@bud-fe/skills 0.0.2 → 0.0.4

package/README.md

@@ -1,19 +1,28 @@
 # skills-x
 
-The CLI for the open agent skills, commands ecosystem.
+Forked from [vercel-labs/skills](https://github.com/vercel-labs/skills).
+
+## Changes based on upstream
+
+### ADDED
 
-Forked from [vercel-labs/skills](https://github.com/vercel-labs/skills), **recent spec changes**:
+- `add-c` 命令：支持按名称从默认源的 `commands/` 目录安装 slash command 文件
 
-- `skills add` now supports implicit default-registry source resolution when flags are provided without a source (for example `--list` and `--all`).
-- `skills add` maps simple identifiers (for example `code-review`) to the curated default registry, while explicit sources (`owner/repo`, URLs, local paths) keep their existing behavior.
-- `skills add-c` installs command markdown files from the default registry `commands/` directory by command name.
-- `skills find` is provider-scoped:
-  - default mode searches the curated registry
-  - `-g` / `--global` searches [skills.sh](https://skills.sh)
-  - the CLI does not silently fall back to another provider if the selected provider fails
+### MODIFIED
+
+- `add` 命令
+  - 支持在未提供源但携带标志（如 `--list` 和 `--all`）时，自动解析至默认源
+  - 将简单标识符（如 `code-review`）映射到默认源，而显式源（`owner/repo`、URL、本地路径）保持原有行为
+- `find` 命令
+  - 无参数时默认从默认源搜索
+  - `-g` / `--global` 搜索 [skills.sh](https://skills.sh)（即原逻辑）
+- `check` 和 `update`
+  - 支持非 GitHub 源（如 GitLab、通用 Git），采用基于内容的内容哈希（SHA-256）进行更新检测
 
 ---
 
+The CLI for the open agent skills, commands ecosystem.
+
 <!-- agent-list:start -->
 
 Supports **OpenCode**, **Claude Code**, **Codex**, **Cursor**, and [37 more](#available-agents).

package/dist/_chunks/libs/xdg-basedir.mjs

@@ -1,5 +1,5 @@
-import path from "path";
 import os from "os";
+import path from "path";
 const homeDirectory = os.homedir();
 const { env } = process;
 const xdgData = env.XDG_DATA_HOME || (homeDirectory ? path.join(homeDirectory, ".local", "share") : void 0);

package/dist/cli.mjs

@@ -9,17 +9,17 @@ import "./_chunks/libs/esprima.mjs";
 import "./_chunks/libs/@kwsites/file-exists.mjs";
 import "./_chunks/libs/@kwsites/promise-deferred.mjs";
 import { t as esm_default } from "./_chunks/libs/simple-git.mjs";
-import { execSync, spawn, spawnSync } from "child_process";
+import { execSync, spawnSync } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
 import { homedir, platform, tmpdir } from "os";
-import { createHash } from "crypto";
+import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
+import { createHash } from "crypto";
 import * as readline from "readline";
 import { Writable } from "stream";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
-var version$1 = "0.0.2";
+var version$1 = "0.0.4";
 const home = homedir();
 const configHome = xdgConfig ?? join(home, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home, ".codex");
@@ -104,6 +104,8 @@ const agents = {
 		displayName: "Codex",
 		skillsDir: ".agents/skills",
 		globalSkillsDir: join(codexHome, "skills"),
+		commandsDir: ".codex/prompts",
+		globalCommandsDir: join(codexHome, "prompts"),
 		detectInstalled: async () => {
 			return existsSync(codexHome) || existsSync("/etc/codex");
 		}
@@ -1295,6 +1297,72 @@ async function listInstalledSkills(options = {}) {
 	} catch {}
 	return Array.from(skillsMap.values());
 }
+const LOCAL_LOCK_FILE = "skills-lock.json";
+const CURRENT_VERSION$1 = 1;
+function getLocalLockPath(cwd) {
+	return join(cwd || process.cwd(), LOCAL_LOCK_FILE);
+}
+async function readLocalLock(cwd) {
+	const lockPath = getLocalLockPath(cwd);
+	try {
+		const content = await readFile(lockPath, "utf-8");
+		const parsed = JSON.parse(content);
+		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
+		if (parsed.version < CURRENT_VERSION$1) return createEmptyLocalLock();
+		return parsed;
+	} catch {
+		return createEmptyLocalLock();
+	}
+}
+async function writeLocalLock(lock, cwd) {
+	const lockPath = getLocalLockPath(cwd);
+	const sortedSkills = {};
+	for (const key of Object.keys(lock.skills).sort()) sortedSkills[key] = lock.skills[key];
+	const sorted = {
+		version: lock.version,
+		skills: sortedSkills
+	};
+	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
+}
+async function computeSkillFolderHash(skillDir) {
+	const files = [];
+	await collectFiles(skillDir, skillDir, files);
+	files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+	const hash = createHash("sha256");
+	for (const file of files) {
+		hash.update(file.relativePath);
+		hash.update(file.content);
+	}
+	return hash.digest("hex");
+}
+async function collectFiles(baseDir, currentDir, results) {
+	const entries = await readdir(currentDir, { withFileTypes: true });
+	await Promise.all(entries.map(async (entry) => {
+		const fullPath = join(currentDir, entry.name);
+		if (entry.isDirectory()) {
+			if (entry.name === ".git" || entry.name === "node_modules") return;
+			await collectFiles(baseDir, fullPath, results);
+		} else if (entry.isFile()) {
+			const content = await readFile(fullPath);
+			const relativePath = relative(baseDir, fullPath).split("\\").join("/");
+			results.push({
+				relativePath,
+				content
+			});
+		}
+	}));
+}
+async function addSkillToLocalLock(skillName, entry, cwd) {
+	const lock = await readLocalLock(cwd);
+	lock.skills[skillName] = entry;
+	await writeLocalLock(lock, cwd);
+}
+function createEmptyLocalLock() {
+	return {
+		version: CURRENT_VERSION$1,
+		skills: {}
+	};
+}
 async function fetchMintlifySkill(url) {
 	try {
 		const response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
@@ -1770,7 +1838,7 @@ registerProvider(mintlifyProvider);
 registerProvider(huggingFaceProvider);
 const AGENTS_DIR$1 = ".agents";
 const LOCK_FILE$1 = ".skill-lock.json";
-const CURRENT_VERSION$1 = 3;
+const CURRENT_VERSION = 3;
 function getSkillLockPath$1() {
 	return join(homedir(), AGENTS_DIR$1, LOCK_FILE$1);
 }
@@ -1780,7 +1848,7 @@ async function readSkillLock$1() {
 		const content = await readFile(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
 		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLockFile();
-		if (parsed.version < CURRENT_VERSION$1) return createEmptyLockFile();
+		if (parsed.version < CURRENT_VERSION) return createEmptyLockFile();
 		return parsed;
 	} catch (error) {
 		return createEmptyLockFile();
@@ -1853,7 +1921,7 @@ async function getSkillFromLock(skillName) {
 }
 function createEmptyLockFile() {
 	return {
-		version: CURRENT_VERSION$1,
+		version: CURRENT_VERSION,
 		skills: {},
 		dismissed: {}
 	};
@@ -1875,72 +1943,6 @@ async function saveSelectedAgents(agents) {
 	lock.lastSelectedAgents = agents;
 	await writeSkillLock(lock);
 }
-const LOCAL_LOCK_FILE = "skills-lock.json";
-const CURRENT_VERSION = 1;
-function getLocalLockPath(cwd) {
-	return join(cwd || process.cwd(), LOCAL_LOCK_FILE);
-}
-async function readLocalLock(cwd) {
-	const lockPath = getLocalLockPath(cwd);
-	try {
-		const content = await readFile(lockPath, "utf-8");
-		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
-		if (parsed.version < CURRENT_VERSION) return createEmptyLocalLock();
-		return parsed;
-	} catch {
-		return createEmptyLocalLock();
-	}
-}
-async function writeLocalLock(lock, cwd) {
-	const lockPath = getLocalLockPath(cwd);
-	const sortedSkills = {};
-	for (const key of Object.keys(lock.skills).sort()) sortedSkills[key] = lock.skills[key];
-	const sorted = {
-		version: lock.version,
-		skills: sortedSkills
-	};
-	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
-}
-async function computeSkillFolderHash(skillDir) {
-	const files = [];
-	await collectFiles(skillDir, skillDir, files);
-	files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-	const hash = createHash("sha256");
-	for (const file of files) {
-		hash.update(file.relativePath);
-		hash.update(file.content);
-	}
-	return hash.digest("hex");
-}
-async function collectFiles(baseDir, currentDir, results) {
-	const entries = await readdir(currentDir, { withFileTypes: true });
-	await Promise.all(entries.map(async (entry) => {
-		const fullPath = join(currentDir, entry.name);
-		if (entry.isDirectory()) {
-			if (entry.name === ".git" || entry.name === "node_modules") return;
-			await collectFiles(baseDir, fullPath, results);
-		} else if (entry.isFile()) {
-			const content = await readFile(fullPath);
-			const relativePath = relative(baseDir, fullPath).split("\\").join("/");
-			results.push({
-				relativePath,
-				content
-			});
-		}
-	}));
-}
-async function addSkillToLocalLock(skillName, entry, cwd) {
-	const lock = await readLocalLock(cwd);
-	lock.skills[skillName] = entry;
-	await writeLocalLock(lock, cwd);
-}
-function createEmptyLocalLock() {
-	return {
-		version: CURRENT_VERSION,
-		skills: {}
-	};
-}
 function getOwnerRepo(parsed) {
 	if (parsed.type === "local") return null;
 	if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
@@ -2073,8 +2075,7 @@ function parseSource(input) {
 		url: input
 	};
 	if (input.match(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i) && !input.includes("/") && !input.includes(":") && !input.startsWith(".")) return {
-		type: "github",
-		url: DEFAULT_REGISTRY_URL,
+		...parseSource(DEFAULT_REGISTRY_URL),
 		subpath: DEFAULT_REGISTRY_SUBPATH,
 		skillFilter: input
 	};
@@ -2322,6 +2323,33 @@ async function selectAgentsInteractive(options) {
 	return selected;
 }
 setVersion(version$1);
+async function resolveGlobalLockHashData(params, deps = {
+	fetchGitHubHash: fetchSkillFolderHash,
+	computeFolderHash: computeSkillFolderHash
+}) {
+	if (params.sourceType === "github") {
+		let skillFolderHash = "";
+		if (params.normalizedSource && params.skillPathValue) try {
+			const hash = await deps.fetchGitHubHash(params.normalizedSource, params.skillPathValue);
+			if (hash) skillFolderHash = hash;
+		} catch {}
+		return {
+			skillFolderHash,
+			hashMethod: "github-tree-sha"
+		};
+	}
+	if (params.sourceType === "git" || params.sourceType === "gitlab") {
+		let skillFolderHash = "";
+		if (params.installDir) try {
+			skillFolderHash = await deps.computeFolderHash(params.installDir);
+		} catch {}
+		return {
+			skillFolderHash,
+			hashMethod: "content-sha256"
+		};
+	}
+	return { skillFolderHash: "" };
+}
 async function handleRemoteSkill(source, url, options, spinner) {
 	const provider = findProvider(url);
 	if (!provider) {
@@ -2494,7 +2522,9 @@ async function handleRemoteSkill(source, url, options, spinner) {
 	});
 	if (successful.length > 0 && installGlobally) try {
 		let skillFolderHash = "";
+		let hashMethod;
 		if (remoteSkill.providerId === "github") {
+			hashMethod = "github-tree-sha";
 			const hash = await fetchSkillFolderHash(remoteSkill.sourceIdentifier, url);
 			if (hash) skillFolderHash = hash;
 		}
@@ -2502,7 +2532,8 @@ async function handleRemoteSkill(source, url, options, spinner) {
 			source: remoteSkill.sourceIdentifier,
 			sourceType: remoteSkill.providerId,
 			sourceUrl: url,
-			skillFolderHash
+			skillFolderHash,
+			hashMethod
 		});
 	} catch {}
 	if (successful.length > 0 && !installGlobally) try {
@@ -3025,12 +3056,12 @@ async function runAdd(args, options = {}) {
 		console.log(import_picocolors.default.bgRed(import_picocolors.default.white(import_picocolors.default.bold(" ERROR "))) + " " + import_picocolors.default.red("Missing required argument: source"));
 		console.log();
 		console.log(import_picocolors.default.dim("  Usage:"));
-		console.log(`    ${import_picocolors.default.cyan("npx skills add")} ${import_picocolors.default.yellow("<source>")} ${import_picocolors.default.dim("[options]")}`);
-		console.log(`    ${import_picocolors.default.cyan("npx skills add")} ${import_picocolors.default.yellow("[options]")} ${import_picocolors.default.dim("(uses default registry)")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add")} ${import_picocolors.default.yellow("<source>")} ${import_picocolors.default.dim("[options]")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add")} ${import_picocolors.default.yellow("[options]")} ${import_picocolors.default.dim("(uses default registry)")}`);
 		console.log();
 		console.log(import_picocolors.default.dim("  Example:"));
-		console.log(`    ${import_picocolors.default.cyan("npx skills add")} ${import_picocolors.default.yellow("vercel-labs/agent-skills")}`);
-		console.log(`    ${import_picocolors.default.cyan("npx skills add")} ${import_picocolors.default.yellow("--all")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add")} ${import_picocolors.default.yellow("vercel-labs/agent-skills")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add")} ${import_picocolors.default.yellow("--all")}`);
 		console.log();
 		process.exit(1);
 	}
@@ -3329,18 +3360,22 @@ async function runAdd(args, options = {}) {
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
-					let skillFolderHash = "";
 					const skillPathValue = skillFiles[skill.name];
-					if (parsed.type === "github" && skillPathValue) {
-						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue);
-						if (hash) skillFolderHash = hash;
-					}
+					const matchingResult = successful.find((r) => r.skill === skillDisplayName);
+					const installDir = matchingResult?.canonicalPath || matchingResult?.path;
+					const { skillFolderHash, hashMethod } = await resolveGlobalLockHashData({
+						sourceType: parsed.type,
+						normalizedSource,
+						skillPathValue,
+						installDir
+					});
 					await addSkillToLock(skill.name, {
 						source: normalizedSource,
 						sourceType: parsed.type,
 						sourceUrl: parsed.url,
 						skillPath: skillPathValue,
-						skillFolderHash
+						skillFolderHash,
+						hashMethod
 					});
 				} catch {}
 			}
@@ -3446,12 +3481,12 @@ async function runAddCommand(args, options = {}) {
 		console.log(import_picocolors.default.bgRed(import_picocolors.default.white(import_picocolors.default.bold(" ERROR "))) + " " + import_picocolors.default.red("Missing required argument: command"));
 		console.log();
 		console.log(import_picocolors.default.dim("  Usage:"));
-		console.log(`    ${import_picocolors.default.cyan("npx skills add-c")} ${import_picocolors.default.yellow("<command>")} ${import_picocolors.default.dim("[options]")}`);
-		console.log(`    ${import_picocolors.default.cyan("npx skills add-c")} ${import_picocolors.default.yellow("[options]")} ${import_picocolors.default.dim("(uses default registry)")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add-c")} ${import_picocolors.default.yellow("<command>")} ${import_picocolors.default.dim("[options]")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add-c")} ${import_picocolors.default.yellow("[options]")} ${import_picocolors.default.dim("(uses default registry)")}`);
 		console.log();
 		console.log(import_picocolors.default.dim("  Example:"));
-		console.log(`    ${import_picocolors.default.cyan("npx skills add-c")} ${import_picocolors.default.yellow("my-command")}`);
-		console.log(`    ${import_picocolors.default.cyan("npx skills add-c")} ${import_picocolors.default.yellow("--list")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add-c")} ${import_picocolors.default.yellow("my-command")}`);
+		console.log(`    ${import_picocolors.default.cyan("npx @bud-fe/skills add-c")} ${import_picocolors.default.yellow("--list")}`);
 		console.log();
 		process.exit(1);
 	}
@@ -3795,11 +3830,11 @@ async function promptForFindSkills(options, targetAgents) {
 				});
 			} catch {
 				M.warn("Failed to install find-skills. You can try again with:");
-				M.message(import_picocolors.default.dim("  npx skills add vercel-labs/skills@find-skills -g -y --all"));
+				M.message(import_picocolors.default.dim("  npx @bud-fe/skills add vercel-labs/skills@find-skills -g -y --all"));
 			}
 		} else {
 			await dismissPrompt("findSkillsPrompt");
-			M.message(import_picocolors.default.dim("You can install it later with: npx skills add vercel-labs/skills@find-skills"));
+			M.message(import_picocolors.default.dim("You can install it later with: npx @bud-fe/skills add vercel-labs/skills@find-skills"));
 		}
 	} catch {}
 }
@@ -3983,7 +4018,7 @@ function formatNonInteractiveResults(mode, defaultResults, apiResults) {
 	const hasDefault = mode === "default" && defaultResults.length > 0;
 	const hasApi = mode === "global" && apiResults.length > 0;
 	if (hasDefault) {
-		lines.push(`${DIM$2}Install with${RESET$2} npx skills add <name>${DIM$2} (From default registry)${RESET$2}`);
+		lines.push(`${DIM$2}Install with${RESET$2} npx @bud-fe/skills add <name>${DIM$2} (From default registry)${RESET$2}`);
 		lines.push("");
 		for (const skill of defaultResults) {
 			lines.push(`${TEXT$1}${skill.name}${RESET$2}`);
@@ -3992,7 +4027,7 @@ function formatNonInteractiveResults(mode, defaultResults, apiResults) {
 		}
 	}
 	if (hasApi) {
-		lines.push(`${DIM$2}Install with${RESET$2} npx skills add <owner/repo@skill>${DIM$2} (From https://skills.sh)${RESET$2}`);
+		lines.push(`${DIM$2}Install with${RESET$2} npx @bud-fe/skills add <owner/repo@skill>${DIM$2} (From https://skills.sh)${RESET$2}`);
 		lines.push("");
 		for (const skill of apiResults.slice(0, 6)) {
 			const pkg = skill.source || skill.slug;
@@ -4177,9 +4212,9 @@ async function runFind(args) {
 	const { mode, query } = parseFindArgs(args);
 	const isNonInteractive = !process.stdin.isTTY;
 	const agentTip = `${DIM$2}Tip: if running in a coding agent, follow these steps:${RESET$2}
-${DIM$2}  1) npx skills find [query]${RESET$2}
-${DIM$2}  2) npx skills find -g [query]${RESET$2}
-${DIM$2}  3) npx skills add <owner/repo@skill>${RESET$2}`;
+${DIM$2}  1) npx @bud-fe/skills find [query]${RESET$2}
+${DIM$2}  2) npx @bud-fe/skills find -g [query]${RESET$2}
+${DIM$2}  3) npx @bud-fe/skills add <owner/repo@skill>${RESET$2}`;
 	if (query) {
 		const { defaultResults, apiResults } = await searchSkillsByMode(query, mode);
 		const totalResults = defaultResults.length + apiResults.length;
@@ -4526,7 +4561,7 @@ async function runInstallFromLock(args) {
 	const skillEntries = Object.entries(lock.skills);
 	if (skillEntries.length === 0) {
 		M.warn("No project skills found in skills-lock.json");
-		M.info(`Add project-level skills with ${import_picocolors.default.cyan("npx skills add <package>")} (without ${import_picocolors.default.cyan("-g")})`);
+		M.info(`Add project-level skills with ${import_picocolors.default.cyan("npx @bud-fe/skills add <package>")} (without ${import_picocolors.default.cyan("-g")})`);
 		return;
 	}
 	const universalAgentNames = getUniversalAgents();
@@ -4826,6 +4861,142 @@ function parseRemoveOptions(args) {
 		options
 	};
 }
+const DEFAULT_DEPS = {
+	fetchGitHubHash: fetchSkillFolderHash,
+	cloneRepo,
+	cleanupTempDir,
+	computeFolderHash: computeSkillFolderHash,
+	pathExists: existsSync
+};
+function normalizeSkillFolderPath(skillPath) {
+	let folderPath = skillPath.replace(/\\/g, "/");
+	if (folderPath.endsWith("/SKILL.md")) folderPath = folderPath.slice(0, -9);
+	else if (folderPath.endsWith("SKILL.md")) folderPath = folderPath.slice(0, -8);
+	if (folderPath.endsWith("/")) folderPath = folderPath.slice(0, -1);
+	return folderPath;
+}
+function resolveHashMethod(entry) {
+	if (entry.hashMethod === "github-tree-sha" || entry.hashMethod === "content-sha256") return entry.hashMethod;
+	if (entry.sourceType === "github") return "github-tree-sha";
+	if ((entry.sourceType === "git" || entry.sourceType === "gitlab") && !!entry.skillFolderHash) return "content-sha256";
+	return null;
+}
+async function detectSkillUpdates(lock, options = {}) {
+	const deps = {
+		...DEFAULT_DEPS,
+		...options.deps || {}
+	};
+	const githubSkillsBySource = /* @__PURE__ */ new Map();
+	const contentSkillsBySourceUrl = /* @__PURE__ */ new Map();
+	let skippedMissingMetadata = 0;
+	for (const [name, entry] of Object.entries(lock.skills)) {
+		const hashMethod = resolveHashMethod(entry);
+		if (!hashMethod || !entry.skillPath || !entry.skillFolderHash) {
+			skippedMissingMetadata++;
+			continue;
+		}
+		if (hashMethod === "github-tree-sha") {
+			const bucket = githubSkillsBySource.get(entry.source) || [];
+			bucket.push({
+				name,
+				entry
+			});
+			githubSkillsBySource.set(entry.source, bucket);
+			continue;
+		}
+		if (!entry.sourceUrl) {
+			skippedMissingMetadata++;
+			continue;
+		}
+		const bucket = contentSkillsBySourceUrl.get(entry.sourceUrl) || [];
+		bucket.push({
+			name,
+			entry
+		});
+		contentSkillsBySourceUrl.set(entry.sourceUrl, bucket);
+	}
+	const updates = [];
+	const errors = [];
+	let checkedCount = 0;
+	for (const [source, skills] of githubSkillsBySource) for (const { name, entry } of skills) {
+		checkedCount++;
+		try {
+			const latestHash = await deps.fetchGitHubHash(source, entry.skillPath, options.githubToken);
+			if (!latestHash) {
+				errors.push({
+					name,
+					source,
+					error: "Could not fetch from GitHub"
+				});
+				continue;
+			}
+			if (latestHash !== entry.skillFolderHash) updates.push({
+				name,
+				source,
+				entry
+			});
+		} catch (err) {
+			errors.push({
+				name,
+				source,
+				error: err instanceof Error ? err.message : "Unknown error"
+			});
+		}
+	}
+	for (const [sourceUrl, skills] of contentSkillsBySourceUrl) {
+		let tempDir = null;
+		try {
+			tempDir = await deps.cloneRepo(sourceUrl);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : "Failed to clone source repository";
+			for (const { name, entry } of skills) {
+				checkedCount++;
+				errors.push({
+					name,
+					source: entry.source,
+					error: message
+				});
+			}
+			continue;
+		}
+		try {
+			for (const { name, entry } of skills) {
+				checkedCount++;
+				try {
+					const folderPath = normalizeSkillFolderPath(entry.skillPath);
+					const targetDir = folderPath ? join(tempDir, folderPath) : tempDir;
+					if (!deps.pathExists(targetDir)) {
+						errors.push({
+							name,
+							source: entry.source,
+							error: `Skill path not found: ${folderPath}`
+						});
+						continue;
+					}
+					if (await deps.computeFolderHash(targetDir) !== entry.skillFolderHash) updates.push({
+						name,
+						source: entry.source,
+						entry
+					});
+				} catch (err) {
+					errors.push({
+						name,
+						source: entry.source,
+						error: err instanceof Error ? err.message : "Unknown error"
+					});
+				}
+			}
+		} finally {
+			await deps.cleanupTempDir(tempDir).catch(() => {});
+		}
+	}
+	return {
+		checkedCount,
+		skippedMissingMetadata,
+		updates,
+		errors
+	};
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
 	try {
@@ -4866,20 +5037,20 @@ function showBanner() {
 	console.log();
 	console.log(`${DIM}The open agent skills ecosystem${RESET}`);
 	console.log();
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills add ${DIM}<package>${RESET}        ${DIM}Add a new skill${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills add-c ${DIM}<command>${RESET} ${DIM}Install a command${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills remove${RESET}               ${DIM}Remove installed skills${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills list${RESET}                 ${DIM}List installed skills${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills find ${DIM}[query] [-g]${RESET}    ${DIM}Search skills (default registry or global)${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills add ${DIM}<package>${RESET}        ${DIM}Add a new skill${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills add-c ${DIM}<command>${RESET} ${DIM}Install a command${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills remove${RESET}               ${DIM}Remove installed skills${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills list${RESET}                 ${DIM}List installed skills${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills find ${DIM}[query] [-g]${RESET}    ${DIM}Search skills (default registry or global)${RESET}`);
 	console.log();
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills check${RESET}                ${DIM}Check for updates${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills update${RESET}               ${DIM}Update all skills${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills check${RESET}                ${DIM}Check for updates${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills update${RESET}               ${DIM}Update all skills${RESET}`);
 	console.log();
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills experimental_install${RESET} ${DIM}Restore from skills-lock.json${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills init ${DIM}[name]${RESET}          ${DIM}Create a new skill${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx skills experimental_sync${RESET}    ${DIM}Sync skills from node_modules${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills experimental_install${RESET} ${DIM}Restore from skills-lock.json${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills init ${DIM}[name]${RESET}          ${DIM}Create a new skill${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx @bud-fe/skills experimental_sync${RESET}    ${DIM}Sync skills from node_modules${RESET}`);
 	console.log();
-	console.log(`${DIM}try:${RESET} npx skills add vercel-labs/agent-skills`);
+	console.log(`${DIM}try:${RESET} npx @bud-fe/skills add vercel-labs/agent-skills`);
 	console.log();
 	console.log(`Discover more skills at ${TEXT}https://skills.sh/${RESET}`);
 	console.log();
@@ -5043,8 +5214,8 @@ Describe when this skill should be used.
 	console.log(`  2. Update the ${TEXT}name${RESET} and ${TEXT}description${RESET} in the frontmatter`);
 	console.log();
 	console.log(`${DIM}Publishing:${RESET}`);
-	console.log(`  ${DIM}GitHub:${RESET}  Push to a repo, then ${TEXT}npx skills add <owner>/<repo>${RESET}`);
-	console.log(`  ${DIM}URL:${RESET}     Host the file, then ${TEXT}npx skills add https://example.com/${displayPath}${RESET}`);
+	console.log(`  ${DIM}GitHub:${RESET}  Push to a repo, then ${TEXT}npx @bud-fe/skills add <owner>/<repo>${RESET}`);
+	console.log(`  ${DIM}URL:${RESET}     Host the file, then ${TEXT}npx @bud-fe/skills add https://example.com/${displayPath}${RESET}`);
 	console.log();
 	console.log(`Browse existing skills for inspiration at ${TEXT}https://skills.sh/${RESET}`);
 	console.log();
@@ -5080,58 +5251,21 @@ async function runCheck(args = []) {
 	console.log(`${TEXT}Checking for skill updates...${RESET}`);
 	console.log();
 	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	if (skillNames.length === 0) {
+	if (Object.keys(lock.skills).length === 0) {
 		console.log(`${DIM}No skills tracked in lock file.${RESET}`);
-		console.log(`${DIM}Install skills with${RESET} ${TEXT}npx skills add <package>${RESET}`);
+		console.log(`${DIM}Install skills with${RESET} ${TEXT}npx @bud-fe/skills add <package>${RESET}`);
 		return;
 	}
-	const token = getGitHubToken();
-	const skillsBySource = /* @__PURE__ */ new Map();
-	let skippedCount = 0;
-	for (const skillName of skillNames) {
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (entry.sourceType !== "github" || !entry.skillFolderHash || !entry.skillPath) {
-			skippedCount++;
-			continue;
-		}
-		const existing = skillsBySource.get(entry.source) || [];
-		existing.push({
-			name: skillName,
-			entry
-		});
-		skillsBySource.set(entry.source, existing);
-	}
-	const totalSkills = skillNames.length - skippedCount;
+	const result = await detectSkillUpdates(lock, { githubToken: getGitHubToken() });
+	const totalSkills = result.checkedCount;
 	if (totalSkills === 0) {
-		console.log(`${DIM}No GitHub skills to check.${RESET}`);
+		console.log(`${DIM}No skills with update metadata to check.${RESET}`);
+		if (result.skippedMissingMetadata > 0) console.log(`${DIM}${result.skippedMissingMetadata} skill(s) are missing hash metadata (run${RESET} ${TEXT}npx @bud-fe/skills add <source> -g${RESET} ${DIM}to reinstall and track updates).${RESET}`);
 		return;
 	}
 	console.log(`${DIM}Checking ${totalSkills} skill(s) for updates...${RESET}`);
-	const updates = [];
-	const errors = [];
-	for (const [source, skills] of skillsBySource) for (const { name, entry } of skills) try {
-		const latestHash = await fetchSkillFolderHash(source, entry.skillPath, token);
-		if (!latestHash) {
-			errors.push({
-				name,
-				source,
-				error: "Could not fetch from GitHub"
-			});
-			continue;
-		}
-		if (latestHash !== entry.skillFolderHash) updates.push({
-			name,
-			source
-		});
-	} catch (err) {
-		errors.push({
-			name,
-			source,
-			error: err instanceof Error ? err.message : "Unknown error"
-		});
-	}
+	const updates = result.updates;
+	const errors = result.errors;
 	console.log();
 	if (updates.length === 0) console.log(`${TEXT}✓ All skills are up to date${RESET}`);
 	else {
@@ -5142,12 +5276,16 @@ async function runCheck(args = []) {
 			console.log(`    ${DIM}source: ${update.source}${RESET}`);
 		}
 		console.log();
-		console.log(`${DIM}Run${RESET} ${TEXT}npx skills update${RESET} ${DIM}to update all skills${RESET}`);
+		console.log(`${DIM}Run${RESET} ${TEXT}npx @bud-fe/skills update${RESET} ${DIM}to update all skills${RESET}`);
 	}
 	if (errors.length > 0) {
 		console.log();
 		console.log(`${DIM}Could not check ${errors.length} skill(s) (may need reinstall)${RESET}`);
 	}
+	if (result.skippedMissingMetadata > 0) {
+		console.log();
+		console.log(`${DIM}Skipped ${result.skippedMissingMetadata} skill(s) missing hash metadata (reinstall to enable update tracking).${RESET}`);
+	}
 	track({
 		event: "check",
 		skillCount: String(totalSkills),
@@ -5159,31 +5297,16 @@ async function runUpdate() {
 	console.log(`${TEXT}Checking for skill updates...${RESET}`);
 	console.log();
 	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	if (skillNames.length === 0) {
+	if (Object.keys(lock.skills).length === 0) {
 		console.log(`${DIM}No skills tracked in lock file.${RESET}`);
-		console.log(`${DIM}Install skills with${RESET} ${TEXT}npx skills add <package>${RESET}`);
+		console.log(`${DIM}Install skills with${RESET} ${TEXT}npx @bud-fe/skills add <package>${RESET}`);
 		return;
 	}
-	const token = getGitHubToken();
-	const updates = [];
-	let checkedCount = 0;
-	for (const skillName of skillNames) {
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (entry.sourceType !== "github" || !entry.skillFolderHash || !entry.skillPath) continue;
-		checkedCount++;
-		try {
-			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token);
-			if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-				name: skillName,
-				source: entry.source,
-				entry
-			});
-		} catch {}
-	}
-	if (checkedCount === 0) {
-		console.log(`${DIM}No skills to check.${RESET}`);
+	const result = await detectSkillUpdates(lock, { githubToken: getGitHubToken() });
+	const updates = result.updates;
+	if (result.checkedCount === 0) {
+		console.log(`${DIM}No skills with update metadata to check.${RESET}`);
+		if (result.skippedMissingMetadata > 0) console.log(`${DIM}${result.skippedMissingMetadata} skill(s) are missing hash metadata (reinstall to enable update tracking).${RESET}`);
 		return;
 	}
 	if (updates.length === 0) {
@@ -5198,22 +5321,21 @@ async function runUpdate() {
 	for (const update of updates) {
 		console.log(`${TEXT}Updating ${update.name}...${RESET}`);
 		let installUrl = update.entry.sourceUrl;
-		if (update.entry.skillPath) {
+		const addArgs = [
+			"-y",
+			"skills",
+			"add"
+		];
+		if (update.entry.sourceType === "github" && update.entry.skillPath) {
 			let skillFolder = update.entry.skillPath;
 			if (skillFolder.endsWith("/SKILL.md")) skillFolder = skillFolder.slice(0, -9);
 			else if (skillFolder.endsWith("SKILL.md")) skillFolder = skillFolder.slice(0, -8);
 			if (skillFolder.endsWith("/")) skillFolder = skillFolder.slice(0, -1);
 			installUrl = update.entry.sourceUrl.replace(/\.git$/, "").replace(/\/$/, "");
 			installUrl = `${installUrl}/tree/main/${skillFolder}`;
-		}
-		if (spawnSync("npx", [
-			"-y",
-			"skills",
-			"add",
-			installUrl,
-			"-g",
-			"-y"
-		], { stdio: [
+			addArgs.push(installUrl, "-g", "-y");
+		} else addArgs.push(installUrl, "--skill", update.name, "-g", "-y");
+		if (spawnSync("npx", addArgs, { stdio: [
 			"inherit",
 			"pipe",
 			"pipe"
@@ -5228,6 +5350,7 @@ async function runUpdate() {
 	console.log();
 	if (successCount > 0) console.log(`${TEXT}✓ Updated ${successCount} skill(s)${RESET}`);
 	if (failCount > 0) console.log(`${DIM}Failed to update ${failCount} skill(s)${RESET}`);
+	if (result.skippedMissingMetadata > 0) console.log(`${DIM}Skipped ${result.skippedMissingMetadata} skill(s) missing hash metadata (reinstall to enable update tracking).${RESET}`);
 	track({
 		event: "update",
 		skillCount: String(updates.length),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bud-fe/skills",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {