken; ignore inherited tokens
@@ -2235,9 +2679,10 @@ do_refresh() {
   base_url="$(normalize_rainbond_url "$base_url_input")"
   confirm_insecure_http_if_needed "$base_url"
 
-  local token generic_mcp_url codex_mcp_url claude_mcp_url
+  local token generic_mcp_url codex_mcp_url claude_mcp_url selected_codex_mcp_url selected_claude_mcp_url
   local migrate_codex=0 migrate_claude=0
   local validate_codex=0 validate_claude=0
+  local using_legacy_compat=0
   obtain_rainbond_token "$base_url" "$DEPLOYMENT_MODE_INPUT"
   token="$OBTAINED_RAINBOND_TOKEN"
   generic_mcp_url="${base_url}/console/mcp/query"
@@ -2272,11 +2717,15 @@ do_refresh() {
 
   set_rainskills_failure_context "verification" "mcp_verification_failed"
   if (( validate_codex == 1 )); then
-    validate_mcp_connectivity "$codex_mcp_url" "$token"
+    select_compatible_mcp_endpoint "$codex_mcp_url" "$generic_mcp_url" "$token"
+    selected_codex_mcp_url="$SELECTED_MCP_URL"
+    [[ "$selected_codex_mcp_url" != "$generic_mcp_url" ]] || using_legacy_compat=1
     token="$VALIDATED_TOKEN"
   fi
   if (( validate_claude == 1 )); then
-    validate_mcp_connectivity "$claude_mcp_url" "$token"
+    select_compatible_mcp_endpoint "$claude_mcp_url" "$generic_mcp_url" "$token"
+    selected_claude_mcp_url="$SELECTED_MCP_URL"
+    [[ "$selected_claude_mcp_url" != "$generic_mcp_url" ]] || using_legacy_compat=1
     token="$VALIDATED_TOKEN"
   fi
 
@@ -2285,16 +2734,21 @@ do_refresh() {
   configure_shell_autoload
 
   set_rainskills_failure_context "configuration" "mcp_configuration_failed"
-  if (( migrate_codex == 1 )); then
+  report_rainskills_lifecycle_event "configure_mcp" "configure_mcp" "configure_mcp" "started"
+  if (( validate_codex == 1 )); then
     migrate_codex_mcp_if_generic "$generic_mcp_url" "$codex_mcp_url" \
-      || die "Codex MCP 专用地址迁移失败"
+      || die "Codex MCP 本地路由迁移失败"
   fi
-  if (( migrate_claude == 1 )); then
+  if (( validate_claude == 1 )); then
     migrate_claude_mcp_if_generic "$generic_mcp_url" "$claude_mcp_url" \
-      || die "Claude MCP 专用地址迁移失败"
+      || die "Claude MCP 本地路由迁移失败"
   fi
   log ""
-  log "JWT 刷新完成。脚本管理的旧通用 MCP 地址已按需迁移到 RainSkills 专用地址。"
+  if (( using_legacy_compat == 1 )); then
+    log "JWT 刷新完成。当前 Rainbond 将继续使用兼容 MCP 地址。"
+  else
+    log "JWT 刷新完成。脚本管理的旧 MCP 地址已按需迁移到 Rainskills 本地路由。"
+  fi
   if (( validate_codex == 1 || validate_claude == 1 )); then
     log "请重启 Claude Code 或 Codex 让新 JWT 生效（它们在启动时一次性读取 RAINBOND_JWT）。"
   fi
@@ -2302,6 +2756,7 @@ do_refresh() {
     log "如果想立刻在当前终端使用，请执行：source ${ACTIVE_SHELL_RC}"
   fi
   RAINSKILLS_INSTALL_TERMINAL_REPORTED=1
+  report_rainskills_lifecycle_event "configure_mcp" "configure_mcp" "configure_mcp" "completed"
   report_rainskills_installation "configured" "success"
 }
 
@@ -2316,6 +2771,7 @@ configure_mcp() {
   fi
 
   set_rainskills_failure_context "authorization" "authorization_failed"
+  report_rainskills_lifecycle_event "authorize_legacy" "legacy_callback" "authorize" "started" "" "" "browser_loopback"
   ensure_python3
   resolve_deployment_mode
 
@@ -2354,54 +2810,67 @@ configure_mcp() {
   base_url="$(normalize_rainbond_url "$base_url_input")"
   confirm_insecure_http_if_needed "$base_url"
 
-  local token codex_mcp_url claude_mcp_url
+  local token generic_mcp_url codex_mcp_url claude_mcp_url selected_codex_mcp_url selected_claude_mcp_url
   obtain_rainbond_token "$base_url" "$DEPLOYMENT_MODE_INPUT"
   token="$OBTAINED_RAINBOND_TOKEN"
   RAINSKILLS_INSTALL_CLIENT="$(rainskills_install_client_for_target "$TARGET")"
   record_rainskills_authorization "$base_url" "$token"
+  generic_mcp_url="${base_url}/console/mcp/query"
   codex_mcp_url="${base_url}/console/mcp/rainskills/codex/query"
   claude_mcp_url="${base_url}/console/mcp/rainskills/claude-code/query"
 
   set_rainskills_failure_context "verification" "mcp_verification_failed"
   case "$TARGET" in
     codex)
-      validate_mcp_connectivity "$codex_mcp_url" "$token"
+      select_compatible_mcp_endpoint "$codex_mcp_url" "$generic_mcp_url" "$token"
+      selected_codex_mcp_url="$SELECTED_MCP_URL"
       token="$VALIDATED_TOKEN"
       ;;
     claude)
-      validate_mcp_connectivity "$claude_mcp_url" "$token"
+      select_compatible_mcp_endpoint "$claude_mcp_url" "$generic_mcp_url" "$token"
+      selected_claude_mcp_url="$SELECTED_MCP_URL"
       token="$VALIDATED_TOKEN"
       ;;
     all)
-      validate_mcp_connectivity "$codex_mcp_url" "$token"
+      select_compatible_mcp_endpoint "$codex_mcp_url" "$generic_mcp_url" "$token"
+      selected_codex_mcp_url="$SELECTED_MCP_URL"
       token="$VALIDATED_TOKEN"
-      validate_mcp_connectivity "$claude_mcp_url" "$token"
+      select_compatible_mcp_endpoint "$claude_mcp_url" "$generic_mcp_url" "$token"
+      selected_claude_mcp_url="$SELECTED_MCP_URL"
       token="$VALIDATED_TOKEN"
       ;;
   esac
 
   # Refresh this process's env for any downstream CLI behavior that resolves it.
   export RAINBOND_JWT="$token"
-  write_token_file "$token" "$base_url"
-  configure_shell_autoload
+  if [[ "$ACTION" == "connect" ]]; then
+    node "$SCRIPT_DIR/bin/rainskills.js" runtime persist-connect-credential \
+      --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID" >/dev/null \
+      || die "runtime connect 凭据安全写入失败。"
+  else
+    write_token_file "$token" "$base_url"
+    configure_shell_autoload
+  fi
 
   set_rainskills_failure_context "configuration" "mcp_configuration_failed"
+  report_rainskills_lifecycle_event "configure_mcp" "configure_mcp" "configure_mcp" "started"
   local configured=0
   case "$TARGET" in
     codex)
-      configure_codex_mcp "$codex_mcp_url" && configured=1 || true
+      configure_codex_mcp && configured=1 || true
       ;;
     claude)
-      configure_claude_mcp "$claude_mcp_url" && configured=1 || true
+      configure_claude_mcp && configured=1 || true
       ;;
     all)
-      configure_codex_mcp "$codex_mcp_url" && configured=$((configured + 1)) || true
-      configure_claude_mcp "$claude_mcp_url" && configured=$((configured + 1)) || true
+      configure_codex_mcp && configured=$((configured + 1)) || true
+      configure_claude_mcp && configured=$((configured + 1)) || true
       ;;
   esac
 
   (( configured > 0 )) || die "所选平台都未能完成 MCP 配置。"
   RAINSKILLS_INSTALL_TERMINAL_REPORTED=1
+  report_rainskills_lifecycle_event "configure_mcp" "configure_mcp" "configure_mcp" "completed"
   report_rainskills_installation "configured" "success"
 
   if [[ -n "$ACTIVE_SHELL_RC" ]]; then
@@ -2418,6 +2887,24 @@ main() {
     return 0
   fi
 
+  if [[ "$ACTION" == "connect" ]]; then
+    [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]] \
+      && valid_runtime_operation_id "${RAINSKILLS_RUNTIME_OPERATION_ID:-}" \
+      || die "runtime connect 必须通过 Rainskills Node 入口执行。"
+    if [[ "$DEPLOYMENT_MODE_INPUT" == "self-hosted" ]]; then
+      assert_canonical_runtime_console_origin "$RAINBOND_URL_INPUT" \
+        || die "Rainbond Console 地址必须是已经安全校验的规范 origin。"
+    fi
+    ALLOW_INSECURE_HTTP=1
+    resolve_target
+    RAINSKILLS_INSTALL_CLIENT="$(rainskills_install_client_for_target "$TARGET")"
+    configure_mcp
+    if [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]]; then
+      node "$SCRIPT_DIR/bin/rainskills.js" runtime complete-connect \
+        --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID"
+    fi
+    return 0
+  fi
   resolve_target
   RAINSKILLS_INSTALL_CLIENT="$(rainskills_install_client_for_target "$TARGET")"
   set_rainskills_failure_context "skill_installation" "skill_installation_failed"
@@ -2440,34 +2927,20 @@ main() {
   done < <(collect_destinations)
 
   for dest in "${destinations[@]}"; do
-    log "安装到：$dest"
+    install_detail_log "安装到：$dest"
     for skill_dir in "${skills[@]}"; do
       copy_skill "$skill_dir" "$dest"
     done
   done
 
-  configure_mcp
-
-  if [[ "$RAINSKILLS_INSTALL_DEFERRED" -eq 1 ]]; then
-    return 0
-  fi
-
-  log ""
-  log "安装完成。本次：${INSTALL_COUNT_NEW} 项新装 / ${INSTALL_COUNT_UPDATED} 项已更新 / ${INSTALL_COUNT_UNCHANGED} 项已是最新 / ${INSTALL_COUNT_FORCED} 项强制覆盖"
-  case "$TARGET" in
-    codex)
-      log "请重新加载 shell 环境并重启 Codex 以加载新技能和 MCP。"
-      ;;
-    claude)
-      log "请重新加载 shell 环境并重启 Claude Code 以加载新技能和 MCP。"
-      ;;
-    all)
-      log "请重启 Codex / Claude Code 以加载新技能和 MCP。"
-      ;;
-  esac
+  install_detail_log ""
+  install_detail_log "安装完成。本次：${INSTALL_COUNT_NEW} 项新装 / ${INSTALL_COUNT_UPDATED} 项已更新 / ${INSTALL_COUNT_UNCHANGED} 项已是最新 / ${INSTALL_COUNT_FORCED} 项强制覆盖"
+  install_detail_log ""
+  print_capability_summary
 }
 
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  assert_internal_connect_entry "$@"
   trap 'handle_installer_signal 130' INT
   trap 'handle_installer_signal 143' TERM
   trap 'handle_installer_exit "$?"' EXIT