@manturhub/cli 0.9.10-dev.20260810.6 → 0.9.11

package/README.md

@@ -15,26 +15,14 @@ manturhub login
 printf '%s' "$YOUR_MANTURHUB_KEY" | manturhub login --key-stdin
 ```
 
-稳定版 `@manturhub/cli@latest` 默认连接生产站 `https://hub.mantur.ai`，生产 Key 必须在该站创建。
-
-开发版 `@manturhub/cli@dev` 默认连接开发网关，无需设置环境变量：
-
-```bash
-npm install -g @manturhub/cli@dev
-manturhub login
-manturhub ls
-```
-
-`MANTURHUB_BASE` 可显式覆盖包的默认网关。开发网关是唯一允许使用远程 HTTP 的例外；生产站和其他远程部署必须使用 HTTPS。开发网关与生产站的 API Key 不通用。
-算子列表和详情通过 `/api/openapi/v1/operators` 获取，只返回当前 Key 已授权的算子。
-文件先通过 `POST /api/openapi/v1/files/upload` 提交 `files: [{ fileName, contentType, size }]`，从 `data.files[0]` 获取 `uploadUrl` 和 `downloadUrl`，再以 PUT 将文件流式上传到 `uploadUrl`；上传成功后命令输出 `downloadUrl`。API Key 只发送给 ManturHub 网关，不会发送给对象存储。
+CLI 默认连接生产站 `https://hub.mantur.ai`，Key 也必须在该生产站创建。`hub.mantur.cn` 是独立测试环境，其 Key 不能用于生产站。
 
 需要 Node.js ≥ 18。也可免安装运行：`npx -y @manturhub/cli <命令>`。
 
 ## 快速开始
 
 ```bash
-# 发现与查看当前 Key 已授权的算子
+# 发现与查看算子无需登录
 manturhub ls --cat text
 manturhub describe 电商文案生成
 
@@ -47,7 +35,7 @@ CLI 会在付费调用前按算子实时 schema 校验未知字段、必填项
 
 面向用户的列表、详情、报价、确认和结算统一显示中文算子名，也可直接用中文名调用。英文算子 ID 仅保留在 `--json` 机器输出和内部 API 请求中，供 Agent 与脚本稳定使用。
 
-在 Agent 或脚本等非交互环境中，第一次运行只返回报价和 `confirmation_token`，不会调用或扣费；Agent 向用户确认后，使用提示中的 `--confirm <confirmation_token>` 执行。确认标识绑定算子、入参、价格版本和幂等 ID：内容或价格变化时拒绝调用，同一次调用重试时复用幂等 ID，避免重复扣费。
+在 Agent 或脚本等非交互环境中，第一次运行只返回报价和 `quote_id`，不会调用或扣费；Agent 向用户确认后，使用提示中的 `--confirm <quote_id>` 执行。报价 5 分钟内有效且只能使用一次。
 
 ## 主要命令
 
@@ -56,9 +44,9 @@ CLI 会在付费调用前按算子实时 schema 校验未知字段、必填项
 | `manturhub ls [--cat image\|video\|audio\|text\|data] [--json]` | 实时列出上线算子 |
 | `manturhub describe <中文算子名> [--json]` | 查看精确入参与异步属性 |
 | `manturhub quote <中文算子名> [--json]` | 查询 Java API 返回的实时计费公式 |
-| `manturhub run <中文算子名> --json '{}' [--confirm <confirmation_token>] [--no-wait]` | 调用算子；非交互确认传确认标识，异步任务默认轮询到终态 |
+| `manturhub run <中文算子名> --json '{}' [--confirm <quote_id>] [--no-wait]` | 调用算子；非交互确认传报价 ID，异步任务默认轮询到终态 |
 | `manturhub run <中文算子名> --json-file params.json` | 从文件读取参数，适合长提示词和自动化 |
-| `manturhub upload <本地文件>` | 通过预签名 PUT 流式上传图片、音频或视频，并输出 `downloadUrl` |
+| `manturhub upload <本地文件>` | 流式上传文档、图片、音频或视频并输出公网 URL |
 | `manturhub status <poll_url>` | 查询 `run --no-wait` 返回的异步任务 |
 | `manturhub balance [--json]` | 查询余额及美元等值（1 馒头 = $0.01 USD） |
 | `manturhub skill ls [--json]` / `skill add <slug> [--client codex]` | 浏览并从当前 ManturHub 站点安装业务 Skill |
@@ -69,6 +57,6 @@ CLI 会在付费调用前按算子实时 schema 校验未知字段、必填项
 
 机器消费输出可在支持的查询命令上加 `--json`。进度和提示写入 stderr，JSON 结果写入 stdout。
 
-环境变量：`MANTURHUB_KEY`（优先于配置文件） · `MANTURHUB_BASE`（显式覆盖当前发布通道的默认网关）。
+环境变量：`MANTURHUB_KEY`（优先于配置文件） · `MANTURHUB_BASE`（测试或私有部署覆盖，默认 `https://hub.mantur.ai`）。
 
 ManturHub 算子广场：https://hub.mantur.ai

package/bin/cli.js

@@ -1,14 +1,6 @@
 #!/usr/bin/env node
-import { getBaseUrl, isAllowedHttpUrl, saveConfig, loadConfig } from "../lib/config.js";
-import {
-  apiFetch,
-  BALANCE_PATH,
-  fetchPublicCatalog,
-  parseBalanceResponse,
-  pollJob,
-  PUBLIC_RECIPES_PATH,
-  unwrapGatewayData,
-} from "../lib/api.js";
+import { getBaseUrl, saveConfig, loadConfig } from "../lib/config.js";
+import { apiFetch, classifyJobResponse, isFailedJobStatus, pollJob } from "../lib/api.js";
 import { runInit } from "../lib/setup.js";
 import { skillLs, skillAdd, skillOutdated, skillUpdate } from "../lib/skill-install.js";
 import { suiteLs, suiteInstall } from "../lib/suite-install.js";
@@ -16,14 +8,19 @@ import { loginViaBrowser } from "../lib/login-link.js";
 import { maybeNotifyUpdate } from "../lib/update-check.js";
 import { maybeNotifySkillUpdates } from "../lib/skill-update-check.js";
 import { createReadStream, readFileSync, statSync } from "node:fs";
-import { createHash, randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join, basename, extname } from "node:path";
 import { parseDynamicParams, validateParams } from "../lib/params.js";
 import { confirmCharge, formatMantou, printBillingResult } from "../lib/billing-confirm.js";
 
-// 本地文件 → MIME(presign 只接受 image/audio/video)
+// 本地文件 → MIME（最终可用类型仍由上传服务端白名单决定）
 const MIME_BY_EXT = {
+  ".md": "text/markdown", ".markdown": "text/markdown", ".txt": "text/plain",
+  ".json": "application/json", ".csv": "text/csv",
+  ".pdf": "application/pdf",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xls": "application/vnd.ms-excel",
   ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".webp": "image/webp",
   ".gif": "image/gif", ".bmp": "image/bmp",
   ".mp3": "audio/mpeg", ".wav": "audio/wav", ".m4a": "audio/mp4", ".aac": "audio/aac",
@@ -35,38 +32,6 @@ function mimeFromFile(f) {
   return MIME_BY_EXT[extname(f).toLowerCase()] || null;
 }
 
-function assertSecureUploadUrl(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error("上传接口返回的 uploadUrl 不合法");
-  }
-  if (url.protocol !== "https:" && !isAllowedHttpUrl(url)) {
-    throw new Error("uploadUrl 必须使用 HTTPS");
-  }
-  return url.href;
-}
-
-async function putFileToUploadUrl(file, mime, size, uploadUrl) {
-  const response = await fetch(assertSecureUploadUrl(uploadUrl), {
-    method: "PUT",
-    headers: {
-      "Content-Type": mime,
-      "Content-Length": String(size),
-    },
-    body: createReadStream(file),
-    duplex: "half",
-    redirect: "manual",
-    signal: AbortSignal.timeout(10 * 60 * 1000),
-  });
-  if (!response.ok) {
-    await response.body?.cancel();
-    throw new Error(`文件上传失败（HTTP ${response.status}）`);
-  }
-  await response.body?.cancel();
-}
-
 const VERSION = JSON.parse(
   readFileSync(join(dirname(fileURLToPath(import.meta.url)), "../package.json"), "utf8")
 ).version;
@@ -134,117 +99,29 @@ const CAT_LABELS = {
   data: "数据",
 };
 
-const OPERATORS_PATH = "/api/openapi/v1/operators";
-const FILE_UPLOAD_PATH = "/api/openapi/v1/files/upload";
-
 function catLabel(cat) {
   return CAT_LABELS[cat] || cat || "其他";
 }
 
-function operatorId(operator) {
-  return operator?.apiCode || operator?.code || operator?.id;
-}
-
-function operatorCat(operator) {
-  return operator?.category || operator?.cat;
-}
-
-function operatorParamsSchema(operator) {
-  const declared = operator?.params_schema || operator?.meta?.params_schema;
-  if (declared) return declared;
-  const inputSchema = operator?.inputSchema;
-  if (!inputSchema || inputSchema.type !== "object" || !inputSchema.properties) return null;
-  const required = new Set(Array.isArray(inputSchema.required) ? inputSchema.required : []);
-  return {
-    fields: Object.entries(inputSchema.properties).map(([name, field]) => ({
-      name,
-      type: field.type,
-      required: required.has(name),
-      enum: field.enum,
-      minLength: field.minLength,
-      maxLength: field.maxLength,
-      minimum: field.minimum,
-      maximum: field.maximum,
-      desc: field.description,
-    })),
-  };
-}
-
-function canonicalJson(value) {
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    const entries = Object.keys(value)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`);
-    return `{${entries.join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-
-function confirmationDigest(operator, input) {
-  return createHash("sha256").update(canonicalJson({ operator, input })).digest("base64url");
-}
-
-function encodeConfirmationToken(priceVersionTag, idempotencyKey, operator, input) {
-  const inputDigest = confirmationDigest(operator, input);
-  return Buffer.from(
-    JSON.stringify({ priceVersionTag, idempotencyKey, inputDigest })
-  ).toString("base64url");
-}
-
-function decodeConfirmationToken(value) {
-  try {
-    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-    if (
-      typeof parsed.priceVersionTag !== "string"
-      || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-        .test(parsed.idempotencyKey || "")
-      || !/^[A-Za-z0-9_-]{43}$/.test(parsed.inputDigest || "")
-    ) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-
-async function listOperators() {
-  const pageSize = 100;
-  const first = await apiFetch(`${OPERATORS_PATH}?pageNum=1&pageSize=${pageSize}`);
-  if (!first.ok) throw new Error(`算子列表获取失败（HTTP ${first.status}）`);
-  const firstPage = unwrapGatewayData(first.json) || {};
-  let records = null;
-  if (Array.isArray(firstPage.records)) records = [...firstPage.records];
-  else if (Array.isArray(firstPage.operators)) records = [...firstPage.operators];
-  else if (Array.isArray(firstPage)) records = [...firstPage];
-  if (!records) throw new Error("算子列表响应缺少 records");
-  const pages = Number(firstPage.pages);
-  if (!Number.isFinite(pages) || pages <= 1) return records;
-
-  for (let pageNum = 2; pageNum <= pages; pageNum++) {
-    const response = await apiFetch(
-      `${OPERATORS_PATH}?pageNum=${pageNum}&pageSize=${pageSize}`
-    );
-    if (!response.ok) throw new Error(`算子列表第 ${pageNum} 页获取失败（HTTP ${response.status}）`);
-    const page = unwrapGatewayData(response.json) || {};
-    if (Array.isArray(page.records)) records.push(...page.records);
-  }
-  return records;
-}
-
-async function fetchOperator(id) {
-  const response = await apiFetch(`${OPERATORS_PATH}/${encodeURIComponent(id)}`);
-  if (!response.ok) throw new Error(`算子信息获取失败（HTTP ${response.status}）`);
-  return unwrapGatewayData(response.json);
-}
-
 // Human commands accept either the stable operator ID or its Chinese display name.
 // Machine-facing --json responses keep IDs unchanged for automation compatibility.
 async function resolveOperator(ref) {
-  const operators = await listOperators();
-  const matches = operators.filter((item) => item?.name === ref || operatorId(item) === ref);
+  if (String(ref).startsWith("op.")) {
+    const direct = await apiFetch(`/api/v1/operators/${encodeURIComponent(ref)}`, { auth: "optional" });
+    if (direct.ok) return direct.json.operator || direct.json;
+    if (direct.status !== 404) throw new Error(`算子信息获取失败（HTTP ${direct.status}）`);
+  }
+
+  const listed = await apiFetch("/api/v1/operators?status=online", { auth: "optional" });
+  if (!listed.ok) throw new Error(`算子列表获取失败（HTTP ${listed.status}）`);
+  const operators = listed.json.operators || listed.json || [];
+  const matches = operators.filter((item) => item?.name === ref || item?.id === ref);
   if (matches.length === 0) throw new Error(`未找到算子“${ref}”`);
   if (matches.length > 1) throw new Error(`算子名称“${ref}”不唯一，请联系平台处理`);
-  return fetchOperator(operatorId(matches[0]));
+
+  const detail = await apiFetch(`/api/v1/operators/${encodeURIComponent(matches[0].id)}`, { auth: "optional" });
+  if (!detail.ok) throw new Error(`算子信息获取失败（HTTP ${detail.status}）`);
+  return detail.json.operator || detail.json;
 }
 
 const HELP = `manturhub — ManturHub 算子广场 CLI  v${VERSION}
@@ -253,15 +130,14 @@ const HELP = `manturhub — ManturHub 算子广场 CLI  v${VERSION}
   manturhub login                     浏览器授权登录（生成链接→登录创建 Key→自动导入，推荐）
   manturhub login --key sk-xxx        手动配置 API Key（存 ~/.manturhub/config.json）
   manturhub login --key-stdin         从 stdin 安全读取 API Key
-  manturhub ls [--cat <分类>] [--json]  列出当前 Key 已授权的上线算子
-  manturhub describe <中文算子名> [--json]  查看已授权算子的入参字段
+  manturhub ls [--cat <分类>] [--json]  列出上线算子（无需登录）
+  manturhub describe <中文算子名> [--json]  查看算子入参字段（无需登录）
   manturhub quote <中文算子名>            查询实时计费公式（不要使用 Skill 内的历史价格）
   manturhub run <中文算子名> --json '{}'  试算并确认费用后调用（异步算子自动轮询到出结果）
   manturhub run <中文算子名> --json-file x.json  从文件读参数（prompt 来自配方/用户时更安全）
-  manturhub run <中文算子名> ... --confirm <confirmation_token>
-                                      使用非交互试算返回的确认标识调用
+  manturhub run <中文算子名> ... --confirm <quote_id>  使用非交互试算返回的报价确认 ID 调用
   manturhub run <中文算子名> ... --no-wait  提交异步任务后立即返回 poll_url，不自动轮询
-  manturhub upload <本地文件>         上传图片/音频/视频 → 公网 URL（喂算子前先转换本地文件）
+  manturhub upload <本地文件>         上传文档/图片/音频/视频 → 公网 URL（喂算子前先转换本地文件）
   manturhub status <poll_url>         查异步任务状态（配合 run --no-wait）
   manturhub balance                   查询馒头余额
   manturhub init [--force]            从线上安装核心 Skill + 写 Agent 引导
@@ -323,32 +199,21 @@ async function main() {
         await loginViaBrowser();
         break;
       }
-      const r = await apiFetch(BALANCE_PATH, { key });
-      let verifiedBalance;
-      let verificationError;
+      const r = await apiFetch("/api/v1/me", { key });
       if (r.ok) {
-        try {
-          verifiedBalance = parseBalanceResponse(r.json);
-        } catch (error) {
-          verificationError = error.message;
-        }
-      }
-      if (r.ok && verifiedBalance) {
         const cfg = loadConfig();
         cfg.key = key;
         saveConfig(cfg);
         console.log(
-          `✓ Key 已验证并保存。余额: ${usdFor(verifiedBalance.totalBalance)}`
-          + `（${verifiedBalance.totalBalance} 馒头）`
+          `✓ Key 已验证并保存。账号: ${r.json.email || "-"}   余额: ${usdFor(r.json.balance)}（${r.json.balance ?? "-"} 馒头）`
         );
       } else {
         const base = getBaseUrl();
         const productionHint = new URL(base).hostname === "hub.mantur.ai"
-          ? " 对外用户请在 https://hub.mantur.ai 创建生产 Key；开发测试网关的 Key 不能用于生产。"
+          ? " 对外用户请在 https://hub.mantur.ai 创建生产 Key；hub.mantur.cn 的测试 Key 不能用于生产。"
           : "";
-        const reason = r.ok ? verificationError : `HTTP ${r.status}`;
         console.error(
-          `Key 验证失败（${reason}），未修改本地配置。当前连接：${base}。` +
+          `Key 验证失败（HTTP ${r.status}），未修改本地配置。当前连接：${base}。` +
           `Key 必须由这个站点创建，请确认 Key 是否正确、是否已激活。${productionHint}`
         );
         process.exit(1);
@@ -380,21 +245,20 @@ async function main() {
         console.error(`未知分类: ${cat}（可选: ${[...cats].join(" | ")}）`);
         process.exit(1);
       }
-      let ops;
-      try {
-        ops = await listOperators();
-      } catch (error) {
-        console.error(error.message);
+      const r = await apiFetch("/api/v1/operators?status=online", { auth: "optional" });
+      if (!r.ok) {
+        console.error(`列表获取失败（HTTP ${r.status}）`);
         process.exit(1);
       }
-      if (cat) ops = ops.filter((o) => operatorCat(o) === cat);
+      let ops = r.json.operators || r.json || [];
+      if (cat) ops = ops.filter((o) => o.cat === cat);
       if (hasFlag("json")) {
         console.log(JSON.stringify({ operators: ops }, null, 2));
         break;
       }
       console.log(`ManturHub 上线算子（${ops.length} 个）:\n`);
       for (const o of ops) {
-        console.log(`  ${o.name}   [${catLabel(operatorCat(o))}]`);
+        console.log(`  ${o.name}   [${catLabel(o.cat)}]`);
       }
       console.log(`\n用 \`manturhub describe <中文算子名>\` 查入参，\`manturhub run <中文算子名> --json '{...}'\` 调用`);
       break;
@@ -424,11 +288,9 @@ async function main() {
         console.log(JSON.stringify(o, null, 2));
         break;
       }
-      console.log(
-        `\n${o.name || "未命名算子"}   [${catLabel(operatorCat(o))}] · ${o.status || "online"}`
-      );
+      console.log(`\n${o.name || "未命名算子"}   [${catLabel(o.cat)}] · ${o.status || "-"}`);
       if (o.description) console.log(o.description);
-      const ps = operatorParamsSchema(o);
+      const ps = o.params_schema || (o.meta && o.meta.params_schema);
       if (ps && Array.isArray(ps.fields) && ps.fields.length) {
         console.log(`\n入参:`);
         for (const f of ps.fields) {
@@ -463,32 +325,23 @@ async function main() {
         console.error(error.message);
         process.exit(1);
       }
-      const id = operatorId(operator);
-      const quotePath = operator.quotePath || `${OPERATORS_PATH}/${encodeURIComponent(id)}/quote`;
-      const r = await apiFetch(quotePath);
+      const r = await apiFetch(`/api/v1/operators/${encodeURIComponent(operator.id)}/quote`, { auth: "optional" });
       if (!r.ok) {
         console.error(`查询价格失败（HTTP ${r.status}）: ${JSON.stringify(r.json)}`);
         process.exit(1);
       }
-      const quoted = unwrapGatewayData(r.json) || {};
       if (args.includes("--json")) {
-        const floor = Number(quoted.floor ?? quoted.estimatedPoints);
+        const floor = Number(r.json.floor);
         console.log(
           JSON.stringify(
-            Number.isFinite(floor) ? { ...quoted, floor_usd: floor * 0.01 } : quoted,
+            Number.isFinite(floor) ? { ...r.json, floor_usd: floor * 0.01 } : r.json,
             null,
             2
           )
         );
       } else {
-        const formulas = Array.isArray(quoted.items)
-          ? quoted.items.map((item) => item.formula).filter(Boolean).join("；")
-          : "";
-        console.log(
-          `${operator.name}: ${quoted.formula || formulas || operator.pricing?.displayText || "详见算子页"}`
-        );
-        const floor = quoted.floor ?? quoted.estimatedPoints;
-        if (floor !== undefined) console.log(`最低扣费: ${usdFor(floor)}（${floor} 馒头）`);
+        console.log(`${operator.name}: ${r.json.formula || "详见算子页"}`);
+        if (r.json.floor !== undefined) console.log(`最低扣费: ${usdFor(r.json.floor)}（${r.json.floor} 馒头）`);
       }
       break;
     }
@@ -547,127 +400,90 @@ async function main() {
         console.error(`${error.message}，已停止调用避免误扣费`);
         process.exit(1);
       }
-      const resolvedOperatorId = operatorId(operator);
-      const schema = operatorParamsSchema(operator);
+      const operatorId = operator.id;
+      const schema = operator.params_schema || operator.meta?.params_schema;
       try {
         body = validateParams(body, schema, { coerceStrings: !jsonArg && !jsonFile });
       } catch (error) {
         console.error(`参数校验失败: ${error.message}`);
         process.exit(1);
       }
-      const confirmationToken = getFlag("confirm");
-      const quotePath = operator.quotePath
-        || `${OPERATORS_PATH}/${encodeURIComponent(resolvedOperatorId)}/quote`;
-      const quoteResponse = await apiFetch(quotePath);
-      if (!quoteResponse.ok) {
-        console.error(
-          `本次费用试算失败（HTTP ${quoteResponse.status}）: ${JSON.stringify(quoteResponse.json)}`
-        );
-        process.exit(1);
-      }
-      const quote = unwrapGatewayData(quoteResponse.json) || {};
-      const estimated = Number(quote.estimatedPoints);
-      const priceVersionTag = quote.priceVersionTag;
-      const formula = Array.isArray(quote.items)
-        ? quote.items.map((item) => item.formula).filter(Boolean).join("；")
-        : "";
-      if (quote.billable !== false && !Number.isFinite(estimated)) {
-        console.error("报价响应缺少有效的 estimatedPoints，已停止调用避免误扣费。");
-        process.exit(1);
-      }
-      if (quote.enoughBalance === false) {
-        console.error(`余额不足：当前 ${quote.balance ?? "-"} 馒头，预计需要 ${estimated} 馒头。`);
-        process.exit(1);
-      }
-      let idempotencyKey = randomUUID();
-      if (confirmationToken) {
-        const confirmation = decodeConfirmationToken(confirmationToken);
-        if (
-          !confirmation
-          || confirmation.priceVersionTag !== priceVersionTag
-          || confirmation.inputDigest !== confirmationDigest(resolvedOperatorId, body)
-        ) {
-          console.error("报价已变化或确认标识无效，请重新执行 run 获取最新报价。");
+      let quoteId = getFlag("confirm");
+      if (!quoteId) {
+        const quote = await apiFetch(`/api/v1/operators/${encodeURIComponent(operatorId)}/quote`, {
+          method: "POST",
+          body,
+        });
+        if (!quote.ok) {
+          console.error(`本次费用试算失败（HTTP ${quote.status}）: ${JSON.stringify(quote.json)}`);
           process.exit(1);
         }
-        idempotencyKey = confirmation.idempotencyKey;
-      }
-      if (!confirmationToken && Number.isFinite(estimated) && estimated > 0) {
-        if (process.stdin.isTTY && process.stderr.isTTY) {
-          if (!(await confirmCharge({
-            estimated_dumplings: estimated,
-            balance: quote.balance,
-            formula,
-            operator_name: operator.name,
-          }))) {
-            console.error("已取消，未调用算子、未扣费。");
-            process.exit(2);
-          }
-        } else {
-          if (!priceVersionTag) {
-            console.error("报价响应缺少 priceVersionTag，无法安全确认付费调用。");
-            process.exit(1);
+        const estimated = Number(quote.json?.estimated_dumplings);
+        quoteId = quote.json?.quote_id;
+        if (Number.isFinite(estimated) && estimated > 0) {
+          if (process.stdin.isTTY && process.stderr.isTTY) {
+            if (!(await confirmCharge({ ...quote.json, operator_name: operator.name }))) {
+              console.error("已取消，未调用算子、未扣费。");
+              process.exit(2);
+            }
+          } else {
+            console.error(JSON.stringify({
+              error: "CONFIRMATION_REQUIRED",
+              operator_name: operator.name,
+              message: `本次预计消耗 ${formatMantou(estimated)}，请先取得用户确认`,
+              estimated_dumplings: estimated,
+              balance: quote.json?.balance,
+              formula: quote.json?.formula,
+              quote_id: quoteId,
+              retry_with: `--confirm ${quoteId}`,
+            }, null, 2));
+            process.exit(3);
           }
-          const encodedConfirmationToken = encodeConfirmationToken(
-            priceVersionTag,
-            idempotencyKey,
-            resolvedOperatorId,
-            body
-          );
-          console.error(JSON.stringify({
-            error: "CONFIRMATION_REQUIRED",
-            operator_name: operator.name,
-            message: `本次预计消耗 ${formatMantou(estimated)}，请先取得用户确认`,
-            estimated_dumplings: estimated,
-            balance: quote.balance,
-            formula,
-            price_version_tag: priceVersionTag,
-            confirmation_token: encodedConfirmationToken,
-            retry_with: `--confirm ${encodedConfirmationToken}`,
-          }, null, 2));
-          process.exit(3);
         }
       }
-      const invokePath = operator.invokePath
-        || `${OPERATORS_PATH}/${encodeURIComponent(resolvedOperatorId)}/invoke`;
       const r = await apiFetch(
-        invokePath,
+        `/api/v1/operators/${encodeURIComponent(operatorId)}/invoke`,
         {
           method: "POST",
-          body: { input: body },
+          body,
           timeoutMs: 120000,
-          headers: { "Idempotency-Key": idempotencyKey },
+          headers: quoteId ? { "X-Mantur-Quote-Id": quoteId } : {},
         }
       );
-      let invoked = r.ok ? unwrapGatewayData(r.json) : r.json;
-      const invokedJobId = invoked?.jobId || invoked?.job_id;
-      if (r.ok && invokedJobId) {
-        // OpenAPI 作业必须通过当前网关查询，不能把 Agent Key 发送到响应中的其他域名。
-        invoked = {
-          ...invoked,
-          pollUrl: `/api/openapi/v1/jobs/${encodeURIComponent(invokedJobId)}`,
-        };
-      }
-      // 异步算子默认自动轮询到出结果；--no-wait 只返回提交结果。
-      const pollUrl = r.ok && (invoked?.pollUrl || invoked?.poll_url);
+      // 异步算子(返回 poll_url)默认自动轮询到出结果;--no-wait 只拿 job_id。
+      const pollUrl = r.ok && r.json && r.json.poll_url;
       if (pollUrl && !args.includes("--no-wait")) {
         process.stderr.write(
-          `⏳ 异步任务 ${invokedJobId || ""} 已提交，轮询结果中…\n`
+          `⏳ 异步任务 ${r.json.job_id || ""} 已提交，轮询结果中（预计 ${r.json.estimated_seconds || "?"}s；加 --no-wait 可只拿 job_id）…\n`
         );
-        const final = await pollJob(pollUrl, {
-          initialBilling: invoked._billing,
-          onTick: (j) =>
-            process.stderr.write(
-              `   ${j.status || "?"}${j.elapsed_ms ? " " + Math.round(j.elapsed_ms / 1000) + "s" : ""}\n`
-            ),
-        });
+        let final;
+        try {
+          final = await pollJob(pollUrl, {
+            initialBilling: r.json._billing,
+            onTick: (j) =>
+              process.stderr.write(
+                `   ${j.status}${j.elapsed_ms ? " " + Math.round(j.elapsed_ms / 1000) + "s" : ""}\n`
+              ),
+          });
+        } catch (error) {
+          console.error(
+            `异步任务 ${r.json.job_id || ""} 已提交，但状态查询失败：${error.message}`
+          );
+          if (error.billing) {
+            printBillingResult({ _billing: error.billing }, process.stderr, operator.name);
+          }
+          console.error("请勿重新调用算子，以免重复生成和重复扣费。");
+          if (r.json.job_id) console.error(`任务 ID：${r.json.job_id}`);
+          console.error(`轮询地址：${pollUrl}`);
+          console.error("请稍后使用 `manturhub status <poll_url>` 继续查询。");
+          process.exit(1);
+        }
         console.log(JSON.stringify(final, null, 2));
         printBillingResult(final, process.stderr, operator.name);
-        const st = String(final?.status || "").toLowerCase();
-        if (st === "failed" || st === "error" || final?._timeout) process.exit(1);
+        if (isFailedJobStatus(final.status) || final._timeout) process.exit(1);
       } else {
-        console.log(JSON.stringify(invoked, null, 2));
-        printBillingResult(invoked, process.stderr, operator.name);
+        console.log(JSON.stringify(r.json, null, 2));
+        printBillingResult(r.json, process.stderr, operator.name);
         if (!r.ok) process.exit(1);
       }
       break;
@@ -676,7 +492,7 @@ async function main() {
     case "upload": {
       const file = args[1];
       if (!file || file.startsWith("--")) {
-        console.error("用法: manturhub upload <本地文件>   (图片/音频/视频 → 公网 URL)");
+        console.error("用法: manturhub upload <本地文件>   (文档/图片/音频/视频 → 公网 URL)");
         process.exit(1);
       }
       try {
@@ -688,7 +504,7 @@ async function main() {
       const mime = mimeFromFile(file);
       if (!mime) {
         console.error(
-          `不支持的文件类型: ${file}\n仅支持图片/音频/视频（png/jpg/webp/gif/mp3/wav/m4a/mp4/mov/webm…）`
+          `不支持的文件类型: ${file}\n支持文档/图片/音频/视频（md/txt/json/csv/pdf/docx/xls/xlsx/png/jpg/mp3/mp4…）`
         );
         process.exit(1);
       }
@@ -700,35 +516,26 @@ async function main() {
         console.error(`读不到文件: ${file}（${e.message}）`);
         process.exit(1);
       }
-      const prepared = await apiFetch(FILE_UPLOAD_PATH, {
+      const p = await apiFetch("/api/v1/uploads/presign", {
         method: "POST",
-        body: {
-          files: [
-            {
-              fileName: basename(file),
-              contentType: mime,
-              size: stat.size,
-            },
-          ],
-        },
+        body: { filename: basename(file), size: stat.size, mime },
       });
-      if (!prepared.ok) {
-        console.error(`获取上传地址失败（HTTP ${prepared.status}）: ${JSON.stringify(prepared.json)}`);
-        process.exit(1);
-      }
-      const result = unwrapGatewayData(prepared.json) || {};
-      const upload = Array.isArray(result.files) ? result.files[0] : null;
-      if (!upload?.uploadUrl || !upload?.downloadUrl) {
-        console.error("上传接口响应的 files[0] 缺少 uploadUrl 或 downloadUrl");
+      if (!p.ok || !p.json || !p.json.put_url) {
+        console.error(`presign 失败（HTTP ${p.status}）: ${JSON.stringify(p.json)}`);
         process.exit(1);
       }
-      try {
-        await putFileToUploadUrl(file, mime, stat.size, upload.uploadUrl);
-      } catch (error) {
-        console.error(error.message);
+      const put = await fetch(p.json.put_url, {
+        method: "PUT",
+        headers: { "Content-Type": mime, "Content-Length": String(stat.size) },
+        body: createReadStream(file),
+        duplex: "half",
+        signal: AbortSignal.timeout(10 * 60 * 1000),
+      });
+      if (!put.ok) {
+        console.error(`上传到存储失败（HTTP ${put.status}）`);
         process.exit(1);
       }
-      console.log(upload.downloadUrl); // 上传成功后输出可直接喂给算子的下载地址
+      console.log(p.json.access_url); // 公网 URL，直接喂给算子
       break;
     }
 
@@ -745,10 +552,20 @@ async function main() {
         process.exit(1);
       }
       const r = await apiFetch(pu);
-      const status = r.ok ? unwrapGatewayData(r.json) : r.json;
-      console.log(JSON.stringify(status, null, 2));
-      printBillingResult(status);
-      if (!r.ok) process.exit(1);
+      if (!r.ok) {
+        console.error(`查询失败（HTTP ${r.status}）`);
+        process.exit(1);
+      }
+      let state;
+      try {
+        state = classifyJobResponse(r.json);
+      } catch (error) {
+        console.error(`任务状态响应无效：${error.message}`);
+        process.exit(1);
+      }
+      console.log(JSON.stringify(r.json, null, 2));
+      printBillingResult(r.json);
+      if (state.failed) process.exit(1);
       break;
     }
 
@@ -759,23 +576,15 @@ async function main() {
         console.error(error.message);
         process.exit(1);
       }
-      const r = await apiFetch(BALANCE_PATH);
+      const r = await apiFetch("/api/v1/me");
       if (!r.ok) {
         console.error(`查询失败（HTTP ${r.status}）`);
         process.exit(1);
       }
-      let parsedBalance;
-      try {
-        parsedBalance = parseBalanceResponse(r.json);
-      } catch (error) {
-        console.error(error.message);
-        process.exit(1);
-      }
-      const { balance, totalBalance: balancePoints } = parsedBalance;
       console.log(
         hasFlag("json")
-          ? JSON.stringify({ ...balance, balance_usd: balancePoints * 0.01 }, null, 2)
-          : `余额: ${usdFor(balancePoints)}（${balancePoints} 馒头）`
+          ? JSON.stringify({ ...r.json, balance_usd: Number(r.json.balance) * 0.01 }, null, 2)
+          : `余额: ${usdFor(r.json.balance)}（${r.json.balance ?? "-"} 馒头）   账号: ${r.json.email || "-"}`
       );
       break;
     }
@@ -866,41 +675,30 @@ async function main() {
           console.error(error.message);
           process.exit(1);
         }
-        const r = await apiFetch(
-          `${PUBLIC_RECIPES_PATH}/${encodeURIComponent(slug)}`,
-          { auth: "optional" }
-        );
+        const r = await apiFetch(`/api/v1/recipes/${encodeURIComponent(slug)}`, { auth: "optional" });
         if (!r.ok) {
           console.error(`获取失败（HTTP ${r.status}）: ${slug}`);
           process.exit(1);
         }
-        let d;
-        try {
-          d = unwrapGatewayData(r.json) || {};
-        } catch (error) {
-          console.error(`获取失败: ${error.message}`);
-          process.exit(1);
-        }
+        const d = r.json;
         if (args.includes("--json")) {
           console.log(JSON.stringify(d, null, 2));
           break;
         }
-        const recipeCode = d.code || slug;
-        console.log(`\n${d.name || recipeCode}  [${d.category || "其他"}]${d.version ? ` · ${d.version}` : ""}`);
-        if (d.description) console.log(`${d.description}\n`);
-        if (d.sampleUrl) {
-          console.log(`效果样片: ${d.sampleUrl}`);
-        }
-        console.log(`配方页:   ${getBaseUrl()}/recipes/${recipeCode}\n`);
-        if (d.usage) console.log(`执行说明:\n${d.usage}\n`);
-        if (d.inputSchema) {
-          console.log("输入结构:");
-          console.log(JSON.stringify(d.inputSchema, null, 2));
-        }
-        if (Array.isArray(d.steps) && d.steps.length) {
-          console.log("\n执行步骤:");
-          console.log(JSON.stringify(d.steps, null, 2));
+        console.log(`\n${d.title}  [${d.cat}] · 复刻 ${d.cost_estimate}`);
+        console.log(`${d.summary}\n`);
+        if (d.sample_url) {
+          const su = d.sample_url.startsWith("http")
+            ? d.sample_url
+            : `${getBaseUrl()}${d.sample_url}`;
+          console.log(`效果样片: ${su}`);
         }
+        console.log(`配方页:   ${getBaseUrl()}/recipes/${d.slug}\n`);
+        if (d.prompt_template) console.log(`提示词模板:\n${d.prompt_template}\n`);
+        console.log("结构化参数（把 {占位符} 换成用户内容）:");
+        console.log(JSON.stringify(d.params_json || {}, null, 2));
+        console.log("\n安全执行：将每步 params 写入 JSON 文件，再运行 `manturhub run <算子ID> --json-file <文件>`。");
+        if (d.sample_text) console.log(`\n效果节选:\n${d.sample_text}`);
         break;
       }
       // manturhub recipe [ls|search] [关键词] [--cat video|image|script]
@@ -918,20 +716,16 @@ async function main() {
         console.error(`未知配方分类: ${cat}（可选: video | image | script）`);
         process.exit(1);
       }
-      let list;
-      try {
-        list = await fetchPublicCatalog(PUBLIC_RECIPES_PATH);
-      } catch (error) {
-        console.error(`配方列表获取失败（${error.message}）`);
+      const r = await apiFetch(`/api/v1/recipes${cat ? `?cat=${encodeURIComponent(cat)}` : ""}`, { auth: "optional" });
+      if (!r.ok) {
+        console.error(`配方列表获取失败（HTTP ${r.status}）`);
         process.exit(1);
       }
-      if (cat) list = list.filter((item) => item.category === cat);
+      let list = r.json.recipes || [];
       if (kwArg) {
         const k = kwArg.toLowerCase();
         list = list.filter((x) =>
-          `${x.name || ""}${x.summary || ""}${(x.tags || []).join(",")}`
-            .toLowerCase()
-            .includes(k)
+          `${x.title}${x.summary}${(x.tags || []).join(",")}`.toLowerCase().includes(k)
         );
       }
       if (hasFlag("json")) {
@@ -940,9 +734,7 @@ async function main() {
       }
       console.log(`ManturHub 配方（${list.length} 个）:\n`);
       for (const x of list) {
-        console.log(
-          `  ${String(x.code || "").padEnd(32)} [${x.category || "其他"}] ${x.name || ""}`
-        );
+        console.log(`  ${x.slug.padEnd(32)} [${x.cat}] ${x.title} · 复刻 ${x.cost_estimate}`);
       }
       console.log(
         `\n用 \`manturhub recipe get <配方ID>\` 看提示词模板与调用参数；挑选体验更好的网页版: ${getBaseUrl()}/recipes`

package/lib/api.js

@@ -1,70 +1,10 @@
 import { getKey, getBaseUrl } from "./config.js";
 
-export const BALANCE_PATH = "/api/openapi/v1/credits/balance";
-export const PUBLIC_RECIPES_PATH = "/api/public/agent/v1/recipes";
-export const PUBLIC_SKILLS_PATH = "/api/public/agent/v1/skills";
-
-export function unwrapGatewayData(json) {
-  if (json?.success === false || (typeof json?.code === "number" && json.code !== 0)) {
-    throw new Error(json?.message || "ManturHub Gateway 请求失败");
-  }
-  return json && Object.hasOwn(json, "data") ? json.data : json;
-}
-
-export function parseBalanceResponse(json) {
-  const balance = unwrapGatewayData(json);
-  const totalBalance = Number(balance?.totalBalance);
-  if (!Number.isFinite(totalBalance)) {
-    throw new Error("余额接口响应缺少有效的 totalBalance");
-  }
-  return { balance, totalBalance };
-}
-
-export async function fetchPublicCatalog(path, { pageSize = 100 } = {}) {
-  const fetchPage = async (pageNum) => {
-    const response = await apiFetch(
-      `${path}?pageNum=${pageNum}&pageSize=${pageSize}`,
-      { auth: "optional" }
-    );
-    if (!response.ok) {
-      const error = new Error(`HTTP ${response.status}`);
-      error.status = response.status;
-      throw error;
-    }
-    const page = unwrapGatewayData(response.json) || {};
-    if (!Array.isArray(page.records)) {
-      throw new Error("公共广场响应缺少 records");
-    }
-    return page;
-  };
-
-  const first = await fetchPage(1);
-  const records = [...first.records];
-  const pages = Number(first.pages);
-  if (!Number.isFinite(pages) || pages <= 1) return records;
-  for (let pageNum = 2; pageNum <= pages; pageNum++) {
-    const page = await fetchPage(pageNum);
-    records.push(...page.records);
-  }
-  return records;
-}
-
 // Thin REST client against the ManturHub gateway. Public discovery calls may omit auth.
 export async function apiFetch(
   path,
-  {
-    method = "GET",
-    body,
-    rawBody,
-    key,
-    auth = "required",
-    timeoutMs = 30000,
-    headers = {},
-  } = {}
+  { method = "GET", body, key, auth = "required", timeoutMs = 30000, headers = {} } = {}
 ) {
-  if (body !== undefined && rawBody !== undefined) {
-    throw new Error("body 和 rawBody 不能同时使用");
-  }
   const apiKey = key === undefined ? getKey() : key;
   if (auth === "required" && !apiKey) {
     throw new Error(
@@ -81,11 +21,10 @@ export async function apiFetch(
       method,
       headers: {
         ...(includeKey && apiKey ? { "x-api-key": apiKey } : {}),
-        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+        ...(body ? { "Content-Type": "application/json" } : {}),
         ...headers,
       },
-      body: rawBody ?? (body !== undefined ? JSON.stringify(body) : undefined),
-      ...(rawBody !== undefined ? { duplex: "half" } : {}),
+      body: body ? JSON.stringify(body) : undefined,
       signal: AbortSignal.timeout(timeoutMs),
     });
   const requestWithRetry = async (includeKey) => {
@@ -123,14 +62,40 @@ export async function apiFetch(
   return { ok: res.ok, status: res.status, json };
 }
 
-// 异步算子:轮询 invoke 返回的 poll_url 直到任务出终态(succeeded/failed/…),返回最终 json。
-// 未知 shape(无 status 字段)按终态处理,直接返回让上层打印。
+// 异步算子只接受已知状态。HTTP 错误、非 JSON object、缺失 status 和未知状态
+// 都必须失败关闭，不能因为“不在活动状态集合里”就被误判为成功终态。
 const ACTIVE = new Set(["created", "queued", "running", "pending", "processing", "in_progress"]);
+const SUCCEEDED = new Set(["succeeded", "success", "completed", "done"]);
+const FAILED = new Set(["failed", "error", "cancelled", "canceled"]);
+
+export function classifyJobResponse(result) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) {
+    throw new Error("异步任务状态响应必须是 JSON object");
+  }
+  if (typeof result.status !== "string" || !result.status.trim()) {
+    throw new Error("异步任务状态响应缺少合法的 status");
+  }
+  const status = result.status.trim().toLowerCase();
+  if (ACTIVE.has(status)) return { status, terminal: false, failed: false };
+  if (SUCCEEDED.has(status)) return { status, terminal: true, failed: false };
+  if (FAILED.has(status)) return { status, terminal: true, failed: true };
+  throw new Error(`异步任务返回未知状态: ${result.status}`);
+}
+
+export function isFailedJobStatus(status) {
+  return FAILED.has(String(status || "").trim().toLowerCase());
+}
+
 export function retainBilling(result, fallbackBilling) {
   if (!fallbackBilling || !result || typeof result !== "object" || Array.isArray(result)) return result;
   return result._billing ? result : { ...result, _billing: fallbackBilling };
 }
 
+function attachBilling(error, billing) {
+  if (billing && error && typeof error === "object" && !error.billing) error.billing = billing;
+  return error;
+}
+
 export async function pollJob(
   pollUrl,
   { intervalMs = 8000, maxMs = 1200000, onTick, initialBilling } = {}
@@ -139,15 +104,28 @@ export async function pollJob(
   let last = null;
   let lastBilling = initialBilling || null;
   while (Date.now() - start < maxMs) {
-    const r = await apiFetch(pollUrl, { timeoutMs: 30000 });
-    const response = r.json && Object.hasOwn(r.json, "data") ? r.json.data : r.json;
-    last = response;
-    if (response?._billing) lastBilling = response._billing;
-    const s = response?.status;
-    if (onTick) onTick(response);
-    if (!r.ok || !s || !ACTIVE.has(String(s).toLowerCase())) {
-      return retainBilling(response, lastBilling); // 终态(或报错/未知 shape)→ 返回
+    let r;
+    try {
+      r = await apiFetch(pollUrl, { timeoutMs: 30000 });
+    } catch (error) {
+      throw attachBilling(error, lastBilling);
+    }
+    if (!r.ok) {
+      throw attachBilling(
+        new Error(`异步任务状态查询失败（HTTP ${r.status}）`),
+        lastBilling
+      );
+    }
+    last = r.json;
+    if (r.json?._billing) lastBilling = r.json._billing;
+    let state;
+    try {
+      state = classifyJobResponse(r.json);
+    } catch (error) {
+      throw attachBilling(error, lastBilling);
     }
+    if (onTick) onTick(r.json);
+    if (state.terminal) return retainBilling(r.json, lastBilling);
     await new Promise((res) => setTimeout(res, intervalMs));
   }
   return retainBilling(

package/lib/config.js

@@ -11,33 +11,15 @@ import {
 // Local config lives at ~/.manturhub/config.json (chmod 600). Env vars win over it.
 const DIR = join(homedir(), ".manturhub");
 const FILE = join(DIR, "config.json");
-const DEVELOPMENT_HTTP_ORIGIN = "http://gateway-dev.guiyi.cn";
-const PRODUCTION_ORIGIN = "https://hub.mantur.ai";
-const PACKAGE_VERSION = JSON.parse(
-  readFileSync(new URL("../package.json", import.meta.url), "utf8")
-).version;
-
-export function defaultBaseForVersion(version) {
-  return /-dev(?:\.|$)/.test(String(version)) ? DEVELOPMENT_HTTP_ORIGIN : PRODUCTION_ORIGIN;
-}
-
-// dev 预发布包默认连接开发网关，稳定包默认连接生产网关。MANTURHUB_BASE
-// 仍可显式覆盖；历史配置中保存过的官方默认地址不应覆盖当前发布通道。
-const DEFAULT_BASE = defaultBaseForVersion(PACKAGE_VERSION);
-const KNOWN_DEFAULT_BASES = new Set([
-  DEVELOPMENT_HTTP_ORIGIN,
-  PRODUCTION_ORIGIN,
+// Published CLI defaults to production; test/private deployments override with
+// MANTURHUB_BASE or config.json. All generated links must go through getBaseUrl().
+const DEFAULT_BASE = "https://hub.mantur.ai";
+const LEGACY_DEFAULT_BASES = new Set([
   "https://hub.mantur.cn",
   "https://manturhub.leisurecat.cloud",
   "https://api.ophub.com",
 ]);
 
-export function isAllowedHttpUrl(url) {
-  const loopback =
-    url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-  return url.protocol === "http:" && (loopback || url.origin === DEVELOPMENT_HTTP_ORIGIN);
-}
-
 export function loadConfig() {
   try {
     return JSON.parse(readFileSync(FILE, "utf8"));
@@ -67,10 +49,9 @@ function validateBaseUrl(value) {
   } catch {
     throw new Error(`ManturHub 网关地址不合法: ${value}`);
   }
-  if (url.protocol !== "https:" && !isAllowedHttpUrl(url)) {
-    throw new Error(
-      "MANTURHUB_BASE 必须使用 HTTPS（仅本机地址和 http://gateway-dev.guiyi.cn 可使用 HTTP）"
-    );
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new Error("MANTURHUB_BASE 必须使用 HTTPS（仅 localhost/127.0.0.1/::1 可使用 HTTP）");
   }
   if (url.username || url.password) throw new Error("MANTURHUB_BASE 不得包含用户名或密码");
   return url.href.replace(/\/$/, "");
@@ -79,6 +60,6 @@ function validateBaseUrl(value) {
 export function getBaseUrl() {
   if (process.env.MANTURHUB_BASE) return validateBaseUrl(process.env.MANTURHUB_BASE);
   const storedBase = loadConfig().baseUrl?.replace(/\/$/, "");
-  if (storedBase && !KNOWN_DEFAULT_BASES.has(storedBase)) return validateBaseUrl(storedBase);
+  if (storedBase && !LEGACY_DEFAULT_BASES.has(storedBase)) return validateBaseUrl(storedBase);
   return DEFAULT_BASE;
 }

package/lib/download.js

@@ -1,7 +1,6 @@
 import { createWriteStream, rmSync } from "node:fs";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { isAllowedHttpUrl } from "./config.js";
 
 export const MAX_PACKAGE_BYTES = 100 * 1024 * 1024;
 
@@ -12,7 +11,8 @@ export function assertSecureDownloadUrl(value) {
   } catch {
     throw new Error("下载重定向地址不合法");
   }
-  if (url.protocol !== "https:" && !isAllowedHttpUrl(url)) {
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
     throw new Error("安装包下载地址必须使用 HTTPS");
   }
   return url.href;

package/lib/login-link.js

@@ -3,7 +3,7 @@
 // key 只经后端 poll(device_code)下发,绝不进浏览器 URL。
 import { spawn } from "node:child_process";
 import { getBaseUrl, loadConfig, saveConfig } from "./config.js";
-import { apiFetch, BALANCE_PATH, parseBalanceResponse } from "./api.js";
+import { apiFetch } from "./api.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -91,31 +91,22 @@ export async function loginViaBrowser() {
       process.exit(1);
     }
     if (poll.status === "ready" && poll.key) {
-      const verification = await apiFetch(BALANCE_PATH, { key: poll.key });
-      let verifiedBalance;
-      let verificationError;
-      if (verification.ok) {
-        try {
-          verifiedBalance = parseBalanceResponse(verification.json);
-        } catch (error) {
-          verificationError = error.message;
-        }
-      }
-      if (verification.ok && verifiedBalance) {
-        const cfg = loadConfig();
-        cfg.key = poll.key;
-        saveConfig(cfg);
-        const usd = `$${(verifiedBalance.totalBalance * 0.01).toFixed(2)} USD`;
+      const cfg = loadConfig();
+      cfg.key = poll.key;
+      saveConfig(cfg);
+      const me = await apiFetch("/api/v1/me", { key: poll.key });
+      if (me.ok) {
+        const balance = Number(me.json.balance);
+        const usd = Number.isFinite(balance) ? `$${(balance * 0.01).toFixed(2)} USD` : "-";
         console.log(
-          `\n  ✓ 授权成功,Key 已验证并导入 ~/.manturhub/config.json。` +
-          `余额: ${usd}（${verifiedBalance.totalBalance} 馒头）\n`
+          `\n  ✓ 授权成功,Key 已导入 ~/.manturhub/config.json。账号: ${
+            me.json.email || "-"
+          }   余额: ${usd}（${me.json.balance ?? "-"} 馒头）\n`
         );
       } else {
-        const reason = verification.ok ? verificationError : `HTTP ${verification.status}`;
-        console.error(
-          `\n  Key 余额验证失败（${reason}），未修改本地配置。请重新运行 manturhub login。\n`
+        console.log(
+          `\n  ✓ Key 已导入,但验证返回 HTTP ${me.status}(稍后可用 manturhub balance 再确认)。\n`
         );
-        process.exit(1);
       }
       return;
     }

package/lib/skill-install.js

@@ -10,14 +10,9 @@ import {
   renameSync,
   rmSync,
 } from "node:fs";
-import { getBaseUrl } from "./config.js";
+import { getKey, getBaseUrl } from "./config.js";
 import { extractZipSafely, validateSlug } from "./archive.js";
-import {
-  apiFetch,
-  fetchPublicCatalog,
-  PUBLIC_SKILLS_PATH,
-  unwrapGatewayData,
-} from "./api.js";
+import { apiFetch } from "./api.js";
 import { assertSecureDownloadUrl, downloadResponseToFile } from "./download.js";
 import { displayClient, resolveSkillClient } from "./agent-target.js";
 import {
@@ -32,31 +27,36 @@ import {
   skillDestination,
 } from "./skill-state.js";
 
+const CLI_SKILL_HEADERS = { "X-ManturHub-Client": "cli" };
+
 function fail(message) {
   console.error(message);
   process.exit(1);
 }
 
 async function fetchOnlineSkills() {
-  const records = await fetchPublicCatalog(PUBLIC_SKILLS_PATH);
-  return records
-    .filter((item) => item.kind !== "suite")
-    .map((item) => ({ ...item, slug: item.code }));
+  const response = await apiFetch("/api/v1/skills", {
+    auth: "optional",
+    headers: CLI_SKILL_HEADERS,
+  });
+  if (!response.ok) throw new Error(`Skill 列表获取失败（HTTP ${response.status}）`);
+  return (response.json.skills || response.json || []).filter((item) => item.kind !== "suite");
 }
 
 async function fetchSkillDetail(slug) {
-  const response = await apiFetch(`${PUBLIC_SKILLS_PATH}/${encodeURIComponent(slug)}`, {
+  const response = await apiFetch(`/api/v1/skills/${encodeURIComponent(slug)}`, {
     auth: "optional",
+    headers: CLI_SKILL_HEADERS,
   });
   if (response.status === 404) {
     throw new Error(`Skill 不存在: ${slug}（用 \`manturhub skill ls\` 看可用列表）`);
   }
   if (!response.ok) throw new Error(`Skill 信息获取失败（HTTP ${response.status}）`);
-  const detail = unwrapGatewayData(response.json) || {};
+  const detail = response.json.skill || response.json;
   if (!detail?.version) {
     throw new Error(`线上 Skill「${slug}」缺少 version，平台需先修正后才能安装`);
   }
-  return { ...detail, slug: detail.code };
+  return detail;
 }
 
 function detectExistingClient(slug) {
@@ -103,13 +103,13 @@ function assertSafeToReplace(destinations, slug, state, baseUrl, force) {
 }
 
 async function downloadSkillBundle(slug, target) {
-  const base = new URL(getBaseUrl());
-  const bundlePath = `${PUBLIC_SKILLS_PATH}/${encodeURIComponent(slug)}/bundle`;
-  const url = new URL(bundlePath, base.href.endsWith("/") ? base.href : `${base.href}/`);
-  if (url.origin !== base.origin) {
-    throw new Error(`Skill「${slug}」的下载地址指向非 ManturHub 地址`);
+  const key = getKey();
+  if (!key) {
+    throw new Error("下载 Skill 需 API Key。运行 `manturhub login`，或设置环境变量 MANTURHUB_KEY。");
   }
+  const url = `${getBaseUrl()}/api/v1/skills/${encodeURIComponent(slug)}/download`;
   const response = await fetch(url, {
+    headers: { "x-api-key": key, ...CLI_SKILL_HEADERS },
     redirect: "manual",
     signal: AbortSignal.timeout(30000),
   });

package/lib/skill-update-fetch.js

@@ -2,7 +2,6 @@ import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { getBaseUrl } from "./config.js";
-import { PUBLIC_SKILLS_PATH, unwrapGatewayData } from "./api.js";
 
 const DIR = join(homedir(), ".manturhub");
 const CACHE = join(DIR, "skill-update-check.json");
@@ -17,23 +16,22 @@ function readPrevious() {
 
 const baseUrl = getBaseUrl();
 try {
-  const url = new URL(
-    `${PUBLIC_SKILLS_PATH}?pageNum=1&pageSize=100`,
-    `${baseUrl}/`
-  );
+  const url = new URL("/api/v1/skills", `${baseUrl}/`);
   const response = await fetch(url, {
     signal: AbortSignal.timeout(8000),
-    headers: { Accept: "application/json" },
+    headers: {
+      Accept: "application/json",
+      "X-ManturHub-Client": "cli",
+    },
   });
   mkdirSync(DIR, { recursive: true });
   if (response.ok) {
     const json = await response.json();
-    const page = unwrapGatewayData(json) || {};
-    const skills = (page.records || [])
-      .filter((item) => item?.kind !== "suite" && item?.code && item?.version)
+    const skills = (json.skills || json || [])
+      .filter((item) => item?.kind !== "suite" && item?.slug && item?.version)
       .map((item) => ({
-        slug: item.code,
-        name: item.name || item.code,
+        slug: item.slug,
+        name: item.name || item.slug,
         version: item.version,
         kind: item.kind || "skill",
       }));

package/lib/suite-install.js

@@ -1,12 +1,14 @@
 import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtempSync, rmSync } from "node:fs";
-import { getBaseUrl } from "./config.js";
+import { getKey, getBaseUrl } from "./config.js";
 import { extractZipSafely, validateSlug } from "./archive.js";
-import { fetchPublicCatalog, PUBLIC_SKILLS_PATH } from "./api.js";
+import { apiFetch } from "./api.js";
 import { assertSecureDownloadUrl, downloadResponseToFile } from "./download.js";
 
-// #456 Agent 套件（团队版 Skill）：与 skill 共用公共 Skill 广场列表和固定 bundle 下载接口，
+const CLI_SKILL_HEADERS = { "X-ManturHub-Client": "cli" };
+
+// #456 Agent 套件（团队版 Skill）：与 skill 共用 /api/v1/skills 元数据与下载端点，
 // 区别在安装形态——解压为当前目录下的工作目录（非用户级 skills）。API Key 继续由
 // CLI 从 ~/.manturhub/config.json 读取，绝不复制进可能被提交的项目目录。
 
@@ -14,14 +16,20 @@ import { assertSecureDownloadUrl, downloadResponseToFile } from "./download.js";
 export async function suiteLs({ json = false } = {}) {
   let res;
   try {
-    res = await fetchPublicCatalog(PUBLIC_SKILLS_PATH);
+    res = await apiFetch("/api/v1/skills", {
+      auth: "optional",
+      headers: CLI_SKILL_HEADERS,
+    });
   } catch (e) {
     console.error(`套件列表获取失败: ${e.message}`);
     process.exit(1);
   }
-  const suites = res
-    .filter((item) => item.kind === "suite")
-    .map((item) => ({ ...item, slug: item.code }));
+  if (!res.ok) {
+    console.error(`套件列表获取失败（HTTP ${res.status}）`);
+    process.exit(1);
+  }
+  const data = res.json;
+  const suites = (data.skills || []).filter((s) => s.kind === "suite");
   if (json) {
     console.log(JSON.stringify({ suites }, null, 2));
     return;
@@ -52,20 +60,18 @@ export async function suiteInstall(slug, dirArg) {
     console.error(error.message);
     process.exit(1);
   }
-  const base = new URL(getBaseUrl());
-  const bundlePath = `${PUBLIC_SKILLS_PATH}/${encodeURIComponent(slug)}/bundle`;
-  const url = new URL(
-    bundlePath,
-    base.href.endsWith("/") ? base.href : `${base.href}/`
-  );
-  if (url.origin !== base.origin) {
-    console.error(`套件「${slug}」的下载地址指向非 ManturHub 地址`);
+  const key = getKey();
+  if (!key) {
+    console.error("下载套件需 API Key。运行 `manturhub login`，或设置环境变量 MANTURHUB_KEY。");
     process.exit(1);
   }
+
+  const url = `${getBaseUrl()}/api/v1/skills/${encodeURIComponent(slug)}/download`;
   // 手动处理 302：跟随预签名地址时不把 API Key 带去对象存储（同 skill add）。
   let res;
   try {
     res = await fetch(url, {
+      headers: { "x-api-key": key, ...CLI_SKILL_HEADERS },
       redirect: "manual",
       signal: AbortSignal.timeout(30000),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manturhub/cli",
-  "version": "0.9.10-dev.20260810.6",
+  "version": "0.9.11",
   "description": "ManturHub 算子广场 CLI：通过 REST 发现和调用 AI 算子、浏览配方，并安装 Skill 与 Agent 套件",
   "type": "module",
   "bin": {
@@ -14,9 +14,7 @@
   },
   "scripts": {
     "test": "node --test",
-    "prepack": "npm test",
-    "release:dev": "npm version prerelease --preid=dev --no-git-tag-version && npm publish --access public --tag dev",
-    "release:prod": "npm version patch --no-git-tag-version && npm publish --access public --tag latest"
+    "prepack": "npm test"
   },
   "files": [
     "bin",