tinet-agent-cli 0.1.0.dev36__py3-none-any.whl

taco/assets/examples/workflow-http.json

@@ -0,0 +1,34 @@
+{
+  "kind": "workflow",
+  "name": "HTTP 客户查询",
+  "description": "根据手机号调用 HTTP 接口并返回响应。",
+  "inputs": {
+    "phone": {
+      "type": "string",
+      "required": true,
+      "description": "客户手机号",
+      "max_length": 32
+    }
+  },
+  "nodes": [
+    {
+      "id": "query_customer",
+      "type": "http",
+      "method": "GET",
+      "url": "https://example.com/api/customers",
+      "query": {
+        "phone": "{{ inputs.phone }}"
+      },
+      "headers": {
+        "Accept": "application/json"
+      }
+    }
+  ],
+  "outputs": {
+    "customer": "{{ query_customer.body }}",
+    "status": "{{ query_customer.status_code }}"
+  },
+  "publish": {
+    "asTool": true
+  }
+}

taco/assets/manifest.json

@@ -0,0 +1,12 @@
+{
+  "format_version": 1,
+  "cli_version": "0.1.0.dev36",
+  "resource_groups": [
+    "skills",
+    "schemas",
+    "scenarios",
+    "examples",
+    "aikb",
+    "agent_openapi"
+  ]
+}

taco/assets/scenarios/README.md

@@ -0,0 +1,3 @@
+# TACO Scenarios
+
+场景步骤、风险和验收元数据位于此目录。

taco/assets/scenarios/agent-basic.json

@@ -0,0 +1,80 @@
+{
+  "id": "agent-basic",
+  "title": "创建、调试并发布基础智能体",
+  "description": "适用于提示词、模型、开场白、关联问题以及分类扩展配置的基础 Agent 场景。",
+  "requirements": [
+    "已配置可用的 TACO profile",
+    "使用专用测试应用执行调试和发布"
+  ],
+  "risks": [
+    {
+      "operation": "agent create",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "会在远端创建应用；本地输出已存在时还需 --overwrite。"
+    },
+    {
+      "operation": "agent publish",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "成功后默认删除本地 DSL；需要保留时传 --keep-dsl。"
+    }
+  ],
+  "steps": [
+    {
+      "id": "discover-category",
+      "command": "taco --json --no-input agent category list",
+      "purpose": "发现真实分类 code，不得猜测。"
+    },
+    {
+      "id": "discover-model",
+      "command": "taco --json --no-input agent model list --category <category-code>",
+      "purpose": "发现该分类可用模型。"
+    },
+    {
+      "id": "describe-model",
+      "command": "taco --json --no-input agent model describe --provider <provider-id> --model <model-id> --category <category-code>",
+      "purpose": "读取参数规则，不得猜 completion_params。"
+    },
+    {
+      "id": "create",
+      "command": "taco --json --no-input agent create --name <name> --category <category-code> --output agent.json --yes",
+      "purpose": "创建 agent-chat 并把服务端默认 model_config 写入本地。"
+    },
+    {
+      "id": "read-schema",
+      "command": "taco --json --no-input agent schema show agent -o json",
+      "purpose": "读取当前版本 DSL schema 后再编辑。"
+    },
+    {
+      "id": "validate",
+      "command": "taco --json --no-input agent validate --dsl agent.json --category <category-code>",
+      "purpose": "在调用服务端前校验本地 DSL 和真实模型。"
+    },
+    {
+      "id": "run",
+      "command": "taco --json --no-input agent run <app-id> --dsl agent.json --query <query>",
+      "purpose": "通过 SSE 调试并读取 answer、conversation_id 和 task_id。"
+    },
+    {
+      "id": "continue-run",
+      "command": "taco --json --no-input agent run <app-id> --dsl agent.json --query <query> --conversation-id <conversation-id>",
+      "purpose": "复用上一轮会话进行多轮调试。"
+    },
+    {
+      "id": "stream-run",
+      "command": "taco --json --no-input agent run <app-id> --dsl agent.json --query <query> --stream-events",
+      "purpose": "实时读取 task_id。"
+    },
+    {
+      "id": "stop",
+      "command": "taco --json --no-input agent stop <app-id> --task-id <task-id>",
+      "purpose": "从另一进程停止正在运行的调试任务。"
+    },
+    {
+      "id": "publish",
+      "command": "taco --json --no-input agent publish <app-id> --dsl agent.json --yes",
+      "purpose": "显式确认后覆盖服务端有效配置。"
+    }
+  ]
+}

taco/assets/scenarios/agent-builtin-tool.json

@@ -0,0 +1,116 @@
+{
+  "id": "agent-builtin-tool",
+  "title": "为语音 Agent 挂载内置工具",
+  "description": "在基础 Agent 场景上发现工具、配置 Provider 凭据，并把工具挂载到本地 DSL 后调试发布。",
+  "requirements": [
+    "已完成 agent-basic 场景并持有本地 agent.json",
+    "已配置可用的 TACO profile",
+    "凭据仅通过 stdin 或环境变量传入"
+  ],
+  "risks": [
+    {
+      "operation": "credential set",
+      "level": "secret-write",
+      "confirmation": "--yes",
+      "note": "写入工作区共享凭据；禁止把凭据放入命令参数、DSL、日志或 Agent 提示词。"
+    },
+    {
+      "operation": "credential delete",
+      "level": "destructive",
+      "confirmation": "--yes",
+      "note": "删除工作区共享凭据，可能影响其他应用。"
+    },
+    {
+      "operation": "agent tool add/remove",
+      "level": "local-write",
+      "confirmation": "--yes",
+      "note": "会修改本地 Agent DSL；工具参数不得包含 Provider 凭据。"
+    },
+    {
+      "operation": "agent publish",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "会覆盖远端有效配置。"
+    }
+  ],
+  "steps": [
+    {
+      "id": "discover-provider",
+      "command": "taco --json --no-input agent tool catalog provider list",
+      "purpose": "发现真实 Provider ID，不得猜测。"
+    },
+    {
+      "id": "discover-tool",
+      "command": "taco --json --no-input agent tool catalog list --provider <provider-id>",
+      "purpose": "发现 Provider 下的真实工具 action。"
+    },
+    {
+      "id": "describe-tool",
+      "command": "taco --json --no-input agent tool catalog describe --provider <provider-id> --tool <tool-name>",
+      "purpose": "读取工具 form 参数与凭据 schema。"
+    },
+    {
+      "id": "credential-status",
+      "command": "taco --json --no-input agent tool credential status <provider-id>",
+      "purpose": "只读取服务端脱敏值与 schema。"
+    },
+    {
+      "id": "credential-set",
+      "command": "taco --json --no-input agent tool credential set <provider-id> --from-env TACO_TOOL_CREDENTIALS --yes",
+      "purpose": "从预先安全设置的 JSON 环境变量写入凭据，输出仅包含字段名。",
+      "when": "credential-status.configured == false",
+      "approval_required": true
+    },
+    {
+      "id": "read-tool-schema",
+      "command": "taco --json --no-input agent schema show agent-tool -o json",
+      "purpose": "读取当前版本 Agent 工具结构。"
+    },
+    {
+      "id": "read-example",
+      "command": "taco --json --no-input agent example describe agent-builtin-tool -o json",
+      "purpose": "读取不含真实 ID 和凭据的工具挂载示例。"
+    },
+    {
+      "id": "attach-tool",
+      "command": "taco --json --no-input agent tool add --dsl agent.json --provider <provider-id> --tool <tool-name> --parameters tool-parameters.json --yes",
+      "purpose": "只把 form 参数挂载到本地 DSL。",
+      "approval_required": true
+    },
+    {
+      "id": "list-attached-tools",
+      "command": "taco --json --no-input agent tool list --dsl agent.json",
+      "purpose": "确认本地工具结构不含 Provider 凭据。"
+    },
+    {
+      "id": "validate",
+      "command": "taco --json --no-input agent validate --dsl agent.json --category <category-code>",
+      "purpose": "调试前校验完整 Agent DSL。"
+    },
+    {
+      "id": "run-tool-positive",
+      "command": "taco --json --no-input agent run <app-id> --dsl agent.json --query <应调用工具的问题> --stream-events",
+      "purpose": "验证 Agent 在满足调用条件时真实调用工具。",
+      "expected_events": [
+        "agent_thought",
+        "message_end"
+      ],
+      "expected_tool_call": true
+    },
+    {
+      "id": "run-tool-negative",
+      "command": "taco --json --no-input agent run <app-id> --dsl agent.json --query <不应调用工具的问题> --stream-events",
+      "purpose": "验证 Agent 不会在普通问题上滥用工具。",
+      "expected_events": [
+        "message_end"
+      ],
+      "expected_tool_call": false
+    },
+    {
+      "id": "publish",
+      "command": "taco --json --no-input agent publish <app-id> --dsl agent.json --yes",
+      "purpose": "显式确认后发布。",
+      "approval_required": true
+    }
+  ]
+}

taco/assets/scenarios/agent-workflow-tool.json

@@ -0,0 +1,277 @@
+{
+  "id": "agent-workflow-tool",
+  "title": "创建 Workflow Tool 并挂载到 Agent",
+  "description": "在专用测试 workspace 中创建、校验、调试并发布 HTTP Workflow，再发布为 Tool，发现真实 Tool 身份后挂载到 Agent 进行正反向调试和发布。",
+  "requirements": [
+    "Zenava 或 TACO 中已配置包含 endpoint 与 AccessKey 的 profile；profile list 展示两个来源及其 current 状态，但不验证在线认证",
+    "TACO 当前不暴露 workspace identity；执行者必须通过 UI/组织流程独立确认当前是专用测试 workspace，不能仅凭 profile list",
+    "Workflow HTTP 节点只能指向专用非生产 mock/test endpoint，禁止生产客户接口；即使 HTTP 方法为 GET 也按外部调用处理",
+    "持有已有 Agent DSL，或具备从专用测试 Agent 拉取 DSL 的条件",
+    "执行者必须通过 UI/组织流程独立确认当前账号具备 admin/owner 发布 Workflow Tool 的权限"
+  ],
+  "invariants": [
+    "Workflow 必须先 publish，之后才能执行 workflow tool publish；后者不会自动发布 Workflow。",
+    "Workflow Tool 参数由 Workflow DSL 的 inputs（Dify Start 输入）派生，不得手写参数定义。",
+    "Agent 工具项的 provider_id 必须使用 workflow_tool_id，不能使用 workflow_app_id。",
+    "Workflow secret 只能通过 --from-env 读取，真实值不得进入命令参数、DSL、stdout、stderr 或报告。",
+    "workflow run 及挂载 Workflow Tool 后的 Agent run 可能触发外部 HTTP；只允许已确认的非生产 endpoint，并须逐次取得用户批准。"
+  ],
+  "risks": [
+    {
+      "operation": "workspace/admin preflight",
+      "level": "external-precondition",
+      "confirmation": "UI/组织流程",
+      "note": "TACO 当前不暴露 workspace identity，profile list 也不返回 workspace 或权限；必须在 UI/组织流程独立确认专用测试 workspace 和 admin/owner 权限。"
+    },
+    {
+      "operation": "workflow create",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "会在远端创建 Workflow 应用，并在本地写入 DSL。"
+    },
+    {
+      "operation": "workflow apply",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "--dry-run 只生成计划；真正同步远端 draft 必须单独执行并显式确认 --yes。"
+    },
+    {
+      "operation": "workflow run",
+      "level": "external-side-effect",
+      "confirmation": "用户批准（CLI 无 --yes）",
+      "note": "调试会真实触发 Workflow 的外部 HTTP 调用；即使方法为 GET 也可能产生副作用，只能使用已确认的专用非生产 mock/test endpoint。"
+    },
+    {
+      "operation": "workflow secret set",
+      "level": "secret-write",
+      "confirmation": "--yes",
+      "note": "仅允许使用 --from-env；真实 secret 不得出现在命令参数、DSL、日志或报告中。"
+    },
+    {
+      "operation": "workflow publish",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "会发布当前远端 draft；必须在 validate、dry-run、apply 和 run 均通过后执行。"
+    },
+    {
+      "operation": "workflow tool publish",
+      "level": "workspace-write",
+      "confirmation": "--yes",
+      "note": "需要 admin/owner 权限；只能在 Workflow 已发布后注册 Tool，命令不会自动发布 Workflow。"
+    },
+    {
+      "operation": "workflow tool update",
+      "level": "workspace-write",
+      "confirmation": "--yes",
+      "note": "会更新 workspace 中已存在的 Workflow Tool；仅在元数据或 Start 输入变化时执行。"
+    },
+    {
+      "operation": "agent tool add",
+      "level": "local-write",
+      "confirmation": "--yes",
+      "note": "会修改本地 Agent DSL；必须让命令动态解析 Workflow Tool，禁止手写 agent_mode.tools。"
+    },
+    {
+      "operation": "agent run with workflow tool",
+      "level": "external-side-effect",
+      "confirmation": "用户批准（CLI 无 --yes）",
+      "note": "挂载 Workflow Tool 后的 Agent 调试可能真实触发外部 HTTP；正向或负向问题都必须使用非生产 endpoint 并逐次批准，即使下游方法为 GET。"
+    },
+    {
+      "operation": "agent publish",
+      "level": "write",
+      "confirmation": "--yes",
+      "note": "会覆盖远端 Agent 有效配置；场景使用 --keep-dsl 保留本地验收文件。"
+    }
+  ],
+  "steps": [
+    {
+      "id": "auth-status",
+      "command": "taco --json --no-input profile list",
+      "purpose": "展示业务命令最终采用的 profile、来源、endpoint、脱敏凭证和 access token 缓存状态；不验证在线认证或权限。"
+    },
+    {
+      "id": "read-workflow-schema",
+      "command": "taco --json --no-input agent schema show workflow -o json",
+      "purpose": "动态读取当前版本 Workflow DSL 契约。"
+    },
+    {
+      "id": "read-workflow-example",
+      "command": "taco --json --no-input agent example describe workflow-http -o json",
+      "purpose": "读取无真实 ID 和密钥的 HTTP Workflow DSL 示例。"
+    },
+    {
+      "id": "read-agent-schema",
+      "command": "taco --json --no-input agent schema show agent -o json",
+      "purpose": "动态读取当前版本 Agent DSL 契约。"
+    },
+    {
+      "id": "read-agent-tool-schema",
+      "command": "taco --json --no-input agent schema show agent-tool -o json",
+      "purpose": "确认 Workflow Tool 的 provider_id 必须是 workflow_tool_id。"
+    },
+    {
+      "id": "read-agent-example",
+      "command": "taco --json --no-input agent example describe agent-workflow-tool -o json",
+      "purpose": "读取 schema 合法的 Workflow Tool Agent 示例；示例中的发现占位符不能直接发布。"
+    },
+    {
+      "id": "workflow-create",
+      "command": "taco --json --no-input agent workflow create --name <workflow-name> --description <workflow-description> --output workflow.yaml --yes",
+      "purpose": "在专用测试 workspace 创建 Workflow 并生成本地 DSL。",
+      "approval_required": true,
+      "captures": {
+        "workflow_app_id": "data.app_id",
+        "workflow_dsl_path": "data.path"
+      }
+    },
+    {
+      "id": "edit-workflow-dsl",
+      "action": "edit_file",
+      "path": "workflow.yaml",
+      "purpose": "由人工或 Agent 严格按已发现 schema 编辑；inputs 将编译为 Start 输入并派生 Tool 参数，secret 只写 selector 引用。",
+      "instructions": [
+        "以 workflow-http 示例为起点，只使用 schema 支持的 HTTP 节点。",
+        "按 inputs 创建 workflow-inputs.json 测试数据，不得包含真实 secret。",
+        "真实 secret 只保存在后续 --from-env 指定的环境变量中。"
+      ],
+      "approval_required": true
+    },
+    {
+      "id": "workflow-validate",
+      "command": "taco --json --no-input agent workflow validate -f workflow.yaml",
+      "purpose": "仅在本地校验并编译 DSL，不产生远端写入。"
+    },
+    {
+      "id": "workflow-apply-dry-run",
+      "command": "taco --json --no-input agent workflow apply <workflow-app-id> -f workflow.yaml --dry-run",
+      "purpose": "读取远端 draft 并检查变更计划；不得把 dry-run 当作已同步。"
+    },
+    {
+      "id": "workflow-apply",
+      "command": "taco --json --no-input agent workflow apply <workflow-app-id> -f workflow.yaml --yes",
+      "purpose": "在单独批准后同步远端 draft。",
+      "approval_required": true
+    },
+    {
+      "id": "workflow-secret-set",
+      "command": "taco --json --no-input agent workflow secret set <workflow-app-id> <secret-selector> --from-env TACO_WORKFLOW_SECRET --yes",
+      "purpose": "仅在 DSL 引用了尚未配置的 secret 时，从安全环境变量写入远端。",
+      "when": "workflow.secret.required == true && workflow.secret.configured == false",
+      "approval_required": true
+    },
+    {
+      "id": "workflow-run",
+      "command": "taco --json --no-input agent workflow run <workflow-app-id> --inputs-file workflow-inputs.json --stream-events",
+      "purpose": "在确认专用非生产 endpoint 并取得用户批准后调试 draft；该操作会真实触发外部 HTTP，最终成功 envelope 才包含 outputs。",
+      "when": "external_http.approved == true && external_http.endpoint_verified_non_production == true",
+      "approval_required": true,
+      "expected_events": [
+        "workflow_started",
+        "node_started",
+        "node_finished",
+        "workflow_finished"
+      ],
+      "expected_outputs": [
+        "customer",
+        "status"
+      ]
+    },
+    {
+      "id": "workflow-publish",
+      "command": "taco --json --no-input agent workflow publish <workflow-app-id> --title <version-title> --notes <release-notes> --yes",
+      "purpose": "发布已完成本地校验、同步和真实调试的 Workflow draft。",
+      "approval_required": true
+    },
+    {
+      "id": "workflow-tool-publish",
+      "command": "taco --json --no-input agent workflow tool publish <workflow-app-id> -f workflow.yaml --name <workflow-tool-name> --yes",
+      "purpose": "在 Workflow 已发布后，将 DSL inputs（Start 输入）派生为 Tool 参数并注册到 workspace。",
+      "requires": [
+        "workflow-publish"
+      ],
+      "approval_required": true
+    },
+    {
+      "id": "workflow-tool-get",
+      "command": "taco --json --no-input agent workflow tool get --app-id <workflow-app-id>",
+      "purpose": "按 Workflow app ID 获取服务端真实 workflow_tool_id 和机器名，禁止猜测。",
+      "captures": {
+        "workflow_tool_id": "data.workflow_tool_id",
+        "workflow_tool_name": "data.name"
+      }
+    },
+    {
+      "id": "workflow-tool-update",
+      "command": "taco --json --no-input agent workflow tool update <workflow-tool-id> -f workflow.yaml --name <workflow-tool-name> --yes",
+      "purpose": "仅在 Tool 元数据或由 Start 输入派生的参数发生变化时，使用已发现 ID 更新。",
+      "when": "workflow_tool.metadata_or_start_inputs_changed == true",
+      "requires": [
+        "workflow-tool-get"
+      ],
+      "approval_required": true
+    },
+    {
+      "id": "agent-pull",
+      "command": "taco --json --no-input agent pull <agent-app-id> --output agent.json",
+      "purpose": "仅在没有本地 Agent DSL 时，从专用测试 Agent 拉取配置。",
+      "when": "agent.dsl.exists == false",
+      "approval_required": true
+    },
+    {
+      "id": "use-existing-agent-dsl",
+      "action": "use_file",
+      "path": "agent.json",
+      "purpose": "已有 DSL 时直接使用，且不得用示例占位符覆盖真实模型配置。",
+      "when": "agent.dsl.exists == true"
+    },
+    {
+      "id": "agent-tool-add",
+      "command": "taco --json --no-input agent tool add --type workflow --dsl agent.json --provider <workflow-tool-id> --tool <workflow-tool-name> --yes",
+      "purpose": "动态解析并挂载 Workflow Tool；provider 会写入 workflow_tool_id，LLM 参数从 Start 输入解析为空字符串占位。",
+      "requires": [
+        "workflow-tool-get"
+      ],
+      "approval_required": true
+    },
+    {
+      "id": "agent-tool-list",
+      "command": "taco --json --no-input agent tool list --dsl agent.json",
+      "purpose": "确认挂载项 provider_type 为 workflow、provider_id 为真实 workflow_tool_id。"
+    },
+    {
+      "id": "agent-validate",
+      "command": "taco --json --no-input agent validate --dsl agent.json",
+      "purpose": "调试前校验完整 Agent DSL。"
+    },
+    {
+      "id": "agent-run-tool-positive",
+      "command": "taco --json --no-input agent run <agent-app-id> --dsl agent.json --query <应调用-workflow-tool-的问题> --stream-events",
+      "purpose": "在确认非生产 endpoint 并取得用户批准后，验证满足提示词条件时真实调用 Workflow Tool；该操作可能触发外部 HTTP。",
+      "when": "external_http.approved == true && external_http.endpoint_verified_non_production == true",
+      "approval_required": true,
+      "expected_events": [
+        "agent_thought",
+        "message_end"
+      ],
+      "expected_tool_call": true
+    },
+    {
+      "id": "agent-run-tool-negative",
+      "command": "taco --json --no-input agent run <agent-app-id> --dsl agent.json --query <不应调用-workflow-tool-的问题> --stream-events",
+      "purpose": "在确认非生产 endpoint 并取得用户批准后验证负向问题；模型仍可能意外调用工具并触发外部 HTTP，因此同样受门禁保护。",
+      "when": "external_http.approved == true && external_http.endpoint_verified_non_production == true",
+      "approval_required": true,
+      "expected_events": [
+        "message_end"
+      ],
+      "expected_tool_call": false
+    },
+    {
+      "id": "agent-publish",
+      "command": "taco --json --no-input agent publish <agent-app-id> --dsl agent.json --keep-dsl --yes",
+      "purpose": "仅在正向和负向调试均通过后，显式批准并发布 Agent。",
+      "approval_required": true
+    }
+  ]
+}

taco/assets/schemas/README.md

@@ -0,0 +1,3 @@
+# TACO Schemas
+
+CLI 可发现的 DSL schema 资源位于此目录。

taco/assets/schemas/agent-tool.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://taco.local/schemas/agent-tool.json",
+  "title": "TACO Agent Tool Entry",
+  "description": "Agent DSL 中的 builtin 或 Workflow Tool 挂载项。",
+  "x-taco": {
+    "example": "agent-builtin-tool",
+    "commands": [
+      "tool provider list",
+      "tool list",
+      "tool describe",
+      "workflow tool get",
+      "workflow tool publish",
+      "workflow tool update",
+      "agent tool add",
+      "agent tool remove"
+    ],
+    "risks": [
+      "agent tool add/remove 会修改本地 DSL，必须显式确认。",
+      "Provider 凭据和 secret-input 不得写入 tool_parameters。",
+      "Workflow Tool 挂载必须使用 workflow_tool_id，不能使用 workflow_app_id。",
+      "workflow tool publish/update 不会自动发布 Workflow。"
+    ]
+  },
+  "type": "object",
+  "required": [
+    "provider_type",
+    "provider_id",
+    "provider_name",
+    "tool_name",
+    "tool_label",
+    "tool_parameters",
+    "enabled"
+  ],
+  "properties": {
+    "provider_type": {
+      "enum": [
+        "builtin",
+        "workflow"
+      ]
+    },
+    "provider_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "provider_name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "tool_name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "tool_label": {
+      "type": "string",
+      "minLength": 1
+    },
+    "tool_parameters": {
+      "type": "object",
+      "description": "builtin 保存安全 form 参数；workflow 同时包含空字符串 LLM 参数和安全 form 参数，不得保存 Provider 凭据。"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "plugin_unique_identifier": {
+      "type": "string",
+      "minLength": 1
+    }
+  },
+  "additionalProperties": true
+}