rainskills 0.1.25 → 0.1.27

package/README.md

@@ -223,7 +223,7 @@ node ~/.rainbond/lib/rainskills/bin/rainskills.js platform install --onboarding-
 
 Rainskills 会在用户下一次发起业务动作时，由本地运行时立即返回环境查询结果，并另行启动后台任务静默检查更新。更新只跟随 npm `latest` 指向的正式版。当前版本是 RC 或其他预发布版本时不会查询、不会自动升级；npm 上的新 RC 版本也不参与正式版自动升级。
 
-发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.25`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
+发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.27`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
 
 升级只更新 Rainskills 自身，不触发 Rainbond 安装、运行环境选择、登录授权或重新对接，也不会新增 Agent MCP 配置。更新内容仅包括 Skills 和本地 CLI。原始业务操作会继续执行；只有该业务操作本身需要运行环境时，才按既有门禁检查当前连接。可用连接直接复用，401 只重新授权一次，403 立即停止，从未连接过运行环境时才进入环境选择。
 

package/SKILL.md

@@ -44,7 +44,11 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 `runtime connect` 的 Device Flow 不依赖 stdin TTY；Agent 必须执行固定 argv 并保持进程附着直到授权完成。能打开本机浏览器时由连接器自动跳转，SSH、容器等无浏览器场景原样展示授权地址并继续轮询。只有 Rainbond 不支持 Device Flow 且进入旧版 loopback 手动粘贴时才需要交互终端；不得要求用户在聊天中粘贴 JWT。
 
-Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.25`）：
+授权命令是同步门禁。执行工具返回“进程仍在运行”或会话 ID 时，必须只等待或轮询同一个命令会话；在该会话结束前，禁止读取专项 Skill、解析 context、调用业务 CLI 或执行任何后续业务步骤。浏览器页面显示成功不代表连接完成；只有原命令退出码为 0，并输出 `rainskills.runtime-connect-result.v1` 且 `state=connected`，才可继续。不得另起 `runtime status` 猜测完成，也不得重复提示用户授权。
+
+Codex 中命令工具一旦返回 `session_id`，必须立即对该 `session_id` 反复调用 `write_stdin`（空输入轮询），直到工具返回 `exit_code`。连接器输出 `[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]` 后进入上述轮询；看到 `[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]` 后仍须继续轮询，直到取得退出码和最终 JSON。
+
+Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.27`）：
 
 - 状态：执行 `runtime status --json`。
 - 首次连接：执行 `runtime connect <target> --saas` 或 `runtime connect <target> --rainbond-url <Console origin>`。

package/bin/rainskills-tools.js

@@ -23,9 +23,15 @@ const SKILL_MANIFEST_FILENAME = "rainskills-skill-manifest.json";
 const OPERATION_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9-]{27,}$/;
 const SKILL_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
+const CONTEXT_RESOLVE_FIELDS = new Set(["required", "hints", "selection"]);
+const CONTEXT_HINT_FIELDS = new Set(["team_id", "team_name", "region_name"]);
 const SKILL_CONTENT_MAX_BYTES = 128 * 1024;
 const SKILL_MANIFEST_MAX_BYTES = 4 * 1024 * 1024;
 const SENSITIVE_RESPONSE_KEY_PATTERN = /(?:authorization|jwt|token|password|secret|credential|private[_-]?key|key[_-]?file|certificate|cert[_-]?file|ssl[_-]?ca[_-]?cert)/i;
+const SENSITIVE_ENV_NAME_PATTERN = /(?:^|_)(?:PASSWORD|PASSWD|PASS|SECRET|TOKEN|API_?KEY|PRIVATE_?KEY|CREDENTIALS?|AUTH(?:ORIZATION)?|COOKIE|CERT(?:IFICATE)?)(?:_|$)/i;
+const ENV_NAME_FIELDS = Object.freeze(["attr_name", "name", "note", "env_name"]);
+const ENV_VALUE_FIELDS = new Set(["attr_value", "value"]);
 const RISK_POLICY = Object.freeze({
   version: "1",
   readPrefixes: [
@@ -34,6 +40,12 @@ const RISK_POLICY = Object.freeze({
   ],
   destructiveFragments: ["delete", "remove", "purge", "destroy"],
 });
+const MIXED_TOOL_OPERATION_POLICY = Object.freeze({
+  rainbond_manage_component_dependency: Object.freeze({
+    readOperations: Object.freeze(["summary"]),
+    destructiveOperations: Object.freeze(["delete"]),
+  }),
+});
 const CALL_OPTION_DEFINITIONS = Object.freeze({
   "--confirm": Object.freeze({ property: "confirmation", pattern: OPERATION_ID_PATTERN }),
   "--skill-id": Object.freeze({ property: "skillId", pattern: SKILL_ID_PATTERN }),
@@ -486,8 +498,16 @@ function loadSkillBinding(config, skillId, rootSkillId) {
   };
 }
 
-function classifyTool(toolName) {
+function classifyTool(toolName, argumentsValue = {}) {
   const normalized = String(toolName || "").toLowerCase();
+  const operation = typeof argumentsValue.operation === "string"
+    ? argumentsValue.operation.trim().toLowerCase()
+    : "";
+  const mixedPolicy = MIXED_TOOL_OPERATION_POLICY[normalized];
+  if (mixedPolicy) {
+    if (mixedPolicy.destructiveOperations.includes(operation)) return "destructive";
+    if (mixedPolicy.readOperations.includes(operation)) return "read";
+  }
   if (RISK_POLICY.destructiveFragments.some((fragment) => normalized.includes(fragment))) {
     return "destructive";
   }
@@ -676,12 +696,47 @@ function fitOutput(value) {
   };
 }
 
-function sanitizeToolResult(value, pathParts = []) {
+function redactString(value, secrets) {
+  let safe = value;
+  for (const secret of secrets) {
+    if (secret) safe = safe.split(secret).join("[REDACTED]");
+  }
+  return safe;
+}
+
+function hasSensitiveEnvName(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  return ENV_NAME_FIELDS.some((field) => (
+    typeof value[field] === "string" && SENSITIVE_ENV_NAME_PATTERN.test(value[field])
+  ));
+}
+
+function collectSensitiveArgumentRedactions(value, output = []) {
   if (Array.isArray(value)) {
-    return value.map((item) => sanitizeToolResult(item, pathParts));
+    for (const item of value) collectSensitiveArgumentRedactions(item, output);
+    return output;
   }
+  if (!value || typeof value !== "object") return output;
+
+  const sensitiveEnv = hasSensitiveEnvName(value);
+  for (const [key, item] of Object.entries(value)) {
+    const sensitiveField = SENSITIVE_RESPONSE_KEY_PATTERN.test(key)
+      || SENSITIVE_ENV_NAME_PATTERN.test(key)
+      || (sensitiveEnv && ENV_VALUE_FIELDS.has(key));
+    if (sensitiveField && typeof item === "string" && item.length >= 4) output.push(item);
+    collectSensitiveArgumentRedactions(item, output);
+  }
+  return output;
+}
+
+function sanitizeToolResult(value, pathParts = [], sensitiveArguments = []) {
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeToolResult(item, pathParts, sensitiveArguments));
+  }
+  if (typeof value === "string") return redactString(value, sensitiveArguments);
   if (!value || typeof value !== "object") return value;
   const safe = {};
+  const sensitiveEnv = hasSensitiveEnvName(value);
   for (const [key, item] of Object.entries(value)) {
     // Console destructive operations may return this one-time control value.
     // It is not a credential and must remain available for the confirmation flow.
@@ -692,7 +747,11 @@ function sanitizeToolResult(value, pathParts = []) {
     if (key !== "confirmation_token"
       && !isPackageUploadAuthMode
       && SENSITIVE_RESPONSE_KEY_PATTERN.test(key)) continue;
-    safe[key] = sanitizeToolResult(item, [...pathParts, key]);
+    if (sensitiveEnv && ENV_VALUE_FIELDS.has(key)) {
+      safe[key] = "[REDACTED]";
+      continue;
+    }
+    safe[key] = sanitizeToolResult(item, [...pathParts, key], sensitiveArguments);
   }
   return safe;
 }
@@ -1017,17 +1076,96 @@ function boundedContextString(value) {
   return typeof value === "string"
     && value.length > 0
     && value.length <= 128
-    && !/[\u0000-\u001f\u007f-\u009f]/u.test(value)
+    && !CONTROL_CHARACTER_PATTERN.test(value)
     ? value
     : null;
 }
 
-async function resolveStatelessContext(input, config) {
-  const required = input?.required;
+function contextInputUsageError() {
+  return new BridgeError("context input fields are invalid", EXIT.USAGE, {
+    error: "context input fields are invalid",
+    expected: {
+      required: ["enterprise", "workspace"],
+      hints: { team_name: "<team-name>" },
+    },
+    note: "enterprise is resolved from the current authenticated identity",
+  });
+}
+
+function validateContextHints(value) {
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new BridgeError("context workspace hints are invalid", EXIT.USAGE);
+  }
+  const entries = Object.entries(value);
+  if (entries.length === 0
+    || entries.some(([field, item]) => !CONTEXT_HINT_FIELDS.has(field) || !boundedContextString(item))) {
+    throw new BridgeError("context workspace hints are invalid", EXIT.USAGE);
+  }
+  return Object.fromEntries(entries);
+}
+
+function validateContextSelection(value) {
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)
+    || Object.keys(value).length !== 1
+    || typeof value.option_id !== "string"
+    || value.option_id.length === 0
+    || value.option_id.length > 300
+    || CONTROL_CHARACTER_PATTERN.test(value.option_id)) {
+    throw new BridgeError("context workspace selection is invalid", EXIT.USAGE);
+  }
+  return { option_id: value.option_id };
+}
+
+function validateContextResolveInput(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw contextInputUsageError();
+  }
+  if (Object.keys(input).some((field) => !CONTEXT_RESOLVE_FIELDS.has(field))) {
+    throw contextInputUsageError();
+  }
+  const required = input.required;
   if (!Array.isArray(required)
     || required.some((item) => !["enterprise", "workspace"].includes(item))) {
     throw new BridgeError("context required dimensions are invalid", EXIT.USAGE);
   }
+
+  const hints = validateContextHints(input.hints);
+  const selection = validateContextSelection(input.selection);
+
+  if ((hints || selection) && !required.includes("workspace")) {
+    throw new BridgeError("context workspace input requires the workspace dimension", EXIT.USAGE);
+  }
+  if (hints && selection) {
+    throw new BridgeError("context hints and selection are mutually exclusive", EXIT.USAGE);
+  }
+  return { required, hints, selection };
+}
+
+function resolvedWorkspaceContext(enterpriseId, option) {
+  return {
+    state: "resolved",
+    context: {
+      enterprise_id: enterpriseId,
+      team_id: option.team_id,
+      team_name: option.team_name,
+      region_name: option.region_name,
+    },
+  };
+}
+
+function workspaceSelectionResult(enterpriseId, options) {
+  return {
+    state: "needs-selection",
+    enterprise_id: enterpriseId,
+    dimension: "workspace-region",
+    options,
+  };
+}
+
+async function resolveStatelessContext(input, config) {
+  const { required, hints, selection } = validateContextResolveInput(input);
   const identity = await execute({
     command: "read",
     toolName: "rainbond_get_current_user",
@@ -1071,19 +1209,22 @@ async function resolveStatelessContext(input, config) {
     }
   }
   if (options.length === 0) return { state: "blocked", reason: "no-accessible-workspace" };
-  if (options.length === 1) {
-    const option = options[0];
-    return {
-      state: "resolved",
-      context: {
-        enterprise_id: enterpriseId,
-        team_id: option.team_id,
-        team_name: option.team_name,
-        region_name: option.region_name,
-      },
-    };
-  }
-  return { state: "needs-selection", dimension: "workspace-region", options };
+  if (selection) {
+    const selected = options.find((option) => option.id === selection.option_id);
+    return selected
+      ? resolvedWorkspaceContext(enterpriseId, selected)
+      : { state: "blocked", reason: "workspace-selection-invalid" };
+  }
+  const matchingOptions = hints
+    ? options.filter((option) => Object.entries(hints).every(([field, value]) => option[field] === value))
+    : options;
+  if (matchingOptions.length === 0) {
+    return { state: "blocked", reason: "workspace-hint-not-found" };
+  }
+  if (matchingOptions.length === 1) {
+    return resolvedWorkspaceContext(enterpriseId, matchingOptions[0]);
+  }
+  return workspaceSelectionResult(enterpriseId, matchingOptions);
 }
 
 async function execute(command, config) {
@@ -1120,14 +1261,14 @@ async function execute(command, config) {
     };
   }
 
-  const operationClass = classifyTool(command.toolName);
+  const argumentsValue = command.argumentsValue || readArguments(command.input);
+  const operationClass = classifyTool(command.toolName, argumentsValue);
   if (command.command === "read" && operationClass !== "read") {
     throw new BridgeError(
       "read is read-only and rejects tools classified as write or destructive",
       EXIT.USAGE
     );
   }
-  const argumentsValue = command.argumentsValue || readArguments(command.input);
   let operation = null;
   let skillBinding = null;
   if (operationClass !== "read") {
@@ -1189,7 +1330,11 @@ async function execute(command, config) {
       throw new BridgeError("Rainbond tool response lacks structuredContent", EXIT.TRANSPORT);
     }
     if (operation) updateOperation(config, operation, "succeeded");
-    return fitOutput(sanitizeToolResult(result.structuredContent));
+    return fitOutput(sanitizeToolResult(
+      result.structuredContent,
+      [],
+      collectSensitiveArgumentRedactions(argumentsValue)
+    ));
   } catch (error) {
     if (operation) {
       updateOperation(config, operation, error.exitCode === EXIT.TRANSPORT ? "unknown" : "failed");

package/bin/rainskills.js

@@ -167,11 +167,29 @@ function runtimeConnectRetryAction(options, origin) {
   };
 }
 
-function runAttached(executable, args, { env = process.env } = {}) {
+function runAttached(executable, args, {
+  env = process.env,
+  signalSource = process,
+  spawnImpl = spawn,
+} = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawn(executable, args, { env, stdio: "inherit" });
-    child.once("error", () => reject(new Error("无法启动 RainSkills 运行环境连接器")));
-    child.once("close", (code, signal) => resolve({ code, signal }));
+    const child = spawnImpl(executable, args, { env, stdio: "inherit" });
+    const forwardSigint = () => child.kill("SIGINT");
+    const forwardSigterm = () => child.kill("SIGTERM");
+    const removeSignalListeners = () => {
+      signalSource.removeListener("SIGINT", forwardSigint);
+      signalSource.removeListener("SIGTERM", forwardSigterm);
+    };
+    signalSource.on("SIGINT", forwardSigint);
+    signalSource.on("SIGTERM", forwardSigterm);
+    child.once("error", () => {
+      removeSignalListeners();
+      reject(new Error("无法启动 RainSkills 运行环境连接器"));
+    });
+    child.once("close", (code, signal) => {
+      removeSignalListeners();
+      resolve({ code, signal });
+    });
   });
 }
 
@@ -416,7 +434,7 @@ async function runBuiltin(args, {
       intent: null,
       operation_id: operationId,
     };
-    manager.startConnecting(connection);
+    manager.startConnecting(connection, { replaceExisting: true });
     try {
       const invocation = runtimeConnectionInvocation(options, inspection.origin);
       let completedWithCredential = false;
@@ -774,6 +792,7 @@ module.exports = {
   classifyNodeMajor,
   parseRuntimeConnectArgs,
   resolveInvocation,
+  runAttached,
   runAutoUpdatePhase,
   runBuiltin,
   runtimeChildEnvironment,

package/install.sh

@@ -1772,6 +1772,20 @@ write_device_token_request_body() {
   chmod 600 "$body_file"
 }
 
+assert_device_authorization_operation_current() {
+  local base_url="$1"
+  [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]] || return 0
+  valid_runtime_operation_id "${RAINSKILLS_RUNTIME_OPERATION_ID:-}" || return 1
+
+  local environment_kind="private"
+  [[ "$DEPLOYMENT_MODE_INPUT" == "saas" ]] && environment_kind="saas"
+  node "$SCRIPT_DIR/bin/rainskills.js" runtime assert-connect \
+    --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID" \
+    --target "$TARGET" \
+    --environment-kind "$environment_kind" \
+    --console-origin "$base_url" >/dev/null 2>&1
+}
+
 poll_device_authorization() {
   local base_url="$1"
   local interval="$DEVICE_FLOW_INTERVAL"
@@ -1790,6 +1804,10 @@ poll_device_authorization() {
 
   while true; do
     device_flow_sleep "$interval"
+    if ! assert_device_authorization_operation_current "$base_url"; then
+      DEVICE_FLOW_ERROR="本次设备授权已被新的授权尝试替换。"
+      return 1
+    fi
     now="$(device_flow_now)"
     if [[ "$now" -ge "$deadline" ]]; then
       DEVICE_FLOW_ERROR="Rainbond 设备授权超时，请重新运行安装。"
@@ -1871,6 +1889,7 @@ device_flow_login_to_rainbond() {
     printf '请在任意能够访问该 Rainbond 平台的电脑上打开上面的地址并完成登录授权。\n' >&2
   fi
   printf '[RAINSKILLS_USER_MESSAGE_END:runtime.device-authorization]\n' >&2
+  printf '[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]\n' >&2
 
   if ! poll_device_authorization "$base_url"; then
     cleanup_device_flow
@@ -2101,6 +2120,8 @@ validate_mcp_connectivity() {
     curl \
       --silent \
       --show-error \
+      --connect-timeout 10 \
+      --max-time 30 \
       --output "$response_file" \
       --dump-header "$header_file" \
       --write-out '%{http_code}' \
@@ -2399,6 +2420,7 @@ obtain_rainbond_token() {
 
   local device_flow_status
   if device_flow_login_to_rainbond "$base_url"; then
+    printf '浏览器授权已完成，正在验证 Rainbond 连接…\n' >&2
     return 0
   else
     device_flow_status=$?
@@ -2409,6 +2431,7 @@ obtain_rainbond_token() {
       die "当前 Rainbond Console 仅支持旧版浏览器回调；此模式需要本机浏览器或交互终端。请升级 Rainbond Console 后重试。"
     fi
     browser_login_to_rainbond "$base_url"
+    printf '浏览器授权已完成，正在验证 Rainbond 连接…\n' >&2
     return 0
   fi
   die "${DEVICE_FLOW_ERROR:-Rainbond 设备授权失败。}"
@@ -2612,6 +2635,7 @@ main() {
     if [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]]; then
       node "$SCRIPT_DIR/bin/rainskills.js" runtime complete-connect \
         --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID"
+      printf '[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]\n' >&2
     fi
     return 0
   fi

package/marketplace/rainskills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Install the complete Rainskills AI deployment skill suite as one product.",
   "author": {
     "name": "Goodrain",

package/marketplace/rainskills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Install the complete Rainskills AI deployment skill suite as one product.",
   "author": {
     "name": "Goodrain",

package/marketplace/rainskills/skills/rainskills/SKILL.md

@@ -14,7 +14,7 @@ This is the single marketplace entry for the complete Rainskills product. The in
 3. Keep stdin, stdout, and stderr attached. When `RAINSKILLS_USER_INPUT_REQUIRED` appears, pause for that installer choice. If the installer emits `rainskills.next-action.v1`, execute only its fixed `argv` through the same launcher; never evaluate output as a shell command. If the adjacent `bin/rainskills.js` exists, use it for fixed next actions; otherwise use the same versioned npm package fallback described below.
 4. Stay attached until every independent Skill is installed. Do not select, connect, or configure an application runtime during installation. In the user-facing response, output only the fixed completion message below.
 
-If the adjacent installer is missing, check the local Node.js version before choosing the fallback. With `npx` and Node.js 18 or newer, use `npx --yes rainskills@0.1.25 <target>`. With no Node.js or a version below 18, use `bash <(curl -fsSL https://get.rainbond.com/rainskills/install.sh) <target>` instead. Omit `<target>` only when the host cannot be determined reliably. Keep either command attached to the interactive terminal. For an update or repair, refresh this marketplace Skill first, then run the installer again; it compares and updates every independent internal Skill.
+If the adjacent installer is missing, check the local Node.js version before choosing the fallback. With `npx` and Node.js 18 or newer, use `npx --yes rainskills@0.1.27 <target>`. With no Node.js or a version below 18, use `bash <(curl -fsSL https://get.rainbond.com/rainskills/install.sh) <target>` instead. Omit `<target>` only when the host cannot be determined reliably. Keep either command attached to the interactive terminal. For an update or repair, refresh this marketplace Skill first, then run the installer again; it compares and updates every independent internal Skill.
 
 Skills-only 安装不需要 Node.js；CDN fallback 只负责安装 Skill 文件，不代表运行环境连接、应用部署或平台安装已经可执行。用户首次提出需要运行环境的动作时，对应业务 Skill 才检查 Node.js；固定 Rainskills launcher 需要 Node.js 18 或更高版本。缺失或版本过低时保留原始 intent 并停止，等待用户或 agent 明确同意安装或升级 Node.js，安装完成消息不得提前提示 Node.js。
 
@@ -44,7 +44,11 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 `runtime connect` 的 Device Flow 不依赖 stdin TTY；Agent 必须执行固定 argv 并保持进程附着直到授权完成。能打开本机浏览器时由连接器自动跳转，SSH、容器等无浏览器场景原样展示授权地址并继续轮询。只有 Rainbond 不支持 Device Flow 且进入旧版 loopback 手动粘贴时才需要交互终端；不得要求用户在聊天中粘贴 JWT。
 
-Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.25`）：
+授权命令是同步门禁。执行工具返回“进程仍在运行”或会话 ID 时，必须只等待或轮询同一个命令会话；在该会话结束前，禁止读取专项 Skill、解析 context、调用业务 CLI 或执行任何后续业务步骤。浏览器页面显示成功不代表连接完成；只有原命令退出码为 0，并输出 `rainskills.runtime-connect-result.v1` 且 `state=connected`，才可继续。不得另起 `runtime status` 猜测完成，也不得重复提示用户授权。
+
+Codex 中命令工具一旦返回 `session_id`，必须立即对该 `session_id` 反复调用 `write_stdin`（空输入轮询），直到工具返回 `exit_code`。连接器输出 `[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]` 后进入上述轮询；看到 `[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]` 后仍须继续轮询，直到取得退出码和最终 JSON。
+
+Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.27`）：
 
 - 状态：执行 `runtime status --json`。
 - 首次连接：执行 `runtime connect <target> --saas` 或 `runtime connect <target> --rainbond-url <Console origin>`。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent",
   "license": "Apache-2.0",
   "homepage": "https://github.com/goodrain/rainskills#readme",
@@ -40,6 +40,7 @@
     "rainbond-template-installer/",
     "scripts/build-skill-manifest.mjs",
     "scripts/install-local-cli.mjs",
+    "scripts/validate_customer_output.py",
     "!**/__pycache__/",
     "!**/*.pyc"
   ],
@@ -67,7 +68,7 @@
     "test:launcher": "node --test tests/console-origin.test.js tests/local-cli-installer.test.js tests/npx-launcher.test.js tests/runtime-state.test.js tests/single-runtime.test.js tests/single-runtime-cli.test.js tests/single-runtime-launcher.test.js tests/skill-manifest-builder.test.js",
     "test:api-bridge": "node --test tests/api-bridge.test.js",
     "test:console-contract": "python3 tests/console_tool_contract_test.py",
-    "test:skill-profile": "node --test tests/skill-profile-builder.test.js tests/markdown-link-integrity.test.js",
+    "test:skill-profile": "node --test tests/skill-profile-builder.test.js tests/markdown-link-integrity.test.js tests/user-facing-output-contract.test.js",
     "test:marketplace": "node --test tests/marketplace-entry.test.js",
     "test:runtime-routing": "node --test tests/runtime-onboarding-routing.test.js && python3 rainbond-app-assistant/scripts/validate_progressive_loading.py && python3 rainbond-app-assistant/scripts/validate_cross_skill_routing.py && python3 tests/progressive-loading-validators.test.py && python3 tests/run_skill_routing_evals.py",
     "test:telemetry": "node --test tests/telemetry.test.js",

package/rainbond-app-assistant/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rainbond-app-assistant
-description: "Use whenever a user asks to deploy, run, deliver, publish, inspect, repair, or troubleshoot source code, the current project or local project, a source directory/package, an ordinary bare Git repository URL, a private-image project, or a named application that is not identified as a third-party open-source suite. Trigger phrases: 帮我部署当前项目 / 帮我把这个项目跑起来 / 帮我看看当前项目卡在哪 / 如果还没初始化就先初始化，然后自动继续到应该停止的位置 / 帮我处理一下这个应用. Not for supplied third-party Compose, Helm, image-set descriptors, or an explicit named third-party open-source suite; use rainbond-opensource-app-deploy. Confirmed market templates use rainbond-template-installer."
+description: "Use whenever a user asks to deploy, run, deliver, publish, inspect, repair, or troubleshoot source code, the current project or local project, a source directory/package, an ordinary bare Git repository URL, a private-image project, a named application that is not identified as a third-party open-source suite, or a new app/component built from one container image. Trigger phrases: 帮我部署当前项目 / 帮我把这个项目跑起来 / 帮我看看当前项目卡在哪 / 如果还没初始化就先初始化，然后自动继续到应该停止的位置 / 帮我处理一下这个应用 / 在团队下新建应用并使用镜像创建组件. Not for supplied third-party Compose, Helm, image-set descriptors, or an explicit named third-party open-source suite; use rainbond-opensource-app-deploy. Confirmed market templates use rainbond-template-installer."
 ---
 
 # Rainbond App Assistant
@@ -14,7 +14,7 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 - 用户实际提供第三方 Docker Compose、Helm、镜像集合描述符，或明确要求部署 Harbor、Dify、n8n 等第三方开源套件：转到 rainbond-opensource-app-deploy。
 - 已确认是 Rainbond 本地/云端市场模板：转到 rainbond-template-installer。
 
-开始前读取 [routing](references/routing.md) 做静态归属判断。只加载最终所属 Skill 的 Runtime Gate，不得读取相邻 Skill 的 Gate。
+开始前读取 [routing](references/routing.md) 做静态归属判断。初始路由阶段只加载最终所属入口 Skill 的 Runtime Gate，不得提前读取专项 Skill 的 Gate。
 
 ## 渐进加载
 
@@ -23,11 +23,11 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 | 阶段 | 必须读取 | 禁止提前读取 |
 |---|---|---|
 | 初始部署或首次 Rainbond 操作 | 本根入口、[own runtime gate](references/runtime-gate.md)、[routing](references/routing.md) | 其余全部 |
-| operation/context 已建立，需要编排或执行 | [workflow rules](references/workflow-rules.md)；仅在核对路线或复盘时读取 [operational reference](references/operational-reference.md) | 输出与对象细节 |
+| workspace context 已解析，需要编排或执行 app/component | [workflow rules](references/workflow-rules.md)；仅在核对路线或复盘时读取 [operational reference](references/operational-reference.md) | 输出与对象细节 |
 | 需要对象边界或跨阶段状态语义 | [product object model](references/product-object-model.md) | 不相关工作流 |
 | 需要生成最终结果或自动化契约 | [output contract](references/output-contract.md) | 不需要结果协议时不得读取 |
 
-这里的 operation/context 是当前任务内的业务操作与 team/region/app 上下文；不得生成或传递 CLI 业务 operation ID、运行环境 ID 或 intent JSON。
+workspace context 包含 `enterprise_id`、`team_id`、`team_name` 和 `region_name`；app/component 标识只来自用户明确输入或本次实时查询/创建结果。它们都由当前任务携带，不写入 Runtime，也不得生成或传递 CLI 业务 operation ID、运行环境 ID 或 intent JSON。
 
 ## Runtime Gate
 
@@ -35,7 +35,7 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 
 不可弱化的不变量：
 
-- 不得绕过 Gate 选择的 transport、context 或授权边界，也不得读取相邻 Skill 的 Gate。
+- 不得绕过 Gate 选择的 transport、context 或授权边界。进入专项阶段后，按 workflow rules 完整读取对应专项 Skill；其中重复的 Gate 只用于一致性核对，不得触发第二次连接、状态检查或 context 解析，除非 Gate 声明的失效条件已经发生。
 - 401：只读调用仅可按 Gate 允许的恢复流程重试一次；写调用不得自动重放，必须先查询真实状态。403：立即停止，不做未授权重试。
 - 可变调用必须先取得确认 ID，再用完全相同输入附加确认执行；不得绕过确认。
 - JWT、凭据与密钥不得回显、复制到报告或通过替代 transport 绕过保护。
@@ -49,7 +49,7 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 - 到达 code_or_build_handoff_needed 后硬停止，不自动改代码、运行本地测试、提交、推送或重试。
 - 密钥只来自当前 profile 允许的输入源，永不回显或写入报告。
 
-详细主线、operation/context 复用、代理规则、构建/运行时证据链、依赖、确认边界与尝试预算只在需要执行时读取 [workflow rules](references/workflow-rules.md)。
+详细主线、context 复用、专项手册加载、构建/运行时证据链、依赖、确认边界与尝试预算只在需要执行时读取 [workflow rules](references/workflow-rules.md)。
 
 ## 简洁结果协议
 
@@ -57,6 +57,7 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 
 - 成功：说明项目、运行环境、工作空间、应用、真实 Rainbond 页面/访问地址及本轮实际完成操作；无法确认的字段省略，禁止猜测。
 - 未完成：输出“部署失败。”、一句直接原因；仅在确有安全可执行方案时增加“解决办法”。
+- 默认不得展示内部对象、状态枚举、Skill/工具名、YAML、JSON 或英文编排标题。
 - 用户明确要求结构化结果或自动化契约时，读取 [output contract](references/output-contract.md)，不得自行发明字段、枚举或状态。
 
 ## 停止条件

package/rainbond-app-assistant/evals/01-linked-topology-missing.expected.yaml

@@ -1,4 +1,5 @@
 case: linked-topology-missing
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/02-linked-topology-building.expected.yaml

@@ -1,4 +1,5 @@
 case: linked-topology-building
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/03-runtime-healthy-delivery-unknown.expected.yaml

@@ -1,4 +1,5 @@
 case: runtime-healthy-delivery-unknown
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/04-delivered-stop-without-promotion.expected.yaml

@@ -1,5 +1,5 @@
 case: delivered-stop-without-promotion
-presentation_mode: concise
+presentation_mode: customer
 assert:
   prose_contains:
     - 部署成功

package/rainbond-app-assistant/evals/05-delivered-explicit-dev-to-test.expected.yaml

@@ -1,4 +1,5 @@
 case: delivered-explicit-dev-to-test
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: dev_to_test_promotion

package/rainbond-app-assistant/evals/06-manual-validation-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: manual-validation-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: dev_to_test_promotion

package/rainbond-app-assistant/evals/07-cluster-capacity-blocked.expected.yaml

@@ -1,4 +1,5 @@
 case: cluster-capacity-blocked
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.orchestration_state: linked-and-cluster-capacity-blocked

package/rainbond-app-assistant/evals/08-code-build-handoff-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: code-build-handoff-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.orchestration_state: linked-and-needs-code-build-handoff

package/rainbond-app-assistant/evals/09-source-backed-failure-no-fallback.expected.yaml

@@ -1,4 +1,5 @@
 case: source-backed-failure-no-fallback
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.execution_path.requested_kind: source

package/rainbond-app-assistant/evals/10-identity-ambiguous-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: identity-ambiguous-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.orchestration_state: linked-and-identity-ambiguous

package/rainbond-app-assistant/evals/11-delivered-with-proxy-and-local-binding.expected.yaml

@@ -1,5 +1,5 @@
 case: delivered-with-proxy-and-local-binding
-presentation_mode: concise
+presentation_mode: customer
 assert:
   prose_contains:
     - 部署成功

package/rainbond-app-assistant/evals/12-complex-suite-needs-descriptor-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: complex-suite-needs-descriptor-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery