@dreamlogic-ai/cli 2.0.2 → 2.0.4

package/dist/commands/catalog.js

@@ -10,14 +10,14 @@ export async function catalogCommand() {
     if (!apiKey)
         return;
     const client = new ApiClient(getServer(), apiKey);
-    const spinner = ui.spinner("Fetching skill catalog...");
+    const spinner = ui.spinner("正在获取技能目录...");
     spinner.start();
     try {
         const skills = await client.listSkills();
-        spinner.succeed(`  ${skills.length} skill(s) available`);
+        spinner.succeed(`  共 ${skills.length} 个技能可用`);
         console.log();
         if (skills.length === 0) {
-            ui.info("No skills available yet. Check back soon!");
+            ui.info("暂无可用技能，请稍后再试！");
             return;
         }
         for (const s of skills) {
@@ -32,7 +32,7 @@ export async function catalogCommand() {
         }
     }
     catch (err) {
-        spinner.fail("  Failed to fetch catalog");
+        spinner.fail("  获取目录失败");
         ui.err(err.message);
         process.exitCode = 1;
     }

package/dist/commands/helpers.js

@@ -7,7 +7,7 @@ import { ui } from "../lib/ui.js";
 export function requireAuth() {
     const key = getApiKey();
     if (!key) {
-        ui.err("Not logged in. Run: dreamlogic login");
+        ui.err("未登录，请先运行: dreamlogic login");
         process.exitCode = 1;
         return null;
     }

package/dist/commands/install.js

@@ -17,15 +17,15 @@ export async function installCommand(skillIds, opts) {
         return;
     const client = new ApiClient(getServer(), apiKey);
     // Fetch catalog
-    const spinner = ui.spinner("Fetching available skills...");
+    const spinner = ui.spinner("正在获取可用技能...");
     spinner.start();
     let skills;
     try {
         skills = await client.listSkills();
-        spinner.succeed(`  ${skills.length} skill(s) available`);
+        spinner.succeed(`  共 ${skills.length} 个技能可用`);
     }
     catch (err) {
-        spinner.fail("  Failed to connect");
+        spinner.fail("  连接失败");
         ui.err(err.message);
         process.exitCode = 1;
         return;
@@ -35,7 +35,7 @@ export async function installCommand(skillIds, opts) {
     let selectedIds;
     if (skillIds.length === 0) {
         if (skills.length === 0) {
-            ui.info("No skills available yet.");
+            ui.info("暂无可用技能。");
             return;
         }
         const options = skills.map((s) => {
@@ -44,13 +44,13 @@ export async function installCommand(skillIds, opts) {
             const currentVer = installed[s.id]?.version;
             let hint = "";
             if (!isInstalled) {
-                hint = chalk.green("NEW");
+                hint = chalk.green("全新");
             }
             else if (currentVer && s.latest_version && currentVer !== s.latest_version) {
-                hint = chalk.yellow(`UPDATE: ${currentVer} → ${s.latest_version}`);
+                hint = chalk.yellow(`可更新: ${currentVer} → ${s.latest_version}`);
             }
             else {
-                hint = chalk.dim("installed");
+                hint = chalk.dim("已安装");
             }
             return {
                 label: `${s.name} (${ver})`,
@@ -60,17 +60,17 @@ export async function installCommand(skillIds, opts) {
         });
         console.log();
         const selected = await clack.multiselect({
-            message: "Select skills to install:",
+            message: "选择要安装的技能（空格选择，回车确认）:",
             options,
             required: true,
         });
         if (clack.isCancel(selected)) {
-            clack.cancel("Installation cancelled.");
+            clack.cancel("安装已取消。");
             return;
         }
         selectedIds = selected;
         if (selectedIds.length === 0) {
-            ui.info("Nothing selected.");
+            ui.info("未选择任何技能。");
             return;
         }
     }
@@ -78,8 +78,8 @@ export async function installCommand(skillIds, opts) {
         // Validate requested skill IDs
         const invalid = skillIds.filter((id) => !skills.find((s) => s.id === id));
         if (invalid.length > 0) {
-            ui.err(`Unknown skill(s): ${invalid.join(", ")}`);
-            ui.info("Available: " + skills.map((s) => s.id).join(", "));
+            ui.err(`未知技能: ${invalid.join(", ")}`);
+            ui.info("可用技能: " + skills.map((s) => s.id).join(", "));
             process.exitCode = 1;
             return;
         }
@@ -87,7 +87,7 @@ export async function installCommand(skillIds, opts) {
     }
     // R1-12: --from-file only works with single skill
     if (opts.fromFile && selectedIds.length > 1) {
-        ui.err("--from-file can only be used with a single skill.");
+        ui.err("--from-file 仅支持单个技能安装。");
         process.exitCode = 1;
         return;
     }
@@ -102,11 +102,11 @@ export async function installCommand(skillIds, opts) {
             return `${chalk.bold(s.name)} ${chalk.dim(ver)} (${size})`;
         });
         planLines.push("");
-        planLines.push(`${chalk.dim("Install to:")} ${getInstallDir()}`);
-        ui.panel("Installation Plan", planLines.join("\n"));
-        const ok = await clack.confirm({ message: "Proceed?", initialValue: true });
+        planLines.push(`${chalk.dim("安装目录:")} ${getInstallDir()}`);
+        ui.panel("安装计划", planLines.join("\n"));
+        const ok = await clack.confirm({ message: "确认安装？", initialValue: true });
         if (clack.isCancel(ok) || !ok) {
-            clack.cancel("Cancelled.");
+            clack.cancel("已取消。");
             return;
         }
     }
@@ -115,26 +115,26 @@ export async function installCommand(skillIds, opts) {
     for (const id of selectedIds) {
         const s = skills.find((s) => s.id === id);
         if (!s) {
-            ui.err(`Skill '${id}' no longer in catalog`);
+            ui.err(`技能 '${id}' 已不在目录中`);
             continue;
         }
         console.log();
-        ui.header(`Installing ${s.name}`);
+        ui.header(`正在安装 ${s.name}`);
         try {
             const result = await installSkill(client, s.id, s.package_file || `${s.id}-${s.latest_version}.zip`, s.package_sha256, s.latest_version || "unknown", { fromFile: opts.fromFile });
-            ui.ok(`Installed to ${result.path}`);
+            ui.ok(`已安装到 ${result.path}`);
             successCount++;
         }
         catch (err) {
-            ui.err(`Failed to install ${s.name}: ${err.message}`);
+            ui.err(`安装 ${s.name} 失败: ${err.message}`);
         }
     }
     console.log();
     if (successCount === selectedIds.length) {
-        ui.ok(`All ${successCount} skill(s) installed successfully!`);
+        ui.ok(`全部 ${successCount} 个技能安装成功！`);
     }
     else {
-        ui.warning(`${successCount}/${selectedIds.length} installed. Check errors above.`);
+        ui.warning(`${successCount}/${selectedIds.length} 已安装，请检查上方错误信息。`);
     }
     // ── Agent Registration Step ──
     if (successCount > 0 && !opts.yes) {
@@ -161,7 +161,7 @@ export async function installCommand(skillIds, opts) {
                 });
             }
             const agentChoice = await clack.multiselect({
-                message: `Register skills with AI agents? (${totalAgents} agents available)`,
+                message: `注册技能到 AI Agent？(共 ${totalAgents} 个可用)`,
                 options: agentOptions,
                 required: false,
             });
@@ -177,7 +177,7 @@ export async function installCommand(skillIds, opts) {
                     const created = results.filter(r => r.status === "created").length;
                     const errors = results.filter(r => r.status === "error");
                     if (created > 0) {
-                        ui.ok(`${id}: registered with ${created} agent location(s)`);
+                        ui.ok(`${id}: 已注册到 ${created} 个 Agent`);
                     }
                     for (const e of errors) {
                         ui.warning(`${e.agent}: ${e.error}`);
@@ -189,7 +189,7 @@ export async function installCommand(skillIds, opts) {
     // Suggest MCP setup
     if (successCount > 0) {
         console.log();
-        ui.info("To configure MCP for your AI agent, run:");
+        ui.info("如需配置 MCP 连接 AI Agent，请运行:");
         ui.line(chalk.cyan("dreamlogic setup-mcp"));
     }
 }

package/dist/commands/list.js

@@ -8,24 +8,24 @@ export function listCommand() {
     const installed = loadInstalled();
     const entries = Object.entries(installed);
     if (entries.length === 0) {
-        ui.info("No skills installed. Run: dreamlogic install");
+        ui.info("暂无已安装的技能。请运行: dreamlogic install");
         return;
     }
     console.log();
-    ui.line(`Install directory: ${getInstallDir()}`);
+    ui.line(`安装目录: ${getInstallDir()}`);
     console.log();
     for (const [id, info] of entries) {
         ui.line(`  ${chalk.green("●")} ${chalk.bold(id)}`);
         ui.table([
-            ["Version", info.version],
-            ["Installed", new Date(info.installed_at).toLocaleString()],
-            ["Path", info.path],
+            ["版本", info.version],
+            ["安装时间", new Date(info.installed_at).toLocaleString()],
+            ["路径", info.path],
             ["SHA256", info.sha256.slice(0, 16) + "..."],
         ]);
         if (info.previous_version) {
-            ui.line(`    ${ui.dim(`Previous: ${info.previous_version}`)}`);
+            ui.line(`    ${ui.dim(`上一版本: ${info.previous_version}`)}`);
         }
         console.log();
     }
-    ui.line(`  Total: ${entries.length} skill(s)`);
+    ui.line(`  共计: ${entries.length} 个技能`);
 }

package/dist/commands/login.js

@@ -10,9 +10,9 @@ const KEY_RE = /^sk-(admin|user)-[a-f0-9]{16,}$/;
 export async function loginCommand(opts) {
     const existingKey = getApiKey();
     if (existingKey && !opts.key) {
-        ui.info(`Already logged in as ${maskKey(existingKey)}`);
+        ui.info(`当前已登录: ${maskKey(existingKey)}`);
         const relogin = await clack.confirm({
-            message: "Re-authenticate with a different key?",
+            message: "是否切换到其他 Key？",
             initialValue: false,
         });
         if (clack.isCancel(relogin) || !relogin)
@@ -21,57 +21,57 @@ export async function loginCommand(opts) {
     let apiKey = opts.key || "";
     // R1-04: Warn about key visibility in args/history
     if (opts.key) {
-        ui.warning("Key passed via CLI argument — it may be visible in shell history.");
-        ui.info("Prefer: dreamlogic login (interactive) or DREAMLOGIC_API_KEY env var");
+        ui.warning("Key 通过命令行参数传入 — 可能会记录在终端历史中");
+        ui.info("建议使用交互模式: dreamlogic login 或环境变量 DREAMLOGIC_API_KEY");
     }
     if (!apiKey) {
         const keyInput = await clack.password({
-            message: "Enter your Dreamlogic API Key:",
+            message: "请输入你的 Dreamlogic API Key:",
             mask: "*",
             validate: (v) => {
                 if (!v || !KEY_RE.test(v))
-                    return "Key must match format: sk-user-xxxx... or sk-admin-xxxx...";
+                    return "Key 格式应为: sk-user-xxxx... 或 sk-admin-xxxx...";
             },
         });
         if (clack.isCancel(keyInput)) {
-            clack.cancel("Login cancelled.");
+            clack.cancel("登录已取消");
             return;
         }
         apiKey = keyInput;
     }
     if (!KEY_RE.test(apiKey)) {
-        ui.err("Invalid key format. Expected: sk-user-xxxx... or sk-admin-xxxx...");
+        ui.err("Key 格式不正确，应为: sk-user-xxxx... 或 sk-admin-xxxx...");
         process.exitCode = 1;
         return;
     }
     const server = getServer();
-    const spinner = ui.spinner("Verifying key...");
+    const spinner = ui.spinner("正在验证 Key...");
     spinner.start();
     try {
         const client = new ApiClient(server, apiKey);
         const user = await client.me();
-        spinner.succeed(`  Welcome, ${ui.brand(user.name)}! (${user.role})`);
+        spinner.succeed(`  欢迎回来, ${ui.brand(user.name)}! (${user.role})`);
         const config = loadConfig() || { api_key: "", server: DEFAULT_SERVER, install_dir: getDefaultInstallDir() };
         config.api_key = apiKey;
         config.server = server;
         if (!config.install_dir)
             config.install_dir = getDefaultInstallDir();
         saveConfig(config);
-        ui.ok("Configuration saved to ~/.dreamlogic/config.json");
+        ui.ok("配置已保存到 ~/.dreamlogic/config.json");
     }
     catch (err) {
-        spinner.fail("  Authentication failed");
+        spinner.fail("  认证失败");
         if (err instanceof ApiError) {
             if (err.status === 401) {
-                ui.err("Invalid or disabled API key. Please check your key and try again.");
+                ui.err("无效或已禁用的 API Key，请检查后重试。");
             }
             else {
-                ui.err(`Server error: ${err.message}`);
+                ui.err(`服务器错误: ${err.message}`);
             }
         }
         else {
-            ui.err(`Connection failed: ${err.message}`);
-            ui.info(`Server: ${server}`);
+            ui.err(`连接失败: ${err.message}`);
+            ui.info(`服务器地址: ${server}`);
         }
         process.exitCode = 1;
     }

package/dist/commands/logout.js

@@ -7,13 +7,13 @@ import { ui } from "../lib/ui.js";
 export async function logoutCommand() {
     const key = getApiKey();
     if (!key) {
-        ui.info("Not logged in.");
+        ui.info("当前未登录。");
         return;
     }
-    ui.info(`Current key: ${maskKey(key)}`);
-    const ok = await clack.confirm({ message: "Clear saved credentials?", initialValue: true });
+    ui.info(`当前 Key: ${maskKey(key)}`);
+    const ok = await clack.confirm({ message: "确定清除已保存的凭证？", initialValue: true });
     if (clack.isCancel(ok) || !ok)
         return;
     clearConfig();
-    ui.ok("Credentials cleared.");
+    ui.ok("凭证已清除。");
 }

package/dist/commands/rollback.js

@@ -8,33 +8,33 @@ import { ui } from "../lib/ui.js";
 export async function rollbackCommand(skillId) {
     const installed = loadInstalled();
     if (!installed[skillId]) {
-        ui.err(`Skill '${skillId}' is not installed.`);
+        ui.err(`技能 '${skillId}' 未安装。`);
         process.exitCode = 1;
         return;
     }
     const info = installed[skillId];
     if (!info.previous_version) {
-        ui.err(`No previous version available for rollback.`);
-        ui.info(`Current version: ${info.version}`);
+        ui.err(`没有可用的历史版本进行回滚。`);
+        ui.info(`当前版本: ${info.version}`);
         return;
     }
-    ui.info(`Current: ${info.version}`);
-    ui.info(`Rollback to: ${info.previous_version}`);
-    const ok = await clack.confirm({ message: "Proceed with rollback?", initialValue: true });
+    ui.info(`当前版本: ${info.version}`);
+    ui.info(`回滚到: ${info.previous_version}`);
+    const ok = await clack.confirm({ message: "确认回滚？", initialValue: true });
     if (clack.isCancel(ok) || !ok) {
-        clack.cancel("Cancelled.");
+        clack.cancel("已取消。");
         return;
     }
-    const spinner = ui.spinner("Rolling back...");
+    const spinner = ui.spinner("正在回滚...");
     spinner.start();
     const success = rollbackSkill(skillId);
     if (success) {
-        spinner.succeed(`  Rolled back to previous version`);
-        ui.ok("Rollback complete.");
+        spinner.succeed(`  已回滚到上一个版本`);
+        ui.ok("回滚完成。");
     }
     else {
-        spinner.fail("  Rollback failed");
-        ui.err("No backup found. Manual restore required.");
+        spinner.fail("  回滚失败");
+        ui.err("未找到备份，需要手动恢复。");
         process.exitCode = 1;
     }
 }

package/dist/commands/setup-mcp.js

@@ -54,7 +54,7 @@ function getAgents(server, key) {
                     catch {
                         // R2-07: Backup corrupted config instead of silently discarding
                         const bakPath = claudeDesktopPath + ".bak";
-                        writeFileSync(bakPath, readFileSync(claudeDesktopPath));
+                        writeFileSync(bakPath, readFileSync(claudeDesktopPath), { mode: 0o600 });
                         ui.warning(`Existing config has invalid JSON — backed up to ${bakPath}`);
                     }
                 }
@@ -117,7 +117,7 @@ function getAgents(server, key) {
                     catch {
                         // R2-07: Backup corrupted config
                         const bakPath = path + ".bak";
-                        writeFileSync(bakPath, readFileSync(path));
+                        writeFileSync(bakPath, readFileSync(path), { mode: 0o600 });
                         ui.warning(`Existing config has invalid JSON — backed up to ${bakPath}`);
                     }
                 }
@@ -140,31 +140,31 @@ export async function setupMcpCommand(opts) {
     const server = getServer();
     const agents = getAgents(server, apiKey);
     console.log();
-    ui.header("MCP Agent Configuration");
+    ui.header("MCP Agent 配置");
     console.log();
     // Detect installed agents
     const detected = agents.filter((a) => a.detect());
     const notDetected = agents.filter((a) => !a.detect());
     if (detected.length > 0) {
-        ui.ok(`Detected ${detected.length} agent(s):`);
+        ui.ok(`检测到 ${detected.length} 个 Agent:`);
         for (const a of detected)
             ui.line(`  ${chalk.green("●")} ${a.name}`);
     }
     if (notDetected.length > 0) {
-        ui.line(`  ${ui.dim("Not detected: " + notDetected.map((a) => a.name).join(", "))}`);
+        ui.line(`  ${ui.dim("未检测到: " + notDetected.map((a) => a.name).join(", "))}`);
     }
     if (detected.length === 0) {
-        ui.warning("No supported agents detected.");
-        ui.info("Supported agents: " + agents.map((a) => a.name).join(", "));
+        ui.warning("未检测到支持的 Agent。");
+        ui.info("支持的 Agent: " + agents.map((a) => a.name).join(", "));
         console.log();
-        ui.info("Manual MCP configuration:");
-        ui.line(`  Server URL: ${server}/sse`);
+        ui.info("手动配置 MCP:");
+        ui.line(`  服务器 URL: ${server}/sse`);
         ui.line(`  API Key: ${maskKey(apiKey)}`);
         return;
     }
-    // R1-01: Warn about key in MCP URL (inherent to MCP SSE protocol)
-    ui.warning("MCP config will contain your API key in the URL (required by MCP protocol).");
-    ui.line(`  Config files are written with restricted permissions (owner-only).`);
+    // R1-01: Warn about key in MCP config (inherent to MCP protocol)
+    ui.warning("MCP 配置将包含你的 API Key（MCP 协议需要认证）");
+    ui.line(`  配置文件将以安全权限写入（仅所有者可读写）。`);
     // Configure each detected agent
     for (const agent of detected) {
         console.log();
@@ -180,26 +180,26 @@ export async function setupMcpCommand(opts) {
             ui.line(`  ${chalk.dim(maskConfigJson(config, apiKey).split("\n").join("\n  "))}`);
         }
         if (opts.dryRun) {
-            ui.info("(dry-run — no changes made)");
+            ui.info("（预览模式 — 未做任何更改）");
             continue;
         }
         const ok = await clack.confirm({
-            message: `Apply configuration for ${agent.name}?`,
+            message: `为 ${agent.name} 应用配置？`,
             initialValue: true,
         });
         if (clack.isCancel(ok) || !ok) {
-            ui.info("Skipped.");
+            ui.info("已跳过。");
             continue;
         }
         try {
             agent.apply(config);
-            ui.ok(`${agent.name} configured`);
+            ui.ok(`${agent.name} 已配置`);
             if (agent.name === "Claude Desktop") {
-                ui.info("Restart Claude Desktop to apply changes.");
+                ui.info("请重启 Claude Desktop 以生效。");
             }
         }
         catch (err) {
-            ui.err(`Failed: ${err.message}`);
+            ui.err(`配置失败: ${err.message}`);
         }
     }
     ui.goodbye();

package/dist/commands/status.js

@@ -10,14 +10,14 @@ export async function statusCommand() {
     const config = loadConfig();
     const installed = loadInstalled();
     console.log();
-    ui.header("Dreamlogic CLI Status");
+    ui.header("Dreamlogic CLI 状态总览");
     console.log();
     // Config
     ui.table([
-        ["CLI Version", CLI_VERSION],
-        ["Server", config?.server || "(not configured)"],
-        ["API Key", config?.api_key ? maskKey(config.api_key) : chalk.red("(not set)")],
-        ["Install Dir", getInstallDir()],
+        ["CLI 版本", CLI_VERSION],
+        ["服务器", config?.server || "(未配置)"],
+        ["API Key", config?.api_key ? maskKey(config.api_key) : chalk.red("(未设置)")],
+        ["安装目录", getInstallDir()],
     ]);
     // Server health — R2-05: use redirect:"error" like all other fetches
     const server = getServer();
@@ -33,16 +33,16 @@ export async function statusCommand() {
             throw new Error("Invalid health response");
         }
         console.log();
-        ui.ok(`Server: ${data.status} (v${data.version})`);
+        ui.ok(`服务器: ${data.status} (v${data.version})`);
     }
     catch {
         console.log();
-        ui.warning("Server unreachable");
+        ui.warning("服务器不可达");
     }
     // Installed skills
     const entries = Object.entries(installed);
     console.log();
-    ui.line(`Installed: ${entries.length} skill(s)`);
+    ui.line(`已安装: ${entries.length} 个技能`);
     if (entries.length > 0) {
         // Check for updates if authenticated
         const apiKey = getApiKey();

package/dist/commands/update.js

@@ -15,11 +15,11 @@ export async function updateCommand(opts) {
     const installed = loadInstalled();
     const installedIds = Object.keys(installed);
     if (installedIds.length === 0) {
-        ui.info("No skills installed. Run: dreamlogic install");
+        ui.info("暂无已安装的技能。请运行: dreamlogic install");
         return;
     }
     const client = new ApiClient(getServer(), apiKey);
-    const spinner = ui.spinner("Checking for updates...");
+    const spinner = ui.spinner("正在检查更新...");
     spinner.start();
     let skills;
     try {
@@ -27,7 +27,7 @@ export async function updateCommand(opts) {
         spinner.stop();
     }
     catch (err) {
-        spinner.fail("  Failed to check updates");
+        spinner.fail("  检查更新失败");
         ui.err(err.message);
         process.exitCode = 1;
         return;
@@ -39,16 +39,16 @@ export async function updateCommand(opts) {
         const local = installed[id];
         const remote = skills.find((s) => s.id === id);
         if (!remote) {
-            ui.line(`${ui.warn("?")} ${id} — not found on server (removed?)`);
+            ui.line(`${ui.warn("?")} ${id} — 服务器上未找到（已移除？）`);
             continue;
         }
         if (!remote.latest_version) {
-            ui.line(`${ui.muted("–")} ${remote.name} — no version info`);
+            ui.line(`${ui.muted("–")} ${remote.name} — 无版本信息`);
             continue;
         }
         const normalizeVer = (v) => v.replace(/^v/, "");
         if (normalizeVer(local.version) === normalizeVer(remote.latest_version)) {
-            ui.line(`${chalk.green("✓")} ${remote.name} ${local.version} — up to date`);
+            ui.line(`${chalk.green("✓")} ${remote.name} ${local.version} — 已是最新`);
         }
         else {
             ui.line(`${chalk.yellow("⬆")} ${chalk.bold(remote.name)} ${local.version} → ${chalk.green(remote.latest_version)}`);
@@ -65,11 +65,11 @@ export async function updateCommand(opts) {
     }
     if (updates.length === 0) {
         console.log();
-        ui.ok("All skills are up to date!");
+        ui.ok("所有技能均已是最新版！");
         return;
     }
     console.log();
-    ui.info(`${updates.length} update(s) available`);
+    ui.info(`发现 ${updates.length} 个可更新`);
     // Select which to update
     let selectedIds;
     if (opts.yes) {
@@ -77,14 +77,14 @@ export async function updateCommand(opts) {
     }
     else if (updates.length === 1) {
         const ok = await clack.confirm({
-            message: `Update ${updates[0].name} to ${updates[0].latestVersion}?`,
+            message: `更新 ${updates[0].name} 到 ${updates[0].latestVersion}？`,
             initialValue: true,
         });
         selectedIds = (clack.isCancel(ok) || !ok) ? [] : [updates[0].id];
     }
     else {
         const selected = await clack.multiselect({
-            message: "Select updates to apply:",
+            message: "选择要更新的技能:",
             options: updates.map((u) => ({
                 label: `${u.name} ${u.currentVersion} → ${u.latestVersion}${u.size ? ` (${ui.fileSize(u.size)})` : ""}`,
                 value: u.id,
@@ -92,13 +92,13 @@ export async function updateCommand(opts) {
             required: true,
         });
         if (clack.isCancel(selected)) {
-            clack.cancel("Cancelled.");
+            clack.cancel("已取消。");
             return;
         }
         selectedIds = selected;
     }
     if (selectedIds.length === 0) {
-        ui.info("No updates selected.");
+        ui.info("未选择任何更新。");
         return;
     }
     // Apply updates
@@ -108,23 +108,23 @@ export async function updateCommand(opts) {
         if (!u)
             continue;
         console.log();
-        ui.header(`Updating ${u.name}`);
+        ui.header(`正在更新 ${u.name}`);
         ui.line(`${u.currentVersion} → ${chalk.green(u.latestVersion)}`);
         try {
             await installSkill(client, u.id, u.packageFile, u.sha256, u.latestVersion);
-            ui.ok(`Updated to ${u.latestVersion}`);
+            ui.ok(`已更新到 ${u.latestVersion}`);
             successCount++;
         }
         catch (err) {
-            ui.err(`Failed: ${err.message}`);
-            ui.info(`Rollback with: dreamlogic rollback ${u.id}`);
+            ui.err(`更新失败: ${err.message}`);
+            ui.info(`可回滚: dreamlogic rollback ${u.id}`);
         }
     }
     console.log();
     if (successCount === selectedIds.length) {
-        ui.ok(`All ${successCount} update(s) applied!`);
+        ui.ok(`全部 ${successCount} 个更新已应用！`);
     }
     else {
-        ui.warning(`${successCount}/${selectedIds.length} updated. Check errors above.`);
+        ui.warning(`${successCount}/${selectedIds.length} 已更新，请检查上方错误信息。`);
     }
 }

package/dist/index.js

@@ -23,65 +23,65 @@ import { setupMcpCommand } from "./commands/setup-mcp.js";
 const program = new Command();
 program
     .name("dreamlogic")
-    .description(`${CLI_NAME} — AI Skill Manager\n${CLI_AUTHOR}`)
+    .description(`${CLI_NAME} — AI 技能管理器\n${CLI_AUTHOR}`)
     .version(CLI_VERSION, "-v, --version");
 // ===== login =====
 program
     .command("login")
-    .description("Authenticate with your Dreamlogic API key")
-    .option("-k, --key <key>", "API key (or enter interactively)")
+    .description("登录 — 验证 API Key")
+    .option("-k, --key <key>", "API Key（留空则交互输入）")
     .action((opts) => loginCommand(opts));
 // ===== logout =====
 program
     .command("logout")
-    .description("Clear saved credentials")
+    .description("登出 — 清除已保存的凭证")
     .action(() => logoutCommand());
 // ===== catalog =====
 program
     .command("catalog")
-    .description("List available skills from server")
+    .description("浏览 — 查看服务器上可用的技能")
     .action(() => catalogCommand());
 // ===== install =====
 program
     .command("install [skills...]")
-    .description("Install skills (interactive if no skill specified)")
-    .option("-y, --yes", "Skip confirmation prompts")
-    .option("--from-file <path>", "Install from local ZIP file (D-10)")
+    .description("安装 — 下载并安装技能（留空则交互选择）")
+    .option("-y, --yes", "跳过确认提示")
+    .option("--from-file <path>", "从本地 ZIP 文件安装")
     .action((skills, opts) => installCommand(skills, opts));
 // ===== update =====
 program
     .command("update")
-    .description("Check for and apply skill updates")
-    .option("-y, --yes", "Auto-apply all updates")
+    .description("更新 — 检查并应用技能升级")
+    .option("-y, --yes", "自动应用全部更新")
     .action((opts) => updateCommand(opts));
 // ===== list =====
 program
     .command("list")
     .alias("ls")
-    .description("List locally installed skills")
+    .description("列表 — 查看已安装的技能")
     .action(() => listCommand());
 // ===== rollback =====
 program
     .command("rollback <skill>")
-    .description("Rollback a skill to its previous version (D-13)")
+    .description("回滚 — 恢复技能到上一个版本")
     .action((skill) => rollbackCommand(skill));
 // ===== status =====
 program
     .command("status")
-    .description("Show full status overview")
+    .description("状态 — 查看完整状态概览")
     .action(() => statusCommand());
 // ===== setup-mcp =====
 program
     .command("setup-mcp")
-    .description("Auto-configure MCP for AI agents")
-    .option("--dry-run", "Show what would be configured without applying")
+    .description("配置 MCP — 自动配置 AI Agent 的 MCP 连接")
+    .option("--dry-run", "仅展示配置内容，不实际写入")
     .action((opts) => setupMcpCommand(opts));
 // ===== Interactive mode (no command) =====
 program.action(async () => {
     ui.banner();
     const isLoggedIn = !!getApiKey();
     if (!isLoggedIn) {
-        ui.info("Welcome! Let's get you set up.");
+        ui.info("欢迎使用 Dreamlogic！让我们先完成登录。");
         console.log();
         await loginCommand({});
         if (!getApiKey())
@@ -91,15 +91,15 @@ program.action(async () => {
     // Interactive menu with @clack/prompts
     while (true) {
         const action = await clack.select({
-            message: "What would you like to do?",
+            message: "请选择操作：",
             options: [
-                { value: "install", label: "Install skills", hint: "download new skills from server" },
-                { value: "update", label: "Check for updates", hint: "update installed skills" },
-                { value: "list", label: "List installed skills", hint: "show local installations" },
-                { value: "setup-mcp", label: "Configure MCP for Agent", hint: "auto-setup Claude/Cursor/Cline" },
-                { value: "status", label: "Status overview", hint: "full system status" },
-                { value: "catalog", label: "Browse skill catalog", hint: "see all available skills" },
-                { value: "exit", label: "Exit" },
+                { value: "install", label: "📦 安装技能", hint: "从服务器下载新技能" },
+                { value: "update", label: "⬆️  检查更新", hint: "升级已安装的技能" },
+                { value: "list", label: "📋 已安装列表", hint: "查看本地安装情况" },
+                { value: "setup-mcp", label: "🔗 配置 MCP", hint: "自动配置 Claude/Cursor/Cline 等" },
+                { value: "status", label: "📊 状态概览", hint: "完整系统状态" },
+                { value: "catalog", label: "🔍 浏览技能目录", hint: "查看全部可用技能" },
+                { value: "exit", label: "👋 退出" },
             ],
         });
         if (clack.isCancel(action)) {
@@ -136,8 +136,8 @@ program.exitOverride();
 async function main() {
     // BUG-2: Warn if TLS verification is disabled
     if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
-        ui.warning("NODE_TLS_REJECT_UNAUTHORIZED=0 detected — TLS verification disabled.");
-        ui.warning("This is a security risk. Remove it: set NODE_TLS_REJECT_UNAUTHORIZED=");
+        ui.warning("检测到 NODE_TLS_REJECT_UNAUTHORIZED=0 — TLS 证书验证已禁用");
+        ui.warning("存在安全风险，建议移除：set NODE_TLS_REJECT_UNAUTHORIZED=");
     }
     try {
         await program.parseAsync(process.argv);
@@ -156,7 +156,7 @@ async function main() {
             clack.cancel("Cancelled.");
             return;
         }
-        ui.err(`Unexpected error: ${err.message}`);
+        ui.err(`意外错误: ${err.message}`);
         process.exitCode = 1;
     }
 }

package/dist/lib/agents.js

@@ -39,13 +39,20 @@ const AGENT_CONFIGS = [
     { name: "Aider", skillsDir: ".aider/skills", group: "additional", detect: ".aider" },
     { name: "Plandex", skillsDir: ".plandex/skills", group: "additional", detect: ".plandex" },
 ];
+// R4-FIX: Shared safe skill ID pattern
+const SAFE_SKILL_ID = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
 /**
  * Resolve the skills directory for an agent (handles env overrides + home expansion)
  */
 function resolveAgentDir(agent) {
     const home = homedir();
     if (agent.envOverride && process.env[agent.envOverride]) {
-        return join(process.env[agent.envOverride], "skills");
+        const dir = join(process.env[agent.envOverride], "skills");
+        // R4-FIX: Prevent env override pointing outside home dir
+        if (!resolve(dir).startsWith(resolve(home))) {
+            throw new Error(`Agent dir must be under home directory: ${dir}`);
+        }
+        return dir;
     }
     return join(home, agent.skillsDir);
 }
@@ -141,6 +148,9 @@ export function registerSkillWithAgents(skillId, skillPath, agents) {
  * Unregister a skill from all agents (remove symlinks only)
  */
 export function unregisterSkillFromAgents(skillId) {
+    // R4-FIX: Validate skillId to prevent path traversal (same as registerSkillWithAgents)
+    if (!SAFE_SKILL_ID.test(skillId))
+        return 0;
     const home = homedir();
     let removed = 0;
     // Check all known agent dirs
@@ -163,6 +173,9 @@ export function unregisterSkillFromAgents(skillId) {
  * List which agents have a specific skill registered
  */
 export function getSkillAgentStatus(skillId) {
+    // R4-FIX: Validate skillId to prevent path traversal info leak
+    if (!SAFE_SKILL_ID.test(skillId))
+        return [];
     const results = [];
     const seenDirs = new Set();
     for (const agent of AGENT_CONFIGS) {

package/dist/lib/config.js

@@ -3,7 +3,7 @@
  * Key stored with file permissions 600 (owner-only)
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, statSync } from "fs";
-import { join } from "path";
+import { join, resolve } from "path";
 import { homedir } from "os";
 import { CONFIG_DIR_NAME, DEFAULT_SERVER, DEFAULT_INSTALL_DIR_NAME, } from "../types.js";
 /** CFG-01 FIX: Recursively strip prototype pollution keys from parsed JSON */
@@ -21,8 +21,8 @@ function sanitize(obj) {
     }
     return obj;
 }
-// R1-06: Key format validation applied everywhere
-const KEY_RE = /^sk-(admin|user)-[a-f0-9]{16,}$/;
+// R1-06: Key format validation applied everywhere — R4-FIX: add upper bound
+const KEY_RE = /^sk-(admin|user)-[a-f0-9]{16,128}$/;
 function getConfigDir() {
     return join(homedir(), CONFIG_DIR_NAME);
 }
@@ -37,9 +37,8 @@ export function getDefaultInstallDir() {
 }
 export function ensureConfigDir() {
     const dir = getConfigDir();
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
+    // R4-FIX: mkdirSync with recursive handles existence; no TOCTOU
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
 }
 export function loadConfig() {
     const path = getConfigPath();
@@ -86,10 +85,14 @@ export function getServer() {
     return url;
 }
 export function getInstallDir() {
-    if (process.env.DREAMLOGIC_INSTALL_DIR)
-        return process.env.DREAMLOGIC_INSTALL_DIR;
-    const config = loadConfig();
-    return config?.install_dir ?? getDefaultInstallDir();
+    const dir = process.env.DREAMLOGIC_INSTALL_DIR || loadConfig()?.install_dir || getDefaultInstallDir();
+    const resolved = resolve(dir);
+    // R4-FIX: Block system-critical paths
+    const BLOCKED = ["/usr", "/bin", "/sbin", "/etc", "/var", "/System", "/Library", "/Windows", "/Program Files"];
+    if (BLOCKED.some(p => resolved.toLowerCase().startsWith(p.toLowerCase()))) {
+        throw new Error(`安装目录不能是系统关键路径: ${resolved}`);
+    }
+    return resolved;
 }
 export function loadInstalled() {
     const path = getInstalledPath();

package/dist/lib/installer.js

@@ -39,11 +39,11 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
         const { createHash } = await import("crypto");
         buffer = readFileSync(opts.fromFile);
         actualSha256 = createHash("sha256").update(buffer).digest("hex");
-        ui.info(`Loaded from file: ${opts.fromFile}`);
+        ui.info(`从本地文件加载: ${opts.fromFile}`);
     }
     else {
         // Download with progress
-        const spinner = ui.spinner(`Downloading ${skillId} ${expectedVersion}...`);
+        const spinner = ui.spinner(`正在下载 ${skillId} ${expectedVersion}...`);
         spinner.start();
         try {
             const result = await client.downloadPackage(packageFile, (dl, total) => {
@@ -53,25 +53,26 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
             });
             buffer = result.buffer;
             actualSha256 = result.sha256;
-            spinner.succeed(`  Downloaded ${ui.fileSize(buffer.length)}`);
+            spinner.succeed(`  已下载 ${ui.fileSize(buffer.length)}`);
         }
         catch (err) {
-            spinner.fail(`  Download failed`);
+            spinner.fail(`  下载失败`);
             throw err;
         }
     }
-    // SHA256 verification
+    // SHA256 verification — R4-FIX: no-hash is a security event, not just a warning
     if (expectedSha256) {
         if (actualSha256 !== expectedSha256) {
-            ui.err("SHA256 mismatch! Package may be corrupted or tampered.");
-            ui.line(`  Expected: ${expectedSha256}`);
-            ui.line(`  Actual:   ${actualSha256}`);
+            ui.err("SHA256 校验失败！文件可能已损坏或被篡改。");
+            ui.line(`  期望值: ${expectedSha256}`);
+            ui.line(`  实际值: ${actualSha256}`);
             throw new Error("SHA256 verification failed");
         }
-        ui.ok("SHA256 verified");
+        ui.ok("SHA256 校验通过");
     }
     else {
-        ui.warning("No SHA256 hash from server — skipping verification");
+        ui.warning("⚠️  服务器未提供 SHA256 校验值 — 无法验证包完整性");
+        ui.warning("   这可能意味着包被篡改或服务器配置错误");
     }
     // Extract to staging directory (D-05: never extract directly to target)
     // R1-10 + R2-01/R2-02: Signal cleanup with proper listener management
@@ -86,15 +87,15 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
     process.on("SIGTERM", cleanupAndExit);
     // R2-01: try/finally ensures listeners are always removed
     try {
-        const extractSpinner = ui.spinner("Extracting...");
+        const extractSpinner = ui.spinner("正在解压...");
         extractSpinner.start();
         try {
             mkdirSync(stagingDir, { recursive: true });
             await extractZip(buffer, stagingDir);
-            extractSpinner.succeed("  Extracted");
+            extractSpinner.succeed("  解压完成");
         }
         catch (err) {
-            extractSpinner.fail("  Extraction failed");
+            extractSpinner.fail("  解压失败");
             rmSync(stagingDir, { recursive: true, force: true });
             throw err;
         }
@@ -102,7 +103,7 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
         try {
             if (existsSync(skillDir)) {
                 renameSync(skillDir, backupDir);
-                ui.info(`Backed up previous version`);
+                ui.info(`已备份上一版本`);
             }
             const extractedRoot = findExtractedRoot(stagingDir);
             renameSync(extractedRoot, skillDir);
@@ -147,7 +148,7 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
     }
     catch { /* best-effort cleanup */ }
     if (existsSync(backupDir)) {
-        ui.info(`Rollback available: dreamlogic rollback ${skillId}`);
+        ui.info(`可回滚: dreamlogic rollback ${skillId}`);
     }
     return { path: skillDir, version: expectedVersion };
 }
@@ -195,6 +196,10 @@ export function rollbackSkill(skillId) {
  */
 function findExtractedRoot(stagingDir) {
     const entries = readdirSync(stagingDir);
+    // R4-FIX: Reject empty packages
+    if (entries.length === 0) {
+        throw new Error("解压后的包为空，不包含任何文件");
+    }
     // If only one directory entry, use that as root
     if (entries.length === 1) {
         const single = join(stagingDir, entries[0]);

package/dist/lib/ui.d.ts

@@ -27,9 +27,9 @@ export declare const ui: {
     dimText(msg: string): void;
     /** Create an ora spinner with brand styling */
     spinner(text: string): Ora;
-    /** Format file size */
+    /** Format file size — R4-FIX: handle NaN/negative */
     fileSize(bytes: number): string;
-    /** Format a skill for display (rich) */
+    /** Format a skill for display (rich) — R4-FIX: sanitize server-provided strings */
     skillLine(s: {
         id: string;
         name: string;

package/dist/lib/ui.js

@@ -21,6 +21,13 @@ const muted = chalk.hex("#6B7280");
 const hasTruecolor = chalk.level >= 3;
 // ===== Gradient helper =====
 const brandGradient = gradientString(BRAND_GRADIENT);
+// R4-FIX: Strip ANSI escape sequences and control chars from untrusted strings
+function stripAnsi(str) {
+    return str
+        .replace(/[\x00-\x1F\x7F-\x9F]/g, "") // control chars
+        .replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "") // CSI sequences
+        .replace(/\x1b\][^\x07]*\x07/g, ""); // OSC sequences
+}
 export const ui = {
     brand,
     accent,
@@ -92,21 +99,23 @@ export const ui = {
             spinner: "dots",
         });
     },
-    /** Format file size */
+    /** Format file size — R4-FIX: handle NaN/negative */
     fileSize(bytes) {
+        if (!Number.isFinite(bytes) || bytes < 0)
+            return "unknown";
         if (bytes < 1024)
             return `${bytes} B`;
         if (bytes < 1024 * 1024)
             return `${(bytes / 1024).toFixed(1)} KB`;
         return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
     },
-    /** Format a skill for display (rich) */
+    /** Format a skill for display (rich) — R4-FIX: sanitize server-provided strings */
     skillLine(s) {
-        const name = chalk.bold.white(s.name);
-        const ver = s.version ? muted(` v${s.version}`) : "";
+        const name = chalk.bold.white(stripAnsi(s.name));
+        const ver = s.version ? muted(` v${stripAnsi(s.version)}`) : "";
         const size = s.size ? muted(` (${ui.fileSize(s.size)})`) : "";
-        const desc = muted(s.description);
-        const tag = s.tag ? ` ${s.tag}` : "";
+        const desc = muted(stripAnsi(s.description));
+        const tag = s.tag ? ` ${stripAnsi(s.tag)}` : "";
         return `${name}${ver}${size}\n      ${desc}${tag}`;
     },
     /** Print a key-value table with alignment */

package/dist/types.d.ts

@@ -33,6 +33,6 @@ export interface InstalledRegistry {
 export declare const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export declare const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export declare const CONFIG_DIR_NAME = ".dreamlogic";
-export declare const CLI_VERSION = "2.0.2";
+export declare const CLI_VERSION = "2.0.4";
 export declare const CLI_NAME = "Dreamlogic CLI";
 export declare const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/dist/types.js

@@ -2,6 +2,6 @@
 export const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export const CONFIG_DIR_NAME = ".dreamlogic";
-export const CLI_VERSION = "2.0.2";
+export const CLI_VERSION = "2.0.4";
 export const CLI_NAME = "Dreamlogic CLI";
 export const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamlogic-ai/cli",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Dreamlogic AI Skill Manager — Install, update and manage AI agent skills",
   "type": "module",
   "bin": {