feat(security): 本地化Agent安全命令的文本输出

- 引入 localize 函数支持中英文本地化显示
- 安全警报和概览命令文本渲染时使用本地化字符串
- 增强输出格式逻辑，--quiet 优先显示告警ID列表确保管道兼容
- 修正安全API错误码 12000092 映射，避免错误提示要求重新登录
- 安全共享组件中统一管理本地化标签和UI文本
- 添加覆盖文本本地化及输出行为的单元测试
- 更新CLI命令索引，补充安全相关命令描述和认证信息

Author: cxy01313369

packages/commands/src/commands/security/alerts.ts

@@ -7,7 +7,13 @@ import {
   type SecurityAlertList,
 } from "bailian-cli-core";
 import { emitResult, emitBare } from "bailian-cli-runtime";
-import { WORKSPACE_FLAG, renderAlert, resolveSecurityHost, setSecurityParam } from "./shared.ts";
+import {
+  SECURITY_UI,
+  WORKSPACE_FLAG,
+  renderAlert,
+  resolveSecurityHost,
+  setSecurityParam,
+} from "./shared.ts";
 
 const ASSET_TYPES = ["agent", "tool", "skill", "knowledge_base", "memory", "channel"] as const;
 
@@ -139,7 +145,7 @@ export default defineCommand({
     },
   ],
   async run(ctx) {
-    const { settings, flags } = ctx;
+    const { settings, flags, localize } = ctx;
     const format = detectOutputFormat(settings.output);
     const host = resolveSecurityHost(ctx);
 
@@ -169,33 +175,38 @@ export default defineCommand({
     const data = await securityGet<SecurityAlertList>(ctx.client, endpoint);
     const alerts = data?.data ?? [];
 
-    if (format === "json") {
-      emitResult(data ?? { stats: null, data: [], next_page: null }, format);
+    // --quiet wins over the output format: emit a bare, pipe-friendly list of
+    // alert IDs even when output=json is configured, so ID-driven pipelines
+    // (`bl agents security alerts --quiet | xargs …`) keep working.
+    if (settings.quiet) {
+      for (const alert of alerts) emitBare(alert.alert_id);
       return;
     }
 
-    if (settings.quiet) {
-      for (const alert of alerts) emitBare(alert.alert_id);
+    if (format === "json") {
+      emitResult(data ?? { stats: null, data: [], next_page: null }, format);
       return;
     }
 
     const stats = data?.stats;
     if (stats) {
       emitBare(
-        `Total: ${stats.total ?? "-"}    high: ${stats.high ?? "-"}    ` +
-          `medium: ${stats.medium ?? "-"}    low: ${stats.low ?? "-"}\n`,
+        `${localize(SECURITY_UI.total)}: ${stats.total ?? "-"}    ` +
+          `${localize(SECURITY_UI.high)}: ${stats.high ?? "-"}    ` +
+          `${localize(SECURITY_UI.medium)}: ${stats.medium ?? "-"}    ` +
+          `${localize(SECURITY_UI.low)}: ${stats.low ?? "-"}\n`,
       );
     }
 
     if (alerts.length === 0) {
-      emitBare("No alerts found.");
+      emitBare(localize(SECURITY_UI.noAlerts));
       return;
     }
 
-    for (const alert of alerts) renderAlert(alert);
+    for (const alert of alerts) renderAlert(localize, alert);
 
     if (data?.next_page) {
-      emitBare(`Next page cursor: ${data.next_page}`);
+      emitBare(`${localize(SECURITY_UI.nextPageCursor)}: ${data.next_page}`);
     }
   },
 });

packages/commands/src/commands/security/overview.ts

@@ -12,6 +12,7 @@ import {
   CAPABILITY_LABELS,
   PROTECTION_LABELS,
   SCAN_CARDS,
+  SECURITY_UI,
   WORKSPACE_FLAG,
   renderToggles,
   resolveSecurityHost,
@@ -58,7 +59,7 @@ export default defineCommand({
     },
   ],
   async run(ctx) {
-    const { settings } = ctx;
+    const { settings, localize } = ctx;
     const format = detectOutputFormat(settings.output);
     const endpoint = securityOverviewEndpoint(resolveSecurityHost(ctx));
 
@@ -70,7 +71,7 @@ export default defineCommand({
     const data = await securityGet<SecurityOverview>(ctx.client, endpoint);
     if (!data) {
       if (format === "json") emitResult({}, format);
-      else emitBare("Overview unavailable.");
+      else emitBare(localize(SECURITY_UI.overviewUnavailable));
       return;
     }
 
@@ -85,22 +86,28 @@ export default defineCommand({
       const stat = keys
         .map((key) => data[key] as SecurityScanStat | null | undefined)
         .find((value) => value !== undefined);
-      return { label, stat: stat ?? null };
+      return { label: localize(label), stat: stat ?? null };
     });
     const sum = (pick: (stat: SecurityScanStat) => number | null): number =>
       cards.reduce((total, card) => total + (card.stat ? (pick(card.stat) ?? 0) : 0), 0);
 
-    emitBare(`Scanned: ${sum((stat) => stat.scanned)}    Risks: ${sum((stat) => stat.hit)}`);
+    emitBare(
+      `${localize(SECURITY_UI.scannedLabel)}: ${sum((stat) => stat.scanned)}    ` +
+        `${localize(SECURITY_UI.risksLabel)}: ${sum((stat) => stat.hit)}`,
+    );
 
-    renderToggles("Capabilities", data.capabilities, CAPABILITY_LABELS);
-    renderToggles("Protection", data.protection, PROTECTION_LABELS);
+    renderToggles(localize, SECURITY_UI.capabilities, data.capabilities, CAPABILITY_LABELS);
+    renderToggles(localize, SECURITY_UI.protection, data.protection, PROTECTION_LABELS);
 
-    emitBare("\nDetections");
+    emitBare(`\n${localize(SECURITY_UI.detections)}`);
     for (const { label, stat } of cards) {
       if (!stat) {
-        emitBare(`  ${label}  (unavailable)`);
+        emitBare(`  ${label}  ${localize(SECURITY_UI.unavailable)}`);
       } else {
-        emitBare(`  ${label}  hit ${stat.hit ?? "-"} / scanned ${stat.scanned ?? "-"}`);
+        emitBare(
+          `  ${label}  ${localize(SECURITY_UI.hit)} ${stat.hit ?? "-"} / ` +
+            `${localize(SECURITY_UI.scanned)} ${stat.scanned ?? "-"}`,
+        );
       }
     }
   },

packages/commands/src/commands/security/shared.ts

@@ -1,4 +1,4 @@
-// Shared building blocks for the Agent security commands (bl security *).
+// Shared building blocks for the Agent security commands (bl agents security *).
 //
 // AgentStudio uses the same per-workspace host scheme as the knowledge admin
 // plane, so the --workspace-id flag and its three-level resolver are reused
@@ -7,6 +7,7 @@
 import {
   agentStudioHost,
   isDashScopeGateway,
+  type LocalizedText,
   type SecurityAlert,
   type SecurityOverview,
   type SecurityToggle,
@@ -36,33 +37,66 @@ export function resolveSecurityHost(ctx: {
   return agentStudioHost(resolveWorkspaceId(ctx));
 }
 
-// The API returns codes only — display names live here to match the console.
-export const CAPABILITY_LABELS: Record<string, string> = {
-  agent_identity: "Agent 身份签发",
-  content_safety: "内容安全",
-  supply_chain_scan: "供应链静态扫描",
-  credential_isolation: "凭证隔离",
-  session_lifecycle: "session 生命周期治理",
+/** Locale selector supplied by the command context (`ctx.localize`). */
+export type Localize = (text: LocalizedText) => string;
+
+// The API returns codes only — display names live here to match the console,
+// localized to en-US / zh-CN per the resolved language.
+export const CAPABILITY_LABELS: Record<string, LocalizedText> = {
+  agent_identity: { "en-US": "Agent identity issuance", "zh-CN": "Agent 身份签发" },
+  content_safety: { "en-US": "Content safety", "zh-CN": "内容安全" },
+  supply_chain_scan: { "en-US": "Supply-chain static scan", "zh-CN": "供应链静态扫描" },
+  credential_isolation: { "en-US": "Credential isolation", "zh-CN": "凭证隔离" },
+  session_lifecycle: { "en-US": "Session lifecycle governance", "zh-CN": "session 生命周期治理" },
 };
 
 // Protection entries are keyed by asset type; the doc lists only the codes, so
 // the display names are maintained here.
-export const PROTECTION_LABELS: Record<string, string> = {
-  flow_agent: "Flow Agent",
-  managed_agent: "Managed Agents",
-  knowledge_base: "RAG",
-  memory: "Memory",
-  mcp: "Store",
-  external_agent: "BYOA 托管",
+export const PROTECTION_LABELS: Record<string, LocalizedText> = {
+  flow_agent: { "en-US": "Flow Agent", "zh-CN": "Flow Agent" },
+  managed_agent: { "en-US": "Managed Agents", "zh-CN": "Managed Agents" },
+  knowledge_base: { "en-US": "RAG", "zh-CN": "RAG" },
+  memory: { "en-US": "Memory", "zh-CN": "Memory" },
+  mcp: { "en-US": "Store", "zh-CN": "Store" },
+  external_agent: { "en-US": "BYOA hosting", "zh-CN": "BYOA 托管" },
 };
 
 /** Detection cards summed into the overview banner: label + snake_case (REST) / camelCase (gateway) keys. */
-export const SCAN_CARDS: Array<{ label: string; keys: Array<keyof SecurityOverview> }> = [
-  { label: "内容安全", keys: ["content_safety", "contentSafety"] },
-  { label: "文件扫描", keys: ["file_scan", "fileScan"] },
-  { label: "技能扫描", keys: ["skill_scan", "skillScan"] },
+export const SCAN_CARDS: Array<{ label: LocalizedText; keys: Array<keyof SecurityOverview> }> = [
+  {
+    label: { "en-US": "Content safety", "zh-CN": "内容安全" },
+    keys: ["content_safety", "contentSafety"],
+  },
+  { label: { "en-US": "File scan", "zh-CN": "文件扫描" }, keys: ["file_scan", "fileScan"] },
+  { label: { "en-US": "Skill scan", "zh-CN": "技能扫描" }, keys: ["skill_scan", "skillScan"] },
 ];
 
+/** User-facing strings shared by the security commands, localized en-US / zh-CN. */
+export const SECURITY_UI = {
+  unavailable: { "en-US": "(unavailable)", "zh-CN": "（不可用）" },
+  on: { "en-US": "on", "zh-CN": "开启" },
+  off: { "en-US": "off", "zh-CN": "关闭" },
+  scannedLabel: { "en-US": "Scanned", "zh-CN": "扫描" },
+  risksLabel: { "en-US": "Risks", "zh-CN": "风险" },
+  capabilities: { "en-US": "Capabilities", "zh-CN": "能力项" },
+  protection: { "en-US": "Protection", "zh-CN": "防护项" },
+  detections: { "en-US": "Detections", "zh-CN": "检测项" },
+  overviewUnavailable: { "en-US": "Overview unavailable.", "zh-CN": "总览不可用。" },
+  hit: { "en-US": "hit", "zh-CN": "命中" },
+  scanned: { "en-US": "scanned", "zh-CN": "扫描" },
+  total: { "en-US": "Total", "zh-CN": "总计" },
+  high: { "en-US": "high", "zh-CN": "高" },
+  medium: { "en-US": "medium", "zh-CN": "中" },
+  low: { "en-US": "low", "zh-CN": "低" },
+  noAlerts: { "en-US": "No alerts found.", "zh-CN": "未找到告警。" },
+  nextPageCursor: { "en-US": "Next page cursor", "zh-CN": "下一页游标" },
+  app: { "en-US": "app", "zh-CN": "应用" },
+  asset: { "en-US": "asset", "zh-CN": "资产" },
+  status: { "en-US": "status", "zh-CN": "状态" },
+  source: { "en-US": "source", "zh-CN": "来源" },
+  checked: { "en-US": "checked", "zh-CN": "检测时间" },
+} satisfies Record<string, LocalizedText>;
+
 /** Append a query param only when present; arrays append each item (repeatable). */
 export function setSecurityParam(
   params: URLSearchParams,
@@ -77,20 +111,23 @@ export function setSecurityParam(
   params.set(key, String(value));
 }
 
-/** Render a capability / protection toggle group; codes map to display names. */
+/** Render a capability / protection toggle group; codes map to localized display names. */
 export function renderToggles(
-  title: string,
+  localize: Localize,
+  title: LocalizedText,
   toggles: SecurityToggle[] | null | undefined,
-  labels: Record<string, string>,
+  labels: Record<string, LocalizedText>,
 ): void {
-  emitBare(`\n${title}`);
+  emitBare(`\n${localize(title)}`);
   if (!toggles || toggles.length === 0) {
-    emitBare("  (unavailable)");
+    emitBare(`  ${localize(SECURITY_UI.unavailable)}`);
     return;
   }
   for (const toggle of toggles) {
     const count = typeof toggle.count === "number" ? `  (${toggle.count})` : "";
-    emitBare(`  ${toggle.enabled ? "on " : "off"}  ${labels[toggle.key] ?? toggle.key}${count}`);
+    const state = localize(toggle.enabled ? SECURITY_UI.on : SECURITY_UI.off);
+    const label = labels[toggle.key] ? localize(labels[toggle.key]) : toggle.key;
+    emitBare(`  ${state}  ${label}${count}`);
   }
 }
 
@@ -102,15 +139,15 @@ export function formatSecurityTime(value: string | null | undefined): string {
   return new Date(millis).toISOString().replace("T", " ").slice(0, 19);
 }
 
-/** Render one alert row in text mode. */
-export function renderAlert(alert: SecurityAlert): void {
+/** Render one alert row in text mode; field labels are localized. */
+export function renderAlert(localize: Localize, alert: SecurityAlert): void {
   const level = (alert.risk_level ?? "unknown").toUpperCase();
   emitBare(`[${level}] ${alert.risk_name ?? "-"}  (${alert.alert_id})`);
   emitBare(
-    `  app: ${alert.app_name ?? "-"}    asset: ${alert.asset_name ?? "-"} (${alert.asset_type ?? "-"})`,
+    `  ${localize(SECURITY_UI.app)}: ${alert.app_name ?? "-"}    ${localize(SECURITY_UI.asset)}: ${alert.asset_name ?? "-"} (${alert.asset_type ?? "-"})`,
   );
   emitBare(
-    `  status: ${alert.status ?? "-"}    source: ${alert.source ?? "-"}    checked: ${formatSecurityTime(alert.check_time)}`,
+    `  ${localize(SECURITY_UI.status)}: ${alert.status ?? "-"}    ${localize(SECURITY_UI.source)}: ${alert.source ?? "-"}    ${localize(SECURITY_UI.checked)}: ${formatSecurityTime(alert.check_time)}`,
   );
   if (alert.risk_desc) emitBare(`  ${alert.risk_desc}`);
   emitBare("");