bfi-cli 0.1.102 → 0.1.103

package/README.md

@@ -101,7 +101,7 @@ Codex 不支持独立旧 SSE、拼接变量或 env_vars 重命名。`cwd` 仅在
 
 `src/lib/installation/contracts.ts` 与 `test-fixtures/installation/collection-v1.json` 固定后续 Java/TypeScript 契约：ID 均为字符串；直接安装根明确列举，嵌套 SKILL.md 只是支持文件；MCP 只允许凭据占位符。当前解析器检查 schema、根重叠、大小写冲突、路径和字面凭据，不下载或执行文件，不开放服务端接口。每文件上限 50 MiB、总计 500 MiB、文件数 20,000，未来服务端必须使用相同限制或更严格限制。
 
-单个技能与技能组合都沿用原有安装路径：`bfi skills add` 安装单个技能，`bfi skills package install` 安装组合内的全部技能；组合关联的 MCP 使用 `bfi mcp install` 单独安装。组合 ZIP 为各技能文件夹加根目录 `mcp.json`（仅当组合关联 MCP 时存在）。其它 Git/本地技能来源仍走既有 skills.sh 路径；独立 MCP 和显式 `--as plugin` 不变。缺 Agent/范围时分别询问，不默认增加 universal Agent。非交互必须显式给出目标、范围和 `-y`；不支持 `--skills-only`，关联 MCP 不可取消。
+单个技能与技能组合都沿用原有安装路径：`bfi skills add` 安装单个技能；`bfi skills package install` 一次下载组合包，批量安装全部技能，并在组合包含 `mcp.json` 时一并安装关联 MCP。安装前会展示技能与 MCP 清单，MCP 需要的变量在交互终端中隐藏输入；用户级配置可直接物化，项目级配置只保存变量引用。组合 ZIP 为各技能文件夹加根目录 `mcp.json`（仅当组合关联 MCP 时存在）。其它 Git/本地技能来源仍走既有 skills.sh 路径；独立 MCP 和显式 `--as plugin` 不变。缺 Agent/范围时分别询问，不默认增加 universal Agent。非交互必须显式给出目标、范围和 `-y`；不支持 `--skills-only`，关联 MCP 不可取消。
 
 ```sh
 bfi skills add @global/bfi-configuring-ui
@@ -134,7 +134,7 @@ MCP 连接结构复用已有标准化校验；已知凭据字段、敏感输入
 
 ### P4 网页安装入口与运行时检查
 
-技能组合的安装卡片直接列出 CLI 命令（登录、安装组合、安装关联 MCP）并提供 ZIP 下载，不解析内容计划；单个技能使用原有的 `bfi skills add` 命令和技能原始 ZIP 下载；插件的安装抽屉先解析固定内容计划，再生成 `--content-plan` 实际命令。目标 Agent 和范围可独立省略，CLI 交互确认。安装、npm 升级与登录命令均可复制。
+技能组合的安装卡片直接列出 CLI 命令（安装 bfi、登录、安装组合、更新）并提供 ZIP 下载，不解析内容计划；组合关联 MCP 由安装命令自动一并安装。单个技能使用原有的 `bfi skills add` 命令和技能原始 ZIP 下载；插件的安装抽屉先解析固定内容计划，再生成 `--content-plan` 实际命令。目标 Agent 和范围可独立省略，CLI 交互确认。安装、npm 升级与登录命令均可复制。
 
 服务端 `INSTALLATION_VERIFIED_CLI_VERSION` 和 `INSTALLATION_VERIFIED_CLI_CAPABILITIES` 默认空，不再作为网页展示命令的前置条件。本机执行 `bfi capabilities --json` 检查实际能力；npm 版尚未发布这些能力时可用当前开发构建验证，不把命令展示等同于已经发布。`COLLECTION_MCP_WRITE_ENABLED` 默认开启，可显式关闭；`COLLECTION_INSTALL_ENABLED=false` 会让含 MCP 的组合失败关闭，保留数据，不退回仅安装技能。旧 v1 组合读取/下载要求声明 `collection-mcp-v1` 才允许处理含 MCP 的组合；能力声明不替代授权。
 

package/dist/_chunks/command.mjs

@@ -3,10 +3,8 @@ import { confirm as confirm$1, multiselect, select } from "./libs/@clack/prompts
 import { inspectPluginArchive } from "./intent.mjs";
 import { loadGlobalConfig, loadProjectConfig, resolveConfig } from "./config.mjs";
 import { agents, detectInstalledAgents, setAgents } from "./agents.mjs";
-import { SkillHubAPI, getAgentBaseDir } from "../cli.mjs";
 import { builtinCommands, normalizeConfig, variables } from "./model.mjs";
-import { planInstall, readDocument, serversIn, targetFor } from "./manager.mjs";
-import { checkPath, readConfig, writeConfig } from "./files.mjs";
+import { SkillHubAPI, checkPath, getAgentBaseDir, planInstall, readConfig, readDocument, serversIn, targetFor, writeConfig } from "../cli.mjs";
 import { canonical, hash, stableManifest, verifyPlan } from "./digest.mjs";
 import { InstallationClient, credentialForRegistry, registryUrl } from "./client.mjs";
 import { resolveAgents } from "./agents2.mjs";

package/dist/_chunks/libs/@clack/core.mjs

@@ -1,5 +1,5 @@
 import { __commonJSMin } from "../../rolldown-runtime.mjs";
-import "node:util";
+import { styleText } from "node:util";
 import { stdin, stdout } from "node:process";
 import l__default, * as l from "node:readline";
 import { ReadStream } from "node:tty";
@@ -734,6 +734,32 @@ var a = class extends y {
 		});
 	}
 };
+let u$1 = class u extends y {
+	_mask = "•";
+	get cursor() {
+		return this._cursor;
+	}
+	get masked() {
+		return this.userInput.replaceAll(/./g, this._mask);
+	}
+	get userInputWithCursor() {
+		if (this.state === "submit" || this.state === "cancel") return this.masked;
+		const t = this.userInput;
+		if (this.cursor >= t.length) return `${this.masked}${styleText(["inverse", "hidden"], "_")}`;
+		const s = this.masked, r = s.slice(0, this.cursor), i = s.slice(this.cursor, this.cursor + 1), o = s.slice(this.cursor + 1);
+		return `${r}${styleText("inverse", i)}${o}`;
+	}
+	clear() {
+		this._clearUserInput();
+	}
+	constructor({ mask: t, ...s }) {
+		super(s), this._mask = t ?? "•", this.on("userInput", (r) => {
+			this._setValue(r);
+		}), this.on("finalize", () => {
+			this.value === void 0 && (this.value = "");
+		});
+	}
+};
 let n$1 = class n extends y {
 	options;
 	cursor = 0;
@@ -760,4 +786,4 @@ let n$1 = class n extends y {
 		});
 	}
 };
-export { a, block, fastStringWidth, getColumns, getRows, isCancel, n$1, r, require_src, settings, u$2, wrapAnsi, wrapTextWithPrefix };
+export { a, block, fastStringWidth, getColumns, getRows, isCancel, n$1, r, require_src, settings, u$1, u$2, wrapAnsi, wrapTextWithPrefix };

package/dist/_chunks/libs/@clack/prompts.mjs

@@ -1,5 +1,5 @@
 import { __exportAll } from "../../rolldown-runtime.mjs";
-import { a, block, fastStringWidth, getColumns, getRows, n$1, r, require_src, settings, u$2, wrapAnsi, wrapTextWithPrefix } from "./core.mjs";
+import { a, block, fastStringWidth, getColumns, getRows, n$1, r, require_src, settings, u$1, u$2, wrapAnsi, wrapTextWithPrefix } from "./core.mjs";
 import { styleText } from "node:util";
 import process$1 from "node:process";
 import "node:fs";
@@ -20,6 +20,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	S_CORNER_TOP_RIGHT: () => S_CORNER_TOP_RIGHT,
 	S_ERROR: () => S_ERROR,
 	S_INFO: () => S_INFO,
+	S_PASSWORD_MASK: () => S_PASSWORD_MASK,
 	S_RADIO_ACTIVE: () => S_RADIO_ACTIVE,
 	S_RADIO_INACTIVE: () => S_RADIO_INACTIVE,
 	S_STEP_ACTIVE: () => S_STEP_ACTIVE,
@@ -39,6 +40,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	multiselect: () => multiselect,
 	note: () => note,
 	outro: () => outro,
+	password: () => password,
 	select: () => select,
 	spinner: () => spinner,
 	symbol: () => symbol,
@@ -66,6 +68,7 @@ const S_RADIO_INACTIVE = unicodeOr("○", " ");
 const S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]");
 const S_CHECKBOX_SELECTED = unicodeOr("◼", "[+]");
 const S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]");
+const S_PASSWORD_MASK = unicodeOr("▪", "•");
 const S_BAR_H = unicodeOr("─", "-");
 const S_CORNER_TOP_RIGHT = unicodeOr("╮", "+");
 const S_CONNECT_LEFT = unicodeOr("├", "+");
@@ -446,6 +449,33 @@ ${h}
 ${styleText("gray", l$1 + S_BAR_H.repeat(t + 2) + S_CORNER_BOTTOM_RIGHT)}
 `);
 };
+const password = (e) => new u$1({
+	validate: e.validate,
+	mask: e.mask ?? S_PASSWORD_MASK,
+	signal: e.signal,
+	input: e.input,
+	output: e.output,
+	render() {
+		const r = e.withGuide ?? settings.withGuide, o = `${r ? `${styleText("gray", S_BAR)}
+` : ""}${symbol(this.state)}  ${e.message}
+`, m = this.userInputWithCursor, i = this.masked;
+		switch (this.state) {
+			case "error": {
+				const s = r ? `${styleText("yellow", S_BAR)}  ` : "", n = r ? `${styleText("yellow", S_BAR_END)}  ` : "", d = i ?? "";
+				return e.clearOnError && this.clear(), `${o.trim()}
+${s}${d}
+${n}${styleText("yellow", this.error)}
+`;
+			}
+			case "submit": return `${o}${r ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText("dim", i) : ""}`;
+			case "cancel": return `${o}${r ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText(["strikethrough", "dim"], i) : ""}${i && r ? `
+${styleText("gray", S_BAR)}` : ""}`;
+			default: return `${o}${r ? `${styleText("cyan", S_BAR)}  ` : ""}${m}
+${r ? styleText("cyan", S_BAR_END) : ""}
+`;
+		}
+	}
+}).prompt();
 const W = (l) => styleText("magenta", l);
 const spinner = ({ indicator: l = "dots", onCancel: h, output: n = process.stdout, cancelMessage: G, errorMessage: O, frames: E = unicode ? [
 	"◒",
@@ -582,4 +612,4 @@ ${f}
 	}).prompt();
 };
 `${styleText("gray", S_BAR)}`;
-export { cancel, confirm, dist_exports, groupMultiselect, intro, log, multiselect, note, outro, select, spinner };
+export { cancel, confirm, dist_exports, groupMultiselect, intro, log, multiselect, note, outro, password, select, spinner };

package/dist/_chunks/mcp.mjs

@@ -1,6 +1,8 @@
-import { builtinCommands, entriesFromJson, normalizeConfig, object, resolveVariables, validName, variables } from "./model.mjs";
-import { agentIds, applyPlan, decodeServer, loadTarget, planInstall, planRemove, readDocument, targetFor } from "./manager.mjs";
-import { readConfig } from "./files.mjs";
+import { isCancel } from "./libs/@clack/core.mjs";
+import { select } from "./libs/@clack/prompts.mjs";
+import { builtinCommands, entriesFromJson, resolveVariables, validName, variables } from "./model.mjs";
+import { agentIds, applyPlan, decodeServer, loadTarget, planInstall, planRemove, readConfig, readDocument, targetFor } from "../cli.mjs";
+import { catalogEntries, readCatalog } from "./registry.mjs";
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -9,87 +11,6 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-async function readCatalog(registry, query = "", fetcher = fetch) {
-	let base;
-	try {
-		base = new URL(registry);
-	} catch {
-		throw new Error("SkillHub 地址无效。");
-	}
-	if (!["https:", "http:"].includes(base.protocol) || base.username || base.password || base.search || base.hash) throw new Error("SkillHub 地址必须为无凭据的 HTTP(S) 地址。");
-	const entries = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (let page = 0; page < 100; page++) {
-		const url = new URL(`${base.toString().replace(/\/$/, "")}/api/web/mcps`);
-		url.search = new URLSearchParams({
-			query,
-			page: String(page),
-			size: "100"
-		}).toString();
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), 15e3);
-		try {
-			const response = await fetcher(url, {
-				signal: controller.signal,
-				redirect: "error",
-				headers: { Accept: "application/json" }
-			});
-			if (!response.ok) throw new Error();
-			const reader = response.body?.getReader();
-			if (!reader) throw new Error();
-			const chunks = [];
-			let size = 0;
-			try {
-				while (true) {
-					const chunk = await reader.read();
-					if (chunk.done) break;
-					size += chunk.value.byteLength;
-					if (size > 2097152) throw new Error();
-					chunks.push(chunk.value);
-				}
-			} finally {
-				await reader.cancel().catch(() => {});
-			}
-			const envelope = object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
-			if (envelope.code !== 0) throw new Error();
-			const data = object(envelope.data);
-			if (!Array.isArray(data.items) || typeof data.total !== "number" || data.total < 0) throw new Error();
-			for (const item of data.items) {
-				const row = object(item);
-				if (typeof row.registrationName !== "string") throw new Error();
-				const name = validName(row.registrationName);
-				if (seen.has(name)) throw new Error();
-				seen.add(name);
-				entries.push({
-					registrationName: name,
-					id: typeof row.id === "string" ? row.id : void 0,
-					title: typeof row.title === "string" ? row.title : void 0,
-					description: typeof row.description === "string" ? row.description : void 0,
-					revision: typeof row.revision === "number" ? row.revision : void 0,
-					config: normalizeConfig(row.config),
-					runtime: row.runtime ? { source: String(object(row.runtime).source) } : null
-				});
-			}
-			if (entries.length >= data.total) return entries;
-			if (!data.items.length) throw new Error();
-		} catch {
-			throw new Error("读取 MCP 市场失败：请核对 SkillHub 地址、网络及服务版本；未修改本地配置。");
-		} finally {
-			clearTimeout(timeout);
-		}
-	}
-	throw new Error("MCP 市场分页超过安全上限，请缩小查询范围。");
-}
-async function catalogEntries(registry, names) {
-	const entries = [];
-	for (const name of names) {
-		validName(name);
-		const matches = (await readCatalog(registry, name)).filter((entry) => entry.registrationName === name);
-		if (matches.length !== 1) throw new Error(`市场中未找到唯一 MCP：${name}。请用 bfi mcp search 查询准确名称。`);
-		entries.push(matches[0]);
-	}
-	return entries;
-}
 async function probe(config, options = {}) {
 	const environment = options.environment ?? process.env;
 	const timeoutMs = options.timeoutMs ?? 3e4;
@@ -230,8 +151,8 @@ const help = `bfi mcp — 安装、管理与验证独立 MCP（不影响技能
   search [query]                    搜索 SkillHub MCP 市场
   info <name>                       查看元信息、传输和所需变量（不显示凭据）
   agents                            查看支持的 Agent 与配置路径
-  install <name...> --agent <agent>  安装选中的 MCP，默认用户级
-  install --file <json> --agent <agent>  离线导入 mcpServers JSON
+  install <name...> [--agent <agent>]  安装选中的 MCP，默认用户级；未指定 Agent 时交互选择
+  install --file <json> [--agent <agent>]  离线导入 mcpServers JSON
   list --agent <agent>              列出所选文件中的 MCP
   remove <name...> --agent <agent>   仅移除配置，不卸载程序
   test <name...> --agent <agent>     显式启动/连接并查询 tools/list，不调用业务工具
@@ -329,7 +250,6 @@ function parseMcpArguments(args) {
 	].includes(result.command)) throw new Error("未知 MCP 命令；请运行 bfi mcp --help。");
 	if (result.command === "help") return result;
 	if ([
-		"install",
 		"list",
 		"remove",
 		"test"
@@ -419,6 +339,18 @@ async function runMcp(args) {
 		if (!entries.length && !options.json) print("未找到 MCP。");
 		return;
 	}
+	if (!options.agent) {
+		if (options.json || !process.stdin.isTTY || !process.stdout.isTTY) throw new Error("非交互安装需要 --agent；bfi mcp agents 可查看支持列表。");
+		const selected = await select({
+			message: "选择目标 Agent",
+			options: agentIds.map((agent) => ({
+				value: agent,
+				label: agent
+			}))
+		});
+		if (isCancel(selected)) throw new Error("已取消，未写入配置。");
+		options.agent = selected;
+	}
 	const target = targetFor(options.agent, options.scope, { config: options.config });
 	if (options.command === "list") {
 		const { servers } = await loadTarget(target);

package/dist/_chunks/receipt.mjs

@@ -1,4 +1,4 @@
-import { checkPath, readConfig } from "./files.mjs";
+import { checkPath, readConfig } from "../cli.mjs";
 import { canonical, hash } from "./digest.mjs";
 import { randomUUID } from "node:crypto";
 import { constants, realpathSync } from "node:fs";

package/dist/_chunks/registry.mjs

@@ -0,0 +1,83 @@
+import { normalizeConfig, object, validName } from "./model.mjs";
+async function readCatalog(registry, query = "", fetcher = fetch) {
+	let base;
+	try {
+		base = new URL(registry);
+	} catch {
+		throw new Error("SkillHub 地址无效。");
+	}
+	if (!["https:", "http:"].includes(base.protocol) || base.username || base.password || base.search || base.hash) throw new Error("SkillHub 地址必须为无凭据的 HTTP(S) 地址。");
+	const entries = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (let page = 0; page < 100; page++) {
+		const url = new URL(`${base.toString().replace(/\/$/, "")}/api/web/mcps`);
+		url.search = new URLSearchParams({
+			query,
+			page: String(page),
+			size: "100"
+		}).toString();
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 15e3);
+		try {
+			const response = await fetcher(url, {
+				signal: controller.signal,
+				redirect: "error",
+				headers: { Accept: "application/json" }
+			});
+			if (!response.ok) throw new Error();
+			const reader = response.body?.getReader();
+			if (!reader) throw new Error();
+			const chunks = [];
+			let size = 0;
+			try {
+				while (true) {
+					const chunk = await reader.read();
+					if (chunk.done) break;
+					size += chunk.value.byteLength;
+					if (size > 2097152) throw new Error();
+					chunks.push(chunk.value);
+				}
+			} finally {
+				await reader.cancel().catch(() => {});
+			}
+			const envelope = object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+			if (envelope.code !== 0) throw new Error();
+			const data = object(envelope.data);
+			if (!Array.isArray(data.items) || typeof data.total !== "number" || data.total < 0) throw new Error();
+			for (const item of data.items) {
+				const row = object(item);
+				if (typeof row.registrationName !== "string") throw new Error();
+				const name = validName(row.registrationName);
+				if (seen.has(name)) throw new Error();
+				seen.add(name);
+				entries.push({
+					registrationName: name,
+					id: typeof row.id === "string" ? row.id : void 0,
+					title: typeof row.title === "string" ? row.title : void 0,
+					description: typeof row.description === "string" ? row.description : void 0,
+					revision: typeof row.revision === "number" ? row.revision : void 0,
+					config: normalizeConfig(row.config),
+					runtime: row.runtime ? { source: String(object(row.runtime).source) } : null
+				});
+			}
+			if (entries.length >= data.total) return entries;
+			if (!data.items.length) throw new Error();
+		} catch {
+			throw new Error("读取 MCP 市场失败：请核对 SkillHub 地址、网络及服务版本；未修改本地配置。");
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	throw new Error("MCP 市场分页超过安全上限，请缩小查询范围。");
+}
+async function catalogEntries(registry, names) {
+	const entries = [];
+	for (const name of names) {
+		validName(name);
+		const matches = (await readCatalog(registry, name)).filter((entry) => entry.registrationName === name);
+		if (matches.length !== 1) throw new Error(`市场中未找到唯一 MCP：${name}。请用 bfi mcp search 查询准确名称。`);
+		entries.push(matches[0]);
+	}
+	return entries;
+}
+export { catalogEntries, readCatalog };