rainskills 0.1.8-rc.2 → 0.1.9

package/README.md

@@ -1,6 +1,6 @@
 # Rainskills
 
-Rainskills 是一组面向应用识别、部署、排障和交付的 AI Skills，支持 Codex 和 Claude Code。用户在市场中只会看到一个 `Rainskills` 产品，安装后 10 个 `rainbond-*` Skill 仍会独立触发。
+Rainskills 是一组面向应用识别、部署、排障和交付的 AI Skills，支持 Codex、Claude Code 和 Pi Agent。用户在市场中只会看到一个 `Rainskills` 产品，安装后 10 个 `rainbond-*` Skill 仍会独立触发。
 
 ## 安装
 
@@ -41,7 +41,7 @@ Claude Code：
 /reload-plugins
 ```
 
-安装流程支持 Codex 和 Claude Code；macOS、Linux 和 WSL 不支持 OpenClaw 安装。不要手工复制 Skill、拼接凭据或修改 Agent 配置。
+安装流程支持 Codex、Claude Code 和 Pi Agent；Pi 与其他 Agent 共用同一组 Skills 和本地 Rainskills CLI，不再提供单独的 Pi MCP adapter。macOS、Linux 和 WSL 不支持 OpenClaw 安装。不要手工复制 Skill、拼接凭据或修改 Agent 配置。
 
 ## 安装完成时用户会看到什么
 
@@ -72,14 +72,14 @@ Rainskills 安装完成，下一条消息即可直接使用。
 固定 launcher 来自当前 `package.json` 版本：
 
 ```json
-["npx", "--yes", "rainskills@0.1.8-rc.2"]
+["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"]
 ```
 
 所有调用都把 launcher 与参数合并成 argv 数组后直接执行；不得使用 `rainskills@latest`，不得把参数拼成 shell 字符串。
 
 1. 执行 launcher + `["environment", "list", "--json"]`，先于项目扫描和任何 Rainbond 业务调用。未指定环境时只使用全局默认环境，默认不可用时停止，不自动回退。
 2. 每个请求生成独立 operation UUID，并执行 `operation begin`；显式环境只写入这次 operation。所有 Rainbond 查询和变更都通过 `~/.rainbond/bin/rainskills-tools.js`，并绑定返回的 operation ID。项目不保存环境、团队或应用绑定，同一项目可以部署到多个目标。
-3. 将动作转换为 `runtime-intents.js` 中对应的受限 intent 并完成字段校验。target 只允许 `codex`、`claude`、`all`；按用户选择构造 launcher + `["runtime", "connect", "<target>", ...环境参数, "--intent-json", "<JSON.stringify(已校验 intent)>"]`。
+3. 将动作转换为 `runtime-intents.js` 中对应的受限 intent 并完成字段校验。target 只允许 `codex`、`claude`、`pi`、`all`；按用户选择构造 launcher + `["runtime", "connect", "<target>", ...环境参数, "--intent-json", "<JSON.stringify(已校验 intent)>"]`。
 4. 环境参数必须恰好选择一组且互斥：Cloud 用 `["--saas"]`，已有私有环境用 `["--rainbond-url", "<已验证 Console origin>"]`，新建私有环境用 `["--install-private", "--location", "local"]` 或 `["--install-private", "--location", "server"]`。
 5. 安装私有环境时，只消费完成 schema、action、onboarding id 和参数边界校验的 `rainskills.next-action.v1.argv`；拒绝字符串命令和其他输出字段。
 6. 探针失败进入 reconnect。连接或安装完成后执行 launcher + `["intent", "resume", "--onboarding-id", "<同一 onboarding-id>"]`，恢复受保护的原始 intent 和 `resume_step`，不重新猜测用户动作。
@@ -192,21 +192,21 @@ Windows 本地安装是预览能力，也可以改选 Linux 服务器。它要
 
 ```bash
 # 本地单机
-npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
+node ~/.rainbond/lib/rainskills/bin/rainskills.js platform install --onboarding-id <id> \
   --location local --mode single-node
 
 # Linux 服务器单机
-npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
+node ~/.rainbond/lib/rainskills/bin/rainskills.js platform install --onboarding-id <id> \
   --location server --mode single-node --ssh <user@host>
 
 # 服务器主机集群（自动生成受保护示例文件）
-npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
+node ~/.rainbond/lib/rainskills/bin/rainskills.js platform install --onboarding-id <id> \
   --location server --mode host-cluster
 
 # 已有高级 ROI cluster.yaml 才追加：--cluster-config <path>
 
 # 已有 Kubernetes
-npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
+node ~/.rainbond/lib/rainskills/bin/rainskills.js platform install --onboarding-id <id> \
   --location server --mode existing-kubernetes \
   --kubeconfig <path> --kube-context <name> --chart-version <version>
 ```
@@ -228,7 +228,7 @@ npx --yes rainskills@0.1.8-rc.2 platform install --onboarding-id <id> \
 
 Rainskills 会在用户下一次发起业务动作时，由本地运行时立即返回环境查询结果，并另行启动后台任务静默检查更新。更新只跟随 npm `latest` 指向的正式版。当前版本是 RC 或其他预发布版本时不会查询、不会自动升级；npm 上的新 RC 版本也不参与正式版自动升级。
 
-发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.8-rc.2`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
+发现更高的正式版后，后台任务只委托到经过校验的精确版本，例如 `rainskills@0.1.9`，不会执行浮动的 `@latest` 业务代码。新版本原子刷新已经安装的 Rainskills Skills；当前业务继续使用启动时已经加载的版本，最迟从下一条新任务开始使用新版。npm 超时、版本检查失败、安装位置不安全或文件迁移失败时会保留旧版本，且不会阻塞或改变当前操作。
 
 升级只更新 Rainskills 自身，不触发 Rainbond 安装、运行环境选择、登录授权或重新对接，也不会新增 Agent MCP 配置。更新内容仅包括 Skills 和本地 CLI。原始业务操作会继续执行；只有该业务操作本身需要运行环境时，才按既有门禁检查当前连接。可用连接直接复用，401 只重新授权一次，403 立即停止，从未连接过运行环境时才进入环境选择。
 

package/SKILL.md

@@ -9,7 +9,7 @@ This is the single marketplace entry for the complete Rainskills product. The in
 
 ## Initialize
 
-1. Detect the current host client and map it to exactly one supported installer target: Codex=`codex` or Claude Code=`claude`. The macOS, Linux, and WSL installer intentionally does not support OpenClaw; report that limitation instead of invoking an unsupported target. Do not ask the user which supported client they are currently using. If the host cannot be determined reliably, omit the target and let the installer ask.
+1. Detect the current host client and map it to exactly one supported installer target: Codex=`codex`, Claude Code=`claude`, or Pi Agent=`pi`. All three use the same installed Skills and protected local Rainskills CLI; Pi has no separate MCP adapter or generated extension. The macOS, Linux, and WSL installer intentionally does not support OpenClaw; report that limitation instead of invoking an unsupported target. Do not ask the user which supported client they are currently using. If the host cannot be determined reliably, omit the target and let the installer ask.
 2. Resolve the directory containing this `SKILL.md`. On native Windows, if the adjacent `bin/rainskills.js` exists, run it by absolute path with the detected target in an attached interactive terminal: `node <skill-directory>/bin/rainskills.js <target>`. On macOS, Linux, or WSL, if the adjacent `install.sh` exists, run `bash <skill-directory>/install.sh <target>` the same way. Do not replace the installer with manual file copies.
 3. Keep stdin, stdout, and stderr attached. When `RAINSKILLS_USER_INPUT_REQUIRED` appears, pause for that installer choice. If the installer emits `rainskills.next-action.v1`, execute only its fixed `argv` through the same launcher; never evaluate output as a shell command. If the adjacent `bin/rainskills.js` exists, use it for fixed next actions; otherwise use the same versioned npm package fallback described below.
 4. Stay attached until every independent Skill is installed. Do not select, connect, or configure an application runtime during installation. In the user-facing response, output only the fixed completion message below.
@@ -38,7 +38,7 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 ## Manage Runtime Environments
 
-环境是全局列表，不是项目绑定。本地状态命令必须定位已安装的同级 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后通过 `node` 以 argv 数组执行；不得为了查询本地环境访问 npm。只有连接或安装环境时才使用与当前技能包一致的固定 launcher `npx --yes rainskills@0.1.8-rc.2`。
+环境是全局列表，不是项目绑定。本地状态命令必须定位已安装的同级 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后通过 `node` 以 argv 数组执行；不得为了查询本地环境访问 npm。只有连接或安装环境时才使用与当前技能包一致的固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.9`）。
 
 - 列表：用本地 launcher 执行 `environment list --json`，只展示名称、类型、状态、是否默认和最近验证时间。
 - 重命名：用本地 launcher 执行 `environment rename --environment-id <uuid> --name <name>`。

package/bin/rainskills-tools.js

@@ -110,6 +110,7 @@ function readPrivateEnvFile(configPath) {
 function requireRuntimeModule(filename) {
   const candidates = [
     path.resolve(__dirname, "..", "rainbond-platform-installer", "scripts", filename),
+    path.resolve(__dirname, "..", "lib", "rainskills", "rainbond-platform-installer", "scripts", filename),
     path.resolve(__dirname, "..", "lib", "rainbond-platform-installer", "scripts", filename),
   ];
   for (const candidate of candidates) {
@@ -509,7 +510,6 @@ function buildAuditMetadata(operation, skillBinding) {
   return {
     schema: "rainskills.operation-meta.v1",
     operation_id: operation.operation_id,
-    runtime_operation_id: operation.runtime_operation_id,
     cli_version: CLI_VERSION,
     confirmation_type: "rainskills_cli",
     root_skill_id: skillBinding.rootSkillId,
@@ -578,15 +578,23 @@ function fitOutput(value) {
   };
 }
 
-function sanitizeToolResult(value) {
-  if (Array.isArray(value)) return value.map(sanitizeToolResult);
+function sanitizeToolResult(value, pathParts = []) {
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeToolResult(item, pathParts));
+  }
   if (!value || typeof value !== "object") return value;
   const safe = {};
   for (const [key, item] of Object.entries(value)) {
     // Console destructive operations may return this one-time control value.
     // It is not a credential and must remain available for the confirmation flow.
-    if (key !== "confirmation_token" && SENSITIVE_RESPONSE_KEY_PATTERN.test(key)) continue;
-    safe[key] = sanitizeToolResult(item);
+    const isPackageUploadAuthMode = key === "authorization"
+      && item === "none"
+      && pathParts.length === 1
+      && pathParts[0] === "upload_request";
+    if (key !== "confirmation_token"
+      && !isPackageUploadAuthMode
+      && SENSITIVE_RESPONSE_KEY_PATTERN.test(key)) continue;
+    safe[key] = sanitizeToolResult(item, [...pathParts, key]);
   }
   return safe;
 }
@@ -623,17 +631,12 @@ function safeJson(value, secrets = []) {
   return output;
 }
 
-function rpcRequest(config, method, params = {}, {
+function httpJsonRpcRequest(config, endpointPath, message, {
   timeoutMs = REQUEST_TIMEOUT_MS,
   maxResponseBytes = RESPONSE_MAX_BYTES,
 } = {}) {
-  const endpoint = new URL(`${config.baseUrl.replace(/\/+$/, "")}${ENDPOINT_PATH}`);
-  const payload = JSON.stringify({
-    jsonrpc: "2.0",
-    id: 1,
-    method,
-    params,
-  });
+  const endpoint = new URL(`${config.baseUrl.replace(/\/+$/, "")}${endpointPath}`);
+  const payload = JSON.stringify(message);
   const client = endpoint.protocol === "https:" ? https : http;
 
   return new Promise((resolve, reject) => {
@@ -694,47 +697,11 @@ function rpcRequest(config, method, params = {}, {
           return;
         }
         const body = Buffer.concat(chunks, responseBytes).toString("utf8");
-        if (response.statusCode === 401 || response.statusCode === 403) {
-          fail(new BridgeError("Rainbond authentication failed", EXIT.CONFIG));
-          return;
-        }
-        if (!response.statusCode || response.statusCode < 200 || response.statusCode >= 300) {
-          fail(new BridgeError(
-            response.statusCode === 404
-              ? "Rainskills API endpoint is unavailable; upgrade Rainbond Console"
-              : "Rainbond API request failed",
-            EXIT.TRANSPORT
-          ));
-          return;
-        }
-        let rpc;
-        try {
-          rpc = JSON.parse(body);
-        } catch (_error) {
-          fail(new BridgeError("Rainbond returned invalid JSON", EXIT.TRANSPORT));
-          return;
-        }
-        if (!rpc || rpc.jsonrpc !== "2.0" || rpc.id !== 1) {
-          fail(new BridgeError("Rainbond returned an invalid JSON-RPC response", EXIT.TRANSPORT));
-          return;
-        }
-        if (rpc.error) {
-          const protocolErrors = new Set([-32700, -32600, -32601]);
-          fail(new BridgeError(
-            "Rainbond rejected the tool request",
-            protocolErrors.has(rpc.error.code) ? EXIT.TRANSPORT : EXIT.TOOL,
-            {
-            code: rpc.error.code,
-            message: rpc.error.message,
-            }
-          ));
-          return;
-        }
-        if (!("result" in rpc)) {
-          fail(new BridgeError("Rainbond JSON-RPC result is missing", EXIT.TRANSPORT));
-          return;
-        }
-        settle(resolve, rpc.result);
+        settle(resolve, {
+          statusCode: response.statusCode || 0,
+          headers: response.headers,
+          body,
+        });
       });
     });
     request.on("error", (error) => {
@@ -749,6 +716,95 @@ function rpcRequest(config, method, params = {}, {
   });
 }
 
+function parseJsonRpcBody(body, expectedId, { allowEmpty = false, contentType = "" } = {}) {
+  if (!body.trim() && allowEmpty) return null;
+  let serialized = body;
+  if (contentType.toLowerCase().includes("text/event-stream")) {
+    const data = body.split(/\r?\n/)
+      .filter((line) => line.startsWith("data:"))
+      .map((line) => line.slice(5).trim())
+      .filter(Boolean)
+      .at(-1);
+    if (!data) throw new BridgeError("Rainbond returned invalid MCP event data", EXIT.TRANSPORT);
+    serialized = data;
+  }
+  let rpc;
+  try {
+    rpc = JSON.parse(serialized);
+  } catch (_error) {
+    throw new BridgeError("Rainbond returned invalid JSON", EXIT.TRANSPORT);
+  }
+  if (!rpc || rpc.jsonrpc !== "2.0" || (expectedId !== undefined && rpc.id !== expectedId)) {
+    throw new BridgeError("Rainbond returned an invalid JSON-RPC response", EXIT.TRANSPORT);
+  }
+  if (rpc.error) {
+    const protocolErrors = new Set([-32700, -32600, -32601]);
+    throw new BridgeError(
+      "Rainbond rejected the tool request",
+      protocolErrors.has(rpc.error.code) ? EXIT.TRANSPORT : EXIT.TOOL,
+      { code: rpc.error.code, message: rpc.error.message }
+    );
+  }
+  if (!("result" in rpc)) {
+    throw new BridgeError("Rainbond JSON-RPC result is missing", EXIT.TRANSPORT);
+  }
+  return rpc.result;
+}
+
+function assertRpcHttpSuccess(response, { endpointUnavailable = false } = {}) {
+  if (response.statusCode === 401 || response.statusCode === 403) {
+    throw new BridgeError("Rainbond authentication failed", EXIT.CONFIG);
+  }
+  if (response.statusCode < 200 || response.statusCode >= 300) {
+    throw new BridgeError(
+      endpointUnavailable && response.statusCode === 404
+        ? "Rainskills API endpoint is unavailable; upgrade Rainbond Console"
+        : "Rainbond API request failed",
+      EXIT.TRANSPORT
+    );
+  }
+}
+
+function isVerifiedMissingRpcRoute(response) {
+  if (response.statusCode !== 404) return false;
+  const contentType = String(response.headers["content-type"] || "").toLowerCase();
+  const body = response.body.trim();
+  if (contentType.includes("text/plain")) return body === "Not Found";
+  if (contentType.includes("text/html")) {
+    const normalized = body.toLowerCase();
+    return normalized.includes("<title") && normalized.includes("not found");
+  }
+  if (!contentType.includes("json")) return false;
+  try {
+    const payload = JSON.parse(body);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    if (["Not Found", "not found"].includes(payload.detail)) return true;
+    return ["code", "status", "status_code", "error_code"]
+      .some((key) => payload[key] === 404 || payload[key] === "404");
+  } catch {
+    return false;
+  }
+}
+
+async function rpcRequest(config, method, params = {}, options = {}) {
+  const response = await httpJsonRpcRequest(config, ENDPOINT_PATH, {
+    jsonrpc: "2.0",
+    id: 1,
+    method,
+    params,
+  }, options);
+  if (isVerifiedMissingRpcRoute(response)) {
+    throw new BridgeError(
+      "当前 Rainbond 版本不支持 Rainskills CLI，请先将 Rainbond 升级到 v6.9.9 或更高版本",
+      EXIT.TRANSPORT
+    );
+  }
+  assertRpcHttpSuccess(response);
+  return parseJsonRpcBody(response.body, 1, {
+    contentType: String(response.headers["content-type"] || ""),
+  });
+}
+
 async function listTools(config) {
   const cached = loadCachedCatalog(config);
   if (cached) return cached.tools;

package/bin/rainskills.js

@@ -80,7 +80,7 @@ function parseRuntimeAssertConnectArgs(args) {
     throw new Error("runtime connect 内部门禁参数无效");
   }
   if (!UUID_PATTERN.test(args[3] || "")) throw new Error("runtime connect operation 无效");
-  if (!["codex", "claude", "all"].includes(args[5])) throw new Error("runtime connect target 无效");
+  if (!["codex", "claude", "pi", "all"].includes(args[5])) throw new Error("runtime connect target 无效");
   if (!["saas", "private"].includes(args[7])) throw new Error("runtime connect environment kind 无效");
   return {
     operationId: args[3],
@@ -122,8 +122,8 @@ function parseRuntimeConnectArgs(args) {
     throw new Error("不是 runtime connect 命令");
   }
   const targetClient = args[2];
-  if (!["codex", "claude", "all"].includes(targetClient)) {
-    throw new Error("runtime connect 需要固定目标 codex、claude 或 all");
+  if (!["codex", "claude", "pi", "all"].includes(targetClient)) {
+    throw new Error("runtime connect 需要固定目标 codex、claude、pi 或 all");
   }
   let environmentChoice = "";
   let rainbondUrl = "";

package/install.sh

@@ -204,6 +204,7 @@ Usage:
   ./install.sh
   ./install.sh claude
   ./install.sh codex
+  ./install.sh pi
   ./install.sh all
   ./install.sh --dest <path>
   ./install.sh all --saas
@@ -214,7 +215,8 @@ Usage:
 Options:
   claude                 Install and configure Claude Code
   codex                  Install and configure Codex
-  all                    Install and configure Codex and Claude Code
+  pi                     Install and configure Pi Agent
+  all                    Install and configure Codex, Claude Code, and Pi Agent
   refresh                Re-run browser login and refresh the protected CLI credential
   --dest PATH            Install skills to a custom directory only
   --force                Overwrite existing installed skills
@@ -293,6 +295,9 @@ rainskills_install_client_for_target() {
     claude)
       printf 'claude_code\n'
       ;;
+    pi)
+      printf 'pi\n'
+      ;;
     all)
       printf 'all\n'
       ;;
@@ -456,7 +461,7 @@ event = {
     "platform": platform,
     "control_mode": control_mode,
     "target": target,
-    "client": client if client in {"codex", "claude_code", "both", "unknown"} else "unknown",
+    "client": client if client in {"codex", "claude_code", "pi", "all", "both", "unknown"} else "unknown",
     "eid": eid or None,
     "phase": None,
     "lifecycle_phase": phase,
@@ -513,7 +518,7 @@ initialize_rainskills_installation_reporting() {
       connect)
         RAINSKILLS_INSTALL_ACTION="connect"
         ;;
-      codex|claude|all)
+      codex|claude|pi|all)
         target="$arg"
         ;;
     esac
@@ -811,12 +816,12 @@ parse_args() {
         ACTION="connect"
         shift
         ;;
-      claude|codex|all)
+      claude|codex|pi|all)
         TARGET="$1"
         shift
         ;;
       openclaw)
-        die "macOS/Linux 安装器不再支持 OpenClaw，请使用 Codex 或 Claude Code。"
+        die "macOS/Linux 安装器不再支持 OpenClaw，请使用 Codex、Claude Code 或 Pi Agent。"
         ;;
       --dest)
         [[ $# -ge 2 ]] || die "--dest 需要一个路径值"
@@ -904,7 +909,7 @@ assert_internal_connect_entry() {
   local target="" environment_kind="" console_origin="" mode=""
   while [[ $# -gt 0 ]]; do
     case "$1" in
-      codex|claude|all)
+      codex|claude|pi|all)
         [[ -z "$target" ]] || return 1
         target="$1"
         shift
@@ -1008,10 +1013,11 @@ resolve_target() {
   log "请选择要安装和配置的平台："
   log "  1) Codex"
   log "  2) Claude Code"
-  log "  3) 全部"
+  log "  3) Pi Agent"
+  log "  4) 全部"
 
   while true; do
-    printf '请输入选项 [1-3]: '
+    printf '请输入选项 [1-4]: '
     read -r choice
     case "$choice" in
       1)
@@ -1022,12 +1028,16 @@ resolve_target() {
         TARGET="claude"
         return 0
         ;;
-      3|"")
+      3)
+        TARGET="pi"
+        return 0
+        ;;
+      4|"")
         TARGET="all"
         return 0
         ;;
       *)
-        log "请输入 1、2 或 3。"
+        log "请输入 1、2、3 或 4。"
         ;;
     esac
   done
@@ -1046,9 +1056,13 @@ collect_destinations() {
       codex)
         destinations+=("$HOME/.codex/skills")
         ;;
+      pi)
+        destinations+=("$HOME/.pi/agent/skills")
+        ;;
       all)
         destinations+=("$HOME/.claude/skills")
         destinations+=("$HOME/.codex/skills")
+        destinations+=("$HOME/.pi/agent/skills")
         ;;
       *)
         die "未知安装目标：$TARGET"
@@ -2238,6 +2252,21 @@ PY
   log "[verify] Rainbond MCP 可访问"
 }
 
+validate_runtime_mcp_connectivity() {
+  local base_url="$1"
+  local token="$2"
+  local status
+  if validate_mcp_connectivity "${base_url}/console/mcp/rainskills/api/query" "$token"; then
+    return 0
+  else
+    status=$?
+  fi
+  if [[ "$status" -eq 2 ]]; then
+    die "当前 Rainbond 版本不支持 Rainskills CLI。请先将 Rainbond 升级到 v6.9.9 或更高版本，然后从当前任务继续。"
+  fi
+  return "$status"
+}
+
 looks_like_jwt() {
   # JWT compact form: header.payload.signature, three base64url segments.
   [[ "$1" =~ ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$ ]]
@@ -2469,14 +2498,13 @@ do_refresh() {
   base_url="$(normalize_rainbond_url "$base_url_input")"
   confirm_insecure_http_if_needed "$base_url"
 
-  local token cli_api_url
+  local token
   obtain_rainbond_token "$base_url" "$DEPLOYMENT_MODE_INPUT"
   token="$OBTAINED_RAINBOND_TOKEN"
-  cli_api_url="${base_url}/console/mcp/rainskills/api/query"
   record_rainskills_authorization "$base_url" "$token"
 
   set_rainskills_failure_context "verification" "mcp_verification_failed"
-  if ! validate_mcp_connectivity "$cli_api_url" "$token"; then
+  if ! validate_runtime_mcp_connectivity "$base_url" "$token"; then
     die "Rainbond CLI 接口校验失败。"
   fi
   token="$VALIDATED_TOKEN"
@@ -2547,15 +2575,14 @@ configure_runtime_connection() {
   base_url="$(normalize_rainbond_url "$base_url_input")"
   confirm_insecure_http_if_needed "$base_url"
 
-  local token cli_api_url
+  local token
   obtain_rainbond_token "$base_url" "$DEPLOYMENT_MODE_INPUT"
   token="$OBTAINED_RAINBOND_TOKEN"
   RAINSKILLS_INSTALL_CLIENT="$(rainskills_install_client_for_target "$TARGET")"
   record_rainskills_authorization "$base_url" "$token"
-  cli_api_url="${base_url}/console/mcp/rainskills/api/query"
 
   set_rainskills_failure_context "verification" "mcp_verification_failed"
-  if ! validate_mcp_connectivity "$cli_api_url" "$token"; then
+  if ! validate_runtime_mcp_connectivity "$base_url" "$token"; then
     die "Rainbond CLI 接口校验失败。"
   fi
   token="$VALIDATED_TOKEN"

package/marketplace/rainskills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.8-rc.2",
+  "version": "0.1.9",
   "description": "Install the complete Rainskills AI deployment skill suite as one product.",
   "author": {
     "name": "Goodrain",

package/marketplace/rainskills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rainskills",
-  "version": "0.1.8-rc.2",
+  "version": "0.1.9",
   "description": "Install the complete Rainskills AI deployment skill suite as one product.",
   "author": {
     "name": "Goodrain",

package/marketplace/rainskills/skills/rainskills/SKILL.md

@@ -9,12 +9,12 @@ This is the single marketplace entry for the complete Rainskills product. The in
 
 ## Initialize
 
-1. Detect the current host client and map it to exactly one supported installer target: Codex=`codex` or Claude Code=`claude`. The macOS, Linux, and WSL installer intentionally does not support OpenClaw; report that limitation instead of invoking an unsupported target. Do not ask the user which supported client they are currently using. If the host cannot be determined reliably, omit the target and let the installer ask.
+1. Detect the current host client and map it to exactly one supported installer target: Codex=`codex`, Claude Code=`claude`, or Pi Agent=`pi`. All three use the same installed Skills and protected local Rainskills CLI; Pi has no separate MCP adapter or generated extension. The macOS, Linux, and WSL installer intentionally does not support OpenClaw; report that limitation instead of invoking an unsupported target. Do not ask the user which supported client they are currently using. If the host cannot be determined reliably, omit the target and let the installer ask.
 2. Resolve the directory containing this `SKILL.md`. On native Windows, if the adjacent `bin/rainskills.js` exists, run it by absolute path with the detected target in an attached interactive terminal: `node <skill-directory>/bin/rainskills.js <target>`. On macOS, Linux, or WSL, if the adjacent `install.sh` exists, run `bash <skill-directory>/install.sh <target>` the same way. Do not replace the installer with manual file copies.
 3. Keep stdin, stdout, and stderr attached. When `RAINSKILLS_USER_INPUT_REQUIRED` appears, pause for that installer choice. If the installer emits `rainskills.next-action.v1`, execute only its fixed `argv` through the same launcher; never evaluate output as a shell command. If the adjacent `bin/rainskills.js` exists, use it for fixed next actions; otherwise use the same versioned npm package fallback described below.
 4. Stay attached until every independent Skill is installed. Do not select, connect, or configure an application runtime during installation. In the user-facing response, output only the fixed completion message below.
 
-If the adjacent installer is missing, check the local Node.js version before choosing the fallback. With `npx` and Node.js 18 or newer, use `npx --yes rainskills@0.1.8-rc.2 <target>`. With no Node.js or a version below 18, use `bash <(curl -fsSL https://get.rainbond.com/rainskills/install.sh) <target>` instead. Omit `<target>` only when the host cannot be determined reliably. Keep either command attached to the interactive terminal. For an update or repair, refresh this marketplace Skill first, then run the installer again; it compares and updates every independent internal Skill.
+If the adjacent installer is missing, check the local Node.js version before choosing the fallback. With `npx` and Node.js 18 or newer, use `npx --yes rainskills@0.1.9 <target>`. With no Node.js or a version below 18, use `bash <(curl -fsSL https://get.rainbond.com/rainskills/install.sh) <target>` instead. Omit `<target>` only when the host cannot be determined reliably. Keep either command attached to the interactive terminal. For an update or repair, refresh this marketplace Skill first, then run the installer again; it compares and updates every independent internal Skill.
 
 Skills-only 安装不需要 Node.js；CDN fallback 只负责安装 Skill 文件，不代表运行环境连接、应用部署或平台安装已经可执行。用户首次提出需要运行环境的动作时，对应业务 Skill 才检查 Node.js；固定 Rainskills launcher 需要 Node.js 18 或更高版本。缺失或版本过低时保留原始 intent 并停止，等待用户或 agent 明确同意安装或升级 Node.js，安装完成消息不得提前提示 Node.js。
 
@@ -38,7 +38,7 @@ Rainskills 安装完成，下一条消息即可直接使用。
 
 ## Manage Runtime Environments
 
-环境是全局列表，不是项目绑定。本地状态命令必须定位已安装的同级 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后通过 `node` 以 argv 数组执行；不得为了查询本地环境访问 npm。只有连接或安装环境时才使用与当前技能包一致的固定 launcher `npx --yes rainskills@0.1.8-rc.2`。
+环境是全局列表，不是项目绑定。本地状态命令必须定位已安装的同级 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后通过 `node` 以 argv 数组执行；不得为了查询本地环境访问 npm。只有连接或安装环境时才使用与当前技能包一致的固定 launcher `node <home>/.rainbond/lib/rainskills/bin/rainskills.js`（运行包版本 `rainskills@0.1.9`）。
 
 - 列表：用本地 launcher 执行 `environment list --json`，只展示名称、类型、状态、是否默认和最近验证时间。
 - 重命名：用本地 launcher 执行 `environment rename --environment-id <uuid> --name <name>`。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rainskills",
-  "version": "0.1.8-rc.2",
-  "description": "Interactive Rainbond skill installer for Codex and Claude Code",
+  "version": "0.1.9",
+  "description": "Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent",
   "license": "Apache-2.0",
   "homepage": "https://github.com/goodrain/rainskills#readme",
   "bugs": {

package/rainbond-app-assistant/SKILL.md

@@ -98,17 +98,20 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
 
   第一步检查 Node.js 是否存在且主版本不低于 18。Node.js 缺失或低于 18 时，只说明“Rainskills 执行组件需要 Node.js 18 或更高版本”并停止：不选择运行环境，不调用 MCP，不猜测替代命令。只有用户或 agent 明确同意后才安装或升级 Node.js，再从同一原始 intent 继续。
 
-  固定 launcher 是 `["npx", "--yes", "rainskills@0.1.8-rc.2"]`；版本必须与本技能包 `package.json` 一致。把 launcher 与参数拼成 argv 数组直接执行，禁止使用 `rainskills@latest`，禁止拼接或执行 shell 字符串。
+  固定 launcher 是 `["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"]`；运行包版本标记为 `rainskills@0.1.9`，且必须与本技能包 `package.json` 一致。把 launcher 与参数拼成 argv 数组直接执行，禁止使用 `rainskills@latest`，禁止拼接或执行 shell 字符串。
 
-  本地 launcher 必须从当前 Skill 所在目录的同级目录定位 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后使用 `["node", "<绝对路径>"]` 执行。`environment list`、`operation begin`、`operation complete` 和 `runtime message` 只能使用本地 launcher；本地 launcher 只读取已安装文件和本机受保护状态，不得访问 npm 或其它网络。只有用户选定连接或安装运行环境后，才使用上面的固定 npx launcher。
+  本地 launcher 必须从当前 Skill 所在目录的同级目录定位 `rainbond-platform-installer/scripts/local-runtime.js`，解析为绝对路径后使用 `["node", "<绝对路径>"]` 执行。`environment list`、`operation begin`、`operation complete` 和 `runtime message` 只能使用本地 launcher；本地 launcher 只读取已安装文件和本机受保护状态，不得访问 npm 或其它网络。只有用户选定连接或安装运行环境后，才使用上面的固定本地 launcher。
 
   所有 Rainbond 查询和变更必须通过本地 `~/.rainbond/bin/rainskills-tools.js` 执行，并绑定本次 operation ID。禁止 Agent 直接调用 Rainbond MCP，也不得启动本地 Rainskills MCP 服务；只允许执行 CLI 返回的结构化结果与确认续接 argv。
 
+  只有 CLI 返回并通过校验的 `rainskills.next-action.v1` argv 才能执行续接。普通失败一律禁止自动重试：不得再次执行原命令，不得执行 `--help`、`sleep`、`rg`、`grep`，不得搜索 Rainskills 源码；同一 `operation complete` 最多执行一次。
+
   <!-- rainskills-runtime-contract:start -->
   ```json
   {
     "schema": "rainskills.skill-runtime-contract.v1",
-    "launcher": ["npx", "--yes", "rainskills@0.1.8-rc.2"],
+    "package_version": "rainskills@0.1.9",
+    "launcher": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js"],
     "local_launcher": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js"],
     "local_argv": {
       "environment-list": ["node", "<installed-skills-root>/rainbond-platform-installer/scripts/local-runtime.js", "environment", "list", "--json"],
@@ -128,15 +131,15 @@ description: "Use whenever a user asks to deploy, run, deliver, publish, inspect
       "existing": ["saas", "private-existing"]
     },
     "connect_argv": {
-      "saas": ["npx", "--yes", "rainskills@0.1.8-rc.2", "runtime", "connect", "<target>", "--saas", "--intent-json", "<intent-json>"],
-      "private-existing": ["npx", "--yes", "rainskills@0.1.8-rc.2", "runtime", "connect", "<target>", "--rainbond-url", "<rainbond-url>", "--intent-json", "<intent-json>"],
-      "install-private": ["npx", "--yes", "rainskills@0.1.8-rc.2", "runtime", "connect", "<target>", "--install-private", "--location", "<private-location>", "--intent-json", "<intent-json>"]
+      "saas": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--saas", "--intent-json", "<intent-json>"],
+      "private-existing": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--rainbond-url", "<rainbond-url>", "--intent-json", "<intent-json>"],
+      "install-private": ["node", "<home>/.rainbond/lib/rainskills/bin/rainskills.js", "runtime", "connect", "<target>", "--install-private", "--location", "<private-location>", "--intent-json", "<intent-json>"]
     }
   }
   ```
   <!-- rainskills-runtime-contract:end -->
 
-  `deploy`/`create` 含 `service_id` 时属于 existing，否则属于 new；`query`、`troubleshoot`、`modify` 始终属于 existing。意图不明确时先澄清，不执行 connect。target 只允许 `codex`、`claude`、`all`。连接前校验 intent，只执行其 scope 在契约中允许的完整 argv。只消费 schema 为 `rainskills.next-action.v1` 且完成字段校验后的 `argv` 数组。
+  `deploy`/`create` 含 `service_id` 时属于 existing，否则属于 new；`query`、`troubleshoot`、`modify` 始终属于 existing。意图不明确时先澄清，不执行 connect。target 只允许 `codex`、`claude`、`pi`、`all`。连接前校验 intent，只执行其 scope 在契约中允许的完整 argv。只消费 schema 为 `rainskills.next-action.v1` 且完成字段校验后的 `argv` 数组。
 
   连接或平台安装完成后，用固定 `onboarding-id` 执行 launcher + `["intent", "resume", "--onboarding-id", "<同一 onboarding-id>"]`，恢复原始 intent 和 `resume_step`，不得重新猜测动作。