@alphafox/cli 0.3.3 → 0.3.5

package/dist/skills-manifest.json

@@ -0,0 +1,141 @@
+{
+  "schemaVersion": 1,
+  "packageName": "@alphafox/cli",
+  "packageVersion": "0.3.5",
+  "contractVersion": "2026-08-13",
+  "bundleHash": "797ff48c83d6f0274e8726c4c6b5a3c9271c79116e9d8f90a268b4936efaeb65",
+  "skills": [
+    {
+      "name": "alphafox",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "9b96984c09a656ef1f0c2b8c2d4c0c7a2ae10177d1b0abe0470ea9e5687095cd",
+          "size": 2184
+        }
+      ],
+      "hash": "1662dc2d889ef7429a4abf53061c6b5e83b2665998b4ccbfbf43338f373ef938"
+    },
+    {
+      "name": "alphafox-account",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "5e6244d3072e7cd9c9a5603d9c72e8ddf959cbca870f81603b7cfcb8d35b6212",
+          "size": 783
+        }
+      ],
+      "hash": "674fe691cdf52c64af5360c09475b7444e8ce6a1c59fa061c39d9ed6b1dfd78e"
+    },
+    {
+      "name": "alphafox-admin",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "cf3503e7d8114767b806d3d2349695b0a2af582d470c16c99064df60792baaca",
+          "size": 787
+        }
+      ],
+      "hash": "e33bb16a3f241ff29423023aebc044c26c6b4689feabe9b5f780dc3a5bdbb4a5"
+    },
+    {
+      "name": "alphafox-auth",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "848fcd9422977c0bb3ee3355c2359c6efbb54e964b64ea253660e7ee12598f1a",
+          "size": 1919
+        }
+      ],
+      "hash": "c17ebdb46ebb36036d9958d8a6a31717af6945267575d7464561728e0c9d3205"
+    },
+    {
+      "name": "alphafox-engine-backtest",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "8e91f3779ee93b680b90fa21d0e7e8fa7cc5ad4ca89941e1b9076526f09075e2",
+          "size": 7346
+        }
+      ],
+      "hash": "73943798e3787ad78a9955aad937154ca0b8a975e44117b78f1afecc9866f13b"
+    },
+    {
+      "name": "alphafox-exchange",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "ea7d153cd5806f471e45e5df2f0558835aa6ad413abe92667352288fa534ff2a",
+          "size": 743
+        }
+      ],
+      "hash": "88d3826590356eed7b3a3405188242ca7e3936856fcd74400c06da701da0b062"
+    },
+    {
+      "name": "alphafox-market",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "c816116463f6b8ef7d7281593500153119bd62d6635517faf71e769e36522385",
+          "size": 1801
+        }
+      ],
+      "hash": "01ae4ac923c4284af527f78991784e9b1bf2599daa57dcead89f2f72510278df"
+    },
+    {
+      "name": "alphafox-notification",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "00c6b87f4742c3c5ea07276228c4b1ba718683abdf6e40c35024b270ec4abd49",
+          "size": 698
+        }
+      ],
+      "hash": "c23e5ed2458d8d2fa58f04b24a1efe300c554b2029f9b218685d204c5f9ed2b7"
+    },
+    {
+      "name": "alphafox-shared",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "c8b7624e43242c3bf1a5f5e8d2101a6b53a0a7c62f04afac079e49a478eaaca9",
+          "size": 4750
+        }
+      ],
+      "hash": "a8d5bedffabb5b0c715bf88bd94f7a3ef4e3be77f854065806d4dd1440ef606f"
+    },
+    {
+      "name": "alphafox-strategy",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "8f94ea6fc3d36ddc8e6808e1e6ebdfcec56973a93fc86d0c6832eff2d6cf4022",
+          "size": 1450
+        }
+      ],
+      "hash": "b1f5c6ae08bc2ea486b32c34c2e271ea504843972ccc7dbbb1e7e68d6a714f7d"
+    },
+    {
+      "name": "alphafox-trading",
+      "version": "0.3.5",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "2eddaa9c903daa62790ead007db4f0f6f412d1a14b291025937927eda6719d03",
+          "size": 1435
+        }
+      ],
+      "hash": "d4b9e260145aca858e4d3a1f13bf81081c96bd8048d8d6eeb487e35dd78129fb"
+    }
+  ]
+}

package/dist/update/run-command.d.ts

@@ -0,0 +1,41 @@
+import type { InstallRunner } from "../install/types";
+import type { SkillsSyncResult } from "../skills/manager";
+export interface UpdateArgs {
+    readonly check: boolean;
+    readonly help: boolean;
+    readonly version?: string;
+}
+export interface UpdateExecutionFlags {
+    readonly yes: boolean;
+    readonly dryRun: boolean;
+}
+export interface UpdateCliFlags extends UpdateExecutionFlags {
+    readonly format: "json" | "jsonl" | "text";
+    readonly noInput: boolean;
+    readonly jq?: string;
+}
+export interface UpdateDeps {
+    readonly runner?: InstallRunner;
+    readonly packageHasSkills?: (packageRoot: string) => boolean;
+    readonly sync?: (packageRoot: string, runner: InstallRunner) => Promise<SkillsSyncResult>;
+}
+export interface CliUpdateResult {
+    readonly currentVersion: string | null;
+    readonly targetVersion: string;
+    readonly updateAvailable: boolean;
+    readonly checkOnly: boolean;
+    readonly dryRun: boolean;
+    readonly cli: {
+        readonly action: "available" | "planned" | "updated" | "current";
+        readonly previousVersion: string | null;
+        readonly version: string;
+    };
+    readonly skills: SkillsSyncResult | {
+        readonly action: "not-run";
+        readonly reason: "check-only" | "dry-run";
+    };
+    readonly restartRequired: boolean;
+}
+export declare function parseUpdateArgs(args: readonly string[]): UpdateArgs;
+export declare function executeCliUpdate(args: UpdateArgs, flags: UpdateExecutionFlags, env?: NodeJS.ProcessEnv, deps?: UpdateDeps): Promise<CliUpdateResult>;
+export declare function cmdUpdate(args: string[], flags: UpdateCliFlags, env?: NodeJS.ProcessEnv, deps?: UpdateDeps): Promise<number>;

package/dist/update/run-command.js

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseUpdateArgs = parseUpdateArgs;
+exports.executeCliUpdate = executeCliUpdate;
+exports.cmdUpdate = cmdUpdate;
+const envelope_1 = require("../envelope");
+const exec_1 = require("../install/exec");
+const package_root_1 = require("../install/package-root");
+const wizard_1 = require("../install/wizard");
+const run_command_1 = require("../skills/run-command");
+const version_1 = require("../version");
+const NPM_TIMEOUT_MS = 120_000;
+function parseUpdateArgs(args) {
+    let check = false;
+    let help = false;
+    let version;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--check") {
+            check = true;
+        }
+        else if (arg === "--version") {
+            version = args[++i];
+            if (!version)
+                throw updateUsage("--version requires a value");
+        }
+        else if (arg.startsWith("--version=")) {
+            version = arg.slice("--version=".length);
+        }
+        else if (arg === "--help" || arg === "-h" || arg === "help") {
+            help = true;
+        }
+        else {
+            throw updateUsage(`Unknown update argument: ${arg}`);
+        }
+    }
+    if (version && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+        throw updateUsage(`Invalid version: ${version}`);
+    }
+    return { check, help, ...(version ? { version } : {}) };
+}
+async function executeCliUpdate(args, flags, env = process.env, deps = {}) {
+    const runner = deps.runner ??
+        (0, exec_1.createDefaultInstallRunner)(env, [__dirname, process.cwd()]);
+    const currentVersion = await readGlobalVersion(runner);
+    const targetVersion = await readTargetVersion(runner, args.version);
+    const updateAvailable = args.version
+        ? currentVersion !== targetVersion
+        : currentVersion == null || (0, wizard_1.semverLessThan)(currentVersion, targetVersion);
+    const effectiveVersion = updateAvailable ? targetVersion : (currentVersion ?? targetVersion);
+    if (args.check) {
+        return {
+            currentVersion,
+            targetVersion,
+            updateAvailable,
+            checkOnly: true,
+            dryRun: false,
+            cli: {
+                action: updateAvailable ? "available" : "current",
+                previousVersion: currentVersion,
+                version: effectiveVersion,
+            },
+            skills: { action: "not-run", reason: "check-only" },
+            restartRequired: false,
+        };
+    }
+    if (updateAvailable &&
+        args.version &&
+        currentVersion &&
+        (0, wizard_1.semverLessThan)(targetVersion, currentVersion) &&
+        !flags.yes) {
+        throw Object.assign(new Error(`Downgrading ${version_1.CLI_PACKAGE} from ${currentVersion} to ${targetVersion} requires --yes`), {
+            type: "confirmation",
+            subtype: "cli_downgrade_confirmation_required",
+        });
+    }
+    if (flags.dryRun) {
+        return {
+            currentVersion,
+            targetVersion,
+            updateAvailable,
+            checkOnly: false,
+            dryRun: true,
+            cli: {
+                action: updateAvailable ? "planned" : "current",
+                previousVersion: currentVersion,
+                version: effectiveVersion,
+            },
+            skills: { action: "not-run", reason: "dry-run" },
+            restartRequired: updateAvailable,
+        };
+    }
+    if (updateAvailable) {
+        await runner.exec("npm", ["install", "-g", `${version_1.CLI_PACKAGE}@${targetVersion}`], { timeoutMs: NPM_TIMEOUT_MS });
+        const installedVersion = await readGlobalVersion(runner);
+        if (installedVersion !== targetVersion) {
+            throw Object.assign(new Error(`npm reported ${installedVersion ?? "no global install"} after updating to ${targetVersion}`), {
+                type: "install",
+                subtype: "cli_update_verify_failed",
+            });
+        }
+    }
+    const packageRoot = await resolveUpdatedPackageRoot(runner, deps.packageHasSkills ?? package_root_1.packageHasSkills, !updateAvailable);
+    const sync = deps.sync ??
+        (async (root, activeRunner) => await (0, run_command_1.syncCurrentSkills)({ force: false, dryRun: false }, env, { runner: activeRunner, packageRoot: root }));
+    const skills = await sync(packageRoot, runner);
+    return {
+        currentVersion,
+        targetVersion,
+        updateAvailable,
+        checkOnly: false,
+        dryRun: false,
+        cli: {
+            action: updateAvailable ? "updated" : "current",
+            previousVersion: currentVersion,
+            version: effectiveVersion,
+        },
+        skills,
+        restartRequired: updateAvailable || skills.restartRequired,
+    };
+}
+async function cmdUpdate(args, flags, env = process.env, deps = {}) {
+    const parsed = parseUpdateArgs(args);
+    if (parsed.help) {
+        (0, envelope_1.writeSuccess)({
+            name: "update",
+            usage: [
+                "alphafox update --check",
+                "alphafox update [--dry-run]",
+                "alphafox update --version <version> [--yes]",
+            ],
+            notes: [
+                "Updates @alphafox/cli through npm, then syncs the verified co-versioned Skills bundle",
+                "A downgrade requires --yes",
+                "No Skills are downloaded independently from GitHub",
+            ],
+        }, { format: flags.format, jq: flags.jq });
+        return 0;
+    }
+    const result = await executeCliUpdate(parsed, flags, env, deps);
+    (0, envelope_1.writeSuccess)(result, { format: flags.format, jq: flags.jq });
+    return result.skills.action !== "not-run" &&
+        result.skills.blocked.length > 0
+        ? 1
+        : 0;
+}
+async function readGlobalVersion(runner) {
+    try {
+        const { stdout, stderr } = await runner.exec("npm", ["list", "-g", version_1.CLI_PACKAGE, "--depth=0"], { timeoutMs: 15_000 });
+        return (0, wizard_1.parseNpmListVersion)(`${stdout}\n${stderr}`);
+    }
+    catch {
+        return null;
+    }
+}
+async function readTargetVersion(runner, requested) {
+    const spec = requested ? `${version_1.CLI_PACKAGE}@${requested}` : version_1.CLI_PACKAGE;
+    const { stdout } = await runner.exec("npm", ["view", spec, "version"], {
+        timeoutMs: 15_000,
+    });
+    const version = stdout.trim();
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+        throw Object.assign(new Error(`npm returned an invalid version for ${spec}`), {
+            type: "install",
+            subtype: "npm_version_invalid",
+        });
+    }
+    return version;
+}
+async function resolveUpdatedPackageRoot(runner, packageHasSkills, allowCurrentFallback) {
+    try {
+        const { stdout } = await runner.exec("npm", ["root", "-g"], {
+            timeoutMs: 15_000,
+        });
+        const root = (0, package_root_1.globalPackageRoot)(stdout.trim());
+        if (packageHasSkills(root))
+            return root;
+    }
+    catch {
+        // Fall back to the currently executing package for repair-only updates.
+    }
+    if (!allowCurrentFallback) {
+        throw Object.assign(new Error("Updated @alphafox/cli package does not contain Skills"), {
+            type: "install",
+            subtype: "updated_skills_missing",
+        });
+    }
+    const current = (0, run_command_1.resolveCurrentSkillsPackageRoot)(runner.packageSearchDirs().length > 0
+        ? runner.packageSearchDirs()
+        : [__dirname, process.cwd()]);
+    if (packageHasSkills(current))
+        return current;
+    throw Object.assign(new Error("Updated @alphafox/cli package does not contain Skills"), {
+        type: "install",
+        subtype: "updated_skills_missing",
+    });
+}
+function updateUsage(message) {
+    return Object.assign(new Error(message), {
+        type: "usage",
+        subtype: "invalid_update_args",
+        status: 64,
+    });
+}

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.3.3";
+export declare const CLI_VERSION = "0.3.5";
 export { CATALOG_VERSION as CLI_CONTRACT_VERSION } from "./catalog/operations";

package/dist/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.3.3";
+exports.CLI_VERSION = "0.3.5";
 var operations_1 = require("./catalog/operations");
 Object.defineProperty(exports, "CLI_CONTRACT_VERSION", { enumerable: true, get: function () { return operations_1.CATALOG_VERSION; } });

package/docs/agents/issue-tracker.md

@@ -1,6 +1,6 @@
 # Issue tracker: Feishu Tasks
 
-Issues and specs for this repo live as tasks in the **Alphafox-Issues** Feishu (Lark) tasklist. Use the `lark-cli` CLI ([`@larksuite/cli`](https://github.com/larksuite/cli)) for all operations, always with `--as user` — a task created by the bot identity is invisible in the human's task centre.
+Issues and specs for this repo live as tasks in the **AlphaFox-Issues** Feishu (Lark) tasklist. Use the `lark-cli` CLI ([`@larksuite/cli`](https://github.com/larksuite/cli)) for all operations, always with `--as user` — a task created by the bot identity is invisible in the human's task centre.
 
 List: <https://applink.feishu.cn/client/todo/task_list?guid=6d628d79-cdfe-47cc-98f7-35561944494b>
 
@@ -46,7 +46,7 @@ Every other label is an option on the single-select `Type` field. Address an opt
 ## Conventions
 
 - **Shared-list title** — prefix every issue/task title with `[alphafox-cli]` so the repository remains identifiable on the shared board.
-- **Tracker boundary** — Matt Skills issues, specs, tickets, triage items, and wayfinder maps belong in `Alphafox-Issues`, not a quarterly execution list. If quarterly planning initiated the work, link its absolute Feishu task URL instead of duplicating workflow state.
+- **Tracker boundary** — Matt Skills issues, specs, tickets, triage items, and wayfinder maps belong in `AlphaFox-Issues`, not a quarterly execution list. If quarterly planning initiated the work, link its absolute Feishu task URL instead of duplicating workflow state.
 
 - **Create an issue** — one call sets body, section (triage role) and `Type`:
 

package/docs/agents/triage-labels.md

@@ -1,6 +1,6 @@
 # Triage Labels
 
-The skills speak in terms of five canonical triage roles. On this repo's tracker (Feishu Tasks) a role is not a label but a **section** of the Alphafox-Issues tasklist — a task sits in exactly one, so the state machine can't be violated. `issue-tracker.md` holds the section GUIDs and the command that moves a task between them.
+The skills speak in terms of five canonical triage roles. On this repo's tracker (Feishu Tasks) a role is not a label but a **section** of the AlphaFox-Issues tasklist — a task sits in exactly one, so the state machine can't be violated. `issue-tracker.md` holds the section GUIDs and the command that moves a task between them.
 
 | Label in mattpocock/skills | Section in our tracker | Meaning                                  |
 | -------------------------- | ---------------------- | ---------------------------------------- |

package/docs/alphafox-cli-installation-guide.md

@@ -1,4 +1,4 @@
-# Alphafox CLI installation guide
+# AlphaFox CLI installation guide
 
 The following steps are designed for AI Agents. Some steps require the user
 to complete a browser or Device Flow approval. Always use
@@ -20,26 +20,25 @@ Skills do **not** register with Cursor / Claude Code / Codex from
 # Install CLI
 npm install -g @alphafox/cli
 
-# Install CLI SKILL (required) — project-local, current workspace
-npx -y skills add "$(npm root -g)/@alphafox/cli" -y
+# Verify and globally sync the exact co-versioned Skills bundle
+alphafox skills sync --format json --no-input
 ```
 
-If the local package path fails (older tarball without `skills/`, or
-`npm root -g` is wrong), fall back to the public GitHub source:
+Do not install Skills from GitHub `main` as a fallback. The CLI verifies the
+manifest and hashes inside the npm package before syncing. If sync fails, stop
+and report the error rather than downloading a different Skills version.
 
-```shell
-npx -y skills add alphafoxai/alphafox-cli -y
-```
-
-To install Skills for every project on this machine instead of the current
-repo, add `-g`:
+For future updates:
 
 ```shell
-npx -y skills add "$(npm root -g)/@alphafox/cli" -y -g
+alphafox update --check --format json --no-input
+alphafox update --format json --no-input
 ```
 
-Do not invent a second catalog. Skills must stay co-versioned with the CLI
-that was just installed.
+`alphafox update` upgrades the npm CLI first, then syncs its bundled Skills.
+Modified Skills are preserved and reported. Only use
+`alphafox skills sync --force --yes` when the user explicitly wants to replace
+them; a backup is created before replacement.
 
 ## Step 2: Login
 
@@ -88,8 +87,8 @@ Parse the JSON envelope: `ok === true` means success. Errors land on
 ## Step 4: Tell the user to restart
 
 Ask the user to **restart the AI tool** so the new Skills are loaded.
-Then they can ask the Agent to use Alphafox (auth, catalog, trading,
-engine-backtest, …).
+Then they can ask the Agent to use AlphaFox. The entry skill `alphafox` routes
+to auth, market, engine-backtest, strategy, trading, and the rest.
 
 ## Human wizard (do not run this from an Agent)
 
@@ -100,6 +99,6 @@ stepping through the commands above:
 npx @alphafox/cli@latest install
 ```
 
-That wizard installs the CLI globally, runs `npx skills add … -y -g`,
+That wizard installs the CLI globally, verifies and syncs the packaged Skills,
 and may prompt for `alphafox auth login --browser`. It is TTY-oriented.
 Agents must follow Steps 1–4 in this document rather than the wizard.

package/docs/index.html

@@ -3,10 +3,10 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>Alphafox CLI</title>
+    <title>AlphaFox CLI</title>
     <meta
       name="description"
-      content="仅需一行指令，在任意 Agent 操作 Alphafox。安装 CLI 与 Skills，用 Public Application API 做回测、策略与交易。"
+      content="仅需一行指令，在任意 Agent 操作 AlphaFox。安装 CLI 与 Skills，用 Public Application API 做回测、策略与交易。"
     />
     <meta name="theme-color" content="#FF991F" />
     <link rel="icon" href="favicon.svg" type="image/svg+xml" />
@@ -491,7 +491,7 @@
   <body>
     <header class="site-header">
       <div class="site-header-inner">
-        <a class="brand" href="./" aria-label="Alphafox CLI">
+        <a class="brand" href="./" aria-label="AlphaFox CLI">
           <img class="mark" src="logo/alphafox-mark.svg" alt="" width="36" height="36" />
           <img
             class="wordmark wordmark-light"
@@ -544,8 +544,8 @@
 
     <main class="wrap">
       <section class="hero">
-        <p class="kicker">Alphafox CLI</p>
-        <h1 class="headline" data-i18n="headline">仅需一行指令，在任意 Agent 操作 Alphafox</h1>
+        <p class="kicker">AlphaFox CLI</p>
+        <h1 class="headline" data-i18n="headline">仅需一行指令，在任意 Agent 操作 AlphaFox</h1>
         <p class="lede" data-i18n="lede">
           安装 CLI 与 Skills，用 Public Application API 做回测、策略与交易。
         </p>
@@ -576,7 +576,7 @@
         <section class="panel" id="panel-agent" role="tabpanel" aria-labelledby="tab-agent" hidden>
           <p class="hint" data-i18n="agentHint">把下面这段话发给任意 AI Agent，它会按安装指南完成配置：</p>
           <div class="cmd">
-            <code id="agent-cmd">帮我安装 Alphafox CLI：https://github.com/alphafoxai/alphafox-cli/blob/main/docs/alphafox-cli-installation-guide.md</code>
+            <code id="agent-cmd">帮我安装 AlphaFox CLI：https://github.com/alphafoxai/alphafox-cli/blob/main/docs/alphafox-cli-installation-guide.md</code>
             <button class="copy" type="button" data-copy="agent-cmd">
               <svg viewBox="0 0 16 16" fill="none" aria-hidden="true">
                 <rect x="5.5" y="5.5" width="8" height="8" rx="1.5" stroke="currentColor" />
@@ -604,7 +604,7 @@
     </main>
 
     <footer class="site-footer">
-      <span>© 2026 Alphafox</span>
+      <span>© 2026 AlphaFox</span>
       ·
       <a href="https://www.alphafox.app">alphafox.app</a>
     </footer>
@@ -613,7 +613,7 @@
       const copyLabels = { zh: { idle: "复制", done: "已复制" }, en: { idle: "Copy", done: "Copied" } };
       const i18n = {
         zh: {
-          headline: "仅需一行指令，在任意 Agent 操作 Alphafox",
+          headline: "仅需一行指令，在任意 Agent 操作 AlphaFox",
           lede: "安装 CLI 与 Skills，用 Public Application API 做回测、策略与交易。",
           tabManual: "手动安装",
           tabAgent: "通过 AI Agent 安装",
@@ -629,10 +629,10 @@
           themeAriaDark: "切换到浅色模式",
           langAria: "切换语言",
           agentCmd:
-            "帮我安装 Alphafox CLI：https://github.com/alphafoxai/alphafox-cli/blob/main/docs/alphafox-cli-installation-guide.md",
+            "帮我安装 AlphaFox CLI：https://github.com/alphafoxai/alphafox-cli/blob/main/docs/alphafox-cli-installation-guide.md",
         },
         en: {
-          headline: "One command to operate Alphafox from any Agent",
+          headline: "One command to operate AlphaFox from any Agent",
           lede: "Install the CLI and Skills, then run backtests, strategies, and trades through the Public Application API.",
           tabManual: "Manual install",
           tabAgent: "Install via AI Agent",
@@ -648,7 +648,7 @@
           themeAriaDark: "Switch to light mode",
           langAria: "Switch language",
           agentCmd:
-            "Install Alphafox CLI for me: https://github.com/alphafoxai/alphafox-cli/blob/main/docs/alphafox-cli-installation-guide.md",
+            "Install AlphaFox CLI for me: https://github.com/alphafoxai/alphafox-cli/blob/main/docs/alphafox-cli-installation-guide.md",
         },
       };
 

package/docs/release-supply-chain.md

@@ -58,12 +58,17 @@ OIDC-provenance release.
 - Skills major aligns with CLI major. There is no separate Skills registry
   in v1 and no silent download of a different Skills version at runtime.
 - `npm install -g @alphafox/cli` places `skills/` next to the binary only.
-  Agents do not load that directory. `alphafox install` (and the Agent
-  install guide) copy those files into Agent skill dirs via
-  `npx skills add`:
-  1. the globally installed package path (co-versioned with the CLI)
-  2. the running package / checkout `skills/` tree
-  3. GitHub `alphafoxai/alphafox-cli` as a last-resort fallback
+  Agents do not load that directory. `alphafox install`, `alphafox update`,
+  and `alphafox skills sync` verify `dist/skills-manifest.json`, then copy
+  only from that exact package into global Agent skill dirs.
+- GitHub `main` is not an update fallback. A missing or invalid package
+  manifest fails closed instead of silently changing the Skills version.
+- Sync state and per-Skill hashes live under the AlphaFox config directory.
+  Missing or unchanged stale Skills may update automatically. Modified Skills
+  require `alphafox skills sync --force --yes` and are backed up first.
+- Retired Skills are removed only when the state proves they are AlphaFox
+  managed and unmodified. Failed copy/removal verification does not advance
+  sync state.
 - `contractVersion` on the CLI profile MUST match the Public API
   `contractVersion` (or the documented compatible range). Mismatch → fail
   closed; do not download an older contract or degrade quietly.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.3.3",
-  "description": "Alphafox CLI — Agent/Human entry for the public Application API.",
+  "version": "0.3.5",
+  "description": "AlphaFox CLI — Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {
     "alphafox": "bin/alphafox.js"

package/skills/account/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-account
 description: Account, wallet, and subscription read paths.
-version: 0.3.3
+version: 0.3.5
 ---
 
 # Account / wallet

package/skills/admin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-admin
 description: Admin-only operations reusing Web role authorization.
-version: 0.3.3
+version: 0.3.5
 ---
 
 # Admin