{"data":{"schema_version":"2026.08.29.agent-install-wizard.1","status":"ready","agent":"auto","server_name":"deepsellers-kb","recommended_endpoint":"https://kb.deepsellers.com:8443/mcp","recommended_transport_order":["remote-http-if-supported","local-stdio-bridge"],"install_metadata_url":"https://kb.deepsellers.com:8443/install.json","agent_bootstrap_url":"https://kb.deepsellers.com:8443/install/bootstrap.json","client_mode_matrix_url":"https://kb.deepsellers.com:8443/install/client-matrix.json","client_mode_matrix":{"schema_version":"2026.08.29.client-mode-matrix.1","status":"ready","server_name":"deepsellers-kb","mcp_url":"https://kb.deepsellers.com:8443/mcp","token_env_var":"ALLEN_KB_TOKEN","token_values_returned":false,"decision_order":[{"id":"native_remote_http","use_when":"The Agent client explicitly supports JSON-RPC HTTP POST MCP with bearer token or secret-store auth and does not require a long-lived SSE session.","recommended":false,"transport":"remote-http","config_template":"mcp-config.remote-http-template.json","mcp_url":"https://kb.deepsellers.com:8443/mcp","customer_steps":["store the customer token in the client secret store or env.ALLEN_KB_TOKEN","configure the Remote/HTTP MCP URL","keep version headers when the client supports custom headers","restart/trust the connector if required"],"fallback_if_failed":"local_stdio_bridge"},{"id":"workbuddy_codex_auto","use_when":"The Agent is WorkBuddy or Codex, or the Agent can run setup_mcp.py and write its own MCP config.","recommended":true,"transport":"local-stdio-bridge","setup_command":"python setup_mcp.py --client auto","requires_agent_pack":true,"requires_restart":true,"requires_trust_when_prompted":true,"fallback_if_failed":"generic_stdio"},{"id":"generic_stdio","use_when":"The Agent only accepts a local stdio MCP server config.","recommended":false,"transport":"local-stdio-bridge","setup_command":"python setup_mcp.py --client generic","config_artifacts":["generic-stdio-mcp-config.json","generic-stdio-mcp-config.toml"],"fallback_if_failed":"ask_customer_for_client_logs_without_token"}],"profiles":{"workbuddy":{"default_choice":"workbuddy_codex_auto","why":"WorkBuddy starts local stdio connectors more reliably than native Remote/HTTP for this service and requires Trust/enable after config changes.","must_not":["hard-code another user's absolute path","put token in args","leave placeholders in command"]},"codex":{"default_choice":"workbuddy_codex_auto","why":"Codex should use the local stdio bridge for a stable live RPC channel and env.ALLEN_KB_TOKEN for auth.","must_not":["put token in args","skip install_diagnose.py --self-test"]},"remote-http-capable":{"default_choice":"native_remote_http","why":"Use only when the client supports this service's JSON-RPC HTTP POST transport and can store Authorization headers securely.","must_not":["use port 443 before ICP filing is complete","send the token in public chat or screenshots"]},"unknown":{"default_choice":"workbuddy_codex_auto","why":"Auto setup can detect supported local clients and generate generic stdio fallback files.","must_not":["ask the user many setup questions before reading install metadata"]}},"agent_auto_decision_rules":["First read /install/bootstrap.json, /install/client-matrix.json, /install/wizard.json, and /install.json.","If the client is WorkBuddy or Codex, choose workbuddy_codex_auto and run setup_mcp.py --client auto.","Choose native_remote_http only when the client explicitly supports JSON-RPC HTTP POST MCP with secure Authorization headers and does not require an SSE session.","If only stdio MCP config is supported, choose generic_stdio and import the generated config artifact.","If setup fails, follow self_healing_contract.repair_sequence before asking the customer for more input.","If repair still fails, export the safe support bundle and report only redacted diagnostics."],"self_healing_contract":{"schema_version":"2026.08.29.agent-self-healing.1","status":"ready","mcp_url":"https://kb.deepsellers.com:8443/mcp","safe_endpoint":"https://kb.deepsellers.com:8443/mcp","do_not_try_443_until_icp_restored":true,"token_env_var":"ALLEN_KB_TOKEN","diagnostic_command":"python install_diagnose.py --self-test","upgrade_command":"python upgrade_mcp.py --client auto","support_bundle_url":"https://kb.deepsellers.com:8443/portal/support-bundle?format=text&days=30","client_matrix_url":"https://kb.deepsellers.com:8443/install/client-matrix.json","wizard_url":"https://kb.deepsellers.com:8443/install/wizard.json","agent_may_repair_without_more_questions":true,"repair_sequence":[{"id":"verify_endpoint","trigger":"tls_reset_on_443 or connection_closed_before_mcp_initialize","action":"Use the safe 8443 endpoint from mcp_url and do not switch to 443 until ICP filing is complete.","success":"HTTPS health or MCP initialize reaches kb.deepsellers.com:8443."},{"id":"verify_token_env","trigger":"401 or unauthorized","action":"Check that ALLEN_KB_TOKEN exists in the Agent process environment or local secret store without printing it.","success":"Token is present, not in args, and not printed in logs."},{"id":"rerun_setup","trigger":"stuck_connecting, connection_closed, tools_missing, placeholder_path_detected","action":"From the stable install directory, run setup_mcp.py --client auto for WorkBuddy/Codex or --client generic for stdio-only clients.","success":"Config uses an absolute Python path, stable remote_bridge.py path, and env.ALLEN_KB_TOKEN."},{"id":"restart_and_trust","trigger":"configured_but_tools_missing or client_shows_pending_connector","action":"Fully quit and reopen the Agent, then trust/enable deepsellers-kb when the client asks.","success":"Tools list includes kb_context, kb_answer_check, and kb_search."},{"id":"run_live_quality_check","trigger":"tools_present_after_setup","action":"Ask the test question, call kb_context first, draft an answer, then call kb_answer_check with the context packet.","success":"context_quality.ok=true, relevance_pass=true, answer_check_ok=true, and answer_check_citation_coverage_pass=true."},{"id":"export_safe_support_bundle","trigger":"repair_sequence_failed","action":"Use support_bundle_url with the customer's bearer token and send the downloaded text to DeepSellers support.","success":"Support bundle is generated and contains no raw token or secret material."}],"error_map":{"401":"Token is missing, expired, revoked, or not visible to the MCP process.","403":"Token scope, customer permission, or optional IP policy does not allow the request.","429":"Minute rate limit, daily quota, or concurrency cap was reached.","connection_closed":"Local stdio bridge crashed or endpoint/TLS setup failed before MCP initialization.","stuck_connecting":"Agent did not restart/trust the connector or local config still points at a bad command path.","tls_reset_on_443":"Domestic 80/443 SNI access is unavailable until ICP filing is complete; keep 8443.","tools_missing":"MCP config was not loaded, connector is not trusted, or setup wrote to the wrong client profile."},"reporting_rules":["Never print the full token in diagnostics, logs, screenshots, or support messages.","Report only redacted token presence, chosen client mode, config file path, tool list, and acceptance markers.","If support is needed, export /portal/support-bundle?format=text&days=30 instead of sending local config with secrets."],"secret_material_returned":false},"failure_triage":[{"symptom":"stuck_connecting","likely_cause":"client did not restart, connector not trusted, or local stdio bridge is waiting on a bad command path","safe_action":"fully quit the Agent, reopen it, trust/enable deepsellers-kb, then run install_diagnose.py --self-test"},{"symptom":"connection_closed","likely_cause":"stdio bridge crashed because Python path, script path, or token env is wrong","safe_action":"rerun setup_mcp.py --client auto from the stable install directory; do not hand-edit token into args"},{"symptom":"tls_reset_on_443","likely_cause":"kb.deepsellers.com 80/443 SNI access is blocked until ICP filing is complete","safe_action":"use https://kb.deepsellers.com:8443/mcp until ICP filing restores 443"},{"symptom":"401","likely_cause":"token missing, expired, revoked, or not available to the MCP process environment","safe_action":"verify ALLEN_KB_TOKEN exists locally without printing it; request rotation if needed"},{"symptom":"429","likely_cause":"minute rate limit, daily quota, or concurrency limit reached","safe_action":"wait for quota reset or upgrade the customer plan"}],"acceptance":{"required_tools":["kb_context","kb_answer_check","kb_search"],"required_order":["kb_context","kb_answer_check","kb_search"],"do_not_use_search_only":true,"test_question":"如何优化亚马逊广告结构？","success_markers":["context_quality.ok=true","relevance_pass=true","answer_quality_contract_ok=true","answer_check_ok=true","answer_check_citation_coverage_pass=true","no_token_in_args_or_logs"]},"user_prompt_short":"请自动接入 DeepSellers KB。先读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 /install.json；WorkBuddy/Codex 默认下载 Agent Pack 后用 ALLEN_KB_TOKEN 运行 setup_mcp.py --client auto；只有客户端明确支持 JSON-RPC HTTP POST MCP 且能安全保存 Authorization Header 时，才直接连 https://kb.deepsellers.com:8443/mcp；如连接失败，按 self_healing_contract.repair_sequence 自愈并导出安全支持包；不要输出完整 token，完成后用 kb_context 和 kb_answer_check 自测。","secret_material_returned":false},"self_healing_contract":{"schema_version":"2026.08.29.agent-self-healing.1","status":"ready","mcp_url":"https://kb.deepsellers.com:8443/mcp","safe_endpoint":"https://kb.deepsellers.com:8443/mcp","do_not_try_443_until_icp_restored":true,"token_env_var":"ALLEN_KB_TOKEN","diagnostic_command":"python install_diagnose.py --self-test","upgrade_command":"python upgrade_mcp.py --client auto","support_bundle_url":"https://kb.deepsellers.com:8443/portal/support-bundle?format=text&days=30","client_matrix_url":"https://kb.deepsellers.com:8443/install/client-matrix.json","wizard_url":"https://kb.deepsellers.com:8443/install/wizard.json","agent_may_repair_without_more_questions":true,"repair_sequence":[{"id":"verify_endpoint","trigger":"tls_reset_on_443 or connection_closed_before_mcp_initialize","action":"Use the safe 8443 endpoint from mcp_url and do not switch to 443 until ICP filing is complete.","success":"HTTPS health or MCP initialize reaches kb.deepsellers.com:8443."},{"id":"verify_token_env","trigger":"401 or unauthorized","action":"Check that ALLEN_KB_TOKEN exists in the Agent process environment or local secret store without printing it.","success":"Token is present, not in args, and not printed in logs."},{"id":"rerun_setup","trigger":"stuck_connecting, connection_closed, tools_missing, placeholder_path_detected","action":"From the stable install directory, run setup_mcp.py --client auto for WorkBuddy/Codex or --client generic for stdio-only clients.","success":"Config uses an absolute Python path, stable remote_bridge.py path, and env.ALLEN_KB_TOKEN."},{"id":"restart_and_trust","trigger":"configured_but_tools_missing or client_shows_pending_connector","action":"Fully quit and reopen the Agent, then trust/enable deepsellers-kb when the client asks.","success":"Tools list includes kb_context, kb_answer_check, and kb_search."},{"id":"run_live_quality_check","trigger":"tools_present_after_setup","action":"Ask the test question, call kb_context first, draft an answer, then call kb_answer_check with the context packet.","success":"context_quality.ok=true, relevance_pass=true, answer_check_ok=true, and answer_check_citation_coverage_pass=true."},{"id":"export_safe_support_bundle","trigger":"repair_sequence_failed","action":"Use support_bundle_url with the customer's bearer token and send the downloaded text to DeepSellers support.","success":"Support bundle is generated and contains no raw token or secret material."}],"error_map":{"401":"Token is missing, expired, revoked, or not visible to the MCP process.","403":"Token scope, customer permission, or optional IP policy does not allow the request.","429":"Minute rate limit, daily quota, or concurrency cap was reached.","connection_closed":"Local stdio bridge crashed or endpoint/TLS setup failed before MCP initialization.","stuck_connecting":"Agent did not restart/trust the connector or local config still points at a bad command path.","tls_reset_on_443":"Domestic 80/443 SNI access is unavailable until ICP filing is complete; keep 8443.","tools_missing":"MCP config was not loaded, connector is not trusted, or setup wrote to the wrong client profile."},"reporting_rules":["Never print the full token in diagnostics, logs, screenshots, or support messages.","Report only redacted token presence, chosen client mode, config file path, tool list, and acceptance markers.","If support is needed, export /portal/support-bundle?format=text&days=30 instead of sending local config with secrets."],"secret_material_returned":false},"client_compatibility_url":"https://kb.deepsellers.com:8443/install/compatibility","client_report_url":"https://kb.deepsellers.com:8443/v1/client-report","agent_pack_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip","setup_prompt_url":"https://kb.deepsellers.com:8443/download/ask-agent-to-setup.txt","install_wizard_url":"https://kb.deepsellers.com:8443/install/wizard","install_wizard_json_url":"https://kb.deepsellers.com:8443/install/wizard.json","agent_bootstrap":{"schema_version":"2026.08.29.agent-bootstrap.1","status":"ready","agent":"auto","server_name":"deepsellers-kb","mcp_url":"https://kb.deepsellers.com:8443/mcp","public_base_url":"https://kb.deepsellers.com:8443","install_metadata_url":"https://kb.deepsellers.com:8443/install.json","install_wizard_json_url":"https://kb.deepsellers.com:8443/install/wizard.json","client_mode_matrix_url":"https://kb.deepsellers.com:8443/install/client-matrix.json","client_mode_matrix":{"schema_version":"2026.08.29.client-mode-matrix.1","status":"ready","server_name":"deepsellers-kb","mcp_url":"https://kb.deepsellers.com:8443/mcp","token_env_var":"ALLEN_KB_TOKEN","token_values_returned":false,"decision_order":[{"id":"native_remote_http","use_when":"The Agent client explicitly supports JSON-RPC HTTP POST MCP with bearer token or secret-store auth and does not require a long-lived SSE session.","recommended":false,"transport":"remote-http","config_template":"mcp-config.remote-http-template.json","mcp_url":"https://kb.deepsellers.com:8443/mcp","customer_steps":["store the customer token in the client secret store or env.ALLEN_KB_TOKEN","configure the Remote/HTTP MCP URL","keep version headers when the client supports custom headers","restart/trust the connector if required"],"fallback_if_failed":"local_stdio_bridge"},{"id":"workbuddy_codex_auto","use_when":"The Agent is WorkBuddy or Codex, or the Agent can run setup_mcp.py and write its own MCP config.","recommended":true,"transport":"local-stdio-bridge","setup_command":"python setup_mcp.py --client auto","requires_agent_pack":true,"requires_restart":true,"requires_trust_when_prompted":true,"fallback_if_failed":"generic_stdio"},{"id":"generic_stdio","use_when":"The Agent only accepts a local stdio MCP server config.","recommended":false,"transport":"local-stdio-bridge","setup_command":"python setup_mcp.py --client generic","config_artifacts":["generic-stdio-mcp-config.json","generic-stdio-mcp-config.toml"],"fallback_if_failed":"ask_customer_for_client_logs_without_token"}],"profiles":{"workbuddy":{"default_choice":"workbuddy_codex_auto","why":"WorkBuddy starts local stdio connectors more reliably than native Remote/HTTP for this service and requires Trust/enable after config changes.","must_not":["hard-code another user's absolute path","put token in args","leave placeholders in command"]},"codex":{"default_choice":"workbuddy_codex_auto","why":"Codex should use the local stdio bridge for a stable live RPC channel and env.ALLEN_KB_TOKEN for auth.","must_not":["put token in args","skip install_diagnose.py --self-test"]},"remote-http-capable":{"default_choice":"native_remote_http","why":"Use only when the client supports this service's JSON-RPC HTTP POST transport and can store Authorization headers securely.","must_not":["use port 443 before ICP filing is complete","send the token in public chat or screenshots"]},"unknown":{"default_choice":"workbuddy_codex_auto","why":"Auto setup can detect supported local clients and generate generic stdio fallback files.","must_not":["ask the user many setup questions before reading install metadata"]}},"agent_auto_decision_rules":["First read /install/bootstrap.json, /install/client-matrix.json, /install/wizard.json, and /install.json.","If the client is WorkBuddy or Codex, choose workbuddy_codex_auto and run setup_mcp.py --client auto.","Choose native_remote_http only when the client explicitly supports JSON-RPC HTTP POST MCP with secure Authorization headers and does not require an SSE session.","If only stdio MCP config is supported, choose generic_stdio and import the generated config artifact.","If setup fails, follow self_healing_contract.repair_sequence before asking the customer for more input.","If repair still fails, export the safe support bundle and report only redacted diagnostics."],"self_healing_contract":{"schema_version":"2026.08.29.agent-self-healing.1","status":"ready","mcp_url":"https://kb.deepsellers.com:8443/mcp","safe_endpoint":"https://kb.deepsellers.com:8443/mcp","do_not_try_443_until_icp_restored":true,"token_env_var":"ALLEN_KB_TOKEN","diagnostic_command":"python install_diagnose.py --self-test","upgrade_command":"python upgrade_mcp.py --client auto","support_bundle_url":"https://kb.deepsellers.com:8443/portal/support-bundle?format=text&days=30","client_matrix_url":"https://kb.deepsellers.com:8443/install/client-matrix.json","wizard_url":"https://kb.deepsellers.com:8443/install/wizard.json","agent_may_repair_without_more_questions":true,"repair_sequence":[{"id":"verify_endpoint","trigger":"tls_reset_on_443 or connection_closed_before_mcp_initialize","action":"Use the safe 8443 endpoint from mcp_url and do not switch to 443 until ICP filing is complete.","success":"HTTPS health or MCP initialize reaches kb.deepsellers.com:8443."},{"id":"verify_token_env","trigger":"401 or unauthorized","action":"Check that ALLEN_KB_TOKEN exists in the Agent process environment or local secret store without printing it.","success":"Token is present, not in args, and not printed in logs."},{"id":"rerun_setup","trigger":"stuck_connecting, connection_closed, tools_missing, placeholder_path_detected","action":"From the stable install directory, run setup_mcp.py --client auto for WorkBuddy/Codex or --client generic for stdio-only clients.","success":"Config uses an absolute Python path, stable remote_bridge.py path, and env.ALLEN_KB_TOKEN."},{"id":"restart_and_trust","trigger":"configured_but_tools_missing or client_shows_pending_connector","action":"Fully quit and reopen the Agent, then trust/enable deepsellers-kb when the client asks.","success":"Tools list includes kb_context, kb_answer_check, and kb_search."},{"id":"run_live_quality_check","trigger":"tools_present_after_setup","action":"Ask the test question, call kb_context first, draft an answer, then call kb_answer_check with the context packet.","success":"context_quality.ok=true, relevance_pass=true, answer_check_ok=true, and answer_check_citation_coverage_pass=true."},{"id":"export_safe_support_bundle","trigger":"repair_sequence_failed","action":"Use support_bundle_url with the customer's bearer token and send the downloaded text to DeepSellers support.","success":"Support bundle is generated and contains no raw token or secret material."}],"error_map":{"401":"Token is missing, expired, revoked, or not visible to the MCP process.","403":"Token scope, customer permission, or optional IP policy does not allow the request.","429":"Minute rate limit, daily quota, or concurrency cap was reached.","connection_closed":"Local stdio bridge crashed or endpoint/TLS setup failed before MCP initialization.","stuck_connecting":"Agent did not restart/trust the connector or local config still points at a bad command path.","tls_reset_on_443":"Domestic 80/443 SNI access is unavailable until ICP filing is complete; keep 8443.","tools_missing":"MCP config was not loaded, connector is not trusted, or setup wrote to the wrong client profile."},"reporting_rules":["Never print the full token in diagnostics, logs, screenshots, or support messages.","Report only redacted token presence, chosen client mode, config file path, tool list, and acceptance markers.","If support is needed, export /portal/support-bundle?format=text&days=30 instead of sending local config with secrets."],"secret_material_returned":false},"failure_triage":[{"symptom":"stuck_connecting","likely_cause":"client did not restart, connector not trusted, or local stdio bridge is waiting on a bad command path","safe_action":"fully quit the Agent, reopen it, trust/enable deepsellers-kb, then run install_diagnose.py --self-test"},{"symptom":"connection_closed","likely_cause":"stdio bridge crashed because Python path, script path, or token env is wrong","safe_action":"rerun setup_mcp.py --client auto from the stable install directory; do not hand-edit token into args"},{"symptom":"tls_reset_on_443","likely_cause":"kb.deepsellers.com 80/443 SNI access is blocked until ICP filing is complete","safe_action":"use https://kb.deepsellers.com:8443/mcp until ICP filing restores 443"},{"symptom":"401","likely_cause":"token missing, expired, revoked, or not available to the MCP process environment","safe_action":"verify ALLEN_KB_TOKEN exists locally without printing it; request rotation if needed"},{"symptom":"429","likely_cause":"minute rate limit, daily quota, or concurrency limit reached","safe_action":"wait for quota reset or upgrade the customer plan"}],"acceptance":{"required_tools":["kb_context","kb_answer_check","kb_search"],"required_order":["kb_context","kb_answer_check","kb_search"],"do_not_use_search_only":true,"test_question":"如何优化亚马逊广告结构？","success_markers":["context_quality.ok=true","relevance_pass=true","answer_quality_contract_ok=true","answer_check_ok=true","answer_check_citation_coverage_pass=true","no_token_in_args_or_logs"]},"user_prompt_short":"请自动接入 DeepSellers KB。先读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 /install.json；WorkBuddy/Codex 默认下载 Agent Pack 后用 ALLEN_KB_TOKEN 运行 setup_mcp.py --client auto；只有客户端明确支持 JSON-RPC HTTP POST MCP 且能安全保存 Authorization Header 时，才直接连 https://kb.deepsellers.com:8443/mcp；如连接失败，按 self_healing_contract.repair_sequence 自愈并导出安全支持包；不要输出完整 token，完成后用 kb_context 和 kb_answer_check 自测。","secret_material_returned":false},"self_healing_contract":{"schema_version":"2026.08.29.agent-self-healing.1","status":"ready","mcp_url":"https://kb.deepsellers.com:8443/mcp","safe_endpoint":"https://kb.deepsellers.com:8443/mcp","do_not_try_443_until_icp_restored":true,"token_env_var":"ALLEN_KB_TOKEN","diagnostic_command":"python install_diagnose.py --self-test","upgrade_command":"python upgrade_mcp.py --client auto","support_bundle_url":"https://kb.deepsellers.com:8443/portal/support-bundle?format=text&days=30","client_matrix_url":"https://kb.deepsellers.com:8443/install/client-matrix.json","wizard_url":"https://kb.deepsellers.com:8443/install/wizard.json","agent_may_repair_without_more_questions":true,"repair_sequence":[{"id":"verify_endpoint","trigger":"tls_reset_on_443 or connection_closed_before_mcp_initialize","action":"Use the safe 8443 endpoint from mcp_url and do not switch to 443 until ICP filing is complete.","success":"HTTPS health or MCP initialize reaches kb.deepsellers.com:8443."},{"id":"verify_token_env","trigger":"401 or unauthorized","action":"Check that ALLEN_KB_TOKEN exists in the Agent process environment or local secret store without printing it.","success":"Token is present, not in args, and not printed in logs."},{"id":"rerun_setup","trigger":"stuck_connecting, connection_closed, tools_missing, placeholder_path_detected","action":"From the stable install directory, run setup_mcp.py --client auto for WorkBuddy/Codex or --client generic for stdio-only clients.","success":"Config uses an absolute Python path, stable remote_bridge.py path, and env.ALLEN_KB_TOKEN."},{"id":"restart_and_trust","trigger":"configured_but_tools_missing or client_shows_pending_connector","action":"Fully quit and reopen the Agent, then trust/enable deepsellers-kb when the client asks.","success":"Tools list includes kb_context, kb_answer_check, and kb_search."},{"id":"run_live_quality_check","trigger":"tools_present_after_setup","action":"Ask the test question, call kb_context first, draft an answer, then call kb_answer_check with the context packet.","success":"context_quality.ok=true, relevance_pass=true, answer_check_ok=true, and answer_check_citation_coverage_pass=true."},{"id":"export_safe_support_bundle","trigger":"repair_sequence_failed","action":"Use support_bundle_url with the customer's bearer token and send the downloaded text to DeepSellers support.","success":"Support bundle is generated and contains no raw token or secret material."}],"error_map":{"401":"Token is missing, expired, revoked, or not visible to the MCP process.","403":"Token scope, customer permission, or optional IP policy does not allow the request.","429":"Minute rate limit, daily quota, or concurrency cap was reached.","connection_closed":"Local stdio bridge crashed or endpoint/TLS setup failed before MCP initialization.","stuck_connecting":"Agent did not restart/trust the connector or local config still points at a bad command path.","tls_reset_on_443":"Domestic 80/443 SNI access is unavailable until ICP filing is complete; keep 8443.","tools_missing":"MCP config was not loaded, connector is not trusted, or setup wrote to the wrong client profile."},"reporting_rules":["Never print the full token in diagnostics, logs, screenshots, or support messages.","Report only redacted token presence, chosen client mode, config file path, tool list, and acceptance markers.","If support is needed, export /portal/support-bundle?format=text&days=30 instead of sending local config with secrets."],"secret_material_returned":false},"client_compatibility_url":"https://kb.deepsellers.com:8443/install/compatibility","client_report_url":"https://kb.deepsellers.com:8443/v1/client-report","quickstart_url":"https://kb.deepsellers.com:8443/install/quickstart.json","agent_pack_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip","manifest_url":"https://kb.deepsellers.com:8443/download/agent-pack-manifest.json","sha256_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip.sha256","pack_version":"2026.09.07.1","sha256":"093af03831655c22336f91b57ac2a9a1d361243034ac5fab4522b4c2b98152b5","token_env_var":"ALLEN_KB_TOKEN","token_values_returned":false,"setup_command":"python setup_mcp.py --client auto","upgrade_command":"python upgrade_mcp.py --client auto","compatibility_without_headers":{"schema_version":"2026.08.29.client-compatibility.1","status":"upgrade_required","upgrade_required":true,"reasons":["agent_pack_version_missing","quality_contract_version_missing","answer_quality_contract_version_missing","bridge_version_missing"],"current":{"agent_pack_version":null,"quality_contract_version":null,"answer_quality_contract_version":null,"bridge_version":null},"required":{"agent_pack_version":"2026.09.07.1","quality_contract_version":"2026.08.25.quality.8","answer_quality_contract_version":"2026.08.26.answer-quality.6","bridge_version":"0.4.0"},"recommended_action":"Run upgrade_mcp.py --client auto, keep ALLEN_KB_TOKEN in the environment, restart/trust the Agent, then run install_diagnose.py --self-test.","upgrade_plan":{"schema_version":"2026.08.29.upgrade-plan.1","server_name":"deepsellers-kb","latest_pack_version":"2026.09.07.1","metadata_url":"https://kb.deepsellers.com:8443/install.json","agent_pack_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip","sha256_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip.sha256","expected_sha256":"093af03831655c22336f91b57ac2a9a1d361243034ac5fab4522b4c2b98152b5","verify_sha256":true,"script":"upgrade_mcp.py","token_env_var":"ALLEN_KB_TOKEN","token_values_returned":false,"token_in_args":false,"command":"ALLEN_KB_TOKEN=<customer-token> python upgrade_mcp.py --client auto","steps":["read /install.json before upgrading","download agent-pack.zip","verify SHA256 when expected_sha256 is present","back up the existing stable install directory","preserve generated generic stdio configs when present","extract the latest pack into the stable install directory","rerun setup_mcp.py with ALLEN_KB_TOKEN from the environment","restart the Agent and trust/enable deepsellers-kb when prompted"],"acceptance":{"required_tools":["kb_context","kb_answer_check","kb_search"],"preferred_first_tool":"kb_context","required_final_check":"kb_answer_check","minimum_success":["latest_pack_version_installed","sha256_verified","setup_reran_successfully","no_token_in_args_or_logs","kb_context_returns_context_packet","kb_answer_check_reports_answer_check_ok"]}},"token_values_returned":false,"secret_material_returned":false},"required_tool_order":["kb_context","kb_answer_check","kb_search"],"preferred_first_tool":"kb_context","required_final_check_tool":"kb_answer_check","do_not_use_search_only":true,"agent_actions":["GET quickstart_url first when the user asks for one-line automatic setup","GET client_mode_matrix_url and select native Remote/HTTP or local stdio bridge before setup","GET install_metadata_url","GET install_wizard_json_url","GET client_compatibility_url before changing local config","download agent_pack_url and verify sha256 when present","store the customer token only in env.ALLEN_KB_TOKEN or the local secret store","run setup_command, then restart/trust the Agent connector","run install_diagnose.py --self-test","if setup fails, follow self_healing_contract.repair_sequence before asking the customer for more input","POST client_report_url with version fields after setup or upgrade"],"acceptance_checks":["tools include kb_context, kb_answer_check, and kb_search","context_quality.ok=true","relevance_pass=true","answer_quality_contract_ok=true","knowledge_map_entrypoint_ok=true","minimum_evidence_pass=true","source_diversity_pass=true","answer_check_ok=true","answer_check_citation_coverage_pass=true"],"user_prompt_short":"请自动安装或升级 DeepSellers KB MCP。先读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 /install.json；使用 ALLEN_KB_TOKEN 保存我的 token，不要写进 args、日志、GitHub 或公开聊天；MCP 地址固定使用 https://kb.deepsellers.com:8443/mcp；安装后必须先调用 kb_context，最终回答前调用 kb_answer_check。","secret_material_returned":false},"token_placeholder":"PASTE_CUSTOMER_TOKEN_HERE","token_policy":{"env_var":"ALLEN_KB_TOKEN","token_values_returned":false,"put_token_in_args":false,"secret_store_preferred":true,"token_in_logs_forbidden":true,"token_in_public_chat_forbidden":true},"agent_profiles":{"workbuddy":{"preferred_mode":"auto","setup_command":"ALLEN_KB_TOKEN=<customer-token> python setup_mcp.py --client auto","post_install":["Trust/enable deepsellers-kb","restart WorkBuddy","run install_diagnose.py --self-test"]},"codex":{"preferred_mode":"auto","setup_command":"ALLEN_KB_TOKEN=<customer-token> python setup_mcp.py --client auto","post_install":["restart Codex","run install_diagnose.py --self-test"]},"generic_stdio":{"preferred_mode":"local-stdio-bridge","setup_command":"ALLEN_KB_TOKEN=<customer-token> python setup_mcp.py --client generic","config_artifacts":["generic-stdio-mcp-config.json","generic-stdio-mcp-config.toml"]},"remote_http":{"preferred_mode":"remote-http","mcp_url":"https://kb.deepsellers.com:8443/mcp","note":"Use only when the Agent client natively supports Remote/HTTP MCP with bearer token or secret-store auth."}},"install_sequence":[{"step":1,"id":"read_wizard_and_metadata","action":"GET /install/wizard.json, GET /install/client-matrix.json, and GET /install.json","success":"schema_version and pack_version are present"},{"step":2,"id":"check_compatibility","action":"GET /install/compatibility before install or upgrade","success":"upgrade_required is understood before changing local config"},{"step":3,"id":"download_and_verify_pack","action":"download agent-pack.zip and verify SHA256 when provided","success":"zip integrity verified"},{"step":4,"id":"write_token_safely","action":"store customer token in secret store or env.ALLEN_KB_TOKEN","success":"token is not in args, logs, screenshots, GitHub, or public chat"},{"step":5,"id":"configure_agent","action":"run setup_mcp.py --client auto for WorkBuddy/Codex or --client generic for stdio clients","success":"MCP server deepsellers-kb is configured"},{"step":6,"id":"trust_restart_self_test","action":"Trust/enable connector, restart Agent, run install_diagnose.py --self-test","must_call":["kb_context","kb_answer_check"],"do_not_use_search_only":true,"success":"context_quality.ok=true, relevance_pass=true, answer_check_ok=true, answer_check_citation_coverage_pass=true"},{"step":7,"id":"self_heal_if_needed","action":"If connection is stuck, closed, 401, 403, 429, or tools are missing, follow self_healing_contract.repair_sequence.","success":"The Agent repaired config or exported a safe support bundle without printing the token."},{"step":8,"id":"report_client_version","action":"POST /v1/client-report with Authorization bearer token and client version fields","success":"server records client_version_report without returning token material"}],"required_tool_order":["kb_context","kb_answer_check","kb_search"],"acceptance_checks":["tools include kb_context, kb_answer_check, and kb_search","context_quality.ok=true","relevance_pass=true","answer_quality_contract_ok=true","knowledge_map_entrypoint_ok=true","minimum_evidence_pass=true","source_diversity_pass=true","answer_check_ok=true","answer_check_citation_coverage_pass=true"],"user_prompt_short":"请帮我安装 DeepSellers KB MCP。安装向导：https://kb.deepsellers.com:8443/install/wizard.json。我的 token 是：PASTE_CUSTOMER_TOKEN_HERE。请先读取 /install/client-matrix.json、/install.json 和 /install/compatibility；WorkBuddy/Codex 优先自动配置，其它客户端用 stdio bridge；把 token 写入本机密钥或环境变量 ALLEN_KB_TOKEN，不要输出完整 token、不要写进 args、日志、GitHub 或公开聊天。如果连接失败，按 self_healing_contract.repair_sequence 自动修复，仍失败时导出 /portal/support-bundle?format=text&days=30 安全支持包。完成后重启/Trust 连接器，用 kb_context 测试“如何优化亚马逊广告结构”，再用 kb_answer_check 检查回答质量，并调用 /v1/client-report 上报客户端版本；不要只调用 kb_search。","agent_prompt_templates":{"workbuddy_codex":"请帮我安装并配置 DeepSellers KB MCP。\n\nMCP 地址：https://kb.deepsellers.com:8443/mcp\n安装摘要：https://kb.deepsellers.com:8443/install/bootstrap.json\n快速安装清单：https://kb.deepsellers.com:8443/install/quickstart.json\n安装元数据：https://kb.deepsellers.com:8443/install.json\n安装向导 JSON：https://kb.deepsellers.com:8443/install/wizard.json\n客户端模式矩阵：https://kb.deepsellers.com:8443/install/client-matrix.json\nAgent Pack：https://kb.deepsellers.com:8443/download/agent-pack.zip\n我的 token：<customer-token>\n\n要求：\n1. 先读取 /install/quickstart.json；如需细节，再读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 install.json，并访问 /install/compatibility 判断是否需要升级。\n2. 下载 agent-pack.zip，并校验 SHA256。\n3. 把 token 写入环境变量 ALLEN_KB_TOKEN，不要写进 args、日志、GitHub 或公开聊天。\n4. 解压到当前用户稳定目录，不要放在临时目录。\n5. WorkBuddy/Codex 使用 python setup_mcp.py --client auto；其它只支持 stdio MCP 的客户端使用 --client generic；只有明确支持 JSON-RPC HTTP POST MCP 且能安全保存 Authorization Header 的客户端才使用 Remote/HTTP。\n6. 安装或升级后运行 python install_diagnose.py --self-test。\n7. 安装、自检或升级完成后，用 token 调用 https://kb.deepsellers.com:8443/v1/client-report 上报版本，不要在日志或回复里展示完整 token。\n8. 成功标准：工具包含 kb_context、kb_answer_check、kb_search；context_quality.ok=true；answer_check_ok=true；answer_check_citation_coverage_pass=true。\n9. 回答亚马逊运营问题时，先调用 kb_context，最终回答前调用 kb_answer_check，只有追查精确片段时才补充 kb_search。\n10. 完成后重启 Agent；WorkBuddy 如出现 Trust/启用按钮，请启用 deepsellers-kb。\n11. 如果出现一直连接、Connection closed、401、403、429 或工具缺失，按 /install/client-matrix.json 里的 self_healing_contract.repair_sequence 自动修复；仍失败时从 /portal/support-bundle?format=text&days=30 导出安全支持包，不要发送完整 token。","workbuddy":"请帮我安装并配置 DeepSellers KB MCP。\n\nMCP 地址：https://kb.deepsellers.com:8443/mcp\n安装摘要：https://kb.deepsellers.com:8443/install/bootstrap.json\n快速安装清单：https://kb.deepsellers.com:8443/install/quickstart.json\n安装元数据：https://kb.deepsellers.com:8443/install.json\n安装向导 JSON：https://kb.deepsellers.com:8443/install/wizard.json\n客户端模式矩阵：https://kb.deepsellers.com:8443/install/client-matrix.json\nAgent Pack：https://kb.deepsellers.com:8443/download/agent-pack.zip\n我的 token：<customer-token>\n\n要求：\n1. 先读取 /install/quickstart.json；如需细节，再读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 install.json，并访问 /install/compatibility 判断是否需要升级。\n2. 下载 agent-pack.zip，并校验 SHA256。\n3. 把 token 写入环境变量 ALLEN_KB_TOKEN，不要写进 args、日志、GitHub 或公开聊天。\n4. 解压到当前用户稳定目录，不要放在临时目录。\n5. WorkBuddy/Codex 使用 python setup_mcp.py --client auto；其它只支持 stdio MCP 的客户端使用 --client generic；只有明确支持 JSON-RPC HTTP POST MCP 且能安全保存 Authorization Header 的客户端才使用 Remote/HTTP。\n6. 安装或升级后运行 python install_diagnose.py --self-test。\n7. 安装、自检或升级完成后，用 token 调用 https://kb.deepsellers.com:8443/v1/client-report 上报版本，不要在日志或回复里展示完整 token。\n8. 成功标准：工具包含 kb_context、kb_answer_check、kb_search；context_quality.ok=true；answer_check_ok=true；answer_check_citation_coverage_pass=true。\n9. 回答亚马逊运营问题时，先调用 kb_context，最终回答前调用 kb_answer_check，只有追查精确片段时才补充 kb_search。\n10. 完成后重启 Agent；WorkBuddy 如出现 Trust/启用按钮，请启用 deepsellers-kb。\n11. 如果出现一直连接、Connection closed、401、403、429 或工具缺失，按 /install/client-matrix.json 里的 self_healing_contract.repair_sequence 自动修复；仍失败时从 /portal/support-bundle?format=text&days=30 导出安全支持包，不要发送完整 token。\n\n客户端类型：WorkBuddy。完成配置后请检查连接器已 Trust/启用。","codex":"请帮我安装并配置 DeepSellers KB MCP。\n\nMCP 地址：https://kb.deepsellers.com:8443/mcp\n安装摘要：https://kb.deepsellers.com:8443/install/bootstrap.json\n快速安装清单：https://kb.deepsellers.com:8443/install/quickstart.json\n安装元数据：https://kb.deepsellers.com:8443/install.json\n安装向导 JSON：https://kb.deepsellers.com:8443/install/wizard.json\n客户端模式矩阵：https://kb.deepsellers.com:8443/install/client-matrix.json\nAgent Pack：https://kb.deepsellers.com:8443/download/agent-pack.zip\n我的 token：<customer-token>\n\n要求：\n1. 先读取 /install/quickstart.json；如需细节，再读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 install.json，并访问 /install/compatibility 判断是否需要升级。\n2. 下载 agent-pack.zip，并校验 SHA256。\n3. 把 token 写入环境变量 ALLEN_KB_TOKEN，不要写进 args、日志、GitHub 或公开聊天。\n4. 解压到当前用户稳定目录，不要放在临时目录。\n5. WorkBuddy/Codex 使用 python setup_mcp.py --client auto；其它只支持 stdio MCP 的客户端使用 --client generic；只有明确支持 JSON-RPC HTTP POST MCP 且能安全保存 Authorization Header 的客户端才使用 Remote/HTTP。\n6. 安装或升级后运行 python install_diagnose.py --self-test。\n7. 安装、自检或升级完成后，用 token 调用 https://kb.deepsellers.com:8443/v1/client-report 上报版本，不要在日志或回复里展示完整 token。\n8. 成功标准：工具包含 kb_context、kb_answer_check、kb_search；context_quality.ok=true；answer_check_ok=true；answer_check_citation_coverage_pass=true。\n9. 回答亚马逊运营问题时，先调用 kb_context，最终回答前调用 kb_answer_check，只有追查精确片段时才补充 kb_search。\n10. 完成后重启 Agent；WorkBuddy 如出现 Trust/启用按钮，请启用 deepsellers-kb。\n11. 如果出现一直连接、Connection closed、401、403、429 或工具缺失，按 /install/client-matrix.json 里的 self_healing_contract.repair_sequence 自动修复；仍失败时从 /portal/support-bundle?format=text&days=30 导出安全支持包，不要发送完整 token。\n\n客户端类型：Codex。优先自动写入当前用户的 MCP 配置。","generic_stdio":"请帮我安装并配置 DeepSellers KB MCP。\n\nMCP 地址：https://kb.deepsellers.com:8443/mcp\n安装摘要：https://kb.deepsellers.com:8443/install/bootstrap.json\n快速安装清单：https://kb.deepsellers.com:8443/install/quickstart.json\n安装元数据：https://kb.deepsellers.com:8443/install.json\n安装向导 JSON：https://kb.deepsellers.com:8443/install/wizard.json\n客户端模式矩阵：https://kb.deepsellers.com:8443/install/client-matrix.json\nAgent Pack：https://kb.deepsellers.com:8443/download/agent-pack.zip\n我的 token：<customer-token>\n\n要求：\n1. 先读取 /install/quickstart.json；如需细节，再读取 /install/bootstrap.json、/install/client-matrix.json、/install/wizard.json 和 install.json，并访问 /install/compatibility 判断是否需要升级。\n2. 下载 agent-pack.zip，并校验 SHA256。\n3. 把 token 写入环境变量 ALLEN_KB_TOKEN，不要写进 args、日志、GitHub 或公开聊天。\n4. 解压到当前用户稳定目录，不要放在临时目录。\n5. WorkBuddy/Codex 使用 python setup_mcp.py --client auto；其它只支持 stdio MCP 的客户端使用 --client generic；只有明确支持 JSON-RPC HTTP POST MCP 且能安全保存 Authorization Header 的客户端才使用 Remote/HTTP。\n6. 安装或升级后运行 python install_diagnose.py --self-test。\n7. 安装、自检或升级完成后，用 token 调用 https://kb.deepsellers.com:8443/v1/client-report 上报版本，不要在日志或回复里展示完整 token。\n8. 成功标准：工具包含 kb_context、kb_answer_check、kb_search；context_quality.ok=true；answer_check_ok=true；answer_check_citation_coverage_pass=true。\n9. 回答亚马逊运营问题时，先调用 kb_context，最终回答前调用 kb_answer_check，只有追查精确片段时才补充 kb_search。\n10. 完成后重启 Agent；WorkBuddy 如出现 Trust/启用按钮，请启用 deepsellers-kb。\n11. 如果出现一直连接、Connection closed、401、403、429 或工具缺失，按 /install/client-matrix.json 里的 self_healing_contract.repair_sequence 自动修复；仍失败时从 /portal/support-bundle?format=text&days=30 导出安全支持包，不要发送完整 token。\n\n客户端类型：Generic stdio MCP。请使用 python setup_mcp.py --client generic，输出生成的 generic-stdio-mcp-config.json 路径，并说明如何导入。"},"upgrade_supported":true,"upgrade_plan":{"schema_version":"2026.08.29.upgrade-plan.1","server_name":"deepsellers-kb","latest_pack_version":"2026.09.07.1","metadata_url":"https://kb.deepsellers.com:8443/install.json","agent_pack_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip","sha256_url":"https://kb.deepsellers.com:8443/download/agent-pack.zip.sha256","expected_sha256":"093af03831655c22336f91b57ac2a9a1d361243034ac5fab4522b4c2b98152b5","verify_sha256":true,"script":"upgrade_mcp.py","token_env_var":"ALLEN_KB_TOKEN","token_values_returned":false,"token_in_args":false,"command":"ALLEN_KB_TOKEN=<customer-token> python upgrade_mcp.py --client auto","steps":["read /install.json before upgrading","download agent-pack.zip","verify SHA256 when expected_sha256 is present","back up the existing stable install directory","preserve generated generic stdio configs when present","extract the latest pack into the stable install directory","rerun setup_mcp.py with ALLEN_KB_TOKEN from the environment","restart the Agent and trust/enable deepsellers-kb when prompted"],"acceptance":{"required_tools":["kb_context","kb_answer_check","kb_search"],"preferred_first_tool":"kb_context","required_final_check":"kb_answer_check","minimum_success":["latest_pack_version_installed","sha256_verified","setup_reran_successfully","no_token_in_args_or_logs","kb_context_returns_context_packet","kb_answer_check_reports_answer_check_ok"]}},"token_values_returned":false,"secret_material_returned":false}}