@dreamlogic-ai/cli 2.0.5 → 2.0.7

package/dist/commands/install.js

@@ -4,6 +4,7 @@
  */
 import * as clack from "@clack/prompts";
 import { join } from "path";
+import { statfsSync } from "fs";
 import { ApiClient } from "../lib/api-client.js";
 import { getServer, getInstallDir, loadInstalled } from "../lib/config.js";
 import { installSkill } from "../lib/installer.js";
@@ -110,6 +111,25 @@ export async function installCommand(skillIds, opts) {
             return;
         }
     }
+    // R4-FIX #8: 安装前检查磁盘空间（可选警告）
+    try {
+        const totalSize = selectedIds.reduce((sum, id) => {
+            const s = skills.find((s) => s.id === id);
+            return sum + (s?.package_size || 0);
+        }, 0);
+        if (totalSize > 0) {
+            const installPath = getInstallDir();
+            const { mkdirSync } = await import("fs");
+            mkdirSync(installPath, { recursive: true });
+            const fsStats = statfsSync(installPath);
+            const freeSpace = fsStats.bsize * fsStats.bavail;
+            // 需要解压后约 2x 空间（压缩包 + 解压内容）
+            if (freeSpace < totalSize * 2) {
+                ui.warning(`磁盘剩余空间不足: ${ui.fileSize(freeSpace)} 可用, 预计需要 ${ui.fileSize(totalSize * 2)}`);
+            }
+        }
+    }
+    catch { /* best-effort: statfsSync 可能在某些平台不可用 */ }
     // Install each
     let successCount = 0;
     for (const id of selectedIds) {

package/dist/commands/list.js

@@ -20,7 +20,7 @@ export function listCommand() {
             ["版本", info.version],
             ["安装时间", new Date(info.installed_at).toLocaleString()],
             ["路径", info.path],
-            ["SHA256", info.sha256.slice(0, 16) + "..."],
+            ["SHA256", (info.sha256 || "unknown").slice(0, 16) + "..."],
         ]);
         if (info.previous_version) {
             ui.line(`    ${ui.dim(`上一版本: ${info.previous_version}`)}`);

package/dist/commands/setup-mcp.js

@@ -36,7 +36,7 @@ function getAgents(server, key) {
         {
             name: "Claude Desktop",
             configPath: claudeDesktopPath,
-            detect: () => existsSync(claudeDesktopPath) || existsSync(join(claudeDesktopPath, "..")),
+            detect: () => existsSync(claudeDesktopPath), // R4-FIX #4: 只检查配置文件本身，避免父目录误检
             generate: () => ({
                 mcpServers: {
                     "dreamlogic-skills": {
@@ -46,6 +46,8 @@ function getAgents(server, key) {
                 },
             }),
             apply: (newSection) => {
+                // R4-FIX #5: read-then-write 存在 TOCTOU 竞态，但此为单用户 CLI 工具，
+                // 风险极低。如需更强保护可使用 flock，但当前场景不需要。
                 let existing = {};
                 if (existsSync(claudeDesktopPath)) {
                     try {
@@ -108,6 +110,7 @@ function getAgents(server, key) {
                 },
             }),
             apply: (newSection) => {
+                // R4-FIX #5: read-then-write TOCTOU — 单用户 CLI 风险极低，添加注释说明
                 const path = join(home, ".cursor", "mcp.json");
                 let existing = {};
                 if (existsSync(path)) {

package/dist/commands/update.js

@@ -49,11 +49,14 @@ export async function updateCommand(opts) {
         const normalizeVer = (v) => v.replace(/^v/, "");
         const localVer = normalizeVer(local.version);
         const remoteVer = normalizeVer(remote.latest_version);
+        // R5-M03 FIX: Numeric comparison to prevent non-standard version bypass
+        const localNum = parseInt(localVer.replace(/\D/g, ""), 10);
+        const remoteNum = parseInt(remoteVer.replace(/\D/g, ""), 10);
         if (localVer === remoteVer) {
             ui.line(`${chalk.green("✓")} ${remote.name} ${local.version} — 已是最新`);
         }
-        else if (remoteVer < localVer) {
-            // R4-C02 FIX: Block version downgrade attacks
+        else if (!isNaN(localNum) && !isNaN(remoteNum) && remoteNum < localNum) {
+            // R4-C02 + R5-M03 FIX: Block version downgrade attacks (numeric comparison)
             ui.line(`${ui.warn("⚠")} ${remote.name} — 服务器版本 ${remote.latest_version} 低于本地 ${local.version}（可能的降级攻击，已跳过）`);
         }
         else {

package/dist/index.js

@@ -10,6 +10,7 @@ import * as clack from "@clack/prompts";
 import { CLI_VERSION, CLI_NAME, CLI_AUTHOR } from "./types.js";
 import { ui } from "./lib/ui.js";
 import { getApiKey } from "./lib/config.js";
+import boxen from "boxen";
 // Commands
 import { loginCommand } from "./commands/login.js";
 import { logoutCommand } from "./commands/logout.js";
@@ -29,8 +30,15 @@ program
 program
     .command("login")
     .description("登录 — 验证 API Key")
-    .option("-k, --key <key>", "API Key（留空则交互输入）")
-    .action((opts) => loginCommand(opts));
+    // R4-FIX #1: API Key 通过 CLI 参数暴露风险警告
+    .option("-k, --key <key>", "API Key（⚠️ 不推荐：会暴露在进程列表和 shell 历史中，建议用交互输入或环境变量）")
+    .action((opts) => {
+    // R4-FIX #1: 清除 process.title 中的敏感参数
+    if (opts.key) {
+        process.title = "dreamlogic login";
+    }
+    return loginCommand(opts);
+});
 // ===== logout =====
 program
     .command("logout")
@@ -134,10 +142,25 @@ program.action(async () => {
 // Handle errors gracefully
 program.exitOverride();
 async function main() {
-    // BUG-2: Warn if TLS verification is disabled
+    // R4-FIX #9: TLS 验证禁用 — 醒目安全警告（红色框）
     if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
-        ui.warning("检测到 NODE_TLS_REJECT_UNAUTHORIZED=0 — TLS 证书验证已禁用");
-        ui.warning("存在安全风险，建议移除：set NODE_TLS_REJECT_UNAUTHORIZED=");
+        const tlsWarning = [
+            "NODE_TLS_REJECT_UNAUTHORIZED=0 已检测到",
+            "TLS 证书验证已完全禁用！",
+            "",
+            "风险：所有 HTTPS 请求均不验证服务器身份，",
+            "可能遭受中间人攻击 (MITM)。",
+            "",
+            "修复：unset NODE_TLS_REJECT_UNAUTHORIZED",
+        ].join("\n");
+        console.log(boxen(tlsWarning, {
+            title: "⚠️  安全警告",
+            titleAlignment: "center",
+            padding: 1,
+            margin: { top: 1, bottom: 1, left: 2, right: 0 },
+            borderStyle: "double",
+            borderColor: "red",
+        }));
     }
     try {
         await program.parseAsync(process.argv);
@@ -150,13 +173,27 @@ async function main() {
             }
         }
         // CLI-001: clack returns isCancel symbol (handled at each prompt site)
-        // Catch any remaining cancellation-like errors gracefully
-        if (err instanceof Error && /cancel/i.test(err.message)) {
+        // R5-M01 FIX: Only match exact clack cancel errors, not all messages containing "cancel"
+        if (clack.isCancel(err) || (err instanceof Error && err.message === "Cancelled")) {
             console.log();
-            clack.cancel("Cancelled.");
+            clack.cancel("已取消。");
             return;
         }
-        ui.err(`意外错误: ${err.message}`);
+        // R4-FIX #10: 错误信息不泄漏内部路径/堆栈
+        const knownErrors = ["ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "EACCES", "EPERM"];
+        const errMsg = err.message || "";
+        if (knownErrors.some(code => errMsg.includes(code))) {
+            ui.err(`操作失败: ${errMsg}`);
+        }
+        else if (errMsg.includes("SHA256") || errMsg.includes("Invalid skill ID")) {
+            ui.err(errMsg);
+        }
+        else {
+            ui.err("发生意外错误，请重试或联系支持。");
+            if (process.env.DREAMLOGIC_DEBUG === "1") {
+                ui.line(`调试信息: ${errMsg}`);
+            }
+        }
         process.exitCode = 1;
     }
 }

package/dist/lib/api-client.d.ts

@@ -12,6 +12,8 @@ export declare class ApiClient {
     downloadPackage(filename: string, onProgress?: (downloaded: number, total: number) => void): Promise<{
         buffer: Buffer;
         sha256: string;
+        contentLength: number;
+        warnLargeDownload: boolean;
     }>;
     /** GET /health — check server connectivity (R2-09: validated) */
     health(): Promise<{

package/dist/lib/api-client.js

@@ -11,6 +11,8 @@ import { CLI_VERSION } from "../types.js";
 const API_TIMEOUT = 30_000; // 30s for API calls
 const DOWNLOAD_TIMEOUT = 300_000; // 5min for downloads
 const MAX_DOWNLOAD_SIZE = 200 * 1024 * 1024; // 200MB
+// R4-FIX #3: 下载预警阈值
+const DOWNLOAD_WARN_SIZE = 50 * 1024 * 1024; // 50MB
 export class ApiClient {
     baseUrl;
     apiKey;
@@ -81,6 +83,8 @@ export class ApiClient {
         if (!Number.isNaN(contentLength) && contentLength > 0 && contentLength > MAX_DOWNLOAD_SIZE) {
             throw new ApiError(`Package too large: ${contentLength} bytes (max ${MAX_DOWNLOAD_SIZE})`, 413);
         }
+        // R4-FIX #3: 大包下载预警 — 通过回调通知调用者
+        const warnLargeDownload = !Number.isNaN(contentLength) && contentLength > DOWNLOAD_WARN_SIZE;
         const reader = res.body?.getReader();
         if (!reader)
             throw new ApiError("No response body", 500);
@@ -103,7 +107,7 @@ export class ApiClient {
         }
         const buffer = Buffer.concat(chunks);
         const sha256 = createHash("sha256").update(buffer).digest("hex");
-        return { buffer, sha256 };
+        return { buffer, sha256, contentLength, warnLargeDownload };
     }
     /** GET /health — check server connectivity (R2-09: validated) */
     async health() {

package/dist/lib/config.js

@@ -4,8 +4,19 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, statSync } from "fs";
 import { join, resolve } from "path";
-import { homedir } from "os";
+import { homedir, platform } from "os";
 import { CONFIG_DIR_NAME, DEFAULT_SERVER, DEFAULT_INSTALL_DIR_NAME, } from "../types.js";
+// R4-FIX #11: Windows 不支持 Unix 文件权限，跳过 chmod
+const isWin = platform() === "win32";
+/** Platform-safe chmod: 只在 Unix 系统上执行 */
+function safeChmod(path, mode) {
+    if (isWin)
+        return; // R4-FIX #11: Windows 下跳过
+    try {
+        chmodSync(path, mode);
+    }
+    catch { /* best-effort */ }
+}
 /** CFG-01 FIX: Recursively strip prototype pollution keys from parsed JSON */
 function sanitize(obj) {
     if (typeof obj !== "object" || obj === null)
@@ -61,10 +72,7 @@ export function saveConfig(config) {
     ensureConfigDir();
     const path = getConfigPath();
     writeFileSync(path, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch { /* Windows fallback */ }
+    safeChmod(path, 0o600);
 }
 /** R1-06: Validate key format from all sources (env, config file) */
 export function getApiKey() {
@@ -104,6 +112,13 @@ export function loadInstalled() {
         // R2-13: Basic shape validation
         if (typeof data !== "object" || data === null || Array.isArray(data))
             return {};
+        // R4-FIX #12: 兼容旧数据 — 将 number 类型的 installed_at 统一为 ISO string
+        for (const key of Object.keys(data)) {
+            const entry = data[key];
+            if (entry && typeof entry.installed_at === "number") {
+                entry.installed_at = new Date(entry.installed_at).toISOString();
+            }
+        }
         return data;
     }
     catch {
@@ -115,10 +130,7 @@ export function saveInstalled(registry) {
     ensureConfigDir();
     const path = getInstalledPath();
     writeFileSync(path, JSON.stringify(registry, null, 2) + "\n", { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch { /* Windows fallback */ }
+    safeChmod(path, 0o600);
 }
 /** R1-13: Zero-fill before overwrite for defense-in-depth */
 export function clearConfig() {

package/dist/lib/installer.js

@@ -54,6 +54,10 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
             buffer = result.buffer;
             actualSha256 = result.sha256;
             spinner.succeed(`  已下载 ${ui.fileSize(buffer.length)}`);
+            // R4-FIX #3: 大包内存占用警告
+            if (result.warnLargeDownload) {
+                ui.warning(`包体积较大 (${ui.fileSize(buffer.length)})，内存占用较高`);
+            }
         }
         catch (err) {
             spinner.fail(`  下载失败`);
@@ -176,6 +180,23 @@ export function rollbackSkill(skillId) {
     if (backups.length === 0)
         return false;
     const latestBackup = join(installDir, backups[0]);
+    // R4-FIX #6: 回滚前验证备份目录完整性
+    try {
+        const backupStat = statSync(latestBackup);
+        if (!backupStat.isDirectory()) {
+            ui.warning("备份路径不是有效目录，回滚中止");
+            return false;
+        }
+        const backupContents = readdirSync(latestBackup);
+        if (backupContents.length === 0) {
+            ui.warning("备份目录为空，回滚中止 — 可能备份已损坏");
+            return false;
+        }
+    }
+    catch {
+        ui.warning("无法验证备份完整性，回滚中止");
+        return false;
+    }
     if (existsSync(skillDir)) {
         rmSync(skillDir, { recursive: true, force: true });
     }
@@ -244,6 +265,16 @@ function extractZip(buffer, targetDir) {
                     reject(new Error(`Unsafe path in ZIP: ${entry.fileName}`));
                     return;
                 }
+                // R4-FIX #2: 拒绝 Windows Alternate Data Streams (filename:stream)
+                // 排除 Windows 盘符 (如 C:\)
+                const pathParts = entryPath.split(sep);
+                for (const part of pathParts) {
+                    if (part.includes(":") && !/^[A-Za-z]:$/.test(part)) {
+                        zipfile.close();
+                        reject(new Error(`不安全的路径（可能包含 Windows ADS）: ${entry.fileName}`));
+                        return;
+                    }
+                }
                 // INS-02 FIX: Reject symlink entries (external attributes bit 0xA000)
                 const externalAttrs = (entry.externalFileAttributes >>> 16) & 0xFFFF;
                 const S_IFLNK = 0xA000;

package/dist/types.d.ts

@@ -22,6 +22,7 @@ export interface CliConfig {
 }
 export interface InstalledSkill {
     version: string;
+    /** R4-FIX #12: 统一为 ISO 8601 字符串 (如 "2025-01-01T00:00:00.000Z") */
     installed_at: string;
     path: string;
     sha256: string;
@@ -33,6 +34,6 @@ export interface InstalledRegistry {
 export declare const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export declare const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export declare const CONFIG_DIR_NAME = ".dreamlogic";
-export declare const CLI_VERSION = "2.0.5";
+export declare const CLI_VERSION = "2.0.7";
 export declare const CLI_NAME = "Dreamlogic CLI";
 export declare const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/dist/types.js

@@ -2,6 +2,6 @@
 export const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export const CONFIG_DIR_NAME = ".dreamlogic";
-export const CLI_VERSION = "2.0.5";
+export const CLI_VERSION = "2.0.7";
 export const CLI_NAME = "Dreamlogic CLI";
 export const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamlogic-ai/cli",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "description": "Dreamlogic AI Skill Manager — Install, update and manage AI agent skills",
   "type": "module",
   "bin": {