licos-platform-cli 0.5.1__tar.gz → 0.6.0__tar.gz

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.5
 Name: licos-platform-cli
-Version: 0.5.1
+Version: 0.6.0
 Summary: LICOS platform CLI
 Requires-Python: >=3.10
-Requires-Dist: licos-platform-sdk>=0.6.1
+Requires-Dist: licos-platform-sdk>=0.7.0
 Description-Content-Type: text/markdown
 
 # licos-platform-cli
@@ -18,7 +18,7 @@ licos-platform user me --workspace-id <执行工作空间ID>
 licos-platform help user me
 ```
 
-默认由可信运行时注入 `LICOS_CURRENT_USER_ID`，平台地址、服务凭证和项目工作空间沿用运行时配置。
+用户接口默认使用 `LICOS_CURRENT_USER_ID` 指定的容器执行用户换取 Token。它不代表网页登录者。平台地址、服务凭证和项目工作空间沿用运行时配置。
 多用户请求可将当前使用者 Token 通过标准输入传入，不将 Token 放在命令行参数中：
 
 ```bash
@@ -31,3 +31,10 @@ licos-platform user me --token-stdin
 主部门、全部所属部门、组织任职、主岗位和主职务。部门含名称路径、ID 路径；
 无部门/任职时保持 `[]`/`null`。缺少当前使用者身份或 Token 失效时返回非零退出码，
 不改用项目所有者。Token 和内部服务凭证不回显。
+
+
+## 身份选择（0.6.0 起）
+
+`user me`、`knowledge enterprise …`、`ontology …` 均支持 `--token-stdin`。HTTP 服务调用这些命令时必须从标准输入传本次网页登录 Token；独立 CLI 不传此选项时按 `LICOS_CURRENT_USER_ID` 换 Token，缺少该变量则报错。
+
+普通 `knowledge …` 命令默认使用项目身份，`--token-stdin` 可显式按调用用户授权。数据库、存储和 OAuth 应用管理仍使用项目身份。空 Token、失效 Token 不切换身份。完整接口分类见仓库 `tools/IDENTITY.md`。

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/README.md

@@ -10,7 +10,7 @@ licos-platform user me --workspace-id <执行工作空间ID>
 licos-platform help user me
 ```
 
-默认由可信运行时注入 `LICOS_CURRENT_USER_ID`，平台地址、服务凭证和项目工作空间沿用运行时配置。
+用户接口默认使用 `LICOS_CURRENT_USER_ID` 指定的容器执行用户换取 Token。它不代表网页登录者。平台地址、服务凭证和项目工作空间沿用运行时配置。
 多用户请求可将当前使用者 Token 通过标准输入传入，不将 Token 放在命令行参数中：
 
 ```bash
@@ -23,3 +23,10 @@ licos-platform user me --token-stdin
 主部门、全部所属部门、组织任职、主岗位和主职务。部门含名称路径、ID 路径；
 无部门/任职时保持 `[]`/`null`。缺少当前使用者身份或 Token 失效时返回非零退出码，
 不改用项目所有者。Token 和内部服务凭证不回显。
+
+
+## 身份选择（0.6.0 起）
+
+`user me`、`knowledge enterprise …`、`ontology …` 均支持 `--token-stdin`。HTTP 服务调用这些命令时必须从标准输入传本次网页登录 Token；独立 CLI 不传此选项时按 `LICOS_CURRENT_USER_ID` 换 Token，缺少该变量则报错。
+
+普通 `knowledge …` 命令默认使用项目身份，`--token-stdin` 可显式按调用用户授权。数据库、存储和 OAuth 应用管理仍使用项目身份。空 Token、失效 Token 不切换身份。完整接口分类见仓库 `tools/IDENTITY.md`。

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "licos-platform-cli"
-version = "0.5.1"
+version = "0.6.0"
 description = "LICOS platform CLI"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "licos-platform-sdk>=0.6.1",
+    "licos-platform-sdk>=0.7.0",
 ]
 
 [project.scripts]

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/src/licos_platform_cli/help_commands.py

@@ -379,7 +379,7 @@ KNOWLEDGE_HELP = {
         "Do not manage graph/ACL internals from generated application code.",
         "Search all accessible datasets by default; pass dataset IDs or names only when the user explicitly asks for specific datasets.",
         "For text imports, the SDK sends UTF-8 text as a text/plain base64 document through the platform API.",
-        "Enterprise commands require an enterprise user. Tenant scope and permissions come from the current user token; never pass or invent tenant IDs.",
+        "Enterprise commands use --token-stdin or the standalone CLI user LICOS_CURRENT_USER_ID. Tenant scope and permissions come from the current user token; never pass or invent tenant IDs.",
         "Enterprise tree supports STANDARD, GRAPH, and OBJECT_STORAGE type filters. Current enterprise APIs support retrieve and list_files only.",
         "Validate enterprise knowledge references before retrieval or listing when an Agent receives IDs from conversation context. Manage enterprise resources through the platform knowledge IFrame.",
         "Use document-url/document-download-link for temporary access URLs; do not construct storage URLs.",
@@ -387,8 +387,8 @@ KNOWLEDGE_HELP = {
     "sdk": {
         "python": "from licos_platform_sdk import knowledge\nknowledge.add_text('FAQ content', dataset_name='project_docs')\nresults = knowledge.search('How to reset password?')",
         "node": "import { knowledge } from '@kmlckj/licos-platform-sdk';\nawait knowledge.addText('FAQ content', { datasetName: 'project_docs' });\nconst results = await knowledge.search('How to reset password?');",
-        "enterprise_python": "from licos_platform_sdk import enterprise_knowledge\nresources = enterprise_knowledge.tree()\nresult = enterprise_knowledge.retrieve('安全规范', 'source-id')",
-        "enterprise_node": "import { enterpriseKnowledge } from '@kmlckj/licos-platform-sdk';\nconst resources = await enterpriseKnowledge.tree();\nconst result = await enterpriseKnowledge.retrieve('安全规范', 'source-id');",
+        "enterprise_python": "from licos_platform_sdk import enterprise_knowledge\nresources = enterprise_knowledge.tree(user_token=token)\nresult = enterprise_knowledge.retrieve('安全规范', 'source-id', user_token=token)",
+        "enterprise_node": "import { enterpriseKnowledge } from '@kmlckj/licos-platform-sdk';\nconst resources = await enterpriseKnowledge.tree({ userToken: token });\nconst result = await enterpriseKnowledge.retrieve('安全规范', 'source-id', { userToken: token });",
     },
     "commands": {'runtime': {'description': 'Show knowledge runtime status and capabilities.',
                  'parameters': [],
@@ -798,27 +798,28 @@ ONTOLOGY_HELP = {
         "Resolve elements by stable IDs before querying context, model checks, or mapped data.",
         "READ tools query state, PREPARE tools validate a change draft, and PERSIST tools apply an explicitly confirmed draft.",
         "PERSIST commands require --confirm. Never reuse a catalog result after its catalogVersion changes.",
-        "实时订阅由项目后端 SDK 完成，CLI 不提供常驻 WebSocket 命令；不得读取 Token 或自行拼上游连接。",
+        "实时订阅由项目后端 SDK 完成，必须传入本次认证会话 Token；CLI 不提供常驻 WebSocket 命令。",
     ],
     "realtimeSdk": {
-        "node": "const subscription = await ontology.subscribeRealtime({ elementIds, attributeIds });\ntry { for await (const event of subscription) { sendBusinessEvent(event); } }\nfinally { await subscription.close(); }",
-        "python": "with ontology.subscribe_realtime(element_ids, attribute_ids=attribute_ids) as subscription:\n    for event in subscription:\n        send_business_event(event)",
-        "minimum_versions": {"node": "0.10.5", "python": "0.5.5"},
+        "node": "const subscription = await ontology.subscribeRealtime({ elementIds, attributeIds }, { userToken: token });\ntry { for await (const event of subscription) { sendBusinessEvent(event); } }\nfinally { await subscription.close(); }",
+        "python": "with ontology.subscribe_realtime(element_ids, attribute_ids=attribute_ids, user_token=token) as subscription:\n    for event in subscription:\n        send_business_event(event)",
+        "minimum_versions": {"node": "0.12.0", "python": "0.7.0"},
         "parameters": {
+            "userToken / user_token": "必填，本次认证会话的用户 Token，不含 Bearer 前缀。",
             "elementIds / element_ids": "必填，非空字符串 ID 数组；已解析且授权的元素，不递归子元素。",
             "attributeIds / attribute_ids": "可选，字符串 ID 数组；省略或空数组表示所选元素的全部授权属性。",
         },
         "returns": "收到订阅确认后返回订阅对象；单消费者迭代 property.changed 原始业务事件，close 取消订阅。Node 使用异步迭代，Python 使用同步 with/for，异步服务放入工作线程。",
-        "errors": "创建错误直接抛出，后续错误从迭代器抛出；401 仅刷新一次，403/协议错误不重试，网络重连累计默认 3 次。不得把获取连接计划当成订阅成功。",
+        "errors": "创建错误直接抛出，后续错误从迭代器抛出；401/403 终止，由调用方更新 Token；网络中断默认使用原 Token 持续重连并重新检查权限。不得把获取连接计划当成订阅成功。",
         "reference": "industrial-ontology/references/realtime-sdk.md",
     },
     "sdk": {
-        "python": "from licos_platform_sdk import ontology\ncatalog = ontology.search_tools('查询设备实时数据')\nselected = next((item for item in catalog['items'] if item['selection'] == 'MATCH' and item['mode'] == 'READ' and item['definition']['function']['name'] == requested_tool_name), None)\nif selected is None:\n    raise RuntimeError('当前目录中没有匹配的只读本体工具')\n# 按 selected['definition']['function']['parameters'] 校验参数后调用精确函数名。",
-        "node": "import { ontology } from '@kmlckj/licos-platform-sdk';\nconst catalog = await ontology.searchTools('查询设备实时数据');\nconst selected = catalog.items.find((item) => item.selection === 'MATCH' && item.mode === 'READ' && item.definition.function.name === requestedToolName);\nif (!selected) throw new Error('当前目录中没有匹配的只读本体工具');\n// 按 selected.definition.function.parameters 校验参数后调用精确函数名。",
+        "python": "from licos_platform_sdk import ontology\ncatalog = ontology.search_tools('查询设备实时数据', user_token=token)\nselected = next((item for item in catalog['items'] if item['selection'] == 'MATCH' and item['mode'] == 'READ' and item['definition']['function']['name'] == requested_tool_name), None)\nif selected is None:\n    raise RuntimeError('当前目录中没有匹配的只读本体工具')\n# 按 selected['definition']['function']['parameters'] 校验参数后调用精确函数名。",
+        "node": "import { ontology } from '@kmlckj/licos-platform-sdk';\nconst catalog = await ontology.searchTools('查询设备实时数据', { userToken: token });\nconst selected = catalog.items.find((item) => item.selection === 'MATCH' && item.mode === 'READ' && item.definition.function.name === requestedToolName);\nif (!selected) throw new Error('当前目录中没有匹配的只读本体工具');\n// 按 selected.definition.function.parameters 校验参数后调用精确函数名。",
     },
     "commands": {
         "search": {
-            "description": "Search the current user's ontology AI tool catalog.",
+            "description": "Search the user catalog; use --token-stdin for a web request or LICOS_CURRENT_USER_ID for standalone CLI.",
             "parameters": [
                 {"name": "query", "required": True, "description": "Natural-language capability query."},
                 {"name": "--limit", "required": False, "description": "Result count from 1 to 10; default 5."},
@@ -850,6 +851,16 @@ HELP_TOPICS = {
     "ontology": ONTOLOGY_HELP,
 }
 
+for topic in (KNOWLEDGE_HELP, ONTOLOGY_HELP):
+    for command_name, command_help in topic["commands"].items():
+        user_scoped = topic is ONTOLOGY_HELP or command_name.startswith("enterprise-")
+        command_help["parameters"].append({
+            "name": "--token-stdin", "required": False,
+            "description": "Read this request's user Token from stdin; otherwise " + (
+                "exchange LICOS_CURRENT_USER_ID for standalone CLI." if user_scoped else "use project identity."
+            ),
+        })
+
 
 def _set_handler(parser: argparse.ArgumentParser, handler: Handler) -> None:
     parser.set_defaults(handler=handler)

licos_platform_cli-0.6.0/src/licos_platform_cli/identity.py

@@ -0,0 +1,26 @@
+"""Select the CLI execution identity without changing SDK or process state."""
+
+import os
+import sys
+
+from licos_platform_sdk import ConfigurationError, runtime_user_token
+
+
+def user_token(args) -> str:
+    if args.token_stdin:
+        token = sys.stdin.read().strip()
+        if not token:
+            raise ConfigurationError("--token-stdin requires a nonempty user Token")
+        return token
+    user_id = os.environ.get("LICOS_CURRENT_USER_ID", "").strip()
+    if not user_id:
+        raise ConfigurationError("CLI user identity requires LICOS_CURRENT_USER_ID or --token-stdin")
+    return runtime_user_token(user_id)
+
+
+def add_user_token_option(parser) -> None:
+    parser.add_argument(
+        "--token-stdin",
+        action="store_true",
+        help="Read the caller Token from stdin; otherwise use LICOS_CURRENT_USER_ID",
+    )

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/src/licos_platform_cli/knowledge_commands.py

@@ -4,15 +4,27 @@ import argparse
 from typing import Any, Callable
 
 from licos_platform_sdk import enterprise_knowledge, knowledge
-
+from .identity import add_user_token_option, user_token
 
 Handler = Callable[[argparse.Namespace], Any]
 
 
 def _set_handler(parser: argparse.ArgumentParser, handler: Handler) -> None:
+    parser.add_argument(
+        "--token-stdin", action="store_true", help="Use the request Token from stdin; omission uses project identity"
+    )
     parser.set_defaults(handler=handler)
 
 
+def _set_user_handler(parser, handler):
+    add_user_token_option(parser)
+    parser.set_defaults(handler=handler)
+
+
+def _project_identity(args):
+    return {"user_token": user_token(args)} if args.token_stdin else {}
+
+
 def _chunk_config(args: argparse.Namespace) -> knowledge.ChunkConfig | None:
     if not any(
         [
@@ -35,12 +47,12 @@ def _dataset_selector(args: argparse.Namespace) -> dict[str, str | None]:
     return {"dataset_id": args.dataset_id, "dataset_name": args.dataset}
 
 
-def _cmd_runtime(_args: argparse.Namespace) -> Any:
-    return knowledge.runtime()
+def _cmd_runtime(args: argparse.Namespace) -> Any:
+    return knowledge.runtime(**_project_identity(args))
 
 
-def _cmd_model_catalog(_args: argparse.Namespace) -> Any:
-    return knowledge.model_catalog()
+def _cmd_model_catalog(args: argparse.Namespace) -> Any:
+    return knowledge.model_catalog(**_project_identity(args))
 
 
 def _cmd_datasets(args: argparse.Namespace) -> Any:
@@ -50,6 +62,7 @@ def _cmd_datasets(args: argparse.Namespace) -> Any:
         page_size=args.page_size,
         page_num=args.page_num,
         format_type=args.format_type,
+        **_project_identity(args),
     )
 
 
@@ -62,28 +75,39 @@ def _cmd_create_dataset(args: argparse.Namespace) -> Any:
         source_type=args.source_type,
         engine_type=args.engine_type,
         access_scope=args.access_scope,
+        **_project_identity(args),
     )
 
 
 def _cmd_ensure_dataset(args: argparse.Namespace) -> Any:
-    return knowledge.ensure_dataset(args.name, description=args.description, space_id=args.space_id)
+    return knowledge.ensure_dataset(
+        args.name, description=args.description, space_id=args.space_id, **_project_identity(args)
+    )
 
 
 def _cmd_get_dataset(args: argparse.Namespace) -> Any:
-    return knowledge.get_dataset(args.dataset_id)
+    return knowledge.get_dataset(args.dataset_id, **_project_identity(args))
 
 
 def _cmd_delete_dataset(args: argparse.Namespace) -> Any:
-    return knowledge.delete_dataset(args.dataset_id)
+    return knowledge.delete_dataset(args.dataset_id, **_project_identity(args))
 
 
 def _cmd_add(args: argparse.Namespace) -> Any:
     selector = _dataset_selector(args)
     chunk_config = _chunk_config(args)
     if args.content is not None:
-        return knowledge.add_text(args.content, name=args.name or "document.txt", chunk_config=chunk_config, **selector)
+        return knowledge.add_text(
+            args.content,
+            name=args.name or "document.txt",
+            chunk_config=chunk_config,
+            **selector,
+            **_project_identity(args),
+        )
     if args.url is not None:
-        return knowledge.add_url(args.url, name=args.name, chunk_config=chunk_config, **selector)
+        return knowledge.add_url(
+            args.url, name=args.name, chunk_config=chunk_config, **selector, **_project_identity(args)
+        )
     return knowledge.add_documents(
         [
             knowledge.KnowledgeDocument(
@@ -95,6 +119,7 @@ def _cmd_add(args: argparse.Namespace) -> Any:
         ],
         chunk_config=chunk_config,
         **selector,
+        **_project_identity(args),
     )
 
 
@@ -110,38 +135,36 @@ def _cmd_search(args: argparse.Namespace) -> Any:
         candidate_top_k=args.candidate_top_k,
         search_method=args.search_method,
         enable_rerank=args.enable_rerank,
+        **_project_identity(args),
     )
 
 
 def _cmd_documents(args: argparse.Namespace) -> Any:
-    return knowledge.list_documents(args.dataset_id, page=args.page, size=args.size)
+    return knowledge.list_documents(args.dataset_id, page=args.page, size=args.size, **_project_identity(args))
 
 
 def _cmd_delete_documents(args: argparse.Namespace) -> Any:
-    return knowledge.delete_documents(args.dataset_id, args.document_id)
+    return knowledge.delete_documents(args.dataset_id, args.document_id, **_project_identity(args))
 
 
 def _cmd_enterprise_tree(args: argparse.Namespace) -> Any:
-    return enterprise_knowledge.tree(include_types=args.include_types)
+    return enterprise_knowledge.tree(include_types=args.include_types, user_token=user_token(args))
 
 
 def _cmd_enterprise_search(args: argparse.Namespace) -> Any:
     return enterprise_knowledge.search_knowledge_bases(
-        args.query,
-        page=args.page,
-        page_size=args.page_size,
+        args.query, page=args.page, page_size=args.page_size, user_token=user_token(args)
     )
 
 
 def _cmd_enterprise_validate(args: argparse.Namespace) -> Any:
     return enterprise_knowledge.validate_references(
-        args.knowledge_base_id,
-        required_capability=args.required_capability,
+        args.knowledge_base_id, required_capability=args.required_capability, user_token=user_token(args)
     )
 
 
 def _cmd_enterprise_retrieve(args: argparse.Namespace) -> Any:
-    return enterprise_knowledge.retrieve(args.query, args.source_id)
+    return enterprise_knowledge.retrieve(args.query, args.source_id, user_token=user_token(args))
 
 
 def _cmd_enterprise_folders(args: argparse.Namespace) -> Any:
@@ -150,11 +173,12 @@ def _cmd_enterprise_folders(args: argparse.Namespace) -> Any:
         include_children=args.include_children,
         page=args.page,
         page_size=args.page_size,
+        user_token=user_token(args),
     )
 
 
 def _cmd_enterprise_folder(args: argparse.Namespace) -> Any:
-    return enterprise_knowledge.get_folder(args.folder_id)
+    return enterprise_knowledge.get_folder(args.folder_id, user_token=user_token(args))
 
 
 def _cmd_enterprise_folder_knowledge_bases(args: argparse.Namespace) -> Any:
@@ -163,40 +187,40 @@ def _cmd_enterprise_folder_knowledge_bases(args: argparse.Namespace) -> Any:
         include_children=args.include_children,
         page=args.page,
         page_size=args.page_size,
+        user_token=user_token(args),
     )
 
 
 def _cmd_enterprise_knowledge_base(args: argparse.Namespace) -> Any:
-    return enterprise_knowledge.get_knowledge_base(args.source_id)
+    return enterprise_knowledge.get_knowledge_base(args.source_id, user_token=user_token(args))
 
 
 def _cmd_enterprise_documents(args: argparse.Namespace) -> Any:
     return enterprise_knowledge.list_documents(
-        args.source_id,
-        page=args.page,
-        page_size=args.page_size,
-        query=args.query,
+        args.source_id, page=args.page, page_size=args.page_size, query=args.query, user_token=user_token(args)
     )
 
 
 def _cmd_enterprise_document(args: argparse.Namespace) -> Any:
-    return enterprise_knowledge.get_document(args.document_id)
+    return enterprise_knowledge.get_document(args.document_id, user_token=user_token(args))
 
 
 def _cmd_enterprise_document_chunks(args: argparse.Namespace) -> Any:
     return enterprise_knowledge.list_document_chunks(
-        args.document_id,
-        page=args.page,
-        page_size=args.page_size,
+        args.document_id, page=args.page, page_size=args.page_size, user_token=user_token(args)
     )
 
 
 def _cmd_enterprise_document_url(args: argparse.Namespace) -> Any:
-    return {"url": enterprise_knowledge.document_original_url(args.document_id, download=args.download)}
+    return {
+        "url": enterprise_knowledge.document_original_url(
+            args.document_id, download=args.download, user_token=user_token(args)
+        )
+    }
 
 
 def _cmd_enterprise_document_download_link(args: argparse.Namespace) -> Any:
-    return enterprise_knowledge.document_download_link(args.document_id)
+    return enterprise_knowledge.document_download_link(args.document_id, user_token=user_token(args))
 
 
 def _add_dataset_selector(parser: argparse.ArgumentParser) -> None:
@@ -244,12 +268,12 @@ def _add_enterprise_parser(
 
     tree = commands.add_parser("tree", help="Get the accessible enterprise knowledge resource tree")
     _add_enterprise_types(tree)
-    _set_handler(tree, _cmd_enterprise_tree)
+    _set_user_handler(tree, _cmd_enterprise_tree)
 
     search = commands.add_parser("search", help="Search enterprise knowledge bases by name")
     search.add_argument("--query", "-q", required=True)
     _add_page_args(search)
-    _set_handler(search, _cmd_enterprise_search)
+    _set_user_handler(search, _cmd_enterprise_search)
 
     validate = commands.add_parser("validate", help="Validate knowledge base references and capabilities")
     validate.add_argument("knowledge_base_id", nargs="+", help="Knowledge base ID")
@@ -258,22 +282,22 @@ def _add_enterprise_parser(
         choices=["retrieve", "upload", "list_files", "batch_delete_files"],
         default="retrieve",
     )
-    _set_handler(validate, _cmd_enterprise_validate)
+    _set_user_handler(validate, _cmd_enterprise_validate)
 
     retrieve = commands.add_parser("retrieve", help="Retrieve evidence from enterprise knowledge bases")
     retrieve.add_argument("--query", "-q", required=True)
     retrieve.add_argument("--source-id", required=True, help="Knowledge base source ID")
-    _set_handler(retrieve, _cmd_enterprise_retrieve)
+    _set_user_handler(retrieve, _cmd_enterprise_retrieve)
 
     folders = commands.add_parser("folders", help="List enterprise knowledge folders")
     folders.add_argument("--parent-id", default=None)
     folders.add_argument("--include-children", action="store_true", default=None)
     _add_page_args(folders)
-    _set_handler(folders, _cmd_enterprise_folders)
+    _set_user_handler(folders, _cmd_enterprise_folders)
 
     folder = commands.add_parser("folder", help="Get one enterprise knowledge folder")
     folder.add_argument("folder_id")
-    _set_handler(folder, _cmd_enterprise_folder)
+    _set_user_handler(folder, _cmd_enterprise_folder)
 
     folder_bases = commands.add_parser(
         "folder-knowledge-bases",
@@ -282,35 +306,34 @@ def _add_enterprise_parser(
     folder_bases.add_argument("folder_id")
     folder_bases.add_argument("--include-children", action="store_true", default=None)
     _add_page_args(folder_bases)
-    _set_handler(folder_bases, _cmd_enterprise_folder_knowledge_bases)
+    _set_user_handler(folder_bases, _cmd_enterprise_folder_knowledge_bases)
 
     knowledge_base = commands.add_parser("knowledge-base", help="Get one enterprise knowledge base")
     knowledge_base.add_argument("source_id")
-    _set_handler(knowledge_base, _cmd_enterprise_knowledge_base)
+    _set_user_handler(knowledge_base, _cmd_enterprise_knowledge_base)
 
     documents = commands.add_parser("documents", help="List documents in an enterprise knowledge base")
     documents.add_argument("source_id")
     _add_enterprise_query_args(documents)
-    _set_handler(documents, _cmd_enterprise_documents)
+    _set_user_handler(documents, _cmd_enterprise_documents)
 
     document = commands.add_parser("document", help="Get one enterprise knowledge document")
     document.add_argument("document_id")
-    _set_handler(document, _cmd_enterprise_document)
+    _set_user_handler(document, _cmd_enterprise_document)
 
     chunks = commands.add_parser("document-chunks", help="List chunks for one enterprise knowledge document")
     chunks.add_argument("document_id")
     _add_page_args(chunks)
-    _set_handler(chunks, _cmd_enterprise_document_chunks)
+    _set_user_handler(chunks, _cmd_enterprise_document_chunks)
 
     document_url = commands.add_parser("document-url", help="Get a temporary original document URL")
     document_url.add_argument("document_id")
     document_url.add_argument("--download", action="store_true", help="Request download disposition")
-    _set_handler(document_url, _cmd_enterprise_document_url)
+    _set_user_handler(document_url, _cmd_enterprise_document_url)
 
     download_link = commands.add_parser("document-download-link", help="Get a temporary document download link")
     download_link.add_argument("document_id")
-    _set_handler(download_link, _cmd_enterprise_document_download_link)
-
+    _set_user_handler(download_link, _cmd_enterprise_document_download_link)
 
 
 def add_knowledge_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/src/licos_platform_cli/ontology_commands.py

@@ -6,12 +6,13 @@ from pathlib import Path
 from typing import Any, Callable
 
 from licos_platform_sdk import ontology
-
+from .identity import add_user_token_option, user_token
 
 Handler = Callable[[argparse.Namespace], Any]
 
 
 def _set_handler(parser: argparse.ArgumentParser, handler: Handler) -> None:
+    add_user_token_option(parser)
     parser.set_defaults(handler=handler)
 
 
@@ -29,11 +30,12 @@ def _arguments(args: argparse.Namespace) -> dict[str, Any]:
 
 
 def _cmd_search(args: argparse.Namespace) -> Any:
-    return ontology.search_tools(args.query, limit=args.limit, offset=args.offset)
+    return ontology.search_tools(args.query, limit=args.limit, offset=args.offset, user_token=user_token(args))
 
 
 def _cmd_invoke(args: argparse.Namespace) -> Any:
-    catalog_version, item = ontology.resolve_tool(args.name)
+    token = user_token(args)
+    catalog_version, item = ontology.resolve_tool(args.name, user_token=token)
     if args.catalog_version and args.catalog_version != catalog_version:
         raise argparse.ArgumentTypeError(
             "ontology tool catalog changed; search again before invoking the tool"
@@ -46,6 +48,7 @@ def _cmd_invoke(args: argparse.Namespace) -> Any:
         args.name,
         _arguments(args),
         catalog_version=catalog_version,
+        user_token=token,
     )
 
 

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/src/licos_platform_cli/user_commands.py

@@ -1,10 +1,9 @@
 from __future__ import annotations
 
 import argparse
-import sys
 
 from licos_platform_sdk import get_current_user
-
+from .identity import user_token
 
 USER_HELP = {
     "topic": "user",
@@ -12,8 +11,11 @@ USER_HELP = {
     "runtime": [
         {"name": "LICOS_PLATFORM_API_BASE_URL", "description": "平台 API 地址。"},
         {"name": "LICOS_AI_AGENT_TOKEN", "description": "运行时内部服务凭证，不输出。"},
-        {"name": "LICOS_CURRENT_USER_ID", "description": "未通过标准输入传 Token 时，必须由可信运行时注入的当前用户 ID。"},
-        {"name": "LICOS_WORKSPACE_ID / LICOS_OWNER_WORKSPACE_ID / AGENT_WORKSPACE_ID", "description": "执行工作空间，决定企业范围。"},
+        {"name": "LICOS_CURRENT_USER_ID", "description": "独立 CLI 默认执行用户，即容器初始化用户；不代表网页登录者。"},
+        {
+            "name": "LICOS_WORKSPACE_ID / LICOS_OWNER_WORKSPACE_ID / AGENT_WORKSPACE_ID",
+            "description": "执行工作空间，决定企业范围。",
+        },
     ],
     "rules": [
         "多用户请求传当前使用者 Token；不使用项目所有者代替使用者。",
@@ -28,8 +30,18 @@ USER_HELP = {
         "me": {
             "description": "查询当前使用者信息。",
             "parameters": [
-                {"name": "--token-stdin", "type": "boolean", "required": False, "description": "从标准输入读取当前用户 Token，不含 Bearer 前缀；不通过命令行参数暴露 Token。"},
-                {"name": "--workspace-id", "type": "string", "required": False, "description": "执行工作空间 ID；省略时由项目运行时获取。"},
+                {
+                    "name": "--token-stdin",
+                    "type": "boolean",
+                    "required": False,
+                    "description": "从标准输入读取当前用户 Token，不含 Bearer 前缀；不通过命令行参数暴露 Token。",
+                },
+                {
+                    "name": "--workspace-id",
+                    "type": "string",
+                    "required": False,
+                    "description": "执行工作空间 ID；省略时由项目运行时获取。",
+                },
             ],
             "returns": "sys_user 对象：id、username、displayName、avatarUrl、tenantId、tenantName、primaryDepartment、departments、organizationAssignments、primaryPosition、primaryJobTitle。",
             "example": "licos-platform user me",
@@ -40,7 +52,7 @@ USER_HELP = {
 
 def _me(args: argparse.Namespace):
     return get_current_user(
-        user_token=sys.stdin.read().strip() if args.token_stdin else None,
+        user_token=user_token(args),
         workspace_id=args.workspace_id,
     )
 

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/tests/test_cli.py

@@ -36,6 +36,15 @@ def run_cli(*args: str) -> tuple[int, str, str]:
 
 
 class PlatformCliTests(unittest.TestCase):
+
+    def setUp(self):
+        identity = mock.patch("licos_platform_cli.identity.runtime_user_token", return_value="cli-token")
+        identity.start()
+        self.addCleanup(identity.stop)
+        env = mock.patch.dict(os.environ, {"LICOS_CURRENT_USER_ID": "cli-user"})
+        env.start()
+        self.addCleanup(env.stop)
+
     def test_enterprise_help_matches_removed_management_commands(self) -> None:
         code, output, _ = run_cli("help", "knowledge")
         self.assertEqual(code, 0)
@@ -53,7 +62,7 @@ class PlatformCliTests(unittest.TestCase):
             code, output, _ = run_cli("knowledge", "enterprise", "document-download-link", "doc-1")
         self.assertEqual(code, 0)
         self.assertEqual(json.loads(output), link)
-        download.assert_called_once_with("doc-1")
+        download.assert_called_once_with("doc-1", user_token="cli-token")
 
     def test_help_exposes_storage_commands(self) -> None:
         stdout = io.StringIO()
@@ -136,7 +145,10 @@ class PlatformCliTests(unittest.TestCase):
         self.assertIn("mode", sdk_help)
         self.assertIn("subscribeRealtime", payload["realtimeSdk"]["node"])
         self.assertIn("subscribe_realtime", payload["realtimeSdk"]["python"])
-        self.assertEqual(payload["realtimeSdk"]["minimum_versions"], {"node": "0.10.5", "python": "0.5.5"})
+        self.assertEqual(payload["realtimeSdk"]["minimum_versions"], {"node": "0.12.0", "python": "0.7.0"})
+        self.assertIn("userToken", payload["realtimeSdk"]["node"])
+        self.assertIn("user_token", payload["realtimeSdk"]["python"])
+        self.assertIn("--token-stdin", [item["name"] for item in payload["commands"]["search"]["parameters"]])
 
     def test_ontology_search_forwards_catalog_pagination(self) -> None:
         result = {"catalogVersion": "v1", "items": []}
@@ -150,7 +162,7 @@ class PlatformCliTests(unittest.TestCase):
         self.assertEqual(code, 0)
         self.assertEqual(stderr, "")
         self.assertEqual(json.loads(stdout), result)
-        search.assert_called_once_with("查询设备数据", limit=7, offset=3)
+        search.assert_called_once_with("查询设备数据", limit=7, offset=3, user_token="cli-token")
 
     def test_ontology_persist_requires_confirmation(self) -> None:
         item = {"mode": "PERSIST"}
@@ -187,7 +199,7 @@ class PlatformCliTests(unittest.TestCase):
         self.assertEqual(stderr, "")
         self.assertEqual(json.loads(stdout), {"value": 7})
         invoke.assert_called_once_with(
-            "queryElementData", {"elementId": "element-1"}, catalog_version="v4"
+            "queryElementData", {"elementId": "element-1"}, catalog_version="v4", user_token="cli-token"
         )
 
     def test_ontology_invoke_rejects_changed_catalog_version(self) -> None:
@@ -689,8 +701,7 @@ class PlatformCliTests(unittest.TestCase):
         self.assertEqual(code, 0)
         self.assertEqual(stderr, "")
         self.assertEqual(json.loads(stdout), {"status": "KNOWLEDGE_TREE_READY"})
-        tree.assert_called_once_with(include_types=["STANDARD", "GRAPH"])
-
+        tree.assert_called_once_with(include_types=["STANDARD", "GRAPH"], user_token="cli-token")
 
     def test_structured_help_describes_enterprise_knowledge_contract(self) -> None:
         code, stdout, stderr = run_cli("help", "knowledge", "enterprise-documents")

licos_platform_cli-0.6.0/tests/test_identity.py

@@ -0,0 +1,31 @@
+import io
+from argparse import Namespace
+from unittest import TestCase, mock
+
+from licos_platform_cli.identity import user_token
+from licos_platform_sdk import ConfigurationError
+
+
+class CliIdentityTests(TestCase):
+    def test_cli_defaults_to_initialization_user(self):
+        with mock.patch.dict(
+            "os.environ", {"LICOS_CURRENT_USER_ID": "initializer", "LICOS_USER_ID": "owner"}, clear=True
+        ), mock.patch("licos_platform_cli.identity.runtime_user_token", return_value="cli-token") as exchange:
+            self.assertEqual(user_token(Namespace(token_stdin=False)), "cli-token")
+            exchange.assert_called_once_with("initializer")
+
+    def test_stdin_token_does_not_exchange_container_identity(self):
+        with mock.patch("sys.stdin", io.StringIO("request-token\n")), mock.patch(
+            "licos_platform_cli.identity.runtime_user_token"
+        ) as exchange:
+            self.assertEqual(user_token(Namespace(token_stdin=True)), "request-token")
+            exchange.assert_not_called()
+
+    def test_missing_user_and_empty_stdin_do_not_use_owner(self):
+        with mock.patch.dict("os.environ", {"LICOS_USER_ID": "owner"}, clear=True), mock.patch(
+            "sys.stdin", io.StringIO(" ")
+        ), mock.patch("licos_platform_cli.identity.runtime_user_token") as exchange:
+            for token_stdin in (True, False):
+                with self.assertRaises(ConfigurationError):
+                    user_token(Namespace(token_stdin=token_stdin))
+            exchange.assert_not_called()

{licos_platform_cli-0.5.1 → licos_platform_cli-0.6.0}/tests/test_user.py

@@ -21,12 +21,16 @@ class UserCliTests(unittest.TestCase):
 
     def test_me_outputs_sdk_json_with_chinese(self):
         with patch.object(user_commands, "get_current_user", return_value={"id": "caller", "displayName": "张三"}) as sdk:
-            code, out, err = self.run_cli("user", "me")
+            with patch(
+                "licos_platform_cli.identity.runtime_user_token", return_value="cli-token"
+            ) as exchange, patch.dict(os.environ, {"LICOS_CURRENT_USER_ID": "cli-user"}):
+                code, out, err = self.run_cli("user", "me")
+            exchange.assert_called_once_with("cli-user")
         self.assertEqual(code, 0)
         self.assertEqual(err, "")
         self.assertEqual(json.loads(out), {"id": "caller", "displayName": "张三"})
         self.assertIn("张三", out)
-        sdk.assert_called_once_with(user_token=None, workspace_id=None)
+        sdk.assert_called_once_with(user_token="cli-token", workspace_id=None)
 
     def test_stdin_token_is_forwarded_without_echo(self):
         with patch("sys.stdin", io.StringIO("request-secret\n")), patch.object(
@@ -45,7 +49,7 @@ class UserCliTests(unittest.TestCase):
             code, out, err = self.run_cli("user", "me", "--token-stdin")
         self.assertEqual(code, 1)
         self.assertEqual(out, "")
-        self.assertIn("不能为空", err)
+        self.assertIn("nonempty", err)
 
     def test_structured_help_exposes_command_and_sdk(self):
         code, out, err = self.run_cli("help", "user")