rovloom 0.4.0 → 0.6.0

package/dist/src/chunk-5b8g62kw.js

@@ -0,0 +1,438 @@
+// @bun
+// src/cli/messages.ts
+function prefersChinese(tag) {
+  return tag.split(".")[0].toLowerCase().replace(/_/gu, "-").startsWith("zh");
+}
+function resolveCliLanguage2(env) {
+  const explicit = env.ROVLOOM_LANG?.trim();
+  if (explicit) {
+    return prefersChinese(explicit) ? "zh-CN" : "en";
+  }
+  return "en";
+}
+var english = Object.freeze({
+  "help.main": `Rovloom {version}
+
+Usage:
+  rovloom --help
+  rovloom --version
+  rovloom config template gateway|connector
+  rovloom config init connector [--provider luvus|herdr|mixed] [--config /absolute/path/config.json]
+  rovloom config init gateway [--container] [--config /absolute/path/config.json]
+  rovloom config check [--role gateway|connector] [--config /absolute/path/config.json]
+  rovloom config check-runtime [--role gateway|connector] [--config /absolute/path/config.json]
+  rovloom gateway [--add-device | --repair-device] [--config /absolute/path/config.json] [--non-interactive]
+  rovloom connector [--repair | --claim] [--config /absolute/path/config.json] [--non-interactive]
+  rovloom service --help
+  rovloom token --help
+  rovloom doctor --help
+  rovloom storage --help
+  rovloom admin --help
+
+gateway / connector starts the matching role. The first run completes one-time pairing and native installation approval in a real local terminal;
+declining the pairing prompt keeps the Gateway running unpaired, so rovloom admin create can be run first and first pairing completed from the management page;
+--add-device pairs one more Connector on top of a completed setup (same MCP credential; authorization grows to the new device);
+--repair-device / --repair re-pairs the same already-paired device (lost or leaked credentials), keeping native setup and MCP authorization.
+--claim lets an unpaired Connector claim an administrator-created pairing application from a running Gateway online (management-page code approval; the Gateway keeps running).
+These four options need a real local terminal and cannot be combined with --non-interactive. --non-interactive disables the local interactive setup (services run this way).
+token manages MCP Bearer tokens, admin manages management-page administrators, and service manages boot services; see each --help.
+config check validates the configuration file read-only; check-runtime additionally verifies program-managed state without reading credentials.
+
+Without --config, ~/.config/rovloom/gateway.json or connector.json is used (Windows also uses the user home).
+A missing file is created with defaults on the first run; an existing file is never overwritten or reset.
+Gateway supports Linux/macOS/Windows; Connector supports Linux x64, Windows x64 and macOS (x64 / arm64, attaching only already-running Herdr / Luvus).
+First-run setup selects luvus (default), herdr or mixed via the Connector's native.provider.
+Agent and model logins must be prepared separately; a ready native installation does not mean a model has replied.
+Exit codes: 0 success/clean shutdown, 2 argument or configuration error, 3 backend unavailable, 1 runtime or shutdown failure.
+`,
+  "help.admin": `Usage:
+  rovloom admin list [--config /absolute/path/gateway.json]
+  rovloom admin create [--principal ID] [--ttl-days N] [--config /absolute/path/gateway.json]
+  rovloom admin revoke [--principal ID] [--config /absolute/path/gateway.json]
+
+The management page (default http://127.0.0.1:9445/) signs in with HTTP Basic: the user name is the administrator ID (default admin) and the password is the secret printed by create.
+The password is written to stdout once, only by create (the Gateway stores only a SHA-256 digest); everything else goes to stderr. If the password is lost, run create again:
+an administrator with the same name is re-issued, and the old password plus signed-in browser sessions stop working immediately. revoke removes an administrator with the same immediate effect. Changes apply without restarting the Gateway.
+Administrators cannot call MCP and share nothing with MCP tokens or device credentials; the default validity is {ttlDays} days (1-365).
+Can be created before the first pairing: a fresh Gateway initializes an empty MCP caller registry on its own, after which the management page
+pairs the first Connector online (create a pairing application, then run rovloom connector --claim on the device).
+`,
+  "help.token": `Usage:
+  rovloom token list [--config /absolute/path/gateway.json]
+  rovloom token create --principal ID --like EXISTING_ID [--ttl-days N]
+  rovloom token renew --principal ID [--ttl-days N]
+  rovloom token rotate --principal ID [--ttl-days N] [--grace-minutes M]
+  rovloom token revoke --principal ID
+  rovloom token permissions --principal ID --discard-response true|false
+
+The token registry lives in the Gateway state directory; the Gateway re-reads it on every authentication, so changes apply immediately without a restart.
+create/rotate write the new token value to stdout once (new tokens are kept in the private registry and can be viewed again in the Dashboard); everything else goes to stderr.
+create clones the new principal's permissions from the existing principal named by --like, without widening them. renew extends the expiry; the token stays the same.
+rotate issues a new token; the old one keeps working within --grace-minutes (default 0, immediate invalidation). revoke removes the principal.
+permissions manages the explicit result-discard permission, hot-reloaded and off by default. Read and save anything you need before discarding results.
+ttl defaults to 30 days (1-365).
+`,
+  "help.storage": `Usage:
+  rovloom doctor --role gateway|connector [--config /absolute/config.json] [--json]
+  rovloom storage check --role gateway [--config /absolute/config.json] [--json]
+  rovloom storage backup --role gateway --output /path/to/gateway.backups/snapshot.db [--config /absolute/config.json] [--json]
+  rovloom storage resume --role gateway [--config /absolute/config.json] [--json]
+
+Gateway commands require the service to be stopped first; they share the same write lock and refuse active or undeterminable holders.
+check is read-only; backup only uses the plain <state>.backups directory next to the real state directory and exports a redacted snapshot (no raw text or valid credentials); full state needs a separate offline backup.
+resume is an explicit degradation release approved by the local operator and still refuses when integrity, clock or budget checks fail.
+Connector doctor only checks the configuration and managed state; it starts no native runtime and claims no native readiness.
+`,
+  "help.service": `service install --role gateway|connector [--executable ABS] [--config ABS] --workdir ABS --user ACCOUNT
+service uninstall|start|restart|stop --role gateway|connector
+install registers boot startup without starting; uninstall only revokes future boot startup and preserves running instances and their control records.
+Omitted --executable uses the current standalone binary; a different binary is rejected.
+Omitted --config uses the same current-user role file as foreground startup. Installation fixes its absolute path; background startup does not select another home.
+Linux uses systemd system units; macOS uses system LaunchDaemons; Windows uses boot-triggered tasks, not SCM services or login tasks.
+Gateway services support Linux systemd, macOS system LaunchDaemons and Windows boot-triggered tasks; the local native Connector service supports Linux x64, Windows x64 and macOS (x64 / arm64).
+Windows uses the explicitly selected existing user with S4U, without storing a password or requiring login. It does not provide an interactive desktop or Windows network credentials/EFS access. Running services receive a local shutdown request; queued/start-racing tasks return service_busy without forced termination; uninstall never stops it.
+`,
+  "guard.bunUnsupported": `Rovloom requires Bun {minimum} or newer (https://bun.sh); this runtime is not supported.
+`,
+  "run.wildcardListenWarning": `wildcard_listener
+MCP/management listen on all interfaces over plain HTTP; protect them with a firewall or a TLS reverse proxy.
+`,
+  "run.pairingRequiredHint": `Gateway is running; complete local pairing and native setup before using an Agent.
+`,
+  "run.configurationRequiredHint": `Setup requires a local terminal, a reachable Gateway, completed pairing and a compatible installed Luvus. Preserve uncertain setup state for owner review.
+`,
+  "setup.gatewayAddressPrompt": "Gateway address (ws://host:port or wss://host): ",
+  "setup.connector.pairingCodePrompt": "One-time pairing code: ",
+  "setup.connector.trustGateway": "Trust this Gateway address for one-time device enrollment and reviewed native setup?",
+  "setup.connector.pairingCompleted": `pairing_completed: Device identity is durably paired; discovering the selected native installation next.
+`,
+  "setup.connector.nativeSetupResponseUnavailable": `Native setup response unavailable; retain the original setup and rerun Connector to check it.
+`,
+  "setup.connector.nativeStatePrepared": `Native state prepared; starting the real Connector. Watch Gateway for connector_ready.
+`,
+  "setup.native.managedUnsupportedWindows": `{provider}_managed_unsupported_on_windows: set native.{configKey}.mode to "attach".
+`,
+  "setup.native.managedUnsupportedMacos": `{provider}_managed_unsupported_on_macos: set native.{configKey}.mode to "attach".
+`,
+  "setup.native.statePathTooLongLuvus": `native_state_path_too_long: choose a shorter data.directory before initialization (Luvus state path maximum 52 UTF-8 bytes).
+`,
+  "setup.native.statePathTooLongHerdr": `native_state_path_too_long: choose a shorter data.directory for the private Herdr sockets (herdr.sock and herdr-client.sock).
+`,
+  "setup.prompt.connectorNativeAttachEnabled": "Attach to your running {kind} session (or start one in your own config directory if none is running); remote callers will act on your REAL workspaces (terminal execution ENABLED in user config)?",
+  "setup.prompt.connectorNativeAttachDisabled": "Attach to your running {kind} session (or start one in your own config directory if none is running); remote callers will act on your REAL workspaces (terminal execution disabled)?",
+  "setup.prompt.connectorNativeIsolatedEnabled": "Discover {kind} and create isolated state (terminal execution ENABLED in user config)?",
+  "setup.prompt.connectorNativeIsolatedDisabled": "Discover this {kind} installation and create its isolated local state (terminal execution disabled)?",
+  "setup.prompt.gatewayNative": "Allow this paired device's measured Luvus ({version}, binary SHA-256 {sha}) for reviewed workspace/Agent operations and one local MCP caller? Terminal execution is controlled by the Connector machine owner's local configuration.",
+  "setup.prompt.gatewayNativeInstallations": "Allow this paired device's measured native installations ({entries}) for reviewed workspace/Agent operations and one local MCP caller? Terminal execution is controlled by the Connector machine owner's local configuration.",
+  "setup.repair.alreadyPaired": `This Connector is paired as {machine}. Re-pairing replaces only its Gateway credential; native setup is kept. Stop any other running Connector for this device first.
+`,
+  "setup.repair.codePrompt": "One-time re-pairing code from rovloom gateway --repair-device: ",
+  "setup.repair.trustConfirm": "Trust this Gateway address and replace this device credential with a new one?",
+  "setup.repair.confirmationUnavailable": `Gateway confirmation unavailable; if this Connector cannot authenticate, run the re-pairing again.
+`,
+  "setup.repair.deviceRepaired": `device_repaired: The device credential is replaced; starting the Connector.
+`,
+  "setup.gateway.resumeRePairing": `Resuming the device re-pairing; waiting for the Connector to reconnect.
+`,
+  "setup.gateway.repairCodeBlock": `Gateway MCP: {mcpUrl}
+Connector endpoint: {endpoint}
+One-time re-pairing code for the existing device (5 minutes; keep private):
+{code}
+Stop that Connector, then run rovloom connector --repair on its machine and enter the code. The old credential no longer works.
+`,
+  "setup.gateway.endpoints": `Gateway MCP: {mcpUrl}
+Connector endpoint: {endpoint}
+`,
+  "setup.gateway.unpairedRunning": `Gateway stays unpaired and running; no enrollment or credential is issued.
+`,
+  "setup.gateway.managementFirstPairing": "Finish first pairing from the management page: create the administrator with `rovloom admin create`, sign in at {page}, create a pairing application, then run `rovloom connector --claim` on the device.\n",
+  "setup.gateway.managementDisabled": `Management is disabled; enable it or rerun to pair from this terminal.
+`,
+  "setup.gateway.pairingCodeBlock": `One-time pairing code (5 minutes; keep private):
+{code}
+Run rovloom connector in another local terminal and enter the Gateway address and code.
+`,
+  "setup.gateway.resumingExisting": `Resuming the existing setup; no new enrollment or credential is issued.
+`,
+  "setup.gateway.connectorReady": `connector_ready: The Connector passed real authentication and every selected native provider is ready.
+`,
+  "setup.gateway.adminBlock": `
+Management page: {page}
+Management user: admin
+Management password (private): {secret}
+(Shown once; run rovloom admin create to re-issue.)`,
+  "setup.gateway.adminNotCreated": `
+Management administrator was not created; run rovloom admin create.`,
+  "setup.gateway.nativeSaved": `Native configuration saved; Gateway will reopen its real providers.
+MCP credential file: {clientPath}
+MCP URL: {url}
+Targets: {targets}
+Binding revision: 1`,
+  "setup.gateway.bearerAdditional": `
+Existing MCP Bearer now also covers this device (not shown again; tokens made with rovloom token create --like need re-creating).`,
+  "setup.gateway.bearerSecret": `
+Bearer (private): {token}`,
+  "setup.approval.resumeConfirm": "Resume the existing device setup?",
+  "setup.approval.pairConfirm": "Pair one Connector with this Gateway?",
+  "setup.approval.repairDeviceConfirm": "Re-pair the existing Connector device {name} ({machine})? The credential it holds stops working now and in-flight calls become unknown.",
+  "setup.claim.pairingCompletedActivated": `pairing_completed: Device identity is durably paired and native activation is complete.
+`,
+  "setup.claim.waitEnded": `Approval wait ended; rerun the same command to resume this claim.
+`,
+  "setup.claim.restartConfirm": "Start a new claim with a new pairing application?",
+  "setup.claim.pairingIdPrompt": "Pairing application ID: ",
+  "setup.claim.trustConfirm": "Trust this Gateway address for online device enrollment?",
+  "setup.claim.claimCodeBlock": `Claim code: {code}
+Approve this exact code for machine {machine} in the management page.
+`,
+  "setup.claim.activationResponseUnavailable": `Native activation response unavailable; rerun the same command to check the original claim.
+`,
+  "setup.claim.nativeStatePrepared": `Native state prepared; starting the real Connector.
+`,
+  "admin.create.login": `login at {url} with user "{user}" and the password below (shown once)
+`,
+  "admin.create.created": `created administrator {principal} expires {expires}
+`,
+  "admin.revoked": `revoked administrator {principal}
+`,
+  "token.created": `created {principal} expires {expires}
+`,
+  "token.renewed": `renewed {principal} expires {expires}
+`,
+  "token.rotated": `rotated {principal} expires {expires}
+`,
+  "token.permissions": `permissions {principal} discard_response={discard}
+`,
+  "token.revoked": `revoked {principal}
+`,
+  "mcp.instructions": "Tool availability does not imply a ready backend; execution, authorization, confirmation, deduplication and result retention are owned by the trusted service.",
+  "mcp.tool.machines_list": "List the devices visible to the current caller; paging and counts must pass the current ACL.",
+  "mcp.tool.machines_get": "Read a visible device by stable ID or exact name.",
+  "mcp.tool.providers_list": "List the configured providers visible to the current caller under a device; local machine configuration is not returned.",
+  "mcp.tool.providers_get": "Read the kind, revision and readiness of an explicit provider.",
+  "mcp.tool.runtime_discover": "Discover the effective capabilities and sources of an explicit Target/revision; grants no execution permission.",
+  "mcp.tool.runtime_describe": "Describe the exact methods\u2019 native parameters, categories and limits under an explicit Target/revision.",
+  "mcp.tool.runtime_call": "Submit one native call for an explicit Target/revision/contract. deadline is an absolute millisecond deadline; wait_ms only controls short waits; no retries or provider management.",
+  "mcp.tool.runtime_call_get": "Read a call under the current ownership, both-end policies and content gating; a short-wait timeout does not change the execution deadline.",
+  "mcp.tool.runtime_call_cancel": "Request stopping a wait or bridge; reports only what the service can confirm and promises no native rollback.",
+  "mcp.tool.runtime_result_read": "Read bounded result pages under the current read authorization and deadlines; the cursor is bound by the service to the caller and the original result.",
+  "mcp.tool.runtime_response_discard": "After processing, explicitly delete the raw text and handle and release read capacity; ownership, the current original-method policy and the independent discard_response permission must be verified. Reading to EOF does not delete the result."
+});
+var chinese = Object.freeze({
+  "help.main": `Rovloom {version}
+
+\u7528\u6CD5\uFF1A
+  rovloom --help
+  rovloom --version
+  rovloom config template gateway|connector
+  rovloom config init connector [--provider luvus|herdr|mixed] [--config /absolute/path/config.json]
+  rovloom config init gateway [--container] [--config /absolute/path/config.json]
+  rovloom config check [--role gateway|connector] [--config /absolute/path/config.json]
+  rovloom config check-runtime [--role gateway|connector] [--config /absolute/path/config.json]
+  rovloom gateway [--add-device | --repair-device] [--config /absolute/path/config.json] [--non-interactive]
+  rovloom connector [--repair | --claim] [--config /absolute/path/config.json] [--non-interactive]
+  rovloom service --help
+  rovloom token --help
+  rovloom doctor --help
+  rovloom storage --help
+  rovloom admin --help
+
+gateway / connector \u542F\u52A8\u5BF9\u5E94\u89D2\u8272\u3002\u9996\u6B21\u8FD0\u884C\u65F6\u5728\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\u5B8C\u6210\u4E00\u6B21\u6027\u914D\u5BF9\u4E0E\u539F\u751F\u5B89\u88C5\u6279\u51C6\uFF1B
+\u5728\u7EC8\u7AEF\u62D2\u7EDD\u914D\u5BF9\u63D0\u793A\u65F6\uFF0CGateway \u4FDD\u6301\u672A\u914D\u5BF9\u8FD0\u884C\uFF0C\u53EF\u5148\u8FD0\u884C rovloom admin create \u518D\u4ECE\u7BA1\u7406\u9875\u5B8C\u6210\u9996\u53F0\u914D\u5BF9\uFF1B
+--add-device \u5728\u5DF2\u5B8C\u6210\u7684\u5F15\u5BFC\u4E4B\u4E0A\u518D\u914D\u5BF9\u4E00\u53F0 Connector\uFF08\u6CBF\u7528\u540C\u4E00 MCP \u51ED\u636E\uFF0C\u6388\u6743\u968F\u4E4B\u6269\u5927\u5230\u65B0\u8BBE\u5907\uFF09\uFF1B
+--repair-device / --repair \u91CD\u65B0\u914D\u5BF9\u5DF2\u914D\u5BF9\u7684\u540C\u4E00\u8BBE\u5907\uFF08\u51ED\u636E\u4E22\u5931\u6216\u6CC4\u6F0F\uFF09\uFF0C\u4FDD\u7559\u539F\u751F\u8BBE\u7F6E\u4E0E MCP \u6388\u6743\u3002
+--claim \u8BA9\u672A\u914D\u5BF9\u7684 Connector \u5411\u8FD0\u884C\u4E2D\u7684 Gateway \u5728\u7EBF\u8BA4\u9886\u7BA1\u7406\u5458\u521B\u5EFA\u7684\u914D\u5BF9\u7533\u8BF7\uFF08\u7BA1\u7406\u9875\u6838\u5BF9\u7801\u6279\u51C6\uFF0CGateway \u4E0D\u505C\u673A\uFF09\u3002
+\u8FD9\u56DB\u4E2A\u9009\u9879\u9700\u8981\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\uFF0C\u4E0D\u53EF\u4E0E --non-interactive \u5408\u7528\u3002--non-interactive \u5173\u95ED\u672C\u5730\u4EA4\u4E92\u5F15\u5BFC\uFF08\u670D\u52A1\u4EE5\u6B64\u8FD0\u884C\uFF09\u3002
+token \u7BA1\u7406 MCP Bearer \u4EE4\u724C\uFF0Cadmin \u7BA1\u7406\u7BA1\u7406\u9875\u7BA1\u7406\u5458\uFF0Cservice \u7BA1\u7406\u5F00\u673A\u670D\u52A1\uFF1B\u8BE6\u89C1\u5404\u81EA\u7684 --help\u3002
+config check \u53EA\u8BFB\u68C0\u67E5\u914D\u7F6E\u6587\u4EF6\uFF1Bcheck-runtime \u53E6\u6838\u5BF9\u7A0B\u5E8F\u7BA1\u7406\u7684\u72B6\u6001\uFF0C\u4E0D\u8BFB\u53D6\u51ED\u636E\u3002
+
+\u7701\u7565 --config \u65F6\u8BFB\u53D6 ~/.config/rovloom/gateway.json \u6216 connector.json\uFF08Windows \u540C\u6837\u4F7F\u7528\u7528\u6237 home\uFF09\u3002
+\u6587\u4EF6\u7F3A\u5931\u65F6\u9996\u6B21\u8FD0\u884C\u4F1A\u751F\u6210\u9ED8\u8BA4\u914D\u7F6E\uFF0C\u5DF2\u6709\u6587\u4EF6\u4E0D\u4F1A\u88AB\u8986\u76D6\u6216\u91CD\u7F6E\u3002
+Gateway \u652F\u6301 Linux/macOS/Windows\uFF1BConnector \u652F\u6301 Linux x64\u3001Windows x64 \u4E0E macOS\uFF08x64 / arm64\uFF0C\u4EC5\u9644\u7740\u5DF2\u8FD0\u884C\u7684 Herdr / Luvus\uFF09\u3002
+\u9996\u6B21\u5F15\u5BFC\u6309 Connector \u7684 native.provider \u9009\u62E9 luvus\uFF08\u9ED8\u8BA4\uFF09\u3001herdr \u6216 mixed\u3002
+Agent \u4E0E\u6A21\u578B\u767B\u5F55\u9700\u72EC\u7ACB\u51C6\u5907\uFF1B\u539F\u751F ready \u4E0D\u4EE3\u8868\u6A21\u578B\u5DF2\u56DE\u590D\u3002
+\u9000\u51FA\u7801\uFF1A0 \u6210\u529F/\u6B63\u5E38\u5173\u95ED\uFF0C2 \u53C2\u6570\u6216\u914D\u7F6E\u9519\u8BEF\uFF0C3 \u540E\u7AEF\u4E0D\u53EF\u7528\uFF0C1 \u8FD0\u884C\u6216\u5173\u95ED\u5931\u8D25\u3002
+`,
+  "help.admin": `\u7528\u6CD5\uFF1A
+  rovloom admin list [--config /absolute/path/gateway.json]
+  rovloom admin create [--principal ID] [--ttl-days N] [--config /absolute/path/gateway.json]
+  rovloom admin revoke [--principal ID] [--config /absolute/path/gateway.json]
+
+\u7BA1\u7406\u9875\uFF08\u9ED8\u8BA4 http://127.0.0.1:9445/\uFF09\u7528 HTTP Basic \u767B\u5F55\uFF1A\u7528\u6237\u540D\u662F\u7BA1\u7406\u5458 ID\uFF08\u9ED8\u8BA4 admin\uFF09\uFF0C\u5BC6\u7801\u662F create \u8F93\u51FA\u7684\u53E3\u4EE4\u3002
+\u53E3\u4EE4\u539F\u503C\u53EA\u5728 create \u65F6\u5199\u5230 stdout \u4E00\u6B21\uFF08Gateway \u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002\u4E22\u5931\u53E3\u4EE4\u5C31\u518D create \u4E00\u6B21\uFF1A
+\u540C\u540D\u7BA1\u7406\u5458\u88AB\u91CD\u65B0\u7B7E\u53D1\uFF0C\u65E7\u53E3\u4EE4\u4E0E\u5DF2\u767B\u5F55\u7684\u6D4F\u89C8\u5668\u4F1A\u8BDD\u7ACB\u5373\u5931\u6548\u3002revoke \u5220\u9664\u7BA1\u7406\u5458\uFF0C\u540C\u6837\u7ACB\u5373\u751F\u6548\u3002\u4FEE\u6539\u65E0\u9700\u91CD\u542F Gateway\u3002
+\u7BA1\u7406\u5458\u4E0D\u80FD\u8C03\u7528 MCP\uFF0C\u4E5F\u4E0E MCP \u4EE4\u724C\u3001\u8BBE\u5907\u51ED\u636E\u4E92\u4E0D\u901A\u7528\uFF1B\u6709\u6548\u671F\u9ED8\u8BA4 {ttlDays} \u5929\uFF081-365\uFF09\u3002
+\u53EF\u5728\u9996\u6B21\u914D\u5BF9\u524D\u521B\u5EFA\uFF1A\u5168\u65B0 Gateway \u4F1A\u81EA\u884C\u521D\u59CB\u5316\u7A7A\u7684 MCP \u8C03\u7528\u65B9\u6CE8\u518C\u8868\uFF0C\u968F\u540E\u5373\u53EF\u5728\u7BA1\u7406\u9875
+\u5728\u7EBF\u914D\u5BF9\u9996\u53F0 Connector\uFF08\u65B0\u5EFA\u7533\u8BF7\uFF0C\u8BBE\u5907\u8FD0\u884C rovloom connector --claim\uFF09\u3002
+`,
+  "help.token": `\u7528\u6CD5\uFF1A
+  rovloom token list [--config /absolute/path/gateway.json]
+  rovloom token create --principal ID --like EXISTING_ID [--ttl-days N]
+  rovloom token renew --principal ID [--ttl-days N]
+  rovloom token rotate --principal ID [--ttl-days N] [--grace-minutes M]
+  rovloom token revoke --principal ID
+  rovloom token permissions --principal ID --discard-response true|false
+
+\u4EE4\u724C\u6CE8\u518C\u8868\u4F4D\u4E8E Gateway \u72B6\u6001\u76EE\u5F55\uFF1BGateway \u6BCF\u6B21\u8BA4\u8BC1\u91CD\u8BFB\uFF0C\u4FEE\u6539\u7ACB\u5373\u751F\u6548\u3001\u65E0\u9700\u91CD\u542F\u3002
+create/rotate \u628A\u65B0\u4EE4\u724C\u539F\u503C\u53EA\u5199\u5230 stdout \u4E00\u6B21\uFF08\u65B0\u4EE4\u724C\u4FDD\u5B58\u5728\u79C1\u6709\u6CE8\u518C\u8868\uFF0C\u53EF\u5728\u7BA1\u7406\u5458\u9762\u677F\u518D\u6B21\u67E5\u770B\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002
+create \u7684\u65B0\u4E3B\u4F53\u6743\u9650\u514B\u9686\u81EA --like \u6307\u5B9A\u7684\u73B0\u6709\u4E3B\u4F53\uFF0C\u4E0D\u6269\u5927\u6743\u9650\u3002renew \u5EF6\u957F\u5230\u671F\u65F6\u95F4\u3001\u4EE4\u724C\u4E0D\u53D8\u3002
+rotate \u7B7E\u53D1\u65B0\u4EE4\u724C\uFF1B--grace-minutes \u5185\u65E7\u4EE4\u724C\u7EE7\u7EED\u6709\u6548\uFF08\u9ED8\u8BA4 0\uFF0C\u7ACB\u5373\u5931\u6548\uFF09\u3002revoke \u5220\u9664\u4E3B\u4F53\u3002
+permissions \u663E\u5F0F\u7BA1\u7406\u7ED3\u679C\u5220\u9664\u6743\u9650\uFF0C\u70ED\u751F\u6548\uFF1B\u9ED8\u8BA4\u5173\u95ED\u3002\u5220\u9664\u7ED3\u679C\u524D\u5E94\u5148\u8BFB\u53D6\u5E76\u4FDD\u5B58\u6240\u9700\u5185\u5BB9\u3002
+ttl \u9ED8\u8BA4 30 \u5929\uFF081-365\uFF09\u3002
+`,
+  "help.storage": `\u7528\u6CD5\uFF1A
+  rovloom doctor --role gateway|connector [--config /absolute/config.json] [--json]
+  rovloom storage check --role gateway [--config /absolute/config.json] [--json]
+  rovloom storage backup --role gateway --output /path/to/gateway.backups/snapshot.db [--config /absolute/config.json] [--json]
+  rovloom storage resume --role gateway [--config /absolute/config.json] [--json]
+
+Gateway \u547D\u4EE4\u987B\u5148\u505C\u6B62\u670D\u52A1\uFF1B\u6CBF\u7528\u540C\u4E00\u5199\u9501\uFF0C\u62D2\u7EDD\u6D3B\u52A8\u6216\u65E0\u6CD5\u5224\u5B9A\u7684\u6301\u6709\u8005\u3002
+check \u53EA\u8BFB\uFF1Bbackup \u4EC5\u4F7F\u7528\u771F\u5B9E\u72B6\u6001\u76EE\u5F55\u540C\u7EA7\u7684 <state>.backups \u666E\u901A\u76EE\u5F55\uFF0C\u5BFC\u51FA\u8131\u654F\u5FEB\u7167\uFF08\u4E0D\u542B\u539F\u6587\u53CA\u6709\u6548\u51ED\u636E\uFF09\uFF0C\u5B8C\u6574\u72B6\u6001\u9700\u53E6\u884C\u79BB\u7EBF\u5907\u4EFD\u3002
+resume \u662F\u672C\u673A\u64CD\u4F5C\u5458\u663E\u5F0F\u6279\u51C6\u7684\u89E3\u9664\u964D\u7EA7\uFF0C\u5B8C\u6574\u6027\u3001\u65F6\u949F\u6216\u9884\u7B97\u4E0D\u6B63\u5E38\u65F6\u4ECD\u62D2\u7EDD\u3002
+Connector doctor \u53EA\u68C0\u67E5\u914D\u7F6E\u53CA managed \u72B6\u6001\uFF0C\u4E0D\u542F\u52A8 native\uFF0C\u4E5F\u4E0D\u58F0\u660E native \u5C31\u7EEA\u3002
+`,
+  "help.service": `service install --role gateway|connector [--executable ABS] [--config ABS] --workdir ABS --user ACCOUNT
+service uninstall|start|restart|stop --role gateway|connector
+install \u6CE8\u518C\u5F00\u673A\u81EA\u542F\u4F46\u4E0D\u7ACB\u5373\u542F\u52A8\uFF1Buninstall \u53EA\u64A4\u9500\u672A\u6765\u7684\u5F00\u673A\u81EA\u542F\uFF0C\u4FDD\u7559\u6B63\u5728\u8FD0\u884C\u7684\u5B9E\u4F8B\u53CA\u5176\u63A7\u5236\u8BB0\u5F55\u3002
+\u7701\u7565 --executable \u65F6\u4F7F\u7528\u5F53\u524D\u72EC\u7ACB\u53EF\u6267\u884C\u6587\u4EF6\uFF1B\u4F20\u5165\u5176\u5B83\u53EF\u6267\u884C\u6587\u4EF6\u4F1A\u88AB\u62D2\u7EDD\u3002
+\u7701\u7565 --config \u65F6\u6CBF\u7528\u4E0E\u524D\u53F0\u542F\u52A8\u76F8\u540C\u7684\u5F53\u524D\u7528\u6237\u89D2\u8272\u6587\u4EF6\uFF1B\u5B89\u88C5\u56FA\u5B9A\u5176\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u540E\u53F0\u542F\u52A8\u4E0D\u518D\u9009\u62E9\u5176\u5B83 home\u3002
+Linux \u4F7F\u7528 systemd system \u5355\u5143\uFF1BmacOS \u4F7F\u7528\u7CFB\u7EDF LaunchDaemons\uFF1BWindows \u4F7F\u7528\u5F00\u673A\u89E6\u53D1\u4EFB\u52A1\uFF0C\u4E0D\u662F SCM \u670D\u52A1\u6216\u767B\u5F55\u4EFB\u52A1\u3002
+Gateway \u670D\u52A1\u652F\u6301 Linux systemd\u3001macOS \u7CFB\u7EDF LaunchDaemons \u548C Windows \u5F00\u673A\u89E6\u53D1\u4EFB\u52A1\uFF1B\u672C\u673A\u539F\u751F Connector \u670D\u52A1\u652F\u6301 Linux x64\u3001Windows x64 \u548C macOS\uFF08x64 / arm64\uFF09\u3002
+Windows \u4F7F\u7528\u663E\u5F0F\u9009\u62E9\u7684\u65E2\u6709\u7528\u6237\u4E0E S4U\uFF0C\u4E0D\u4FDD\u5B58\u5BC6\u7801\u3001\u4E0D\u8981\u6C42\u767B\u5F55\uFF1B\u4E0D\u63D0\u4F9B\u4EA4\u4E92\u684C\u9762\u6216 Windows \u7F51\u7EDC\u51ED\u636E/EFS \u8BBF\u95EE\u3002\u8FD0\u884C\u4E2D\u7684\u670D\u52A1\u6536\u5230\u672C\u5730\u505C\u6B62\u8BF7\u6C42\uFF1B\u6392\u961F/\u542F\u52A8\u7ADE\u6001\u4E2D\u7684\u4EFB\u52A1\u8FD4\u56DE service_busy \u4E14\u4E0D\u5F3A\u505C\uFF1Buninstall \u4ECE\u4E0D\u505C\u6B62\u5B83\u3002
+`,
+  "guard.bunUnsupported": `Rovloom \u9700\u8981 Bun {minimum} \u6216\u66F4\u9AD8\u7248\u672C\uFF08https://bun.sh\uFF09\uFF1B\u5F53\u524D\u8FD0\u884C\u65F6\u4E0D\u53D7\u652F\u6301\u3002
+`,
+  "run.wildcardListenWarning": `wildcard_listener
+MCP/\u7BA1\u7406\u9875\u76D1\u542C\u6240\u6709\u7F51\u5361\u4E14\u4E3A\u660E\u6587 HTTP\uFF1B\u8BF7\u7528\u9632\u706B\u5899\u6216 TLS \u53CD\u5411\u4EE3\u7406\u6536\u53E3\u3002
+`,
+  "run.pairingRequiredHint": `Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u6210\u672C\u5730\u914D\u5BF9\u548C\u539F\u751F\u521D\u59CB\u5316\u3002
+`,
+  "run.configurationRequiredHint": `\u521D\u59CB\u5316\u9700\u672C\u5730\u7EC8\u7AEF\u3001\u53EF\u8FBE Gateway\u3001\u5B8C\u6574\u914D\u5BF9\u53CA\u517C\u5BB9 Luvus \u5B89\u88C5\uFF1B\u7ED3\u679C\u4E0D\u786E\u5B9A\u65F6\u4FDD\u7559\u539F\u72B6\u6001\u5E76\u7531\u6240\u6709\u8005\u6838\u67E5\u3002
+`,
+  "setup.gatewayAddressPrompt": "Gateway \u5730\u5740: ",
+  "setup.connector.pairingCodePrompt": "\u4E00\u6B21\u6027\u914D\u5BF9\u7801: ",
+  "setup.connector.trustGateway": "\u4FE1\u4EFB\u6B64 Gateway \u5730\u5740\u5E76\u5151\u6362\u4E00\u6B21\u6027\u8BBE\u5907\u914D\u5BF9\uFF1F",
+  "setup.connector.pairingCompleted": `pairing_completed: \u8BBE\u5907\u8EAB\u4EFD\u5DF2\u6301\u4E45\u914D\u5BF9\uFF1B\u63A5\u4E0B\u6765\u53D1\u73B0\u6240\u9009\u539F\u751F\u5B89\u88C5\u3002
+`,
+  "setup.connector.nativeSetupResponseUnavailable": `\u539F\u751F\u8BBE\u7F6E\u54CD\u5E94\u4E0D\u53EF\u7528\uFF1B\u4FDD\u7559\u539F\u72B6\u6001\uFF0C\u91CD\u65B0\u8FD0\u884C Connector \u6838\u5BF9\u3002
+`,
+  "setup.connector.nativeStatePrepared": `\u539F\u751F\u72B6\u6001\u5DF2\u51C6\u5907\uFF1B\u542F\u52A8\u6B63\u5F0F Connector\uFF0C\u4EE5 Gateway \u7684\u5B9E\u9645\u5C31\u7EEA\u63D0\u793A\u4E3A\u51C6\u3002
+`,
+  "setup.native.managedUnsupportedWindows": `{provider}_managed_unsupported_on_windows: Windows \u4E0A\u6682\u4E0D\u652F\u6301 managed\uFF0C\u8BF7\u628A native.{configKey}.mode \u8BBE\u4E3A "attach"\u3002
+`,
+  "setup.native.managedUnsupportedMacos": `{provider}_managed_unsupported_on_macos: macOS \u4E0A\u6682\u4E0D\u652F\u6301 managed\uFF0C\u8BF7\u628A native.{configKey}.mode \u8BBE\u4E3A "attach"\u3002
+`,
+  "setup.native.statePathTooLongLuvus": `native_state_path_too_long: \u521D\u59CB\u5316\u524D\u8BF7\u7F29\u77ED data.directory\uFF08Luvus \u72B6\u6001\u8DEF\u5F84\u6700\u591A52\u4E2AUTF-8\u5B57\u8282\uFF09\u3002
+`,
+  "setup.native.statePathTooLongHerdr": `native_state_path_too_long: \u8BF7\u7F29\u77ED data.directory \u4EE5\u5BB9\u7EB3\u9694\u79BB Herdr \u7684 socket\uFF08\u542B herdr-client.sock\uFF09\u3002
+`,
+  "setup.prompt.connectorNativeAttachEnabled": "\u9644\u7740\u5230\u4F60\u6B63\u5728\u8FD0\u884C\u7684 {kind} \u4F1A\u8BDD\uFF08\u6CA1\u6709\u5219\u5728\u4F60\u81EA\u5DF1\u7684\u914D\u7F6E\u76EE\u5F55\u91CC\u542F\u52A8\u4E00\u4E2A\uFF09\uFF0C\u8FDC\u7A0B\u8C03\u7528\u5C06\u76F4\u63A5\u64CD\u4F5C\u4F60\u7684\u771F\u5B9E\u5DE5\u4F5C\u533A\uFF08\u7528\u6237\u914D\u7F6E\u5DF2\u5F00\u542F\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F",
+  "setup.prompt.connectorNativeAttachDisabled": "\u9644\u7740\u5230\u4F60\u6B63\u5728\u8FD0\u884C\u7684 {kind} \u4F1A\u8BDD\uFF08\u6CA1\u6709\u5219\u5728\u4F60\u81EA\u5DF1\u7684\u914D\u7F6E\u76EE\u5F55\u91CC\u542F\u52A8\u4E00\u4E2A\uFF09\uFF0C\u8FDC\u7A0B\u8C03\u7528\u5C06\u76F4\u63A5\u64CD\u4F5C\u4F60\u7684\u771F\u5B9E\u5DE5\u4F5C\u533A\uFF08\u5173\u95ED\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F",
+  "setup.prompt.connectorNativeIsolatedEnabled": "\u53D1\u73B0 {kind} \u5E76\u521B\u5EFA\u9694\u79BB\u72B6\u6001\uFF08\u7528\u6237\u914D\u7F6E\u5DF2\u5F00\u542F\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F",
+  "setup.prompt.connectorNativeIsolatedDisabled": "\u53D1\u73B0 {kind} \u5E76\u521B\u5EFA\u9694\u79BB\u72B6\u6001\uFF08\u5173\u95ED\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F",
+  "setup.prompt.gatewayNative": "\u6279\u51C6\u8FD9\u53F0\u8BBE\u5907\u7684\u5B9E\u6D4B Luvus\uFF08\u7248\u672C {version}\uFF0C\u4E8C\u8FDB\u5236 SHA-256 {sha}\uFF09\u3001\u666E\u901A\u7A97\u53E3/Agent \u64CD\u4F5C\u53CA\u4E00\u4E2A\u672C\u673A MCP caller\uFF08\u7EC8\u7AEF\u6267\u884C\u7531 Connector \u672C\u673A\u6240\u6709\u8005\u914D\u7F6E\u51B3\u5B9A\uFF09\uFF1F",
+  "setup.prompt.gatewayNativeInstallations": "\u6279\u51C6\u8FD9\u4E9B\u5B9E\u6D4B\u539F\u751F\u6765\u6E90\uFF08{entries}\uFF09\u3001\u5404\u81EA\u7A97\u53E3/Agent \u64CD\u4F5C\u53CA\u4E00\u4E2A\u672C\u673A MCP caller\uFF08\u7EC8\u7AEF\u6267\u884C\u7531 Connector \u672C\u673A\u6240\u6709\u8005\u914D\u7F6E\u51B3\u5B9A\uFF09\uFF1F",
+  "setup.repair.alreadyPaired": `\u6B64 Connector \u5DF2\u914D\u5BF9\u4E3A {machine}\u3002\u91CD\u65B0\u914D\u5BF9\u53EA\u66F4\u6362\u4E0E Gateway \u7684\u51ED\u636E\uFF0C\u4FDD\u7559\u539F\u751F\u8BBE\u7F6E\uFF1B\u8BF7\u5148\u505C\u6B62\u8BE5\u8BBE\u5907\u4E0A\u5176\u5B83\u6B63\u5728\u8FD0\u884C\u7684 Connector\u3002
+`,
+  "setup.repair.codePrompt": "\u6765\u81EA rovloom gateway --repair-device \u7684\u4E00\u6B21\u6027\u7801: ",
+  "setup.repair.trustConfirm": "\u4FE1\u4EFB\u6B64 Gateway \u5730\u5740\u5E76\u7528\u65B0\u51ED\u636E\u66FF\u6362\u672C\u673A\u8BBE\u5907\u51ED\u636E\uFF1F",
+  "setup.repair.confirmationUnavailable": `\u672A\u6536\u5230 Gateway \u7684\u786E\u8BA4\uFF1B\u82E5 Connector \u4E4B\u540E\u65E0\u6CD5\u8BA4\u8BC1\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C\u91CD\u65B0\u914D\u5BF9\u3002
+`,
+  "setup.repair.deviceRepaired": `device_repaired: \u8BBE\u5907\u51ED\u636E\u5DF2\u66F4\u6362\uFF1B\u6B63\u5728\u542F\u52A8 Connector\u3002
+`,
+  "setup.gateway.resumeRePairing": `\u7EE7\u7EED\u539F\u91CD\u65B0\u914D\u5BF9\uFF0C\u7B49\u5F85 Connector \u91CD\u8FDE\u3002
+`,
+  "setup.gateway.repairCodeBlock": `Gateway MCP: {mcpUrl}
+Connector endpoint: {endpoint}
+\u5DF2\u6709\u8BBE\u5907\u7684\u4E00\u6B21\u6027\u91CD\u65B0\u914D\u5BF9\u7801\uFF085\u5206\u949F\uFF0C\u8BF7\u4FDD\u5BC6\uFF09:
+{code}
+\u5728\u8BE5\u8BBE\u5907\u4E0A\u505C\u6B62 Connector\uFF0C\u8FD0\u884C rovloom connector --repair \u5E76\u8F93\u5165\u6B64\u7801\uFF1B\u65E7\u51ED\u636E\u5DF2\u5931\u6548\u3002
+`,
+  "setup.gateway.endpoints": `Gateway MCP: {mcpUrl}
+Connector endpoint: {endpoint}
+`,
+  "setup.gateway.unpairedRunning": `Gateway \u4FDD\u6301\u672A\u914D\u5BF9\u5E76\u7EE7\u7EED\u8FD0\u884C\uFF0C\u4E0D\u7B7E\u53D1\u51ED\u636E\u3002
+`,
+  "setup.gateway.managementFirstPairing": "\u5728\u7BA1\u7406\u9875\u5B8C\u6210\u9996\u6B21\u914D\u5BF9\uFF1A\u5148\u7528 `rovloom admin create` \u521B\u5EFA\u7BA1\u7406\u5458\uFF0C\u767B\u5F55 {page} \u65B0\u5EFA\u914D\u5BF9\u7533\u8BF7\uFF0C\u518D\u5728\u8BBE\u5907\u4E0A\u8FD0\u884C `rovloom connector --claim`\u3002\n",
+  "setup.gateway.managementDisabled": `\u7BA1\u7406\u9875\u672A\u542F\u7528\uFF1B\u8BF7\u542F\u7528\u540E\u91CD\u8BD5\u6216\u5728\u672C\u7EC8\u7AEF\u5B8C\u6210\u914D\u5BF9\u3002
+`,
+  "setup.gateway.pairingCodeBlock": `\u4E00\u6B21\u6027\u914D\u5BF9\u7801\uFF085\u5206\u949F\uFF0C\u8BF7\u4FDD\u5BC6\uFF09:
+{code}
+\u5728 Connector \u7684\u672C\u5730\u7EC8\u7AEF\u8F93\u5165 Gateway \u5730\u5740\u4E0E\u8BE5\u7801\uFF1B\u968F\u540E\u56DE\u5230\u6B64\u7EC8\u7AEF\u6279\u51C6\u5B9E\u6D4B\u5B89\u88C5\u3002
+`,
+  "setup.gateway.resumingExisting": `\u7EE7\u7EED\u539F\u8BBE\u7F6E\uFF0C\u4E0D\u91CD\u65B0\u7B7E\u53D1\u3002
+`,
+  "setup.gateway.connectorReady": `connector_ready: Connector \u5DF2\u901A\u8FC7\u771F\u5B9E\u8BA4\u8BC1\u4E14\u5168\u90E8\u6240\u9009\u539F\u751F provider \u5C31\u7EEA\u3002
+`,
+  "setup.gateway.adminBlock": `
+\u7BA1\u7406\u9875: {page}
+\u7BA1\u7406\u5458: admin
+\u7BA1\u7406\u5458\u5BC6\u7801: {secret}
+(\u53EA\u663E\u793A\u4E00\u6B21\uFF1B\u4E22\u5931\u540E\u8FD0\u884C rovloom admin create \u91CD\u65B0\u7B7E\u53D1\u3002)`,
+  "setup.gateway.adminNotCreated": `
+\u672A\u80FD\u521B\u5EFA\u7BA1\u7406\u9875\u7BA1\u7406\u5458\uFF0C\u8BF7\u7A0D\u540E\u8FD0\u884C rovloom admin create\u3002`,
+  "setup.gateway.nativeSaved": `\u539F\u751F\u914D\u7F6E\u5DF2\u4FDD\u5B58\uFF0CGateway \u5C06\u91CD\u5F00\u5B9E\u9645 provider\u3002
+MCP \u51ED\u636E\u6587\u4EF6: {clientPath}
+MCP URL: {url}
+Targets: {targets}
+Binding revision: 1`,
+  "setup.gateway.bearerAdditional": `
+\u73B0\u6709 MCP Bearer \u5DF2\u8986\u76D6\u6B64\u8BBE\u5907\uFF08\u4E0D\u518D\u663E\u793A\uFF1B\u7528 token create --like \u514B\u9686\u7684\u4EE4\u724C\u9700\u8981\u91CD\u65B0\u514B\u9686\uFF09\u3002`,
+  "setup.gateway.bearerSecret": `
+Bearer (private): {token}`,
+  "setup.approval.resumeConfirm": "\u7EE7\u7EED\u539F\u8BBE\u5907\u8BBE\u7F6E\uFF1F",
+  "setup.approval.pairConfirm": "\u5141\u8BB8\u914D\u5BF9\u4E00\u4E2A Connector\uFF1F",
+  "setup.approval.repairDeviceConfirm": "\u91CD\u65B0\u914D\u5BF9\u5DF2\u6709\u8BBE\u5907 {name}\uFF08{machine}\uFF09\uFF1F\u8BE5\u8BBE\u5907\u5F53\u524D\u51ED\u636E\u7ACB\u5373\u5931\u6548\uFF0C\u8FDB\u884C\u4E2D\u7684\u8C03\u7528\u7ED3\u679C\u53D8\u4E3A\u672A\u77E5\u3002",
+  "setup.claim.pairingCompletedActivated": `pairing_completed: \u8BBE\u5907\u8EAB\u4EFD\u5DF2\u6301\u4E45\u914D\u5BF9\uFF0C\u539F\u751F\u6FC0\u6D3B\u5DF2\u5B8C\u6210\u3002
+`,
+  "setup.claim.waitEnded": `\u7B49\u5F85\u6279\u51C6\u5DF2\u7ED3\u675F\uFF1B\u91CD\u65B0\u8FD0\u884C\u540C\u4E00\u547D\u4EE4\u53EF\u7EE7\u7EED\u539F\u8BA4\u9886\u3002
+`,
+  "setup.claim.restartConfirm": "\u539F\u8BA4\u9886\u5DF2\u7EC8\u6B62\u6216\u8FC7\u671F\uFF0C\u662F\u5426\u4F7F\u7528\u65B0\u7684\u914D\u5BF9\u7533\u8BF7\u91CD\u65B0\u8BA4\u9886\uFF1F",
+  "setup.claim.pairingIdPrompt": "\u914D\u5BF9\u7533\u8BF7 ID: ",
+  "setup.claim.trustConfirm": "\u4FE1\u4EFB\u6B64 Gateway \u5730\u5740\u5E76\u5728\u7EBF\u8BA4\u9886\u8BBE\u5907\u914D\u5BF9\uFF1F",
+  "setup.claim.claimCodeBlock": `\u6838\u5BF9\u7801: {code}
+\u8BF7\u5728\u7BA1\u7406\u9875\u4E3A\u8BBE\u5907 {machine} \u6838\u5BF9\u5E76\u6279\u51C6\u6B64\u7801\u3002
+`,
+  "setup.claim.activationResponseUnavailable": `\u539F\u751F\u6FC0\u6D3B\u54CD\u5E94\u4E0D\u53EF\u7528\uFF1B\u91CD\u65B0\u8FD0\u884C\u540C\u4E00\u547D\u4EE4\u6309\u539F\u8BA4\u9886\u6838\u5BF9\u3002
+`,
+  "setup.claim.nativeStatePrepared": `\u539F\u751F\u72B6\u6001\u5DF2\u51C6\u5907\uFF1B\u542F\u52A8\u6B63\u5F0F Connector\u3002
+`,
+  "admin.create.login": `\u5728 {url} \u7528\u7528\u6237\u540D "{user}" \u548C\u4E0B\u65B9\u5BC6\u7801\u767B\u5F55\uFF08\u5BC6\u7801\u53EA\u663E\u793A\u4E00\u6B21\uFF09
+`,
+  "admin.create.created": `\u5DF2\u521B\u5EFA\u7BA1\u7406\u5458 {principal}\uFF0C\u5230\u671F\u65F6\u95F4 {expires}
+`,
+  "admin.revoked": `\u5DF2\u64A4\u9500\u7BA1\u7406\u5458 {principal}
+`,
+  "token.created": `\u5DF2\u521B\u5EFA {principal}\uFF0C\u5230\u671F\u65F6\u95F4 {expires}
+`,
+  "token.renewed": `\u5DF2\u7EED\u671F {principal}\uFF0C\u5230\u671F\u65F6\u95F4 {expires}
+`,
+  "token.rotated": `\u5DF2\u8F6E\u6362 {principal}\uFF0C\u5230\u671F\u65F6\u95F4 {expires}
+`,
+  "token.permissions": `\u5DF2\u8BBE\u7F6E {principal} \u7684\u6743\u9650 discard_response={discard}
+`,
+  "token.revoked": `\u5DF2\u64A4\u9500 {principal}
+`,
+  "mcp.instructions": "\u5DE5\u5177\u5B58\u5728\u4E0D\u8868\u793A\u540E\u7AEF\u53EF\u7528\uFF1B\u6267\u884C\u3001\u6388\u6743\u3001\u786E\u8BA4\u3001\u53BB\u91CD\u4E0E\u7ED3\u679C\u4FDD\u7559\u7531\u53D7\u4FE1\u670D\u52A1\u8D1F\u8D23\u3002",
+  "mcp.tool.machines_list": "\u5217\u51FA\u5F53\u524D caller \u53EF\u89C1\u7684\u8BBE\u5907\uFF1B\u5206\u9875\u548C\u8BA1\u6570\u987B\u7ECF\u8FC7\u5F53\u524D ACL\u3002",
+  "mcp.tool.machines_get": "\u6309\u7A33\u5B9A ID \u6216\u7CBE\u786E\u540D\u79F0\u8BFB\u53D6\u53EF\u89C1\u8BBE\u5907\u3002",
+  "mcp.tool.providers_list": "\u5217\u51FA\u6307\u5B9A\u8BBE\u5907\u4E0B\u5F53\u524D caller \u53EF\u89C1\u7684\u5DF2\u914D\u7F6E provider\uFF1B\u4E0D\u8FD4\u56DE\u672C\u673A\u914D\u7F6E\u3002",
+  "mcp.tool.providers_get": "\u8BFB\u53D6\u663E\u5F0F provider \u7684 kind\u3001revision \u548C readiness\u3002",
+  "mcp.tool.runtime_discover": "\u53D1\u73B0\u663E\u5F0F Target/revision \u7684\u6709\u6548\u80FD\u529B\u53CA\u6765\u6E90\uFF1B\u4E0D\u6388\u4E88\u6267\u884C\u6743\u9650\u3002",
+  "mcp.tool.runtime_describe": "\u63CF\u8FF0\u663E\u5F0F Target/revision \u4E0B\u7CBE\u786E\u65B9\u6CD5\u7684\u539F\u751F\u53C2\u6570\u3001\u5206\u7C7B\u548C\u9650\u5236\u3002",
+  "mcp.tool.runtime_call": "\u63D0\u4EA4\u4E00\u6B21\u663E\u5F0F Target/revision/\u5951\u7EA6\u7684\u539F\u751F\u8C03\u7528\u3002deadline \u662F\u7EDD\u5BF9\u6BEB\u79D2\u671F\u9650\uFF0Cwait_ms \u53EA\u63A7\u5236\u77ED\u7B49\uFF1B\u4E0D\u91CD\u8BD5\u6216\u7BA1\u7406 provider\u3002",
+  "mcp.tool.runtime_call_get": "\u6309\u5F53\u524D\u5F52\u5C5E\u3001\u53CC\u7AEF\u7B56\u7565\u548C\u5185\u5BB9\u95E8\u7981\u8BFB\u53D6\u8C03\u7528\uFF1B\u77ED\u7B49\u5230\u671F\u4E0D\u6539\u53D8\u6267\u884C\u671F\u9650\u3002",
+  "mcp.tool.runtime_call_cancel": "\u8BF7\u6C42\u505C\u6B62\u7B49\u5F85\u6216\u6865\u63A5\uFF1B\u4EC5\u62A5\u544A\u670D\u52A1\u53EF\u786E\u8BA4\u7A0B\u5EA6\uFF0C\u4E0D\u627F\u8BFA\u539F\u751F\u56DE\u6EDA\u3002",
+  "mcp.tool.runtime_result_read": "\u6309\u5F53\u524D\u8BFB\u53D6\u6388\u6743\u548C\u671F\u9650\u8BFB\u53D6\u6709\u754C\u7ED3\u679C\u9875\uFF1Bcursor \u7531\u670D\u52A1\u7ED1\u5B9A caller \u548C\u539F\u7ED3\u679C\u3002",
+  "mcp.tool.runtime_response_discard": "\u5904\u7406\u5B8C\u7ED3\u679C\u540E\u663E\u5F0F\u5220\u9664\u539F\u6587\u4E0E\u53E5\u67C4\u5E76\u91CA\u653E\u8BFB\u53D6\u5BB9\u91CF\uFF1B\u5FC5\u987B\u9A8C\u8BC1\u5F52\u5C5E\u3001\u5F53\u524D\u539F\u65B9\u6CD5\u7B56\u7565\u53CA\u72EC\u7ACB discard_response \u6743\u9650\u3002\u8BFB\u53D6\u5230 EOF \u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\u7ED3\u679C\u3002"
+});
+function cliMessages2(language = "en") {
+  return language === "zh-CN" ? chinese : english;
+}
+function formatMessage2(template, values) {
+  return template.replace(/\{(\w+)\}/gu, (match, name) => Object.hasOwn(values, name) ? String(values[name]) : match);
+}
+
+export { resolveCliLanguage2, cliMessages2, formatMessage2 };
+
+//# debugId=8069F52A271C482D64756E2164756E21

package/dist/src/chunk-5j0gj6w2.js

@@ -0,0 +1,7 @@
+// @bun
+// src/pairing-policy.ts
+var DEFAULT_PAIRING_POLICY_REF = "rovloom_setup_v1";
+
+export { DEFAULT_PAIRING_POLICY_REF };
+
+//# debugId=C4F08DA3B385473E64756E2164756E21

package/dist/src/{chunk-v1httsp6.js → chunk-8ykrqhxh.js}

@@ -1,14 +1,14 @@
 // @bun
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   CliError2,
   parseConfig2,
   configDocument2,
   configTemplate2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   ensurePrivateDirectory
 } from "./chunk-0y5542k8.js";
@@ -41,7 +41,13 @@ function defaults(role, environment, initialization) {
     return { ...config, native: { ...config.native, provider: initialization.provider } };
   }
   if (config.role === "gateway" && initialization.container) {
-    return { ...config, mcp_hostname: "0.0.0.0", device_hostname: "0.0.0.0", management_hostname: "0.0.0.0" };
+    return {
+      ...config,
+      mcp_hostname: "0.0.0.0",
+      device_hostname: "0.0.0.0",
+      management_hostname: "0.0.0.0",
+      management_lan: true
+    };
   }
   return config;
 }
@@ -98,4 +104,4 @@ function readOrCreateRoleConfig(role, path, environment, initialization = {}) {
 
 export { privateDirectory, readOrCreateRoleConfig };
 
-//# debugId=98F38BF75586543964756E2164756E21
+//# debugId=2B2959D62D3C434064756E2164756E21

package/dist/src/{chunk-76wgt2g5.js → chunk-9zkq0kc8.js}

@@ -3,6 +3,9 @@ import {
   canonical2,
   digest2
 } from "./chunk-d71r315c.js";
+import {
+  cliMessages2
+} from "./chunk-5b8g62kw.js";
 import {
   MAX_MCP_BYTES2,
   TOOLS_PAGE_SIZE,
@@ -13,13 +16,13 @@ import {
   SERVICE_ERROR_CODES,
   FacadeServiceError2,
   NativeRequestNotDispatchedError
-} from "./chunk-smpevv7n.js";
+} from "./chunk-0dqx2mmz.js";
 import {
   parseNativeJson2
 } from "./chunk-7crhmqn2.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-xmkgq3nh.js";
+} from "./chunk-s3ydr65k.js";
 import {
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";
@@ -109,9 +112,10 @@ function toolOffset(cursor) {
   return offset;
 }
 function createMcpFacade2(options) {
+  const language = options.language ?? "en";
   const server = new Server({ name: "rovloom", version: PRODUCT_VERSION2 }, {
     capabilities: { tools: {} },
-    instructions: "\u5DE5\u5177\u5B58\u5728\u4E0D\u8868\u793A\u540E\u7AEF\u53EF\u7528\uFF1B\u6267\u884C\u3001\u6388\u6743\u3001\u786E\u8BA4\u3001\u53BB\u91CD\u4E0E\u7ED3\u679C\u4FDD\u7559\u7531\u53D7\u4FE1\u670D\u52A1\u8D1F\u8D23\u3002"
+    instructions: cliMessages2(language)["mcp.instructions"]
   });
   let initialized = false;
   let inflight = 0;
@@ -140,7 +144,7 @@ function createMcpFacade2(options) {
     const names = toolNames2();
     const next = offset + TOOLS_PAGE_SIZE;
     return {
-      tools: names.slice(offset, next).map(toolDefinition2),
+      tools: names.slice(offset, next).map((name) => toolDefinition2(name, language)),
       ...next < names.length ? { nextCursor: Buffer.from(`rovloom-tools-v1:${next}`).toString("base64url") } : {}
     };
   });
@@ -504,6 +508,7 @@ function createHttpFacade2(options) {
     const server = createMcpFacade2({
       service: options.service,
       diagnostic: options.diagnostic,
+      ...options.language ? { language: options.language } : {},
       context: {
         resolve: (signal) => {
           const context = scope.getStore();
@@ -539,13 +544,14 @@ function createHttpFacade2(options) {
       return denied(503);
     }
     const host = request.headers.get("host");
-    const loopback = url.origin === origin.origin && host === origin.host;
+    const lanOrigin = options.lan === true && host !== null && Buffer.byteLength(host) <= 2048 && url.protocol === "http:" && host.toLowerCase() !== origin.host.toLowerCase() && host.toLowerCase() !== publicUrl?.host.toLowerCase() ? "http://" + host.toLowerCase() : undefined;
+    const loopback = url.origin === origin.origin && host !== null && host.toLowerCase() === origin.host.toLowerCase();
     const proxied = publicUrl !== undefined && host === publicUrl.host && url.host === publicUrl.host;
-    if (!loopback && !proxied || url.pathname !== "/mcp" || url.search || url.hash) {
+    if (!loopback && !proxied && lanOrigin === undefined || url.pathname !== "/mcp" || url.search || url.hash) {
       return denied(403);
     }
     const requestOrigin = request.headers.get("origin");
-    if (requestOrigin !== null && !allowedOrigins.has(requestOrigin)) {
+    if (requestOrigin !== null && !allowedOrigins.has(requestOrigin) && requestOrigin !== lanOrigin) {
       return denied(403);
     }
     if (!["GET", "POST", "DELETE"].includes(request.method)) {
@@ -763,4 +769,4 @@ function startHttpFacade2(options) {
 
 export { createMcpFacade2, HTTP_BODY_BYTES2, createHttpFacade2, startHttpFacade2 };
 
-//# debugId=70BAA7C73CB4FDA064756E2164756E21
+//# debugId=69C1DCB6911C499664756E2164756E21

package/dist/src/{chunk-6hxy1fcg.js → chunk-bspzg8er.js}

@@ -8,10 +8,10 @@ import {
 import {
   runtimeReference,
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 
 // src/cli/runtime-config.ts
 function providers(config) {