bfi-cli 0.1.102 → 0.1.104

package/dist/cli.mjs

@@ -1,33 +1,37 @@
 #!/usr/bin/env node
 import { __exportAll, __toESM } from "./_chunks/rolldown-runtime.mjs";
 import { isCancel } from "./_chunks/libs/@clack/core.mjs";
-import { cancel, confirm, groupMultiselect, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";
+import { cancel, confirm, groupMultiselect, intro, log, multiselect as multiselect$1, note, outro, password, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";
 import { require_picocolors } from "./_chunks/libs/picocolors.mjs";
 import { addSkillToLocalLock, addSkillToLock, computeSkillFolderHash, discoverSkills, dismissPrompt, filterSkills, getAllLockedSkills, getGitHubToken, getLastSelectedAgents, getSkillDisplayName, getSkillFromLock, isPromptDismissed, parseFrontmatter, parseSkillMd, readLocalLock, readSkillLock, removeSkillFromLock, sanitizeMetadata, saveSelectedAgents, stripTerminalEscapes } from "./_chunks/skills.mjs";
-import { PluginRegistryClient, parsePackageIntent } from "./_chunks/intent.mjs";
+import { PluginRegistryClient, normalizeRegistry, parsePackageIntent } from "./_chunks/intent.mjs";
 import { loadGlobalConfig, loadLockfile, loadProjectConfig, resolveConfig, saveGlobalConfig, saveLockfile, setConfigValue } from "./_chunks/config.mjs";
 import { esm_default } from "./_chunks/libs/simple-git.mjs";
 import { EVE_SUBAGENTS_DIR, agents, detectInstalledAgents, getEveSubagents, getNonUniversalAgents, getUniversalAgents, getVisibleUniversalAgents, isUniversalAgent } from "./_chunks/agents.mjs";
-import { packageSkillName } from "./_chunks/package-skill-identity.mjs";
+import { entriesFromJson, mapStrings, normalizeConfig, object, resolveVariables, validName, variablePattern, variables } from "./_chunks/model.mjs";
+import { hash, verifyPlan } from "./_chunks/digest.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
 import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { createHash, randomUUID } from "node:crypto";
-import { stripVTControlCharacters } from "node:util";
-import fs from "node:fs";
-import path$1 from "node:path";
+import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
+import fs, { constants, existsSync as existsSync$1 } from "node:fs";
+import path$1, { dirname as dirname$1, join as join$1, parse, resolve as resolve$1 } from "node:path";
 import { homedir, platform, tmpdir } from "os";
 import * as readline from "readline";
 import { Writable } from "stream";
 import https from "node:https";
 import http from "node:http";
+import { lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import zlib, { gunzipSync, inflateRawSync } from "node:zlib";
-import os$1 from "node:os";
+import os$1, { homedir as homedir$1 } from "node:os";
 import { promisify } from "util";
 import { execFile, spawn, spawnSync } from "child_process";
-import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "fs/promises";
+import { access as access$1, chmod, cp as cp$1, lstat as lstat$1, mkdir as mkdir$1, mkdtemp, readFile as readFile$1, readdir as readdir$1, readlink, realpath as realpath$1, rename as rename$1, rm as rm$1, stat, symlink, writeFile as writeFile$1 } from "fs/promises";
 import { determineAgent } from "@vercel/detect-agent";
+import { applyEdits, getNodeValue, modify, parseTree } from "jsonc-parser";
+import { parse as parse$1, stringify } from "smol-toml";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const GIT_HOST = process.env.BFI_GIT_HOST || "git.yyrd.com";
 const GIT_URL = `https://${GIT_HOST}`;
@@ -1223,11 +1227,11 @@ function createGitClient(extraEnv) {
 	}).env(env);
 }
 async function resetTempDir(dir) {
-	await rm(dir, {
+	await rm$1(dir, {
 		recursive: true,
 		force: true
 	}).catch(() => {});
-	await mkdir(dir, { recursive: true });
+	await mkdir$1(dir, { recursive: true });
 }
 async function tryGhClone(repo, tempDir, ref) {
 	let cloneTarget = repo.slug;
@@ -1292,7 +1296,7 @@ async function cloneRepo(url, ref) {
 		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
 		const isAuthError = isAuthFailure(errorMessage);
 		if (isTimeout) {
-			await rm(tempDir, {
+			await rm$1(tempDir, {
 				recursive: true,
 				force: true
 			}).catch(() => {});
@@ -1309,7 +1313,7 @@ async function cloneRepo(url, ref) {
 				return tempDir;
 			} catch {}
 		}
-		await rm(tempDir, {
+		await rm$1(tempDir, {
 			recursive: true,
 			force: true
 		}).catch(() => {});
@@ -1321,13 +1325,26 @@ async function cleanupTempDir(dir) {
 	const normalizedDir = normalize(resolve(dir));
 	const normalizedTmpDir = normalize(resolve(tmpdir()));
 	if (!normalizedDir.startsWith(normalizedTmpDir + sep) && normalizedDir !== normalizedTmpDir) throw new Error("Attempted to clean up directory outside of temp directory");
-	await rm(dir, {
+	await rm$1(dir, {
 		recursive: true,
 		force: true
 	});
 }
 const AGENTS_DIR = ".agents";
 const SKILLS_SUBDIR = "skills";
+var installer_exports = /* @__PURE__ */ __exportAll({
+	getAgentBaseDir: () => getAgentBaseDir,
+	getCanonicalPath: () => getCanonicalPath,
+	getCanonicalSkillsDir: () => getCanonicalSkillsDir,
+	getEveSubagentSkillsDir: () => getEveSubagentSkillsDir,
+	getInstallPath: () => getInstallPath,
+	installBlobSkillForAgent: () => installBlobSkillForAgent,
+	installSkillForAgent: () => installSkillForAgent,
+	installWellKnownSkillForAgent: () => installWellKnownSkillForAgent,
+	isSkillInstalled: () => isSkillInstalled,
+	listInstalledSkills: () => listInstalledSkills,
+	sanitizeName: () => sanitizeName
+});
 function sanitizeName(name) {
 	return name.toLowerCase().replace(/[^a-z0-9._]+/g, "-").replace(/^[.\-]+|[.\-]+$/g, "").substring(0, 255) || "unnamed-skill";
 }
@@ -1372,7 +1389,7 @@ function resolveSymlinkTarget(linkPath, linkTarget) {
 }
 async function cleanAndCreateDirectory(path) {
 	try {
-		await rm(path, {
+		await rm$1(path, {
 			recursive: true,
 			force: true
 		});
@@ -1387,7 +1404,7 @@ async function classifyPathEntry(path) {
 		return (await stat(path)).isDirectory() ? "dir" : "blocker";
 	} catch {
 		try {
-			await lstat(path);
+			await lstat$1(path);
 			return "blocker";
 		} catch {
 			return "missing";
@@ -1407,32 +1424,32 @@ async function findBlockingEntry(path) {
 }
 async function ensureDirectory(path) {
 	try {
-		await mkdir(path, { recursive: true });
+		await mkdir$1(path, { recursive: true });
 		return;
 	} catch (err) {
 		if (!isErrnoException(err) || err.code !== "ENOTDIR" && err.code !== "EEXIST" && err.code !== "ELOOP" && err.code !== "ENOENT") throw err;
 	}
 	const blockingEntry = await findBlockingEntry(path);
 	if (!blockingEntry) {
-		await mkdir(path, { recursive: true });
+		await mkdir$1(path, { recursive: true });
 		return;
 	}
 	const backupPath = `${blockingEntry}.bak-${Date.now()}`;
 	try {
-		await rename(blockingEntry, backupPath);
+		await rename$1(blockingEntry, backupPath);
 	} catch (renameErr) {
 		const reason = renameErr instanceof Error ? renameErr.message : String(renameErr);
 		throw new Error(`无法创建目录 ${path}：${blockingEntry} 存在但不是可用目录（可能是文件或失效的链接），且自动移开失败（${reason}）。请手动删除或重命名该条目后重试。`);
 	}
 	console.warn(`检测到 ${blockingEntry} 不是可用目录（可能是文件或失效的链接），已重命名为 ${backupPath}`);
-	await mkdir(path, { recursive: true });
+	await mkdir$1(path, { recursive: true });
 }
 async function resolveParentSymlinks(path) {
 	const resolved = resolve(path);
 	const dir = dirname(resolved);
 	const base = basename(resolved);
 	try {
-		const realDir = await realpath(dir);
+		const realDir = await realpath$1(dir);
 		return join(realDir, base);
 	} catch {
 		return resolved;
@@ -1442,21 +1459,21 @@ async function createSymlink(target, linkPath) {
 	try {
 		const resolvedTarget = resolve(target);
 		const resolvedLinkPath = resolve(linkPath);
-		const [realTarget, realLinkPath] = await Promise.all([realpath(resolvedTarget).catch(() => resolvedTarget), realpath(resolvedLinkPath).catch(() => resolvedLinkPath)]);
+		const [realTarget, realLinkPath] = await Promise.all([realpath$1(resolvedTarget).catch(() => resolvedTarget), realpath$1(resolvedLinkPath).catch(() => resolvedLinkPath)]);
 		if (realTarget === realLinkPath) return true;
 		if (await resolveParentSymlinks(target) === await resolveParentSymlinks(linkPath)) return true;
 		try {
-			if ((await lstat(linkPath)).isSymbolicLink()) {
+			if ((await lstat$1(linkPath)).isSymbolicLink()) {
 				if (resolveSymlinkTarget(linkPath, await readlink(linkPath)) === resolvedTarget) return true;
-				await rm(linkPath);
-			} else await rm(linkPath, { recursive: true });
+				await rm$1(linkPath);
+			} else await rm$1(linkPath, { recursive: true });
 		} catch (err) {
 			if (err && typeof err === "object" && "code" in err && err.code === "ELOOP") try {
-				await rm(linkPath, { force: true });
+				await rm$1(linkPath, { force: true });
 			} catch {}
 		}
 		const linkDir = dirname(linkPath);
-		await mkdir(linkDir, { recursive: true });
+		await mkdir$1(linkDir, { recursive: true });
 		const realLinkDir = await resolveParentSymlinks(linkDir);
 		const relativePath = relative(realLinkDir, target);
 		const symlinkType = platform() === "win32" ? "junction" : void 0;
@@ -1589,18 +1606,18 @@ function stripIgnoredEveFrontmatter(raw) {
 	return `---\n${keys.map((key) => `${key}: ${JSON.stringify(eveData[key])}`).join("\n")}\n---\n${content.replace(/^\r?\n/u, "")}`;
 }
 async function copyDirectory(src, dest, agentType) {
-	await mkdir(dest, { recursive: true });
-	const entries = await readdir(src, { withFileTypes: true });
+	await mkdir$1(dest, { recursive: true });
+	const entries = await readdir$1(src, { withFileTypes: true });
 	await Promise.all(entries.filter((entry) => !isExcluded$1(entry.name, entry.isDirectory())).map(async (entry) => {
 		const srcPath = join(src, entry.name);
 		const destPath = join(dest, entry.name);
 		if (entry.isDirectory()) await copyDirectory(srcPath, destPath, agentType);
 		else try {
 			if (agentType === "eve" && entry.name.toLowerCase() === "skill.md") {
-				await writeFile(destPath, stripIgnoredEveFrontmatter(await readFile(srcPath, "utf-8")));
+				await writeFile$1(destPath, stripIgnoredEveFrontmatter(await readFile$1(srcPath, "utf-8")));
 				return;
 			}
-			await cp(srcPath, destPath, {
+			await cp$1(srcPath, destPath, {
 				dereference: true,
 				recursive: true
 			});
@@ -1632,7 +1649,7 @@ async function isSkillInstalled(skillName, agentType, options = {}) {
 	const skillDir = join(targetBase, sanitized);
 	if (!isPathSafe$1(targetBase, skillDir)) return false;
 	try {
-		await access(skillDir);
+		await access$1(skillDir);
 		return true;
 	} catch {
 		return false;
@@ -1688,8 +1705,8 @@ async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
 			const fullPath = join(targetDir, filePath);
 			if (!isPathSafe$1(targetDir, fullPath)) continue;
 			const parentDir = dirname(fullPath);
-			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, agentType === "eve" && basename(filePath).toLowerCase() === "skill.md" && typeof content === "string" ? stripIgnoredEveFrontmatter(content) : content);
+			if (parentDir !== targetDir) await mkdir$1(parentDir, { recursive: true });
+			await writeFile$1(fullPath, agentType === "eve" && basename(filePath).toLowerCase() === "skill.md" && typeof content === "string" ? stripIgnoredEveFrontmatter(content) : content);
 		}
 	}
 	try {
@@ -1760,11 +1777,11 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 		};
 		try {
 			await ensureDirectory(agentBase);
-			await rm(flatSkillPath, {
+			await rm$1(flatSkillPath, {
 				recursive: true,
 				force: true
 			});
-			await writeFile(flatSkillPath, getEveFlatSkillMarkdown(skill.files), "utf-8");
+			await writeFile$1(flatSkillPath, getEveFlatSkillMarkdown(skill.files), "utf-8");
 			return {
 				success: true,
 				path: flatSkillPath,
@@ -1799,8 +1816,8 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 			const fullPath = join(targetDir, file.path);
 			if (!isPathSafe$1(targetDir, fullPath)) continue;
 			const parentDir = dirname(fullPath);
-			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, agentType === "eve" && basename(file.path).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(file.contents) : file.contents, "utf-8");
+			if (parentDir !== targetDir) await mkdir$1(parentDir, { recursive: true });
+			await writeFile$1(fullPath, agentType === "eve" && basename(file.path).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(file.contents) : file.contents, "utf-8");
 		}
 	}
 	try {
@@ -1905,7 +1922,7 @@ async function listInstalledSkills(options = {}) {
 		}
 	}
 	for (const scope of scopes) try {
-		const entries = await readdir(scope.path, { withFileTypes: true });
+		const entries = await readdir$1(scope.path, { withFileTypes: true });
 		for (const entry of entries) {
 			const skillDir = join(scope.path, entry.name);
 			if (!await isDirEntryOrSymlinkToDir(entry, skillDir)) continue;
@@ -1949,13 +1966,13 @@ async function listInstalledSkills(options = {}) {
 					const agentSkillDir = join(agentBase, possibleName);
 					if (!isPathSafe$1(agentBase, agentSkillDir)) continue;
 					try {
-						await access(agentSkillDir);
+						await access$1(agentSkillDir);
 						found = true;
 						break;
 					} catch {}
 				}
 				if (!found) try {
-					const agentEntries = await readdir(agentBase, { withFileTypes: true });
+					const agentEntries = await readdir$1(agentBase, { withFileTypes: true });
 					for (const agentEntry of agentEntries) {
 						const candidateDir = join(agentBase, agentEntry.name);
 						if (!await isDirEntryOrSymlinkToDir(agentEntry, candidateDir)) continue;
@@ -3111,13 +3128,14 @@ async function selectAgentsInteractive(options) {
 		hint: options.global ? agents[a].globalSkillsDir : agents[a].skillsDir
 	}));
 	let lastSelected = [];
-	try {
+	if (options.useMemory !== false) try {
 		lastSelected = await getLastSelectedAgents() || [];
 	} catch {}
+	const baseSelection = lastSelected.length > 0 ? lastSelected : options.preselectDetected === false ? [] : installedAgents;
 	const selected = await searchMultiselect({
 		message: "请选择要安装到的 Agent：",
 		items: otherChoices,
-		initialSelected: [.../* @__PURE__ */ new Set([...installedAgents, ...lastSelected])].filter((a) => otherAgents.includes(a) && !universalAgents.includes(a)),
+		initialSelected: [...new Set(baseSelection)].filter((a) => otherAgents.includes(a) && !universalAgents.includes(a)),
 		lockedSection: universalSection
 	});
 	if (!isCancelled(selected)) try {
@@ -3542,7 +3560,7 @@ async function installFromSkillHub(parsed, options, spinner) {
 		process.exit(1);
 	}
 	if (options.packageSkill) {
-		const { scopePackageSkill } = await import("./_chunks/package-skill-identity.mjs").then((n) => n.package_skill_identity_exports);
+		const { scopePackageSkill } = await Promise.resolve().then(() => package_skill_identity_exports);
 		try {
 			return {
 				skills: scopePackageSkill(skills, namespace, slug),
@@ -3600,10 +3618,10 @@ async function runAdd(args, options = {}) {
 	else if (!process.stdin.isTTY) showInstallTip();
 	let tempDir = null;
 	try {
-		const spinner$3 = spinner();
-		spinner$3.start("正在解析源...");
+		const spinner$4 = spinner();
+		spinner$4.start("正在解析源...");
 		const parsed = parseSource(source);
-		spinner$3.stop(`源：${parsed.type === "local" ? parsed.localPath : parsed.url}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
+		spinner$4.stop(`源：${parsed.type === "local" ? parsed.localPath : parsed.url}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
 		const ownerRepoRaw = getOwnerRepo(parsed);
 		const repoPrivacyPromise = (() => {
 			if (!ownerRepoRaw) return Promise.resolve(null);
@@ -3612,7 +3630,7 @@ async function runAdd(args, options = {}) {
 			return isRepoPrivate(ownerRepo.owner, ownerRepo.repo).catch(() => null);
 		})();
 		if (parsed.type === "well-known") {
-			await handleWellKnownSkills(source, parsed.url, options, spinner$3);
+			await handleWellKnownSkills(source, parsed.url, options, spinner$4);
 			return;
 		}
 		if (parsed.skillFilter) {
@@ -3623,18 +3641,18 @@ async function runAdd(args, options = {}) {
 		let skills;
 		let blobResult = null;
 		if (parsed.type === "skillhub") {
-			const result = await installFromSkillHub(parsed, options, spinner$3);
+			const result = await installFromSkillHub(parsed, options, spinner$4);
 			skills = result.skills;
 			tempDir = result.tempDir;
 		} else if (parsed.type === "local") {
-			spinner$3.start("正在验证本地路径...");
+			spinner$4.start("正在验证本地路径...");
 			if (!existsSync(parsed.localPath)) {
-				spinner$3.stop(import_picocolors.default.red("路径未找到"));
+				spinner$4.stop(import_picocolors.default.red("路径未找到"));
 				outro(import_picocolors.default.red(`本地路径不存在：${parsed.localPath}`));
 				process.exit(1);
 			}
-			spinner$3.stop("本地路径验证通过");
-			spinner$3.start("正在发现技能...");
+			spinner$4.stop("本地路径验证通过");
+			spinner$4.start("正在发现技能...");
 			skills = await discoverSkills(parsed.localPath, parsed.subpath, {
 				includeInternal,
 				fullDepth: options.fullDepth
@@ -3649,7 +3667,7 @@ async function runAdd(args, options = {}) {
 			const owner = ownerRepo?.split("/")[0]?.toLowerCase();
 			const isSelfHostedRepo = !!ownerRepo && Object.hasOwn(BLOB_ALLOWED_REPOS, ownerRepo.toLowerCase());
 			if (ownerRepo && owner && (isSelfHostedRepo || BLOB_ALLOWED_OWNERS.includes(owner))) {
-				spinner$3.start("正在获取技能...");
+				spinner$4.start("正在获取技能...");
 				blobResult = await tryBlobInstall(ownerRepo, {
 					subpath: parsed.subpath,
 					skillFilter: parsed.skillFilter,
@@ -3657,36 +3675,36 @@ async function runAdd(args, options = {}) {
 					getToken: getGitHubToken,
 					includeInternal
 				});
-				if (!blobResult) spinner$3.stop(import_picocolors.default.dim("Falling back to clone..."));
+				if (!blobResult) spinner$4.stop(import_picocolors.default.dim("Falling back to clone..."));
 			}
 			if (blobResult) {
 				skills = blobResult.skills;
-				spinner$3.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
+				spinner$4.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
 			} else {
-				tempDir = await cloneWithGitHubFallback(parsed.url, options.branch || parsed.ref, spinner$3);
-				spinner$3.stop("仓库克隆完成");
-				spinner$3.start("正在发现技能...");
+				tempDir = await cloneWithGitHubFallback(parsed.url, options.branch || parsed.ref, spinner$4);
+				spinner$4.stop("仓库克隆完成");
+				spinner$4.start("正在发现技能...");
 				skills = await discoverSkills(tempDir, parsed.subpath, {
 					includeInternal,
 					fullDepth: options.fullDepth
 				});
 			}
 		} else {
-			tempDir = await cloneWithGitHubFallback(parsed.url, options.branch || parsed.ref, spinner$3);
-			spinner$3.stop("仓库克隆完成");
-			spinner$3.start("正在发现技能...");
+			tempDir = await cloneWithGitHubFallback(parsed.url, options.branch || parsed.ref, spinner$4);
+			spinner$4.stop("仓库克隆完成");
+			spinner$4.start("正在发现技能...");
 			skills = await discoverSkills(tempDir, parsed.subpath, {
 				includeInternal,
 				fullDepth: options.fullDepth
 			});
 		}
 		if (skills.length === 0) {
-			spinner$3.stop(import_picocolors.default.red("未找到技能"));
+			spinner$4.stop(import_picocolors.default.red("未找到技能"));
 			outro(import_picocolors.default.red("未找到有效技能。技能需要包含 name 和 description 的 SKILL.md 文件。"));
 			await cleanup(tempDir);
 			process.exit(1);
 		}
-		if (!blobResult) spinner$3.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
+		if (!blobResult) spinner$4.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
 		if (options.list) {
 			console.log();
 			log.step(import_picocolors.default.bold("可用技能"));
@@ -3800,10 +3818,10 @@ async function runAdd(args, options = {}) {
 			}
 			targetAgents = options.agent;
 		} else {
-			spinner$3.start("正在加载 Agent...");
+			spinner$4.start("正在加载 Agent...");
 			const installedAgents = await detectInstalledAgents();
 			const totalAgents = Object.keys(agents).length;
-			spinner$3.stop(`${totalAgents} agents`);
+			spinner$4.stop(`${totalAgents} agents`);
 			if (installedAgents.includes("eve") && (options.yes || !agentResult.isAgent)) {
 				const useEve = options.yes ? true : await confirm({
 					message: formatEveInstallPromptMessage(selectedSkills),
@@ -4005,7 +4023,7 @@ async function runAdd(args, options = {}) {
 				process.exit(0);
 			}
 		}
-		spinner$3.start("正在安装技能...");
+		spinner$4.start("正在安装技能...");
 		const results = [];
 		for (const skill of selectedSkills) for (const target of installTargets) {
 			const { agent, subagent } = target;
@@ -4042,7 +4060,7 @@ async function runAdd(args, options = {}) {
 				...result
 			});
 		}
-		spinner$3.stop("安装完成");
+		spinner$4.stop("安装完成");
 		console.log();
 		const successful = results.filter((r) => r.success);
 		const failed = results.filter((r) => !r.success);
@@ -4712,12 +4730,12 @@ async function removeCommand(skillNames, options) {
 	}
 	const isGlobal = options.global ?? false;
 	const cwd = process.cwd();
-	const spinner$2 = spinner();
-	spinner$2.start("正在扫描已安装的技能...");
+	const spinner$3 = spinner();
+	spinner$3.start("正在扫描已安装的技能...");
 	const skillNamesSet = /* @__PURE__ */ new Set();
 	const scanDir = async (dir) => {
 		try {
-			const entries = await readdir(dir, { withFileTypes: true });
+			const entries = await readdir$1(dir, { withFileTypes: true });
 			for (const entry of entries) if (entry.isDirectory()) skillNamesSet.add(entry.name);
 		} catch (err) {
 			if (err instanceof Error && err.code !== "ENOENT") log.warn(`Could not scan directory ${dir}: ${err.message}`);
@@ -4732,7 +4750,7 @@ async function removeCommand(skillNames, options) {
 		for (const subagent of getEveSubagents(cwd)) await scanDir(getEveSubagentSkillsDir(subagent, cwd));
 	}
 	const installedSkills = Array.from(skillNamesSet).sort();
-	spinner$2.stop(`发现 ${installedSkills.length} 个已安装技能`);
+	spinner$3.stop(`发现 ${installedSkills.length} 个已安装技能`);
 	if (installedSkills.length === 0) {
 		outro(import_picocolors.default.yellow("没有可卸载的技能。"));
 		return { removed: [] };
@@ -4774,7 +4792,7 @@ async function removeCommand(skillNames, options) {
 	if (options.agent && options.agent.length > 0) targetAgents = options.agent;
 	else {
 		targetAgents = Object.keys(agents);
-		spinner$2.stop(`Targeting ${targetAgents.length} potential agent(s)`);
+		spinner$3.stop(`Targeting ${targetAgents.length} potential agent(s)`);
 	}
 	const { assertLegacyUnmanaged } = await import("./_chunks/ownership.mjs");
 	await assertLegacyUnmanaged(selectedSkills.flatMap((skill) => [getCanonicalPath(skill, {
@@ -4795,7 +4813,7 @@ async function removeCommand(skillNames, options) {
 			process.exit(0);
 		}
 	}
-	spinner$2.start("正在卸载技能...");
+	spinner$3.start("正在卸载技能...");
 	const results = [];
 	for (const skillName of selectedSkills) try {
 		const canonicalPath = getCanonicalPath(skillName, {
@@ -4818,7 +4836,7 @@ async function removeCommand(skillNames, options) {
 			for (const pathToCleanup of pathsToCleanup) {
 				if (pathToCleanup === canonicalPath) continue;
 				try {
-					if (await lstat(pathToCleanup).catch(() => null)) await rm(pathToCleanup, {
+					if (await lstat$1(pathToCleanup).catch(() => null)) await rm$1(pathToCleanup, {
 						recursive: true,
 						force: true
 					});
@@ -4835,12 +4853,12 @@ async function removeCommand(skillNames, options) {
 				global: isGlobal,
 				cwd
 			});
-			if (await lstat(path).catch(() => null)) {
+			if (await lstat$1(path).catch(() => null)) {
 				isStillUsed = true;
 				break;
 			}
 		}
-		if (!isStillUsed) await rm(canonicalPath, {
+		if (!isStillUsed) await rm$1(canonicalPath, {
 			recursive: true,
 			force: true
 		});
@@ -4861,7 +4879,7 @@ async function removeCommand(skillNames, options) {
 			error: err instanceof Error ? err.message : String(err)
 		});
 	}
-	spinner$2.stop("卸载完成");
+	spinner$3.stop("卸载完成");
 	const successful = results.filter((r) => r.success);
 	const failed = results.filter((r) => !r.success);
 	if (successful.length > 0) {
@@ -5496,7 +5514,20 @@ async function runUpdate(args = []) {
 		totalFail += failCount;
 		totalFound += foundCount;
 	}
-	if (options.skills && totalFound === 0) console.log(`${DIM$9}未找到匹配的已安装技能：${options.skills.join(", ")}${RESET$9}`);
+	if (options.skills && totalFound === 0) {
+		console.log(`${DIM$9}未找到安装记录，按首次安装重新获取：${options.skills.join(", ")}${RESET$9}`);
+		const { runAdd } = await Promise.resolve().then(() => add_exports);
+		for (const skill of options.skills) try {
+			await runAdd([skill], {
+				yes: true,
+				global: options.global || scope === "global"
+			});
+			totalSuccess += 1;
+		} catch (error) {
+			totalFail += 1;
+			console.log(`${DIM$9}✗ ${skill}：${error instanceof Error ? error.message : "安装失败"}${RESET$9}`);
+		}
+	}
 	console.log();
 	if (totalSuccess > 0) console.log(`${TEXT$7}✓ 已更新 ${totalSuccess} 个技能${RESET$9}`);
 	if (totalFail > 0) {
@@ -5583,14 +5614,14 @@ async function materializeUseSkill(skill) {
 	const tempRoot = await mkdtemp(join(tmpdir(), "skills-use-"));
 	const skillDir = join(tempRoot, sanitizeName(skill.directoryName || skill.name));
 	if (!isPathSafe(tempRoot, skillDir)) throw new Error("Invalid skill name: potential path traversal detected");
-	await mkdir(skillDir, { recursive: true });
+	await mkdir$1(skillDir, { recursive: true });
 	if (skill.kind === "blob") await writeSnapshotFiles(skillDir, skill.files);
 	else if (skill.kind === "well-known") await writeMapFiles(skillDir, skill.files);
 	else await copySkillDirectory(skill.path, skillDir);
 	return {
 		tempRoot,
 		skillDir,
-		skillMd: skill.rawContent ?? await readFile(join(skillDir, "SKILL.md"), "utf-8"),
+		skillMd: skill.rawContent ?? await readFile$1(join(skillDir, "SKILL.md"), "utf-8"),
 		hasSupportingFiles: await containsSupportingFiles(skillDir, skillDir)
 	};
 }
@@ -5806,13 +5837,13 @@ async function writeMapFiles(targetDir, files) {
 async function writeSafeFile(targetDir, filePath, contents) {
 	const fullPath = join(targetDir, filePath);
 	if (!isPathSafe(targetDir, fullPath)) return;
-	await mkdir(dirname(fullPath), { recursive: true });
-	if (typeof contents === "string") await writeFile(fullPath, contents, "utf-8");
-	else await writeFile(fullPath, contents);
+	await mkdir$1(dirname(fullPath), { recursive: true });
+	if (typeof contents === "string") await writeFile$1(fullPath, contents, "utf-8");
+	else await writeFile$1(fullPath, contents);
 }
 async function copySkillDirectory(src, dest) {
-	await mkdir(dest, { recursive: true });
-	const entries = await readdir(src, { withFileTypes: true });
+	await mkdir$1(dest, { recursive: true });
+	const entries = await readdir$1(src, { withFileTypes: true });
 	await Promise.all(entries.filter((entry) => !isExcluded(entry.name, entry.isDirectory())).map(async (entry) => {
 		const srcPath = join(src, entry.name);
 		const destPath = join(dest, entry.name);
@@ -5822,7 +5853,7 @@ async function copySkillDirectory(src, dest) {
 			return;
 		}
 		try {
-			await cp(srcPath, destPath, {
+			await cp$1(srcPath, destPath, {
 				dereference: true,
 				recursive: true
 			});
@@ -5836,7 +5867,7 @@ async function copySkillDirectory(src, dest) {
 	}));
 }
 async function containsSupportingFiles(rootDir, currentDir) {
-	const entries = await readdir(currentDir, { withFileTypes: true });
+	const entries = await readdir$1(currentDir, { withFileTypes: true });
 	for (const entry of entries) {
 		const entryPath = join(currentDir, entry.name);
 		const relPath = relative(rootDir, entryPath).split(sep).join("/");
@@ -6966,6 +6997,673 @@ function maybePrintAnalyticsNotice(env = process.env) {
 		console.log();
 	} catch {}
 }
+function registryUrl(value) {
+	const url = new URL(value);
+	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error("无效的 registry 地址。");
+	return url.toString().replace(/\/$/, "");
+}
+function credentialForRegistry(registry, config) {
+	return config?.token && registryUrl(registry) === registryUrl(config.registry ?? "https://bfi.yyuap.com:811") ? config.token : void 0;
+}
+async function readResponse(response, limit) {
+	const chunks = [];
+	let size = 0;
+	if (!response.body) throw new Error("服务返回空响应。");
+	const reader = response.body.getReader();
+	try {
+		while (true) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			size += chunk.value.length;
+			if (size > limit) throw new Error("响应超过安全大小上限。");
+			chunks.push(chunk.value);
+		}
+	} finally {
+		await reader.cancel().catch(() => {});
+	}
+	return Buffer.concat(chunks);
+}
+var InstallationClient = class {
+	registry;
+	token;
+	fetcher;
+	constructor(registry, token, fetcher = fetch) {
+		this.registry = registryUrl(registry);
+		this.token = token;
+		this.fetcher = fetcher;
+	}
+	async request(path, method = "GET", body) {
+		const headers = { Accept: "application/json" };
+		if (this.token) headers.Authorization = `Bearer ${this.token}`;
+		if (method === "POST") {
+			headers["Content-Type"] = "application/json";
+			if (!this.token) {
+				const initial = await this.request("/api/web/mcps?size=1");
+				const cookie = initial.headers.get("set-cookie")?.match(/(?:^|,\s*)XSRF-TOKEN=([^;]+)/)?.[1];
+				await initial.body?.cancel();
+				if (!cookie) throw new Error("无法获取匿名 CSRF 凭据，请检查服务配置。");
+				headers.Cookie = `XSRF-TOKEN=${cookie}`;
+				headers["X-XSRF-TOKEN"] = decodeURIComponent(cookie);
+			}
+		}
+		let response;
+		try {
+			response = await this.fetcher(`${this.registry}${path}`, {
+				method,
+				headers,
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				redirect: "error",
+				signal: AbortSignal.timeout(12e4)
+			});
+		} catch {
+			throw new Error("网络连接失败或服务重定向；未转发登录凭据。");
+		}
+		if (response.status === 401) throw new Error("登录无效或需要登录，请运行 bfi auth login 后重试。");
+		if (response.status === 403) throw new Error("权限不足或 CSRF 校验失败；不会覆盖现有登录。");
+		if (response.status >= 300 && response.status < 400) throw new Error("不允许服务重定向。");
+		if (!response.ok) throw new Error(`安装服务请求失败（HTTP ${response.status}），请检查权限、计划有效期和服务版本。`);
+		return response;
+	}
+	async plan(response, kind, ref, id) {
+		const envelope = JSON.parse((await readResponse(response, 12 * 1024 ** 2)).toString("utf8"));
+		if (envelope.code !== 0) throw new Error("安装服务拒绝请求。");
+		const plan = verifyPlan(envelope.data);
+		if (registryUrl(plan.registry) !== this.registry || plan.kind !== kind || plan.ref !== ref || id && plan.id !== id) throw new Error("计划与请求来源或资源不匹配。");
+		if (Date.parse(plan.expiresAt) <= Date.now()) throw new Error("内容计划已过期，请重新确认最新内容。");
+		return plan;
+	}
+	async resolve(kind, ref) {
+		return this.plan(await this.request("/api/v1/installation-content-plans", "POST", {
+			kind,
+			ref
+		}), kind, ref);
+	}
+	async get(id, kind, ref) {
+		return this.plan(await this.request(`/api/v1/installation-content-plans/${encodeURIComponent(id)}`), kind, ref, id);
+	}
+	async artifact(plan) {
+		const response = await this.request(`/api/v1/installation-content-plans/${encodeURIComponent(plan.id)}/artifact`);
+		const bytes = await readResponse(response, 510 * 1024 ** 2);
+		if (response.headers.get("X-Archive-SHA256") !== hash(bytes)) throw new Error("下载归档摘要不匹配。");
+		return bytes;
+	}
+	async verifyAccount() {
+		if (!this.token) throw new Error("BFI MCP 需要本机登录态，请先运行 bfi auth login；不会把 Token 写进 MCP 配置。");
+		const response = await this.request("/api/v1/whoami");
+		let envelope;
+		try {
+			envelope = JSON.parse((await readResponse(response, 1048576)).toString("utf8"));
+		} catch {
+			throw new Error("本机 BFI 登录响应无效；未覆盖现有登录。");
+		}
+		if (!envelope || typeof envelope !== "object") throw new Error("本机 BFI 登录响应无效。");
+		if (envelope.code !== void 0 && envelope.code !== 0) throw new Error("本机 BFI 登录态验证失败。");
+		const data = envelope.data ?? envelope;
+		if (!data?.id && !data?.user?.id) throw new Error("本机 BFI 登录响应无效。");
+	}
+};
+function printArchiveHeaders(globalOpts) {
+	const { registry } = resolveConfig(globalOpts);
+	const token = typeof globalOpts.token === "string" ? globalOpts.token : credentialForRegistry(registry, loadGlobalConfig());
+	if (!token) throw new Error("BFI_TOKEN_REQUIRED: run bfi auth login first");
+	console.log(JSON.stringify({ Authorization: `Bearer ${token}` }));
+}
+async function addClaudeMarketplace(namespace, globalOpts) {
+	const { registry } = resolveConfig(globalOpts);
+	const base = normalizeRegistry(String(registry));
+	const url = `${base}/api/web/namespaces/${encodeURIComponent(namespace)}/plugin-marketplace.json`;
+	const market = `skillhub-${namespace}`;
+	const path = join$1(homedir$1(), ".claude", "settings.json");
+	const existing = await readFile(path, "utf8").then(JSON.parse).catch(() => ({}));
+	if (!existing || typeof existing !== "object" || Array.isArray(existing)) throw new Error("CLAUDE_SETTINGS_INVALID");
+	const known = { ...existing.extraKnownMarketplaces };
+	known[market] = { source: {
+		source: "url",
+		url,
+		headersHelper: `bfi skills package archive-headers --registry ${base}`
+	} };
+	existing.extraKnownMarketplaces = known;
+	await mkdir(dirname$1(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.${process.pid}.tmp`;
+	await writeFile(temporary, JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+	await rename(temporary, path);
+	return {
+		market,
+		url,
+		settings: path,
+		next: `claude plugin install <plugin>@${market} --scope user`,
+		message: "Claude Code 将通过 headersHelper 使用 bfi 当前登录态读取市场和归档；安装后可用 claude plugin update 更新。"
+	};
+}
+var package_skill_identity_exports = /* @__PURE__ */ __exportAll({
+	packageSkillName: () => packageSkillName,
+	scopePackageSkill: () => scopePackageSkill
+});
+function packageSkillName(namespace, slug) {
+	if (!namespace || !slug) throw new Error("Namespace and slug are required");
+	return `bfi-skill-${createHash("sha256").update(JSON.stringify([namespace, slug])).digest("hex")}`;
+}
+function scopePackageSkill(skills, namespace, slug) {
+	if (skills.length !== 1) throw new Error("A package reference must resolve to exactly one skill");
+	return [{
+		...skills[0],
+		name: packageSkillName(namespace, slug)
+	}];
+}
+function checkNode(node) {
+	if (node.type === "object") {
+		const keys = (node.children ?? []).map((child) => String(child.children?.[0]?.value));
+		if (keys.length !== new Set(keys).size || keys.some((key) => [
+			"__proto__",
+			"prototype",
+			"constructor"
+		].includes(key))) throw new Error("配置包含重复键或不安全键，拒绝修改。");
+	}
+	node.children?.forEach(checkNode);
+}
+function readDocument(text, format) {
+	if (!text.trim()) return {};
+	try {
+		if (format === "toml") return object(parse$1(text));
+		const errors = [];
+		const tree = parseTree(text, errors, {
+			allowTrailingComma: true,
+			disallowComments: false
+		});
+		if (!tree || errors.length) throw new Error();
+		checkNode(tree);
+		return object(JSON.parse(JSON.stringify(getNodeValue(tree))));
+	} catch {
+		throw new Error("现有配置解析失败，未修改任何内容。请先修复配置格式或重复键。");
+	}
+}
+function serversIn(document, path) {
+	let current = document;
+	for (const key of path) {
+		if (current[key] === void 0) return {};
+		current = object(current[key], "MCP 配置节点");
+	}
+	return current;
+}
+function tablePath(line) {
+	if (!/^\s*\[[^[]/.test(line)) return;
+	try {
+		let value = parse$1(`${line}\n__bfi_table_marker__ = true\n`);
+		const path = [];
+		while (value && typeof value === "object") {
+			const entries = Object.entries(value);
+			if (entries.length !== 1) return;
+			const [key, next] = entries[0];
+			if (key === "__bfi_table_marker__") return path;
+			path.push(key);
+			value = next;
+		}
+	} catch {
+		return;
+	}
+}
+function editToml(text, replacements) {
+	const lines = text.split(/(?<=\n)/);
+	const starts = [];
+	let offset = 0;
+	for (const line of lines) {
+		if (/^\s*\[/.test(line)) starts.push({
+			offset,
+			path: tablePath(line.trim())
+		});
+		offset += line.length;
+	}
+	const existing = serversIn(readDocument(text, "toml"), ["mcp_servers"]);
+	const ranges = [];
+	for (const name of Object.keys(replacements)) {
+		const matches = starts.flatMap((start, index) => start.path?.[0] === "mcp_servers" && start.path[1] === name ? [[start.offset, starts[index + 1]?.offset ?? text.length]] : []);
+		if (existing[name] !== void 0 && !matches.length) throw new Error("目标 MCP 使用内联或复杂 TOML 定义，无法安全增量更新；请先改为独立 [mcp_servers.\"name\"] 表。");
+		ranges.push(...matches);
+	}
+	let result = text;
+	for (const [start, end] of ranges.sort((left, right) => right[0] - left[0])) result = result.slice(0, start) + result.slice(end);
+	for (const [name, config] of Object.entries(replacements)) if (config !== void 0) result += `${result.endsWith("\n") || !result ? "" : "\n"}\n${stringify({ mcp_servers: { [name]: config } }).replace(/^\[mcp_servers\]\r?\n/m, "")}`;
+	if (!readDocument(result, "toml").mcp_servers) result += "\n[mcp_servers]\n";
+	return result;
+}
+function editDocument(text, format, path, replacements) {
+	serversIn(readDocument(text, format), path);
+	const expected = readDocument(text, format);
+	let parent = expected;
+	for (const key of path) parent = object(parent[key] ?? (parent[key] = {}));
+	for (const [name, value] of Object.entries(replacements)) if (value === void 0) delete parent[name];
+	else parent[name] = value;
+	let result = text.trim() ? text : format === "jsonc" ? "{}\n" : "";
+	if (format === "toml") result = editToml(result, replacements);
+	else for (const [name, value] of Object.entries(replacements)) result = applyEdits(result, modify(result, [...path, name], value, { formattingOptions: {
+		insertSpaces: true,
+		tabSize: 2,
+		eol: text.includes("\r\n") ? "\r\n" : "\n"
+	} }));
+	if (!isDeepStrictEqual(readDocument(result, format), expected)) throw new Error("配置保留校验失败，未写入；请使用客户端原生配置处理复杂结构。");
+	return result;
+}
+const agentIds = [
+	"claude-code",
+	"codex",
+	"cursor",
+	"qwen-code",
+	"gemini-cli",
+	"zcode",
+	"codebuddy",
+	"kimi-code",
+	"opencode"
+];
+const aliases = {
+	claude: "claude-code",
+	qwen: "qwen-code",
+	gemini: "gemini-cli",
+	kimi: "kimi-code",
+	"kimi-cli": "kimi-code",
+	"codebuddy-code": "codebuddy"
+};
+function preferred(paths) {
+	return paths.find((filename) => existsSync$1(filename)) ?? paths[0];
+}
+function targetFor(name, scope = "user", options = {}) {
+	const agent = aliases[name] ?? name;
+	if (!agentIds.includes(agent)) throw new Error(`尚未支持该 Agent 的自动配置。支持：${agentIds.join(", ")}。WorkBuddy/IDE 专有配置请使用原生导入，不猜测路径。`);
+	const home = options.home ?? homedir$1();
+	const cwd = options.cwd ?? process.cwd();
+	const env = options.env ?? process.env;
+	const user = scope === "user";
+	const paths = {
+		"claude-code": [user ? join$1(home, ".claude.json") : join$1(cwd, ".mcp.json")],
+		codex: [user ? join$1(env.CODEX_HOME ?? join$1(home, ".codex"), "config.toml") : join$1(cwd, ".codex/config.toml")],
+		cursor: [join$1(user ? home : cwd, ".cursor/mcp.json")],
+		"qwen-code": [join$1(user ? home : cwd, ".qwen/settings.json")],
+		"gemini-cli": [join$1(user ? home : cwd, ".gemini/settings.json")],
+		zcode: [join$1(user ? home : cwd, user ? ".zcode/cli/config.json" : ".zcode/config.json")],
+		codebuddy: user ? [
+			join$1(home, ".codebuddy/.mcp.json"),
+			join$1(home, ".codebuddy/mcp.json"),
+			join$1(home, ".codebuddy.json")
+		] : [join$1(cwd, ".mcp.json"), join$1(cwd, "mcp.json")],
+		"kimi-code": [join$1(user ? env.KIMI_CODE_HOME ?? join$1(home, ".kimi-code") : join$1(cwd, ".kimi-code"), "mcp.json")],
+		opencode: [join$1(user ? env.XDG_CONFIG_HOME ? join$1(env.XDG_CONFIG_HOME, "opencode") : join$1(home, ".config/opencode") : cwd, "opencode.jsonc"), join$1(user ? env.XDG_CONFIG_HOME ? join$1(env.XDG_CONFIG_HOME, "opencode") : join$1(home, ".config/opencode") : cwd, "opencode.json")]
+	};
+	if (agent === "claude-code" && env.CLAUDE_CONFIG_DIR && !options.config) throw new Error("设置了 CLAUDE_CONFIG_DIR；请用 --config 明确 MCP 文件，避免改错作用域。");
+	if (agent === "kimi-code" && user && !env.KIMI_CODE_HOME && !existsSync$1(join$1(home, ".kimi-code")) && existsSync$1(join$1(home, ".kimi/mcp.json")) && !options.config) throw new Error("检测到旧版 Kimi 配置，请核对版本后用 --config 明确文件；本适配器面向 .kimi-code 布局。");
+	return {
+		agent,
+		scope,
+		path: resolve$1(options.config ?? preferred(paths[agent])),
+		format: agent === "codex" ? "toml" : "jsonc",
+		key: agent === "codex" ? ["mcp_servers"] : agent === "opencode" ? ["mcp"] : agent === "zcode" ? ["mcp", "servers"] : ["mcpServers"]
+	};
+}
+function hasLiteralSecrets(config) {
+	const literal = (value) => !/^Bearer \$\{(?:user_config\.)?[A-Za-z_][A-Za-z0-9_]*\}$/i.test(value) && Boolean(value.replace(variablePattern, (_whole, _name, fallback) => fallback ?? "").trim());
+	const sensitive = /token|secret|password|api.?key|authorization|credential|private.?key|x-pm-(ak|sk)/i;
+	if (Object.entries(config.headers ?? {}).some(([key, value]) => !/^(accept|content-type|user-agent|x-pm-env|x-pm-product-line)$/i.test(key) && literal(value))) return true;
+	if (Object.entries(config.env ?? {}).some(([key, value]) => sensitive.test(key) && literal(value))) return true;
+	if ((config.args ?? []).some((value, index, args) => /^--?(token|password|secret|api-key)(=|$)/i.test(value) && literal(value.includes("=") ? value.split("=").slice(1).join("=") : args[index + 1] ?? ""))) return true;
+	if (config.url) {
+		if ([...new URL(config.url.replace(variablePattern, "__BFI_VARIABLE__")).searchParams].some(([key, value]) => sensitive.test(key) && value.replaceAll("__BFI_VARIABLE__", ""))) return true;
+	}
+	return false;
+}
+function encodeServer(config, target, bindings = {}, materialize = false, environment = process.env) {
+	if (config.cwd && ![
+		"codex",
+		"qwen-code",
+		"gemini-cli",
+		"kimi-code"
+	].includes(target.agent)) throw new Error("此宿主的 MCP cwd 字段未支持或未确证；请提供不依赖 cwd 的启动配置。");
+	if (Object.values(bindings).some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) throw new Error("环境变量绑定名称无效。");
+	if (materialize && target.scope !== "user") throw new Error("凭据物化仅允许用户级配置，项目级配置只能保存引用。");
+	if (hasLiteralSecrets(config) && !materialize) throw new Error("源配置可能含明文凭据；请改为环境变量占位符，或显式选择用户级 --materialize-inputs。");
+	let value = materialize ? resolveVariables(config, bindings, environment) : config;
+	if (variables(value).length && ["zcode", "kimi-code"].includes(target.agent)) throw new Error("该宿主的通用变量插值未确证。请使用用户级 --materialize-inputs，或原生秘密配置；不会保存无效占位符。");
+	if (!materialize && target.agent !== "codex") value = mapStrings(value, (text) => text.replace(variablePattern, (_whole, key, fallback) => {
+		const name = bindings[key] ?? key;
+		if (fallback !== void 0 && !["claude-code", "codebuddy"].includes(target.agent)) throw new Error("此宿主不支持带默认值的变量引用。");
+		if (target.agent === "cursor") return `\${env:${name}}`;
+		if (target.agent === "opencode") return `{env:${name}}`;
+		return `\${${name}${fallback === void 0 ? "" : `:-${fallback}`}}`;
+	}));
+	const { type, ...rest } = value;
+	if (target.agent === "codex") {
+		if (type === "sse") throw new Error("Codex 不支持旧 SSE 配置；请提供 Streamable HTTP 服务。");
+		const result = {};
+		if (type === "stdio") {
+			result.command = value.command;
+			if (value.args) result.args = value.args;
+			if (value.cwd) result.cwd = value.cwd;
+			const env = {};
+			const inherited = [];
+			for (const [name, text] of Object.entries(value.env ?? {})) {
+				const match = /^\$\{(?:user_config\.)?([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(text);
+				if (match && (bindings[match[1]] ?? match[1]) === name) inherited.push(name);
+				else if (text.includes("${")) throw new Error("Codex env_vars 不能重命名或拼接变量；请使用同名环境变量或用户级物化。");
+				else env[name] = text;
+			}
+			if (Object.keys(env).length) result.env = env;
+			if (inherited.length) result.env_vars = inherited;
+			if ([
+				value.command,
+				value.cwd,
+				...value.args ?? []
+			].some((item) => item?.includes("${"))) throw new Error("Codex command/args/cwd 不支持变量插值。");
+		} else {
+			result.url = value.url;
+			if (value.url?.includes("${")) throw new Error("Codex URL 不支持变量插值。");
+			const literal = {};
+			const inherited = {};
+			for (const [header, text] of Object.entries(value.headers ?? {})) {
+				const match = /^\$\{(?:user_config\.)?([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(text);
+				const bearer = /^Bearer \$\{(?:user_config\.)?([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(text);
+				if (match) inherited[header] = bindings[match[1]] ?? match[1];
+				else if (header.toLowerCase() === "authorization" && bearer) result.bearer_token_env_var = bindings[bearer[1]] ?? bearer[1];
+				else if (text.includes("${")) throw new Error("Codex header 只支持整值环境引用或 Bearer 引用，不支持拼接。");
+				else literal[header] = text;
+			}
+			if (Object.keys(literal).length) result.http_headers = literal;
+			if (Object.keys(inherited).length) result.env_http_headers = inherited;
+		}
+		return result;
+	}
+	if (target.agent === "opencode") {
+		if (value.cwd) throw new Error("OpenCode MCP 无独立 cwd 字段；请提供绝对启动路径。");
+		return type === "stdio" ? {
+			type: "local",
+			command: [value.command, ...value.args ?? []],
+			...value.env ? { environment: value.env } : {}
+		} : {
+			type: "remote",
+			url: value.url,
+			...value.headers ? { headers: value.headers } : {}
+		};
+	}
+	if (["qwen-code", "gemini-cli"].includes(target.agent)) {
+		const { url, ...fields } = rest;
+		return {
+			...fields,
+			...url ? { [type === "http" ? "httpUrl" : "url"]: url } : {}
+		};
+	}
+	if (target.agent === "cursor") return rest;
+	if (target.agent === "kimi-code") return {
+		...rest,
+		...type === "sse" ? { transport: "sse" } : {}
+	};
+	return {
+		type,
+		...rest
+	};
+}
+const managedKeys = /* @__PURE__ */ new Set([
+	"type",
+	"transport",
+	"command",
+	"args",
+	"env",
+	"environment",
+	"cwd",
+	"url",
+	"httpUrl",
+	"headers",
+	"http_headers",
+	"env_http_headers",
+	"env_vars",
+	"bearer_token_env_var"
+]);
+function mergeServer(existing, desired) {
+	if (existing === void 0) return desired;
+	const previous = object(existing, "已有 MCP");
+	const extras = Object.fromEntries(Object.entries(previous).filter(([key]) => !managedKeys.has(key)));
+	if ([
+		"oauth",
+		"auth",
+		"headersHelper",
+		"http_headers_helper",
+		"bearerTokenEnvVar",
+		"bearer_token"
+	].some((key) => extras[key] !== void 0) && [
+		"url",
+		"httpUrl",
+		"command",
+		"type",
+		"transport"
+	].some((key) => previous[key] !== desired[key])) throw new Error("已有服务器包含宿主专有认证设置，不能安全更换启动目标；请在客户端中处理。");
+	return {
+		...extras,
+		...desired
+	};
+}
+function decodeServer(raw, target) {
+	const source = object(raw, "MCP");
+	if (source.cwd && ![
+		"codex",
+		"qwen-code",
+		"gemini-cli",
+		"kimi-code"
+	].includes(target.agent)) throw new Error("此宿主 cwd 语义未确证，请使用客户端原生测试。");
+	if (source.enabled === false || source.disabled === true) throw new Error("此 MCP 已在客户端停用；测试不会绕过停用设置。");
+	if ([
+		"oauth",
+		"auth",
+		"headersHelper",
+		"http_headers_helper",
+		"bearer_token",
+		"bearerTokenEnvVar"
+	].some((key) => source[key] !== void 0)) throw new Error("此服务器使用宿主专有认证；请用客户端原生连接测试。");
+	let result = Object.fromEntries(Object.entries(source).filter(([key]) => managedKeys.has(key)));
+	if (target.agent === "codex") {
+		const { env_vars, env_http_headers, http_headers, bearer_token_env_var, ...rest } = result;
+		result = rest;
+		if (source.command) {
+			const env = { ...object(source.env ?? {}) };
+			if (env_vars !== void 0 && (!Array.isArray(env_vars) || !env_vars.every((item) => typeof item === "string"))) throw new Error("不支持的 Codex env_vars 结构。");
+			for (const name of env_vars ?? []) env[name] = `\${${name}}`;
+			if (Object.keys(env).length) result.env = env;
+		} else {
+			const headers = { ...object(http_headers ?? {}) };
+			for (const [name, variable] of Object.entries(object(env_http_headers ?? {}))) {
+				if (typeof variable !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(variable)) throw new Error("无效环境变量引用。");
+				headers[name] = `\${${variable}}`;
+			}
+			if (typeof bearer_token_env_var === "string") headers.Authorization = `Bearer \${${bearer_token_env_var}}`;
+			if (Object.keys(headers).length) result.headers = headers;
+		}
+	} else if (target.agent === "opencode") {
+		if (source.type === "local") {
+			if (!Array.isArray(source.command) || !source.command.length) throw new Error("OpenCode command 必须为非空数组。");
+			result = {
+				type: "stdio",
+				command: source.command[0],
+				args: source.command.slice(1),
+				...source.environment ? { env: source.environment } : {}
+			};
+		} else result = {
+			type: "http",
+			url: source.url,
+			...source.headers ? { headers: source.headers } : {}
+		};
+		result = mapStrings(result, (text) => text.replace(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, "${$1}"));
+	} else if (["qwen-code", "gemini-cli"].includes(target.agent)) {
+		const { httpUrl, ...rest } = result;
+		result = {
+			...rest,
+			...httpUrl ? {
+				type: "http",
+				url: httpUrl
+			} : source.url ? { type: "sse" } : {}
+		};
+	} else if (target.agent === "cursor") result = mapStrings(result, (text) => text.replace(/\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, "${$1}"));
+	return normalizeConfig(result);
+}
+async function checkPath(filename) {
+	let current = resolve$1(filename);
+	while (current !== parse(current).root) {
+		try {
+			const stat = await lstat(current);
+			if (stat.isSymbolicLink() || current === resolve$1(filename) && (!stat.isFile() || stat.nlink > 1)) throw new Error("配置路径含符号链接、特殊文件或硬链接，拒绝写入。");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		current = dirname$1(current);
+	}
+}
+async function readConfig(filename) {
+	await checkPath(filename);
+	try {
+		const handle = await open(filename, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+		try {
+			const stat = await handle.stat();
+			if (!stat.isFile() || stat.size > 2097152) throw new Error("配置文件不是普通文件或超过 2 MiB。");
+			return await handle.readFile("utf8");
+		} finally {
+			await handle.close();
+		}
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+}
+async function identity(filename) {
+	try {
+		const stat = await lstat(filename, { bigint: true });
+		return `${stat.dev}:${stat.ino}:${stat.mode}:${stat.mtimeNs}:${stat.size}`;
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+}
+async function writeConfig(filename, previous, next, expectedIdentity) {
+	if (previous === next) return;
+	await checkPath(filename);
+	const originalIdentity = expectedIdentity ?? await identity(filename);
+	if (previous !== void 0 && ((await lstat(filename)).mode & 128) === 0) throw new Error("配置文件只读，不放宽其权限。");
+	await mkdir(dirname$1(filename), {
+		recursive: true,
+		mode: 448
+	});
+	const lockPath = `${filename}.bfi-mcp.lock`;
+	const temporary = `${filename}.bfi-mcp-${randomUUID()}.tmp`;
+	const backup = previous === void 0 ? void 0 : `${filename}.bfi-mcp-${Date.now()}-${randomUUID()}.bak`;
+	let lock;
+	try {
+		lock = await open(lockPath, "wx", 384);
+	} catch {
+		throw new Error("无法取得配置写入锁。可能有其它安装正在进行；请核对残留 .bfi-mcp.lock 后重试。");
+	}
+	try {
+		await checkPath(filename);
+		if (await readConfig(filename) !== previous || await identity(filename) !== originalIdentity) throw new Error("配置已被其它进程修改，请重新预览并重试。");
+		if (backup) {
+			const handle = await open(backup, "wx", 384);
+			try {
+				await handle.writeFile(previous, "utf8");
+				await handle.sync();
+			} finally {
+				await handle.close();
+			}
+		}
+		const handle = await open(temporary, "wx", 384);
+		try {
+			await handle.writeFile(next, "utf8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		await checkPath(filename);
+		if (await readConfig(filename) !== previous || await identity(filename) !== originalIdentity) throw new Error("写入前检测到并发修改，已取消。");
+		await rename(temporary, filename);
+		return backup;
+	} finally {
+		await unlink(temporary).catch(() => {});
+		await lock.close().catch(() => {});
+		await unlink(lockPath).catch(() => {});
+	}
+}
+async function loadTarget(target) {
+	const fileIdentity = await identity(target.path);
+	const text = await readConfig(target.path);
+	if (await identity(target.path) !== fileIdentity) throw new Error("读取时配置发生变化，请重试。");
+	return {
+		text,
+		fileIdentity,
+		servers: serversIn(readDocument(text ?? "", target.format), target.key)
+	};
+}
+async function planInstall(target, entries, options = {}) {
+	if (!entries.length || entries.length > 100) throw new Error("每次需要选择 1–100 个 MCP。");
+	const names = entries.map((entry) => validName(entry.registrationName));
+	if (new Set(names).size !== names.length) throw new Error("安装列表包含重复名称。");
+	const knownVariables = new Set(entries.flatMap((entry) => variables(entry.config)));
+	if (Object.keys(options.bindings ?? {}).some((key) => !knownVariables.has(key))) throw new Error("环境绑定包含未使用的变量名，请检查 --input-env。");
+	for (const [server, bindings] of Object.entries(options.bindingsByServer ?? {})) {
+		const entry = entries.find((candidate) => candidate.registrationName === server);
+		if (!entry || Object.keys(bindings).some((key) => !variables(entry.config).includes(key))) throw new Error("服务器环境绑定包含未使用的名称。");
+	}
+	const { text, fileIdentity, servers } = await loadTarget(target);
+	const replacements = {};
+	const changes = [];
+	for (const entry of entries) {
+		if (entry.runtime?.source === "upload") throw new Error(`MCP ${entry.registrationName} 需要上传运行包。请先下载检查并准备本地启动路径，再用 --file 安装本地配置。`);
+		const name = entry.registrationName;
+		const bindings = {
+			...options.bindings,
+			...options.bindingsByServer?.[name]
+		};
+		const desired = encodeServer(entry.config, target, bindings, options.materialize, options.environment);
+		const merged = mergeServer(servers[name], desired);
+		const action = servers[name] === void 0 ? "add" : isDeepStrictEqual(servers[name], merged) ? "unchanged" : "replace";
+		if (action === "replace" && !options.replace) throw new Error(`同名 MCP ${name} 配置不同；未修改任何服务器。确认要替换其连接配置时使用 --replace。`);
+		if (action !== "unchanged") replacements[name] = merged;
+		changes.push({
+			name,
+			action,
+			transport: entry.config.type,
+			variables: variables(entry.config).map((key) => bindings[key] ?? key)
+		});
+	}
+	return {
+		target,
+		previous: text,
+		next: Object.keys(replacements).length ? editDocument(text ?? "", target.format, target.key, replacements) : text,
+		fileIdentity,
+		changes
+	};
+}
+async function planRemove(target, names) {
+	if (!names.length || names.length > 100) throw new Error("请明确指定 1–100 个要移除的 MCP。");
+	const { text, fileIdentity, servers } = await loadTarget(target);
+	const replacements = {};
+	const changes = [...new Set(names)].map((name) => {
+		validName(name);
+		const action = Object.hasOwn(servers, name) ? "remove" : "absent";
+		if (action === "remove") replacements[name] = void 0;
+		return {
+			name,
+			action
+		};
+	});
+	return {
+		target,
+		previous: text,
+		next: Object.keys(replacements).length ? editDocument(text ?? "", target.format, target.key, replacements) : text,
+		fileIdentity,
+		changes
+	};
+}
+async function applyPlan(plan) {
+	if (plan.previous === plan.next || plan.next === void 0) return { changed: false };
+	if (await identity(plan.target.path) !== plan.fileIdentity) throw new Error("配置在预览后发生变化，请重新运行；未写入。");
+	return {
+		changed: true,
+		backup: await writeConfig(plan.target.path, plan.previous, plan.next, plan.fileIdentity)
+	};
+}
 var package_exports = /* @__PURE__ */ __exportAll({ runPackage: () => runPackage });
 const RESET$3 = "\x1B[0m";
 const BOLD$1 = "\x1B[1m";
@@ -7007,6 +7705,12 @@ async function dispatchPackage(args, globalOpts) {
 		case "up":
 			await handleUpdate(args.slice(1), api, globalOpts);
 			break;
+		case "marketplace":
+			await handleMarketplace(args.slice(1), globalOpts);
+			break;
+		case "archive-headers":
+			printArchiveHeaders(globalOpts);
+			break;
 		case "search":
 			await handleSearch(args.slice(1), api, globalOpts);
 			break;
@@ -7136,7 +7840,7 @@ function buildTargetSummaryLines(targets, installMode) {
 	const subagentNames = targets.filter((t) => t.subagent).map(targetDisplayName);
 	const { universal, symlinked } = splitAgentsByType(rootAgents);
 	if (installMode === "symlink") {
-		if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("共享目录：")} ${formatList(universal, 3)}`);
+		if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("共享目录（共用 .agents/skills）：")} ${formatList(universal, 3)}`);
 		if (symlinked.length > 0) lines.push(`  ${import_picocolors.default.dim("符号链接 →")} ${formatList(symlinked)}`);
 		if (subagentNames.length > 0) lines.push(`  ${import_picocolors.default.dim("copy →")} ${formatList(subagentNames)}`);
 	} else {
@@ -7193,8 +7897,47 @@ async function handleInstall(args, api, globalOpts) {
 		console.log(`  ${DIM$3}• ${skill.displayName || skill.slug}${RESET$3}  ${DIM$3}${ref}${RESET$3}`);
 	}
 	console.log();
+	let mcpNames = [];
+	let mcpEntries = [];
+	try {
+		mcpNames = ((await api.getPackageMcps(namespace, slug))?.mcps ?? []).filter((entry) => entry?.mcpEntryId).map((entry) => entry.lastKnownName).filter((name) => typeof name === "string" && name.length > 0);
+	} catch {}
+	if (mcpNames.length > 0) {
+		try {
+			const { catalogEntries } = await import("./_chunks/registry.mjs");
+			const { registry } = resolveConfig(globalOpts);
+			mcpEntries = await catalogEntries(registry, mcpNames);
+		} catch {}
+		console.log(`${BOLD$1}关联 MCP（${mcpNames.length}）：${RESET$3}`);
+		for (const name of mcpNames) {
+			const entry = mcpEntries.find((item) => item.registrationName === name);
+			const keys = entry ? variables(entry.config) : [];
+			console.log(`  ${DIM$3}• ${name}${keys.length > 0 ? `  变量：${keys.join("、")}` : ""}${RESET$3}`);
+		}
+		if (mcpEntries.length === 0) console.log(`  ${YELLOW$1}变量信息暂不可用，安装时会读取组合包内容。${RESET$3}`);
+		console.log();
+	}
+	const bindingsByServer = {};
+	const envNames = [];
+	const interactive = !isYes && !!process.stdin.isTTY && !!process.stdout.isTTY;
+	const promptBinding = async (entry, key) => {
+		let value;
+		do {
+			value = await password({ message: `${entry.registrationName}.${key}（输入不回显）` });
+			if (isCancel(value)) {
+				cancel("安装已取消");
+				process.exit(0);
+			}
+		} while (!String(value).trim());
+		const envName = `${entry.registrationName}_${key}`.replace(/[^A-Za-z0-9_]/g, "_").toUpperCase().replace(/^(?=[0-9])/, "_");
+		process.env[envName] = String(value);
+		(bindingsByServer[entry.registrationName] ??= {})[key] = envName;
+		if (!envNames.includes(envName)) envNames.push(envName);
+	};
+	if (interactive) for (const entry of mcpEntries) for (const key of variables(entry.config)) await promptBinding(entry, key);
 	let targetAgents;
 	let installGlobally;
+	let mcpGloballyOverride;
 	let installMode;
 	let eveSubagentTargets = [void 0];
 	if (requestedAgents) {
@@ -7240,7 +7983,11 @@ async function handleInstall(args, api, globalOpts) {
 				targetAgents = ["eve"];
 				console.log(`${DIM$3}安装到：eve agent${RESET$3}`);
 			} else {
-				const selected = await selectAgentsInteractive({ global: false });
+				const selected = await selectAgentsInteractive({
+					global: false,
+					useMemory: false,
+					preselectDetected: false
+				});
 				if (isCancel(selected)) {
 					cancel("安装已取消");
 					process.exit(0);
@@ -7262,7 +8009,11 @@ async function handleInstall(args, api, globalOpts) {
 			const firstAgent = installedAgents[0];
 			console.log(`${DIM$3}安装到：${agents[firstAgent].displayName}${RESET$3}`);
 		} else {
-			const selected = await selectAgentsInteractive({ global: false });
+			const selected = await selectAgentsInteractive({
+				global: false,
+				useMemory: false,
+				preselectDetected: false
+			});
 			if (isCancel(selected)) {
 				cancel("安装已取消");
 				process.exit(0);
@@ -7339,7 +8090,7 @@ async function handleInstall(args, api, globalOpts) {
 		const overwriteChecks = await Promise.all(skills.flatMap((skill) => installTargets.map(async (target) => ({
 			skillName: skill.slug,
 			target,
-			installed: await isSkillInstalled(packageSkillName(skill.namespace || namespace, skill.slug), target.agent, {
+			installed: await isSkillInstalled(skill.slug, target.agent, {
 				global: installGlobally,
 				eveSubagent: target.subagent
 			})
@@ -7349,6 +8100,17 @@ async function handleInstall(args, api, globalOpts) {
 			if (!overwriteStatus.has(skillName)) overwriteStatus.set(skillName, /* @__PURE__ */ new Map());
 			overwriteStatus.get(skillName).set(targetKey(target), installed);
 		}
+		if (envNames.length > 0 && !installGlobally) {
+			const choice = await confirm({
+				message: "项目级配置不能保存明文变量。是否将关联 MCP 写入用户级配置并保存输入值？",
+				initialValue: true
+			});
+			if (isCancel(choice)) {
+				cancel("安装已取消");
+				process.exit(0);
+			}
+			mcpGloballyOverride = !!choice;
+		}
 		const summaryLines = [];
 		for (const skill of skills) {
 			if (summaryLines.length > 0) summaryLines.push("");
@@ -7366,41 +8128,128 @@ async function handleInstall(args, api, globalOpts) {
 			process.exit(0);
 		}
 	}
-	const { runAdd } = await Promise.resolve().then(() => add_exports);
+	const mcpGlobally = mcpGloballyOverride ?? installGlobally;
+	const { mkdtemp, readdir, realpath, rm } = await import("node:fs/promises");
+	const { join } = await import("node:path");
+	const { extractZip } = await Promise.resolve().then(() => zip_exports);
+	const { discoverSkills } = await import("./_chunks/skills.mjs").then((n) => n.skills_exports);
+	const { installSkillForAgent } = await Promise.resolve().then(() => installer_exports);
 	const installedSkills = [];
 	const nonEveAgents = targetAgents.filter((a) => a !== "eve");
-	const runAddBaseOpts = {
-		registry: globalOpts.registry,
-		token: globalOpts.token,
-		packageSkill: true,
-		global: installGlobally,
-		copy: installMode === "copy",
-		yes: true
-	};
-	if (nonEveAgents.length > 0) runAddBaseOpts.agent = nonEveAgents;
-	if (targetAgents.includes("eve")) runAddBaseOpts.subagent = eveSubagentTargets.map((s) => s ?? "root");
-	for (const skill of skills) {
-		const skillRef = `@${skill.namespace || namespace}/${skill.slug}`;
-		console.log(`  ${DIM$3}正在安装 ${skillRef}...${RESET$3}`);
+	const universalTarget = targetAgents.find((agent) => isUniversalAgent(agent));
+	const installTargetsForInstall = [
+		...universalTarget ? [{ agent: universalTarget }] : [],
+		...targetAgents.filter((agent) => agent !== "eve" && !isUniversalAgent(agent)).map((agent) => ({ agent })),
+		...targetAgents.includes("eve") ? eveSubagentTargets.map((subagent) => ({
+			agent: "eve",
+			subagent
+		})) : []
+	];
+	const work = await mkdtemp(join(await realpath(os$1.tmpdir()), "bfi-package-"));
+	let mcpFile;
+	try {
+		const archive = join(work, "package.zip");
+		const unpack = join(work, "content");
+		const spinner$2 = spinner();
+		spinner$2.start("正在下载组合包...");
+		await api.downloadPackage(namespace, slug, archive);
+		spinner$2.message("正在解压组合包...");
+		await extractZip(archive, unpack);
+		spinner$2.stop("组合包已就绪，开始安装技能");
+		const entries = await readdir(unpack, { withFileTypes: true });
+		if (entries.some((entry) => entry.isFile() && entry.name === "mcp.json")) mcpFile = join(unpack, "mcp.json");
+		const directories = entries.filter((entry) => entry.isDirectory());
+		if (directories.length === 0) throw new Error("组合包中没有技能目录");
+		const installSpinner = spinner();
+		installSpinner.start("正在安装技能...");
+		const failures = [];
+		for (const directory of directories) {
+			const skill = skills.find((entry) => entry.slug === directory.name);
+			const skillRef = skill ? `@${skill.namespace || namespace}/${skill.slug}` : directory.name;
+			installSpinner.message(`正在安装 ${directory.name}`);
+			try {
+				const found = (await discoverSkills(join(unpack, directory.name)))[0];
+				if (!found) throw new Error("未找到有效的 SKILL.md");
+				const results = [];
+				for (const target of installTargetsForInstall) results.push(await installSkillForAgent(found, target.agent, {
+					global: installGlobally,
+					cwd: process.cwd(),
+					mode: installMode,
+					eveSubagent: target.subagent
+				}));
+				const failed = results.filter((result) => !result.success);
+				if (failed.length > 0) throw new Error(failed.map((result) => result.error).filter(Boolean).join("；") || "安装失败");
+				installedSkills.push({
+					ref: skillRef,
+					name: found.name || directory.name
+				});
+			} catch (error) {
+				failures.push(`${directory.name}：${error.message}`);
+			}
+		}
+		installSpinner.stop(`已安装 ${installedSkills.length}/${directories.length} 个技能`);
+		for (const failure of failures) log.error(failure);
+	} catch (error) {
+		await rm(work, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
+	let mcpJsonText;
+	if (mcpFile) try {
+		mcpJsonText = await readConfig(mcpFile);
+	} catch {
+		mcpJsonText = void 0;
+	}
+	await rm(work, {
+		recursive: true,
+		force: true
+	});
+	if (installedSkills.length > 0) {
+		let entries = [];
 		try {
-			await runAdd([skillRef], runAddBaseOpts);
-			const targets = targetAgents.flatMap((agent) => agent === "eve" ? eveSubagentTargets.map((subagent) => ({
-				agent,
-				subagent
-			})) : [{
-				agent,
-				subagent: void 0
-			}]);
-			const verified = await Promise.all(targets.map((target) => isSkillInstalled(packageSkillName(skill.namespace || namespace, skill.slug), target.agent, {
-				global: installGlobally,
-				eveSubagent: target.subagent
-			})));
-			if (verified.length === 0 || verified.some((result) => !result)) throw new Error("Skill installation could not be verified");
-			console.log(`  ${GREEN$2}✓ ${skill.slug}${RESET$3}`);
-			installedSkills.push(skillRef);
-		} catch (error) {
-			console.log(`  ${RED$1}✗ ${skill.slug}：${error.message}${RESET$3}`);
+			if (mcpJsonText) entries = entriesFromJson(readDocument(mcpJsonText, "jsonc"));
+		} catch {
+			entries = [];
 		}
+		if (entries.length === 0) entries = mcpEntries;
+		if (entries.length > 0) {
+			const scope = mcpGlobally ? "user" : "project";
+			if (interactive) {
+				for (const entry of entries) for (const key of variables(entry.config)) if (!bindingsByServer[entry.registrationName]?.[key]) await promptBinding(entry, key);
+			}
+			const supported = nonEveAgents.filter((agent) => agentIds.includes(agent));
+			const skipped = nonEveAgents.filter((agent) => !agentIds.includes(agent));
+			const lines = [];
+			let installedMcps = 0;
+			for (const agent of supported) try {
+				const plan = await planInstall(targetFor(agent, scope), entries, {
+					bindingsByServer,
+					materialize: scope === "user",
+					environment: process.env
+				});
+				const result = await applyPlan(plan);
+				const added = plan.changes.filter((change) => change.action === "add").length;
+				const replaced = plan.changes.filter((change) => change.action === "replace").length;
+				const unchanged = plan.changes.filter((change) => change.action === "unchanged").length;
+				lines.push(`${agent.padEnd(14)} ${[
+					added > 0 ? `新增 ${added}` : "",
+					replaced > 0 ? `更新 ${replaced}` : "",
+					unchanged > 0 ? `未变 ${unchanged}` : "",
+					result.changed ? "" : "无变化"
+				].filter(Boolean).join(" · ")}`);
+				installedMcps++;
+			} catch (error) {
+				lines.push(`${agent.padEnd(14)} ✗ ${error.message}`);
+			}
+			note(lines.join("\n"), `关联 MCP（${installedMcps}/${supported.length} 个 Agent）`);
+			if (skipped.length > 0) log.info(`未支持自动写入 MCP 的 Agent：${skipped.join(", ")}`);
+			if (scope === "project") {
+				const projectVariables = [...new Set(entries.flatMap((entry) => variables(entry.config).map((key) => bindingsByServer[entry.registrationName]?.[key] ?? key)))];
+				if (projectVariables.length > 0) log.info(`项目级 MCP 配置只保存变量引用：${projectVariables.map((name) => "${" + name + "}").join("、")}。请在启动 Agent 前导出这些环境变量；需要保存输入值时可在提示中选择写入用户级配置。`);
+			}
+		} else if (mcpNames.length > 0) log.warn("组合声明的 MCP 未能加载，请稍后重试或使用 bfi mcp install 单独安装。");
 	}
 	if (installedSkills.length === 0) {
 		console.log(`${YELLOW$1}没有确认安装成功的技能，未创建包安装记录${RESET$3}`);
@@ -7417,14 +8266,14 @@ async function handleInstall(args, api, globalOpts) {
 		version: pkgInfo.version || "latest",
 		skillCount: installedSkills.length
 	};
-	for (const skillRef of installedSkills) {
+	for (const { ref: skillRef, name } of installedSkills) {
 		const identity = parseSkillRef(skillRef);
 		const existing = lock.skills[skillRef];
 		lock.skills[skillRef] = {
 			...existing,
 			namespace: identity.namespace,
 			slug: identity.slug,
-			installedName: packageSkillName(identity.namespace, identity.slug),
+			installedName: name,
 			version: existing?.version || "latest",
 			package: {
 				namespace,
@@ -7433,15 +8282,7 @@ async function handleInstall(args, api, globalOpts) {
 		};
 	}
 	saveLockfile(cwd, lock);
-	try {
-		const mcpNames = ((await api.getPackageMcps(namespace, slug))?.mcps ?? []).filter((entry) => entry?.mcpEntryId).map((entry) => entry.lastKnownName).filter((name) => typeof name === "string" && name.length > 0);
-		if (mcpNames.length > 0) {
-			console.log();
-			console.log(`${DIM$3}该组合关联 MCP：${mcpNames.join("、")}${RESET$3}`);
-			console.log(`${DIM$3}安装 MCP：bfi mcp install ${mcpNames.join(" ")} --agent <agent>${RESET$3}`);
-		}
-	} catch {}
-	for (const skillRef of installedSkills) await reportInstallEventForSkill(api, {
+	for (const { ref: skillRef } of installedSkills) await reportInstallEventForSkill(api, {
 		skillId: skills.find((entry) => `@${entry.namespace || namespace}/${entry.slug}` === skillRef)?.skillId,
 		agentTarget: targetAgents[0]
 	});
@@ -7492,10 +8333,7 @@ async function handleUpdate(args, api, globalOpts) {
 	const pkgs = lock.packages || {};
 	if (pkgRef) {
 		const { namespace, slug } = parseSkillRef(pkgRef, globalOpts.namespace);
-		if (!pkgs[`@${namespace}/${slug}`]) {
-			console.log(`${YELLOW$1}包未安装：@${namespace}/${slug}${RESET$3}`);
-			return;
-		}
+		if (!pkgs[`@${namespace}/${slug}`]) console.log(`${DIM$3}未找到安装记录，按首次安装重新执行：@${namespace}/${slug}${RESET$3}`);
 		packagesToUpdate.push({
 			namespace,
 			slug
@@ -7530,6 +8368,12 @@ async function handleUpdate(args, api, globalOpts) {
 	}
 	console.log(`${GREEN$2}✓ 包更新完成${RESET$3}`);
 }
+async function handleMarketplace(args, globalOpts) {
+	const [action, namespace] = args;
+	if (action !== "add" || !namespace) throw new Error("用法：bfi skills package marketplace add <namespace>");
+	const result = await addClaudeMarketplace(namespace, globalOpts);
+	console.log(JSON.stringify(result, null, 2));
+}
 async function handleSearch(args, api, globalOpts) {
 	const query = args.filter((a) => !a.startsWith("--")).join(" ") || void 0;
 	const json = args.includes("--json");
@@ -9822,6 +10666,11 @@ ${BOLD}━━━ 技能包管理 ━━━${RESET}
     --prepare-native <dir>  准备完整原生目录和市场索引，审阅后交给宿主安装；不注册、不转技能
     --agent <a>      目标 agent（如 claude-code、codex、zcode）
     --global         安装到主目录（跨项目可用）
+  skills package download <ref> --as plugin [--output <file>] [--format zip|tgz|tar.gz]  下载并校验插件归档（不安装、不需要 --agent）
+  skills package prepare <ref> --as plugin --agent <a> [--dir <dir>]  生成版本化原生目录并更新市场索引
+  skills package update <ref> --as plugin [--agent <a>]  按默认安装版本重新下载/交接，不依赖安装记录
+  skills package marketplace add <namespace>  将命名空间注册为 Claude Code 市场（settings.json）
+  skills package archive-headers              输出 marketplace/归档所需的认证头（供 headersHelper 调用）
 
 ${BOLD}━━━ 文档 ━━━${RESET}
   docs upload <file>    上传文档
@@ -10288,4 +11137,4 @@ main().catch((e) => {
 	console.error(`✗ ${e?.message || e}`);
 	process.exit(1);
 });
-export { SkillHubAPI, getAgentBaseDir };
+export { InstallationClient, SkillHubAPI, agentIds, applyPlan, checkPath, credentialForRegistry, decodeServer, getAgentBaseDir, loadTarget, planInstall, planRemove, readConfig, readDocument, registryUrl, serversIn, targetFor, writeConfig };