aliyun · guima-why · Jul 9, 2026 · Jul 9, 2026
diff --git a/website/docs/acp/examples.md b/website/docs/acp/examples.md
@@ -265,7 +265,7 @@ async def main():
             "params": {
                 "protocolVersion": 1,
                 "clientInfo": {"name": "http-client", "version": "1.0"},
-                "capabilities": {}
+                "clientCapabilities": {}
             }
         }, headers=HEADERS)
         resp.raise_for_status()

diff --git a/website/docs/acp/http-transport.md b/website/docs/acp/http-transport.md
@@ -102,7 +102,7 @@ Below is a full interaction using `curl`:
 # Step 1: Initialize — creates a connection and returns the Connection ID
 CONN_ID=$(curl -s -D - -X POST http://localhost:8765/acp \
   -H "Content-Type: application/json" \
-  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":1,"capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":1,"clientCapabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}' \
   | grep -i 'acp-connection-id' | awk '{print $2}' | tr -d '\r')
 
 echo "Connection ID: $CONN_ID"

diff --git a/website/docs/acp/protocol-reference.md b/website/docs/acp/protocol-reference.md
@@ -64,6 +64,8 @@ Protocol handshake. Must be the first call on every connection.
 | `promptCapabilities.embeddedContext` | `true` | Accepts embedded resource content in prompts |
 | `promptCapabilities.image` | `false` | Image input not supported (degrades to text marker) |
 | `promptCapabilities.audio` | `false` | Audio input not supported (degrades to text marker) |
+| `mcpCapabilities.http` | `true` | Accepts HTTP (streamable) MCP servers at session creation |
+| `mcpCapabilities.sse` | `true` | Accepts SSE MCP servers at session creation |
 | `sessionCapabilities.list` | `{}` | Supports listing sessions |
 | `sessionCapabilities.close` | `{}` | Supports closing sessions |
 
@@ -78,7 +80,7 @@ Create a new session with an independent agent runtime, tool registry, and LLM c
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
 | `cwd` | string | Yes | Absolute path to the working directory |
-| `mcpServers` | object | No | MCP server configuration (accepted but not yet functional) |
+| `mcpServers` | object | No | MCP server configuration; HTTP (streamable) and SSE servers are connected for the session |
 
 **Response Fields**
 
@@ -189,7 +191,7 @@ Send user input and trigger streaming agent responses.
 | Field | Type | Description |
 |-------|------|-------------|
 | `stopReason` | string | Why the prompt completed (see Stop Reasons) |
-| `usage` | object | Token usage: `inputTokens`, `outputTokens`, `totalTokens` |
+| `_meta.usage` | object | Token usage delivered under the response `_meta` object: `input_tokens`, `output_tokens`, `total_tokens` |
 
 **Stop Reasons**
 
@@ -243,7 +245,7 @@ Close a session and release its resources.
 
 ---
 
-### sessions/list
+### session/list
 
 List all persisted sessions for a given working directory.
 
@@ -261,7 +263,7 @@ List all persisted sessions for a given working directory.
 
 ---
 
-### config/set
+### session/set_config_option
 
 Dynamically set a configuration option for a session.
 
@@ -371,16 +373,16 @@ For `aliyun_api`, read-only actions are auto-allowed. Non-read-only RPC and ROA
 
 ```json
 {
-  "outcome": "allowed",
-  "option_id": "allow_once"
+  "outcome": "selected",
+  "optionId": "allow_once"
 }
 ```
 
 Or to deny:
 
 ```json
 {
-  "outcome": "denied"
+  "outcome": "cancelled"
 }
 ```
 

diff --git a/website/docs/cli/command-line-options.md b/website/docs/cli/command-line-options.md
@@ -17,6 +17,7 @@ Command line options change how IaC Code starts. Use them before entering the in
 | `--max-turns <number>` | Limit the maximum number of agent turns in non-interactive mode. The default is `100`. |
 | `--thinking-enabled`, `--no-thinking-enabled` | Control whether one-shot non-interactive requests explicitly enable thinking. The default is `--thinking-enabled`; use `--no-thinking-enabled` to send `thinking_enabled=false` for this run without rewriting `settings.yml`. |
 | `-d`, `--debug` | Enable debug logging for the current run. In interactive mode, use `/debug` to inspect or change debug logging after startup. |
+| `--verbose` | Show headless (non-interactive) progress on standard error. |
 | `-r <session-id-or-name>`, `--resume <session-id-or-name>` | Resume a previous session by exact session ID, unique ID prefix, or unique session name. Cross-project resolved sessions print a `cd ... && iac-code --resume <id>` command instead of hot-swapping the current project. |
 | `-c`, `--continue` | Resume the most recent session. This cannot be used together with `--resume`. |
 | `--allowed-tools <patterns>` | Comma-separated tool permission patterns to allow, e.g. `'bash(git *),write_file'`. |
@@ -47,7 +48,7 @@ iac-code
 Start with a specific model for this run:
 
 ```bash
-iac-code --model qwen3.6-plus
+iac-code --model qwen3.7-max
 ```
 
 Run a one-shot prompt:

diff --git a/website/docs/cli/skills.md b/website/docs/cli/skills.md
@@ -7,26 +7,14 @@ description: Create and use reusable prompt templates as slash commands.
 
 Skills are reusable prompt templates that extend IaC Code with custom slash commands. They let you package complex instructions, tool configurations, and workflow patterns into named commands that can be invoked during a conversation.
 
-## Skill File Formats
+## Skill File Format
 
-Skills are defined as Markdown files with YAML frontmatter. Two formats are supported:
-
-### Single File
-
-A standalone Markdown file named after the skill:
-
-```text
-skills/
-  deploy-check.md
-  code-review.md
-```
-
-### Directory
-
-A directory containing a `SKILL.md` file, useful when the skill needs additional reference files:
+A skill is a directory containing a `SKILL.md` file with YAML frontmatter. The directory name is the skill's default name, and the directory can hold additional reference files the skill depends on:
 
 ```text
 skills/
+  deploy-check/
+    SKILL.md
   my-skill/
     SKILL.md
     references/
@@ -35,16 +23,16 @@ skills/
 
 ## Discovery and Priority
 
-IaC Code discovers skills from multiple locations. When skills share the same name, later sources override earlier ones:
+IaC Code discovers skills from multiple locations. When skills share the same name, higher-priority sources override lower-priority ones:
 
 | Priority | Location | Description |
 |----------|----------|-------------|
-| 1 (lowest) | Bundled | Built-in skills shipped with IaC Code |
-| 2 | `~/.iac-code/skills/` | User-global skills (follows `IAC_CODE_CONFIG_DIR`) |
-| 3 | `skills/` | Project-level skills directory |
-| 4 (highest) | `.iac-code/skills/` | Project config-level skills directory |
+| 1 (lowest) | `~/.iac-code/skills/` | User-global skills (follows `IAC_CODE_CONFIG_DIR`) |
+| 2 | `skills/` | Project-level skills directory |
+| 3 | `.iac-code/skills/` | Project config-level skills directory |
+| 4 (highest) | Bundled | Built-in skills shipped with IaC Code; cannot be shadowed by user or project skills of the same name |
 
-Project skill directories are searched upward from the current working directory to the filesystem root.
+Project skill directories are searched from the git repository root down to the current working directory. When the current directory is not inside a git repository, only the current directory is searched.
 
 ## Frontmatter Reference
 
@@ -81,7 +69,7 @@ paths:
 | `when_to_use` | No | `""` | Hint for the model on when to invoke this skill automatically |
 | `argument_hint` | No | `""` | Placeholder shown after the command name |
 | `arguments` | No | `[]` | Named argument list for positional substitution |
-| `allowed_tools` | No | `[]` | Tools the skill is allowed to use (applies to fork mode) |
+| `allowed_tools` | No | `[]` | Tools the skill is allowed to use (applies to both inline and fork modes) |
 | `user_invocable` | No | `true` | Whether the user can invoke this skill directly via `/name` (or `$name`) |
 | `model` | No | `"inherit"` | Model override for this skill execution |
 | `effort` | No | `""` | Thinking effort override |
@@ -189,7 +177,7 @@ Review the current project and generate a pre-deployment checklist covering:
 If a stack name is provided, also check the current stack status.
 ```
 
-Save this as `~/.iac-code/skills/checklist.md` or `.iac-code/skills/checklist.md` in your project. Then invoke it with `/checklist` in the REPL — or with `$checklist`, which is identical but filters autocomplete suggestions to skills only.
+Save this as `~/.iac-code/skills/checklist/SKILL.md` or `.iac-code/skills/checklist/SKILL.md` in your project. Then invoke it with `/checklist` in the REPL — or with `$checklist`, which is identical but filters autocomplete suggestions to skills only.
 
 ## Permissions
 

diff --git a/website/docs/configuration/environment-variables.md b/website/docs/configuration/environment-variables.md
@@ -19,7 +19,7 @@ Environment variables are useful for CI/CD pipelines, containers, and one-off ov
 |---|---|
 | `IAC_CODE_PROVIDER` | Model provider name (case-insensitive). Valid values: `DashScope`, `DashScope Token Plan`, `OpenAI`, `Anthropic`, `DeepSeek`, `Gemini`, `Azure OpenAI`, `ModelScope`, `Kimi CN`, `Kimi Intl`, `MiniMax CN`, `MiniMax Intl`, `ZhiPu CN`, `ZhiPu Intl`, `Volcengine CN`, `SiliconFlow CN`, `SiliconFlow Intl`, `Aliyun CodingPlan`, `Aliyun CodingPlan Intl`, `ZhiPu CN CodingPlan`, `ZhiPu Intl CodingPlan`, `Volcengine CodingPlan`, `OpenAI Compatible`, `Anthropic Compatible`, `OpenRouter`, `Ollama`, `LM Studio` |
 | `IAC_CODE_MODEL` | Model name |
-| `IAC_CODE_BASE_URL` | API endpoint for `OpenAI Compatible` and `Anthropic Compatible` only; ignored for other providers |
+| `IAC_CODE_BASE_URL` | API endpoint for `OpenAI Compatible` only; ignored (with a warning) for other providers |
 | `IAC_CODE_API_KEY` | Provider API key; overrides the active provider's key in `.credentials.yml` |
 
 See [LLM Providers](./llm-providers.md) for provider details.

diff --git a/website/docs/configuration/llm-providers.md b/website/docs/configuration/llm-providers.md
@@ -74,5 +74,5 @@ CLI arguments > environment variables > configuration files
 |---|---|
 | `IAC_CODE_PROVIDER` | Model provider name (case-insensitive). See tables above for valid values |
 | `IAC_CODE_MODEL` | Model name |
-| `IAC_CODE_BASE_URL` | API endpoint for `OpenAI Compatible` and `Anthropic Compatible` only; ignored for other providers |
+| `IAC_CODE_BASE_URL` | API endpoint for `OpenAI Compatible` only; ignored (with a warning) for other providers |
 | `IAC_CODE_API_KEY` | Provider API key |
diff --git a/website/docs/intro.md b/website/docs/intro.md
@@ -10,8 +10,8 @@ IaC Code is an AI-powered Infrastructure as Code assistant for cloud infrastruct
 
 Core capabilities:
 
-- **Say it, ship it** — describe what you need in plain language and get validated, deployment-ready ROS or Terraform templates.
-- **One command to production** — go from template to running infrastructure and applications in one flow; create, update, delete, and monitor stacks across regions.
+- **Say it, ship it** — describe what you need in plain language and get validated ROS templates ready to deploy, or generated Terraform templates.
+- **One command to production** — for Alibaba Cloud ROS, go from template to running infrastructure in one flow: create, update, delete, and monitor stacks across regions. Terraform support covers template generation and conversion, not deployment.
 - **Cloud smarts built in** — search documentation, check resource availability, and estimate costs before you deploy; every decision backed by real cloud data.
 
 The documentation is organized around user tasks. Start with installation and quick start, then configure providers and credentials, then use the CLI reference when you need command details.
diff --git a/website/docs/mcp/oauth-and-security.md b/website/docs/mcp/oauth-and-security.md
@@ -85,7 +85,7 @@ Headless and protocol server modes skip unapproved project servers rather than p
 IaC Code protects secrets in several ways:
 
 - Config output from `iac-code mcp get` redacts keys that look like tokens, secrets, passwords, API keys, and authorization headers.
-- Plaintext sensitive header or env values are rejected unless they use an environment-variable reference.
+- Plaintext sensitive header or env values are rejected when adding servers via `iac-code mcp add` or `mcp add-json` unless they use an environment-variable reference. Configuration files edited by hand are not re-validated on load, so avoid storing plaintext secrets directly.
 - MCP stdio servers inherit only an allowlist of safe environment variables plus the explicit server env.
 - Proxy environment variables with embedded usernames or passwords are not inherited by stdio MCP servers.
 - MCP artifact files are written under the private IaC Code runtime configuration directory.

diff --git a/website/docs/mcp/overview.md b/website/docs/mcp/overview.md
@@ -43,7 +43,7 @@ Use MCP when you want IaC Code to call a local or remote capability that is not
 
 At runtime IaC Code:
 
-1. Loads MCP configuration from user, local, project, and session sources.
+1. Loads MCP configuration from user, project, local, and session sources.
 2. Expands `${VAR}` and `${VAR:-default}` references.
 3. Skips unsafe or invalid servers with user-visible warnings.
 4. Connects approved servers with bounded concurrency.

diff --git a/website/i18n/de/docusaurus-plugin-content-docs/current/acp/examples.md b/website/i18n/de/docusaurus-plugin-content-docs/current/acp/examples.md
@@ -265,7 +265,7 @@ async def main():
             "params": {
                 "protocolVersion": 1,
                 "clientInfo": {"name": "http-client", "version": "1.0"},
-                "capabilities": {}
+                "clientCapabilities": {}
             }
         }, headers=HEADERS)
         resp.raise_for_status()

diff --git a/website/i18n/de/docusaurus-plugin-content-docs/current/acp/http-transport.md b/website/i18n/de/docusaurus-plugin-content-docs/current/acp/http-transport.md
@@ -102,7 +102,7 @@ Nachfolgend eine vollstaendige Interaktion mit `curl`:
 # Step 1: Initialize — creates a connection and returns the Connection ID
 CONN_ID=$(curl -s -D - -X POST http://localhost:8765/acp \
   -H "Content-Type: application/json" \
-  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":1,"capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":1,"clientCapabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}' \
   | grep -i 'acp-connection-id' | awk '{print $2}' | tr -d '\r')
 
 echo "Connection ID: $CONN_ID"

diff --git a/website/i18n/de/docusaurus-plugin-content-docs/current/acp/protocol-reference.md b/website/i18n/de/docusaurus-plugin-content-docs/current/acp/protocol-reference.md
@@ -64,6 +64,8 @@ Protokoll-Handshake. Muss der erste Aufruf bei jeder Verbindung sein.
 | `promptCapabilities.embeddedContext` | `true` | Akzeptiert eingebettete Ressourceninhalte in Eingaben |
 | `promptCapabilities.image` | `false` | Bildeingabe nicht unterstuetzt (wird zu Textmarker degradiert) |
 | `promptCapabilities.audio` | `false` | Audioeingabe nicht unterstuetzt (wird zu Textmarker degradiert) |
+| `mcpCapabilities.http` | `true` | Akzeptiert HTTP-/Streamable-MCP-Server bei der Sitzungserstellung |
+| `mcpCapabilities.sse` | `true` | Akzeptiert SSE-MCP-Server bei der Sitzungserstellung |
 | `sessionCapabilities.list` | `{}` | Unterstuetzt das Auflisten von Sitzungen |
 | `sessionCapabilities.close` | `{}` | Unterstuetzt das Schliessen von Sitzungen |
 
@@ -78,7 +80,7 @@ Erstellen Sie eine neue Sitzung mit einer unabhaengigen Agenten-Laufzeitumgebung
 | Feld | Typ | Erforderlich | Beschreibung |
 |-------|------|----------|-------------|
 | `cwd` | string | Ja | Absoluter Pfad zum Arbeitsverzeichnis |
-| `mcpServers` | object | Nein | MCP-Serverkonfiguration (akzeptiert, aber noch nicht funktional) |
+| `mcpServers` | object | Nein | MCP-Serverkonfiguration; HTTP- (Streamable) und SSE-Server werden fuer die Sitzung verbunden |
 
 **Antwortfelder**
 
@@ -189,7 +191,7 @@ Senden Sie Benutzereingaben und loesen Sie Streaming-Agentenantworten aus.
 | Feld | Typ | Beschreibung |
 |-------|------|-------------|
 | `stopReason` | string | Warum die Eingabe abgeschlossen wurde (siehe Abschlussgruende) |
-| `usage` | object | Token-Nutzung: `inputTokens`, `outputTokens`, `totalTokens` |
+| `_meta.usage` | object | Token-Nutzung unter dem `_meta`-Objekt der Antwort: `input_tokens`, `output_tokens`, `total_tokens` |
 
 **Abschlussgruende**
 
@@ -243,7 +245,7 @@ Schliessen Sie eine Sitzung und geben Sie ihre Ressourcen frei.
 
 ---
 
-### sessions/list
+### session/list
 
 Listen Sie alle gespeicherten Sitzungen fuer ein gegebenes Arbeitsverzeichnis auf.
 
@@ -261,7 +263,7 @@ Listen Sie alle gespeicherten Sitzungen fuer ein gegebenes Arbeitsverzeichnis au
 
 ---
 
-### config/set
+### session/set_config_option
 
 Setzen Sie dynamisch eine Konfigurationsoption fuer eine Sitzung.
 
@@ -371,16 +373,16 @@ Fuer `aliyun_api` werden Nur-Lese-Aktionen automatisch erlaubt. Nicht nur lesend
 
 ```json
 {
-  "outcome": "allowed",
-  "option_id": "allow_once"
+  "outcome": "selected",
+  "optionId": "allow_once"
 }
 ```
 
 Oder zum Verweigern:
 
 ```json
 {
-  "outcome": "denied"
+  "outcome": "cancelled"
 }
 ```
 

diff --git a/website/i18n/de/docusaurus-plugin-content-docs/current/cli/command-line-options.md b/website/i18n/de/docusaurus-plugin-content-docs/current/cli/command-line-options.md
@@ -17,6 +17,7 @@ Befehlszeilenoptionen steuern, wie IaC Code gestartet wird. Sie können vor dem
 | `--max-turns <number>` | Maximale Anzahl der Agenten-Runden im nicht-interaktiven Modus begrenzen. Standard ist `100`. |
 | `--thinking-enabled`, `--no-thinking-enabled` | Steuert, ob einmalige nicht-interaktive Anfragen Thinking explizit aktivieren. Standard ist `--thinking-enabled`; verwenden Sie `--no-thinking-enabled`, um fuer diesen Lauf `thinking_enabled=false` zu senden, ohne `settings.yml` umzuschreiben. |
 | `-d`, `--debug` | Debug-Protokollierung für den aktuellen Lauf aktivieren. Im interaktiven Modus verwenden Sie `/debug`, um die Debug-Protokollierung nach dem Start zu prüfen oder zu ändern. |
+| `--verbose` | Headless-Fortschritt (nicht-interaktiv) auf der Standardfehlerausgabe anzeigen. |
 | `-r <session-id-oder-name>`, `--resume <session-id-oder-name>` | Eine vorherige Sitzung über die exakte Sitzungs-ID, ein eindeutiges ID-Präfix oder einen eindeutigen Sitzungsnamen fortsetzen. Projektübergreifend aufgelöste Sitzungen geben einen `cd ... && iac-code --resume <id>`-Befehl aus, statt das aktuelle Projekt direkt zu wechseln. |
 | `-c`, `--continue` | Die letzte Sitzung fortsetzen. Kann nicht zusammen mit `--resume` verwendet werden. |
 | `--allowed-tools <patterns>` | Kommagetrennte Werkzeug-Berechtigungsmuster zum Erlauben, z.B. `'bash(git *),write_file'`. |
@@ -47,7 +48,7 @@ iac-code
 Für diesen Lauf ein bestimmtes Modell angeben:
 
 ```bash
-iac-code --model qwen3.6-plus
+iac-code --model qwen3.7-max
 ```
 
 Einen einmaligen Prompt ausführen: