rainskills 0.1.26 → 0.1.28

package/README.md

@@ -223,7 +223,7 @@ node ~/.rainbond/lib/rainskills/bin/rainskills.js platform install --onboarding-
 
 Rainskills 会在用户下一次发起业务动作时，由本地运行时立即返回环境查询结果，并另行启动后台任务静默检查更新。更新只跟随 npm `latest` 指向的正式版。当前版本是 RC 或其他预发布版本时不会查询、不会自动升级；npm 上的新 RC 版本也不参与正式版自动升级。
 
-发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.26`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
+发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.28`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
 
 升级只更新 Rainskills 自身，不触发 Rainbond 安装、运行环境选择、登录授权或重新对接，也不会新增 Agent MCP 配置。更新内容仅包括 Skills 和本地 CLI。原始业务操作会继续执行；只有该业务操作本身需要运行环境时，才按既有门禁检查当前连接。可用连接直接复用，401 只重新授权一次，403 立即停止，从未连接过运行环境时才进入环境选择。
 

package/SKILL.md

@@ -44,7 +44,11 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 `runtime connect` 的 Device Flow 不依赖 stdin TTY；Agent 必须执行固定 argv 并保持进程附着直到授权完成。能打开本机浏览器时由连接器自动跳转，SSH、容器等无浏览器场景原样展示授权地址并继续轮询。只有 Rainbond 不支持 Device Flow 且进入旧版 loopback 手动粘贴时才需要交互终端；不得要求用户在聊天中粘贴 JWT。
 
-Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.26`）：
+授权命令是同步门禁。执行工具返回“进程仍在运行”或会话 ID 时，必须只等待或轮询同一个命令会话；在该会话结束前，禁止读取专项 Skill、解析 context、调用业务 CLI 或执行任何后续业务步骤。浏览器页面显示成功不代表连接完成；只有原命令退出码为 0，并输出 `rainskills.runtime-connect-result.v1` 且 `state=connected`，才可继续。不得另起 `runtime status` 猜测完成，也不得重复提示用户授权。
+
+Codex 中命令工具一旦返回 `session_id`，必须立即对该 `session_id` 反复调用 `write_stdin`（空输入轮询），直到工具返回 `exit_code`。连接器输出 `[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]` 后进入上述轮询；看到 `[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]` 后仍须继续轮询，直到取得退出码和最终 JSON。
+
+Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.28`）：
 
 - 状态：执行 `runtime status --json`。
 - 首次连接：执行 `runtime connect <target> --saas` 或 `runtime connect <target> --rainbond-url <Console origin>`。

package/bin/rainskills-tools.js

@@ -29,6 +29,9 @@ const CONTEXT_HINT_FIELDS = new Set(["team_id", "team_name", "region_name"]);
 const SKILL_CONTENT_MAX_BYTES = 128 * 1024;
 const SKILL_MANIFEST_MAX_BYTES = 4 * 1024 * 1024;
 const SENSITIVE_RESPONSE_KEY_PATTERN = /(?:authorization|jwt|token|password|secret|credential|private[_-]?key|key[_-]?file|certificate|cert[_-]?file|ssl[_-]?ca[_-]?cert)/i;
+const SENSITIVE_ENV_NAME_PATTERN = /(?:^|_)(?:PASSWORD|PASSWD|PASS|SECRET|TOKEN|API_?KEY|PRIVATE_?KEY|CREDENTIALS?|AUTH(?:ORIZATION)?|COOKIE|CERT(?:IFICATE)?)(?:_|$)/i;
+const ENV_NAME_FIELDS = Object.freeze(["attr_name", "name", "note", "env_name"]);
+const ENV_VALUE_FIELDS = new Set(["attr_value", "value"]);
 const RISK_POLICY = Object.freeze({
   version: "1",
   readPrefixes: [
@@ -37,6 +40,12 @@ const RISK_POLICY = Object.freeze({
   ],
   destructiveFragments: ["delete", "remove", "purge", "destroy"],
 });
+const MIXED_TOOL_OPERATION_POLICY = Object.freeze({
+  rainbond_manage_component_dependency: Object.freeze({
+    readOperations: Object.freeze(["summary"]),
+    destructiveOperations: Object.freeze(["delete"]),
+  }),
+});
 const CALL_OPTION_DEFINITIONS = Object.freeze({
   "--confirm": Object.freeze({ property: "confirmation", pattern: OPERATION_ID_PATTERN }),
   "--skill-id": Object.freeze({ property: "skillId", pattern: SKILL_ID_PATTERN }),
@@ -489,8 +498,16 @@ function loadSkillBinding(config, skillId, rootSkillId) {
   };
 }
 
-function classifyTool(toolName) {
+function classifyTool(toolName, argumentsValue = {}) {
   const normalized = String(toolName || "").toLowerCase();
+  const operation = typeof argumentsValue.operation === "string"
+    ? argumentsValue.operation.trim().toLowerCase()
+    : "";
+  const mixedPolicy = MIXED_TOOL_OPERATION_POLICY[normalized];
+  if (mixedPolicy) {
+    if (mixedPolicy.destructiveOperations.includes(operation)) return "destructive";
+    if (mixedPolicy.readOperations.includes(operation)) return "read";
+  }
   if (RISK_POLICY.destructiveFragments.some((fragment) => normalized.includes(fragment))) {
     return "destructive";
   }
@@ -679,12 +696,47 @@ function fitOutput(value) {
   };
 }
 
-function sanitizeToolResult(value, pathParts = []) {
+function redactString(value, secrets) {
+  let safe = value;
+  for (const secret of secrets) {
+    if (secret) safe = safe.split(secret).join("[REDACTED]");
+  }
+  return safe;
+}
+
+function hasSensitiveEnvName(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  return ENV_NAME_FIELDS.some((field) => (
+    typeof value[field] === "string" && SENSITIVE_ENV_NAME_PATTERN.test(value[field])
+  ));
+}
+
+function collectSensitiveArgumentRedactions(value, output = []) {
+  if (Array.isArray(value)) {
+    for (const item of value) collectSensitiveArgumentRedactions(item, output);
+    return output;
+  }
+  if (!value || typeof value !== "object") return output;
+
+  const sensitiveEnv = hasSensitiveEnvName(value);
+  for (const [key, item] of Object.entries(value)) {
+    const sensitiveField = SENSITIVE_RESPONSE_KEY_PATTERN.test(key)
+      || SENSITIVE_ENV_NAME_PATTERN.test(key)
+      || (sensitiveEnv && ENV_VALUE_FIELDS.has(key));
+    if (sensitiveField && typeof item === "string" && item.length >= 4) output.push(item);
+    collectSensitiveArgumentRedactions(item, output);
+  }
+  return output;
+}
+
+function sanitizeToolResult(value, pathParts = [], sensitiveArguments = []) {
   if (Array.isArray(value)) {
-    return value.map((item) => sanitizeToolResult(item, pathParts));
+    return value.map((item) => sanitizeToolResult(item, pathParts, sensitiveArguments));
   }
+  if (typeof value === "string") return redactString(value, sensitiveArguments);
   if (!value || typeof value !== "object") return value;
   const safe = {};
+  const sensitiveEnv = hasSensitiveEnvName(value);
   for (const [key, item] of Object.entries(value)) {
     // Console destructive operations may return this one-time control value.
     // It is not a credential and must remain available for the confirmation flow.
@@ -695,7 +747,11 @@ function sanitizeToolResult(value, pathParts = []) {
     if (key !== "confirmation_token"
       && !isPackageUploadAuthMode
       && SENSITIVE_RESPONSE_KEY_PATTERN.test(key)) continue;
-    safe[key] = sanitizeToolResult(item, [...pathParts, key]);
+    if (sensitiveEnv && ENV_VALUE_FIELDS.has(key)) {
+      safe[key] = "[REDACTED]";
+      continue;
+    }
+    safe[key] = sanitizeToolResult(item, [...pathParts, key], sensitiveArguments);
   }
   return safe;
 }
@@ -1205,14 +1261,14 @@ async function execute(command, config) {
     };
   }
 
-  const operationClass = classifyTool(command.toolName);
+  const argumentsValue = command.argumentsValue || readArguments(command.input);
+  const operationClass = classifyTool(command.toolName, argumentsValue);
   if (command.command === "read" && operationClass !== "read") {
     throw new BridgeError(
       "read is read-only and rejects tools classified as write or destructive",
       EXIT.USAGE
     );
   }
-  const argumentsValue = command.argumentsValue || readArguments(command.input);
   let operation = null;
   let skillBinding = null;
   if (operationClass !== "read") {
@@ -1274,7 +1330,11 @@ async function execute(command, config) {
       throw new BridgeError("Rainbond tool response lacks structuredContent", EXIT.TRANSPORT);
     }
     if (operation) updateOperation(config, operation, "succeeded");
-    return fitOutput(sanitizeToolResult(result.structuredContent));
+    return fitOutput(sanitizeToolResult(
+      result.structuredContent,
+      [],
+      collectSensitiveArgumentRedactions(argumentsValue)
+    ));
   } catch (error) {
     if (operation) {
       updateOperation(config, operation, error.exitCode === EXIT.TRANSPORT ? "unknown" : "failed");

package/bin/rainskills.js

@@ -167,11 +167,29 @@ function runtimeConnectRetryAction(options, origin) {
   };
 }
 
-function runAttached(executable, args, { env = process.env } = {}) {
+function runAttached(executable, args, {
+  env = process.env,
+  signalSource = process,
+  spawnImpl = spawn,
+} = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawn(executable, args, { env, stdio: "inherit" });
-    child.once("error", () => reject(new Error("无法启动 RainSkills 运行环境连接器")));
-    child.once("close", (code, signal) => resolve({ code, signal }));
+    const child = spawnImpl(executable, args, { env, stdio: "inherit" });
+    const forwardSigint = () => child.kill("SIGINT");
+    const forwardSigterm = () => child.kill("SIGTERM");
+    const removeSignalListeners = () => {
+      signalSource.removeListener("SIGINT", forwardSigint);
+      signalSource.removeListener("SIGTERM", forwardSigterm);
+    };
+    signalSource.on("SIGINT", forwardSigint);
+    signalSource.on("SIGTERM", forwardSigterm);
+    child.once("error", () => {
+      removeSignalListeners();
+      reject(new Error("无法启动 RainSkills 运行环境连接器"));
+    });
+    child.once("close", (code, signal) => {
+      removeSignalListeners();
+      resolve({ code, signal });
+    });
   });
 }
 
@@ -416,7 +434,7 @@ async function runBuiltin(args, {
       intent: null,
       operation_id: operationId,
     };
-    manager.startConnecting(connection);
+    manager.startConnecting(connection, { replaceExisting: true });
     try {
       const invocation = runtimeConnectionInvocation(options, inspection.origin);
       let completedWithCredential = false;
@@ -774,6 +792,7 @@ module.exports = {
   classifyNodeMajor,
   parseRuntimeConnectArgs,
   resolveInvocation,
+  runAttached,
   runAutoUpdatePhase,
   runBuiltin,
   runtimeChildEnvironment,

package/install.sh

@@ -1772,6 +1772,20 @@ write_device_token_request_body() {
   chmod 600 "$body_file"
 }
 
+assert_device_authorization_operation_current() {
+  local base_url="$1"
+  [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]] || return 0
+  valid_runtime_operation_id "${RAINSKILLS_RUNTIME_OPERATION_ID:-}" || return 1
+
+  local environment_kind="private"
+  [[ "$DEPLOYMENT_MODE_INPUT" == "saas" ]] && environment_kind="saas"
+  node "$SCRIPT_DIR/bin/rainskills.js" runtime assert-connect \
+    --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID" \
+    --target "$TARGET" \
+    --environment-kind "$environment_kind" \
+    --console-origin "$base_url" >/dev/null 2>&1
+}
+
 poll_device_authorization() {
   local base_url="$1"
   local interval="$DEVICE_FLOW_INTERVAL"
@@ -1790,6 +1804,10 @@ poll_device_authorization() {
 
   while true; do
     device_flow_sleep "$interval"
+    if ! assert_device_authorization_operation_current "$base_url"; then
+      DEVICE_FLOW_ERROR="本次设备授权已被新的授权尝试替换。"
+      return 1
+    fi
     now="$(device_flow_now)"
     if [[ "$now" -ge "$deadline" ]]; then
       DEVICE_FLOW_ERROR="Rainbond 设备授权超时，请重新运行安装。"
@@ -1871,6 +1889,7 @@ device_flow_login_to_rainbond() {
     printf '请在任意能够访问该 Rainbond 平台的电脑上打开上面的地址并完成登录授权。\n' >&2
   fi
   printf '[RAINSKILLS_USER_MESSAGE_END:runtime.device-authorization]\n' >&2
+  printf '[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]\n' >&2
 
   if ! poll_device_authorization "$base_url"; then
     cleanup_device_flow
@@ -2101,6 +2120,8 @@ validate_mcp_connectivity() {
     curl \
       --silent \
       --show-error \
+      --connect-timeout 10 \
+      --max-time 30 \
       --output "$response_file" \
       --dump-header "$header_file" \
       --write-out '%{http_code}' \
@@ -2399,6 +2420,7 @@ obtain_rainbond_token() {
 
   local device_flow_status
   if device_flow_login_to_rainbond "$base_url"; then
+    printf '浏览器授权已完成，正在验证 Rainbond 连接…\n' >&2
     return 0
   else
     device_flow_status=$?
@@ -2409,6 +2431,7 @@ obtain_rainbond_token() {
       die "当前 Rainbond Console 仅支持旧版浏览器回调；此模式需要本机浏览器或交互终端。请升级 Rainbond Console 后重试。"
     fi
     browser_login_to_rainbond "$base_url"
+    printf '浏览器授权已完成，正在验证 Rainbond 连接…\n' >&2
     return 0
   fi
   die "${DEVICE_FLOW_ERROR:-Rainbond 设备授权失败。}"
@@ -2612,6 +2635,7 @@ main() {
     if [[ "${RAINSKILLS_RUNTIME_CONNECT_COMPLETION:-0}" == "1" ]]; then
       node "$SCRIPT_DIR/bin/rainskills.js" runtime complete-connect \
         --onboarding-id "$RAINSKILLS_RUNTIME_OPERATION_ID"
+      printf '[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]\n' >&2
     fi
     return 0
   fi

package/marketplace/rainskills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Install the complete Rainskills AI deployment skill suite as one product.",
   "author": {
     "name": "Goodrain",

package/marketplace/rainskills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Install the complete Rainskills AI deployment skill suite as one product.",
   "author": {
     "name": "Goodrain",

package/marketplace/rainskills/skills/rainskills/SKILL.md

@@ -14,7 +14,7 @@ This is the single marketplace entry for the complete Rainskills product. The in
 3. Keep stdin, stdout, and stderr attached. When `RAINSKILLS_USER_INPUT_REQUIRED` appears, pause for that installer choice. If the installer emits `rainskills.next-action.v1`, execute only its fixed `argv` through the same launcher; never evaluate output as a shell command. If the adjacent `bin/rainskills.js` exists, use it for fixed next actions; otherwise use the same versioned npm package fallback described below.
 4. Stay attached until every independent Skill is installed. Do not select, connect, or configure an application runtime during installation. In the user-facing response, output only the fixed completion message below.
 
-If the adjacent installer is missing, check the local Node.js version before choosing the fallback. With `npx` and Node.js 18 or newer, use `npx --yes rainskills@0.1.26 <target>`. With no Node.js or a version below 18, use `bash <(curl -fsSL https://get.rainbond.com/rainskills/install.sh) <target>` instead. Omit `<target>` only when the host cannot be determined reliably. Keep either command attached to the interactive terminal. For an update or repair, refresh this marketplace Skill first, then run the installer again; it compares and updates every independent internal Skill.
+If the adjacent installer is missing, check the local Node.js version before choosing the fallback. With `npx` and Node.js 18 or newer, use `npx --yes rainskills@0.1.28 <target>`. With no Node.js or a version below 18, use `bash <(curl -fsSL https://get.rainbond.com/rainskills/install.sh) <target>` instead. Omit `<target>` only when the host cannot be determined reliably. Keep either command attached to the interactive terminal. For an update or repair, refresh this marketplace Skill first, then run the installer again; it compares and updates every independent internal Skill.
 
 Skills-only 安装不需要 Node.js；CDN fallback 只负责安装 Skill 文件，不代表运行环境连接、应用部署或平台安装已经可执行。用户首次提出需要运行环境的动作时，对应业务 Skill 才检查 Node.js；固定 Rainskills launcher 需要 Node.js 18 或更高版本。缺失或版本过低时保留原始 intent 并停止，等待用户或 agent 明确同意安装或升级 Node.js，安装完成消息不得提前提示 Node.js。
 
@@ -44,7 +44,11 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 `runtime connect` 的 Device Flow 不依赖 stdin TTY；Agent 必须执行固定 argv 并保持进程附着直到授权完成。能打开本机浏览器时由连接器自动跳转，SSH、容器等无浏览器场景原样展示授权地址并继续轮询。只有 Rainbond 不支持 Device Flow 且进入旧版 loopback 手动粘贴时才需要交互终端；不得要求用户在聊天中粘贴 JWT。
 
-Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.26`）：
+授权命令是同步门禁。执行工具返回“进程仍在运行”或会话 ID 时，必须只等待或轮询同一个命令会话；在该会话结束前，禁止读取专项 Skill、解析 context、调用业务 CLI 或执行任何后续业务步骤。浏览器页面显示成功不代表连接完成；只有原命令退出码为 0，并输出 `rainskills.runtime-connect-result.v1` 且 `state=connected`，才可继续。不得另起 `runtime status` 猜测完成，也不得重复提示用户授权。
+
+Codex 中命令工具一旦返回 `session_id`，必须立即对该 `session_id` 反复调用 `write_stdin`（空输入轮询），直到工具返回 `exit_code`。连接器输出 `[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]` 后进入上述轮询；看到 `[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]` 后仍须继续轮询，直到取得退出码和最终 JSON。
+
+Rainskills 只保存一个全局运行环境，不维护环境列表、名称、默认值或环境 ID。使用固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.28`）：
 
 - 状态：执行 `runtime status --json`。
 - 首次连接：执行 `runtime connect <target> --saas` 或 `runtime connect <target> --rainbond-url <Console origin>`。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent",
   "license": "Apache-2.0",
   "homepage": "https://github.com/goodrain/rainskills#readme",
@@ -40,6 +40,7 @@
     "rainbond-template-installer/",
     "scripts/build-skill-manifest.mjs",
     "scripts/install-local-cli.mjs",
+    "scripts/validate_customer_output.py",
     "!**/__pycache__/",
     "!**/*.pyc"
   ],
@@ -67,7 +68,7 @@
     "test:launcher": "node --test tests/console-origin.test.js tests/local-cli-installer.test.js tests/npx-launcher.test.js tests/runtime-state.test.js tests/single-runtime.test.js tests/single-runtime-cli.test.js tests/single-runtime-launcher.test.js tests/skill-manifest-builder.test.js",
     "test:api-bridge": "node --test tests/api-bridge.test.js",
     "test:console-contract": "python3 tests/console_tool_contract_test.py",
-    "test:skill-profile": "node --test tests/skill-profile-builder.test.js tests/markdown-link-integrity.test.js",
+    "test:skill-profile": "node --test tests/skill-profile-builder.test.js tests/markdown-link-integrity.test.js tests/user-facing-output-contract.test.js",
     "test:marketplace": "node --test tests/marketplace-entry.test.js",
     "test:runtime-routing": "node --test tests/runtime-onboarding-routing.test.js && python3 rainbond-app-assistant/scripts/validate_progressive_loading.py && python3 rainbond-app-assistant/scripts/validate_cross_skill_routing.py && python3 tests/progressive-loading-validators.test.py && python3 tests/run_skill_routing_evals.py",
     "test:telemetry": "node --test tests/telemetry.test.js",

package/rainbond-app-assistant/SKILL.md

@@ -27,7 +27,7 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 | 需要对象边界或跨阶段状态语义 | [product object model](references/product-object-model.md) | 不相关工作流 |
 | 需要生成最终结果或自动化契约 | [output contract](references/output-contract.md) | 不需要结果协议时不得读取 |
 
-workspace context 包含 `enterprise_id`、`team_id`、`team_name` 和 `region_name`；app/component 标识只来自用户明确输入或本次实时查询/创建结果。它们都由当前任务携带，不写入 Runtime，也不得生成或传递 CLI 业务 operation ID、运行环境 ID 或 intent JSON。
+workspace context 包含 `enterprise_id`、`team_id`、`team_name` 和 `region_name`；`team_id` 可作为内部调用参数继续使用，但不得复制到用户可见的过程消息或最终结果中。app/component 标识只来自用户明确输入或本次实时查询/创建结果。它们都由当前任务携带，不写入 Runtime，也不得生成或传递 CLI 业务 operation ID、运行环境 ID 或 intent JSON。
 
 ## Runtime Gate
 
@@ -57,6 +57,8 @@ workspace context 包含 `enterprise_id`、`team_id`、`team_name` 和 `region_n
 
 - 成功：说明项目、运行环境、工作空间、应用、真实 Rainbond 页面/访问地址及本轮实际完成操作；无法确认的字段省略，禁止猜测。
 - 未完成：输出“部署失败。”、一句直接原因；仅在确有安全可执行方案时增加“解决办法”。
+- 默认不得展示内部对象、状态枚举、Skill/工具名、YAML、JSON 或英文编排标题。
+- 过程消息和最终结果中的工作空间一律用 `team_name` 展示，可连同 `region_name` 写成“工作空间 / 集群”；除非用户明确要求调试原始数据，不展示 `team_id`。
 - 用户明确要求结构化结果或自动化契约时，读取 [output contract](references/output-contract.md)，不得自行发明字段、枚举或状态。
 
 ## 停止条件

package/rainbond-app-assistant/evals/01-linked-topology-missing.expected.yaml

@@ -1,4 +1,5 @@
 case: linked-topology-missing
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/02-linked-topology-building.expected.yaml

@@ -1,4 +1,5 @@
 case: linked-topology-building
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/03-runtime-healthy-delivery-unknown.expected.yaml

@@ -1,4 +1,5 @@
 case: runtime-healthy-delivery-unknown
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/04-delivered-stop-without-promotion.expected.yaml

@@ -1,5 +1,5 @@
 case: delivered-stop-without-promotion
-presentation_mode: concise
+presentation_mode: customer
 assert:
   prose_contains:
     - 部署成功

package/rainbond-app-assistant/evals/05-delivered-explicit-dev-to-test.expected.yaml

@@ -1,4 +1,5 @@
 case: delivered-explicit-dev-to-test
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: dev_to_test_promotion

package/rainbond-app-assistant/evals/06-manual-validation-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: manual-validation-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: dev_to_test_promotion

package/rainbond-app-assistant/evals/07-cluster-capacity-blocked.expected.yaml

@@ -1,4 +1,5 @@
 case: cluster-capacity-blocked
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.orchestration_state: linked-and-cluster-capacity-blocked

package/rainbond-app-assistant/evals/08-code-build-handoff-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: code-build-handoff-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.orchestration_state: linked-and-needs-code-build-handoff

package/rainbond-app-assistant/evals/09-source-backed-failure-no-fallback.expected.yaml

@@ -1,4 +1,5 @@
 case: source-backed-failure-no-fallback
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.execution_path.requested_kind: source

package/rainbond-app-assistant/evals/10-identity-ambiguous-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: identity-ambiguous-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.orchestration_state: linked-and-identity-ambiguous

package/rainbond-app-assistant/evals/11-delivered-with-proxy-and-local-binding.expected.yaml

@@ -1,5 +1,5 @@
 case: delivered-with-proxy-and-local-binding
-presentation_mode: concise
+presentation_mode: customer
 assert:
   prose_contains:
     - 部署成功

package/rainbond-app-assistant/evals/12-complex-suite-needs-descriptor-stop.expected.yaml

@@ -1,4 +1,5 @@
 case: complex-suite-needs-descriptor-stop
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/13-explicit-git-url-locks-source.expected.yaml

@@ -1,4 +1,5 @@
 case: explicit-git-url-locks-source
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/14-strategy-switch-cleans-residue.expected.yaml

@@ -1,4 +1,5 @@
 case: strategy-switch-cleans-residue
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/15-turn-discipline-reuse-alias.expected.yaml

@@ -1,4 +1,5 @@
 case: turn-discipline-reuse-alias
+presentation_mode: structured
 assert:
   equal:
     AppAssistantResult.request_intent: source_app_delivery

package/rainbond-app-assistant/evals/16-source-delivered-manual-validation.expected.yaml

@@ -1,5 +1,5 @@
 case: source-delivered-manual-validation
-presentation_mode: concise
+presentation_mode: customer
 assert:
   prose_contains:
     - 部署成功，待浏览器访问确认

package/rainbond-app-assistant/references/operational-reference.md

@@ -13,7 +13,7 @@ Load this reference only when checking a proposed route or reviewing a completed
   - reporting team/region/app identity as a substitute for the clickable Rainbond deployment location
   - using the public service URL as the Rainbond deployment location, or constructing the public service URL from naming conventions
   - stripping useful diagnostic evidence from building, blocked, unhealthy, ambiguous, handoff, or incomplete promotion states
-  - omitting the required `### Structured Output` section in structured contract mode
+  - omitting `### Structured Output` after explicit structured contract mode was selected
   - replacing the required five human-readable sections with freeform narrative in structured contract mode
   - treating a project as unlinked only because `.rainbond/local.json.metadata.status` is stale even though the platform confirms the same app in the current run
   - omitting `Actions Performed` detail when the run only did inspection/classification and intentionally skipped downstream skills

package/rainbond-app-assistant/references/output-contract.md

@@ -30,22 +30,11 @@
     - concise delivery report mode
     - structured contract mode
 
-  ### Concise delivery report mode
-
-  Use this mode by default when all of the following are true:
-  - `request_intent = source_app_delivery`
-  - `runtime_state.phase = runtime_healthy`
-  - `delivery_state.status` is `delivered` or `delivered-but-needs-manual-validation`
-  - `delivery_state.verification_mode` is `verified`, `inferred`, or `manual_validation_needed` consistently with that status
-  - `next_action` is `stop` or `stop and validate URL manually`
-  - `promotion_result = null`
-  - there is no unresolved `runtime_state.blocker` or `delivery_state.blocker`
-  - `project.deployment_location_url` is non-null
-  - `delivery_state.preferred_access_url` is non-null
-  - the user did not explicitly request structured output, YAML, JSON, debug output, or machine-readable output
-  - no eval/automation consumer explicitly requires structured contract mode
-
-  In concise delivery report mode:
+  ### Customer report mode
+
+  Use this mode by default for successful, incomplete, blocked, ambiguous, and handoff results. Switch away from it only when the user explicitly requests structured output, YAML, JSON, debug details, or machine-readable output, or when an automation/evaluation consumer explicitly declares the structured contract requirement.
+
+  In customer report mode:
   - do not append `### Structured Output`
   - do not expose the fenced YAML block
   - keep the report short and directly useful to the user
@@ -93,17 +82,13 @@
   Use this mode when any of the following is true:
   - the user asks for structured output, YAML, JSON, debug details, or machine-readable output
   - an eval, wrapper, or automation flow explicitly needs deterministic structured schema validation
-  - any concise delivery report condition above is not met
-  - the app is building, unhealthy, blocked, identity-ambiguous, or requires handoff
-  - `promotion_result` is non-null or the user requested dev-to-test promotion
-  - there is any unresolved blocker or handoff
   - another skill or wrapper will consume the result as input
 
-  Building, unhealthy, blocked, ambiguous, handoff, and incomplete promotion states should keep the detailed human-readable sections and evidence below. Do not make non-success output terse merely because successful output is concise.
+  Building, unhealthy, blocked, ambiguous, handoff, and incomplete promotion states do not enable structured mode by themselves. In customer mode, explain the direct result and one actionable next step in concise Chinese without exposing internal enums or action ledgers.
 
   In structured contract mode:
   - the human-readable sections below are the narrative view over `AppAssistantResult`
-  - the reply must end with a final `### Structured Output` section
+  - the explicitly structured reply ends with a final `### Structured Output` section
   - the `### Structured Output` section must render `AppAssistantResult` in fenced `yaml`
   - the literal section order must be:
     - `### Project State`
@@ -394,7 +379,7 @@
   ```
   ````
 
-  In structured contract mode, always respond using exactly these sections:
+  Only in explicit structured contract mode, respond using exactly these sections:
 
   ### Project State
   - state the current classification

package/rainbond-app-assistant/references/runtime-gate.md

@@ -9,14 +9,18 @@ Canonical progressive-loading contract: `rainskills.skill-runtime-contract.v1`.
 
 没有运行环境时，让用户选择 Rainbond Cloud 或一个已有/新建的私有 Rainbond，并执行对应的 `runtime connect`。连接和重新授权必须进入浏览器 Device Flow，不复用 Shell 中缓存的 JWT；新凭据通过 live probe 后才覆盖唯一运行环境。CLI 返回 401 时，只读调用可在 `runtime reconnect` 成功后重试一次；写调用不得自动重放，必须先查询平台真实状态。403 直接停止，不重新授权。
 
-`context resolve` 是无状态调用：单一工作空间直接返回上下文，多个候选返回组合选项；用户选择后由当前任务直接携带 team/region 参数，不执行 `context select`，不写本地 operation。所有可变 `call` 仍需先取得 confirmation ID，再以完全相同的输入追加 `--confirm` 执行一次。
+授权命令是同步门禁。执行工具返回“进程仍在运行”或会话 ID 时，必须只等待或轮询同一个命令会话；在该会话结束前，禁止读取专项 Skill、解析 context、调用业务 CLI 或执行任何后续业务步骤。浏览器页面显示成功不代表连接完成；只有原命令退出码为 0，并输出 `rainskills.runtime-connect-result.v1` 且 `state=connected`，才可继续。不得另起 `runtime status` 猜测完成，也不得重复提示用户授权。
+
+Codex 中命令工具一旦返回 `session_id`，必须立即对该 `session_id` 反复调用 `write_stdin`（空输入轮询），直到工具返回 `exit_code`。连接器输出 `[RAINSKILLS_AGENT_WAIT_REQUIRED:runtime-connect]` 后进入上述轮询；看到 `[RAINSKILLS_AGENT_WAIT_COMPLETE:runtime-connect]` 后仍须继续轮询，直到取得退出码和最终 JSON。
+
+`context resolve` 是无状态调用：单一工作空间直接返回上下文，多个候选返回组合选项；其中 `team_id` 是后续平台调用的内部参数，不得复制到用户可见的过程消息或最终结果中。用户选择后由当前任务直接携带 team/region 参数，不执行 `context select`，不写本地 operation。所有可变 `call` 仍需先取得 confirmation ID，再以完全相同的输入追加 `--confirm` 执行一次。
 
 `required` 只声明要解析的维度，企业 ID 始终来自当前登录身份。用户明确给出的 team/region 必须放进 `hints` 做精确匹配；不得把企业名、team 名或选择对象作为顶层 `enterprise` / `workspace` 字段传入。多候选时只展示 CLI 返回的 label；用户选择后再次执行同一个无状态 `context resolve`，通过 `selection.option_id` 让 CLI 重新查询并验证当前候选，不写本地 context 状态。
 
 ```json
 {
   "schema": "rainskills.single-runtime-contract.v1",
-  "package_version": "rainskills@0.1.26",
+  "package_version": "rainskills@0.1.28",
   "runtime_status": [
     "node",
     "<home>/.rainbond/lib/rainskills/bin/rainskills.js",

package/rainbond-app-assistant/references/workflow-rules.md

@@ -529,7 +529,7 @@
     反例（来自真实回归 case `cs_1779149681822_3u`，2026-05-19）：模型从 `rainbond_get_component_summary` 响应的 `recent_events` 段看到形如 `{"ID": 17740, "event_id": "...", "opt_type": "build-service"}`，直接把 `17740` 当成 `event_id` 传给 `rainbond_get_component_build_logs`，工具返回 `items: []`（找不到该 UUID 的日志）。正确做法：从同一 `recent_events[i].event_id` 字段取出 UUID 字符串，或调 `rainbond_get_component_events` 重查。
 35. **会话内部叙述纪律 + 内部 preflight 工具不要主动调**。下列四类是"内部会话状态"，对用户**无信息量**，禁止外漏到 assistant 可见消息：
     - **专项 Skill 手册加载过程**：这是当前任务的内部准备。不要说"我先加载 bootstrap 手册"、"手册已加载"或"skill ready"；读完直接进入下一个真实工具调用。
-    - **`rainbond_get_current_user`**：不得由 Agent 单独调用。`enterprise_id`、`team_id`、`team_name` 和 `region_name` 统一由受保护的 `context resolve` 命令无状态解析并由当前任务携带；只有 CLI 明确返回需要选择时才询问用户。
+    - **`rainbond_get_current_user`**：不得由 Agent 单独调用。`enterprise_id`、`team_id`、`team_name` 和 `region_name` 统一由受保护的 `context resolve` 命令无状态解析并由当前任务携带；`team_id` 可继续用于后续平台调用，但不得在过程消息或最终报告中展示。只有 CLI 明确返回需要选择时才询问用户，并且只展示名称标签。
     - **`rainbond_query_components` 同入参重复轮询**：服务端 30s 内的同 args 调用会走缓存；你**不要**在每个新 user turn 开头都"先查一下组件列表"。只有本次调用使用的 `enterprise_id`、`app_id` 和查询条件均未变化，且没有新的平台动作时，才可复用 priorTurnMessages 里的最近结果。
     - **规则推理过程 / Rainbond Tool 内部限制 / 分类决策叙述**：你内部基于哪条 Iron Law / hard rule / 推断信号做的决策、具体 Tool 签名 / 字段限制、对组件 / 服务的分类判断（"ClickHouse 是公认的列式分析数据库"这类），都属于内部状态，对用户**无信息量**。