aisc-cli 0.1.1__tar.gz → 0.1.2__tar.gz

{aisc_cli-0.1.1/src/aisc_cli.egg-info → aisc_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aisc-cli
-Version: 0.1.1
+Version: 0.1.2
 Summary: AISC CLI — Super Claude workstation management
 Author: AISC contributors
 License-Expression: MIT
@@ -122,9 +122,10 @@ AISC 尚未代码签名。SmartScreen 提示时，请先确认文件来自项目
 | **火山引擎 Ark** | 兼容 OpenAI 格式；需配置接入点 ID |
 | **智谱 GLM** | GLM-5.2 旗舰模型 |
 | **Kimi** | 月之暗面 Kimi K3 |
-| **Codesome-Group** | 二合一中转；Codex 默认模型 `gpt-5.6-sol`，Claude 侧 `https://v5.codesome.cn/api` |
+| **Codesome V3** | 月卡/按量中转（`sk-` Key，后台建 Key 选分组） |
+| **Codesome 二合一** | V5 月卡中转（`cr-` 卡密即 Key，Claude/GPT 双端通用） |
 
-所有预置供应商的 Codex 上游格式统一为 **OpenAI Responses API（原生直连）**，存量容器在下次启动时自动刷新（用户自定义值不受影响）。
+2.1.12 起（D-6.7）镜像**不再预置**任何 provider 行——以上为「添加 provider」的模板清单（Codesome 置顶默认）。所有模板的 Codex 上游走 S9a 形态（本地路由把 Responses 翻译为 Anthropic Messages，直连模板声明的 Anthropic 端点）；Codesome 两模板的 Claude 侧不含模型键（官方要求，模型由 Key 的服务端分组路由），并预填官方推荐的自动压缩水位（claude 150k / codex 900k）。
 
 ## CLI 使用指南
 
@@ -390,18 +391,18 @@ MIT License，详见 [LICENSE](https://github.com/wangyuncepu/AISC/blob/main/LIC
 
 ### Codesome｜Codex 与 Claude Code 二合一服务
 
-Codesome 提供 API 调用形式的二合一月卡：一张 `cr-...` API Key 可分别接入 Claude Code 和 Codex。这是 API 服务，不是 Claude 或 Codex 成品账号。
+Codesome 提供 API 调用形式的接入服务，有两条产品线：**V3**（Claude/GPT 月卡 + 按量，`sk-...` Key，在后台建 Key 并选分组）与**二合一/V5**（月卡，订单里的 `cr-...` 卡密直接就是 Key，Claude/GPT 双端通用，无分组）。这是 API 服务，不是 Claude 或 Codex 成品账号。
 
-**v2.1.7 起 AISC 镜像已内置 Codesome-Group 预置供应商**——Workbench 的 Providers 页或容器内 cc-switch 选择 Codesome-Group、填入 API Key 即可使用，无需手工配置端点。
+**2.1.12 起内置两个 Codesome 模板**（`codesome-v3` / `codesome-2in1`）——Workbench Providers 页「添加 provider」默认选中 Codesome，选对产品线、填入 Key 即可（表单下方「获取服务」直达注册/购买页）。两条线的地址不可混用，V3 的 `sk-` Key 不能配二合一，反之亦然。
 
-手动配置时的端点（二合一 Key 两端通用，URL 不同不可混用）：
+手动配置时的端点（两线各自两端通用，URL 不同不可混用）：
 
-| 使用端 | API URL |
-| --- | --- |
-| Claude Code / Claude | `https://v5.codesome.cn/api` |
-| Codex / OpenAI 格式客户端 | `https://v5.codesome.cn/openai` |
+| 产品线 | Claude 端 | Codex / OpenAI 格式端 |
+| --- | --- | --- |
+| V3（sk-） | `https://cc.codesome.ai` | `https://cc.codesome.ai/v1` |
+| 二合一（cr-） | `https://v5.codesome.cn/api` | `https://v5.codesome.cn/openai` |
 
-Claude Code 通过 `ANTHROPIC_BASE_URL` 和 `ANTHROPIC_AUTH_TOKEN` 配置；Codex 使用 OpenAI 格式配置。完整教程见 [Codesome 文档](https://doc.codesome.ai/)。
+Claude Code 通过 `ANTHROPIC_BASE_URL` 和 `ANTHROPIC_AUTH_TOKEN` 配置（加 `CLAUDE_CODE_ATTRIBUTION_HEADER=0`，官方核心三行之一）；Codex 使用 OpenAI 格式配置（模型统一 `gpt-5.6-terra`）。可选：自动压缩（claude `CLAUDE_AUTO_COMPACT_WINDOW`，codex `model_auto_compact_token_limit`）到值自动压缩历史。完整教程见 [Codesome 文档](https://doc.codesome.ai/)。
 
 购买与开通（注册/下单入口，非服务使用地址）：
 

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/README.md

@@ -91,9 +91,10 @@ AISC 尚未代码签名。SmartScreen 提示时，请先确认文件来自项目
 | **火山引擎 Ark** | 兼容 OpenAI 格式；需配置接入点 ID |
 | **智谱 GLM** | GLM-5.2 旗舰模型 |
 | **Kimi** | 月之暗面 Kimi K3 |
-| **Codesome-Group** | 二合一中转；Codex 默认模型 `gpt-5.6-sol`，Claude 侧 `https://v5.codesome.cn/api` |
+| **Codesome V3** | 月卡/按量中转（`sk-` Key，后台建 Key 选分组） |
+| **Codesome 二合一** | V5 月卡中转（`cr-` 卡密即 Key，Claude/GPT 双端通用） |
 
-所有预置供应商的 Codex 上游格式统一为 **OpenAI Responses API（原生直连）**，存量容器在下次启动时自动刷新（用户自定义值不受影响）。
+2.1.12 起（D-6.7）镜像**不再预置**任何 provider 行——以上为「添加 provider」的模板清单（Codesome 置顶默认）。所有模板的 Codex 上游走 S9a 形态（本地路由把 Responses 翻译为 Anthropic Messages，直连模板声明的 Anthropic 端点）；Codesome 两模板的 Claude 侧不含模型键（官方要求，模型由 Key 的服务端分组路由），并预填官方推荐的自动压缩水位（claude 150k / codex 900k）。
 
 ## CLI 使用指南
 
@@ -359,18 +360,18 @@ MIT License，详见 [LICENSE](https://github.com/wangyuncepu/AISC/blob/main/LIC
 
 ### Codesome｜Codex 与 Claude Code 二合一服务
 
-Codesome 提供 API 调用形式的二合一月卡：一张 `cr-...` API Key 可分别接入 Claude Code 和 Codex。这是 API 服务，不是 Claude 或 Codex 成品账号。
+Codesome 提供 API 调用形式的接入服务，有两条产品线：**V3**（Claude/GPT 月卡 + 按量，`sk-...` Key，在后台建 Key 并选分组）与**二合一/V5**（月卡，订单里的 `cr-...` 卡密直接就是 Key，Claude/GPT 双端通用，无分组）。这是 API 服务，不是 Claude 或 Codex 成品账号。
 
-**v2.1.7 起 AISC 镜像已内置 Codesome-Group 预置供应商**——Workbench 的 Providers 页或容器内 cc-switch 选择 Codesome-Group、填入 API Key 即可使用，无需手工配置端点。
+**2.1.12 起内置两个 Codesome 模板**（`codesome-v3` / `codesome-2in1`）——Workbench Providers 页「添加 provider」默认选中 Codesome，选对产品线、填入 Key 即可（表单下方「获取服务」直达注册/购买页）。两条线的地址不可混用，V3 的 `sk-` Key 不能配二合一，反之亦然。
 
-手动配置时的端点（二合一 Key 两端通用，URL 不同不可混用）：
+手动配置时的端点（两线各自两端通用，URL 不同不可混用）：
 
-| 使用端 | API URL |
-| --- | --- |
-| Claude Code / Claude | `https://v5.codesome.cn/api` |
-| Codex / OpenAI 格式客户端 | `https://v5.codesome.cn/openai` |
+| 产品线 | Claude 端 | Codex / OpenAI 格式端 |
+| --- | --- | --- |
+| V3（sk-） | `https://cc.codesome.ai` | `https://cc.codesome.ai/v1` |
+| 二合一（cr-） | `https://v5.codesome.cn/api` | `https://v5.codesome.cn/openai` |
 
-Claude Code 通过 `ANTHROPIC_BASE_URL` 和 `ANTHROPIC_AUTH_TOKEN` 配置；Codex 使用 OpenAI 格式配置。完整教程见 [Codesome 文档](https://doc.codesome.ai/)。
+Claude Code 通过 `ANTHROPIC_BASE_URL` 和 `ANTHROPIC_AUTH_TOKEN` 配置（加 `CLAUDE_CODE_ATTRIBUTION_HEADER=0`，官方核心三行之一）；Codex 使用 OpenAI 格式配置（模型统一 `gpt-5.6-terra`）。可选：自动压缩（claude `CLAUDE_AUTO_COMPACT_WINDOW`，codex `model_auto_compact_token_limit`）到值自动压缩历史。完整教程见 [Codesome 文档](https://doc.codesome.ai/)。
 
 购买与开通（注册/下单入口，非服务使用地址）：
 

aisc_cli-0.1.2/src/aisc/VERSION

@@ -0,0 +1 @@
+0.1.2

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/src/aisc/application/cc_switch_provider.py

@@ -21,7 +21,7 @@ from aisc.domain.models import CliError, RuntimeExitCode
 PROTOCOL = "aisc.cc-switch-provider/v1"
 _ADAPTER_PATH = "/usr/local/bin/aisc-cc-provider"
 _AGENTS = ("claude", "codex")
-_OPS = ("list", "add", "edit", "switch", "delete", "fetch-models")
+_OPS = ("list", "add", "edit", "switch", "delete", "fetch-models", "templates")
 
 
 def _validate(runtime_id: str, agent: str, op: str) -> None:
@@ -161,6 +161,25 @@ def list_providers(runtime_id: str, agent: str, workspace: Optional[str], execut
             "operation_id": envelope.get("operation_id")}
 
 
+def list_templates(runtime_id: str, agent: str, workspace: Optional[str],
+                   executor: Any) -> Dict[str, Any]:
+    """D-6.8: the add-provider template manifest (adapter `templates` op).
+
+    The op itself is agent-less; the transport keeps the uniform --agent
+    argument (validated, then ignored inside the adapter)."""
+    from aisc.application.data_root import workspace_state_dir
+    from pathlib import Path
+
+    ws_path = Path(workspace).resolve() if workspace else Path.cwd()
+    _validate(runtime_id, agent, "templates")
+    envelope = _exec_adapter(
+        runtime_id, workspace_state_dir(ws_path), executor, "templates", agent,
+        None, None,
+    )
+    return {"agent": agent, "templates": envelope.get("templates") or [],
+            "operation_id": envelope.get("operation_id")}
+
+
 def add_provider(runtime_id: str, agent: str, request: Dict[str, Any],
                  workspace: Optional[str], executor: Any) -> Dict[str, Any]:
     from aisc.application.data_root import workspace_state_dir

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/src/aisc/application/docker_lifecycle.py

@@ -31,6 +31,7 @@ Stage C wires the installers' rebuild flow.
 from __future__ import annotations
 
 import json
+import re
 from pathlib import Path
 from typing import Any, Dict, Iterable, List, Optional, Tuple
 
@@ -541,6 +542,374 @@ def _log_tail(stdout: str, lines: int = 20) -> str:
 
 CACHE_USAGE_SCHEMA = "aisc.docker-cache-usage/v1"
 CACHE_CLEANUP_SCHEMA = "aisc.docker-cache-cleanup/v1"
+CACHE_INSPECT_SCHEMA = "aisc.docker-cache-inspect/v1"
+
+
+# --- v2.1.13 (docker-scan-fidelity): read-only per-resource inspection -----
+#
+# D-2 (2026-09-19): detect FINER and report ACCURATELY; never clean anything
+# automatically, never add new prune paths. Primary size/detail source is
+# `docker system df -v --format json` (Docker 29.x returns structured
+# per-item JSON there — verified on 29.8.0; officially undocumented, so
+# callers must tolerate absence). Fallbacks degrade per-category and mark
+# rows unknown; nothing here blocks anything else.
+#
+# Accuracy notes (the "更准确" half):
+# - Image RECLAIMABLE aggregates over-count shared layers; the accurate
+#   per-image figure is UNIQUE SIZE, summed over images with Containers==0.
+# - `image prune` (no -a) only ever removes DANGLING images, so rows also
+#   carry will_be_cleaned to show what the CURRENT manual cleanup would hit.
+# - Build cache has no Reclaimable boolean in df -v; it is derived from
+#   InUse. buildx du (fallback) carries it natively.
+
+_SIZE_UNITS: Dict[str, int] = {
+    "": 1, "B": 1,
+    "K": 10**3, "KI": 2**10,
+    "M": 10**6, "MI": 2**20,
+    "G": 10**9, "GI": 2**30,
+    "T": 10**12, "TI": 2**40,
+}
+
+
+def _size_bytes(value: Any) -> Optional[int]:
+    """Best-effort docker size strings (`35.6 kB`, `1.2GB`, ints) → bytes.
+    None for N/A / unparseable — the row is reported as unknown."""
+    if value is None:
+        return None
+    if isinstance(value, (int, float)):
+        return int(value)
+    s = str(value).strip()
+    if not s or s.upper() in ("N/A", "UNKNOWN"):
+        return None
+    m = re.match(r"^([\d.]+)\s*([A-Za-z]*)$", s)
+    if not m:
+        return None
+    try:
+        num = float(m.group(1))
+    except ValueError:
+        return None
+    unit = m.group(2).upper().rstrip("B") if m.group(2) else ""
+    if unit not in _SIZE_UNITS:
+        return None
+    return int(num * _SIZE_UNITS[unit])
+
+
+def _container_rw_size(value: Any) -> Optional[int]:
+    """`ps -s` size strings: `35.6 kB (virtual 109 MB)` → writable layer."""
+    if value is None:
+        return None
+    head = str(value).split("(virtual")[0].strip()
+    return _size_bytes(head)
+
+
+def _json_lines(stdout: str) -> List[Dict[str, Any]]:
+    out: List[Dict[str, Any]] = []
+    for line in (stdout or "").splitlines():
+        line = line.strip()
+        if not line.startswith("{"):
+            continue
+        try:
+            row = json.loads(line)
+        except ValueError:
+            continue
+        if isinstance(row, dict):
+            out.append(row)
+    return out
+
+
+def _df_verbose(executor: Any) -> Optional[Dict[str, Any]]:
+    """`docker system df -v --format json` → {Images, Containers, Volumes,
+    BuildCache} (no Networks section). None when unavailable."""
+    try:
+        result = executor.run_captured(
+            ["system", "df", "-v", "--format", "json"], timeout=60.0
+        )
+    except Exception:
+        return None
+    if getattr(result, "exit_code", 1) != 0:
+        return None
+    text = (result.stdout or "").strip()
+    if not text:
+        return None
+    try:
+        doc = json.loads(text)
+        if isinstance(doc, dict):
+            return doc
+    except ValueError:
+        pass
+    merged: Dict[str, Any] = {}
+    for row in _json_lines(text):
+        merged.update(row)
+    return merged or None
+
+
+def _buildx_du(executor: Any) -> Optional[List[Dict[str, Any]]]:
+    """`docker buildx du --format json` (NDJSON records). None when the
+    buildx plugin is absent/old (Docker Desktop's `docker builder` aliases
+    to buildx; classic CLIs lack du entirely)."""
+    try:
+        result = executor.run_captured(
+            ["buildx", "du", "--format", "json"], timeout=60.0
+        )
+    except Exception:
+        return None
+    if getattr(result, "exit_code", 1) != 0:
+        return None
+    rows = _json_lines(result.stdout or "")
+    return rows or None
+
+
+def _images_rows(executor: Any, df_v: Optional[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Image rows. df -v Images is the ONLY real Unique/Shared source on
+    Docker 29 (image ls --format json reports N/A placeholders there); the
+    ls pass adds dangling classification for older daemons. Reclaimable =
+    Σ UniqueSize over images with no containers; dangling is the subset the
+    current manual cleanup would remove (its 24h age filter is NOT applied
+    per-row — the disclaimer says so)."""
+    rows: List[Dict[str, Any]] = []
+    ls = executor.run_captured(["images", "--format", "{{json .}}"], timeout=30.0)
+    fallback: List[Dict[str, Any]] = []
+    if getattr(ls, "exit_code", 1) == 0:
+        for row in _json_lines(ls.stdout or ""):
+            repo = str(row.get("Repository") or "")
+            fallback.append({
+                "id": str(row.get("ID") or ""),
+                "name": f"{repo}:{row.get('Tag')}",
+                "in_use": None,
+                "dangling": repo == "<none>",
+                "size": row.get("Size"),
+                "size_bytes": _size_bytes(row.get("Size")),
+                "unique_size": None,
+                "shared": None,
+                "reclaimable_bytes": None,
+                "will_be_cleaned": repo == "<none>",
+            })
+    dv = (df_v or {}).get("Images")
+    if not isinstance(dv, list) or not dv:
+        return fallback
+    for row in dv:
+        if not isinstance(row, dict):
+            continue
+        containers = str(row.get("Containers") or "").strip()
+        in_use = containers not in ("", "0", "N/A")
+        repo = str(row.get("Repository") or "")
+        dangling = repo == "<none>"
+        unique = _size_bytes(row.get("UniqueSize"))
+        rows.append({
+            "id": str(row.get("ID") or ""),
+            "name": f"{repo}:{row.get('Tag')}",
+            "in_use": in_use,
+            "dangling": dangling,
+            "size": row.get("Size"),
+            "size_bytes": _size_bytes(row.get("Size")),
+            "unique_size": row.get("UniqueSize"),
+            # SharedSize is a display STRING (e.g. "326.5MB") - it must never
+            # ride the boolean shared field (2.1.13 hand-test: the string
+            # made the Rust serde drop the whole images category).
+            "shared": None,
+            "reclaimable_bytes": (0 if in_use else unique),
+            "will_be_cleaned": dangling,
+        })
+    return rows
+
+
+def _container_rows(executor: Any) -> List[Dict[str, Any]]:
+    """Stopped containers' writable layers are the reclaimable part; running
+    ones report unknown (they cannot be reclaimed without stopping)."""
+    ps = executor.run_captured(
+        ["ps", "-a", "--size", "--format", "{{json .}}"], timeout=30.0
+    )
+    rows: List[Dict[str, Any]] = []
+    if getattr(ps, "exit_code", 1) != 0:
+        return rows
+    for row in _json_lines(ps.stdout or ""):
+        names = row.get("Names") or row.get("Name") or ""
+        name = ", ".join(str(n) for n in names) if isinstance(names, list) else str(names)
+        state = str(row.get("State") or "")
+        running = state == "running"
+        rw = _container_rw_size(row.get("Size"))
+        rows.append({
+            "id": str(row.get("ID") or ""),
+            "name": name,
+            "image": str(row.get("Image") or ""),
+            "state": state,
+            "size": row.get("Size"),
+            "size_bytes": None if running else _container_rw_size(row.get("Size")),
+            "in_use": running,
+            "reclaimable_bytes": (None if running else rw),
+            "will_be_cleaned": False,  # AISC never removes user containers here
+        })
+    return rows
+
+
+def _volume_rows(executor: Any) -> List[Dict[str, Any]]:
+    """Named/anonymous × in-use/dangling. Sizes stay unknown by default
+    (per-volume du can take minutes); AISC NEVER deletes volumes (02 §5) —
+    every row is will_be_cleaned=False and the UI says so."""
+    ls = executor.run_captured(["volume", "ls", "--format", "{{json .}}"], timeout=30.0)
+    if getattr(ls, "exit_code", 1) != 0:
+        return []
+    dang = executor.run_captured(
+        ["volume", "ls", "--filter", "dangling=true", "--format", "{{json .}}"],
+        timeout=30.0,
+    )
+    dangling: set = set()
+    if getattr(dang, "exit_code", 1) == 0:
+        for row in _json_lines(dang.stdout or ""):
+            name = str(row.get("Name") or "")
+            if name:
+                dangling.add(name)
+    rows: List[Dict[str, Any]] = []
+    for row in _json_lines(ls.stdout or ""):
+        name = str(row.get("Name") or "")
+        if not name:
+            continue
+        rows.append({
+            "id": name,
+            "name": name,
+            "dangling": name in dangling,
+            "in_use": name not in dangling,
+            "size": row.get("Size"),
+            "size_bytes": _size_bytes(row.get("Size")),
+            "reclaimable_bytes": None,  # volumes are never reclaimed by AISC
+            "will_be_cleaned": False,
+        })
+    return rows
+
+
+def _cache_rows(executor: Any, df_v: Optional[Dict[str, Any]]) -> Tuple[List[Dict[str, Any]], bool]:
+    """Build-cache rows + whether the buildx fallback ran. Primary: df -v
+    BuildCache (daemon-wide, deduped; Reclaimable derived from InUse).
+    Fallback: buildx du (Reclaimable natively; single builder)."""
+    rows: List[Dict[str, Any]] = []
+    dv = (df_v or {}).get("BuildCache")
+    if isinstance(dv, list) and dv:
+        for row in dv:
+            if not isinstance(row, dict):
+                continue
+            in_use = bool(row.get("InUse"))
+            size_bytes = _size_bytes(row.get("Size"))
+            rows.append({
+                "id": str(row.get("ID") or ""),
+                "kind": str(row.get("CacheType") or row.get("Type") or ""),
+                "in_use": in_use,
+                "shared": bool(row.get("Shared")),
+                "size": row.get("Size"),
+                "size_bytes": size_bytes,
+                "reclaimable_bytes": (0 if in_use else (size_bytes or 0)),
+                "will_be_cleaned": not in_use,
+                "last_used_at": row.get("LastUsedAt"),
+                "usage_count": row.get("UsageCount"),
+            })
+        return rows, False
+    bx = _buildx_du(executor)
+    if bx is not None:
+        for row in bx:
+            reclaimable = bool(row.get("Reclaimable"))
+            size_bytes = _size_bytes(row.get("Size"))
+            rows.append({
+                "id": str(row.get("ID") or ""),
+                "kind": str(row.get("Type") or row.get("CacheType") or ""),
+                "in_use": not reclaimable,
+                "shared": bool(row.get("Shared")),
+                "size": row.get("Size"),
+                "size_bytes": size_bytes,
+                "reclaimable_bytes": ((size_bytes or 0) if reclaimable else 0),
+                "will_be_cleaned": reclaimable,
+                "last_used_at": row.get("LastUsedAt"),
+                "usage_count": row.get("UsageCount"),
+            })
+        return rows, True
+    return rows, False
+
+
+def _network_rows(executor: Any) -> List[Dict[str, Any]]:
+    """Networks are 0-byte; only the count/reference picture matters."""
+    ls = executor.run_captured(["network", "ls", "--format", "{{json .}}"], timeout=30.0)
+    rows: List[Dict[str, Any]] = []
+    if getattr(ls, "exit_code", 1) != 0:
+        return rows
+    for row in _json_lines(ls.stdout or ""):
+        name = str(row.get("Name") or "")
+        if not name:
+            continue
+        rows.append({
+            "id": name,
+            "name": name,
+            "kind": str(row.get("Driver") or ""),
+            "in_use": None,  # reference counting rides the containers pass
+            "size_bytes": 0,
+            "reclaimable_bytes": 0,
+            "will_be_cleaned": False,
+        })
+    return rows
+
+
+def _category_summary(rows: List[Dict[str, Any]]) -> Dict[str, Any]:
+    reclaimable = 0
+    unknown = 0
+    for row in rows:
+        value = row.get("reclaimable_bytes")
+        if value is None:
+            unknown += 1
+        else:
+            reclaimable += int(value)
+    return {
+        "count": len(rows),
+        "reclaimable_bytes": reclaimable,
+        "unknown_count": unknown,
+    }
+
+
+def cache_inspect(executor: Any, *, cleanup_min_age_hours: int = 24) -> Dict[str, Any]:
+    """Read-only per-resource inspection (D-2). Detects images / containers /
+    volumes / build cache / networks item-by-item, reports the deduped
+    (UNIQUE-size) reclaimable picture, and flags what the CURRENT manual
+    cleanup would hit. Absolutely no prune/rmi/rm anywhere in here, and no
+    caller ever chains this into cleanup."""
+    df = _system_df(executor)
+    docker_available = bool(df)
+    warnings: List[str] = []
+    df_v: Optional[Dict[str, Any]] = None
+    buildx_used = False
+    if docker_available:
+        df_v = _df_verbose(executor)
+        if df_v is None:
+            warnings.append("df-verbose-json-unavailable")
+        buildx_used = _buildx_du(executor) is None
+    images = _images_rows(executor, df_v)
+    containers = _container_rows(executor)
+    volumes = _volume_rows(executor)
+    cache_rows, buildx_used = _cache_rows(executor, df_v)
+    networks = _network_rows(executor)
+
+    def cat(rows: List[Dict[str, Any]]) -> Dict[str, Any]:
+        return {"rows": rows, "summary": _category_summary(rows)}
+
+    return {
+        "schema_version": CACHE_INSPECT_SCHEMA,
+        "action": "cache-inspect",
+        "docker_available": docker_available,
+        "categories": {
+            "images": cat(images),
+            "containers": cat(containers),
+            "volumes": cat(volumes),
+            "build_cache": cat(cache_rows),
+            "networks": cat(networks),
+        },
+        "capabilities": {
+            "df_verbose_json": df_v is not None,
+            "buildx_du": buildx_used,
+        },
+        "cleanup_min_age_hours": cleanup_min_age_hours,
+        "warnings": warnings,
+        "disclaimer": (
+            "Reclaimable figures are estimates (UNIQUE-size based, deduped); "
+            "actual freed space can be lower. will_be_cleaned approximates "
+            "the current manual cleanup (dangling images / not-in-use build "
+            "cache) without its age filter."
+        ),
+    }
 
 
 def _cache_cleanup_argv(kind: str, min_age_hours: int) -> List[str]:

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/src/aisc/application/update.py

@@ -182,7 +182,12 @@ def perform_update(
 
     ``workdir`` overrides the exe directory (tests). Raises UpdateError /
     BundleFetchError fail-closed; nothing is replaced unless every check
-    passed."""
+    passed.
+
+    D-8 (2026-09-19): releases no longer ship CLI archives — the NSIS
+    installer IS the CLI+UI update channel for frozen installs, and pip is
+    the other. The download path therefore only works with an explicit
+    ``--from-file`` archive (manual/offline updates)."""
     import hashlib
 
     if form["form"] == "pip":
@@ -202,8 +207,19 @@ def perform_update(
             UPDATE_ERROR_STATE,
             "no final release published yet — nothing to update to "
             "(explicit --version <ver> to force)")
-    if not version and _version_key(target) <= _version_key(cli_version):
+    if not from_file and not version and _version_key(target) <= _version_key(cli_version):
         return {"status": "up-to-date", "cli_version": cli_version, "latest_final": target}
+    # D-8 (2026-09-19): releases no longer ship CLI archives. The online
+    # sidecar-swap is retired — NSIS installs update the CLI with the
+    # Workbench, pip installs via pip. Manual/offline updates keep working
+    # through --from-file.
+    if not from_file:
+        raise UpdateError(
+            UPDATE_ERROR_USAGE,
+            "aisc update no longer downloads CLI archives (releases ship "
+            "the Workbench installer only). Update paths: pip install -U "
+            "aisc-cli · Workbench 检查更新（自带最新 CLI）· or --from-file "
+            "<archive> --sha256 <hex> for a manual archive")
 
     exe = Path(form["exe"]) if not workdir else workdir / Path(form["exe"]).name
     exe_dir = exe.parent

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/src/aisc/cli/commands/cc_switch.py

@@ -55,6 +55,18 @@ def cmd_cc_switch_list(args: Any) -> Dict[str, Any]:
     )
 
 
+def cmd_cc_switch_templates(args: Any) -> Dict[str, Any]:
+    """D-6.8: the add-provider template manifest (agent-less adapter op)."""
+    from aisc.application.cc_switch_provider import list_templates
+
+    return list_templates(
+        runtime_id=args.runtime_id,
+        agent=args.agent,
+        workspace=args.workspace,
+        executor=None,
+    )
+
+
 def cmd_cc_switch_add(args: Any) -> Dict[str, Any]:
     from aisc.application.cc_switch_provider import add_provider
 

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/src/aisc/cli/commands/run.py

@@ -155,12 +155,6 @@ def plan_run(
 # Run result (structured outcome)
 # ---------------------------------------------------------------------------
 
-def _name_series(container_name: str) -> str:
-    """Container names are ``<alias>-<hash8>``; the alias may itself contain
-    dashes, the hash never does — strip the last segment to get the series
-    (rename detection keys off it, r2 #C)."""
-    return container_name.rsplit("-", 1)[0]
-
 
 @dataclass
 class RunResult:
@@ -177,9 +171,6 @@ class RunResult:
     # r1 #2: older same-workspace containers this activation swept
     # (stopped+removed+unregistered before the new one started).
     replaced: List[str] = field(default_factory=list)
-    # r1 #2 (revised): a LIVE same-workspace container was REUSED — nothing
-    # was started; the summary tells the user it is already open.
-    reused: Optional[str] = None
 
     def to_dict(self) -> Dict[str, Any]:
         out = {
@@ -194,8 +185,6 @@ class RunResult:
             out["web_gateway"] = dict(self.web_gateway)
         if self.replaced:
             out["replaced"] = list(self.replaced)
-        if self.reused:
-            out["reused"] = self.reused
         return out
 
 
@@ -353,21 +342,21 @@ def run_container(
         )
     # EXISTS → proceed
 
-    # --- r1 #2 (revised) + r2 #C: same-workspace activation is IDEMPOTENT;
-    # a DIFFERENT --name is a rename intent and rebuilds ---
-    # A default (label-less) activation owns the workspace's single CLI
-    # slot. A LIVE older container of the SAME name series is REUSED — the
-    # user chose to run a workspace that is already open, so tell them
-    # (and how to reach or rebuild it) instead of churning containers under
-    # them. A live container of a DIFFERENT series (explicit --name that
-    # disagrees with the existing one) is a rename: rebuild under the new
-    # name (alias and container name must stay one story). Only DEAD ones
-    # (Exited/gone — nobody is using them) are swept (stop+rm+unregister)
-    # before the new start. GUI runtimes (owner=workbench, lease-guarded)
-    # and --label multi-container slots are never touched. If docker does
-    # not answer the liveness probe, judge nothing: fall through to the
-    # normal start path rather than risk tearing down a live container we
-    # could not see.
+    # --- r1 #2 + r2 #C, revised 2026-09-19 (cli-run-guard): `aisc run` is
+    # FORBIDDEN while a live container exists for this workspace. Previously
+    # a live same-series container was silently reused, a rename intent
+    # rebuilt around live containers, and workbench-owned runtimes were
+    # bypassed (stacking a one-shot on top of a managed runtime). Now any
+    # LIVE label-less container of this workspace (CLI- or workbench-owned,
+    # any name series) refuses the run with guidance. DEAD CLI-owned
+    # containers are still swept (stop+rm+unregister) before the new start —
+    # sweeping a dead different-series container is the rename path (r2 #C).
+    # Dead workbench singletons stay untouched (the Workbench/reconcile owns
+    # their lifecycle). --label slots remain a bypass activation: neither
+    # checked nor touched. If docker does not answer the liveness probe,
+    # judge nothing: fall through to the normal start path rather than risk
+    # tearing down a live container we could not see.
+    live_blockers: List[tuple] = []
     if not plan.dry_run and not plan.label:
         from aisc.adapters.container_registry import list_containers as _lc
         from aisc.adapters.container_registry import unregister
@@ -386,8 +375,6 @@ def run_container(
                         _states[_nm2] = _st
                 for _nm, _meta in _lc(_reg).items():
                     _meta = _meta if isinstance(_meta, dict) else {}
-                    if _meta.get("owner") == "workbench":
-                        continue
                     if _meta.get("label"):
                         continue
                     try:
@@ -395,13 +382,16 @@ def run_container(
                             continue
                     except OSError:
                         continue
-                    if (_states.get(str(_nm), "").startswith("Up")
-                            and _name_series(str(_nm)) == _name_series(plan.name)):
-                        if result.reused is None:
-                            result.reused = str(_nm)
+                    if (_states.get(str(_nm), "") or "").startswith("Up"):
+                        live_blockers.append(
+                            (str(_nm), str(_meta.get("owner") or "cli")))
+                        continue
+                    if _meta.get("owner") == "workbench":
+                        # dead GUI singleton: the Workbench/reconcile owns its
+                        # lifecycle — never swept from the CLI path
                         continue
-                    # dead, unknown-to-docker, or a different name series
-                    # (rename intent) → sweep and rebuild
+                    # dead or unknown-to-docker CLI-owned (any series — a
+                    # different series is the rename path) → sweep and rebuild
                     exec_.run_captured(["stop", _nm], timeout=30.0)
                     _rm = exec_.run_captured(["rm", "-f", _nm], timeout=30.0)
                     if _rm.exit_code == 0 or "no such" in (_rm.stderr or "").lower():
@@ -413,9 +403,21 @@ def run_container(
         except Exception:
             pass
 
-    if result.reused is not None:
-        result.executed = False
-        return result
+    if live_blockers:
+        # raise OUTSIDE the sweeping try/except — a CliError must not be
+        # swallowed by the best-effort guard above
+        _nm, _owner = live_blockers[0]
+        _who = "Workbench 管理的运行时" if _owner == "workbench" else "容器"
+        raise CliError(
+            message=(
+                f"该工作区已存在运行中的{_who}「{_nm}」，aisc run 禁止重复创建。\n"
+                f"  进入容器: aisc claude / aisc codex / aisc shell\n"
+                f"  生命周期: aisc runtime stop（或 Workbench）停止后再运行\n"
+                f"  多实例: aisc run --label <槽位名>"
+            ),
+            exit_code=6, error_code="AISC_ERR_CONTAINER_EXISTS",
+            data=result.to_dict(),
+        )
 
     # --- register container in the multi-container index ---
     # F2-C: the registry root is the WORKSPACE's state dir (workspaces/<h>/

{aisc_cli-0.1.1 → aisc_cli-0.1.2}/src/aisc/cli/main.py

@@ -347,6 +347,13 @@ def _build_parser() -> _AiscArgumentParser:
                      help="Additionally emit the FULL api_key of this provider "
                           "(edit-time explicit view, 2.1.11 P1)")
 
+    # D-6.8 (2.1.12): the add-provider template manifest (agent-less op;
+    # --agent stays required for transport uniformity and is ignored).
+    cst = cssub.add_parser("templates",
+                           help="Emit the add-provider template manifest",
+                           allow_abbrev=False)
+    _cc_switch_common(cst)
+
     csa = cssub.add_parser("add", help="Add a provider (request JSON on stdin)",
                            allow_abbrev=False)
     _cc_switch_common(csa)
@@ -516,6 +523,10 @@ def _build_parser() -> _AiscArgumentParser:
     mtu = mtsub.add_parser("cache-usage", help="Read-only docker system df summary",
                            allow_abbrev=False)
     _add_global_args(mtu, is_subparser=True)
+    mtci = mtsub.add_parser("cache-inspect",
+                            help="Read-only per-item Docker resource inspection (D-2)",
+                            allow_abbrev=False)
+    _add_global_args(mtci, is_subparser=True)
 
     mtcc = mtsub.add_parser("cache-cleanup",
                             help="Prune builder cache + dangling images (until-filtered)",
@@ -1423,12 +1434,6 @@ def _cmd_run(
     ]
 
     if effective_format == "text" and emitter is None:
-        if out.get("reused"):
-            print(f"ℹ 工作区已在运行中: {plan.workspace}")
-            print(f"  容器 {out['reused']}（Up） · 复用现有容器，未新建")
-            print("  进入方式: aisc claude | aisc codex | aisc switch | aisc shell")
-            print("  如需重建: 先 aisc stop 再重新 aisc run")
-            return out, 0, []
         print(f"💯 工作区已激活: {plan.workspace}")
         print(f"  容器 {plan.name}（detached） · 镜像 {plan.image} · 网络 {plan.network}")
         if out.get("replaced"):
@@ -1726,6 +1731,8 @@ def _cmd_cc_switch(
     sub = getattr(args, "cc_switch_command", None)
     if sub == "list":
         data = cs_cmd.cmd_cc_switch_list(args)
+    elif sub == "templates":
+        data = cs_cmd.cmd_cc_switch_templates(args)
     elif sub == "add":
         data = cs_cmd.cmd_cc_switch_add(args)
     elif sub == "edit":
@@ -1954,6 +1961,10 @@ def _cmd_maintenance(
     if sub == "cache-usage":
         from aisc.application.docker_lifecycle import cache_usage
         return cache_usage(executor), 0, []
+    if sub == "cache-inspect":
+        # D-2 read-only per-item inspection — never chained into cleanup
+        from aisc.application.docker_lifecycle import cache_inspect
+        return cache_inspect(executor), 0, []
     if sub == "cache-cleanup":
         from aisc.application.docker_lifecycle import docker_cache_cleanup
         data = docker_cache_cleanup(executor, min_age_hours=args.min_age_hours)

{aisc_cli-0.1.1 → aisc_cli-0.1.2/src/aisc_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aisc-cli
-Version: 0.1.1
+Version: 0.1.2
 Summary: AISC CLI — Super Claude workstation management
 Author: AISC contributors
 License-Expression: MIT
@@ -122,9 +122,10 @@ AISC 尚未代码签名。SmartScreen 提示时，请先确认文件来自项目
 | **火山引擎 Ark** | 兼容 OpenAI 格式；需配置接入点 ID |
 | **智谱 GLM** | GLM-5.2 旗舰模型 |
 | **Kimi** | 月之暗面 Kimi K3 |
-| **Codesome-Group** | 二合一中转；Codex 默认模型 `gpt-5.6-sol`，Claude 侧 `https://v5.codesome.cn/api` |
+| **Codesome V3** | 月卡/按量中转（`sk-` Key，后台建 Key 选分组） |
+| **Codesome 二合一** | V5 月卡中转（`cr-` 卡密即 Key，Claude/GPT 双端通用） |
 
-所有预置供应商的 Codex 上游格式统一为 **OpenAI Responses API（原生直连）**，存量容器在下次启动时自动刷新（用户自定义值不受影响）。
+2.1.12 起（D-6.7）镜像**不再预置**任何 provider 行——以上为「添加 provider」的模板清单（Codesome 置顶默认）。所有模板的 Codex 上游走 S9a 形态（本地路由把 Responses 翻译为 Anthropic Messages，直连模板声明的 Anthropic 端点）；Codesome 两模板的 Claude 侧不含模型键（官方要求，模型由 Key 的服务端分组路由），并预填官方推荐的自动压缩水位（claude 150k / codex 900k）。
 
 ## CLI 使用指南
 
@@ -390,18 +391,18 @@ MIT License，详见 [LICENSE](https://github.com/wangyuncepu/AISC/blob/main/LIC
 
 ### Codesome｜Codex 与 Claude Code 二合一服务
 
-Codesome 提供 API 调用形式的二合一月卡：一张 `cr-...` API Key 可分别接入 Claude Code 和 Codex。这是 API 服务，不是 Claude 或 Codex 成品账号。
+Codesome 提供 API 调用形式的接入服务，有两条产品线：**V3**（Claude/GPT 月卡 + 按量，`sk-...` Key，在后台建 Key 并选分组）与**二合一/V5**（月卡，订单里的 `cr-...` 卡密直接就是 Key，Claude/GPT 双端通用，无分组）。这是 API 服务，不是 Claude 或 Codex 成品账号。
 
-**v2.1.7 起 AISC 镜像已内置 Codesome-Group 预置供应商**——Workbench 的 Providers 页或容器内 cc-switch 选择 Codesome-Group、填入 API Key 即可使用，无需手工配置端点。
+**2.1.12 起内置两个 Codesome 模板**（`codesome-v3` / `codesome-2in1`）——Workbench Providers 页「添加 provider」默认选中 Codesome，选对产品线、填入 Key 即可（表单下方「获取服务」直达注册/购买页）。两条线的地址不可混用，V3 的 `sk-` Key 不能配二合一，反之亦然。
 
-手动配置时的端点（二合一 Key 两端通用，URL 不同不可混用）：
+手动配置时的端点（两线各自两端通用，URL 不同不可混用）：
 
-| 使用端 | API URL |
-| --- | --- |
-| Claude Code / Claude | `https://v5.codesome.cn/api` |
-| Codex / OpenAI 格式客户端 | `https://v5.codesome.cn/openai` |
+| 产品线 | Claude 端 | Codex / OpenAI 格式端 |
+| --- | --- | --- |
+| V3（sk-） | `https://cc.codesome.ai` | `https://cc.codesome.ai/v1` |
+| 二合一（cr-） | `https://v5.codesome.cn/api` | `https://v5.codesome.cn/openai` |
 
-Claude Code 通过 `ANTHROPIC_BASE_URL` 和 `ANTHROPIC_AUTH_TOKEN` 配置；Codex 使用 OpenAI 格式配置。完整教程见 [Codesome 文档](https://doc.codesome.ai/)。
+Claude Code 通过 `ANTHROPIC_BASE_URL` 和 `ANTHROPIC_AUTH_TOKEN` 配置（加 `CLAUDE_CODE_ATTRIBUTION_HEADER=0`，官方核心三行之一）；Codex 使用 OpenAI 格式配置（模型统一 `gpt-5.6-terra`）。可选：自动压缩（claude `CLAUDE_AUTO_COMPACT_WINDOW`，codex `model_auto_compact_token_limit`）到值自动压缩历史。完整教程见 [Codesome 文档](https://doc.codesome.ai/)。
 
 购买与开通（注册/下单入口，非服务使用地址）：
 

aisc_cli-0.1.1/src/aisc/VERSION

@@ -1 +0,0 @@
-0.1.1