Back to Details

manage-railcode-org

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Manage Railcode Org

管理Railcode组织

Update First

先更新

Before answering a Railcode management or CLI question or running a 
railcode
command, update the installed Railcode skills and CLI, then confirm npm's published version:
bash
npx skills add Railcode-HQ/railcode-skills
npm install -g railcode@latest
railcode --version
npm view railcode version
If the skill changes, re-read this file from the top. If npm is unreachable, state that the latest version could not be verified and do not claim this guidance is current. This version was checked against published Railcode CLI 0.1.28.
Since 0.1.28 the CLI self-updates within its major version — but only on an interactive terminal, and agent-driven sessions are non-interactive, so keep running the explicit 
npm install -g railcode@latest
above rather than assuming you're on the latest.
在解答Railcode管理或CLI相关问题，或执行
railcode
命令之前，请先更新已安装的Railcode技能和CLI，然后确认npm上的已发布版本：
bash
npx skills add Railcode-HQ/railcode-skills
npm install -g railcode@latest
railcode --version
npm view railcode version
如果技能有更新，请从头重新阅读本文档。如果无法访问npm，请说明无法验证最新版本，且不要声称本指南是当前最新版本。本版本是基于已发布的Railcode CLI 0.1.28进行校验的。
自0.1.28版本起，CLI会在其大版本内自动更新，但仅在交互式终端中生效，而Agent驱动的会话是非交互式的，因此请持续运行上述显式的
npm install -g railcode@latest
命令，不要假设已处于最新版本。

Management Workflow

管理工作流

1. Authenticate and establish scope

1. 身份验证并确定作用域

Run 
railcode login
if needed. Management commands target the organization saved by login and work from any directory; they do not require an app or 
railcode.json
.
Before mutating state, confirm the intended organization and inspect the current resource. Most references accept a name, slug, or email as appropriate, or a UUID. Prefer UUIDs when a human-readable reference is ambiguous. Use 
--json
when a machine-readable result matters.
如有需要，运行
railcode login
命令。管理命令会针对登录时保存的组织，可在任意目录下执行；无需应用或
railcode.json
文件。
在修改状态之前，请确认目标组织并检查当前资源。大多数引用会根据情况接受名称、别名、邮箱或UUID。当人类可读的引用存在歧义时，优先使用UUID。当需要机器可读的结果时，使用
--json
参数。

2. Inspect before changing

2. 修改前先检查

Use the matching read command first: 
apps show/access
, 
members list
, 
roles list/grants/effective/catalog
, 
connections list
, 
connector list --admin
/
native
, 
query list
, 
analytics
, or 
logs
.
Owner/admin permissions are enforced server-side. A 
403
is an authority boundary, not a reason to bypass the CLI or use another credential without the user's authorization.
先使用对应的读取命令：
apps show/access
、
members list
、
roles list/grants/effective/catalog
、
connections list
、
connector list --admin
/
native
、
query list
、
analytics
或
logs
。
所有者/管理员权限由服务器端强制执行。
403
错误代表权限边界，未经用户授权，请勿绕过CLI或使用其他凭据。

3. Apply the narrowest mutation

3. 应用最窄范围的修改

Change only the named resource. Preserve least privilege:
  • grant specific resources instead of 
    *
    unless broad access is explicitly intended;
  • prefer saved queries over ad-hoc SQL authority;
  • restrict service-connector HTTP methods;
  • avoid embedding credentials in shell history—prefer the supported file options;
  • do not delete, remove a member, transfer ownership, revoke access, or rotate credentials unless the user requested that state change.
仅修改指定资源。遵循最小权限原则：
  • 授予特定资源权限而非
    *
    ，除非明确需要广泛访问；
  • 优先使用已保存查询而非临时SQL权限；
  • 限制服务连接器的HTTP方法；
  • 避免在Shell历史中嵌入凭据——优先使用支持的文件选项；
  • 除非用户明确要求，否则不要执行删除、移除成员、转移所有权、撤销访问或轮换凭据操作。

4. Verify effective state

4. 验证生效状态

Repeat the relevant read command after mutation. For access changes, verify both the direct policy and computed grants (
apps access
, 
roles effective
). For connector setup, validate with the least invasive list/docs/query operation that proves configuration without causing unrequested downstream side effects.
修改后重复执行相关的读取命令。对于访问权限变更，需同时验证直接策略和计算出的权限（
apps access
、
roles effective
）。对于连接器设置，使用侵入性最小的列表/文档/查询操作验证配置，避免产生未请求的下游副作用。

Capability Boundaries

能力边界

  • members list
    is readable by any member; member mutations require admin authority.
  • App list/show/access follow per-app visibility; set-access/transfer/archive/unarchive/delete require manage rights (owner or org admin).
  • Roles, grants, connections, connector administration, analytics, and logs are capability- gated server-side.
  • The CLI cannot create a member. A new person joins through the invite flow in the web app; the CLI then lists, re-roles, or removes them.
  • apps delete
    removes deploys and app data and is irreversible. 
    apps archive
    is the reversible alternative — the app keeps serving, keeps its data, and keeps running its agents; it only leaves the launcher. Propose archiving whenever the user's goal is to retire an app rather than destroy it.
  • app kv
    / 
    app files
    (singular 
    app
    ) read and write a deployed app's records and files. They need an owner grant or 
    app:manage_any
    , and 
    set
    /
    delete
    /
    drop
    /
    upload
    mutate live tenant data — including individual members' private scopes. Inspect first; mutate only what was asked for.
  • roles materialize
    expands a wildcard into explicit rows; inspect the subject and resource first because it changes future grant maintenance semantics.
  • members list
    命令可被任意成员读取；修改成员信息需要管理员权限。
  • 应用列表/查看/访问遵循每个应用的可见性设置；设置权限/转移所有权/归档/取消归档/删除应用需要管理权限（所有者或组织管理员）。
  • 角色、权限授予、连接、连接器管理、分析和日志均由服务器端进行能力限制。
  • CLI无法创建成员。新成员需通过Web应用的邀请流程加入；之后可通过CLI列出成员、变更角色或移除成员。
  • apps delete
    命令会移除部署和应用数据，且不可恢复。
    apps archive
    是可逆的替代方案——应用会继续提供服务、保留数据并运行其Agent；仅会从启动器中移除。当用户的目标是停用而非销毁应用时，建议使用归档操作。
  • app kv
    / 
    app files
    （单数
    app
    ）用于读写已部署应用的记录和文件。需要所有者权限或
    app:manage_any
    权限，且
    set
    /
    delete
    /
    drop
    /
    upload
    操作会修改实时租户数据——包括单个成员的私有作用域。请先检查，仅修改用户要求的内容。
  • roles materialize
    命令会将通配符展开为明确的行；请先检查主体和资源，因为这会改变未来权限授予的维护语义。

Skill Boundaries

技能边界

Use 
$create-railcode-app
for scaffolding, developing, testing, manifesting, and deploying a static app. Use 
$create-railcode-agent
for managed-agent JSON manifests, tests, invocations, and schedules. This skill owns the organization-level administration those builders may depend on.
使用
$create-railcode-app
进行静态应用的脚手架搭建、开发、测试、清单编写和部署。使用
$create-railcode-agent
进行托管Agent的JSON清单编写、测试、调用和调度。本技能负责这些构建工具所依赖的组织级管理工作。

Reference

参考资料

Read CLI management reference for exact commands, flags, resource types, access modes, connection shapes, log filters, and saved-query administration.
阅读CLI管理参考文档获取确切的命令、参数、资源类型、访问模式、连接格式、日志过滤器以及已保存查询的管理方法。