bfi-cli 0.1.102 → 0.1.104

package/README.md

@@ -15,27 +15,33 @@ bfi package install @team/kit --agent claude-code
 ## 明确选择插件
 
 ```sh
-bfi skills package install @team/kit --as plugin --version 1.0.0
-bfi package install @team/kit --as plugin --agent claude-code --version 1.0.0 --plan
-bfi package install @team/kit --as plugin --agent claude-code --version 1.0.0 --export ./kit-1.0.0.zip
-bfi package install @team/kit --as plugin --agent claude-code --scope user --version 1.0.0 --prepare-native ./kit-1.0.0-native
-bfi package install ./kit.tgz --as plugin --agent codex --root bundle --version 1.0.0 --plan
+# 下载并校验默认安装版本（= 最新发布版），不安装
+bfi skills package download @team/kit --as plugin -o ./kit.zip
+bfi skills package download @team/kit --as plugin --format tgz -o ./kit.tgz
+bfi skills package download @team/kit --as plugin --format tar.gz -o ./kit.tar.gz
+
+# 生成版本化原生目录并更新本地市场索引；由用户执行输出中的宿主命令
+bfi skills package prepare @team/kit --as plugin --agent claude-code --dir ./kit-handoff
+
+# 按默认版本重新下载/交接，不依赖安装记录
+bfi skills package update @team/kit --as plugin --agent claude-code --dir ./kit-handoff
+
+# 把命名空间注册为 Claude Code 市场（写入 ~/.claude/settings.json，headersHelper 使用 bfi 登录态）
+bfi skills package marketplace add global
+
+# 本地归档
+bfi package prepare ./kit.tgz --as plugin --agent codex --root bundle --dir ./kit-handoff
 bfi package list --as plugin --scope project
 ```
 
-- Claude Code **2.1.251** 的已验证组件开放受控原生注册；仍须满足精确发布版本的服务端授权、宿主/adapter 版本和 LOAD 证据。没有这些证据时不会安装。Codex **0.136.0** 仅开放原生技能型插件的人工交接；ZCode、CodeBuddy、Qwen Code 未实测，只导出并明确提示待适配。详见 [插件验证矩阵](PLUGIN-VALIDATION.md)。
-- 通用安装命令不必指定 Agent 和范围，CLI 会在交互终端中询问；非交互调用必须显式选择，`--yes` 不会代选。不支持的宿主或组件仍明确停止，不降级成技能安装。
-- `--plan` 只给计划/阻断原因；`--export` 原样导出归档，不计作安装。目标文件必须不存在，扩展名与源格式一致。
-- `--prepare-native <新目录>` 生成完整原始插件目录及独立市场索引，输出真实宿主命令；不注册宿主、不执行 Hooks、不创建 bfi 安装归属。只在宿主版本、作用域及全部必要组件受支持时生成。审阅后由用户确认执行；安装后保留该目录。人工交接的更新/卸载由原生宿主管理。
-- `--plan` 返回 READY 后，去掉 `--plan` 并确认可原生注册；非交互需显式 `--yes`。结果 REGISTERED 仅表示注册和文件归属已核对，需重启宿主检查所有组件，不能视为运行功能验证通过。
-- 市场来源必须写完整名称 `@namespace/package`，不要求用户输入数据库 ID。未指定版本时只解析一次可见 stable；没有 stable 则要求明确版本，不猜 latest。
-- 本地支持 zip/tgz/tar.gz，多根必须用 `--root` 选择；保留全部原始文件、执行位和未知字段，不自动转换各宿主格式。缺原生版本时可用 `--version` 描述本地导出身份，但不会改源文件或绕过市场正式发布的版本校验。
-- 原生安装/卸载/交接要求明确范围：`--scope user`（或 `-g`）/ `--scope project`；交互终端省略时询问，非交互或 `--yes` 不能代选。只读计划/导出/列表省略时按项目范围查看。插件独立使用 `.bfi/plugin-lock.json`，不与旧技能锁混用。
-- 未知安装结果保留 PREPARED 并阻止盲目重试；更新/卸载必须证明精确来源、宿主、范围、版本及安装归属。
-- 同一已安装内容重复安装不重复写入；原生版本更新暂不自动替换，提示 NATIVE_UPDATE_REQUIRES_USER 并保留旧版。卸载保留数据、市场索引及原始目录；重装使用新的独立市场，不覆盖保留目录。明确的同名预检冲突记录 FAILED，可解决后重试；原生命令结果不明才保留 PREPARED。
-- 所有路径都先执行归档安全检查。疑似凭据、非法路径、缺失关键组件或不支持的格式会停止，不能为导出或安装绕过，也不会自动降级成技能安装。
-
-服务器插件功能默认开启；显式设置 `PACKAGE_PLUGIN_ENABLED=false` 时仍可使用既有技能包，但插件市场操作不可用。本地原始包计划/导出不等于服务器发布。
+- 版本默认取「默认安装版本」，即最近一次发布；无需 `--version`。没有默认版本时才要求显式版本，不猜 latest。
+- Claude Code **2.1.251** 与 Codex **0.136.0** 已实现适配器，但原生自动注册仍受服务端能力与运行时 LOAD 证据门禁；不满足时使用 `download` / `prepare`，不会降级成技能安装。ZCode、CodeBuddy、Qwen Code 只导出/交接。
+- `download` 不要求 `--agent`，只导出并校验归档；支持 `--format zip|tgz|tar.gz`（默认按输出扩展名或 zip）。zip 校验归档摘要，tar 格式校验 treeDigest 与逐文件摘要；目标文件必须不存在。
+- `prepare` 生成 `versions/<version>/plugin` 与市场索引（`.claude-plugin/marketplace.json` 或 `.agents/plugins/marketplace.json`），更新时原子改写索引指向新版本；不注册宿主、不执行 Hooks、不创建安装归属。
+- `update`、`download`、`prepare` 均不以安装记录为前提；记录只用于原生注册的归属校验与卸载。
+- 市场来源必须写完整名称 `@namespace/package`；跨来源凭据不转发。
+- 原生安装/卸载要求明确范围：`--scope user`（或 `-g`）/ `--scope project`；交互终端省略时询问，非交互或 `--yes` 不能代选。
+- 未知安装结果保留 PREPARED 并阻止盲目重试；卸载保留数据与市场索引。
 
 ## 独立 MCP 安装与测试
 
@@ -101,7 +107,7 @@ Codex 不支持独立旧 SSE、拼接变量或 env_vars 重命名。`cwd` 仅在
 
 `src/lib/installation/contracts.ts` 与 `test-fixtures/installation/collection-v1.json` 固定后续 Java/TypeScript 契约：ID 均为字符串；直接安装根明确列举，嵌套 SKILL.md 只是支持文件；MCP 只允许凭据占位符。当前解析器检查 schema、根重叠、大小写冲突、路径和字面凭据，不下载或执行文件，不开放服务端接口。每文件上限 50 MiB、总计 500 MiB、文件数 20,000，未来服务端必须使用相同限制或更严格限制。
 
-单个技能与技能组合都沿用原有安装路径：`bfi skills add` 安装单个技能，`bfi skills package install` 安装组合内的全部技能；组合关联的 MCP 使用 `bfi mcp install` 单独安装。组合 ZIP 为各技能文件夹加根目录 `mcp.json`（仅当组合关联 MCP 时存在）。其它 Git/本地技能来源仍走既有 skills.sh 路径；独立 MCP 和显式 `--as plugin` 不变。缺 Agent/范围时分别询问，不默认增加 universal Agent。非交互必须显式给出目标、范围和 `-y`；不支持 `--skills-only`，关联 MCP 不可取消。
+单个技能与技能组合都沿用原有安装路径：`bfi skills add` 安装单个技能；`bfi skills package install` 一次下载组合包，批量安装全部技能，并在组合包含 `mcp.json` 时一并安装关联 MCP。安装前会展示技能与 MCP 清单，MCP 需要的变量在交互终端中隐藏输入；用户级配置可直接物化，项目级配置只保存变量引用。组合 ZIP 为各技能文件夹加根目录 `mcp.json`（仅当组合关联 MCP 时存在）。其它 Git/本地技能来源仍走既有 skills.sh 路径；独立 MCP 和显式 `--as plugin` 不变。缺 Agent/范围时分别询问，不默认增加 universal Agent。非交互必须显式给出目标、范围和 `-y`；不支持 `--skills-only`，关联 MCP 不可取消。
 
 ```sh
 bfi skills add @global/bfi-configuring-ui
@@ -134,7 +140,7 @@ MCP 连接结构复用已有标准化校验；已知凭据字段、敏感输入
 
 ### P4 网页安装入口与运行时检查
 
-技能组合的安装卡片直接列出 CLI 命令（登录、安装组合、安装关联 MCP）并提供 ZIP 下载，不解析内容计划；单个技能使用原有的 `bfi skills add` 命令和技能原始 ZIP 下载；插件的安装抽屉先解析固定内容计划，再生成 `--content-plan` 实际命令。目标 Agent 和范围可独立省略，CLI 交互确认。安装、npm 升级与登录命令均可复制。
+技能组合的安装卡片直接列出 CLI 命令（安装 bfi、登录、安装组合、更新）并提供 ZIP 下载，不解析内容计划；组合关联 MCP 由安装命令自动一并安装。单个技能使用原有的 `bfi skills add` 命令和技能原始 ZIP 下载；插件的安装抽屉先解析固定内容计划，再生成 `--content-plan` 实际命令。目标 Agent 和范围可独立省略，CLI 交互确认。安装、npm 升级与登录命令均可复制。
 
 服务端 `INSTALLATION_VERIFIED_CLI_VERSION` 和 `INSTALLATION_VERIFIED_CLI_CAPABILITIES` 默认空，不再作为网页展示命令的前置条件。本机执行 `bfi capabilities --json` 检查实际能力；npm 版尚未发布这些能力时可用当前开发构建验证，不把命令展示等同于已经发布。`COLLECTION_MCP_WRITE_ENABLED` 默认开启，可显式关闭；`COLLECTION_INSTALL_ENABLED=false` 会让含 MCP 的组合失败关闭，保留数据，不退回仅安装技能。旧 v1 组合读取/下载要求声明 `collection-mcp-v1` 才允许处理含 MCP 的组合；能力声明不替代授权。
 

package/dist/_chunks/command.mjs

@@ -3,12 +3,9 @@ import { confirm as confirm$1, multiselect, select } from "./libs/@clack/prompts
 import { inspectPluginArchive } from "./intent.mjs";
 import { loadGlobalConfig, loadProjectConfig, resolveConfig } from "./config.mjs";
 import { agents, detectInstalledAgents, setAgents } from "./agents.mjs";
-import { SkillHubAPI, getAgentBaseDir } from "../cli.mjs";
 import { builtinCommands, normalizeConfig, variables } from "./model.mjs";
-import { planInstall, readDocument, serversIn, targetFor } from "./manager.mjs";
-import { checkPath, readConfig, writeConfig } from "./files.mjs";
 import { canonical, hash, stableManifest, verifyPlan } from "./digest.mjs";
-import { InstallationClient, credentialForRegistry, registryUrl } from "./client.mjs";
+import { InstallationClient, SkillHubAPI, checkPath, credentialForRegistry, getAgentBaseDir, planInstall, readConfig, readDocument, registryUrl, serversIn, targetFor, writeConfig } from "../cli.mjs";
 import { resolveAgents } from "./agents2.mjs";
 import { assertWritable, atomicPrivate, checkpoint, fingerprint, operationRoot, ownershipDigest, pathKey, readReceipt, receipts, safeDirectory, treeFingerprint, withInstallationLock } from "./receipt.mjs";
 import { randomUUID } from "node:crypto";

package/dist/_chunks/intent.mjs

@@ -572,8 +572,9 @@ var PluginRegistryClient = class {
 	async release(namespace, slug, version) {
 		return this.json(`${this.base(namespace, slug)}/plugin/releases/${segment(version)}`);
 	}
-	async download(namespace, slug, version, maximum = pluginArchiveLimits.compressedBytes) {
-		return this.bytes(`${this.base(namespace, slug)}/plugin/releases/${segment(version)}/download`, maximum);
+	async download(namespace, slug, version, format = "zip", maximum = pluginArchiveLimits.compressedBytes) {
+		const suffix = format === "zip" ? "" : `?format=${encodeURIComponent(format)}`;
+		return this.bytes(`${this.base(namespace, slug)}/plugin/releases/${segment(version)}/download${suffix}`, maximum);
 	}
 };
 const pluginTargets = [
@@ -600,10 +601,13 @@ function parsePackageIntent(args) {
 		"--plan",
 		"--export",
 		"--prepare-native",
+		"--dir",
+		"--output",
+		"--format",
 		"--scope",
 		"--root",
 		"--operation"
-	].includes(value) || /^(--plan|--export|--prepare-native|--scope|--root|--operation)=/u.test(value)) || isPluginArchive(output[1] ?? ""))) throw new Error("Plugin archives and plugin options require explicit --as plugin; no skills were installed");
+	].includes(value) || /^(--plan|--export|--prepare-native|--dir|--output|--format|--scope|--root|--operation)=/u.test(value)) || isPluginArchive(output[1] ?? ""))) throw new Error("Plugin archives and plugin options require explicit --as plugin; no skills were installed");
 	return {
 		mode,
 		args: output
@@ -615,12 +619,17 @@ function parsePluginArguments(args) {
 		i: "install",
 		update: "update",
 		up: "update",
+		download: "download",
+		dl: "download",
+		export: "download",
+		prepare: "prepare",
+		handoff: "prepare",
 		uninstall: "uninstall",
 		rm: "uninstall",
 		list: "list",
 		ls: "list"
 	}[args[0] ?? ""];
-	if (!command) throw new Error("Plugin intent supports install, update, uninstall and list");
+	if (!command) throw new Error("Plugin intent supports install, update, download, prepare, uninstall and list");
 	const result = {
 		command,
 		scope: "project",
@@ -634,7 +643,10 @@ function parsePluginArguments(args) {
 		"--scope",
 		"--root",
 		"--export",
+		"--output",
+		"--format",
 		"--prepare-native",
+		"--dir",
 		"--operation",
 		"--registry",
 		"--token",
@@ -663,9 +675,16 @@ function parsePluginArguments(args) {
 				if (!["project", "user"].includes(value)) throw new Error("Plugin scope must be project or user");
 				result.scope = value;
 			} else if (flag === "--root") result.root = value;
-			else if (flag === "--export") result.exportPath = value;
-			else if (flag === "--prepare-native") result.preparePath = value;
-			else if (flag === "--operation") result.operationId = value;
+			else if (flag === "--export" || flag === "--output") result.exportPath = value;
+			else if (flag === "--prepare-native" || flag === "--dir") result.preparePath = value;
+			else if (flag === "--format") {
+				if (![
+					"zip",
+					"tgz",
+					"tar.gz"
+				].includes(value)) throw new Error("Plugin archive format must be zip, tgz or tar.gz");
+				result.format = value;
+			} else if (flag === "--operation") result.operationId = value;
 		} else if (flag === "--global") result.scope = "user";
 		else if (flag === "--plan") result.planOnly = true;
 		else if (flag === "--json") result.json = true;
@@ -677,9 +696,21 @@ function parsePluginArguments(args) {
 	if (command !== "list" && !result.source && !(command === "uninstall" && result.operationId)) throw new Error("Specify @namespace/package or a local zip/tgz path");
 	if (result.source && !/^@[^/\s]+\/[^/\s]+$/u.test(result.source) && !isPluginArchive(result.source)) throw new Error("Use a namespace-qualified @namespace/package reference or local archive");
 	if (result.planOnly && result.exportPath) throw new Error("Plan and export are separate operations");
-	if (result.preparePath && (result.planOnly || result.exportPath || command !== "install")) throw new Error("Native handoff, plan and export are separate install operations");
-	if (result.root !== void 0 && !isPluginArchive(result.source ?? "") || result.operationId && command !== "uninstall" || (result.exportPath || result.root !== void 0) && command !== "install") throw new Error("Plugin option is invalid for this operation");
-	if (command === "list" && (result.source || result.version || result.planOnly || result.exportPath || result.operationId)) throw new Error("Invalid plugin list options");
+	if (result.planOnly && command !== "install") throw new Error("--plan is only available for plugin install");
+	if (result.preparePath && result.exportPath) throw new Error("Download and native handoff are separate operations");
+	if (command === "download" && (result.planOnly || result.preparePath)) throw new Error("Download only supports --output; use prepare for native handoff");
+	if (command === "prepare" && !result.agent) throw new Error("AGENT_REQUIRED: native handoff needs --agent claude-code or --agent codex");
+	if ((result.exportPath || result.preparePath) && ![
+		"install",
+		"update",
+		"download",
+		"prepare"
+	].includes(command)) throw new Error("Plugin option is invalid for this operation");
+	if (result.root !== void 0 && !isPluginArchive(result.source ?? "")) throw new Error("--root only applies to local plugin archives");
+	if (result.operationId && command !== "uninstall") throw new Error("--operation is only valid for uninstall");
+	if (command === "list" && (result.source || result.version || result.planOnly || result.exportPath || result.preparePath || result.operationId)) throw new Error("Invalid plugin list options");
+	if (command === "prepare" && result.planOnly) throw new Error("Plan and native handoff are separate operations");
+	if (result.format && !(command === "download" || result.exportPath)) throw new Error("--format requires download or --export");
 	return result;
 }
 export { PluginInstallRecords, PluginRegistryClient, inspectPluginArchive, isPluginArchive, isPluginVersion, materializePluginTree, normalizeRegistry, parsePackageIntent, parsePluginArguments, pluginArchiveLimits, pluginInstallKey, pluginSlotKey, pluginTargets, selectPluginRoot, sha256, treeDigest };

package/dist/_chunks/libs/@clack/core.mjs

@@ -1,5 +1,5 @@
 import { __commonJSMin } from "../../rolldown-runtime.mjs";
-import "node:util";
+import { styleText } from "node:util";
 import { stdin, stdout } from "node:process";
 import l__default, * as l from "node:readline";
 import { ReadStream } from "node:tty";
@@ -734,6 +734,32 @@ var a = class extends y {
 		});
 	}
 };
+let u$1 = class u extends y {
+	_mask = "•";
+	get cursor() {
+		return this._cursor;
+	}
+	get masked() {
+		return this.userInput.replaceAll(/./g, this._mask);
+	}
+	get userInputWithCursor() {
+		if (this.state === "submit" || this.state === "cancel") return this.masked;
+		const t = this.userInput;
+		if (this.cursor >= t.length) return `${this.masked}${styleText(["inverse", "hidden"], "_")}`;
+		const s = this.masked, r = s.slice(0, this.cursor), i = s.slice(this.cursor, this.cursor + 1), o = s.slice(this.cursor + 1);
+		return `${r}${styleText("inverse", i)}${o}`;
+	}
+	clear() {
+		this._clearUserInput();
+	}
+	constructor({ mask: t, ...s }) {
+		super(s), this._mask = t ?? "•", this.on("userInput", (r) => {
+			this._setValue(r);
+		}), this.on("finalize", () => {
+			this.value === void 0 && (this.value = "");
+		});
+	}
+};
 let n$1 = class n extends y {
 	options;
 	cursor = 0;
@@ -760,4 +786,4 @@ let n$1 = class n extends y {
 		});
 	}
 };
-export { a, block, fastStringWidth, getColumns, getRows, isCancel, n$1, r, require_src, settings, u$2, wrapAnsi, wrapTextWithPrefix };
+export { a, block, fastStringWidth, getColumns, getRows, isCancel, n$1, r, require_src, settings, u$1, u$2, wrapAnsi, wrapTextWithPrefix };

package/dist/_chunks/libs/@clack/prompts.mjs

@@ -1,5 +1,5 @@
 import { __exportAll } from "../../rolldown-runtime.mjs";
-import { a, block, fastStringWidth, getColumns, getRows, n$1, r, require_src, settings, u$2, wrapAnsi, wrapTextWithPrefix } from "./core.mjs";
+import { a, block, fastStringWidth, getColumns, getRows, n$1, r, require_src, settings, u$1, u$2, wrapAnsi, wrapTextWithPrefix } from "./core.mjs";
 import { styleText } from "node:util";
 import process$1 from "node:process";
 import "node:fs";
@@ -20,6 +20,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	S_CORNER_TOP_RIGHT: () => S_CORNER_TOP_RIGHT,
 	S_ERROR: () => S_ERROR,
 	S_INFO: () => S_INFO,
+	S_PASSWORD_MASK: () => S_PASSWORD_MASK,
 	S_RADIO_ACTIVE: () => S_RADIO_ACTIVE,
 	S_RADIO_INACTIVE: () => S_RADIO_INACTIVE,
 	S_STEP_ACTIVE: () => S_STEP_ACTIVE,
@@ -39,6 +40,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	multiselect: () => multiselect,
 	note: () => note,
 	outro: () => outro,
+	password: () => password,
 	select: () => select,
 	spinner: () => spinner,
 	symbol: () => symbol,
@@ -66,6 +68,7 @@ const S_RADIO_INACTIVE = unicodeOr("○", " ");
 const S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]");
 const S_CHECKBOX_SELECTED = unicodeOr("◼", "[+]");
 const S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]");
+const S_PASSWORD_MASK = unicodeOr("▪", "•");
 const S_BAR_H = unicodeOr("─", "-");
 const S_CORNER_TOP_RIGHT = unicodeOr("╮", "+");
 const S_CONNECT_LEFT = unicodeOr("├", "+");
@@ -446,6 +449,33 @@ ${h}
 ${styleText("gray", l$1 + S_BAR_H.repeat(t + 2) + S_CORNER_BOTTOM_RIGHT)}
 `);
 };
+const password = (e) => new u$1({
+	validate: e.validate,
+	mask: e.mask ?? S_PASSWORD_MASK,
+	signal: e.signal,
+	input: e.input,
+	output: e.output,
+	render() {
+		const r = e.withGuide ?? settings.withGuide, o = `${r ? `${styleText("gray", S_BAR)}
+` : ""}${symbol(this.state)}  ${e.message}
+`, m = this.userInputWithCursor, i = this.masked;
+		switch (this.state) {
+			case "error": {
+				const s = r ? `${styleText("yellow", S_BAR)}  ` : "", n = r ? `${styleText("yellow", S_BAR_END)}  ` : "", d = i ?? "";
+				return e.clearOnError && this.clear(), `${o.trim()}
+${s}${d}
+${n}${styleText("yellow", this.error)}
+`;
+			}
+			case "submit": return `${o}${r ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText("dim", i) : ""}`;
+			case "cancel": return `${o}${r ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText(["strikethrough", "dim"], i) : ""}${i && r ? `
+${styleText("gray", S_BAR)}` : ""}`;
+			default: return `${o}${r ? `${styleText("cyan", S_BAR)}  ` : ""}${m}
+${r ? styleText("cyan", S_BAR_END) : ""}
+`;
+		}
+	}
+}).prompt();
 const W = (l) => styleText("magenta", l);
 const spinner = ({ indicator: l = "dots", onCancel: h, output: n = process.stdout, cancelMessage: G, errorMessage: O, frames: E = unicode ? [
 	"◒",
@@ -582,4 +612,4 @@ ${f}
 	}).prompt();
 };
 `${styleText("gray", S_BAR)}`;
-export { cancel, confirm, dist_exports, groupMultiselect, intro, log, multiselect, note, outro, select, spinner };
+export { cancel, confirm, dist_exports, groupMultiselect, intro, log, multiselect, note, outro, password, select, spinner };

package/dist/_chunks/mcp.mjs

@@ -1,6 +1,8 @@
-import { builtinCommands, entriesFromJson, normalizeConfig, object, resolveVariables, validName, variables } from "./model.mjs";
-import { agentIds, applyPlan, decodeServer, loadTarget, planInstall, planRemove, readDocument, targetFor } from "./manager.mjs";
-import { readConfig } from "./files.mjs";
+import { isCancel } from "./libs/@clack/core.mjs";
+import { select } from "./libs/@clack/prompts.mjs";
+import { builtinCommands, entriesFromJson, resolveVariables, validName, variables } from "./model.mjs";
+import { agentIds, applyPlan, decodeServer, loadTarget, planInstall, planRemove, readConfig, readDocument, targetFor } from "../cli.mjs";
+import { catalogEntries, readCatalog } from "./registry.mjs";
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -9,87 +11,6 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-async function readCatalog(registry, query = "", fetcher = fetch) {
-	let base;
-	try {
-		base = new URL(registry);
-	} catch {
-		throw new Error("SkillHub 地址无效。");
-	}
-	if (!["https:", "http:"].includes(base.protocol) || base.username || base.password || base.search || base.hash) throw new Error("SkillHub 地址必须为无凭据的 HTTP(S) 地址。");
-	const entries = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (let page = 0; page < 100; page++) {
-		const url = new URL(`${base.toString().replace(/\/$/, "")}/api/web/mcps`);
-		url.search = new URLSearchParams({
-			query,
-			page: String(page),
-			size: "100"
-		}).toString();
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), 15e3);
-		try {
-			const response = await fetcher(url, {
-				signal: controller.signal,
-				redirect: "error",
-				headers: { Accept: "application/json" }
-			});
-			if (!response.ok) throw new Error();
-			const reader = response.body?.getReader();
-			if (!reader) throw new Error();
-			const chunks = [];
-			let size = 0;
-			try {
-				while (true) {
-					const chunk = await reader.read();
-					if (chunk.done) break;
-					size += chunk.value.byteLength;
-					if (size > 2097152) throw new Error();
-					chunks.push(chunk.value);
-				}
-			} finally {
-				await reader.cancel().catch(() => {});
-			}
-			const envelope = object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
-			if (envelope.code !== 0) throw new Error();
-			const data = object(envelope.data);
-			if (!Array.isArray(data.items) || typeof data.total !== "number" || data.total < 0) throw new Error();
-			for (const item of data.items) {
-				const row = object(item);
-				if (typeof row.registrationName !== "string") throw new Error();
-				const name = validName(row.registrationName);
-				if (seen.has(name)) throw new Error();
-				seen.add(name);
-				entries.push({
-					registrationName: name,
-					id: typeof row.id === "string" ? row.id : void 0,
-					title: typeof row.title === "string" ? row.title : void 0,
-					description: typeof row.description === "string" ? row.description : void 0,
-					revision: typeof row.revision === "number" ? row.revision : void 0,
-					config: normalizeConfig(row.config),
-					runtime: row.runtime ? { source: String(object(row.runtime).source) } : null
-				});
-			}
-			if (entries.length >= data.total) return entries;
-			if (!data.items.length) throw new Error();
-		} catch {
-			throw new Error("读取 MCP 市场失败：请核对 SkillHub 地址、网络及服务版本；未修改本地配置。");
-		} finally {
-			clearTimeout(timeout);
-		}
-	}
-	throw new Error("MCP 市场分页超过安全上限，请缩小查询范围。");
-}
-async function catalogEntries(registry, names) {
-	const entries = [];
-	for (const name of names) {
-		validName(name);
-		const matches = (await readCatalog(registry, name)).filter((entry) => entry.registrationName === name);
-		if (matches.length !== 1) throw new Error(`市场中未找到唯一 MCP：${name}。请用 bfi mcp search 查询准确名称。`);
-		entries.push(matches[0]);
-	}
-	return entries;
-}
 async function probe(config, options = {}) {
 	const environment = options.environment ?? process.env;
 	const timeoutMs = options.timeoutMs ?? 3e4;
@@ -230,8 +151,8 @@ const help = `bfi mcp — 安装、管理与验证独立 MCP（不影响技能
   search [query]                    搜索 SkillHub MCP 市场
   info <name>                       查看元信息、传输和所需变量（不显示凭据）
   agents                            查看支持的 Agent 与配置路径
-  install <name...> --agent <agent>  安装选中的 MCP，默认用户级
-  install --file <json> --agent <agent>  离线导入 mcpServers JSON
+  install <name...> [--agent <agent>]  安装选中的 MCP，默认用户级；未指定 Agent 时交互选择
+  install --file <json> [--agent <agent>]  离线导入 mcpServers JSON
   list --agent <agent>              列出所选文件中的 MCP
   remove <name...> --agent <agent>   仅移除配置，不卸载程序
   test <name...> --agent <agent>     显式启动/连接并查询 tools/list，不调用业务工具
@@ -329,7 +250,6 @@ function parseMcpArguments(args) {
 	].includes(result.command)) throw new Error("未知 MCP 命令；请运行 bfi mcp --help。");
 	if (result.command === "help") return result;
 	if ([
-		"install",
 		"list",
 		"remove",
 		"test"
@@ -419,6 +339,18 @@ async function runMcp(args) {
 		if (!entries.length && !options.json) print("未找到 MCP。");
 		return;
 	}
+	if (!options.agent) {
+		if (options.json || !process.stdin.isTTY || !process.stdout.isTTY) throw new Error("非交互安装需要 --agent；bfi mcp agents 可查看支持列表。");
+		const selected = await select({
+			message: "选择目标 Agent",
+			options: agentIds.map((agent) => ({
+				value: agent,
+				label: agent
+			}))
+		});
+		if (isCancel(selected)) throw new Error("已取消，未写入配置。");
+		options.agent = selected;
+	}
 	const target = targetFor(options.agent, options.scope, { config: options.config });
 	if (options.command === "list") {
 		const { servers } = await loadTarget(target);