feat: sync g14 harness and device-pod cli

skills/device-pod-cli/SKILL.md

@@ -94,11 +94,51 @@ node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs device-pod-71-freq:io
 Run mutating jobs only with reason and lease token when required by cloud-api:
 
 ```sh
-node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs device-pod-71-freq:workspace:/ apply-patch --reason "DEV edit" --lease-token <lease-token> --api-base-url <url> --session-token <token> < patch.diff
-node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs device-pod-71-freq:workspace:/ build start --reason "build smoke" --lease-token <lease-token> --api-base-url <url> --session-token <token>
-node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs device-pod-71-freq:debug-probe download start --reason "DEV smoke" --lease-token <lease-token> --api-base-url <url> --session-token <token>
-node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs device-pod-71-freq:debug-probe reset --reason "reset smoke" --lease-token <lease-token> --api-base-url <url> --session-token <token>
-node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs device-pod-71-freq:io-probe:/uart/1 write "AT" --reason "UART write smoke" --lease-token <lease-token> --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ apply-patch \
+  --reason "DEV edit" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token> < patch.diff
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ put User/new.c \
+  --reason "DEV edit" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token> < file
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ rm User/old.c --missing-ok \
+  --reason "remove obsolete source" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ rmdir User/empty \
+  --reason "remove empty folder" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ keil add-source User/new.c --group User \
+  --reason "sync Keil project" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ keil remove-source User/old.c \
+  --reason "sync Keil project" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:workspace:/ build start \
+  --reason "build smoke" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:debug-probe download start \
+  --reason "DEV smoke" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:debug-probe reset \
+  --reason "reset smoke" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:io-probe:/uart/1 write "AT" \
+  --reason "UART write smoke" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
+node /app/skills/device-pod-cli/scripts/device-pod-cli.mjs \
+  device-pod-71-freq:io-probe:/uart/1 jsonrpc gpio.read \
+  --params-json '{"pin":"PB5"}' --expect-result-field value \
+  --reason "UART JSON-RPC smoke" --lease-token <lease-token> \
+  --api-base-url <url> --session-token <token>
 ```
 
 Inspect or cancel jobs through cloud-api:
@@ -125,6 +165,8 @@ Do not treat local files such as `.device-pod/device-pod-71-freq.json` or `DEVIC
 ## Operation Rules
 
 - Use `device-pod-cli` first for workspace, build, download, reset, UART, and debug-probe tasks.
+- Prefer `workspace apply-patch` for source edits. Use `workspace put` only for intentional whole-file writes or new files, because it bypasses hunk-level conflict detection.
+- If apply-patch fails, read the returned `patchHint`, re-read the current file with `workspace cat` or `workspace rg`, and retry a smaller exact-context hunk before using whole-file write.
 - Do not start by calling `/app/tools/hwlab-gateway-tran.mjs`, Windows-side Keil skills, serial-monitor skills, `keil-cli.py`, or generic shell when the Device Pod REST path is available.
 - If the CLI returns an auth, grant, lease, executor, or gateway blocker, fix that named blocker in the cloud-api/device-pod path; do not bypass the profile with generic gateway shell.
 - The server-side profile already carries `hostWorkspaceRoot`, `projectWorkspace`, `debugInterface.uv4Path`, probe UID, UART port, and gateway route. Let `cloud-api -> hwlab-device-pod -> device-host-cli` apply those values.
@@ -160,3 +202,7 @@ Do not upload or recreate runner-side `.device-pod/*.json` as the formal profile
 ## T4
 
 阅读 `/app/skills/device-pod-cli/SKILL.md`，然后用 cli 手动测试以下内容：运行 `profile create --pod-id <devicePodId>`，确认返回 `legacy_profile_create_removed`，并提示使用 cloud-api admin API 管理服务端 profile/grant。
+
+## T5
+
+阅读 `/app/skills/device-pod-cli/SKILL.md`，然后用 cli 手动测试以下内容：运行 `workspace put/rm/rmdir/keil` 和 `io-probe jsonrpc` 的 `--dry-run`，确认 JSON plan 中 intent 分别为 `workspace.put`、`workspace.rm`、`workspace.rmdir`、`workspace.keil`、`io.uart.jsonrpc`，且 `contentB64`、`text`、`patch` 不以原文泄露。