rainskills 0.1.6 → 0.1.8-rc.2

package/README.md

@@ -41,11 +41,11 @@ Claude Code：
 /reload-plugins
 ```
 
-安装流程支持 Codex 和 Claude Code；macOS、Linux 和 WSL 不支持 OpenClaw 或 Pi Agent 安装。不要手工复制 Skill、拼接凭据或修改 MCP 配置。
+安装流程支持 Codex 和 Claude Code；macOS、Linux 和 WSL 不支持 OpenClaw 安装。不要手工复制 Skill、拼接凭据或修改 Agent 配置。
 
 ## 安装完成时用户会看到什么
 
-安装完成后只完成 Skills 安装并展示能力列表，不选择运行环境、不登录 Rainbond，也不配置业务 MCP：
+安装完成后只完成 Skills 和受保护本地 CLI 的安装并展示能力列表，不选择运行环境、不登录 Rainbond，也不配置 Agent MCP：
 
 ```text
 Rainskills 安装完成，下一条消息即可直接使用。
@@ -72,13 +72,13 @@ Rainskills 安装完成，下一条消息即可直接使用。
 固定 launcher 来自当前 `package.json` 版本：
 
 ```json
-["npx", "--yes", "rainskills@0.1.6"]
+["npx", "--yes", "rainskills@0.1.8-rc.2"]
 ```
 
 所有调用都把 launcher 与参数合并成 argv 数组后直接执行；不得使用 `rainskills@latest`，不得把参数拼成 shell 字符串。
 
-1. 执行 launcher + `["environment", "list", "--json"]`，先于项目扫描和任何业务 MCP。未指定环境时只使用全局默认环境，默认不可用时停止，不自动回退。
-2. 每个请求生成独立 operation UUID，并执行 `operation begin`；显式环境只写入这次 operation。每个 Rainbond MCP 调用都携带返回的 `rainskills_operation_id`。项目不保存环境、团队或应用绑定，同一项目可以部署到多个目标。
+1. 执行 launcher + `["environment", "list", "--json"]`，先于项目扫描和任何 Rainbond 业务调用。未指定环境时只使用全局默认环境，默认不可用时停止，不自动回退。
+2. 每个请求生成独立 operation UUID，并执行 `operation begin`；显式环境只写入这次 operation。所有 Rainbond 查询和变更都通过 `~/.rainbond/bin/rainskills-tools.js`，并绑定返回的 operation ID。项目不保存环境、团队或应用绑定，同一项目可以部署到多个目标。
 3. 将动作转换为 `runtime-intents.js` 中对应的受限 intent 并完成字段校验。target 只允许 `codex`、`claude`、`all`；按用户选择构造 launcher + `["runtime", "connect", "<target>", ...环境参数, "--intent-json", "<JSON.stringify(已校验 intent)>"]`。
 4. 环境参数必须恰好选择一组且互斥：Cloud 用 `["--saas"]`，已有私有环境用 `["--rainbond-url", "<已验证 Console origin>"]`，新建私有环境用 `["--install-private", "--location", "local"]` 或 `["--install-private", "--location", "server"]`。
 5. 安装私有环境时，只消费完成 schema、action、onboarding id 和参数边界校验的 `rainskills.next-action.v1.argv`；拒绝字符串命令和其他输出字段。
@@ -141,10 +141,10 @@ Rainskills 安装完成，下一条消息即可直接使用。
 - 第一个连接成功的环境自动成为全局默认环境；以后新增环境不修改默认值。
 - 用户未指定环境时使用默认环境；用户明确指定时只覆盖本次 operation。
 - 环境名称自动生成，可重命名；内部不可变 ID 不随重命名改变。
-- 添加、重命名、重新授权或删除环境不改项目配置，也不需要为每个环境重新配置 Agent MCP。
+- 添加、重命名、重新授权或删除环境不改项目配置，也不需要为每个 Agent 单独配置 MCP。
 - 新增环境直接建立独立连接，不读取或恢复旧版单环境状态；HTTPS 直接进入授权，明文 HTTP 只增加一次可信网络确认。
 - 新增环境与首次部署复用同一套固定选择：先选“云端环境（免费体验）/私有环境（去对接）”；选择私有环境后直接选“部署到本机/部署到独立服务器/部署到已有 Rainbond”，不再出现旧的接入方式中间步骤。
-- Agent 始终连接一个本地 Rainskills MCP。Rainskills 按 `operation_id` 从隔离凭据存储中选择目标 Rainbond。
+- Agent 始终执行同一个受保护的本地 Rainskills CLI。CLI 按 `operation_id` 从隔离凭据存储中选择目标 Rainbond；Rainskills 不提供本地 MCP 服务，Agent 也不得绕过 CLI 直接调用 Rainbond MCP。
 - 明确说“团队”表示默认或指定运行环境中的 Rainbond 团队；明确说“运行环境/平台”表示环境。裸名称同时匹配两者时必须询问。
 
 常用管理命令：
@@ -164,7 +164,7 @@ node <已安装的 Skills 根目录>/rainbond-platform-installer/scripts/local-r
 
 ### 认证与权限恢复
 
-业务 MCP 返回 401 时，依次执行以下 argv 参数：
+Rainbond 能力端点经 CLI 返回 401 时，依次执行以下 argv 参数：
 
 ```json
 ["runtime", "record-failure", "--onboarding-id", "<同一 onboarding-id>", "--step", "<当前固定步骤>", "--reason", "credential-expired"]
@@ -192,21 +192,21 @@ Windows 本地安装是预览能力，也可以改选 Linux 服务器。它要
 
 ```bash
 # 本地单机
-npx --yes rainskills@0.1.6 platform install --onboarding-id <id> \
+npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
   --location local --mode single-node
 
 # Linux 服务器单机
-npx --yes rainskills@0.1.6 platform install --onboarding-id <id> \
+npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
   --location server --mode single-node --ssh <user@host>
 
 # 服务器主机集群（自动生成受保护示例文件）
-npx --yes rainskills@0.1.6 platform install --onboarding-id <id> \
+npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
   --location server --mode host-cluster
 
 # 已有高级 ROI cluster.yaml 才追加：--cluster-config <path>
 
 # 已有 Kubernetes
-npx --yes rainskills@0.1.6 platform install --onboarding-id <id> \
+npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
   --location server --mode existing-kubernetes \
   --kubeconfig <path> --kube-context <name> --chart-version <version>
 ```
@@ -228,9 +228,9 @@ npx --yes rainskills@0.1.6 platform install --onboarding-id <id> \
 
 Rainskills 会在用户下一次发起业务动作时，由本地运行时立即返回环境查询结果，并另行启动后台任务静默检查更新。更新只跟随 npm `latest` 指向的正式版。当前版本是 RC 或其他预发布版本时不会查询、不会自动升级；npm 上的新 RC 版本也不参与正式版自动升级。
 
-发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@1.2.3`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
+发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.8-rc.2`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
 
-升级只更新 Rainskills 自身，不触发 Rainbond 安装、运行环境选择、登录授权、MCP 配置或重新对接。原始业务操作会继续执行；只有该业务操作本身需要运行环境时，才按既有门禁检查当前连接。可用连接直接复用，401 只重新授权一次，403 立即停止，从未连接过运行环境时才进入环境选择。
+升级只更新 Rainskills 自身，不触发 Rainbond 安装、运行环境选择、登录授权或重新对接，也不会新增 Agent MCP 配置。更新内容仅包括 Skills 和本地 CLI。原始业务操作会继续执行；只有该业务操作本身需要运行环境时，才按既有门禁检查当前连接。可用连接直接复用，401 只重新授权一次，403 立即停止，从未连接过运行环境时才进入环境选择。
 
 正在执行的部署、私有平台安装和授权流程继续使用启动时锁定的旧版本，自动升级不会插入这些流程。操作完成后会再次静默调度更新检查；检查进程有固定超时且不向用户输出远程 npx 命令。
 

package/SKILL.md

@@ -9,7 +9,7 @@ This is the single marketplace entry for the complete Rainskills product. The in
 
 ## Initialize
 
-1. Detect the current host client and map it to exactly one supported installer target: Codex=`codex` or Claude Code=`claude`. The macOS, Linux, and WSL installer intentionally does not support OpenClaw or Pi Agent; report that limitation instead of invoking an unsupported target. Do not ask the user which supported client they are currently using. If the host cannot be determined reliably, omit the target and let the installer ask.
+1. Detect the current host client and map it to exactly one supported installer target: Codex=`codex` or Claude Code=`claude`. The macOS, Linux, and WSL installer intentionally does not support OpenClaw; report that limitation instead of invoking an unsupported target. Do not ask the user which supported client they are currently using. If the host cannot be determined reliably, omit the target and let the installer ask.
 2. Resolve the directory containing this `SKILL.md`. On native Windows, if the adjacent `bin/rainskills.js` exists, run it by absolute path with the detected target in an attached interactive terminal: `node <skill-directory>/bin/rainskills.js <target>`. On macOS, Linux, or WSL, if the adjacent `install.sh` exists, run `bash <skill-directory>/install.sh <target>` the same way. Do not replace the installer with manual file copies.
 3. Keep stdin, stdout, and stderr attached. When `RAINSKILLS_USER_INPUT_REQUIRED` appears, pause for that installer choice. If the installer emits `rainskills.next-action.v1`, execute only its fixed `argv` through the same launcher; never evaluate output as a shell command. If the adjacent `bin/rainskills.js` exists, use it for fixed next actions; otherwise use the same versioned npm package fallback described below.
 4. Stay attached until every independent Skill is installed. Do not select, connect, or configure an application runtime during installation. In the user-facing response, output only the fixed completion message below.
@@ -38,7 +38,7 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 ## Manage Runtime Environments
 
-环境是全局列表，不是项目绑定。本地状态命令必须定位已安装的同级 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后通过 `node` 以 argv 数组执行；不得为了查询本地环境访问 npm。只有连接或安装环境时才使用与当前技能包一致的固定 launcher `npx --yes rainskills@0.1.6`。
+环境是全局列表，不是项目绑定。本地状态命令必须定位已安装的同级 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后通过 `node` 以 argv 数组执行；不得为了查询本地环境访问 npm。只有连接或安装环境时才使用与当前技能包一致的固定 launcher `npx --yes rainskills@0.1.8-rc.2`。
 
 - 列表：用本地 launcher 执行 `environment list --json`，只展示名称、类型、状态、是否默认和最近验证时间。
 - 重命名：用本地 launcher 执行 `environment rename --environment-id <uuid> --name <name>`。

package/bin/rainskills-tools.js

@@ -20,7 +20,12 @@ const CREDENTIALS_FILENAME = "credentials.env";
 const LEGACY_CREDENTIALS_FILENAME = "mcp.env";
 const CATALOG_FILENAME = "capabilities.json";
 const OPERATIONS_DIRECTORY = "operations";
+const SKILL_MANIFEST_FILENAME = "rainskills-skill-manifest.json";
 const OPERATION_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9-]{27,}$/;
+const SKILL_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const SKILL_CONTENT_MAX_BYTES = 128 * 1024;
+const SKILL_MANIFEST_MAX_BYTES = 4 * 1024 * 1024;
 const SENSITIVE_RESPONSE_KEY_PATTERN = /(?:authorization|jwt|token|password|secret|credential|private[_-]?key|key[_-]?file|certificate|cert[_-]?file|ssl[_-]?ca[_-]?cert)/i;
 const RISK_POLICY = Object.freeze({
   version: "1",
@@ -102,7 +107,72 @@ function readPrivateEnvFile(configPath) {
   }
 }
 
-function loadConfig({ env = process.env, homeDir = os.homedir(), includeRuntime = false } = {}) {
+function requireRuntimeModule(filename) {
+  const candidates = [
+    path.resolve(__dirname, "..", "rainbond-platform-installer", "scripts", filename),
+    path.resolve(__dirname, "..", "lib", "rainbond-platform-installer", "scripts", filename),
+  ];
+  for (const candidate of candidates) {
+    try {
+      const info = fs.lstatSync(candidate);
+      if (info.isFile() && !info.isSymbolicLink()) return require(candidate);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  throw new BridgeError("installed Rainskills CLI runtime is incomplete", EXIT.CONFIG);
+}
+
+function loadOperationConfig({ homeDir, operationId, includeRuntime }) {
+  let operationStore;
+  const { createEnvironmentRegistry } = requireRuntimeModule("environment-registry.js");
+  const { createEnvironmentCredentialStore } = requireRuntimeModule("environment-credentials.js");
+  const { createRuntimeOperationStore } = requireRuntimeModule("runtime-operations.js");
+  const registry = createEnvironmentRegistry({
+    home: homeDir,
+    activeOperationIds: (environmentId) => operationStore?.activeOperationIds(environmentId) || [],
+  });
+  operationStore = createRuntimeOperationStore({ home: homeDir, registry });
+  const operation = operationStore.read(operationId);
+  if (!operation || !["active", "interrupted"].includes(operation.stage)) {
+    throw new BridgeError("protected runtime operation is missing or inactive", EXIT.CONFIG);
+  }
+  const environment = registry.get(operation.environment_id);
+  if (!environment || environment.connection_state !== "connected") {
+    throw new BridgeError("the operation environment is unavailable", EXIT.CONFIG);
+  }
+  const credential = createEnvironmentCredentialStore({ home: homeDir }).read({
+    environmentId: environment.id,
+    expectedOrigin: environment.console_origin,
+  });
+  const parsed = new URL(environment.console_origin);
+  const { INTENT_DEFINITIONS } = requireRuntimeModule("runtime-intents.js");
+  const requiredSkillId = INTENT_DEFINITIONS[operation.intent.type]?.skillId;
+  if (!requiredSkillId) {
+    throw new BridgeError("the protected runtime intent has no Skill binding", EXIT.CONFIG);
+  }
+  return {
+    baseUrl: environment.console_origin,
+    jwt: credential.token,
+    operationId: operation.operation_id,
+    environmentId: environment.id,
+    intent: operation.intent,
+    requiredSkillId,
+    ...(includeRuntime ? {
+      homeDir,
+      allowInsecureHttp: parsed.protocol === "http:",
+      isInsecureHttp: parsed.protocol === "http:",
+    } : {}),
+  };
+}
+
+function loadConfig({
+  env = process.env,
+  homeDir = os.homedir(),
+  includeRuntime = false,
+  operationId,
+} = {}) {
+  if (operationId) return loadOperationConfig({ homeDir, operationId, includeRuntime });
   const configDirectory = path.join(homeDir, CONFIG_DIRECTORY);
   const credentialsPath = path.join(configDirectory, CREDENTIALS_FILENAME);
   const legacyCredentialsPath = path.join(configDirectory, LEGACY_CREDENTIALS_FILENAME);
@@ -149,24 +219,50 @@ function loadConfig({ env = process.env, homeDir = os.homedir(), includeRuntime
 }
 
 function parseCommand(args) {
-  const command = args[0];
-  if (command === "status" && args.length === 1) return { command };
+  const operationIndex = args.indexOf("--operation-id");
+  if (
+    operationIndex < 0
+    || !OPERATION_ID_PATTERN.test(args[operationIndex + 1] || "")
+    || args.indexOf("--operation-id", operationIndex + 1) !== -1
+  ) {
+    throw new BridgeError("every tools command requires --operation-id <uuid>", EXIT.USAGE);
+  }
+  const operationId = args[operationIndex + 1];
+  const remaining = [
+    ...args.slice(0, operationIndex),
+    ...args.slice(operationIndex + 2),
+  ];
+  const command = remaining[0];
+  if (command === "status" && remaining.length === 1) return { command, operationId };
   if (command === "list") {
-    if (args.length === 1) return { command };
-    if (args.length === 3 && args[1] === "--prefix" && args[2]) {
-      return { command, prefix: args[2] };
+    if (remaining.length === 1) return { command, operationId };
+    if (remaining.length === 3 && remaining[1] === "--prefix" && remaining[2]) {
+      return { command, prefix: remaining[2], operationId };
     }
   }
-  if (command === "describe" && args.length === 2 && args[1]) {
-    return { command, toolName: args[1] };
-  }
-  if (command === "read" && args.length === 4 && args[1] && args[2] === "--input" && args[3] === "-") {
-    return { command, toolName: args[1], input: args[3] };
-  }
-  if (command === "call" && args.length >= 4 && args[1] && args[2] === "--input" && args[3] === "-") {
-    if (args.length === 4) return { command, toolName: args[1], input: args[3] };
-    if (args.length === 6 && args[4] === "--confirm" && OPERATION_ID_PATTERN.test(args[5])) {
-      return { command, toolName: args[1], input: args[3], confirmation: args[5] };
+  if (command === "describe" && remaining.length === 2 && remaining[1]) {
+    return { command, toolName: remaining[1], operationId };
+  }
+  if (command === "read" && remaining.length === 4 && remaining[1] && remaining[2] === "--input" && remaining[3] === "-") {
+    return { command, toolName: remaining[1], input: remaining[3], operationId };
+  }
+  if (command === "call" && remaining.length >= 4 && remaining[1] && remaining[2] === "--input" && remaining[3] === "-") {
+    const parsed = { command, toolName: remaining[1], input: remaining[3], operationId };
+    const allowed = new Set(["--confirm", "--skill-id", "--root-skill-id"]);
+    for (let index = 4; index < remaining.length; index += 2) {
+      const option = remaining[index];
+      const value = remaining[index + 1];
+      if (!allowed.has(option) || !value || value.startsWith("--")) break;
+      if (option === "--confirm" && !parsed.confirmation && OPERATION_ID_PATTERN.test(value)) {
+        parsed.confirmation = value;
+      } else if (option === "--skill-id" && !parsed.skillId && SKILL_ID_PATTERN.test(value)) {
+        parsed.skillId = value;
+      } else if (option === "--root-skill-id" && !parsed.rootSkillId && SKILL_ID_PATTERN.test(value)) {
+        parsed.rootSkillId = value;
+      } else {
+        break;
+      }
+      if (index + 2 === remaining.length) return parsed;
     }
   }
   throw new BridgeError("invalid command; use status, list, describe, read, or call", EXIT.USAGE);
@@ -233,6 +329,62 @@ function operationsPath(config) {
   return path.join(config.homeDir || os.homedir(), CONFIG_DIRECTORY, OPERATIONS_DIRECTORY);
 }
 
+function skillManifestPath(config) {
+  return path.join(config.homeDir || os.homedir(), CONFIG_DIRECTORY, "bin", SKILL_MANIFEST_FILENAME);
+}
+
+function loadSkillBinding(config, skillId, rootSkillId) {
+  if (skillId !== config.requiredSkillId) {
+    throw new BridgeError("Skill does not match the protected runtime operation intent", EXIT.CONFIG);
+  }
+  const target = skillManifestPath(config);
+  let manifest;
+  try {
+    const info = fs.lstatSync(target);
+    if (
+      !info.isFile()
+      || info.isSymbolicLink()
+      || (process.platform !== "win32" && (info.mode & 0o077) !== 0)
+      || info.size > SKILL_MANIFEST_MAX_BYTES
+    ) throw new Error("unsafe manifest");
+    manifest = JSON.parse(fs.readFileSync(target, "utf8"));
+  } catch (_error) {
+    throw new BridgeError("RainSkills Skill manifest is missing or unsafe", EXIT.CONFIG);
+  }
+  if (
+    !manifest
+    || manifest.schema !== "rainskills.skill-manifest.v1"
+    || manifest.profile !== "cli"
+    || typeof manifest.package_version !== "string"
+    || !manifest.package_version
+    || !Array.isArray(manifest.skills)
+  ) {
+    throw new BridgeError("RainSkills Skill manifest schema is incompatible", EXIT.CONFIG);
+  }
+  const entry = manifest.skills.find((candidate) => candidate && candidate.id === skillId);
+  if (
+    !entry
+    || entry.profile !== "cli"
+    || entry.package_version !== manifest.package_version
+    || typeof entry.content !== "string"
+    || Buffer.byteLength(entry.content, "utf8") > SKILL_CONTENT_MAX_BYTES
+    || !SHA256_PATTERN.test(entry.content_sha256)
+    || !SHA256_PATTERN.test(entry.bundle_sha256)
+    || createHash("sha256").update(entry.content, "utf8").digest("hex") !== entry.content_sha256
+  ) {
+    throw new BridgeError("RainSkills Skill manifest entry is invalid", EXIT.CONFIG);
+  }
+  return {
+    skillId,
+    rootSkillId: rootSkillId || skillId,
+    packageVersion: entry.package_version,
+    sourceRevision: entry.source_revision || null,
+    contentSha256: entry.content_sha256,
+    bundleSha256: entry.bundle_sha256,
+    content: entry.content,
+  };
+}
+
 function classifyTool(toolName) {
   const normalized = String(toolName || "").toLowerCase();
   if (RISK_POLICY.destructiveFragments.some((fragment) => normalized.includes(fragment))) {
@@ -298,13 +450,20 @@ function readOperation(config, operationId) {
   }
 }
 
-function prepareOperation(config, toolName, operationClass, argumentsValue) {
+function prepareOperation(config, toolName, operationClass, argumentsValue, skillBinding) {
   const operationId = randomUUID();
   const record = {
     operation_id: operationId,
     tool_name: toolName,
     operation_class: operationClass,
     arguments_digest: argumentsDigest(argumentsValue),
+    runtime_operation_id: config.operationId,
+    skill_id: skillBinding.skillId,
+    root_skill_id: skillBinding.rootSkillId,
+    skill_package_version: skillBinding.packageVersion,
+    skill_source_revision: skillBinding.sourceRevision,
+    skill_content_sha256: skillBinding.contentSha256,
+    skill_bundle_sha256: skillBinding.bundleSha256,
     policy_version: RISK_POLICY.version,
     created_at: new Date().toISOString(),
     status: "awaiting_confirmation",
@@ -318,12 +477,19 @@ function confirmOperation(
   operationId,
   toolName,
   operationClass,
-  argumentsValue
+  argumentsValue,
+  skillBinding
 ) {
   const record = readOperation(config, operationId);
   if (!record || record.status !== "awaiting_confirmation" || record.tool_name !== toolName ||
     record.operation_class !== operationClass ||
-    record.arguments_digest !== argumentsDigest(argumentsValue)) {
+    record.arguments_digest !== argumentsDigest(argumentsValue) ||
+    record.runtime_operation_id !== config.operationId ||
+    record.skill_id !== skillBinding.skillId ||
+    record.root_skill_id !== skillBinding.rootSkillId ||
+    record.skill_package_version !== skillBinding.packageVersion ||
+    record.skill_content_sha256 !== skillBinding.contentSha256 ||
+    record.skill_bundle_sha256 !== skillBinding.bundleSha256) {
     throw new BridgeError("operation confirmation is missing or does not match this tool", EXIT.USAGE);
   }
   let claim;
@@ -339,6 +505,26 @@ function confirmOperation(
   return record;
 }
 
+function buildAuditMetadata(operation, skillBinding) {
+  return {
+    schema: "rainskills.operation-meta.v1",
+    operation_id: operation.operation_id,
+    runtime_operation_id: operation.runtime_operation_id,
+    cli_version: CLI_VERSION,
+    confirmation_type: "rainskills_cli",
+    root_skill_id: skillBinding.rootSkillId,
+    skill: {
+      id: skillBinding.skillId,
+      profile: "cli",
+      package_version: skillBinding.packageVersion,
+      source_revision: skillBinding.sourceRevision,
+      content_sha256: skillBinding.contentSha256,
+      bundle_sha256: skillBinding.bundleSha256,
+      content: skillBinding.content,
+    },
+  };
+}
+
 function updateOperation(config, record, status) {
   writeOperation(config, { ...record, status, updated_at: new Date().toISOString() });
 }
@@ -581,6 +767,8 @@ async function execute(command, config) {
     return {
       status: "ok",
       cli_version: CLI_VERSION,
+      operation_id: config.operationId,
+      environment_id: config.environmentId,
       tool_count: tools.length,
       catalog_age_ms: cached ? Math.max(0, Math.round(cached.age)) : 0,
     };
@@ -611,17 +799,23 @@ async function execute(command, config) {
   }
   const argumentsValue = command.argumentsValue || readArguments(command.input);
   let operation = null;
+  let skillBinding = null;
   if (operationClass !== "read") {
+    if (!command.skillId) {
+      throw new BridgeError("mutable calls require --skill-id <active-skill-id>", EXIT.USAGE);
+    }
+    skillBinding = loadSkillBinding(config, command.skillId, command.rootSkillId);
     if (!command.confirmation) {
       operation = prepareOperation(
         config,
         command.toolName,
         operationClass,
-        argumentsValue
+        argumentsValue,
+        skillBinding
       );
       return {
         requires_confirmation: true,
-        operation_id: operation.operation_id,
+        confirmation_id: operation.operation_id,
         operation_class: operation.operation_class,
         summary: "Review the target and repeat this exact call with --confirm <operation_id> to execute it once.",
       };
@@ -631,15 +825,22 @@ async function execute(command, config) {
       command.confirmation,
       command.toolName,
       operationClass,
-      argumentsValue
+      argumentsValue,
+      skillBinding
     );
   }
 
   try {
-    const result = await rpcRequest(config, "tools/call", {
+    const params = {
       name: command.toolName,
       arguments: argumentsValue,
-    });
+    };
+    if (operation) {
+      params._meta = {
+        "com.rainbond/rainskills": buildAuditMetadata(operation, skillBinding),
+      };
+    }
+    const result = await rpcRequest(config, "tools/call", params);
     if (!result || typeof result !== "object") {
       throw new BridgeError("Rainbond tool result is invalid", EXIT.TRANSPORT);
     }
@@ -677,7 +878,10 @@ async function main(args = process.argv.slice(2)) {
       command.argumentsValue = argumentsValue;
       argumentRedactions = collectArgumentRedactions(argumentsValue);
     }
-    config = loadConfig({ includeRuntime: true });
+    config = loadConfig({
+      includeRuntime: true,
+      operationId: command.operationId,
+    });
     if (config.isInsecureHttp) {
       process.stderr.write('{"warning":"using insecure HTTP transport"}\n');
     }

package/bin/rainskills.js

@@ -332,39 +332,6 @@ function parseOperationBeginArgs(args) {
   return { operationId, environmentId: environmentId || undefined, intent };
 }
 
-function parseMcpServeArgs(args) {
-  if (
-    args.length !== 4
-    || args[0] !== "mcp"
-    || args[1] !== "serve"
-    || args[2] !== "--client"
-    || !["codex", "claude", "pi", "generic"].includes(args[3])
-  ) {
-    throw new Error("mcp serve 参数无效");
-  }
-  return { client: args[3] };
-}
-
-async function defaultMcpServerRunner({
-  environmentRegistry,
-  environmentCredentialStore,
-  operationStore,
-}) {
-  const { createMcpRouter } = require(
-    "../rainbond-platform-installer/scripts/mcp-router.js"
-  );
-  const { serveStdio } = require(
-    "../rainbond-platform-installer/scripts/mcp-server.js"
-  );
-  return serveStdio({
-    router: createMcpRouter({
-      registry: environmentRegistry,
-      credentialStore: environmentCredentialStore,
-      operationStore,
-    }),
-  });
-}
-
 function runAttached(executable, args, { env = process.env } = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(executable, args, { env, stdio: "inherit" });
@@ -434,7 +401,6 @@ async function runBuiltin(args, {
   credentialEnvironment = process.env,
   credentialPersister,
   connectedCredentialReader,
-  mcpServerRunner = defaultMcpServerRunner,
 } = {}) {
   let environmentServices;
   const getEnvironmentServices = () => {
@@ -457,17 +423,6 @@ async function runBuiltin(args, {
     ).createRuntimeStateManager(operationScoped ? { operationId } : {});
   };
 
-  if (args[0] === "mcp" && args[1] === "serve") {
-    const { client } = parseMcpServeArgs(args);
-    await mcpServerRunner({
-      client,
-      environmentRegistry: getEnvironmentRegistry(),
-      environmentCredentialStore: getEnvironmentCredentialStore(),
-      operationStore: getOperationStore(),
-    });
-    return true;
-  }
-
   if (args[0] === "environment" && args[1] === "list") {
     if (args.length !== 3 || args[2] !== "--json") {
       throw new Error("environment list 只支持固定参数 --json");
@@ -998,6 +953,10 @@ function resolveInvocation(args, {
     "windows-onboarding.js"
   );
 
+  if (args[0] === "mcp") {
+    throw new Error("Rainskills 不再提供本地 MCP 服务，请使用本地 CLI");
+  }
+
   if (args[0] === "tools") {
     return {
       executable: execPath,