@dreamlogic-ai/cli 2.0.6 → 2.0.7

package/dist/commands/list.js

@@ -20,7 +20,7 @@ export function listCommand() {
             ["版本", info.version],
             ["安装时间", new Date(info.installed_at).toLocaleString()],
             ["路径", info.path],
-            ["SHA256", info.sha256.slice(0, 16) + "..."],
+            ["SHA256", (info.sha256 || "unknown").slice(0, 16) + "..."],
         ]);
         if (info.previous_version) {
             ui.line(`    ${ui.dim(`上一版本: ${info.previous_version}`)}`);

package/dist/commands/update.js

@@ -49,11 +49,14 @@ export async function updateCommand(opts) {
         const normalizeVer = (v) => v.replace(/^v/, "");
         const localVer = normalizeVer(local.version);
         const remoteVer = normalizeVer(remote.latest_version);
+        // R5-M03 FIX: Numeric comparison to prevent non-standard version bypass
+        const localNum = parseInt(localVer.replace(/\D/g, ""), 10);
+        const remoteNum = parseInt(remoteVer.replace(/\D/g, ""), 10);
         if (localVer === remoteVer) {
             ui.line(`${chalk.green("✓")} ${remote.name} ${local.version} — 已是最新`);
         }
-        else if (remoteVer < localVer) {
-            // R4-C02 FIX: Block version downgrade attacks
+        else if (!isNaN(localNum) && !isNaN(remoteNum) && remoteNum < localNum) {
+            // R4-C02 + R5-M03 FIX: Block version downgrade attacks (numeric comparison)
             ui.line(`${ui.warn("⚠")} ${remote.name} — 服务器版本 ${remote.latest_version} 低于本地 ${local.version}（可能的降级攻击，已跳过）`);
         }
         else {

package/dist/index.js

@@ -173,10 +173,10 @@ async function main() {
             }
         }
         // CLI-001: clack returns isCancel symbol (handled at each prompt site)
-        // Catch any remaining cancellation-like errors gracefully
-        if (err instanceof Error && /cancel/i.test(err.message)) {
+        // R5-M01 FIX: Only match exact clack cancel errors, not all messages containing "cancel"
+        if (clack.isCancel(err) || (err instanceof Error && err.message === "Cancelled")) {
             console.log();
-            clack.cancel("Cancelled.");
+            clack.cancel("已取消。");
             return;
         }
         // R4-FIX #10: 错误信息不泄漏内部路径/堆栈

package/dist/types.d.ts

@@ -34,6 +34,6 @@ export interface InstalledRegistry {
 export declare const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export declare const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export declare const CONFIG_DIR_NAME = ".dreamlogic";
-export declare const CLI_VERSION = "2.0.6";
+export declare const CLI_VERSION = "2.0.7";
 export declare const CLI_NAME = "Dreamlogic CLI";
 export declare const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/dist/types.js

@@ -2,6 +2,6 @@
 export const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export const CONFIG_DIR_NAME = ".dreamlogic";
-export const CLI_VERSION = "2.0.6";
+export const CLI_VERSION = "2.0.7";
 export const CLI_NAME = "Dreamlogic CLI";
 export const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamlogic-ai/cli",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "Dreamlogic AI Skill Manager — Install, update and manage AI agent skills",
   "type": "module",
   "bin": {