tk-wizard

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

User-Run Wizard

用户执行向导

Guide

host-session

procedures that users must perform themselves. Internally, strictly track steps, value sources/destinations, secrecy, and safety boundaries, but do not dump them to the user like an approval document.

Keep the conversation natural and the state strict.

Initially describe the full journey in only 1–3 sentences, then naturally guide the user through one action they must take now. Do not repeatedly confirm already completed steps. 사용자가 action이나 비가역 confirmation을 선택해야 하면 host별 native structured question surface를 우선 사용합니다 (Claude Code: AskUserQuestion; Codex: request_user_input; Hermes: clarify). unavailable하면 같은 안내를 plain chat으로 fallback하고 secret 자체를 tool input으로 수집하지 않습니다.

引导用户必须亲自完成的

host-session

流程。内部需严格追踪步骤、值的来源/去向、保密性及安全边界，但不得像审批文档一样将这些信息直接展示给用户。

保持对话自然，状态管控严格。

最初仅用1-3句话描述完整流程，然后自然引导用户完成当前必须执行的一项操作。无需反复确认已完成的步骤。当用户需要选择操作或不可逆确认时，优先使用对应host的原生结构化提问界面（Claude Code：AskUserQuestion；Codex：request_user_input；Hermes：clarify）。若无法使用，则退化为普通聊天形式进行引导，且不将secret本身作为工具输入收集。

Scope

适用范围

Applicable examples:

```
provisioning
```
and
```
dashboard
```
setup
Issuing and placing
```
credential
```
/
```
secret
```
values
```
login
```
, MFA, OTP, CAPTCHA,
```
passkey
```
```
permission
```
/
```
keychain
```
/
```
device
```
```
pairing
```
Human-only steps during
```
migration
```
/
```
cutover
```

Routine code/CLI tasks the

agent

can safely execute, product decisions, and

acceptance

verification

are outside this skill's scope.

适用场景示例：

```
provisioning
```
与
```
dashboard
```
设置
```
credential
```
/
```
secret
```
值的发放与配置
```
login
```
、MFA、OTP、CAPTCHA、
```
passkey
```
相关操作
```
permission
```
/
```
keychain
```
/
```
device
```
```
pairing
```
配对
```
migration
```
/
```
cutover
```
过程中仅能由人工完成的步骤

agent

可安全执行的常规代码/CLI任务、产品决策及

acceptance

verification

验收验证不在本技能的适用范围内。

Research and Planning

调研与规划

upstream provenance

또는

adaptation

판단이 필요할 때만 upstream 증류를 읽고, 일반

wizard

실행에서는 읽지 않습니다.

First read the

repository

and current

host

evidence

to build this internal state:

Full journey and sequence
Each value's
```
source
```
/
```
destination
```
```
secret
```
/
```
public
```
classification
Already completed steps
Steps the user must perform
Irreversible steps
Verifiable
```
completion
```
```
signal
```

Do not invent unknown UI, buttons, URLs, or commands. Where evidence is unavailable, describe only that point as

Unverifiable

For example, tell the user:

text

대략 키 발급 → 로컬 저장 → 연결 확인 세 단계면 끝납니다.
키 값은 대화에 남기지 않을게요. 먼저 발급 화면까지 들어가 주세요.

Guide the next step only after observing the previous step's

completion

仅当需要判断

upstream provenance

上游来源或

adaptation

适配性时，才阅读上游提炼，常规

wizard

向导执行无需阅读。

首先读取

repository

仓库及当前

host

主机的

evidence

证据，构建以下内部状态：

完整流程与步骤顺序
每个值的
```
source
```
来源/
```
destination
```
去向
```
secret
```
机密/
```
public
```
公开的分类
已完成的步骤
用户必须执行的步骤
不可逆步骤
可验证的
```
completion
```
完成
```
signal
```
信号

不得虚构未知的UI、按钮、URL或命令。当证据缺失时，仅将该环节标注为

Unverifiable

无法验证。

例如，告知用户：

text

大致分为密钥发放 → 本地存储 → 连接验证三个步骤即可完成。
我不会在对话中留存密钥值，请先进入发放页面。

仅在观察到上一步的

completion

完成状态后，再引导下一步操作。

Secrets and Authentication

机密信息与身份验证

Never

echo

secret

or store it in

chat

, Markdown,

log

, or

eval

. When necessary, use only

hidden

ephemeral

input

at execution time.

Do not prompt users to paste OTP,

password

token

session

value

, or

recovery

code

into the conversation. Do not retain even non-secret

identifier

values unless needed for the task.

If a

helper

is needed, create it as a one-time

user-run

helper

and preserve these semantics:

Separate normal input from
```
secret
```
```
input
```
Do not
```
persist
```
```
secret
```
values by default
Clearly show the
```
destination
```
Do not silently overwrite existing values
Statically validate with
```
bash -n
```
and, when possible,
```
shellcheck
```
Explain how to delete or retain it afterward

绝不可

echo

输出

secret

机密信息，也不得将其存储在

chat

聊天记录、Markdown、

log

日志或

eval

执行环境中。必要时，仅在执行阶段使用

hidden

隐藏/

ephemeral

临时输入框。

不得提示用户将OTP、

password

密码、

token

令牌、

session

会话

value

值或

recovery

恢复

code

码粘贴到对话中。除非任务必需，否则即使是非机密的

identifier

标识值也不得留存。

若需要辅助工具，需创建一次性的

user-run

用户执行

helper

辅助工具，并遵循以下规则：

将普通输入与
```
secret
```
机密输入分离
默认不
```
persist
```
持久化存储
```
secret
```
机密值
清晰展示
```
destination
```
去向
不得静默覆盖现有值
使用
```
bash -n
```
进行静态验证，尽可能同时使用
```
shellcheck
```
检查
事后说明如何删除或保留该工具

🔴 CHECKPOINT · 🛑 STOP · Safety Confirmation

🔴 检查点 · 🛑 终止 · 安全确认

Treat irreversible, production-affecting, or unverifiable steps below as hard stops; ordinary reversible steps remain frictionless.

Do not ask for approval at every ordinary

reversible

step. Require explicit confirmation only for actions that change the user's decision, are difficult to reverse, or affect

production

Example:

text

여기서 기존 production key를 폐기하면 현재 서비스에 영향이 생길 수 있어요.
새 key 연결이 정상인지 먼저 확인한 뒤 폐기하는 걸 권장합니다.
새 key 확인 후 기존 key를 폐기할까요?

If no safe verification path exists, do not rush execution; explain the state as

Blocked

Unverifiable

将不可逆、影响生产环境或无法验证的步骤视为强制终止节点；普通可逆步骤则保持流畅无需中断。

无需对每个普通的

reversible

可逆步骤请求批准。仅当操作会改变用户决策、难以撤销或影响

production

生产环境时，才要求明确确认。

示例：

text

在此处废弃现有生产密钥可能会影响当前服务。
建议先确认新密钥连接正常后再进行废弃操作。
确认新密钥正常后，是否要废弃旧密钥？

若不存在安全的验证路径，请勿急于执行；需将状态说明为

Blocked

受阻或

Unverifiable

无法验证。

Completion

完成阶段

At the end, briefly explain what the user completed and how it was verified. Do not expose a

stage

table

secret

inventory

, internal state machine, or long

receipt

by default.

Use exactly one actual state from

Status: Pass | Pending | Blocked | Unverifiable | Fail

as the

terminal

token

结束时，简要说明用户完成的内容及验证方式。默认不得暴露

stage

阶段

table

表格、

secret

机密

inventory

清单、内部状态机或冗长的

receipt

回执。

需使用

Status: Pass | Pending | Blocked | Unverifiable | Fail

中的某一实际状态作为

terminal

终结

token

标识。