@alphafox/cli 0.3.5 → 0.3.6

package/README.md

@@ -45,6 +45,9 @@ alphafox update
 alphafox skills status
 ```
 
+Ordinary CLI commands check npm at most once every 24 hours and only print a
+stderr notice when a newer version exists. They never auto-upgrade.
+
 `alphafox update` upgrades the npm package and then syncs the exact Skills
 bundle shipped inside it. It never updates Skills independently from GitHub.
 Locally modified Skills are reported and preserved; use

package/dist/commands/run.js

@@ -16,6 +16,7 @@ const version_1 = require("../version");
 const run_command_1 = require("../engine-backtest/run-command");
 const run_command_2 = require("../resolve-symbols/run-command");
 const run_command_3 = require("../skills/run-command");
+const notify_1 = require("../update/notify");
 const run_command_4 = require("../update/run-command");
 const validate_body_1 = require("../catalog/validate-body");
 const types_1 = require("../install/types");
@@ -107,6 +108,14 @@ async function runCli(argv, env = process.env) {
         return 0;
     }
     try {
+        if (!(0, notify_1.shouldSkipUpdateCheck)(cmd, env)) {
+            try {
+                await (0, notify_1.maybeNotifyCliUpdate)({ env, currentVersion: version_1.CLI_VERSION });
+            }
+            catch {
+                // Update notices must never fail a command.
+            }
+        }
         if (cmd !== "version" &&
             cmd !== "install" &&
             cmd !== "update" &&

package/dist/index.d.ts

@@ -20,3 +20,4 @@ export { AGENT_INSTALL_GUIDE_BLOB_URL, AGENT_INSTALL_GUIDE_URL, SKILLS_GITHUB_SO
 export { buildSkillsManifest, inspectSkills, loadAndVerifySkillsManifest, loadSkillsState, syncSkills, writeSkillsManifest, } from "./skills/manager";
 export { inspectCurrentSkills, installedSkillsRoot, skillsStatePath, syncCurrentSkills, } from "./skills/run-command";
 export { executeCliUpdate, parseUpdateArgs, } from "./update/run-command";
+export { formatUpdateNotice, maybeNotifyCliUpdate, shouldSkipUpdateCheck, } from "./update/notify";

package/dist/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateCatalogWriteBody = exports.CLI_CONTRACT_VERSION = exports.CLI_PACKAGE = exports.CLI_VERSION = exports.checkGeneratedCatalogCompatibility = exports.buildCapabilityManifest = exports.getOperationSchemaDocument = exports.findCatalogOperationByRoute = exports.findCatalogOperation = exports.COMPATIBILITY_RANGE = exports.CATALOG_VERSION = exports.CATALOG_SOURCE = exports.CATALOG_OPERATIONS = exports.startLoopbackCallbackServer = exports.runBrowserPkceLogin = exports.accessTokenNeedsRefresh = exports.refreshStoredTokensOrNull = exports.refreshStoredTokens = exports.requiresHighRiskConfirmation = exports.inferRawApiRisk = exports.assertHighRiskConfirmation = exports.resolveTypedCommand = exports.checkCliCompatibility = exports.pathTemplateMatches = exports.normalizeApiPath = exports.isInternalDisallowedPath = exports.isFacadeAllowlistedPath = exports.WINDOWS_CRED_MAX_BYTES = exports.windowsCredentialTarget = exports.linuxSecretToolBin = exports.linuxSecretServiceArgs = exports.keychainPlatform = exports.probeOsKeychain = exports.getLastTokenSaveResult = exports.tokenFingerprint = exports.deleteTokens = exports.loadTokens = exports.saveTokens = exports.assertNoTokenFields = exports.saveConfigFile = exports.loadConfigFile = exports.resolveProfile = exports.applyJqFilter = exports.writeError = exports.writeSuccess = exports.parseJsonEnvelope = exports.errorEnvelope = exports.successEnvelope = exports.parseGlobalFlags = exports.runCli = void 0;
-exports.parseUpdateArgs = exports.executeCliUpdate = exports.syncCurrentSkills = exports.skillsStatePath = exports.installedSkillsRoot = exports.inspectCurrentSkills = exports.writeSkillsManifest = exports.syncSkills = exports.loadSkillsState = exports.loadAndVerifySkillsManifest = exports.inspectSkills = exports.buildSkillsManifest = exports.SKILLS_GITHUB_SOURCE = exports.AGENT_INSTALL_GUIDE_URL = exports.AGENT_INSTALL_GUIDE_BLOB_URL = exports.skillsListHasAlphafox = exports.semverLessThan = exports.runInstallWizard = exports.parseInstallArgs = exports.loadJsonArg = exports.parseRequestBodyFlags = void 0;
+exports.shouldSkipUpdateCheck = exports.maybeNotifyCliUpdate = exports.formatUpdateNotice = exports.parseUpdateArgs = exports.executeCliUpdate = exports.syncCurrentSkills = exports.skillsStatePath = exports.installedSkillsRoot = exports.inspectCurrentSkills = exports.writeSkillsManifest = exports.syncSkills = exports.loadSkillsState = exports.loadAndVerifySkillsManifest = exports.inspectSkills = exports.buildSkillsManifest = exports.SKILLS_GITHUB_SOURCE = exports.AGENT_INSTALL_GUIDE_URL = exports.AGENT_INSTALL_GUIDE_BLOB_URL = exports.skillsListHasAlphafox = exports.semverLessThan = exports.runInstallWizard = exports.parseInstallArgs = exports.loadJsonArg = exports.parseRequestBodyFlags = void 0;
 var run_1 = require("./commands/run");
 Object.defineProperty(exports, "runCli", { enumerable: true, get: function () { return run_1.runCli; } });
 Object.defineProperty(exports, "parseGlobalFlags", { enumerable: true, get: function () { return run_1.parseGlobalFlags; } });
@@ -95,3 +95,7 @@ Object.defineProperty(exports, "syncCurrentSkills", { enumerable: true, get: fun
 var run_command_2 = require("./update/run-command");
 Object.defineProperty(exports, "executeCliUpdate", { enumerable: true, get: function () { return run_command_2.executeCliUpdate; } });
 Object.defineProperty(exports, "parseUpdateArgs", { enumerable: true, get: function () { return run_command_2.parseUpdateArgs; } });
+var notify_1 = require("./update/notify");
+Object.defineProperty(exports, "formatUpdateNotice", { enumerable: true, get: function () { return notify_1.formatUpdateNotice; } });
+Object.defineProperty(exports, "maybeNotifyCliUpdate", { enumerable: true, get: function () { return notify_1.maybeNotifyCliUpdate; } });
+Object.defineProperty(exports, "shouldSkipUpdateCheck", { enumerable: true, get: function () { return notify_1.shouldSkipUpdateCheck; } });

package/dist/skills-manifest.json

@@ -1,141 +1,141 @@
 {
   "schemaVersion": 1,
   "packageName": "@alphafox/cli",
-  "packageVersion": "0.3.5",
+  "packageVersion": "0.3.6",
   "contractVersion": "2026-08-13",
-  "bundleHash": "797ff48c83d6f0274e8726c4c6b5a3c9271c79116e9d8f90a268b4936efaeb65",
+  "bundleHash": "1eb4c16a941eee4c125efc6bb64ed7bb0db1d12b71f71cae66e55e64f600cf9a",
   "skills": [
     {
       "name": "alphafox",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "9b96984c09a656ef1f0c2b8c2d4c0c7a2ae10177d1b0abe0470ea9e5687095cd",
-          "size": 2184
+          "sha256": "a60f579e6321533d4f965c607f1158ddb50d1a89905d8793eca0b401b3f67fd2",
+          "size": 3055
         }
       ],
-      "hash": "1662dc2d889ef7429a4abf53061c6b5e83b2665998b4ccbfbf43338f373ef938"
+      "hash": "c47e6e2d6154e831a681b731e123053c2d20c6c77654191f0a78ae2137ce5304"
     },
     {
       "name": "alphafox-account",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "5e6244d3072e7cd9c9a5603d9c72e8ddf959cbca870f81603b7cfcb8d35b6212",
+          "sha256": "c60baab539cca008ccc48d53f0262d7a019db82b3945402d16b5ac84624b475f",
           "size": 783
         }
       ],
-      "hash": "674fe691cdf52c64af5360c09475b7444e8ce6a1c59fa061c39d9ed6b1dfd78e"
+      "hash": "e828192ec19a24bc18ce64d07a583eaba498e6a0c356214dbe18ccae6e9f6a6d"
     },
     {
       "name": "alphafox-admin",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "cf3503e7d8114767b806d3d2349695b0a2af582d470c16c99064df60792baaca",
+          "sha256": "87bbc12b803be021d94ad8161293263ce69e1d6c50f887a245ebe5c0a285e4f6",
           "size": 787
         }
       ],
-      "hash": "e33bb16a3f241ff29423023aebc044c26c6b4689feabe9b5f780dc3a5bdbb4a5"
+      "hash": "2881be10858efaad4543ffbe94f3bf87a91d4b0a4f3d905c3e0a5b8463e8756b"
     },
     {
       "name": "alphafox-auth",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "848fcd9422977c0bb3ee3355c2359c6efbb54e964b64ea253660e7ee12598f1a",
+          "sha256": "99e954df23206b0deb32761ce39396897d5af2ee8852e3a8340ed1b9c2e88a46",
           "size": 1919
         }
       ],
-      "hash": "c17ebdb46ebb36036d9958d8a6a31717af6945267575d7464561728e0c9d3205"
+      "hash": "659ca92bdfa0b31bcd1d39d7af151c308f1f9e7cd541bd38cf89326a825a38b8"
     },
     {
       "name": "alphafox-engine-backtest",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "8e91f3779ee93b680b90fa21d0e7e8fa7cc5ad4ca89941e1b9076526f09075e2",
+          "sha256": "176c329a665709461403671d34e73dd5b58bf389a328010c8a32cec5b949a9c5",
           "size": 7346
         }
       ],
-      "hash": "73943798e3787ad78a9955aad937154ca0b8a975e44117b78f1afecc9866f13b"
+      "hash": "23db5ab285f8600a43561ce3d4b7641ea45cd55c7c3b16d9f6fb7ff0c862b379"
     },
     {
       "name": "alphafox-exchange",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "ea7d153cd5806f471e45e5df2f0558835aa6ad413abe92667352288fa534ff2a",
+          "sha256": "089db4794cd55ba04278d4616cd6d5e92bc4c1d4c7c183001ea363bc4eeba578",
           "size": 743
         }
       ],
-      "hash": "88d3826590356eed7b3a3405188242ca7e3936856fcd74400c06da701da0b062"
+      "hash": "d4b0fe876ced82185eb477a23420cb24a8990f3dcbb6d4d5e9412dfd4cd2c279"
     },
     {
       "name": "alphafox-market",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "c816116463f6b8ef7d7281593500153119bd62d6635517faf71e769e36522385",
+          "sha256": "79fd7431c119b9d9318566c0419e2820ad9b06f0fda2882fdf9d1d7f4c1b9566",
           "size": 1801
         }
       ],
-      "hash": "01ae4ac923c4284af527f78991784e9b1bf2599daa57dcead89f2f72510278df"
+      "hash": "8814883b9b5bfb7eab4406fe1236091410dcb1130d4904dae8756e1302a02687"
     },
     {
       "name": "alphafox-notification",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "00c6b87f4742c3c5ea07276228c4b1ba718683abdf6e40c35024b270ec4abd49",
+          "sha256": "9a90360b83b72bb252349612cb052ffded40d00e07ca8568b76a6b13479252ac",
           "size": 698
         }
       ],
-      "hash": "c23e5ed2458d8d2fa58f04b24a1efe300c554b2029f9b218685d204c5f9ed2b7"
+      "hash": "99f8309b235b2b89734ed49d0a9e0e8981b5216025815fbe69f9101cf4f412cc"
     },
     {
       "name": "alphafox-shared",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "c8b7624e43242c3bf1a5f5e8d2101a6b53a0a7c62f04afac079e49a478eaaca9",
-          "size": 4750
+          "sha256": "60051a6c9b789e306ec968d3c8762a75039c34a0db2470dfddd1063bf2a3553f",
+          "size": 5071
         }
       ],
-      "hash": "a8d5bedffabb5b0c715bf88bd94f7a3ef4e3be77f854065806d4dd1440ef606f"
+      "hash": "20832738f9f15063291309871197b6274fd24f2630bd2525092ac017f7491b68"
     },
     {
       "name": "alphafox-strategy",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "8f94ea6fc3d36ddc8e6808e1e6ebdfcec56973a93fc86d0c6832eff2d6cf4022",
+          "sha256": "e4188e115eca6610c482bbcdf11ab1eb455cb5b6f242af96d1d8090e6ce9ce9d",
           "size": 1450
         }
       ],
-      "hash": "b1f5c6ae08bc2ea486b32c34c2e271ea504843972ccc7dbbb1e7e68d6a714f7d"
+      "hash": "878fd5c365eb33a431e91f6922a8cf45bcf94a7136b0105d50f3b487112c3573"
     },
     {
       "name": "alphafox-trading",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "2eddaa9c903daa62790ead007db4f0f6f412d1a14b291025937927eda6719d03",
+          "sha256": "098e0f975ae9f0169b0da696b76e74ffd3c6748e898e7c4f8c8f8a33aec47dc8",
           "size": 1435
         }
       ],
-      "hash": "d4b9e260145aca858e4d3a1f13bf81081c96bd8048d8d6eeb487e35dd78129fb"
+      "hash": "99b72870808f871ddeffd69ee89872e8532f2847494a0e5ad83de48ad58c675a"
     }
   ]
 }

package/dist/update/notify.d.ts

@@ -0,0 +1,24 @@
+export declare const UPDATE_CHECK_INTERVAL_MS: number;
+export interface UpdateCheckState {
+    readonly schemaVersion: 1;
+    readonly checkedAt: string;
+    readonly currentVersion: string;
+    readonly latestVersion: string | null;
+    readonly updateAvailable: boolean;
+}
+export interface UpdateNoticeResult {
+    readonly checked: boolean;
+    readonly notified: boolean;
+    readonly latestVersion: string | null;
+}
+export interface UpdateNoticeDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly currentVersion?: string;
+    readonly now?: Date;
+    readonly fetchLatest?: () => Promise<string>;
+    readonly writeNotice?: (line: string) => void;
+}
+export declare function updateCheckStatePath(env?: NodeJS.ProcessEnv): string;
+export declare function formatUpdateNotice(currentVersion: string, latestVersion: string): string;
+export declare function shouldSkipUpdateCheck(command: string | undefined, env?: NodeJS.ProcessEnv): boolean;
+export declare function maybeNotifyCliUpdate(deps?: UpdateNoticeDeps): Promise<UpdateNoticeResult>;

package/dist/update/notify.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPDATE_CHECK_INTERVAL_MS = void 0;
+exports.updateCheckStatePath = updateCheckStatePath;
+exports.formatUpdateNotice = formatUpdateNotice;
+exports.shouldSkipUpdateCheck = shouldSkipUpdateCheck;
+exports.maybeNotifyCliUpdate = maybeNotifyCliUpdate;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const profiles_1 = require("../config/profiles");
+const exec_1 = require("../install/exec");
+const wizard_1 = require("../install/wizard");
+const version_1 = require("../version");
+exports.UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const NPM_VIEW_TIMEOUT_MS = 4_000;
+function updateCheckStatePath(env = process.env) {
+    return (0, node_path_1.join)((0, profiles_1.defaultConfigDir)(env), "update-check.json");
+}
+function formatUpdateNotice(currentVersion, latestVersion) {
+    return `[alphafox] update available: ${currentVersion} -> ${latestVersion}. After the user confirms, run: alphafox update --format json --no-input`;
+}
+function shouldSkipUpdateCheck(command, env = process.env) {
+    if (env.ALPHAFOX_SKIP_UPDATE_CHECK === "1")
+        return true;
+    return command === "update" || command === "install";
+}
+async function maybeNotifyCliUpdate(deps = {}) {
+    const env = deps.env ?? process.env;
+    const currentVersion = deps.currentVersion ?? version_1.CLI_VERSION;
+    const now = deps.now ?? new Date();
+    const writeNotice = deps.writeNotice ??
+        ((line) => {
+            process.stderr.write(`${line}\n`);
+        });
+    const previous = loadUpdateCheckState(updateCheckStatePath(env));
+    if (previous &&
+        now.getTime() - Date.parse(previous.checkedAt) < exports.UPDATE_CHECK_INTERVAL_MS) {
+        return {
+            checked: false,
+            notified: false,
+            latestVersion: previous.latestVersion,
+        };
+    }
+    let latestVersion = null;
+    try {
+        latestVersion = await (deps.fetchLatest ?? defaultFetchLatest)(env);
+    }
+    catch {
+        saveUpdateCheckState(updateCheckStatePath(env), {
+            schemaVersion: 1,
+            checkedAt: now.toISOString(),
+            currentVersion,
+            latestVersion: previous?.latestVersion ?? null,
+            updateAvailable: false,
+        });
+        return {
+            checked: true,
+            notified: false,
+            latestVersion: previous?.latestVersion ?? null,
+        };
+    }
+    const updateAvailable = (0, wizard_1.semverLessThan)(currentVersion, latestVersion);
+    saveUpdateCheckState(updateCheckStatePath(env), {
+        schemaVersion: 1,
+        checkedAt: now.toISOString(),
+        currentVersion,
+        latestVersion,
+        updateAvailable,
+    });
+    if (updateAvailable) {
+        writeNotice(formatUpdateNotice(currentVersion, latestVersion));
+    }
+    return {
+        checked: true,
+        notified: updateAvailable,
+        latestVersion,
+    };
+}
+function loadUpdateCheckState(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+        if (parsed.schemaVersion !== 1 ||
+            typeof parsed.checkedAt !== "string" ||
+            Number.isNaN(Date.parse(parsed.checkedAt))) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function saveUpdateCheckState(path, state) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(path, ".."), { recursive: true });
+    (0, node_fs_1.writeFileSync)(path, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+}
+async function defaultFetchLatest(env) {
+    const runner = (0, exec_1.createDefaultInstallRunner)(env, []);
+    const { stdout } = await runner.exec("npm", ["view", version_1.CLI_PACKAGE, "version"], {
+        timeoutMs: NPM_VIEW_TIMEOUT_MS,
+    });
+    const version = stdout.trim();
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+        throw new Error(`invalid npm version: ${version}`);
+    }
+    return version;
+}

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.3.5";
+export declare const CLI_VERSION = "0.3.6";
 export { CATALOG_VERSION as CLI_CONTRACT_VERSION } from "./catalog/operations";

package/dist/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.3.5";
+exports.CLI_VERSION = "0.3.6";
 var operations_1 = require("./catalog/operations");
 Object.defineProperty(exports, "CLI_CONTRACT_VERSION", { enumerable: true, get: function () { return operations_1.CATALOG_VERSION; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "AlphaFox CLI — Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {

package/skills/account/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-account
 description: Account, wallet, and subscription read paths.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Account / wallet

package/skills/admin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-admin
 description: Admin-only operations reusing Web role authorization.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Admin

package/skills/alphafox/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox
-description: AlphaFox CLI entry router. Use for any AlphaFox request — install, update, login, whoami, 回测, engine backtest, strategy chat, traders, ticker/标的 resolve, market data, exchange connectors, wallet, subscriptions, notifications, or admin. Start here, then open the routed domain skill. Do not guess alphafox-engine-backtest vs alphafox-strategy from memory.
-version: 0.3.5
+description: AlphaFox CLI entry router. Use for any AlphaFox request — install, update, login, whoami, 回测, engine backtest, strategy chat, traders, ticker/标的 resolve, market data, exchange connectors, wallet, subscriptions, notifications, or admin. If a CLI command prints `[alphafox] update available`, ask the user「检测到新的版本，是否需要我帮你升级？」and only then run `alphafox update --format json --no-input`. Start here, then open the routed domain skill. Do not guess alphafox-engine-backtest vs alphafox-strategy from memory.
+version: 0.3.6
 ---
 
 # AlphaFox
@@ -29,6 +29,28 @@ Human-mentioned tickers go through `alphafox-market` (`alphafox resolve-symbols`
 
 If several rows apply, load **all** of them (typical: `alphafox-shared` + `alphafox-market` + one domain skill).
 
+## Upgrade reminder
+
+The CLI may print this on **stderr** at most once every 24 hours:
+
+```text
+[alphafox] update available: 0.3.5 -> 0.3.6. After the user confirms, run: alphafox update --format json --no-input
+```
+
+If you see that notice (or `updateAvailable: true` from `alphafox update --check`):
+
+1. Ask the user: **检测到新的版本，是否需要我帮你升级？**
+2. Wait for an explicit yes. Do not upgrade on your own.
+3. After they confirm:
+
+```bash
+alphafox update --format json --no-input
+```
+
+4. Tell the user to **restart the AI tool** so the new Skills load.
+
+Do not install Skills from GitHub. Details and dry-run / check commands live in `alphafox-shared`.
+
 ## Do not mix these backtest paths
 
 - Local Engine tape + wasm + optional persist → `alphafox-engine-backtest` (`alphafox engine-backtest run`, hyphen).

package/skills/alphafox-shared/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-shared
 description: Shared AlphaFox CLI rules for Agents — auth, profiles, envelopes, risk gates, and public operationIds only.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # AlphaFox shared Agent contract
@@ -24,7 +24,13 @@ npx @alphafox/cli version --format json --no-input
 npx @alphafox/cli doctor --format json --no-input
 ```
 
-Update checks are read-only. A real update keeps CLI and Skills co-versioned:
+The CLI checks npm at most once every 24 hours and only prints a notice on
+**stderr**. It never auto-upgrades. If you see
+`[alphafox] update available` (or `updateAvailable: true`), ask the user:
+
+**检测到新的版本，是否需要我帮你升级？**
+
+Wait for an explicit yes. Then keep CLI and Skills co-versioned:
 
 ```bash
 alphafox update --check --format json --no-input
@@ -32,6 +38,8 @@ alphafox update --format json --no-input
 alphafox skills status --format json --no-input
 ```
 
+After a successful `alphafox update`, tell the user to restart the AI tool.
+
 Never update AlphaFox Skills independently from GitHub. If `skills status`
 reports local modifications, stop and ask before using
 `alphafox skills sync --force --yes`; the CLI backs up replaced files.

package/skills/auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-auth
 description: Login, status, logout, whoami, and environment isolation for AlphaFox CLI.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Auth Skill

package/skills/engine-backtest/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-engine-backtest
 description: Local Engine WASM backtest (alphafox engine-backtest run|sweep) vs catalog experiment CRUD.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Engine Backtest

package/skills/exchange/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-exchange
 description: Exchange connectors list and connection management via Public API.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Exchange connectors

package/skills/market/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-market
 description: Market data, ticker resolution, and spread-radar readonly queries.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Market

package/skills/notification/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-notification
 description: Notification channels and subscriptions.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Notification

package/skills/strategy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-strategy
 description: Strategy definitions and chats via public operationIds.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Strategy / Chat

package/skills/trading/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-trading
 description: Traders list and high-risk start/stop with confirmation gates.
-version: 0.3.5
+version: 0.3.6
 ---
 
 # Trading