rainskills 0.1.19 → 0.1.21

package/rainbond-platform-installer/scripts/user-message.js

@@ -15,16 +15,9 @@ const USER_MESSAGES = Object.freeze({
       "请选择应用要运行的环境：",
       "",
       "1) 云端环境（免费体验）",
-      "2) 私有环境（去对接）",
-    ].join("\n"),
-  },
-  "add-environment-location": {
-    messageId: "runtime.add-environment-location",
-    message: [
-      "请选择要添加的运行环境：",
-      "",
-      "1) 云端环境（免费体验）",
-      "2) 私有环境（去对接）",
+      "2) 本机环境",
+      "3) 独立服务器",
+      "4) 已有 Rainbond",
     ].join("\n"),
   },
   "private-console-origin": {
@@ -78,48 +71,9 @@ function renderCatalogUserMessage(id, { controlPlatform = process.platform } = {
   return renderUserMessage(entry.messageId, entry.message);
 }
 
-function renderEnvironmentConnectedList({
-  environments,
-  defaultEnvironmentId,
-  addedEnvironmentId,
-}) {
-  if (!Array.isArray(environments) || environments.length === 0) {
-    throw new Error("运行环境列表无效");
-  }
-  const defaultEnvironment = environments.find((entry) => entry.id === defaultEnvironmentId);
-  const addedEnvironment = environments.find((entry) => entry.id === addedEnvironmentId);
-  if (!defaultEnvironment || !addedEnvironment) {
-    throw new Error("运行环境列表缺少默认环境或新增环境");
-  }
-  const kindLabel = (kind) => kind === "saas" ? "在线环境" : "私有环境";
-  const stateLabel = (state) => ({
-    connected: "已连接",
-    "needs-reconnect": "需要重新授权",
-    unavailable: "不可用",
-  })[state] || "状态未知";
-  const lines = environments.map((environment) => {
-    const labels = [kindLabel(environment.kind), stateLabel(environment.connection_state)];
-    if (environment.id === defaultEnvironmentId) labels.push("默认");
-    if (environment.id === addedEnvironmentId) labels.push("刚新增");
-    return `- ${environment.name}（${labels.join("，")}）`;
-  });
-  return renderUserMessage("runtime.environment-connected-list", [
-    "新环境已对接成功。",
-    "",
-    "当前运行环境：",
-    "",
-    ...lines,
-    "",
-    defaultEnvironmentId === addedEnvironmentId
-      ? `全局默认环境是：${defaultEnvironment.name}`
-      : `全局默认环境仍是：${defaultEnvironment.name}`,
-  ].join("\n"));
-}
-
 module.exports = {
   privateDeploymentLocationMessage,
   renderUserMessage,
   renderCatalogUserMessage,
-  renderEnvironmentConnectedList,
   writeUserMessage,
 };

package/rainbond-platform-installer/scripts/windows-client-config.js

@@ -1,23 +1,10 @@
 "use strict";
 
 const os = require("node:os");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
 const { looksLikeJwt } = require("./windows-auth.js");
 
 const MAX_MISSING_ROUTE_BODY_BYTES = 64 * 1024;
 
-function normalizeBaseUrl(value) {
-  const url = new URL(value);
-  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
-    throw new Error("Rainbond Console 地址必须是无凭据的 HTTP(S) URL");
-  }
-  url.search = "";
-  url.hash = "";
-  url.pathname = url.pathname.replace(/\/$/, "");
-  return url.toString().replace(/\/$/, "");
-}
-
 async function readBoundedResponseText(response) {
   const declaredLength = Number(response.headers?.get?.("content-length") || 0);
   if (Number.isFinite(declaredLength) && declaredLength > MAX_MISSING_ROUTE_BODY_BYTES) return null;
@@ -121,45 +108,7 @@ async function validateMcp({ url, token, fetchImpl = globalThis.fetch }) {
   return { token: looksLikeJwt(renewed) ? renewed : token };
 }
 
-function checkedSpawn(spawnImpl, command, args, options) {
-  const result = spawnImpl(command, args, options);
-  if (result.error) {
-    if (result.error.code === "ENOENT") throw new Error(`未找到所选客户端命令：${command}`);
-    throw result.error;
-  }
-  if (result.signal) throw new Error(`${command} 被信号 ${result.signal} 中断`);
-  if (result.status !== 0) throw new Error(`${command} 配置失败，退出码 ${result.status}`);
-}
-
-function persistWindowsEnvironment({
-  token,
-  baseUrl,
-  spawnImpl = spawnSync,
-  helperPath = path.join(__dirname, "windows-client-config.ps1"),
-}) {
-  if (!looksLikeJwt(token)) throw new Error("Rainbond JWT 格式无效");
-  const normalizedBase = normalizeBaseUrl(baseUrl);
-  const environment = {
-    ...process.env,
-    RAINSKILLS_RAINBOND_JWT: token,
-    RAINSKILLS_RAINBOND_URL: normalizedBase,
-  };
-  checkedSpawn(spawnImpl, "powershell.exe", [
-    "-NoProfile",
-    "-NonInteractive",
-    "-File",
-    helperPath,
-  ], {
-    encoding: "utf8",
-    env: environment,
-    windowsHide: true,
-  });
-  process.env.RAINBOND_JWT = token;
-  process.env.RAINBOND_URL = normalizedBase;
-}
-
 module.exports = {
   isVerifiedMissingMcpRoute,
-  persistWindowsEnvironment,
   validateMcp,
 };

package/rainbond-platform-installer/scripts/windows-onboarding.js

@@ -10,7 +10,6 @@ const readline = require("node:readline/promises");
 const { stdin, stdout } = require("node:process");
 const { pathToFileURL } = require("node:url");
 const { createSecureStateStore } = require("./secure-state.js");
-const { assertIntentCanInstallNewPlatform } = require("./runtime-intents.js");
 const { createWindowsSecureStateStore } = require("./windows-platform.js");
 const {
   authorizeWithDeviceFlow,
@@ -293,7 +292,6 @@ function createOnboardingCheckpoint({
   operationId = crypto.randomUUID(),
   now = () => new Date().toISOString(),
   stateStore,
-  intent,
 }) {
   if (!UUID_PATTERN.test(operationId)) throw new Error("operation id 不是有效的 UUID");
   if (!["codex", "claude", "pi", "all"].includes(target)) throw new Error("安装目标无效");
@@ -324,7 +322,6 @@ function createOnboardingCheckpoint({
     ),
     console_url: null,
   };
-  if (intent !== undefined) state.intent = assertIntentCanInstallNewPlatform(intent);
   store.atomicWriteJson(checkpointPath, state);
   return { path: checkpointPath, state };
 }

package/rainbond-platform-installer/scripts/windows-platform.ps1

@@ -303,7 +303,7 @@ function Get-StateAclFacts([string]$PathValue, [string]$Kind, [string]$HomeValue
       } finally {
         $hasher.Dispose()
       }
-      $fileIdentity = "sha256:$digest:$($stream.Length)"
+      $fileIdentity = "sha256:${digest}:$($stream.Length)"
     }
     return [ordered]@{
       ownerSid = Convert-IdentityToSid $acl.Owner

package/rainbond-platform-query/SKILL.md

@@ -6,82 +6,124 @@ description: Use for a user-requested, read-only Rainbond platform query about t
 # Rainbond Platform Query
 
 <!-- rainskills-runtime-gate:start -->
-## 运行环境门禁（最高优先级）
+## 单运行环境 CLI 门禁（最高优先级）
 
-### CLI 调用格式（强制）
+本机只允许连接一个 Rainbond 运行环境。当前 Skill 在本会话第一次调用 Rainbond 前，执行固定 launcher 的 `runtime status --json`。返回 `connected` 且 `usable=true` 后，所有查询和变更直接通过本地 `~/.rainbond/bin/rainskills-tools.js` 执行。不得配置或直接调用客户端 MCP，不得执行环境枚举或业务 operation 生命周期命令，也不得生成或传递运行环境 ID、业务 operation ID 或 intent JSON。
 
-所有可变 `call` 都必须使用完整 argv：`call <tool> --input - --operation-id <uuid> --skill-id rainbond-platform-query`。CLI 返回确认 ID 后，只能在同一 argv 末尾加入 `--confirm <confirmation-id>`；不得省略 `--skill-id`、猜测参数，或根据泛化错误反复重试。
+没有运行环境时，让用户选择 Rainbond Cloud 或一个已有/新建的私有 Rainbond，并执行对应的 `runtime connect`。连接和重新授权必须进入浏览器 Device Flow，不复用 Shell 中缓存的 JWT；新凭据通过 live probe 后才覆盖唯一运行环境。CLI 返回 401 时，只读调用可在 `runtime reconnect` 成功后重试一次；写调用不得自动重放，必须先查询平台真实状态。403 直接停止，不重新授权。
 
-### 多运行环境操作契约
+`context resolve` 是无状态调用：单一工作空间直接返回上下文，多个候选返回组合选项；用户选择后由当前任务直接携带 team/region 参数，不执行 `context select`，不写本地 operation。所有可变 `call` 仍需先取得 confirmation ID，再以完全相同的输入追加 `--confirm` 执行一次。
 
-Node.js 前置检查通过后，平台只读查询只执行一次本地 `rainskills-tools.js query`。用户未指定运行环境时，不得先执行 `environment list`，由 CLI 直接使用全局默认环境；默认环境缺失或不可用时停止且不回退。用户明确指定运行环境时，才允许执行一次本地 launcher + `["environment", "list", "--json"]` 解析不可变环境 ID，随后执行带 `--environment-id` 的单次查询。CLI 直接从受保护环境注册表读取环境与凭据，校验完整 `platform-query` intent 后调用 Rainbond；只读查询不创建 `operation_id` 或 operation 记录。Agent 禁止生成 UUID、禁止传 `--intent-json`，也禁止调用 `operation begin` 或 `operation complete`。环境、团队和应用只属于本次查询，禁止保存项目级默认环境或绑定；同一项目可以在多个环境中查询。明确“团队”表示环境内团队；明确“运行环境/平台”表示环境；裸名称同时匹配环境和团队时必须询问。
-
-查询入口只接受固定 Tool 映射：`rainbond_get_current_user`、`rainbond_query_enterprises`、`rainbond_query_teams`、`rainbond_query_regions`、`rainbond_query_apps`、`rainbond_get_team_apps`、`rainbond_query_components`。resource 和 intent 由 CLI 从 Tool 与输入参数构造并校验，Agent 不得自行拼接。CLI 参数校验失败表示命令尚未发起 Rainbond 查询，必须如实报告本地参数错误，不得表述为授权被拒绝。
-
-对 `rainbond_query_teams({})` 等企业范围查询，CLI 会在同一条 `query` 命令内部自动调用 `rainbond_get_current_user`，从当前身份取得 `enterprise_id`，再调用 `rainbond_query_teams` 等目标 Tool。Agent 不得要求用户提供或输入 `enterprise_id`，也不得为了取得该字段额外执行一条身份查询命令。
-
-第一步检查 Node.js 是否存在且主版本不低于 18。Node.js 缺失或低于 18 时，只说明“Rainskills 执行组件需要 Node.js 18 或更高版本”并停止：不选择运行环境，不调用 MCP，不猜测替代命令。只有用户或 agent 明确同意后才安装或升级 Node.js，再从同一原始 intent 继续。
-
-固定 launcher 是 `["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"]`；运行包版本标记为 `rainskills@0.1.19`，且必须与本技能包 `package.json` 一致。把 launcher 与参数拼成 argv 数组直接执行，禁止 `rainskills@latest` 或执行 shell 字符串。
-
-本地 launcher 必须从当前 Skill 所在目录的同级目录定位 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后使用 `["node", "<绝对路径>"]` 执行。仅在用户明确指定环境时使用 `environment list`；`runtime message` 仍使用本地 launcher。本地 launcher 只读取已安装文件和本机受保护状态，不得访问 npm 或其它网络。
-
-所有 Rainbond 查询必须通过本地 `~/.rainbond/bin/rainskills-tools.js` 的单次 `query` 命令执行。默认环境 argv 固定为 `["node", "<home>/.rainbond/bin/rainskills-tools.js", "query", "<tool>", "--input", "-"]`；明确环境 argv 固定为 `["node", "<home>/.rainbond/bin/rainskills-tools.js", "query", "<tool>", "--environment-id", "<environment-id>", "--input", "-"]`。JSON 只经 stdin 输入。禁止 Agent 直接调用 Rainbond MCP，也不得启动本地 Rainskills MCP 服务；不得把一次查询拆成 `environment list`、`operation begin`、`read`、`operation complete` 四次执行。
-
-只有 CLI 返回并通过校验的 `rainskills.next-action.v1` argv 才能执行续接。普通失败一律禁止自动重试：不得再次执行原命令，不得执行 `--help`、`sleep`、`rg`、`grep`，不得搜索 Rainskills 源码；只读查询不得手工补跑 `operation begin` 或 `operation complete`。
-
-<!-- rainskills-runtime-contract:start -->
 ```json
 {
-  "schema": "rainskills.skill-runtime-contract.v1",
-  "package_version": "rainskills@0.1.19",
-  "launcher": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"],
-  "local_launcher": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js"],
-  "local_argv": {
-    "environment-list": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "environment", "list", "--json"],
-    "runtime-message": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "runtime", "message", "--id", "<message-id>"],
-    "platform-query-default": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "query", "<tool>", "--input", "-"],
-    "platform-query-selected": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "query", "<tool>", "--environment-id", "<environment-id>", "--input", "-"]
-  },
-  "intents": {
-    "platform-query": {
-      "type": "platform-query",
-      "required": ["type", "resource"],
-      "optional": ["enterprise_id", "team_id", "app_id"],
-      "enums": {
-        "resource": ["current-user", "current-enterprise", "teams", "regions", "apps", "team-apps", "components"]
-      },
-      "example": {
-        "type": "platform-query",
-        "resource": "components",
-        "app_id": "app"
-      }
-    }
-  },
-  "routes": {
-    "existing": ["saas", "private-existing"]
-  },
-  "connect_argv": {
-    "saas": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--saas", "--intent-json", "<intent-json>"],
-    "private-existing": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--rainbond-url", "<rainbond-url>", "--intent-json", "<intent-json>"]
+  "schema": "rainskills.single-runtime-contract.v1",
+  "package_version": "rainskills@0.1.21",
+  "runtime_status": [
+    "node",
+    "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+    "runtime",
+    "status",
+    "--json"
+  ],
+  "runtime_connect": {
+    "saas": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "connect",
+      "<target>",
+      "--saas"
+    ],
+    "private_existing": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "connect",
+      "<target>",
+      "--rainbond-url",
+      "<console-origin>"
+    ],
+    "install_private": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "connect",
+      "<target>",
+      "--install-private",
+      "--location",
+      "<local-or-server>"
+    ],
+    "reconnect": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "reconnect",
+      "<target>"
+    ]
   },
   "input_commands": {
-    "query-default": {
-      "argv": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "query", "<tool>", "--input", "-"],
+    "context_resolve": {
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "context",
+        "resolve",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-platform-query"
+      ],
+      "stdin": {
+        "required": [
+          "enterprise",
+          "workspace"
+        ]
+      }
+    },
+    "read": {
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "read",
+        "<tool>",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-platform-query"
+      ],
       "stdin_schema_source": "tool-catalog"
     },
-    "query-selected": {
-      "argv": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "query", "<tool>", "--environment-id", "<environment-id>", "--input", "-"],
+    "call": {
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "call",
+        "<tool>",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-platform-query"
+      ],
       "stdin_schema_source": "tool-catalog"
+    },
+    "call_confirm": {
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "call",
+        "<tool>",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-platform-query",
+        "--confirm",
+        "<confirmation-id>"
+      ],
+      "stdin_schema_source": "same-confirmed-input"
     }
   }
 }
 ```
-<!-- rainskills-runtime-contract:end -->
-
-target 只允许 `codex`、`claude`、`pi`、`all`。校验 intent 后只执行 existing scope 的完整 argv；只消费 schema 为 `rainskills.next-action.v1` 且校验后的 `argv` 数组。
-
-连接完成后用固定 `onboarding-id` 执行 launcher + `["intent", "resume", "--onboarding-id", "<同一 onboarding-id>"]`，恢复原始 intent 和 `resume_step`。401 先执行 launcher + `["runtime", "record-failure", "--onboarding-id", "<同一 onboarding-id>", "--step", "<当前固定步骤>", "--reason", "credential-expired"]`，再仅一次执行 launcher + `["runtime", "reconnect", "--onboarding-id", "<同一 onboarding-id>"]` 后 resume，只重试该步骤；第二次 401 停止。403 执行 launcher + `["runtime", "record-failure", "--onboarding-id", "<同一 onboarding-id>", "--step", "<当前固定步骤>", "--reason", "permission-denied"]` 后停止，不得 reconnect、重新授权或自动重试。
 <!-- rainskills-runtime-gate:end -->
 
 受限沙箱（包括 Codex）执行本地状态命令时，必须申请用户级受保护目录访问权限；在 Codex 中使用 `require_escalated`。不得修改 `~/.rainbond` 权限、复制受保护状态到工作区，或因沙箱权限错误建议重装。

package/rainbond-project-init/SKILL.md

@@ -6,95 +6,124 @@ description: "Use only when the user explicitly asks to initialize or link a loc
 # Rainbond Project Init
 
 <!-- rainskills-runtime-gate:start -->
-## 运行环境门禁（最高优先级）
+## 单运行环境 CLI 门禁（最高优先级）
 
-### CLI 调用格式（强制）
+本机只允许连接一个 Rainbond 运行环境。当前 Skill 在本会话第一次调用 Rainbond 前，执行固定 launcher 的 `runtime status --json`。返回 `connected` 且 `usable=true` 后，所有查询和变更直接通过本地 `~/.rainbond/bin/rainskills-tools.js` 执行。不得配置或直接调用客户端 MCP，不得执行环境枚举或业务 operation 生命周期命令，也不得生成或传递运行环境 ID、业务 operation ID 或 intent JSON。
 
-所有可变 `call` 都必须使用完整 argv：`call <tool> --input - --operation-id <uuid> --skill-id rainbond-project-init`。CLI 返回确认 ID 后，只能在同一 argv 末尾加入 `--confirm <confirmation-id>`；不得省略 `--skill-id`、猜测参数，或根据泛化错误反复重试。
+没有运行环境时，让用户选择 Rainbond Cloud 或一个已有/新建的私有 Rainbond，并执行对应的 `runtime connect`。连接和重新授权必须进入浏览器 Device Flow，不复用 Shell 中缓存的 JWT；新凭据通过 live probe 后才覆盖唯一运行环境。CLI 返回 401 时，只读调用可在 `runtime reconnect` 成功后重试一次；写调用不得自动重放，必须先查询平台真实状态。403 直接停止，不重新授权。
 
-### 多运行环境操作契约
+`context resolve` 是无状态调用：单一工作空间直接返回上下文，多个候选返回组合选项；用户选择后由当前任务直接携带 team/region 参数，不执行 `context select`，不写本地 operation。所有可变 `call` 仍需先取得 confirmation ID，再以完全相同的输入追加 `--confirm` 执行一次。
 
-  Node.js 前置检查通过后，每次请求先执行本地 launcher + `["environment", "list", "--json"]`，按用户明确指定的运行环境选择不可变环境 ID；未指定时只用全局默认环境，默认不可用时停止且不回退。生成 UUID 后执行本地 launcher + `["operation", "begin", "--operation-id", "<uuid>", "--environment-id", "<id>", "--intent-json", "<intent-json>"]`，并在之后每个 Rainbond MCP 调用中加入 `rainskills_operation_id`。环境、团队和应用只属于本次操作，禁止保存项目绑定；同一项目可以部署到多个环境。明确“团队”表示环境内团队；明确“运行环境/平台”表示环境；裸名称同时匹配环境和团队时必须询问。
-
-第一步检查 Node.js 是否存在且主版本不低于 18。Node.js 缺失或低于 18 时，只说明“Rainskills 执行组件需要 Node.js 18 或更高版本”并停止：不选择运行环境，不调用 MCP，不猜测替代命令。只有用户或 agent 明确同意后才安装或升级 Node.js，再从同一原始 intent 继续。
-
-固定 launcher 是 `["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"]`；运行包版本标记为 `rainskills@0.1.19`，且必须与本技能包 `package.json` 一致。把 launcher 与参数拼成 argv 数组直接执行，禁止 `rainskills@latest` 或执行 shell 字符串。
-
-本地 launcher 必须从当前 Skill 所在目录的同级目录定位 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后使用 `["node", "<绝对路径>"]` 执行。`environment list`、`operation begin`、`operation complete` 和 `runtime message` 只能使用本地 launcher；本地 launcher 只读取已安装文件和本机受保护状态，不得访问 npm 或其它网络。只有用户选定连接或安装运行环境后，才使用上面的固定本地 launcher。
-
-所有 Rainbond 查询和变更必须通过本地 `~/.rainbond/bin/rainskills-tools.js` 执行，并绑定本次 operation ID。禁止 Agent 直接调用 Rainbond MCP，也不得启动本地 Rainskills MCP 服务；只允许执行 CLI 返回的结构化结果与确认续接 argv。
-
-业务操作开始后，必须使用 runtime contract 的 `input_commands.context-resolve` 完整 argv 和配套 stdin。返回 `resolved` 时只使用该 operation 已保存的企业、工作空间和集群上下文；返回 `needs-selection` 时，把 CLI 返回的“工作空间 + 集群”组合选项一次性列给用户，不得逐项询问，也不得让用户提供 enterprise_id。用户选择后必须使用 `input_commands.context-select` 的完整 argv 和配套 stdin；选择成功后继续原操作，同一 operation 不再重复查询上下文。
-
-只有 CLI 返回并通过校验的 `rainskills.next-action.v1` argv 才能执行续接。普通失败一律禁止自动重试：不得再次执行原命令，不得执行 `--help`、`sleep`、`rg`、`grep`，不得搜索 Rainskills 源码；同一 `operation complete` 最多执行一次。
-
-<!-- rainskills-runtime-contract:start -->
 ```json
 {
-  "schema": "rainskills.skill-runtime-contract.v1",
-  "package_version": "rainskills@0.1.19",
-  "launcher": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"],
-  "local_launcher": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js"],
-  "local_argv": {
-    "environment-list": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "environment", "list", "--json"],
-    "operation-begin-default": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "operation", "begin", "--operation-id", "<uuid>", "--intent-json", "<intent-json>"],
-    "operation-begin-selected": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "operation", "begin", "--operation-id", "<uuid>", "--environment-id", "<environment-id>", "--intent-json", "<intent-json>"],
-    "operation-complete": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "operation", "complete", "--operation-id", "<uuid>"],
-    "runtime-message": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "runtime", "message", "--id", "<message-id>"]
-  },
-  "intents": {
-    "project-init": {
-      "type": "project-init",
-      "required": ["type", "project_root"],
-      "optional": ["source_kind", "source_url", "image_ref"],
-      "enums": {
-        "source_kind": ["local", "git", "image", "package"]
-      },
-      "example": {
-        "type": "project-init",
-        "project_root": "/workspace/app",
-        "source_kind": "local"
-      }
-    }
-  },
-  "routes": {
-    "new": ["saas", "private-existing", "install-private"]
-  },
-  "connect_argv": {
-    "saas": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--saas", "--intent-json", "<intent-json>"],
-    "private-existing": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--rainbond-url", "<rainbond-url>", "--intent-json", "<intent-json>"],
-    "install-private": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--install-private", "--location", "<private-location>", "--intent-json", "<intent-json>"]
+  "schema": "rainskills.single-runtime-contract.v1",
+  "package_version": "rainskills@0.1.21",
+  "runtime_status": [
+    "node",
+    "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+    "runtime",
+    "status",
+    "--json"
+  ],
+  "runtime_connect": {
+    "saas": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "connect",
+      "<target>",
+      "--saas"
+    ],
+    "private_existing": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "connect",
+      "<target>",
+      "--rainbond-url",
+      "<console-origin>"
+    ],
+    "install_private": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "connect",
+      "<target>",
+      "--install-private",
+      "--location",
+      "<local-or-server>"
+    ],
+    "reconnect": [
+      "node",
+      "<home>/.rainbond/lib/rainskills/bin/rainskills.js",
+      "runtime",
+      "reconnect",
+      "<target>"
+    ]
   },
   "input_commands": {
-    "context-resolve": {
-      "argv": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "context", "resolve", "--input", "-", "--operation-id", "<uuid>", "--skill-id", "rainbond-project-init"],
-      "stdin": {
-        "required": ["enterprise", "workspace"]
-      }
-    },
-    "context-select": {
-      "argv": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "context", "select", "--input", "-", "--operation-id", "<uuid>", "--skill-id", "rainbond-project-init"],
+    "context_resolve": {
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "context",
+        "resolve",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-project-init"
+      ],
       "stdin": {
-        "selection_id": "<selection-id>",
-        "option_id": "<option-id>"
+        "required": [
+          "enterprise",
+          "workspace"
+        ]
       }
     },
     "read": {
-      "argv": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "read", "<tool>", "--input", "-", "--operation-id", "<uuid>", "--skill-id", "rainbond-project-init"],
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "read",
+        "<tool>",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-project-init"
+      ],
       "stdin_schema_source": "tool-catalog"
     },
     "call": {
-      "argv": ["node", "<home>/.rainbond/bin/rainskills-tools.js", "call", "<tool>", "--input", "-", "--operation-id", "<uuid>", "--skill-id", "rainbond-project-init"],
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "call",
+        "<tool>",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-project-init"
+      ],
       "stdin_schema_source": "tool-catalog"
+    },
+    "call_confirm": {
+      "argv": [
+        "node",
+        "<home>/.rainbond/bin/rainskills-tools.js",
+        "call",
+        "<tool>",
+        "--input",
+        "-",
+        "--skill-id",
+        "rainbond-project-init",
+        "--confirm",
+        "<confirmation-id>"
+      ],
+      "stdin_schema_source": "same-confirmed-input"
     }
   }
 }
 ```
-<!-- rainskills-runtime-contract:end -->
-
-target 只允许 `codex`、`claude`、`pi`、`all`。校验 intent 后只执行 new scope 的完整 argv；只消费 schema 为 `rainskills.next-action.v1` 且校验后的 `argv` 数组。
-
-连接完成后用固定 `onboarding-id` 执行 launcher + `["intent", "resume", "--onboarding-id", "<同一 onboarding-id>"]`，恢复原始 intent 和 `resume_step`。401 先执行 launcher + `["runtime", "record-failure", "--onboarding-id", "<同一 onboarding-id>", "--step", "<当前固定步骤>", "--reason", "credential-expired"]`，再仅一次执行 launcher + `["runtime", "reconnect", "--onboarding-id", "<同一 onboarding-id>"]` 后 resume，只重试该步骤；第二次 401 停止。403 执行 launcher + `["runtime", "record-failure", "--onboarding-id", "<同一 onboarding-id>", "--step", "<当前固定步骤>", "--reason", "permission-denied"]` 后停止，不得 reconnect、重新授权或自动重试。
 <!-- rainskills-runtime-gate:end -->
 
 受限沙箱（包括 Codex）执行本地状态命令时，必须申请用户级受保护目录访问权限；在 Codex 中使用 `require_escalated`。不得修改 `~/.rainbond` 权限、复制受保护状态到工作区，或因沙箱权限错误建议重装。
@@ -113,17 +142,11 @@ target 只允许 `codex`、`claude`、`pi`、`all`。校验 intent 后只执行
 请提示“请选择应用要运行的环境：”，并只显示：
 
 1) 云端环境（免费体验）
-2) 私有环境（去对接）
-
-用户选择私有环境后，立即执行本地 launcher + `["runtime", "message", "--id", "private-deployment-location"]`，并原样输出固定消息：
-
-请选择部署位置：
-
-1、部署到本机
-2、部署到独立服务器
-3、部署到已有 Rainbond
+2) 本机环境
+3) 独立服务器
+4) 已有 Rainbond
 
-选择 1 时执行 `install-private` route，并使用 `["--location", "local"]`；选择 2 时执行 `install-private` route，并使用 `["--location", "server"]`；选择 3 时执行本地 launcher + `["runtime", "message", "--id", "private-console-origin"]`，收到地址后执行 `private-existing`。不得显示额外的接入方式中间步骤，不得重复询问部署位置，也不得在环境准备完成前询问应用来源。
+选择 1 时执行 `saas` route；选择 2 时执行 `install-private` route，并使用 `["--location", "local"]`；选择 3 时执行 `install-private` route，并使用 `["--location", "server"]`；选择 4 时执行本地 launcher + `["runtime", "message", "--id", "private-console-origin"]`，收到地址后执行 `private-existing`。不得显示“私有环境”或部署位置中间层，不得重复询问部署位置，也不得在环境准备完成前询问应用来源。
 <!-- rainskills-runtime-routing:end -->
 
 ## Overview