@manturhub/cli 0.9.8 → 0.9.10-dev.20260810.5

package/README.md

@@ -15,14 +15,25 @@ manturhub login
 printf '%s' "$YOUR_MANTURHUB_KEY" | manturhub login --key-stdin
 ```
 
-CLI 默认连接生产站 `https://hub.mantur.ai`，Key 也必须在该生产站创建。`hub.mantur.cn` 是独立测试环境，其 Key 不能用于生产站。
+CLI 默认连接生产站 `https://hub.mantur.ai`，Key 也必须在该生产站创建。
+
+开发和测试环境使用开发网关：
+
+```bash
+MANTURHUB_BASE=http://gateway-dev.guiyi.cn manturhub login
+MANTURHUB_BASE=http://gateway-dev.guiyi.cn manturhub ls
+```
+
+开发网关是唯一允许使用远程 HTTP 的例外；生产站和其他远程部署必须使用 HTTPS。开发网关与生产站的 API Key 不通用。
+算子列表和详情通过 `/api/openapi/v1/operators` 获取，只返回当前 Key 已授权的算子。
+文件先通过 `POST /api/openapi/v1/files/upload` 提交 `files: [{ fileName, contentType, size }]`，从 `data.files[0]` 获取 `uploadUrl` 和 `downloadUrl`，再以 PUT 将文件流式上传到 `uploadUrl`；上传成功后命令输出 `downloadUrl`。API Key 只发送给 ManturHub 网关，不会发送给对象存储。
 
 需要 Node.js ≥ 18。也可免安装运行：`npx -y @manturhub/cli <命令>`。
 
 ## 快速开始
 
 ```bash
-# 发现与查看算子无需登录
+# 发现与查看当前 Key 已授权的算子
 manturhub ls --cat text
 manturhub describe 电商文案生成
 
@@ -35,7 +46,7 @@ CLI 会在付费调用前按算子实时 schema 校验未知字段、必填项
 
 面向用户的列表、详情、报价、确认和结算统一显示中文算子名，也可直接用中文名调用。英文算子 ID 仅保留在 `--json` 机器输出和内部 API 请求中，供 Agent 与脚本稳定使用。
 
-在 Agent 或脚本等非交互环境中，第一次运行只返回报价和 `quote_id`，不会调用或扣费；Agent 向用户确认后，使用提示中的 `--confirm <quote_id>` 执行。报价 5 分钟内有效且只能使用一次。
+在 Agent 或脚本等非交互环境中，第一次运行只返回报价和 `confirmation_token`，不会调用或扣费；Agent 向用户确认后，使用提示中的 `--confirm <confirmation_token>` 执行。确认标识绑定算子、入参、价格版本和幂等 ID：内容或价格变化时拒绝调用，同一次调用重试时复用幂等 ID，避免重复扣费。
 
 ## 主要命令
 
@@ -44,9 +55,9 @@ CLI 会在付费调用前按算子实时 schema 校验未知字段、必填项
 | `manturhub ls [--cat image\|video\|audio\|text\|data] [--json]` | 实时列出上线算子 |
 | `manturhub describe <中文算子名> [--json]` | 查看精确入参与异步属性 |
 | `manturhub quote <中文算子名> [--json]` | 查询 Java API 返回的实时计费公式 |
-| `manturhub run <中文算子名> --json '{}' [--confirm <quote_id>] [--no-wait]` | 调用算子；非交互确认传报价 ID，异步任务默认轮询到终态 |
+| `manturhub run <中文算子名> --json '{}' [--confirm <confirmation_token>] [--no-wait]` | 调用算子；非交互确认传确认标识，异步任务默认轮询到终态 |
 | `manturhub run <中文算子名> --json-file params.json` | 从文件读取参数，适合长提示词和自动化 |
-| `manturhub upload <本地文件>` | 流式上传图片、音频或视频并输出公网 URL |
+| `manturhub upload <本地文件>` | 通过预签名 PUT 流式上传图片、音频或视频，并输出 `downloadUrl` |
 | `manturhub status <poll_url>` | 查询 `run --no-wait` 返回的异步任务 |
 | `manturhub balance [--json]` | 查询余额及美元等值（1 馒头 = $0.01 USD） |
 | `manturhub skill ls [--json]` / `skill add <slug> [--client codex]` | 浏览并从当前 ManturHub 站点安装业务 Skill |

package/bin/cli.js

@@ -1,6 +1,14 @@
 #!/usr/bin/env node
-import { getBaseUrl, saveConfig, loadConfig } from "../lib/config.js";
-import { apiFetch, pollJob } from "../lib/api.js";
+import { getBaseUrl, isAllowedHttpUrl, saveConfig, loadConfig } from "../lib/config.js";
+import {
+  apiFetch,
+  BALANCE_PATH,
+  fetchPublicCatalog,
+  parseBalanceResponse,
+  pollJob,
+  PUBLIC_RECIPES_PATH,
+  unwrapGatewayData,
+} from "../lib/api.js";
 import { runInit } from "../lib/setup.js";
 import { skillLs, skillAdd, skillOutdated, skillUpdate } from "../lib/skill-install.js";
 import { suiteLs, suiteInstall } from "../lib/suite-install.js";
@@ -8,6 +16,7 @@ import { loginViaBrowser } from "../lib/login-link.js";
 import { maybeNotifyUpdate } from "../lib/update-check.js";
 import { maybeNotifySkillUpdates } from "../lib/skill-update-check.js";
 import { createReadStream, readFileSync, statSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join, basename, extname } from "node:path";
 import { parseDynamicParams, validateParams } from "../lib/params.js";
@@ -26,6 +35,38 @@ function mimeFromFile(f) {
   return MIME_BY_EXT[extname(f).toLowerCase()] || null;
 }
 
+function assertSecureUploadUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("上传接口返回的 uploadUrl 不合法");
+  }
+  if (url.protocol !== "https:" && !isAllowedHttpUrl(url)) {
+    throw new Error("uploadUrl 必须使用 HTTPS");
+  }
+  return url.href;
+}
+
+async function putFileToUploadUrl(file, mime, size, uploadUrl) {
+  const response = await fetch(assertSecureUploadUrl(uploadUrl), {
+    method: "PUT",
+    headers: {
+      "Content-Type": mime,
+      "Content-Length": String(size),
+    },
+    body: createReadStream(file),
+    duplex: "half",
+    redirect: "manual",
+    signal: AbortSignal.timeout(10 * 60 * 1000),
+  });
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new Error(`文件上传失败（HTTP ${response.status}）`);
+  }
+  await response.body?.cancel();
+}
+
 const VERSION = JSON.parse(
   readFileSync(join(dirname(fileURLToPath(import.meta.url)), "../package.json"), "utf8")
 ).version;
@@ -93,29 +134,117 @@ const CAT_LABELS = {
   data: "数据",
 };
 
+const OPERATORS_PATH = "/api/openapi/v1/operators";
+const FILE_UPLOAD_PATH = "/api/openapi/v1/files/upload";
+
 function catLabel(cat) {
   return CAT_LABELS[cat] || cat || "其他";
 }
 
+function operatorId(operator) {
+  return operator?.apiCode || operator?.code || operator?.id;
+}
+
+function operatorCat(operator) {
+  return operator?.category || operator?.cat;
+}
+
+function operatorParamsSchema(operator) {
+  const declared = operator?.params_schema || operator?.meta?.params_schema;
+  if (declared) return declared;
+  const inputSchema = operator?.inputSchema;
+  if (!inputSchema || inputSchema.type !== "object" || !inputSchema.properties) return null;
+  const required = new Set(Array.isArray(inputSchema.required) ? inputSchema.required : []);
+  return {
+    fields: Object.entries(inputSchema.properties).map(([name, field]) => ({
+      name,
+      type: field.type,
+      required: required.has(name),
+      enum: field.enum,
+      minLength: field.minLength,
+      maxLength: field.maxLength,
+      minimum: field.minimum,
+      maximum: field.maximum,
+      desc: field.description,
+    })),
+  };
+}
+
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function confirmationDigest(operator, input) {
+  return createHash("sha256").update(canonicalJson({ operator, input })).digest("base64url");
+}
+
+function encodeConfirmationToken(priceVersionTag, idempotencyKey, operator, input) {
+  const inputDigest = confirmationDigest(operator, input);
+  return Buffer.from(
+    JSON.stringify({ priceVersionTag, idempotencyKey, inputDigest })
+  ).toString("base64url");
+}
+
+function decodeConfirmationToken(value) {
+  try {
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    if (
+      typeof parsed.priceVersionTag !== "string"
+      || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+        .test(parsed.idempotencyKey || "")
+      || !/^[A-Za-z0-9_-]{43}$/.test(parsed.inputDigest || "")
+    ) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+async function listOperators() {
+  const pageSize = 100;
+  const first = await apiFetch(`${OPERATORS_PATH}?pageNum=1&pageSize=${pageSize}`);
+  if (!first.ok) throw new Error(`算子列表获取失败（HTTP ${first.status}）`);
+  const firstPage = unwrapGatewayData(first.json) || {};
+  let records = null;
+  if (Array.isArray(firstPage.records)) records = [...firstPage.records];
+  else if (Array.isArray(firstPage.operators)) records = [...firstPage.operators];
+  else if (Array.isArray(firstPage)) records = [...firstPage];
+  if (!records) throw new Error("算子列表响应缺少 records");
+  const pages = Number(firstPage.pages);
+  if (!Number.isFinite(pages) || pages <= 1) return records;
+
+  for (let pageNum = 2; pageNum <= pages; pageNum++) {
+    const response = await apiFetch(
+      `${OPERATORS_PATH}?pageNum=${pageNum}&pageSize=${pageSize}`
+    );
+    if (!response.ok) throw new Error(`算子列表第 ${pageNum} 页获取失败（HTTP ${response.status}）`);
+    const page = unwrapGatewayData(response.json) || {};
+    if (Array.isArray(page.records)) records.push(...page.records);
+  }
+  return records;
+}
+
+async function fetchOperator(id) {
+  const response = await apiFetch(`${OPERATORS_PATH}/${encodeURIComponent(id)}`);
+  if (!response.ok) throw new Error(`算子信息获取失败（HTTP ${response.status}）`);
+  return unwrapGatewayData(response.json);
+}
+
 // Human commands accept either the stable operator ID or its Chinese display name.
 // Machine-facing --json responses keep IDs unchanged for automation compatibility.
 async function resolveOperator(ref) {
-  if (String(ref).startsWith("op.")) {
-    const direct = await apiFetch(`/api/v1/operators/${encodeURIComponent(ref)}`, { auth: "optional" });
-    if (direct.ok) return direct.json.operator || direct.json;
-    if (direct.status !== 404) throw new Error(`算子信息获取失败（HTTP ${direct.status}）`);
-  }
-
-  const listed = await apiFetch("/api/v1/operators?status=online", { auth: "optional" });
-  if (!listed.ok) throw new Error(`算子列表获取失败（HTTP ${listed.status}）`);
-  const operators = listed.json.operators || listed.json || [];
-  const matches = operators.filter((item) => item?.name === ref || item?.id === ref);
+  const operators = await listOperators();
+  const matches = operators.filter((item) => item?.name === ref || operatorId(item) === ref);
   if (matches.length === 0) throw new Error(`未找到算子“${ref}”`);
   if (matches.length > 1) throw new Error(`算子名称“${ref}”不唯一，请联系平台处理`);
-
-  const detail = await apiFetch(`/api/v1/operators/${encodeURIComponent(matches[0].id)}`, { auth: "optional" });
-  if (!detail.ok) throw new Error(`算子信息获取失败（HTTP ${detail.status}）`);
-  return detail.json.operator || detail.json;
+  return fetchOperator(operatorId(matches[0]));
 }
 
 const HELP = `manturhub — ManturHub 算子广场 CLI  v${VERSION}
@@ -124,12 +253,13 @@ const HELP = `manturhub — ManturHub 算子广场 CLI  v${VERSION}
   manturhub login                     浏览器授权登录（生成链接→登录创建 Key→自动导入，推荐）
   manturhub login --key sk-xxx        手动配置 API Key（存 ~/.manturhub/config.json）
   manturhub login --key-stdin         从 stdin 安全读取 API Key
-  manturhub ls [--cat <分类>] [--json]  列出上线算子（无需登录）
-  manturhub describe <中文算子名> [--json]  查看算子入参字段（无需登录）
+  manturhub ls [--cat <分类>] [--json]  列出当前 Key 已授权的上线算子
+  manturhub describe <中文算子名> [--json]  查看已授权算子的入参字段
   manturhub quote <中文算子名>            查询实时计费公式（不要使用 Skill 内的历史价格）
   manturhub run <中文算子名> --json '{}'  试算并确认费用后调用（异步算子自动轮询到出结果）
   manturhub run <中文算子名> --json-file x.json  从文件读参数（prompt 来自配方/用户时更安全）
-  manturhub run <中文算子名> ... --confirm <quote_id>  使用非交互试算返回的报价确认 ID 调用
+  manturhub run <中文算子名> ... --confirm <confirmation_token>
+                                      使用非交互试算返回的确认标识调用
   manturhub run <中文算子名> ... --no-wait  提交异步任务后立即返回 poll_url，不自动轮询
   manturhub upload <本地文件>         上传图片/音频/视频 → 公网 URL（喂算子前先转换本地文件）
   manturhub status <poll_url>         查异步任务状态（配合 run --no-wait）
@@ -193,21 +323,32 @@ async function main() {
         await loginViaBrowser();
         break;
       }
-      const r = await apiFetch("/api/v1/me", { key });
+      const r = await apiFetch(BALANCE_PATH, { key });
+      let verifiedBalance;
+      let verificationError;
       if (r.ok) {
+        try {
+          verifiedBalance = parseBalanceResponse(r.json);
+        } catch (error) {
+          verificationError = error.message;
+        }
+      }
+      if (r.ok && verifiedBalance) {
         const cfg = loadConfig();
         cfg.key = key;
         saveConfig(cfg);
         console.log(
-          `✓ Key 已验证并保存。账号: ${r.json.email || "-"}   余额: ${usdFor(r.json.balance)}（${r.json.balance ?? "-"} 馒头）`
+          `✓ Key 已验证并保存。余额: ${usdFor(verifiedBalance.totalBalance)}`
+          + `（${verifiedBalance.totalBalance} 馒头）`
         );
       } else {
         const base = getBaseUrl();
         const productionHint = new URL(base).hostname === "hub.mantur.ai"
-          ? " 对外用户请在 https://hub.mantur.ai 创建生产 Key；hub.mantur.cn 的测试 Key 不能用于生产。"
+          ? " 对外用户请在 https://hub.mantur.ai 创建生产 Key；开发测试网关的 Key 不能用于生产。"
           : "";
+        const reason = r.ok ? verificationError : `HTTP ${r.status}`;
         console.error(
-          `Key 验证失败（HTTP ${r.status}），未修改本地配置。当前连接：${base}。` +
+          `Key 验证失败（${reason}），未修改本地配置。当前连接：${base}。` +
           `Key 必须由这个站点创建，请确认 Key 是否正确、是否已激活。${productionHint}`
         );
         process.exit(1);
@@ -239,20 +380,21 @@ async function main() {
         console.error(`未知分类: ${cat}（可选: ${[...cats].join(" | ")}）`);
         process.exit(1);
       }
-      const r = await apiFetch("/api/v1/operators?status=online", { auth: "optional" });
-      if (!r.ok) {
-        console.error(`列表获取失败（HTTP ${r.status}）`);
+      let ops;
+      try {
+        ops = await listOperators();
+      } catch (error) {
+        console.error(error.message);
         process.exit(1);
       }
-      let ops = r.json.operators || r.json || [];
-      if (cat) ops = ops.filter((o) => o.cat === cat);
+      if (cat) ops = ops.filter((o) => operatorCat(o) === cat);
       if (hasFlag("json")) {
         console.log(JSON.stringify({ operators: ops }, null, 2));
         break;
       }
       console.log(`ManturHub 上线算子（${ops.length} 个）:\n`);
       for (const o of ops) {
-        console.log(`  ${o.name}   [${catLabel(o.cat)}]`);
+        console.log(`  ${o.name}   [${catLabel(operatorCat(o))}]`);
       }
       console.log(`\n用 \`manturhub describe <中文算子名>\` 查入参，\`manturhub run <中文算子名> --json '{...}'\` 调用`);
       break;
@@ -282,9 +424,11 @@ async function main() {
         console.log(JSON.stringify(o, null, 2));
         break;
       }
-      console.log(`\n${o.name || "未命名算子"}   [${catLabel(o.cat)}] · ${o.status || "-"}`);
+      console.log(
+        `\n${o.name || "未命名算子"}   [${catLabel(operatorCat(o))}] · ${o.status || "online"}`
+      );
       if (o.description) console.log(o.description);
-      const ps = o.params_schema || (o.meta && o.meta.params_schema);
+      const ps = operatorParamsSchema(o);
       if (ps && Array.isArray(ps.fields) && ps.fields.length) {
         console.log(`\n入参:`);
         for (const f of ps.fields) {
@@ -319,23 +463,32 @@ async function main() {
         console.error(error.message);
         process.exit(1);
       }
-      const r = await apiFetch(`/api/v1/operators/${encodeURIComponent(operator.id)}/quote`, { auth: "optional" });
+      const id = operatorId(operator);
+      const quotePath = operator.quotePath || `${OPERATORS_PATH}/${encodeURIComponent(id)}/quote`;
+      const r = await apiFetch(quotePath);
       if (!r.ok) {
         console.error(`查询价格失败（HTTP ${r.status}）: ${JSON.stringify(r.json)}`);
         process.exit(1);
       }
+      const quoted = unwrapGatewayData(r.json) || {};
       if (args.includes("--json")) {
-        const floor = Number(r.json.floor);
+        const floor = Number(quoted.floor ?? quoted.estimatedPoints);
         console.log(
           JSON.stringify(
-            Number.isFinite(floor) ? { ...r.json, floor_usd: floor * 0.01 } : r.json,
+            Number.isFinite(floor) ? { ...quoted, floor_usd: floor * 0.01 } : quoted,
             null,
             2
           )
         );
       } else {
-        console.log(`${operator.name}: ${r.json.formula || "详见算子页"}`);
-        if (r.json.floor !== undefined) console.log(`最低扣费: ${usdFor(r.json.floor)}（${r.json.floor} 馒头）`);
+        const formulas = Array.isArray(quoted.items)
+          ? quoted.items.map((item) => item.formula).filter(Boolean).join("；")
+          : "";
+        console.log(
+          `${operator.name}: ${quoted.formula || formulas || operator.pricing?.displayText || "详见算子页"}`
+        );
+        const floor = quoted.floor ?? quoted.estimatedPoints;
+        if (floor !== undefined) console.log(`最低扣费: ${usdFor(floor)}（${floor} 馒头）`);
       }
       break;
     }
@@ -394,64 +547,115 @@ async function main() {
         console.error(`${error.message}，已停止调用避免误扣费`);
         process.exit(1);
       }
-      const operatorId = operator.id;
-      const schema = operator.params_schema || operator.meta?.params_schema;
+      const resolvedOperatorId = operatorId(operator);
+      const schema = operatorParamsSchema(operator);
       try {
         body = validateParams(body, schema, { coerceStrings: !jsonArg && !jsonFile });
       } catch (error) {
         console.error(`参数校验失败: ${error.message}`);
         process.exit(1);
       }
-      let quoteId = getFlag("confirm");
-      if (!quoteId) {
-        const quote = await apiFetch(`/api/v1/operators/${encodeURIComponent(operatorId)}/quote`, {
-          method: "POST",
-          body,
-        });
-        if (!quote.ok) {
-          console.error(`本次费用试算失败（HTTP ${quote.status}）: ${JSON.stringify(quote.json)}`);
+      const confirmationToken = getFlag("confirm");
+      const quotePath = operator.quotePath
+        || `${OPERATORS_PATH}/${encodeURIComponent(resolvedOperatorId)}/quote`;
+      const quoteResponse = await apiFetch(quotePath);
+      if (!quoteResponse.ok) {
+        console.error(
+          `本次费用试算失败（HTTP ${quoteResponse.status}）: ${JSON.stringify(quoteResponse.json)}`
+        );
+        process.exit(1);
+      }
+      const quote = unwrapGatewayData(quoteResponse.json) || {};
+      const estimated = Number(quote.estimatedPoints);
+      const priceVersionTag = quote.priceVersionTag;
+      const formula = Array.isArray(quote.items)
+        ? quote.items.map((item) => item.formula).filter(Boolean).join("；")
+        : "";
+      if (quote.billable !== false && !Number.isFinite(estimated)) {
+        console.error("报价响应缺少有效的 estimatedPoints，已停止调用避免误扣费。");
+        process.exit(1);
+      }
+      if (quote.enoughBalance === false) {
+        console.error(`余额不足：当前 ${quote.balance ?? "-"} 馒头，预计需要 ${estimated} 馒头。`);
+        process.exit(1);
+      }
+      let idempotencyKey = randomUUID();
+      if (confirmationToken) {
+        const confirmation = decodeConfirmationToken(confirmationToken);
+        if (
+          !confirmation
+          || confirmation.priceVersionTag !== priceVersionTag
+          || confirmation.inputDigest !== confirmationDigest(resolvedOperatorId, body)
+        ) {
+          console.error("报价已变化或确认标识无效，请重新执行 run 获取最新报价。");
           process.exit(1);
         }
-        const estimated = Number(quote.json?.estimated_dumplings);
-        quoteId = quote.json?.quote_id;
-        if (Number.isFinite(estimated) && estimated > 0) {
-          if (process.stdin.isTTY && process.stderr.isTTY) {
-            if (!(await confirmCharge({ ...quote.json, operator_name: operator.name }))) {
-              console.error("已取消，未调用算子、未扣费。");
-              process.exit(2);
-            }
-          } else {
-            console.error(JSON.stringify({
-              error: "CONFIRMATION_REQUIRED",
-              operator_name: operator.name,
-              message: `本次预计消耗 ${formatMantou(estimated)}，请先取得用户确认`,
-              estimated_dumplings: estimated,
-              balance: quote.json?.balance,
-              formula: quote.json?.formula,
-              quote_id: quoteId,
-              retry_with: `--confirm ${quoteId}`,
-            }, null, 2));
-            process.exit(3);
+        idempotencyKey = confirmation.idempotencyKey;
+      }
+      if (!confirmationToken && Number.isFinite(estimated) && estimated > 0) {
+        if (process.stdin.isTTY && process.stderr.isTTY) {
+          if (!(await confirmCharge({
+            estimated_dumplings: estimated,
+            balance: quote.balance,
+            formula,
+            operator_name: operator.name,
+          }))) {
+            console.error("已取消，未调用算子、未扣费。");
+            process.exit(2);
           }
+        } else {
+          if (!priceVersionTag) {
+            console.error("报价响应缺少 priceVersionTag，无法安全确认付费调用。");
+            process.exit(1);
+          }
+          const encodedConfirmationToken = encodeConfirmationToken(
+            priceVersionTag,
+            idempotencyKey,
+            resolvedOperatorId,
+            body
+          );
+          console.error(JSON.stringify({
+            error: "CONFIRMATION_REQUIRED",
+            operator_name: operator.name,
+            message: `本次预计消耗 ${formatMantou(estimated)}，请先取得用户确认`,
+            estimated_dumplings: estimated,
+            balance: quote.balance,
+            formula,
+            price_version_tag: priceVersionTag,
+            confirmation_token: encodedConfirmationToken,
+            retry_with: `--confirm ${encodedConfirmationToken}`,
+          }, null, 2));
+          process.exit(3);
         }
       }
+      const invokePath = operator.invokePath
+        || `${OPERATORS_PATH}/${encodeURIComponent(resolvedOperatorId)}/invoke`;
       const r = await apiFetch(
-        `/api/v1/operators/${encodeURIComponent(operatorId)}/invoke`,
+        invokePath,
         {
           method: "POST",
-          body,
+          body: { input: body },
           timeoutMs: 120000,
-          headers: quoteId ? { "X-Mantur-Quote-Id": quoteId } : {},
+          headers: { "Idempotency-Key": idempotencyKey },
         }
       );
-      // 异步算子(返回 poll_url)默认自动轮询到出结果;--no-wait 只拿 job_id。
-      const pollUrl = r.ok && r.json && r.json.poll_url;
+      let invoked = r.ok ? unwrapGatewayData(r.json) : r.json;
+      const invokedJobId = invoked?.jobId || invoked?.job_id;
+      if (r.ok && invokedJobId) {
+        // OpenAPI 作业必须通过当前网关查询，不能把 Agent Key 发送到响应中的其他域名。
+        invoked = {
+          ...invoked,
+          pollUrl: `/api/openapi/v1/jobs/${encodeURIComponent(invokedJobId)}`,
+        };
+      }
+      // 异步算子默认自动轮询到出结果；--no-wait 只返回提交结果。
+      const pollUrl = r.ok && (invoked?.pollUrl || invoked?.poll_url);
       if (pollUrl && !args.includes("--no-wait")) {
         process.stderr.write(
-          `⏳ 异步任务 ${r.json.job_id || ""} 已提交，轮询结果中（预计 ${r.json.estimated_seconds || "?"}s；加 --no-wait 可只拿 job_id）…\n`
+          `⏳ 异步任务 ${invokedJobId || ""} 已提交，轮询结果中…\n`
         );
         const final = await pollJob(pollUrl, {
-          initialBilling: r.json._billing,
+          initialBilling: invoked._billing,
           onTick: (j) =>
             process.stderr.write(
               `   ${j.status || "?"}${j.elapsed_ms ? " " + Math.round(j.elapsed_ms / 1000) + "s" : ""}\n`
@@ -459,11 +663,11 @@ async function main() {
         });
         console.log(JSON.stringify(final, null, 2));
         printBillingResult(final, process.stderr, operator.name);
-        const st = final && final.status;
-        if (st === "failed" || st === "error" || (final && final._timeout)) process.exit(1);
+        const st = String(final?.status || "").toLowerCase();
+        if (st === "failed" || st === "error" || final?._timeout) process.exit(1);
       } else {
-        console.log(JSON.stringify(r.json, null, 2));
-        printBillingResult(r.json, process.stderr, operator.name);
+        console.log(JSON.stringify(invoked, null, 2));
+        printBillingResult(invoked, process.stderr, operator.name);
         if (!r.ok) process.exit(1);
       }
       break;
@@ -496,26 +700,35 @@ async function main() {
         console.error(`读不到文件: ${file}（${e.message}）`);
         process.exit(1);
       }
-      const p = await apiFetch("/api/v1/uploads/presign", {
+      const prepared = await apiFetch(FILE_UPLOAD_PATH, {
         method: "POST",
-        body: { filename: basename(file), size: stat.size, mime },
+        body: {
+          files: [
+            {
+              fileName: basename(file),
+              contentType: mime,
+              size: stat.size,
+            },
+          ],
+        },
       });
-      if (!p.ok || !p.json || !p.json.put_url) {
-        console.error(`presign 失败（HTTP ${p.status}）: ${JSON.stringify(p.json)}`);
+      if (!prepared.ok) {
+        console.error(`获取上传地址失败（HTTP ${prepared.status}）: ${JSON.stringify(prepared.json)}`);
         process.exit(1);
       }
-      const put = await fetch(p.json.put_url, {
-        method: "PUT",
-        headers: { "Content-Type": mime, "Content-Length": String(stat.size) },
-        body: createReadStream(file),
-        duplex: "half",
-        signal: AbortSignal.timeout(10 * 60 * 1000),
-      });
-      if (!put.ok) {
-        console.error(`上传到存储失败（HTTP ${put.status}）`);
+      const result = unwrapGatewayData(prepared.json) || {};
+      const upload = Array.isArray(result.files) ? result.files[0] : null;
+      if (!upload?.uploadUrl || !upload?.downloadUrl) {
+        console.error("上传接口响应的 files[0] 缺少 uploadUrl 或 downloadUrl");
         process.exit(1);
       }
-      console.log(p.json.access_url); // 公网 URL，直接喂给算子
+      try {
+        await putFileToUploadUrl(file, mime, stat.size, upload.uploadUrl);
+      } catch (error) {
+        console.error(error.message);
+        process.exit(1);
+      }
+      console.log(upload.downloadUrl); // 上传成功后输出可直接喂给算子的下载地址
       break;
     }
 
@@ -532,8 +745,9 @@ async function main() {
         process.exit(1);
       }
       const r = await apiFetch(pu);
-      console.log(JSON.stringify(r.json, null, 2));
-      printBillingResult(r.json);
+      const status = r.ok ? unwrapGatewayData(r.json) : r.json;
+      console.log(JSON.stringify(status, null, 2));
+      printBillingResult(status);
       if (!r.ok) process.exit(1);
       break;
     }
@@ -545,15 +759,23 @@ async function main() {
         console.error(error.message);
         process.exit(1);
       }
-      const r = await apiFetch("/api/v1/me");
+      const r = await apiFetch(BALANCE_PATH);
       if (!r.ok) {
         console.error(`查询失败（HTTP ${r.status}）`);
         process.exit(1);
       }
+      let parsedBalance;
+      try {
+        parsedBalance = parseBalanceResponse(r.json);
+      } catch (error) {
+        console.error(error.message);
+        process.exit(1);
+      }
+      const { balance, totalBalance: balancePoints } = parsedBalance;
       console.log(
         hasFlag("json")
-          ? JSON.stringify({ ...r.json, balance_usd: Number(r.json.balance) * 0.01 }, null, 2)
-          : `余额: ${usdFor(r.json.balance)}（${r.json.balance ?? "-"} 馒头）   账号: ${r.json.email || "-"}`
+          ? JSON.stringify({ ...balance, balance_usd: balancePoints * 0.01 }, null, 2)
+          : `余额: ${usdFor(balancePoints)}（${balancePoints} 馒头）`
       );
       break;
     }
@@ -644,30 +866,41 @@ async function main() {
           console.error(error.message);
           process.exit(1);
         }
-        const r = await apiFetch(`/api/v1/recipes/${encodeURIComponent(slug)}`, { auth: "optional" });
+        const r = await apiFetch(
+          `${PUBLIC_RECIPES_PATH}/${encodeURIComponent(slug)}`,
+          { auth: "optional" }
+        );
         if (!r.ok) {
           console.error(`获取失败（HTTP ${r.status}）: ${slug}`);
           process.exit(1);
         }
-        const d = r.json;
+        let d;
+        try {
+          d = unwrapGatewayData(r.json) || {};
+        } catch (error) {
+          console.error(`获取失败: ${error.message}`);
+          process.exit(1);
+        }
         if (args.includes("--json")) {
           console.log(JSON.stringify(d, null, 2));
           break;
         }
-        console.log(`\n${d.title}  [${d.cat}] · 复刻 ${d.cost_estimate}`);
-        console.log(`${d.summary}\n`);
-        if (d.sample_url) {
-          const su = d.sample_url.startsWith("http")
-            ? d.sample_url
-            : `${getBaseUrl()}${d.sample_url}`;
-          console.log(`效果样片: ${su}`);
+        const recipeCode = d.code || slug;
+        console.log(`\n${d.name || recipeCode}  [${d.category || "其他"}]${d.version ? ` · ${d.version}` : ""}`);
+        if (d.description) console.log(`${d.description}\n`);
+        if (d.sampleUrl) {
+          console.log(`效果样片: ${d.sampleUrl}`);
+        }
+        console.log(`配方页:   ${getBaseUrl()}/recipes/${recipeCode}\n`);
+        if (d.usage) console.log(`执行说明:\n${d.usage}\n`);
+        if (d.inputSchema) {
+          console.log("输入结构:");
+          console.log(JSON.stringify(d.inputSchema, null, 2));
+        }
+        if (Array.isArray(d.steps) && d.steps.length) {
+          console.log("\n执行步骤:");
+          console.log(JSON.stringify(d.steps, null, 2));
         }
-        console.log(`配方页:   ${getBaseUrl()}/recipes/${d.slug}\n`);
-        if (d.prompt_template) console.log(`提示词模板:\n${d.prompt_template}\n`);
-        console.log("结构化参数（把 {占位符} 换成用户内容）:");
-        console.log(JSON.stringify(d.params_json || {}, null, 2));
-        console.log("\n安全执行：将每步 params 写入 JSON 文件，再运行 `manturhub run <算子ID> --json-file <文件>`。");
-        if (d.sample_text) console.log(`\n效果节选:\n${d.sample_text}`);
         break;
       }
       // manturhub recipe [ls|search] [关键词] [--cat video|image|script]
@@ -685,16 +918,20 @@ async function main() {
         console.error(`未知配方分类: ${cat}（可选: video | image | script）`);
         process.exit(1);
       }
-      const r = await apiFetch(`/api/v1/recipes${cat ? `?cat=${encodeURIComponent(cat)}` : ""}`, { auth: "optional" });
-      if (!r.ok) {
-        console.error(`配方列表获取失败（HTTP ${r.status}）`);
+      let list;
+      try {
+        list = await fetchPublicCatalog(PUBLIC_RECIPES_PATH);
+      } catch (error) {
+        console.error(`配方列表获取失败（${error.message}）`);
         process.exit(1);
       }
-      let list = r.json.recipes || [];
+      if (cat) list = list.filter((item) => item.category === cat);
       if (kwArg) {
         const k = kwArg.toLowerCase();
         list = list.filter((x) =>
-          `${x.title}${x.summary}${(x.tags || []).join(",")}`.toLowerCase().includes(k)
+          `${x.name || ""}${x.summary || ""}${(x.tags || []).join(",")}`
+            .toLowerCase()
+            .includes(k)
         );
       }
       if (hasFlag("json")) {
@@ -703,7 +940,9 @@ async function main() {
       }
       console.log(`ManturHub 配方（${list.length} 个）:\n`);
       for (const x of list) {
-        console.log(`  ${x.slug.padEnd(32)} [${x.cat}] ${x.title} · 复刻 ${x.cost_estimate}`);
+        console.log(
+          `  ${String(x.code || "").padEnd(32)} [${x.category || "其他"}] ${x.name || ""}`
+        );
       }
       console.log(
         `\n用 \`manturhub recipe get <配方ID>\` 看提示词模板与调用参数；挑选体验更好的网页版: ${getBaseUrl()}/recipes`

package/lib/api.js

@@ -1,10 +1,70 @@
 import { getKey, getBaseUrl } from "./config.js";
 
+export const BALANCE_PATH = "/api/openapi/v1/credits/balance";
+export const PUBLIC_RECIPES_PATH = "/api/public/agent/v1/recipes";
+export const PUBLIC_SKILLS_PATH = "/api/public/agent/v1/skills";
+
+export function unwrapGatewayData(json) {
+  if (json?.success === false || (typeof json?.code === "number" && json.code !== 0)) {
+    throw new Error(json?.message || "ManturHub Gateway 请求失败");
+  }
+  return json && Object.hasOwn(json, "data") ? json.data : json;
+}
+
+export function parseBalanceResponse(json) {
+  const balance = unwrapGatewayData(json);
+  const totalBalance = Number(balance?.totalBalance);
+  if (!Number.isFinite(totalBalance)) {
+    throw new Error("余额接口响应缺少有效的 totalBalance");
+  }
+  return { balance, totalBalance };
+}
+
+export async function fetchPublicCatalog(path, { pageSize = 100 } = {}) {
+  const fetchPage = async (pageNum) => {
+    const response = await apiFetch(
+      `${path}?pageNum=${pageNum}&pageSize=${pageSize}`,
+      { auth: "optional" }
+    );
+    if (!response.ok) {
+      const error = new Error(`HTTP ${response.status}`);
+      error.status = response.status;
+      throw error;
+    }
+    const page = unwrapGatewayData(response.json) || {};
+    if (!Array.isArray(page.records)) {
+      throw new Error("公共广场响应缺少 records");
+    }
+    return page;
+  };
+
+  const first = await fetchPage(1);
+  const records = [...first.records];
+  const pages = Number(first.pages);
+  if (!Number.isFinite(pages) || pages <= 1) return records;
+  for (let pageNum = 2; pageNum <= pages; pageNum++) {
+    const page = await fetchPage(pageNum);
+    records.push(...page.records);
+  }
+  return records;
+}
+
 // Thin REST client against the ManturHub gateway. Public discovery calls may omit auth.
 export async function apiFetch(
   path,
-  { method = "GET", body, key, auth = "required", timeoutMs = 30000, headers = {} } = {}
+  {
+    method = "GET",
+    body,
+    rawBody,
+    key,
+    auth = "required",
+    timeoutMs = 30000,
+    headers = {},
+  } = {}
 ) {
+  if (body !== undefined && rawBody !== undefined) {
+    throw new Error("body 和 rawBody 不能同时使用");
+  }
   const apiKey = key === undefined ? getKey() : key;
   if (auth === "required" && !apiKey) {
     throw new Error(
@@ -21,10 +81,11 @@ export async function apiFetch(
       method,
       headers: {
         ...(includeKey && apiKey ? { "x-api-key": apiKey } : {}),
-        ...(body ? { "Content-Type": "application/json" } : {}),
+        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
         ...headers,
       },
-      body: body ? JSON.stringify(body) : undefined,
+      body: rawBody ?? (body !== undefined ? JSON.stringify(body) : undefined),
+      ...(rawBody !== undefined ? { duplex: "half" } : {}),
       signal: AbortSignal.timeout(timeoutMs),
     });
   const requestWithRetry = async (includeKey) => {
@@ -64,7 +125,7 @@ export async function apiFetch(
 
 // 异步算子:轮询 invoke 返回的 poll_url 直到任务出终态(succeeded/failed/…),返回最终 json。
 // 未知 shape(无 status 字段)按终态处理,直接返回让上层打印。
-const ACTIVE = new Set(["queued", "running", "pending", "processing", "in_progress"]);
+const ACTIVE = new Set(["created", "queued", "running", "pending", "processing", "in_progress"]);
 export function retainBilling(result, fallbackBilling) {
   if (!fallbackBilling || !result || typeof result !== "object" || Array.isArray(result)) return result;
   return result._billing ? result : { ...result, _billing: fallbackBilling };
@@ -79,12 +140,13 @@ export async function pollJob(
   let lastBilling = initialBilling || null;
   while (Date.now() - start < maxMs) {
     const r = await apiFetch(pollUrl, { timeoutMs: 30000 });
-    last = r.json;
-    if (r.json?._billing) lastBilling = r.json._billing;
-    const s = r.json && r.json.status;
-    if (onTick) onTick(r.json);
-    if (!r.ok || !s || !ACTIVE.has(s)) {
-      return retainBilling(r.json, lastBilling); // 终态(或报错/未知 shape)→ 返回
+    const response = r.json && Object.hasOwn(r.json, "data") ? r.json.data : r.json;
+    last = response;
+    if (response?._billing) lastBilling = response._billing;
+    const s = response?.status;
+    if (onTick) onTick(response);
+    if (!r.ok || !s || !ACTIVE.has(String(s).toLowerCase())) {
+      return retainBilling(response, lastBilling); // 终态(或报错/未知 shape)→ 返回
     }
     await new Promise((res) => setTimeout(res, intervalMs));
   }

package/lib/config.js

@@ -14,12 +14,19 @@ const FILE = join(DIR, "config.json");
 // Published CLI defaults to production; test/private deployments override with
 // MANTURHUB_BASE or config.json. All generated links must go through getBaseUrl().
 const DEFAULT_BASE = "https://hub.mantur.ai";
+const DEVELOPMENT_HTTP_ORIGIN = "http://gateway-dev.guiyi.cn";
 const LEGACY_DEFAULT_BASES = new Set([
   "https://hub.mantur.cn",
   "https://manturhub.leisurecat.cloud",
   "https://api.ophub.com",
 ]);
 
+export function isAllowedHttpUrl(url) {
+  const loopback =
+    url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  return url.protocol === "http:" && (loopback || url.origin === DEVELOPMENT_HTTP_ORIGIN);
+}
+
 export function loadConfig() {
   try {
     return JSON.parse(readFileSync(FILE, "utf8"));
@@ -49,9 +56,10 @@ function validateBaseUrl(value) {
   } catch {
     throw new Error(`ManturHub 网关地址不合法: ${value}`);
   }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
-    throw new Error("MANTURHUB_BASE 必须使用 HTTPS（仅 localhost/127.0.0.1/::1 可使用 HTTP）");
+  if (url.protocol !== "https:" && !isAllowedHttpUrl(url)) {
+    throw new Error(
+      "MANTURHUB_BASE 必须使用 HTTPS（仅本机地址和 http://gateway-dev.guiyi.cn 可使用 HTTP）"
+    );
   }
   if (url.username || url.password) throw new Error("MANTURHUB_BASE 不得包含用户名或密码");
   return url.href.replace(/\/$/, "");

package/lib/download.js

@@ -1,6 +1,7 @@
 import { createWriteStream, rmSync } from "node:fs";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { isAllowedHttpUrl } from "./config.js";
 
 export const MAX_PACKAGE_BYTES = 100 * 1024 * 1024;
 
@@ -11,8 +12,7 @@ export function assertSecureDownloadUrl(value) {
   } catch {
     throw new Error("下载重定向地址不合法");
   }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+  if (url.protocol !== "https:" && !isAllowedHttpUrl(url)) {
     throw new Error("安装包下载地址必须使用 HTTPS");
   }
   return url.href;

package/lib/login-link.js

@@ -3,7 +3,7 @@
 // key 只经后端 poll(device_code)下发,绝不进浏览器 URL。
 import { spawn } from "node:child_process";
 import { getBaseUrl, loadConfig, saveConfig } from "./config.js";
-import { apiFetch } from "./api.js";
+import { apiFetch, BALANCE_PATH, parseBalanceResponse } from "./api.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -91,22 +91,31 @@ export async function loginViaBrowser() {
       process.exit(1);
     }
     if (poll.status === "ready" && poll.key) {
-      const cfg = loadConfig();
-      cfg.key = poll.key;
-      saveConfig(cfg);
-      const me = await apiFetch("/api/v1/me", { key: poll.key });
-      if (me.ok) {
-        const balance = Number(me.json.balance);
-        const usd = Number.isFinite(balance) ? `$${(balance * 0.01).toFixed(2)} USD` : "-";
+      const verification = await apiFetch(BALANCE_PATH, { key: poll.key });
+      let verifiedBalance;
+      let verificationError;
+      if (verification.ok) {
+        try {
+          verifiedBalance = parseBalanceResponse(verification.json);
+        } catch (error) {
+          verificationError = error.message;
+        }
+      }
+      if (verification.ok && verifiedBalance) {
+        const cfg = loadConfig();
+        cfg.key = poll.key;
+        saveConfig(cfg);
+        const usd = `$${(verifiedBalance.totalBalance * 0.01).toFixed(2)} USD`;
         console.log(
-          `\n  ✓ 授权成功,Key 已导入 ~/.manturhub/config.json。账号: ${
-            me.json.email || "-"
-          }   余额: ${usd}（${me.json.balance ?? "-"} 馒头）\n`
+          `\n  ✓ 授权成功,Key 已验证并导入 ~/.manturhub/config.json。` +
+          `余额: ${usd}（${verifiedBalance.totalBalance} 馒头）\n`
         );
       } else {
-        console.log(
-          `\n  ✓ Key 已导入,但验证返回 HTTP ${me.status}(稍后可用 manturhub balance 再确认)。\n`
+        const reason = verification.ok ? verificationError : `HTTP ${verification.status}`;
+        console.error(
+          `\n  Key 余额验证失败（${reason}），未修改本地配置。请重新运行 manturhub login。\n`
         );
+        process.exit(1);
       }
       return;
     }

package/lib/skill-install.js

@@ -10,9 +10,14 @@ import {
   renameSync,
   rmSync,
 } from "node:fs";
-import { getKey, getBaseUrl } from "./config.js";
+import { getBaseUrl } from "./config.js";
 import { extractZipSafely, validateSlug } from "./archive.js";
-import { apiFetch } from "./api.js";
+import {
+  apiFetch,
+  fetchPublicCatalog,
+  PUBLIC_SKILLS_PATH,
+  unwrapGatewayData,
+} from "./api.js";
 import { assertSecureDownloadUrl, downloadResponseToFile } from "./download.js";
 import { displayClient, resolveSkillClient } from "./agent-target.js";
 import {
@@ -33,24 +38,25 @@ function fail(message) {
 }
 
 async function fetchOnlineSkills() {
-  const response = await apiFetch("/api/v1/skills", { auth: "optional" });
-  if (!response.ok) throw new Error(`Skill 列表获取失败（HTTP ${response.status}）`);
-  return (response.json.skills || response.json || []).filter((item) => item.kind !== "suite");
+  const records = await fetchPublicCatalog(PUBLIC_SKILLS_PATH);
+  return records
+    .filter((item) => item.kind !== "suite")
+    .map((item) => ({ ...item, slug: item.code }));
 }
 
 async function fetchSkillDetail(slug) {
-  const response = await apiFetch(`/api/v1/skills/${encodeURIComponent(slug)}`, {
+  const response = await apiFetch(`${PUBLIC_SKILLS_PATH}/${encodeURIComponent(slug)}`, {
     auth: "optional",
   });
   if (response.status === 404) {
     throw new Error(`Skill 不存在: ${slug}（用 \`manturhub skill ls\` 看可用列表）`);
   }
   if (!response.ok) throw new Error(`Skill 信息获取失败（HTTP ${response.status}）`);
-  const detail = response.json.skill || response.json;
+  const detail = unwrapGatewayData(response.json) || {};
   if (!detail?.version) {
     throw new Error(`线上 Skill「${slug}」缺少 version，平台需先修正后才能安装`);
   }
-  return detail;
+  return { ...detail, slug: detail.code };
 }
 
 function detectExistingClient(slug) {
@@ -97,13 +103,13 @@ function assertSafeToReplace(destinations, slug, state, baseUrl, force) {
 }
 
 async function downloadSkillBundle(slug, target) {
-  const key = getKey();
-  if (!key) {
-    throw new Error("下载 Skill 需 API Key。运行 `manturhub login`，或设置环境变量 MANTURHUB_KEY。");
+  const base = new URL(getBaseUrl());
+  const bundlePath = `${PUBLIC_SKILLS_PATH}/${encodeURIComponent(slug)}/bundle`;
+  const url = new URL(bundlePath, base.href.endsWith("/") ? base.href : `${base.href}/`);
+  if (url.origin !== base.origin) {
+    throw new Error(`Skill「${slug}」的下载地址指向非 ManturHub 地址`);
   }
-  const url = `${getBaseUrl()}/api/v1/skills/${encodeURIComponent(slug)}/download`;
   const response = await fetch(url, {
-    headers: { "x-api-key": key },
     redirect: "manual",
     signal: AbortSignal.timeout(30000),
   });

package/lib/skill-update-fetch.js

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { getBaseUrl } from "./config.js";
+import { PUBLIC_SKILLS_PATH, unwrapGatewayData } from "./api.js";
 
 const DIR = join(homedir(), ".manturhub");
 const CACHE = join(DIR, "skill-update-check.json");
@@ -16,7 +17,10 @@ function readPrevious() {
 
 const baseUrl = getBaseUrl();
 try {
-  const url = new URL("/api/v1/skills", `${baseUrl}/`);
+  const url = new URL(
+    `${PUBLIC_SKILLS_PATH}?pageNum=1&pageSize=100`,
+    `${baseUrl}/`
+  );
   const response = await fetch(url, {
     signal: AbortSignal.timeout(8000),
     headers: { Accept: "application/json" },
@@ -24,11 +28,12 @@ try {
   mkdirSync(DIR, { recursive: true });
   if (response.ok) {
     const json = await response.json();
-    const skills = (json.skills || json || [])
-      .filter((item) => item?.kind !== "suite" && item?.slug && item?.version)
+    const page = unwrapGatewayData(json) || {};
+    const skills = (page.records || [])
+      .filter((item) => item?.kind !== "suite" && item?.code && item?.version)
       .map((item) => ({
-        slug: item.slug,
-        name: item.name || item.slug,
+        slug: item.code,
+        name: item.name || item.code,
         version: item.version,
         kind: item.kind || "skill",
       }));

package/lib/suite-install.js

@@ -1,12 +1,12 @@
 import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtempSync, rmSync } from "node:fs";
-import { getKey, getBaseUrl } from "./config.js";
+import { getBaseUrl } from "./config.js";
 import { extractZipSafely, validateSlug } from "./archive.js";
-import { apiFetch } from "./api.js";
+import { fetchPublicCatalog, PUBLIC_SKILLS_PATH } from "./api.js";
 import { assertSecureDownloadUrl, downloadResponseToFile } from "./download.js";
 
-// #456 Agent 套件（团队版 Skill）：与 skill 共用 /api/v1/skills 元数据与下载端点，
+// #456 Agent 套件（团队版 Skill）：与 skill 共用公共 Skill 广场列表和固定 bundle 下载接口，
 // 区别在安装形态——解压为当前目录下的工作目录（非用户级 skills）。API Key 继续由
 // CLI 从 ~/.manturhub/config.json 读取，绝不复制进可能被提交的项目目录。
 
@@ -14,17 +14,14 @@ import { assertSecureDownloadUrl, downloadResponseToFile } from "./download.js";
 export async function suiteLs({ json = false } = {}) {
   let res;
   try {
-    res = await apiFetch("/api/v1/skills", { auth: "optional" });
+    res = await fetchPublicCatalog(PUBLIC_SKILLS_PATH);
   } catch (e) {
     console.error(`套件列表获取失败: ${e.message}`);
     process.exit(1);
   }
-  if (!res.ok) {
-    console.error(`套件列表获取失败（HTTP ${res.status}）`);
-    process.exit(1);
-  }
-  const data = res.json;
-  const suites = (data.skills || []).filter((s) => s.kind === "suite");
+  const suites = res
+    .filter((item) => item.kind === "suite")
+    .map((item) => ({ ...item, slug: item.code }));
   if (json) {
     console.log(JSON.stringify({ suites }, null, 2));
     return;
@@ -55,18 +52,20 @@ export async function suiteInstall(slug, dirArg) {
     console.error(error.message);
     process.exit(1);
   }
-  const key = getKey();
-  if (!key) {
-    console.error("下载套件需 API Key。运行 `manturhub login`，或设置环境变量 MANTURHUB_KEY。");
+  const base = new URL(getBaseUrl());
+  const bundlePath = `${PUBLIC_SKILLS_PATH}/${encodeURIComponent(slug)}/bundle`;
+  const url = new URL(
+    bundlePath,
+    base.href.endsWith("/") ? base.href : `${base.href}/`
+  );
+  if (url.origin !== base.origin) {
+    console.error(`套件「${slug}」的下载地址指向非 ManturHub 地址`);
     process.exit(1);
   }
-
-  const url = `${getBaseUrl()}/api/v1/skills/${encodeURIComponent(slug)}/download`;
   // 手动处理 302：跟随预签名地址时不把 API Key 带去对象存储（同 skill add）。
   let res;
   try {
     res = await fetch(url, {
-      headers: { "x-api-key": key },
       redirect: "manual",
       signal: AbortSignal.timeout(30000),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manturhub/cli",
-  "version": "0.9.8",
+  "version": "0.9.10-dev.20260810.5",
   "description": "ManturHub 算子广场 CLI：通过 REST 发现和调用 AI 算子、浏览配方，并安装 Skill 与 Agent 套件",
   "type": "module",
   "bin": {
@@ -14,7 +14,9 @@
   },
   "scripts": {
     "test": "node --test",
-    "prepack": "npm test"
+    "prepack": "npm test",
+    "release:dev": "npm version prerelease --preid=dev --no-git-tag-version && npm publish --access public --tag dev",
+    "release:prod": "npm version patch --no-git-tag-version && npm publish --access public --tag latest"
   },
   "files": [
     "bin",