holos-skillhub 0.1.0

package/dist/client.d.ts

@@ -0,0 +1,76 @@
+export interface LoginResult {
+    token: string;
+    username: string;
+}
+export interface UploadResult {
+    task_id: string;
+    skill_id: string;
+    sha256: string;
+    duplicate: boolean;
+    existing_audit_id?: string;
+}
+export interface StatusResult {
+    status: "PENDING" | "RUNNING" | "DONE" | "FAILED";
+    phase: string | null;
+    message: string | null;
+    scorecard_status: "approved" | "conditional" | "rejected" | null;
+}
+export interface SkillListItem {
+    id: string;
+    skill_id: string;
+    skill_name: string;
+    skill_description?: string;
+    scorecard_status: string | null;
+    status: string;
+    output_risk_tags: string[];
+    input_sensitivity_tags: string[];
+    source_type: string;
+    source_url?: string;
+    created_at: string;
+    completed_at?: string;
+    analysis_time_ms?: number;
+    uploaded_by?: string;
+}
+export interface SkillListResult {
+    total: number;
+    page: number;
+    page_size: number;
+    items: SkillListItem[];
+}
+export interface ListParams {
+    q?: string;
+    status?: string;
+    output_tag?: string[];
+    input_tag?: string[];
+    uploaded_by?: string;
+    page?: number;
+    page_size?: number;
+}
+export interface WsProgressEvent {
+    type: "progress" | "done" | "error" | "ping";
+    phase?: string;
+    percent?: number;
+    message?: string;
+    scorecard_status?: string;
+}
+export declare class HolosHubClient {
+    private server;
+    private token;
+    constructor(server: string, token: string);
+    private get headers();
+    private request;
+    login(username: string, password: string): Promise<LoginResult>;
+    uploadZip(zipPath: string, mode?: string): Promise<UploadResult>;
+    uploadFolder(dirPath: string, mode?: string): Promise<UploadResult>;
+    uploadGithub(githubUrl: string, mode?: string): Promise<UploadResult>;
+    getStatus(auditId: string): Promise<StatusResult>;
+    getSkill(auditId: string): Promise<SkillListItem & {
+        scorecard_status: string | null;
+    }>;
+    listSkills(params?: ListParams): Promise<SkillListResult>;
+    downloadReport(auditId: string, fmt: "json" | "md", outPath: string): Promise<void>;
+    downloadSkillZip(auditId: string, outPath: string): Promise<void>;
+    watchProgress(taskId: string, onEvent: (event: WsProgressEvent) => void): Promise<void>;
+    private _walkDir;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;CAClE;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAS;gBAEV,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAKzC,OAAO,KAAK,OAAO,GAKlB;YAEa,OAAO;IA4Cf,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAkB/D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAmBpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA0BvE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAMzE,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIjD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG;QAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAIvF,UAAU,CAAC,MAAM,GAAE,UAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAa7D,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAcV,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavE,aAAa,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,OAAO,CAAC,IAAI,CAAC;IA8BhB,OAAO,CAAC,QAAQ;CAcjB"}

package/dist/client.js

@@ -0,0 +1,208 @@
+import * as fs from "fs";
+import * as path from "path";
+import WebSocket from "ws";
+export class HolosHubClient {
+    server;
+    token;
+    constructor(server, token) {
+        this.server = server.replace(/\/$/, "");
+        this.token = token;
+    }
+    get headers() {
+        return {
+            Authorization: `Bearer ${this.token}`,
+            "Content-Type": "application/json",
+        };
+    }
+    async request(method, path, options = {}) {
+        const url = `${this.server}${path}`;
+        const headers = {
+            Authorization: `Bearer ${this.token}`,
+        };
+        if (options.body) {
+            headers["Content-Type"] = "application/json";
+        }
+        const res = await fetch(url, {
+            method,
+            headers,
+            body: options.body ?? undefined,
+        });
+        if (!res.ok) {
+            let detail = "";
+            try {
+                const text = await res.text();
+                try {
+                    const err = JSON.parse(text);
+                    detail = err.detail || text;
+                }
+                catch {
+                    detail = text;
+                }
+            }
+            catch {
+                detail = res.statusText;
+            }
+            throw new Error(`HTTP ${res.status}: ${detail || res.statusText}`);
+        }
+        if (options.stream) {
+            return res;
+        }
+        return res.json();
+    }
+    async login(username, password) {
+        const url = `${this.server}/api/auth/login`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ username, password }),
+        });
+        if (!res.ok) {
+            let detail = "";
+            try {
+                const err = await res.json();
+                detail = err.detail || "";
+            }
+            catch { }
+            throw new Error(`登录失败 HTTP ${res.status}: ${detail || res.statusText}`);
+        }
+        return res.json();
+    }
+    async uploadZip(zipPath, mode = "standard") {
+        const form = new FormData();
+        const content = fs.readFileSync(zipPath);
+        form.append("file", new Blob([content]), path.basename(zipPath));
+        form.append("mode", mode);
+        const url = `${this.server}/api/upload/zip`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${this.token}` },
+            body: form,
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({}));
+            throw new Error(`上传失败 HTTP ${res.status}: ${err.detail || res.statusText}`);
+        }
+        return res.json();
+    }
+    async uploadFolder(dirPath, mode = "standard") {
+        const form = new FormData();
+        form.append("mode", mode);
+        const absDir = path.resolve(dirPath);
+        const allFiles = this._walkDir(absDir);
+        for (const file of allFiles) {
+            const relPath = path.relative(absDir, file).split(path.sep).join("/");
+            const content = fs.readFileSync(file);
+            form.append("files", new Blob([content]), path.basename(file));
+            form.append("paths", relPath);
+        }
+        const url = `${this.server}/api/upload/folder`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${this.token}` },
+            body: form,
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({}));
+            throw new Error(`上传失败 HTTP ${res.status}: ${err.detail || res.statusText}`);
+        }
+        return res.json();
+    }
+    async uploadGithub(githubUrl, mode = "standard") {
+        return this.request("POST", "/api/upload/github", {
+            body: JSON.stringify({ github_url: githubUrl, mode }),
+        });
+    }
+    async getStatus(auditId) {
+        return this.request("GET", `/api/skills/${auditId}/status`);
+    }
+    async getSkill(auditId) {
+        return this.request("GET", `/api/skills/${auditId}`);
+    }
+    async listSkills(params = {}) {
+        const qs = new URLSearchParams();
+        if (params.q)
+            qs.set("q", params.q);
+        if (params.status)
+            qs.set("status", params.status);
+        if (params.output_tag)
+            params.output_tag.forEach((t) => qs.append("output_tag", t));
+        if (params.input_tag)
+            params.input_tag.forEach((t) => qs.append("input_tag", t));
+        if (params.uploaded_by)
+            qs.set("uploaded_by", params.uploaded_by);
+        if (params.page)
+            qs.set("page", String(params.page));
+        if (params.page_size)
+            qs.set("page_size", String(params.page_size));
+        return this.request("GET", `/api/skills/?${qs.toString()}`);
+    }
+    async downloadReport(auditId, fmt, outPath) {
+        const endpoint = fmt === "json" ? "json" : "markdown";
+        const url = `${this.server}/api/reports/${auditId}/${endpoint}`;
+        const res = await fetch(url, {
+            headers: { Authorization: `Bearer ${this.token}` },
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({}));
+            throw new Error(`下载报告失败 HTTP ${res.status}: ${err.detail || res.statusText}`);
+        }
+        const buffer = await res.arrayBuffer();
+        fs.writeFileSync(outPath, Buffer.from(buffer));
+    }
+    async downloadSkillZip(auditId, outPath) {
+        const url = `${this.server}/api/reports/${auditId}/zip`;
+        const res = await fetch(url, {
+            headers: { Authorization: `Bearer ${this.token}` },
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({}));
+            throw new Error(`下载 Skill zip 失败 HTTP ${res.status}: ${err.detail || res.statusText}`);
+        }
+        const buffer = await res.arrayBuffer();
+        fs.writeFileSync(outPath, Buffer.from(buffer));
+    }
+    watchProgress(taskId, onEvent) {
+        return new Promise((resolve, reject) => {
+            const wsUrl = this.server.replace(/^http/, "ws") + `/ws/audit/${taskId}`;
+            const ws = new WebSocket(wsUrl, {
+                headers: { Authorization: `Bearer ${this.token}` },
+            });
+            ws.on("message", (data) => {
+                try {
+                    const event = JSON.parse(data.toString());
+                    onEvent(event);
+                    if (event.type === "done" || event.type === "error") {
+                        ws.close();
+                        resolve();
+                    }
+                }
+                catch {
+                    // ignore parse errors
+                }
+            });
+            ws.on("error", (err) => {
+                reject(err);
+            });
+            ws.on("close", () => {
+                resolve();
+            });
+        });
+    }
+    _walkDir(dir) {
+        const results = [];
+        const skip = new Set(["__pycache__", ".git", "node_modules", ".DS_Store"]);
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (skip.has(entry.name))
+                continue;
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                results.push(...this._walkDir(full));
+            }
+            else {
+                results.push(full);
+            }
+        }
+        return results;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,SAAS,MAAM,IAAI,CAAC;AAgE3B,MAAM,OAAO,cAAc;IACjB,MAAM,CAAS;IACf,KAAK,CAAS;IAEtB,YAAY,MAAc,EAAE,KAAa;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,IAAY,OAAO;QACjB,OAAO;YACL,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,cAAc,EAAE,kBAAkB;SACnC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,UAGI,EAAE;QAEN,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;SACtC,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;oBACpD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,GAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,iBAAiB,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;gBACpD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAA0B,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAI,GAAG,UAAU;QAChD,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,iBAAiB,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAwB,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAA2B,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,UAAU;QACnD,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,oBAAoB,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAwB,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAA2B,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,IAAI,GAAG,UAAU;QACrD,OAAO,IAAI,CAAC,OAAO,CAAe,MAAM,EAAE,oBAAoB,EAAE;YAC9D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAe,KAAK,EAAE,eAAe,OAAO,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAqB,EAAE;QACtC,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,CAAC;YAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,UAAU;YAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,WAAW;YAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEpE,OAAO,IAAI,CAAC,OAAO,CAAkB,KAAK,EAAE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,GAAkB,EAClB,OAAe;QAEf,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,gBAAgB,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAwB,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,OAAe;QACrD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,gBAAgB,OAAO,MAAM,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAwB,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,aAAa,CACX,MAAc,EACd,OAAyC;QAEzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,aAAa,MAAM,EAAE,CAAC;YACzE,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,EAAE;gBAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;aACnD,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAoB,CAAC;oBAC7D,OAAO,CAAC,KAAK,CAAC,CAAC;oBACf,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACpD,EAAE,CAAC,KAAK,EAAE,CAAC;wBACX,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/commands/audit.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerAudit(program: Command): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8DpD"}

package/dist/commands/audit.js

@@ -0,0 +1,70 @@
+import chalk from "chalk";
+import * as path from "path";
+import * as fs from "fs";
+import { HolosHubClient } from "../client.js";
+import { requireAuth } from "../config.js";
+import { watchAuditProgress } from "../progress.js";
+import { promptText, cmd } from "../prompts.js";
+export function registerAudit(program) {
+    program
+        .command("audit [skill-path]")
+        .description("提交 skill 进行安全审计（支持本地目录或 zip 文件）")
+        .option("-m, --mode <mode>", "审计模式：standard（完整）或 quick（快速）", "standard")
+        .option("-w, --wait", "等待审计完成并实时显示进度")
+        .action(async (skillPath, opts) => {
+        if (!skillPath) {
+            skillPath = await promptText(chalk.cyan("? ") + "Skill 路径（目录或 .zip 文件）：");
+            if (!skillPath) {
+                console.error(chalk.red("❌ 必须提供 skill 路径"));
+                process.exit(1);
+            }
+        }
+        const { server, token } = await requireAuth();
+        const client = new HolosHubClient(server, token);
+        let result;
+        try {
+            const abs = path.resolve(skillPath);
+            if (!fs.existsSync(abs)) {
+                console.error(chalk.red(`❌ 路径不存在：${abs}`));
+                process.exit(1);
+            }
+            const stat = fs.statSync(abs);
+            if (stat.isDirectory()) {
+                console.log(chalk.cyan(`⬆️  上传目录：${abs}`));
+                result = await client.uploadFolder(abs, opts.mode);
+            }
+            else if (abs.endsWith(".zip")) {
+                console.log(chalk.cyan(`⬆️  上传 ZIP：${abs}`));
+                result = await client.uploadZip(abs, opts.mode);
+            }
+            else {
+                console.error(chalk.red("❌ skill-path 必须是目录或 .zip 文件"));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red(`❌ 提交失败：${err.message}`));
+            process.exit(1);
+        }
+        if (result.duplicate) {
+            console.log(chalk.yellow(`⚠️  检测到重复 skill（SHA256 相同）`));
+            console.log(`   已有审计 ID：${result.existing_audit_id || result.task_id}`);
+        }
+        else {
+            console.log(chalk.green(`✅ 已提交审计任务`));
+        }
+        console.log(`   task_id：${chalk.bold(result.task_id)}`);
+        console.log(`   skill_id：${result.skill_id}`);
+        console.log(`   sha256：${result.sha256}`);
+        console.log(`\n   查看状态：${chalk.cyan(cmd(`status ${result.task_id}`))}`);
+        console.log(`   下载报告：${chalk.cyan(cmd(`report ${result.task_id}`))}`);
+        if (opts.wait && !result.duplicate) {
+            console.log();
+            const status = await watchAuditProgress(client, result.task_id);
+            if (status) {
+                console.log(`\n   下载报告：${chalk.cyan(cmd(`report ${result.task_id}`))}`);
+            }
+        }
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,EAAE,UAAU,CAAC;SACvE,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,SAA6B,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,MAAM,UAAU,CAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAC5C,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEjD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3C,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7C,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEtE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/install.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerInstall(program: Command): void;
+//# sourceMappingURL=install.d.ts.map

package/dist/commands/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6GtD"}

package/dist/commands/install.js

@@ -0,0 +1,110 @@
+import chalk from "chalk";
+import * as path from "path";
+import * as fs from "fs";
+import AdmZip from "adm-zip";
+import { HolosHubClient } from "../client.js";
+import { requireAuth, getConfig } from "../config.js";
+import { promptText, promptConfirm, cmd, resolveAuditId } from "../prompts.js";
+export function registerInstall(program) {
+    program
+        .command("install [audit-id-or-name]")
+        .description("安装经过安全审计的 skill（仅限 approved 或 conditional）")
+        .option("-d, --dest <dir>", "安装目录（默认：~/.holoshub/skills）")
+        .option("-y, --yes", "对 conditional skill 自动确认安装")
+        .action(async (auditId, opts) => {
+        if (!auditId) {
+            auditId = await promptText(chalk.cyan("? ") + "审计任务 ID 或 Skill 名称：");
+            if (!auditId) {
+                console.error(chalk.red("❌ 必须提供审计任务 ID 或 Skill 名称"));
+                process.exit(1);
+            }
+        }
+        const { server, token } = await requireAuth();
+        const cfg = getConfig();
+        const client = new HolosHubClient(server, token);
+        const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+        const resolvedByName = !UUID_RE.test(auditId);
+        try {
+            auditId = await resolveAuditId(client, auditId);
+        }
+        catch (err) {
+            console.error(chalk.red(`❌ ${err.message}`));
+            process.exit(1);
+        }
+        // 按名称解析时需用户确认，防止误装同名 skill
+        if (resolvedByName) {
+            const confirmed = await promptConfirm("确认安装这个 skill？", true);
+            if (!confirmed) {
+                console.log(chalk.gray("已取消安装。"));
+                process.exit(0);
+            }
+        }
+        // 检查状态
+        let skillName = auditId;
+        try {
+            const status = await client.getStatus(auditId);
+            if (status.status !== "DONE") {
+                console.error(chalk.yellow(`⚠️  审计尚未完成（${status.status}），无法安装`));
+                process.exit(1);
+            }
+            if (status.scorecard_status === "rejected") {
+                console.error(chalk.red("❌ 此 skill 审计结果为 REJECTED，拒绝安装。"));
+                console.error(chalk.dim("   运行以下命令查看详细报告："));
+                console.error(chalk.cyan(`   ${cmd(`report ${auditId}`)}`));
+                process.exit(1);
+            }
+            if (status.scorecard_status === "conditional") {
+                console.warn(chalk.yellow("⚠️  此 skill 审计结果为 CONDITIONAL（存在条件性风险）。"));
+                if (!opts.yes) {
+                    const confirmed = await promptConfirm(chalk.yellow("确认继续安装？（运行 report 可查看详情）"), false);
+                    if (!confirmed) {
+                        console.log(chalk.gray("已取消安装。"));
+                        process.exit(0);
+                    }
+                }
+            }
+            // 获取 skill 详情以拿到名称
+            try {
+                const detail = await client.getSkill(auditId);
+                skillName = detail.skill_name || auditId;
+            }
+            catch {
+                // 使用 auditId 作为 fallback
+            }
+        }
+        catch (err) {
+            console.error(chalk.red(`❌ ${err.message}`));
+            process.exit(1);
+        }
+        // 确定安装目录
+        const baseDir = opts.dest || cfg.installDir;
+        const installDir = path.join(baseDir, skillName);
+        fs.mkdirSync(installDir, { recursive: true });
+        // 下载 zip 到临时文件
+        const tmpZip = path.join(installDir, "__download.zip");
+        try {
+            console.log(chalk.cyan(`⬇️  下载 skill：${skillName}`));
+            await client.downloadSkillZip(auditId, tmpZip);
+            // 解压（防 Zip Slip：校验每个条目路径不超出 installDir）
+            const zip = new AdmZip(tmpZip);
+            const canonicalBase = path.resolve(installDir) + path.sep;
+            for (const entry of zip.getEntries()) {
+                const entryPath = path.resolve(installDir, entry.entryName);
+                if (!entryPath.startsWith(canonicalBase)) {
+                    throw new Error(`不安全的 zip 条目路径：${entry.entryName}`);
+                }
+            }
+            zip.extractAllTo(installDir, true);
+            fs.unlinkSync(tmpZip);
+            console.log(chalk.green(`✅ 已安装到：${installDir}`));
+        }
+        catch (err) {
+            // 清理临时文件
+            if (fs.existsSync(tmpZip))
+                fs.unlinkSync(tmpZip);
+            console.error(chalk.red(`❌ 安装失败：${err.message}`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=install.js.map

package/dist/commands/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/E,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,4BAA4B,CAAC;SACrC,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACzD,MAAM,CAAC,WAAW,EAAE,4BAA4B,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,IAAI,EAAE,EAAE;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,iEAAiE,CAAC;QAClF,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2BAA2B;QAC3B,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO;QACP,IAAI,SAAS,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAE/C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;gBAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC3D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,aAAa,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAC;gBACtE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,EACxC,KAAK,CACN,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC9C,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,SAAS;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,eAAe;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE/C,wCAAwC;YACxC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;YAC1D,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;gBACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YACD,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACnC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAEtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;YACT,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/list.d.ts

@@ -0,0 +1,5 @@
+import { Command } from "commander";
+import { SkillListItem } from "../client.js";
+export declare function formatSkillRow(item: SkillListItem): void;
+export declare function registerList(program: Command): void;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAU7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAexD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiDnD"}

package/dist/commands/list.js

@@ -0,0 +1,63 @@
+import chalk from "chalk";
+import { HolosHubClient } from "../client.js";
+import { requireAuth } from "../config.js";
+import { cmd } from "../prompts.js";
+const SCORECARD_COLORS = {
+    approved: chalk.green,
+    conditional: chalk.yellow,
+    rejected: chalk.red,
+};
+export function formatSkillRow(item) {
+    const sc = item.scorecard_status || "—";
+    const colorFn = SCORECARD_COLORS[sc] || chalk.gray;
+    const tags = [...item.output_risk_tags, ...item.input_sensitivity_tags].join(", ") || "—";
+    console.log(`  ${chalk.bold(item.skill_name.padEnd(30))} ` +
+        `${colorFn(sc)}`);
+    if (item.skill_description) {
+        console.log(`    ${chalk.dim(item.skill_description.slice(0, 80))}`);
+    }
+    if (tags !== "—") {
+        console.log(`    ${chalk.dim("tags: " + tags)}`);
+    }
+}
+export function registerList(program) {
+    program
+        .command("list")
+        .description("列出已审计的 skills")
+        .option("-s, --status <status>", "按状态过滤：approved | conditional | rejected | RUNNING | PENDING | FAILED")
+        .option("-q, --query <query>", "关键字搜索（支持语义搜索）")
+        .option("--page <n>", "页码（从 1 开始）", "1")
+        .option("--page-size <n>", "每页条数（1-100）", "20")
+        .option("--by <username>", "按上传者过滤")
+        .action(async (opts) => {
+        const { server, token } = await requireAuth();
+        const client = new HolosHubClient(server, token);
+        try {
+            const result = await client.listSkills({
+                q: opts.query,
+                status: opts.status,
+                uploaded_by: opts.by,
+                page: parseInt(opts.page, 10),
+                page_size: parseInt(opts.pageSize, 10),
+            });
+            if (result.items.length === 0) {
+                console.log(chalk.gray("  没有找到符合条件的 skill。"));
+                return;
+            }
+            console.log(`\n  ${chalk.bold("名称".padEnd(30))} 安全评级`);
+            console.log("  " + "─".repeat(44));
+            for (const item of result.items) {
+                formatSkillRow(item);
+            }
+            console.log(`\n  共 ${result.total} 条，当前第 ${result.page}/${Math.ceil(result.total / result.page_size)} 页`);
+            if (result.page < Math.ceil(result.total / result.page_size)) {
+                console.log(`  下一页：${chalk.cyan(cmd(`list --page ${result.page + 1}`))}`);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red(`❌ ${err.message}`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAiB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,MAAM,gBAAgB,GAA0C;IAC9D,QAAQ,EAAE,KAAK,CAAC,KAAK;IACrB,WAAW,EAAE,KAAK,CAAC,MAAM;IACzB,QAAQ,EAAE,KAAK,CAAC,GAAG;CACpB,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAE1F,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG;QAC9C,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,CACjB,CAAC;IACF,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,eAAe,CAAC;SAC5B,MAAM,CAAC,uBAAuB,EAAE,sEAAsE,CAAC;SACvG,MAAM,CAAC,qBAAqB,EAAE,eAAe,CAAC;SAC9C,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC;SACvC,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,IAAI,CAAC;SAC9C,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;gBACrC,CAAC,EAAE,IAAI,CAAC,KAAK;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,EAAE;gBACpB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC7B,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;aACvC,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAC1C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAEnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,cAAc,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAED,OAAO,CAAC,GAAG,CACT,SAAS,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAC7F,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,OAAO,CAAC,GAAG,CACT,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/login.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerLogin(program: Command): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqCpD"}