@hcmai/cli 0.3.3 → 0.3.5

package/dist/index.js

@@ -523,8 +523,8 @@ var init_TerminalRenderer = __esm({
         }
       }
       /** 来源行（仅子代理触发，agentPath ≥2 段时显示 `↑ 来自 a › b`，对齐 Web）。 */
-      originLine(path7) {
-        const segs = path7.split(".").filter(Boolean);
+      originLine(path9) {
+        const segs = path9.split(".").filter(Boolean);
         if (segs.length < 2) return "";
         const names = segs.map((k) => agentDisplayName(k));
         return chalk.gray(`  \u2191 \u6765\u81EA ${names.join(" \u203A ")}`) + "\n";
@@ -1706,8 +1706,8 @@ function agentLabel(agentId) {
   if (/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(agentId)) return `agent \u2026${agentId.slice(-4)}`;
   return agentDisplayName(agentId);
 }
-function originLine(path7) {
-  const segs = (path7 ?? "").split(".").filter(Boolean);
+function originLine(path9) {
+  const segs = (path9 ?? "").split(".").filter(Boolean);
   if (segs.length < 2) return null;
   return `\u6765\u81EA ${segs.map((k) => agentDisplayName(k)).join(" \u203A ")}`;
 }
@@ -2286,9 +2286,9 @@ async function loginCommand(args) {
   } catch (e) {
     const err = e;
     if (err.isAxiosError) {
-      const { fromAxiosError: fromAxiosError18 } = await import("@hcmai/sdk");
+      const { fromAxiosError: fromAxiosError19 } = await import("@hcmai/sdk");
       exitWithError(
-        fromAxiosError18(
+        fromAxiosError19(
           e,
           envName
         )
@@ -2503,13 +2503,13 @@ async function envRemove(name, args) {
       }
     }
     const ids = await listIdentities(name);
-    const failed = [];
+    const failed2 = [];
     for (const id of ids) {
       try {
         await TokenStore2.forIdentity(id).clear();
         await deleteIdentity(id);
       } catch (err) {
-        failed.push(id);
+        failed2.push(id);
         process.stderr.write(
           `[hcm] event=identity_cleanup_failed identity=${id} reason=${JSON.stringify(String(err.message))}
 `
@@ -2522,9 +2522,9 @@ async function envRemove(name, args) {
       g.activeEnv = "default";
       await saveGlobalConfig2(g);
     }
-    const removedCount = ids.length - failed.length;
+    const removedCount = ids.length - failed2.length;
     const noun = (n) => n === 1 ? "identity" : "identities";
-    const failPart = failed.length > 0 ? `, ${failed.length} ${noun(failed.length)} failed: ${failed.join(", ")}` : "";
+    const failPart = failed2.length > 0 ? `, ${failed2.length} ${noun(failed2.length)} failed: ${failed2.join(", ")}` : "";
     exitOk(`\u2705 env '${name}' removed (${removedCount} ${noun(removedCount)} removed${failPart})`);
   } catch (e) {
     exitWithError(e);
@@ -3059,8 +3059,8 @@ import {
   formatObject as formatObject7,
   fromAxiosError as fromAxiosError8
 } from "@hcmai/sdk";
-function collectYmlFiles(path7) {
-  if (statSync(path7).isFile()) return [path7];
+function collectYmlFiles(path9) {
+  if (statSync(path9).isFile()) return [path9];
   const out = [];
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
@@ -3069,7 +3069,7 @@ function collectYmlFiles(path7) {
       else if (full.endsWith(".yml") || full.endsWith(".yaml")) out.push(full);
     }
   };
-  walk(path7);
+  walk(path9);
   return out.sort();
 }
 var DRY_RUN_CLIENT = {
@@ -3077,9 +3077,9 @@ var DRY_RUN_CLIENT = {
   create: async () => ({ id: "" }),
   update: async () => ({})
 };
-async function importCommand(path7, args) {
+async function importCommand(path9, args) {
   try {
-    const files = collectYmlFiles(path7);
+    const files = collectYmlFiles(path9);
     const fixtures = files.map(
       (f) => parseFixture(readFileSync2(f, "utf8"), relative(process.cwd(), f))
     );
@@ -4278,10 +4278,10 @@ async function uploadCommand(filePath, args) {
 
 // src/commands/skills.ts
 init_exit();
-import { promises as fsp } from "fs";
+import { promises as fsp2 } from "fs";
 import os2 from "os";
-import path4 from "path";
-import { createHash as createHash3 } from "crypto";
+import path6 from "path";
+import { createHash as createHash4 } from "crypto";
 import {
   createHttpClient as createHttpClient2,
   fetchSkillCatalog,
@@ -4290,31 +4290,316 @@ import {
   fetchSkillReference,
   resolveChironBase,
   assertSafeSkillId as assertSafeSkillId2,
-  assertSafeReferencePath,
+  assertSafeReferencePath as assertSafeReferencePath2,
   normalizeReferences as normalizeReferences2,
-  parseSkillRequirements,
-  parseSkillFrontmatter,
+  parseSkillRequirements as parseSkillRequirements2,
+  parseSkillFrontmatter as parseSkillFrontmatter2,
   resolveSkillInstallOrder as resolveSkillInstallOrder2,
   resolveAllSkillsInstallOrder,
-  flattenSkills,
   matchSkills,
   filterByStage,
-  formatObject as formatObject13,
+  formatObject as formatObject14,
   fromAxiosError as fromAxiosError13,
   loadEnv as loadEnv5,
   loadGlobalConfig as loadGlobalConfig6,
   resolveActiveEnv as resolveActiveEnv3,
-  CliError as CliError16,
-  CliErrorCode as CliErrorCode15
+  CliError as CliError18,
+  CliErrorCode as CliErrorCode17
 } from "@hcmai/sdk";
 
-// src/commands/skills-sync.ts
+// src/commands/skills-catalog.ts
+import { flattenSkills, CliError as CliError14, CliErrorCode as CliErrorCode13 } from "@hcmai/sdk";
+var CLI_CATEGORY_KEY = "cli-operations";
+var CLI_CATEGORY_NAME = "CLI \u64CD\u4F5C";
+function chironEntry(skill) {
+  return {
+    meta: {
+      id: skill.id,
+      title: skill.title,
+      description: skill.description,
+      category: skill.category,
+      stages: skill.stages ?? [],
+      actionSurface: skill.actionSurface,
+      requires: skill.requires,
+      bytes: skill.bytes,
+      files: skill.files
+    },
+    locator: { kind: "chiron", markdownUrl: skill.markdownUrl }
+  };
+}
+function bundledEntry(entry, cliVersion) {
+  return {
+    meta: {
+      id: entry.id,
+      title: entry.title ?? entry.id,
+      description: entry.description ?? "",
+      category: entry.category ?? CLI_CATEGORY_KEY,
+      stages: entry.stages ?? [],
+      // 自带技能讲的就是本 CLI 的命令，恒为 cli。
+      actionSurface: "cli",
+      requires: entry.requires,
+      bytes: entry.bytes,
+      files: entry.files
+    },
+    locator: { kind: "cli", packagePath: `skills/${entry.id}`, cliVersion }
+  };
+}
+function cliLocatorString(id, cliVersion) {
+  return `@hcmai/cli@${cliVersion}:skills/${id}`;
+}
+var SOURCE_FILTERS = ["cli", "chiron", "all"];
+function parseSourceFilter(raw) {
+  if (raw === void 0) return "all";
+  if (SOURCE_FILTERS.includes(raw)) return raw;
+  throw new CliError14({
+    code: CliErrorCode13.INVALID_ARGUMENT,
+    message: `--source \u53EA\u8BA4 ${SOURCE_FILTERS.join(" / ")}\uFF0C\u6536\u5230 "${raw}"\u3002\uFF08\`local\` \u4E0D\u662F\u53D6\u503C\uFF1A\u6CA1\u6709\u54EA\u4E00\u8D9F\u4F1A\u53BB\u300C\u626B local \u6765\u6E90\u300D\uFF0Cinstall --from \u88C5\u7684\u90A3\u4E9B\u5728\u4EFB\u4F55 --source \u4E0B\u90FD\u5355\u5217\u3001\u90FD\u4E0D\u53C2\u4E0E\u5347\u7EA7\u3002\uFF09`
+  });
+}
+function emptyHalf() {
+  return { status: "skipped", entries: /* @__PURE__ */ new Map() };
+}
+function buildUnifiedCatalog(input) {
+  const chiron = emptyHalf();
+  const cli = emptyHalf();
+  if (input.source !== "cli" && input.chironManifest) {
+    chiron.status = "fetched";
+    for (const skill of flattenSkills(input.chironManifest)) chiron.entries.set(skill.id, chironEntry(skill));
+  }
+  if (input.source !== "chiron" && input.bundled) {
+    cli.status = "fetched";
+    for (const entry of input.bundled) cli.entries.set(entry.id, bundledEntry(entry, input.cliVersion));
+  }
+  return { chiron, cli };
+}
+function detectIdConflicts(catalog) {
+  if (catalog.chiron.status !== "fetched" || catalog.cli.status !== "fetched") {
+    return { checked: false, ids: [] };
+  }
+  const ids = [...catalog.cli.entries.keys()].filter((id) => catalog.chiron.entries.has(id)).sort();
+  return { checked: true, ids };
+}
+function conflictMessage(ids, endpoint) {
+  return `\u6280\u80FD id \`${ids.join("`\u3001`")}\` \u5728 CLI \u81EA\u5E26\u4E0E ${endpoint} \u7684\u777F\u620E\u76EE\u5F55\u91CC\u540C\u65F6\u5B58\u5728\u3002
+\u4E24\u8FB9\u5404\u81EA\u4E3B\u5F20\u7684\u4E1C\u897F\u4E0D\u540C\uFF0C\u53D6\u4EFB\u4F55\u4E00\u4EFD\u90FD\u4F1A\u8BA9\u53E6\u4E00\u4EFD\u7684\u8BFB\u8005\u62FF\u5230\u9519\u7684\u5408\u540C\u3002
+\u51FA\u8DEF\u53EA\u6709\u4E24\u6761\uFF1A\u2460 \u5347\u7EA7 CLI\uFF08\u4EA7\u54C1\u628A\u5B83\u6536\u7F16\u4E86\uFF0C\u65B0\u7248 CLI \u4F1A\u64A4\u6389\u81EA\u5E26\u7684\u90A3\u4EFD\uFF09\uFF1B
+\u2461 \u8FD9\u662F\u4E00\u6B21\u5F52\u5C5E\u672A\u5B9A\uFF0C\u628A id \u4E0E\u4E24\u5904\u51FA\u5904\u62A5\u7ED9\u4EA7\u54C1\u4FA7\u88C1\u51B3\u3002`;
+}
+function unconfirmedConflictNote(source) {
+  return `\u672C\u8D9F\u53EA\u770B\u4E86${source === "cli" ? "CLI \u81EA\u5E26" : "\u777F\u620E"}\u6765\u6E90\uFF0C\u672A\u505A\u8DE8\u6765\u6E90\u51B2\u7A81\u68C0\u67E5`;
+}
+function classifyInstalledSource(id, record, catalog) {
+  const kind = record.sourceKind ?? "chiron";
+  if (kind === "local") return "local";
+  const half = kind === "cli" ? catalog.cli : catalog.chiron;
+  if (half.status !== "fetched") return "not-checked";
+  if (half.entries.has(id)) return "present";
+  return kind === "cli" ? "removed-in-cli" : "removed-upstream";
+}
+var SOURCE_STATUS_NOTE = {
+  "removed-upstream": "\u4EA7\u54C1\u8FD9\u4E00\u7248\u7684\u6280\u80FD\u76EE\u5F55\u91CC\u5DF2\u7ECF\u6CA1\u6709\u5B83\u4E86\uFF1B\u672C\u5730\u6587\u4EF6\u4FDD\u7559\u4E0D\u52A8",
+  "removed-in-cli": "\u8FD9\u4E00\u7248 CLI \u4E0D\u518D\u81EA\u5E26\u5B83\uFF08\u591A\u534A\u662F\u88AB\u4EA7\u54C1\u6536\u7F16\u4E86\uFF0C\u8DD1 hcm skills list \u770B\u770B\uFF09",
+  "not-checked": "\u672C\u8F6E\u6CA1\u8FDE\u7F51\u6838\u5BF9\u5B83\u7684\u6765\u6E90\uFF08--source cli\uFF09\uFF0C\u5B83\u662F\u4E0D\u662F\u8FD8\u5728\u4EA7\u54C1\u76EE\u5F55\u91CC\u8FD9\u4E00\u8D9F\u4E0D\u77E5\u9053",
+  local: "\u672C\u5730\u6765\u6E90\uFF08install --from \u88C5\u7684\uFF09\uFF0Cupdate \u4E0D\u7BA1\u5B83\uFF1B\u8981\u66F4\u65B0\u5C31\u518D install --from \u4E00\u6B21"
+};
+function checkCrossSourceRequires(catalog) {
+  if (catalog.chiron.status !== "fetched" || catalog.cli.status !== "fetched") return [];
+  const out = [];
+  for (const [id, entry] of catalog.chiron.entries) {
+    for (const need of entry.meta.requires ?? []) {
+      if (catalog.chiron.entries.has(need)) continue;
+      if (catalog.cli.entries.has(need)) {
+        out.push({
+          from: id,
+          to: need,
+          reason: "\u777F\u620E\u6280\u80FD\u4E0D\u5F97\u4F9D\u8D56 CLI \u81EA\u5E26\u6280\u80FD\uFF1A\u4EA7\u54C1\u77E5\u8BC6\u7684\u53EF\u8BFB\u6027\u4E0D\u80FD\u53D6\u51B3\u4E8E\u987E\u95EE\u88C5\u4E86\u54EA\u7248 CLI"
+        });
+      }
+    }
+  }
+  return out;
+}
+
+// src/commands/skills-bundled.ts
+import { promises as fsp } from "fs";
+import * as path3 from "path";
+import { CliError as CliError15, CliErrorCode as CliErrorCode14, assertSafeReferencePath, parseSkillRequirements } from "@hcmai/sdk";
+
+// src/commands/skills-manifest.ts
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3, existsSync } from "fs";
 import { createHash } from "crypto";
+import * as path2 from "path";
+import { fileURLToPath } from "url";
+import { formatObject as formatObject13, parseSkillFrontmatter } from "@hcmai/sdk";
+function collectCommandSurface(root) {
+  const out = [];
+  const walk = (cmd, prefix) => {
+    for (const sub of cmd.commands) {
+      const segs = [...prefix, sub.name()];
+      const options = sub.options.map((o) => /(--[a-zA-Z0-9][\w-]*)/.exec(o.flags)?.[1] ?? "").filter((s) => s.length > 0);
+      out.push({ path: segs.join(" "), options: [...new Set(options)].sort() });
+      walk(sub, segs);
+    }
+  };
+  walk(root, []);
+  return out.sort((a, b) => a.path.localeCompare(b.path));
+}
+function bundledSkillsDir() {
+  const here = path2.dirname(fileURLToPath(import.meta.url));
+  return path2.join(here, "skills");
+}
+function sha256(buf) {
+  return createHash("sha256").update(buf).digest("hex");
+}
+function listFiles(dir, rel = "") {
+  const out = [];
+  for (const name of readdirSync2(dir)) {
+    const p = path2.join(dir, name);
+    const r = rel ? `${rel}/${name}` : name;
+    if (statSync3(p).isDirectory()) out.push(...listFiles(p, r));
+    else out.push(r);
+  }
+  return out;
+}
+function collectBundledSkills(dir = bundledSkillsDir()) {
+  if (!existsSync(dir)) return [];
+  const out = [];
+  for (const id of readdirSync2(dir).sort()) {
+    const skillDir = path2.join(dir, id);
+    if (!statSync3(skillDir).isDirectory()) continue;
+    const files = listFiles(skillDir).sort();
+    if (!files.includes("SKILL.md")) continue;
+    let bytes = 0;
+    const fileRows = files.map((rel) => {
+      const buf = readFileSync3(path2.join(skillDir, rel));
+      bytes += buf.byteLength;
+      return { path: rel, bytes: buf.byteLength, sha256: sha256(buf) };
+    });
+    const body = readFileSync3(path2.join(skillDir, "SKILL.md"), "utf8");
+    const fm = parseSkillFrontmatter(body, id);
+    out.push({
+      id,
+      title: str(fm.title),
+      description: str(fm.description),
+      category: str(fm.category),
+      stages: strArray(fm.stages),
+      actionSurface: str(fm.actionSurface),
+      requires: strArray(fm.requires),
+      bytes,
+      files: fileRows
+    });
+  }
+  return out;
+}
+function buildManifest(root, skillsDir = bundledSkillsDir()) {
+  return {
+    schemaVersion: 1,
+    cliVersion: CLI_VERSION,
+    commands: collectCommandSurface(root),
+    skills: collectBundledSkills(skillsDir)
+  };
+}
+function skillsManifestCommand(root, args) {
+  const manifest2 = buildManifest(root);
+  process.stdout.write(formatObject13(manifest2, { format: args.output ?? "json" }) + "\n");
+}
+function str(v) {
+  return typeof v === "string" && v ? v : void 0;
+}
+function strArray(v) {
+  return Array.isArray(v) ? v.map(String) : void 0;
+}
+
+// src/commands/skills-bundled.ts
+function listBundledSkills(dir = bundledSkillsDir()) {
+  return collectBundledSkills(dir);
+}
+function unreachable(id, detail) {
+  return new CliError15({
+    code: CliErrorCode14.SKILL_SOURCE_UNREACHABLE,
+    message: `\u88C5\u5728\u8FD9\u4EFD CLI \u91CC\u7684\u6280\u80FD\u8D44\u6E90\u8BFB\u4E0D\u5230\uFF08${detail}\uFF09\uFF0C\u91CD\u88C5 @hcmai/cli\u3002
+\u6280\u80FD id\uFF1A${id}\uFF1B\u627E\u7684\u4F4D\u7F6E\uFF1A${bundledSkillsDir()}`
+  });
+}
+async function readBundledReferences(skillDir) {
+  const root = path3.join(skillDir, "references");
+  const out = [];
+  const walk = async (dir, prefix) => {
+    let items;
+    try {
+      items = await fsp.readdir(dir, { withFileTypes: true });
+    } catch (cause) {
+      if (cause?.code === "ENOENT") return;
+      throw cause;
+    }
+    for (const item of items.sort((a, b) => a.name.localeCompare(b.name))) {
+      const relative2 = prefix ? `${prefix}/${item.name}` : item.name;
+      if (item.isDirectory()) {
+        await walk(path3.join(dir, item.name), relative2);
+        continue;
+      }
+      if (!item.isFile()) continue;
+      assertSafeReferencePath(relative2);
+      out.push({ path: relative2, content: await fsp.readFile(path3.join(dir, item.name), "utf8") });
+    }
+  };
+  await walk(root, "");
+  return out;
+}
+async function readBundledSkillDocument(id, dir = bundledSkillsDir()) {
+  const skillDir = path3.join(dir, id);
+  let markdown;
+  try {
+    markdown = await fsp.readFile(path3.join(skillDir, "SKILL.md"), "utf8");
+  } catch (cause) {
+    if (cause?.code === "ENOENT") throw unreachable(id, "SKILL.md \u4E0D\u5B58\u5728");
+    throw cause;
+  }
+  if (!markdown.trim()) throw unreachable(id, "SKILL.md \u662F\u7A7A\u7684");
+  return {
+    id,
+    markdown,
+    source: cliLocatorString(id, CLI_VERSION),
+    sourceKind: "cli",
+    references: await readBundledReferences(skillDir)
+  };
+}
+async function resolveBundledClosure(targetId, dir = bundledSkillsDir()) {
+  const documents = [];
+  const external = /* @__PURE__ */ new Set();
+  const state = /* @__PURE__ */ new Map();
+  const stack = [];
+  const available = new Set(listBundledSkills(dir).map((s) => s.id));
+  const visit = async (id) => {
+    if (state.get(id) === "done") return;
+    if (state.get(id) === "visiting") {
+      throw new CliError15({
+        code: CliErrorCode14.INVALID_ARGUMENT,
+        message: `\u81EA\u5E26\u6280\u80FD\u4F9D\u8D56\u6210\u73AF\uFF1A${[...stack, id].join(" \u2192 ")}`
+      });
+    }
+    state.set(id, "visiting");
+    stack.push(id);
+    const document = await readBundledSkillDocument(id, dir);
+    for (const need of parseSkillRequirements(document.markdown, id)) {
+      if (available.has(need)) await visit(need);
+      else external.add(need);
+    }
+    stack.pop();
+    state.set(id, "done");
+    documents.push(document);
+  };
+  await visit(targetId);
+  return { documents, external: [...external].sort() };
+}
+
+// src/commands/skills-sync.ts
+import { createHash as createHash2 } from "crypto";
 import { promises as fs5 } from "fs";
-import path2 from "path";
+import path4 from "path";
 import {
-  CliError as CliError14,
-  CliErrorCode as CliErrorCode13,
+  CliError as CliError16,
+  CliErrorCode as CliErrorCode15,
   assertSafeSkillFilePath,
   assertSafeSkillId,
   normalizeReferences,
@@ -4347,7 +4632,7 @@ async function prepareSkillDocuments(catalog, requestedSkill, fetchMarkdown, fet
               path: targetPath,
               content: referenceContent,
               bytes: referenceContent.length,
-              sha256: sha256(referenceContent)
+              sha256: sha2562(referenceContent)
             };
           })
         );
@@ -4356,7 +4641,7 @@ async function prepareSkillDocuments(catalog, requestedSkill, fetchMarkdown, fet
             path: "SKILL.md",
             content,
             bytes: content.length,
-            sha256: sha256(content)
+            sha256: sha2562(content)
           },
           ...referenceFiles
         ];
@@ -4384,7 +4669,7 @@ async function prepareSkillDocuments(catalog, requestedSkill, fetchMarkdown, fet
                 `\u6280\u80FD ${skill.id}/${file.path} \u5B57\u8282\u6570\u4E0E\u76EE\u5F55\u4E0D\u4E00\u81F4\uFF1A\u76EE\u5F55=${file.bytes}\uFF0C\u5B9E\u9645=${content.length}`
               );
             }
-            const digest = sha256(content);
+            const digest = sha2562(content);
             if (digest !== file.sha256) {
               throw invalid(`\u6280\u80FD ${skill.id}/${file.path} \u6458\u8981\u4E0E\u76EE\u5F55\u4E0D\u4E00\u81F4`);
             }
@@ -4406,10 +4691,10 @@ async function prepareSkillDocuments(catalog, requestedSkill, fetchMarkdown, fet
   );
 }
 async function syncWorkBuddyProject(input) {
-  const project = path2.resolve(input.project);
-  const metaDir = path2.join(project, ".hcm-delivery");
-  const skillsDir = path2.join(project, ".codebuddy", "skills");
-  const lockPath = path2.join(metaDir, "chiron.lock.json");
+  const project = path4.resolve(input.project);
+  const metaDir = path4.join(project, ".hcm-delivery");
+  const skillsDir = path4.join(project, ".codebuddy", "skills");
+  const lockPath = path4.join(metaDir, "chiron.lock.json");
   assertSafeSkillId(input.requestedSkill);
   validatePreparedDocuments(input.documents, input.requestedSkill);
   validatePreparedRuntime(input.runtime);
@@ -4429,27 +4714,27 @@ async function syncWorkBuddyProject(input) {
   const oldDigestByFile = lockDigests(oldLock);
   for (const file of oldOwned) validateOwnedFile(file);
   for (const file of desiredFiles) {
-    const absolute = path2.join(project, file);
+    const absolute = path4.join(project, file);
     const current = await readOptionalBytes(absolute);
     if (current !== void 0 && !oldOwned.has(file)) {
       throw invalid(`\u76EE\u6807\u6587\u4EF6\u4E0D\u5C5E\u4E8E\u4E0A\u4E00\u4EFD Chiron \u9501\uFF0C\u62D2\u7EDD\u8986\u76D6\u987E\u95EE\u6587\u4EF6\uFF1A${file}`);
     }
   }
   for (const file of oldOwned) {
-    const absolute = path2.join(project, file);
+    const absolute = path4.join(project, file);
     const current = await readOptionalBytes(absolute);
     if (current === void 0) continue;
     const expected = oldDigestByFile.get(file);
-    if (!expected || sha256(current) !== expected.sha256 || !await fileModeMatches(absolute, expected.mode)) {
+    if (!expected || sha2562(current) !== expected.sha256 || !await fileModeMatches(absolute, expected.mode)) {
       throw invalid(`\u4E0A\u4E00\u4EFD\u9501\u62E5\u6709\u7684\u751F\u6210\u6587\u4EF6\u5DF2\u88AB\u4EBA\u5DE5\u4FEE\u6539\uFF0C\u62D2\u7EDD\u8986\u76D6\u6216\u6E05\u7406\uFF1A${file}`);
     }
   }
   const newLock = {
     schemaVersion: 1,
     source: {
-      endpointOriginSha256: sha256(normalizeEndpoint(input.endpoint)),
+      endpointOriginSha256: sha2562(normalizeEndpoint(input.endpoint)),
       catalogPath: "/skills.json",
-      catalogSha256: sha256(stableJson2(input.catalog))
+      catalogSha256: sha2562(stableJson2(input.catalog))
     },
     selection: { requestedSkill: input.requestedSkill },
     resolvedSkills: input.documents.map(({ id, bytes, sha256: digest, files: skillFiles }) => ({
@@ -4481,16 +4766,16 @@ async function syncWorkBuddyProject(input) {
   }
   const obsolete = [...oldOwned].filter((file) => !desiredByFile.has(file));
   await fs5.mkdir(metaDir, { recursive: true });
-  const staging = await fs5.mkdtemp(path2.join(metaDir, ".staging-"));
-  const stagedFiles = path2.join(staging, "new");
-  const backups = path2.join(staging, "backup");
-  const stagedLock = path2.join(staging, "chiron.lock.json");
-  const journalPath = path2.join(staging, "journal.json");
+  const staging = await fs5.mkdtemp(path4.join(metaDir, ".staging-"));
+  const stagedFiles = path4.join(staging, "new");
+  const backups = path4.join(staging, "backup");
+  const stagedLock = path4.join(staging, "chiron.lock.json");
+  const journalPath = path4.join(staging, "journal.json");
   let journalReady = false;
   try {
     for (const [file, preparedFile2] of desiredByFile) {
-      const staged = path2.join(stagedFiles, file);
-      await fs5.mkdir(path2.dirname(staged), { recursive: true });
+      const staged = path4.join(stagedFiles, file);
+      await fs5.mkdir(path4.dirname(staged), { recursive: true });
       await fs5.writeFile(
         staged,
         preparedFile2.content,
@@ -4501,16 +4786,16 @@ async function syncWorkBuddyProject(input) {
 `, "utf8");
     const affected = [.../* @__PURE__ */ new Set([...desiredFiles, ...obsolete])];
     for (const file of affected) {
-      const target = path2.join(project, file);
+      const target = path4.join(project, file);
       if (!await exists(target)) continue;
-      const backup = path2.join(backups, file);
-      await fs5.mkdir(path2.dirname(backup), { recursive: true });
+      const backup = path4.join(backups, file);
+      await fs5.mkdir(path4.dirname(backup), { recursive: true });
       await fs5.copyFile(target, backup);
     }
     const oldLockExisted = await exists(lockPath);
     if (oldLockExisted) {
-      const backupLock = path2.join(backups, ".hcm-delivery", "chiron.lock.json");
-      await fs5.mkdir(path2.dirname(backupLock), { recursive: true });
+      const backupLock = path4.join(backups, ".hcm-delivery", "chiron.lock.json");
+      await fs5.mkdir(path4.dirname(backupLock), { recursive: true });
       await fs5.copyFile(lockPath, backupLock);
     }
     const journal = {
@@ -4523,12 +4808,12 @@ async function syncWorkBuddyProject(input) {
 `, "utf8");
     journalReady = true;
     for (const file of desiredFiles) {
-      const target = path2.join(project, file);
-      await fs5.mkdir(path2.dirname(target), { recursive: true });
+      const target = path4.join(project, file);
+      await fs5.mkdir(path4.dirname(target), { recursive: true });
       await fs5.rm(target, { force: true });
-      await fs5.rename(path2.join(stagedFiles, file), target);
+      await fs5.rename(path4.join(stagedFiles, file), target);
     }
-    for (const file of obsolete) await fs5.unlink(path2.join(project, file)).catch(ignoreMissing);
+    for (const file of obsolete) await fs5.unlink(path4.join(project, file)).catch(ignoreMissing);
     await fs5.rm(lockPath, { force: true });
     await fs5.rename(stagedLock, lockPath);
     await fs5.unlink(journalPath);
@@ -4559,32 +4844,32 @@ async function recoverInterruptedSyncs(project, metaDir, lockPath) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.startsWith(".staging-")) continue;
-    const staging = path2.join(metaDir, entry.name);
-    if (await exists(path2.join(staging, "journal.json"))) {
+    const staging = path4.join(metaDir, entry.name);
+    if (await exists(path4.join(staging, "journal.json"))) {
       await recoverStaging(project, staging, lockPath);
     }
     await fs5.rm(staging, { recursive: true, force: true });
   }
 }
 async function recoverStaging(project, staging, lockPath) {
-  const journalPath = path2.join(staging, "journal.json");
+  const journalPath = path4.join(staging, "journal.json");
   const journal = parseJournal(await fs5.readFile(journalPath, "utf8"), project);
-  const backups = path2.join(staging, "backup");
+  const backups = path4.join(staging, "backup");
   for (const file of journal.affectedFiles) {
-    const target = path2.join(project, file);
-    const backup = path2.join(backups, file);
+    const target = path4.join(project, file);
+    const backup = path4.join(backups, file);
     if (await exists(backup)) {
-      await fs5.mkdir(path2.dirname(target), { recursive: true });
+      await fs5.mkdir(path4.dirname(target), { recursive: true });
       await fs5.rm(target, { force: true });
       await fs5.rename(backup, target);
     } else {
       await fs5.rm(target, { force: true });
     }
   }
-  const backupLock = path2.join(backups, ".hcm-delivery", "chiron.lock.json");
+  const backupLock = path4.join(backups, ".hcm-delivery", "chiron.lock.json");
   if (journal.oldLockExisted) {
     if (!await exists(backupLock)) throw invalid(`\u540C\u6B65\u6062\u590D\u7F3A\u5C11\u65E7\u9501\u5907\u4EFD\uFF1A${backupLock}`);
-    await fs5.mkdir(path2.dirname(lockPath), { recursive: true });
+    await fs5.mkdir(path4.dirname(lockPath), { recursive: true });
     await fs5.rm(lockPath, { force: true });
     await fs5.rename(backupLock, lockPath);
   } else {
@@ -4596,8 +4881,8 @@ function parseJournal(content, project) {
   try {
     journal = JSON.parse(content);
   } catch (cause) {
-    throw new CliError14({
-      code: CliErrorCode13.CONFIG_PARSE_ERROR,
+    throw new CliError16({
+      code: CliErrorCode15.CONFIG_PARSE_ERROR,
       message: "Chiron \u540C\u6B65\u6062\u590D\u65E5\u5FD7\u635F\u574F",
       cause
     });
@@ -4620,7 +4905,7 @@ function validatePreparedDocuments(documents, requestedSkill) {
       assertSafeSkillFilePath(file.path);
       if (paths.has(file.path)) throw invalid(`\u6280\u80FD ${document.id} \u5305\u542B\u91CD\u590D\u6587\u4EF6: ${file.path}`);
       paths.add(file.path);
-      if (file.content.length !== file.bytes || sha256(file.content) !== file.sha256) {
+      if (file.content.length !== file.bytes || sha2562(file.content) !== file.sha256) {
         throw invalid(`\u6280\u80FD ${document.id}/${file.path} \u7684\u5DF2\u51C6\u5907\u5185\u5BB9\u6458\u8981\u4E0D\u4E00\u81F4`);
       }
     }
@@ -4642,7 +4927,7 @@ function validatePreparedRuntime(runtime) {
     }
     capabilities.add(capability);
   }
-  if (!validDigest(runtime.capabilitiesSha256) || runtime.capabilitiesSha256 !== sha256(`${runtime.capabilities.join("\n")}
+  if (!validDigest(runtime.capabilitiesSha256) || runtime.capabilitiesSha256 !== sha2562(`${runtime.capabilities.join("\n")}
 `)) {
     throw invalid("WorkBuddy CLI \u80FD\u529B\u6458\u8981\u4E0D\u4E00\u81F4");
   }
@@ -4667,7 +4952,7 @@ function validatePreparedRuntime(runtime) {
 }
 function validateRuntimeFile(file) {
   validateOwnedFile(file.path);
-  if (file.content.length !== file.bytes || sha256(file.content) !== file.sha256 || !Number.isInteger(file.mode) || file.mode < 0 || file.mode > 511) {
+  if (file.content.length !== file.bytes || sha2562(file.content) !== file.sha256 || !Number.isInteger(file.mode) || file.mode < 0 || file.mode > 511) {
     throw invalid(`WorkBuddy \u8FD0\u884C\u5165\u53E3\u6458\u8981\u6216\u6743\u9650\u4E0D\u4E00\u81F4\uFF1A${file.path}`);
   }
 }
@@ -4712,15 +4997,15 @@ async function readLock(lockPath) {
     for (const file of lock.ownedFiles) validateOwnedFile(file);
     return lock;
   } catch (cause) {
-    throw new CliError14({
-      code: CliErrorCode13.CONFIG_PARSE_ERROR,
+    throw new CliError16({
+      code: CliErrorCode15.CONFIG_PARSE_ERROR,
       message: `Chiron \u9501\u6587\u4EF6\u635F\u574F\uFF0C\u62D2\u7EDD\u731C\u6D4B\u6587\u4EF6\u6240\u6709\u6743\uFF1A${lockPath}`,
       cause
     });
   }
 }
 function validateLockedRuntime(runtime) {
-  if (!Array.isArray(runtime.capabilities) || runtime.capabilities.length === 0 || !validDigest(runtime.capabilitiesSha256) || runtime.capabilitiesSha256 !== sha256(`${runtime.capabilities.join("\n")}
+  if (!Array.isArray(runtime.capabilities) || runtime.capabilities.length === 0 || !validDigest(runtime.capabilitiesSha256) || runtime.capabilitiesSha256 !== sha2562(`${runtime.capabilities.join("\n")}
 `) || !runtime.launch || !validDigest(runtime.launch.executableSha256) || !Array.isArray(runtime.files) || runtime.files.length !== 2) {
     throw new Error("invalid runtime");
   }
@@ -4754,9 +5039,9 @@ function sameLockContent(left, right) {
 }
 async function desiredFilesMatch(project, desired) {
   for (const [file, preparedFile2] of desired) {
-    const absolute = path2.join(project, file);
+    const absolute = path4.join(project, file);
     const current = await readOptionalBytes(absolute);
-    if (current === void 0 || sha256(current) !== preparedFile2.sha256 || !await fileModeMatches(absolute, preparedFile2.mode)) {
+    if (current === void 0 || sha2562(current) !== preparedFile2.sha256 || !await fileModeMatches(absolute, preparedFile2.mode)) {
       return false;
     }
   }
@@ -4770,7 +5055,7 @@ function result(changed, input, project, skillsDir, lockPath, installed, removed
     project,
     skillsDir,
     lockPath,
-    runnerPath: path2.join(project, ".hcm-delivery", "bin", "hcm"),
+    runnerPath: path4.join(project, ".hcm-delivery", "bin", "hcm"),
     capabilitiesSha256: input.runtime.capabilitiesSha256,
     installed,
     removed
@@ -4805,8 +5090,8 @@ function normalizeEndpoint(endpoint) {
   try {
     url = new URL(endpoint);
   } catch (cause) {
-    throw new CliError14({
-      code: CliErrorCode13.INVALID_ARGUMENT,
+    throw new CliError16({
+      code: CliErrorCode15.INVALID_ARGUMENT,
       message: `\u975E\u6CD5 endpoint\uFF1A${endpoint}`,
       cause
     });
@@ -4818,8 +5103,8 @@ function normalizeEndpoint(endpoint) {
   url.pathname = url.pathname.replace(/\/+$/, "");
   return url.toString().replace(/\/$/, "");
 }
-function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
+function sha2562(value) {
+  return createHash2("sha256").update(value).digest("hex");
 }
 function stableJson2(value) {
   if (Array.isArray(value)) return `[${value.map(stableJson2).join(",")}]`;
@@ -4882,16 +5167,16 @@ function ignoreMissing(cause) {
   if (cause.code !== "ENOENT") throw cause;
 }
 function invalid(message) {
-  return new CliError14({ code: CliErrorCode13.INVALID_ARGUMENT, message });
+  return new CliError16({ code: CliErrorCode15.INVALID_ARGUMENT, message });
 }
 
 // src/commands/skills-runtime.ts
 import { execFile } from "child_process";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { createReadStream, promises as fs6 } from "fs";
-import path3 from "path";
+import path5 from "path";
 import { promisify } from "util";
-import { CliError as CliError15, CliErrorCode as CliErrorCode14 } from "@hcmai/sdk";
+import { CliError as CliError17, CliErrorCode as CliErrorCode16 } from "@hcmai/sdk";
 var execFileAsync = promisify(execFile);
 var REQUIRED_CAPABILITIES = [
   "hcm.help.skills",
@@ -4928,7 +5213,7 @@ async function prepareWorkBuddyRuntime(input = {}) {
     }
   }
   const capabilities = [...REQUIRED_CAPABILITIES];
-  const capabilitiesSha256 = sha2562(`${capabilities.join("\n")}
+  const capabilitiesSha256 = sha2563(`${capabilities.join("\n")}
 `);
   const executableSha256 = await sha256File(launch.executable);
   const launchRecord = launch.kind === "node-entry" ? {
@@ -4949,7 +5234,7 @@ async function prepareWorkBuddyRuntime(input = {}) {
   };
 }
 async function resolveLaunch(candidate, nodeExecutable) {
-  const requested = path3.resolve(candidate);
+  const requested = path5.resolve(candidate);
   const resolvedCandidate = await realFile(requested, "\u5019\u9009 HCM CLI");
   const header = (await readPrefix(resolvedCandidate, 256)).toString("utf8");
   const nodeEntry = /^(?:#![^\r\n]*\bnode\b)|\.(?:c|m)?js$/i.test(
@@ -4958,7 +5243,7 @@ async function resolveLaunch(candidate, nodeExecutable) {
   if (nodeEntry) {
     return {
       kind: "node-entry",
-      executable: await realFile(path3.resolve(nodeExecutable), "Node \u53EF\u6267\u884C\u6587\u4EF6"),
+      executable: await realFile(path5.resolve(nodeExecutable), "Node \u53EF\u6267\u884C\u6587\u4EF6"),
       entry: resolvedCandidate
     };
   }
@@ -4971,15 +5256,15 @@ async function realFile(file, label) {
     if (!stat.isFile()) throw new Error("not a regular file");
     return resolved;
   } catch (cause) {
-    throw new CliError15({
-      code: CliErrorCode14.INVALID_ARGUMENT,
+    throw new CliError17({
+      code: CliErrorCode16.INVALID_ARGUMENT,
       message: `${label}\u4E0D\u53EF\u7528\uFF1A${file}`,
       cause
     });
   }
 }
 async function comparablePath(file) {
-  const absolute = path3.resolve(file);
+  const absolute = path5.resolve(file);
   return fs6.realpath(absolute).catch(() => absolute);
 }
 async function launchIdentity(launch) {
@@ -5025,8 +5310,8 @@ async function runProbe(launch, args, timeoutMs = 5e3) {
     return `${stdout}
 ${stderr}`;
   } catch (cause) {
-    throw new CliError15({
-      code: CliErrorCode14.INVALID_ARGUMENT,
+    throw new CliError17({
+      code: CliErrorCode16.INVALID_ARGUMENT,
       message: `\u5019\u9009 HCM CLI \u80FD\u529B\u63A2\u9488\u5931\u8D25\uFF1Ahcm ${args.join(" ")}`,
       cause
     });
@@ -5091,10 +5376,10 @@ function cmdQuote(value) {
   return `"${value.replace(/%/g, "%%")}"`;
 }
 function preparedFile(filePath, content, mode) {
-  return { path: filePath, content, bytes: content.length, sha256: sha2562(content), mode };
+  return { path: filePath, content, bytes: content.length, sha256: sha2563(content), mode };
 }
 async function sha256File(file) {
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   await new Promise((resolve3, reject) => {
     const stream = createReadStream(file);
     stream.on("data", (chunk) => hash.update(chunk));
@@ -5103,17 +5388,29 @@ async function sha256File(file) {
   });
   return hash.digest("hex");
 }
-function sha2562(value) {
-  return createHash2("sha256").update(value).digest("hex");
+function sha2563(value) {
+  return createHash3("sha256").update(value).digest("hex");
 }
 function invalid2(message) {
-  return new CliError15({ code: CliErrorCode14.INVALID_ARGUMENT, message });
+  return new CliError17({ code: CliErrorCode16.INVALID_ARGUMENT, message });
 }
 
 // src/commands/skills.ts
 var SKILLS_STATE_FILE = ".hcm-skills.json";
-function sha2563(text) {
-  return createHash3("sha256").update(text, "utf8").digest("hex");
+function migrateSkillsState(state) {
+  const skills2 = {};
+  for (const [id, record] of Object.entries(state.skills ?? {})) {
+    if (record.sourceKind) {
+      skills2[id] = record;
+      continue;
+    }
+    const kind = /^https?:\/\//i.test(record.source ?? "") ? "chiron" : "local";
+    skills2[id] = { ...record, sourceKind: kind, sourceLocator: record.source };
+  }
+  return { ...state, skills: skills2 };
+}
+function sha2564(text) {
+  return createHash4("sha256").update(text, "utf8").digest("hex");
 }
 async function resolveEndpoint(args) {
   if (args.endpoint) return args.endpoint.replace(/\/+$/, "");
@@ -5121,8 +5418,8 @@ async function resolveEndpoint(args) {
   const envName = resolveActiveEnv3({ envFlag: args.env }, process.env, g);
   const env2 = await loadEnv5(envName).catch(() => null);
   if (!env2?.endpoint) {
-    throw new CliError16({
-      code: CliErrorCode15.MISSING_FLAG,
+    throw new CliError18({
+      code: CliErrorCode17.MISSING_FLAG,
       message: "\u672A\u89E3\u6790\u5230 endpoint \u2014\u2014 \u4F20 --endpoint <url>\uFF0C\u6216\u5148 `hcm env add <name> --endpoint <url>`\u3002\uFF08\u6280\u80FD\u5E93\u514D\u8BA4\u8BC1\uFF0C\u4E0D\u9700\u8981\u5148 login\uFF09"
     });
   }
@@ -5141,8 +5438,8 @@ function decideTrackedEndpoint(options) {
   }
   if (!recorded) {
     if (!current) {
-      throw new CliError16({
-        code: CliErrorCode15.MISSING_FLAG,
+      throw new CliError18({
+        code: CliErrorCode17.MISSING_FLAG,
         message: "\u672A\u89E3\u6790\u5230 endpoint \u2014\u2014 \u4F20 --endpoint <url>\uFF0C\u6216\u5148 `hcm env add <name> --endpoint <url>`\u3002\uFF08\u6280\u80FD\u5E93\u514D\u8BA4\u8BC1\uFF0C\u4E0D\u9700\u8981\u5148 login\uFF09"
       });
     }
@@ -5159,32 +5456,32 @@ function decideTrackedEndpoint(options) {
 }
 async function exists2(target) {
   try {
-    await fsp.stat(target);
+    await fsp2.stat(target);
     return true;
   } catch {
     return false;
   }
 }
 async function detectTarget(cwd) {
-  if (await exists2(path4.join(cwd, ".claude"))) return "claude";
-  if (await exists2(path4.join(cwd, "AGENTS.md"))) return "codex";
-  if (await exists2(path4.join(cwd, ".codex"))) return "codex";
+  if (await exists2(path6.join(cwd, ".claude"))) return "claude";
+  if (await exists2(path6.join(cwd, "AGENTS.md"))) return "codex";
+  if (await exists2(path6.join(cwd, ".codex"))) return "codex";
   return void 0;
 }
 async function resolveInstallLayout(args, cwd = process.cwd()) {
   const requested = args.target && args.target !== "auto" ? args.target : void 0;
   const target = requested ?? await detectTarget(cwd) ?? "claude";
   if (target === "codex") {
-    const root = args.global ? path4.join(os2.homedir(), ".codex") : cwd;
+    const root = args.global ? path6.join(os2.homedir(), ".codex") : cwd;
     return {
       target,
-      baseDir: args.dir ? path4.resolve(args.dir) : path4.join(root, "hcm-skills"),
-      agentsFile: path4.join(root, "AGENTS.md")
+      baseDir: args.dir ? path6.resolve(args.dir) : path6.join(root, "hcm-skills"),
+      agentsFile: path6.join(root, "AGENTS.md")
     };
   }
   return {
     target,
-    baseDir: args.dir ? path4.resolve(args.dir) : args.global ? path4.join(os2.homedir(), ".claude", "skills") : path4.join(cwd, ".claude", "skills")
+    baseDir: args.dir ? path6.resolve(args.dir) : args.global ? path6.join(os2.homedir(), ".claude", "skills") : path6.join(cwd, ".claude", "skills")
   };
 }
 async function chironClient(args) {
@@ -5209,10 +5506,41 @@ function fail3(e, args) {
 async function skillsListCommand(keyword, args) {
   try {
     if (args.installed) return await listInstalledSkills(keyword, args);
-    const { http, endpoint, base } = await chironClient(args);
-    const manifest2 = await fetchSkillCatalog(http, base);
+    const source = parseSourceFilter(args.source);
+    let manifest2;
+    let endpoint;
+    if (source !== "cli") {
+      const client3 = await chironClient(args);
+      endpoint = client3.endpoint;
+      manifest2 = await fetchSkillCatalog(client3.http, client3.base);
+    }
+    const bundled = source === "chiron" ? void 0 : listBundledSkills();
+    const catalog = buildUnifiedCatalog({ source, chironManifest: manifest2, bundled, cliVersion: CLI_VERSION });
+    const conflicts = detectIdConflicts(catalog);
+    if (conflicts.ids.length > 0) {
+      throw new CliError18({
+        code: CliErrorCode17.SKILL_ID_CONFLICT,
+        message: conflictMessage(conflicts.ids, endpoint ?? "(\u672A\u77E5\u73AF\u5883)")
+      });
+    }
     const fmt = args.output ?? "table";
-    let cats = manifest2.categories ?? [];
+    const cliCategory = catalog.cli.entries.size > 0 ? {
+      key: CLI_CATEGORY_KEY,
+      name: CLI_CATEGORY_NAME,
+      description: "\u968F\u8FD9\u4EFD CLI \u53D1\u5E03\u7684\u6280\u80FD\uFF0C\u8BB2\u7684\u662F\u672C CLI \u7684\u547D\u4EE4\uFF1B\u5347\u7EA7 CLI \u5C31\u662F\u5347\u7EA7\u5B83\u4EEC",
+      skills: [...catalog.cli.entries.values()].map((entry) => ({
+        id: entry.meta.id,
+        title: entry.meta.title,
+        category: CLI_CATEGORY_KEY,
+        actionSurface: "cli",
+        description: entry.meta.description,
+        stages: entry.meta.stages,
+        requires: entry.meta.requires,
+        bytes: entry.meta.bytes,
+        markdownUrl: ""
+      }))
+    } : void 0;
+    let cats = [...manifest2?.categories ?? [], ...cliCategory ? [cliCategory] : []];
     if (args.category) cats = cats.filter((c) => c.key === args.category);
     if (keyword) {
       cats = cats.map((c) => ({ ...c, skills: matchSkills(c.skills ?? [], keyword) })).filter((c) => c.skills.length > 0);
@@ -5221,21 +5549,41 @@ async function skillsListCommand(keyword, args) {
       cats = cats.map((c) => ({ ...c, skills: filterByStage(c.skills ?? [], args.stage) })).filter((c) => c.skills.length > 0);
     }
     if (fmt === "json" || fmt === "yaml") {
-      process.stdout.write(formatObject13({ ...manifest2, categories: cats }, { format: fmt }) + "\n");
+      process.stdout.write(
+        formatObject14(
+          {
+            ...manifest2 ?? {},
+            categories: cats,
+            sources: {
+              cli: { status: catalog.cli.status, count: catalog.cli.entries.size },
+              chiron: { status: catalog.chiron.status, count: catalog.chiron.entries.size }
+            },
+            conflictCheck: conflicts.checked ? { checked: true } : { checked: false, note: unconfirmedConflictNote(source) }
+          },
+          { format: fmt }
+        ) + "\n"
+      );
       process.exit(0);
     }
     const shown = cats.flatMap((c) => c.skills);
+    const total = (manifest2?.skillCount ?? 0) + catalog.cli.entries.size;
     if (shown.length === 0) {
-      process.stdout.write(`\u6CA1\u6709\u5339\u914D\u7684\u6280\u80FD\uFF08${endpoint} \u5171 ${manifest2.skillCount} \u4E2A\uFF09
+      process.stdout.write(`\u6CA1\u6709\u5339\u914D\u7684\u6280\u80FD\uFF08\u8FD9\u4E00\u8D9F\u770B\u7684\u6765\u6E90\u5171 ${total} \u4E2A\uFF09
 `);
       process.exit(0);
     }
-    process.stdout.write(`${manifest2.title ?? "Chiron"} \u2014 ${endpoint}
+    process.stdout.write(`${manifest2?.title ?? "HCM \u6280\u80FD"} \u2014 ${endpoint ?? `@hcmai/cli@${CLI_VERSION}`}
 
 `);
     if (args.byStage) {
       const all = cats.flatMap((c) => c.skills);
-      for (const st of manifest2.stages ?? []) {
+      const stageList = manifest2?.stages ?? [...new Set(all.flatMap((skill) => skill.stages ?? []))].sort().map((key) => ({
+        key,
+        name: key,
+        description: "",
+        skillCount: 0
+      }));
+      for (const st of stageList) {
         const inStage = filterByStage(all, st.key);
         if (inStage.length === 0 && !args.stage) {
           process.stdout.write(`  ${st.name}  (\u65E0\u6280\u80FD\u8986\u76D6)
@@ -5284,10 +5632,10 @@ async function listInstalledSkills(keyword, args) {
   const fmt = args.output ?? "table";
   if (!state || Object.keys(state.skills).length === 0) {
     if (fmt === "json" || fmt === "yaml") {
-      process.stdout.write(formatObject13({ baseDir: layout.baseDir, target: layout.target, all: false, skills: [] }, { format: fmt }) + "\n");
+      process.stdout.write(formatObject14({ baseDir: layout.baseDir, target: layout.target, all: false, skills: [] }, { format: fmt }) + "\n");
       process.exit(0);
     }
-    process.stdout.write(`${path4.join(layout.baseDir, SKILLS_STATE_FILE)} \u4E0D\u5B58\u5728\u6216\u4E3A\u7A7A \u2014\u2014 \u8FD9\u4E2A\u76EE\u5F55\u4E0B\u8FD8\u6CA1\u7528\u672C CLI \u88C5\u8FC7\u6280\u80FD\u3002
+    process.stdout.write(`${path6.join(layout.baseDir, SKILLS_STATE_FILE)} \u4E0D\u5B58\u5728\u6216\u4E3A\u7A7A \u2014\u2014 \u8FD9\u4E2A\u76EE\u5F55\u4E0B\u8FD8\u6CA1\u7528\u672C CLI \u88C5\u8FC7\u6280\u80FD\u3002
 `);
     process.stdout.write("  \u88C5\u5168\u90E8\uFF1Ahcm skills install --all\n");
     process.exit(0);
@@ -5297,31 +5645,43 @@ async function listInstalledSkills(keyword, args) {
     const markdown = await readInstalled(layout.baseDir, id);
     let title = id;
     if (markdown !== void 0) {
-      const raw = parseSkillFrontmatter(markdown, id).title;
+      const raw = parseSkillFrontmatter2(markdown, id).title;
       if (typeof raw === "string" && raw.trim()) title = raw.trim();
     }
     rows.push({
       id,
       title,
+      // 迁移保证它必然有值；`?? 'chiron'` 只是让类型闭合，不是业务缺省。
+      sourceKind: record.sourceKind ?? "chiron",
+      sourceLocator: record.sourceLocator ?? record.source,
       direct: record.direct,
       installedAt: record.installedAt,
       // 三种状态互斥：文件没了 / 本地改过 / 和装的时候一致
-      status: markdown === void 0 ? "missing" : sha2563(markdown) !== record.sha256 ? "locally-modified" : "installed"
+      status: markdown === void 0 ? "missing" : sha2564(markdown) !== record.sha256 ? "locally-modified" : "installed"
     });
   }
-  const shown = keyword ? rows.filter((row) => row.id.includes(keyword) || row.title.includes(keyword)) : rows;
+  const byKeyword = keyword ? rows.filter((row) => row.id.includes(keyword) || row.title.includes(keyword)) : rows;
+  const sourceFilter = parseSourceFilter(args.source);
+  const shown = sourceFilter === "all" ? byKeyword : byKeyword.filter((row) => row.sourceKind === sourceFilter);
+  const groupOf = (kind) => kind === "cli" ? "CLI \u81EA\u5E26" : kind === "local" ? "\u672C\u5730\u76EE\u5F55\u88C5\u7684" : "\u777F\u620E\u6280\u80FD\u5E93";
   if (fmt === "json" || fmt === "yaml") {
-    process.stdout.write(formatObject13({
+    process.stdout.write(formatObject14({
       baseDir: layout.baseDir,
       target: layout.target,
       endpoint: state.endpoint,
       all: Boolean(state.all),
       updatedAt: state.updatedAt,
+      // 按来源分组的小计：顾问要能一眼看出「这份是跟着 CLI 走的还是跟着后端走的」
+      bySource: {
+        cli: shown.filter((r) => r.sourceKind === "cli").length,
+        chiron: shown.filter((r) => r.sourceKind === "chiron").length,
+        local: shown.filter((r) => r.sourceKind === "local").length
+      },
       skills: shown
     }, { format: fmt }) + "\n");
     process.exit(0);
   }
-  process.stdout.write(`\u5DF2\u5B89\u88C5\u7684\u777F\u620E\u6280\u80FD \u2014 ${layout.baseDir}\uFF08${layout.target}\uFF09
+  process.stdout.write(`\u5DF2\u5B89\u88C5\u7684\u6280\u80FD \u2014 ${layout.baseDir}\uFF08${layout.target}\uFF09
 `);
   process.stdout.write(`\u6765\u6E90 ${state.endpoint ?? "\uFF08\u672A\u8BB0\u5F55\uFF09"}` + (state.all ? "   \u8DDF\u968F\u5168\u96C6\uFF1A\u662F\n\n" : "\n\n"));
   if (shown.length === 0) {
@@ -5329,11 +5689,18 @@ async function listInstalledSkills(keyword, args) {
 `);
     process.exit(0);
   }
-  for (const row of shown) {
-    const mark = row.status === "missing" ? "?" : row.status === "locally-modified" ? "!" : row.direct ? "\u25CF" : "\u25CB";
-    const note = row.status === "missing" ? "\u6587\u4EF6\u4E0D\u89C1\u4E86\uFF08update \u4F1A\u88C5\u56DE\uFF09" : row.status === "locally-modified" ? "\u672C\u5730\u6539\u8FC7" : row.direct ? "" : "\u4F9D\u8D56\u5E26\u5165";
-    process.stdout.write(`  ${mark} ${row.id.padEnd(30)} ${row.title.padEnd(24)} ${note}
+  for (const kind of ["chiron", "cli", "local"]) {
+    const group = shown.filter((row) => row.sourceKind === kind);
+    if (group.length === 0) continue;
+    process.stdout.write(`  ${groupOf(kind)}\uFF08${group.length}\uFF09
 `);
+    for (const row of group) {
+      const mark = row.status === "missing" ? "?" : row.status === "locally-modified" ? "!" : row.direct ? "\u25CF" : "\u25CB";
+      const note = row.status === "missing" ? "\u6587\u4EF6\u4E0D\u89C1\u4E86\uFF08update \u4F1A\u88C5\u56DE\uFF09" : row.status === "locally-modified" ? "\u672C\u5730\u6539\u8FC7" : row.direct ? "" : "\u4F9D\u8D56\u5E26\u5165";
+      process.stdout.write(`    ${mark} ${row.id.padEnd(30)} ${row.title.padEnd(24)} ${note}
+`);
+    }
+    process.stdout.write("\n");
   }
   const modified = shown.filter((row) => row.status === "locally-modified").length;
   const missing = shown.filter((row) => row.status === "missing").length;
@@ -5352,6 +5719,16 @@ async function listInstalledSkills(keyword, args) {
 }
 async function skillsShowCommand(id, args) {
   try {
+    assertSafeSkillId2(id);
+    const source = parseSourceFilter(args.source);
+    if (source !== "chiron" && listBundledSkills().some((s) => s.id === id)) {
+      const document = await readBundledSkillDocument(id);
+      process.stdout.write(document.markdown.endsWith("\n") ? document.markdown : document.markdown + "\n");
+      process.exit(0);
+    }
+    if (source === "cli") {
+      throw invalid3(`\u8FD9\u4E00\u7248 CLI \u6CA1\u6709\u81EA\u5E26 ${id} \u8FD9\u4E2A\u6280\u80FD\uFF08--source cli \u4E0D\u770B\u777F\u620E\u76EE\u5F55\uFF09`);
+    }
     const { http, base } = await chironClient(args);
     const md = await fetchSkillMarkdown(http, id, base);
     process.stdout.write(md.endsWith("\n") ? md : md + "\n");
@@ -5367,13 +5744,19 @@ async function skillsSyncCommand(id, args) {
       throw invalid3(`sync --target \u5F53\u524D\u53EA\u652F\u6301 workbuddy\uFF0C\u6536\u5230 "${args.target ?? ""}"`);
     }
     if (!args.project?.trim()) throw invalid3("sync \u5FC5\u987B\u4F20 --project <path>");
-    const project = path4.resolve(args.project);
+    if (listBundledSkills().some((one) => one.id === id)) {
+      throw new CliError18({
+        code: CliErrorCode17.SYNC_SOURCE_UNSUPPORTED,
+        message: `\`${id}\` \u662F CLI \u81EA\u5E26\u6280\u80FD\uFF1Bskills sync \u7684\u9501\u6587\u4EF6\uFF08chiron.lock.json\uFF09\u6B64\u523B\u53EA\u80FD\u8BB0\u5F55\u777F\u620E\u6765\u6E90\u7684\u51FA\u5904\u3002\u88C5\u5230\u672C\u5730\u7528 \`hcm skills install ` + id + "`\u3002"
+      });
+    }
+    const project = path6.resolve(args.project);
     const runtime = await prepareWorkBuddyRuntime({
       candidate: args.cli,
       currentEntryHasRequiredCapabilities: !args.cli?.trim(),
       forbiddenCandidatePaths: [
-        path4.join(project, ".hcm-delivery", "bin", "hcm"),
-        path4.join(project, ".hcm-delivery", "bin", "hcm.cmd")
+        path6.join(project, ".hcm-delivery", "bin", "hcm"),
+        path6.join(project, ".hcm-delivery", "bin", "hcm.cmd")
       ]
     });
     const connectionArgs = { endpoint: args.endpoint, env: args.env };
@@ -5396,7 +5779,7 @@ async function skillsSyncCommand(id, args) {
     });
     const fmt = args.output ?? "table";
     if (fmt === "json" || fmt === "yaml") {
-      process.stdout.write(`${formatObject13(result2, { format: fmt })}
+      process.stdout.write(`${formatObject14(result2, { format: fmt })}
 `);
     } else if (result2.changed) {
       process.stdout.write(`\u2705 ${id} \u2192 ${result2.skillsDir}
@@ -5434,8 +5817,9 @@ async function skillsInstallCommand(id, args) {
     let endpoint;
     let base;
     let manifest2;
+    let conflictNote;
     if (args.from) {
-      const root = path4.resolve(args.from);
+      const root = path6.resolve(args.from);
       requestedIds = all ? await listLocalSkillIds(root) : [id];
       const seen = /* @__PURE__ */ new Set();
       documents = [];
@@ -5447,23 +5831,97 @@ async function skillsInstallCommand(id, args) {
         }
       }
     } else {
-      const tracked = decideTrackedEndpoint({
-        explicit: Boolean(args.endpoint || args.env),
-        current: await resolveEndpoint(args).catch(() => void 0),
-        recorded: (await readSkillsState(layout.baseDir))?.endpoint
-      });
-      const client3 = await chironClient({ ...args, endpoint: tracked });
-      endpoint = client3.endpoint;
-      base = client3.base;
-      manifest2 = await fetchSkillCatalog(client3.http, base);
-      const order = all ? resolveAllSkillsInstallOrder(manifest2) : resolveSkillInstallOrder2(manifest2, id);
-      if (all && order.length === 0) throw invalid3(`${endpoint} \u7684\u6280\u80FD\u76EE\u5F55\u662F\u7A7A\u7684\uFF0C\u6CA1\u6709\u53EF\u88C5\u7684\u6280\u80FD`);
-      requestedIds = all ? order.map((skill) => skill.id) : [id];
-      documents = await mapWithConcurrency(
-        order,
-        FETCH_CONCURRENCY,
-        (skill) => fetchSkillDocument(client3.http, skill, endpoint, base)
-      );
+      const source = parseSourceFilter(args.source);
+      const bundled = source === "chiron" ? void 0 : listBundledSkills();
+      let http;
+      if (source !== "cli") {
+        const tracked = decideTrackedEndpoint({
+          explicit: Boolean(args.endpoint || args.env),
+          current: await resolveEndpoint(args).catch(() => void 0),
+          recorded: (await readSkillsState(layout.baseDir))?.endpoint
+        });
+        const client3 = await chironClient({ ...args, endpoint: tracked });
+        endpoint = client3.endpoint;
+        base = client3.base;
+        http = client3.http;
+        manifest2 = await fetchSkillCatalog(http, base);
+      }
+      const catalog = buildUnifiedCatalog({ source, chironManifest: manifest2, bundled, cliVersion: CLI_VERSION });
+      const conflicts = detectIdConflicts(catalog);
+      if (conflicts.ids.length > 0) {
+        throw new CliError18({
+          code: CliErrorCode17.SKILL_ID_CONFLICT,
+          message: conflictMessage(conflicts.ids, endpoint ?? "(\u672A\u77E5\u73AF\u5883)")
+        });
+      }
+      conflictNote = conflicts.checked ? void 0 : unconfirmedConflictNote(source);
+      for (const v of checkCrossSourceRequires(catalog)) {
+        throw invalid3(`${v.from} \u58F0\u660E\u4F9D\u8D56 ${v.to}\uFF0C\u4F46 ${v.to} \u662F CLI \u81EA\u5E26\u6280\u80FD\u3002${v.reason}`);
+      }
+      const wantBundled = (one) => catalog.cli.entries.has(one);
+      const seen = /* @__PURE__ */ new Set();
+      documents = [];
+      const pushAll = (docs) => {
+        for (const d of docs) {
+          if (seen.has(d.id)) continue;
+          seen.add(d.id);
+          documents.push(d);
+        }
+      };
+      const installBundled = async (one) => {
+        const { documents: local, external } = await resolveBundledClosure(one);
+        for (const need of external) {
+          if (catalog.chiron.status !== "fetched") {
+            throw invalid3(
+              `\u81EA\u5E26\u6280\u80FD ${one} \u4F9D\u8D56\u777F\u620E\u6280\u80FD ${need}\uFF0C\u4F46\u8FD9\u4E00\u8D9F\u6CA1\u8FDE\u7F51\u53D6\u777F\u620E\u76EE\u5F55\uFF08--source ${source}\uFF09\u3002\u8054\u7F51\u540E\u91CD\u8DD1\uFF0C\u6216\u5148\u5355\u72EC\u88C5\u4E0A\u5B83\u3002`
+            );
+          }
+          if (!catalog.chiron.entries.has(need)) {
+            throw invalid3(`\u81EA\u5E26\u6280\u80FD ${one} \u4F9D\u8D56 ${need}\uFF0C\u4F46 ${endpoint} \u7684\u6280\u80FD\u76EE\u5F55\u91CC\u6CA1\u6709\u5B83`);
+          }
+          pushAll(
+            await mapWithConcurrency(
+              resolveSkillInstallOrder2(manifest2, need),
+              FETCH_CONCURRENCY,
+              (skill) => fetchSkillDocument(http, skill, endpoint, base)
+            )
+          );
+        }
+        pushAll(local);
+      };
+      if (all) {
+        const order = manifest2 ? resolveAllSkillsInstallOrder(manifest2) : [];
+        const bundledIds = [...catalog.cli.entries.keys()].sort();
+        if (order.length === 0 && bundledIds.length === 0) {
+          throw invalid3(`${endpoint ?? "\u8FD9\u4E00\u8D9F\u770B\u7684\u6765\u6E90"} \u91CC\u6CA1\u6709\u53EF\u88C5\u7684\u6280\u80FD`);
+        }
+        requestedIds = [...order.map((skill) => skill.id), ...bundledIds];
+        if (order.length > 0) {
+          pushAll(
+            await mapWithConcurrency(
+              order,
+              FETCH_CONCURRENCY,
+              (skill) => fetchSkillDocument(http, skill, endpoint, base)
+            )
+          );
+        }
+        for (const one of bundledIds) await installBundled(one);
+      } else if (wantBundled(id)) {
+        requestedIds = [id];
+        await installBundled(id);
+      } else {
+        if (source === "cli") {
+          throw invalid3(`\u8FD9\u4E00\u7248 CLI \u6CA1\u6709\u81EA\u5E26 ${id} \u8FD9\u4E2A\u6280\u80FD\uFF08--source cli \u4E0D\u770B\u777F\u620E\u76EE\u5F55\uFF09`);
+        }
+        requestedIds = [id];
+        pushAll(
+          await mapWithConcurrency(
+            resolveSkillInstallOrder2(manifest2, id),
+            FETCH_CONCURRENCY,
+            (skill) => fetchSkillDocument(http, skill, endpoint, base)
+          )
+        );
+      }
     }
     const result2 = await installSkillDocuments(documents, requestedIds, layout.baseDir, Boolean(args.force), {
       endpoint,
@@ -5474,9 +5932,9 @@ async function skillsInstallCommand(id, args) {
     const agents = layout.agentsFile ? await syncAgentsIndex(layout, manifest2) : void 0;
     const fmt = args.output ?? "table";
     if (fmt === "json" || fmt === "yaml") {
-      process.stdout.write(formatObject13({ ...result2, all, target_agent: layout.target, agentsFile: layout.agentsFile, agents }, { format: fmt }) + "\n");
+      process.stdout.write(formatObject14({ ...result2, all, target_agent: layout.target, agentsFile: layout.agentsFile, agents, conflictCheck: conflictNote ? { checked: false, note: conflictNote } : { checked: true } }, { format: fmt }) + "\n");
     } else {
-      const headline = all ? `\u2705 \u5168\u90E8 ${requestedIds.length} \u4E2A\u6280\u80FD \u2192 ${result2.baseDir}` : `\u2705 ${id} \u2192 ${path4.join(result2.baseDir, id, "SKILL.md")}`;
+      const headline = all ? `\u2705 \u5168\u90E8 ${requestedIds.length} \u4E2A\u6280\u80FD \u2192 ${result2.baseDir}` : `\u2705 ${id} \u2192 ${path6.join(result2.baseDir, id, "SKILL.md")}`;
       process.stdout.write(`${headline}
 `);
       if (result2.installed.length > 0) {
@@ -5498,7 +5956,9 @@ async function skillsInstallCommand(id, args) {
         process.stdout.write(`   \u5DF2${agents === "created" ? "\u521B\u5EFA" : "\u66F4\u65B0"} ${layout.agentsFile} \u91CC\u7684\u6280\u80FD\u7D22\u5F15\uFF08Codex \u8BFB\u8FD9\u91CC\uFF09
 `);
       }
-      process.stdout.write(`   \u6765\u6E90 ${endpoint ?? path4.resolve(args.from)}
+      process.stdout.write(`   \u6765\u6E90 ${endpoint ?? (args.from ? path6.resolve(args.from) : `@hcmai/cli@${CLI_VERSION}`)}
+`);
+      if (conflictNote) process.stdout.write(`   \u26A0\uFE0F ${conflictNote}
 `);
       process.stdout.write(all ? "   \u5DF2\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D\uFF1A\u4EE5\u540E\u8DD1 hcm skills update\uFF0C\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\u4F1A\u81EA\u52A8\u8865\u4E0A\n" : "   \u4EA7\u54C1\u66F4\u65B0\u540E\u8DD1 hcm skills update \u5347\u7EA7\n");
     }
@@ -5524,14 +5984,14 @@ async function mapWithConcurrency(items, limit, fn) {
 async function listLocalSkillIds(root) {
   let entries;
   try {
-    entries = await fsp.readdir(root, { withFileTypes: true });
+    entries = await fsp2.readdir(root, { withFileTypes: true });
   } catch {
     throw invalid3(`\u8BFB\u4E0D\u5230\u672C\u5730\u6280\u80FD\u76EE\u5F55\uFF1A${root}`);
   }
   const ids = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    if (await exists2(path4.join(root, entry.name, "SKILL.md"))) ids.push(entry.name);
+    if (await exists2(path6.join(root, entry.name, "SKILL.md"))) ids.push(entry.name);
   }
   if (ids.length === 0) throw invalid3(`\u672C\u5730\u76EE\u5F55\u91CC\u6CA1\u6709\u4EFB\u4F55 <id>/SKILL.md\uFF1A${root}`);
   return ids.sort();
@@ -5546,6 +6006,7 @@ async function fetchSkillDocument(http, skill, endpoint, base) {
     id: skill.id,
     markdown: await fetchSkillMarkdown(http, skill.id, base),
     source: `${endpoint}${base}/skills/${skill.id}.md`,
+    sourceKind: "chiron",
     references
   };
 }
@@ -5557,17 +6018,17 @@ async function syncAgentsIndex(layout, manifest2) {
   for (const category of manifest2?.categories ?? []) {
     for (const skill of category.skills ?? []) catalog.set(skill.id, skill);
   }
-  const agentsDir = path4.dirname(layout.agentsFile);
+  const agentsDir = path6.dirname(layout.agentsFile);
   const entries = Object.keys(state.skills).sort().map((id) => {
     const known = catalog.get(id);
-    const absolute = path4.join(layout.baseDir, id, "SKILL.md");
-    let relative2 = path4.relative(agentsDir, absolute);
+    const absolute = path6.join(layout.baseDir, id, "SKILL.md");
+    let relative2 = path6.relative(agentsDir, absolute);
     if (!relative2.startsWith(".")) relative2 = `./${relative2}`;
     return {
       id,
       title: known?.title ?? id,
       description: known?.description ?? "",
-      relativePath: relative2.split(path4.sep).join("/")
+      relativePath: relative2.split(path6.sep).join("/")
     };
   });
   return upsertAgentsBlock(layout.agentsFile, renderAgentsBlock(entries));
@@ -5585,13 +6046,13 @@ async function resolveLocalSkillDocuments(sourceRoot, targetId) {
       throw invalid3(`\u6280\u80FD\u4F9D\u8D56\u5B58\u5728\u73AF: ${[...pathStack.slice(Math.max(0, start)), id].join(" -> ")}`);
     }
     assertSafeSkillId2(id);
-    const local = path4.join(sourceRoot, id, "SKILL.md");
+    const local = path6.join(sourceRoot, id, "SKILL.md");
     let markdown;
     try {
-      markdown = await fsp.readFile(local, "utf8");
+      markdown = await fsp2.readFile(local, "utf8");
     } catch (cause) {
       if (cause?.code === "ENOENT") {
-        throw invalid3(requiredBy ? `\u672C\u5730\u6280\u80FD ${requiredBy} \u4F9D\u8D56\u4E0D\u5B58\u5728: ${id}\uFF08${local}\uFF09` : `\u672C\u5730\u76EE\u5F55\u91CC\u6CA1\u6709 ${id}/SKILL.md\uFF1A${path4.join(sourceRoot, id)}`);
+        throw invalid3(requiredBy ? `\u672C\u5730\u6280\u80FD ${requiredBy} \u4F9D\u8D56\u4E0D\u5B58\u5728: ${id}\uFF08${local}\uFF09` : `\u672C\u5730\u76EE\u5F55\u91CC\u6CA1\u6709 ${id}/SKILL.md\uFF1A${path6.join(sourceRoot, id)}`);
       }
       throw cause;
     }
@@ -5602,9 +6063,10 @@ async function resolveLocalSkillDocuments(sourceRoot, targetId) {
       id,
       markdown,
       source: local,
-      references: await readLocalReferences(path4.join(sourceRoot, id))
+      sourceKind: "local",
+      references: await readLocalReferences(path6.join(sourceRoot, id))
     };
-    for (const required of parseSkillRequirements(markdown, id)) {
+    for (const required of parseSkillRequirements2(markdown, id)) {
       await visit(required, id);
     }
     pathStack.pop();
@@ -5616,20 +6078,20 @@ async function resolveLocalSkillDocuments(sourceRoot, targetId) {
 }
 async function readSkillsState(baseDir) {
   try {
-    const raw = await fsp.readFile(path4.join(baseDir, SKILLS_STATE_FILE), "utf8");
+    const raw = await fsp2.readFile(path6.join(baseDir, SKILLS_STATE_FILE), "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.skills) return void 0;
-    return parsed;
+    return migrateSkillsState(parsed);
   } catch {
     return void 0;
   }
 }
 async function writeSkillsState(baseDir, state) {
-  await fsp.mkdir(baseDir, { recursive: true });
-  const file = path4.join(baseDir, SKILLS_STATE_FILE);
+  await fsp2.mkdir(baseDir, { recursive: true });
+  const file = path6.join(baseDir, SKILLS_STATE_FILE);
   const temp = `${file}.${process.pid}.tmp`;
-  await fsp.writeFile(temp, JSON.stringify(state, null, 2) + "\n", "utf8");
-  await fsp.rename(temp, file);
+  await fsp2.writeFile(temp, JSON.stringify(state, null, 2) + "\n", "utf8");
+  await fsp2.rename(temp, file);
 }
 var AGENTS_BLOCK_BEGIN = "<!-- hcm-skills:begin -->";
 var AGENTS_BLOCK_END = "<!-- hcm-skills:end -->";
@@ -5652,22 +6114,22 @@ function renderAgentsBlock(entries) {
 async function upsertAgentsBlock(agentsFile, block) {
   let existing = "";
   try {
-    existing = await fsp.readFile(agentsFile, "utf8");
+    existing = await fsp2.readFile(agentsFile, "utf8");
   } catch (cause) {
     if (cause?.code !== "ENOENT") throw cause;
-    await fsp.mkdir(path4.dirname(agentsFile), { recursive: true });
-    await fsp.writeFile(agentsFile, block + "\n", "utf8");
+    await fsp2.mkdir(path6.dirname(agentsFile), { recursive: true });
+    await fsp2.writeFile(agentsFile, block + "\n", "utf8");
     return "created";
   }
   const begin = existing.indexOf(AGENTS_BLOCK_BEGIN);
   const end = existing.indexOf(AGENTS_BLOCK_END);
   if (begin >= 0 && end > begin) {
     const next = existing.slice(0, begin) + block + existing.slice(end + AGENTS_BLOCK_END.length);
-    await fsp.writeFile(agentsFile, next, "utf8");
+    await fsp2.writeFile(agentsFile, next, "utf8");
     return "replaced";
   }
   const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-  await fsp.writeFile(agentsFile, existing + separator + block + "\n", "utf8");
+  await fsp2.writeFile(agentsFile, existing + separator + block + "\n", "utf8");
   return "appended";
 }
 async function installSkillDocuments(documents, requestedIds, baseDir, force, meta2) {
@@ -5681,7 +6143,7 @@ async function installSkillDocuments(documents, requestedIds, baseDir, force, me
     if (!document.markdown.trim()) throw invalid3(`\u6280\u80FD ${document.id} \u5185\u5BB9\u4E3A\u7A7A`);
     return {
       ...document,
-      target: path4.join(baseDir, document.id, "SKILL.md"),
+      target: path6.join(baseDir, document.id, "SKILL.md"),
       bytes: Buffer.byteLength(document.markdown)
     };
   });
@@ -5732,12 +6194,12 @@ async function sameOnDisk(baseDir, candidate) {
   return true;
 }
 async function readLocalReferences(skillDir) {
-  const root = path4.join(skillDir, "references");
+  const root = path6.join(skillDir, "references");
   const out = [];
   const walk = async (dir, prefix) => {
     let items;
     try {
-      items = await fsp.readdir(dir, { withFileTypes: true });
+      items = await fsp2.readdir(dir, { withFileTypes: true });
     } catch (cause) {
       if (cause?.code === "ENOENT") return;
       throw cause;
@@ -5745,49 +6207,79 @@ async function readLocalReferences(skillDir) {
     for (const item of items.sort((a, b) => a.name.localeCompare(b.name))) {
       const relative2 = prefix ? `${prefix}/${item.name}` : item.name;
       if (item.isDirectory()) {
-        await walk(path4.join(dir, item.name), relative2);
+        await walk(path6.join(dir, item.name), relative2);
         continue;
       }
       if (!item.isFile()) continue;
-      assertSafeReferencePath(relative2);
-      out.push({ path: relative2, content: await fsp.readFile(path4.join(dir, item.name), "utf8") });
+      assertSafeReferencePath2(relative2);
+      out.push({ path: relative2, content: await fsp2.readFile(path6.join(dir, item.name), "utf8") });
     }
   };
   await walk(root, "");
   return out;
 }
-async function writeSkillDocuments(documents, baseDir) {
+async function planStaleReferences(state, documents, baseDir) {
+  const remove = [];
+  const keptLocallyModified = [];
+  for (const document of documents) {
+    const recorded = state.skills[document.id]?.references ?? {};
+    const fresh = new Set((document.references ?? []).map((r) => r.path));
+    for (const [relative2, recordedSha] of Object.entries(recorded)) {
+      if (fresh.has(relative2)) continue;
+      const onDisk = await readInstalledReference(baseDir, document.id, relative2);
+      if (onDisk === void 0) continue;
+      if (sha2564(onDisk) !== recordedSha) {
+        keptLocallyModified.push({ id: document.id, path: relative2 });
+        continue;
+      }
+      remove.push({ id: document.id, path: relative2 });
+    }
+  }
+  const byKey = (a, b) => `${a.id}/${a.path}`.localeCompare(`${b.id}/${b.path}`);
+  return { remove: remove.sort(byKey), keptLocallyModified: keptLocallyModified.sort(byKey) };
+}
+async function writeSkillDocuments(documents, baseDir, removals = []) {
   const staged = [];
+  const removed = [];
   try {
     for (const document of documents) {
-      const target = path4.join(baseDir, document.id, "SKILL.md");
-      await fsp.mkdir(path4.dirname(target), { recursive: true });
-      const temp = path4.join(path4.dirname(target), `.SKILL.md.${process.pid}.${Date.now()}.tmp`);
-      await fsp.writeFile(temp, document.markdown, "utf8");
+      const target = path6.join(baseDir, document.id, "SKILL.md");
+      await fsp2.mkdir(path6.dirname(target), { recursive: true });
+      const temp = path6.join(path6.dirname(target), `.SKILL.md.${process.pid}.${Date.now()}.tmp`);
+      await fsp2.writeFile(temp, document.markdown, "utf8");
       staged.push({ temp, target });
       for (const reference of document.references ?? []) {
-        assertSafeReferencePath(reference.path);
-        const referenceTarget = path4.join(baseDir, document.id, "references", reference.path);
-        await fsp.mkdir(path4.dirname(referenceTarget), { recursive: true });
+        assertSafeReferencePath2(reference.path);
+        const referenceTarget = path6.join(baseDir, document.id, "references", reference.path);
+        await fsp2.mkdir(path6.dirname(referenceTarget), { recursive: true });
         const referenceTemp = `${referenceTarget}.${process.pid}.${Date.now()}.tmp`;
-        await fsp.writeFile(referenceTemp, reference.content, "utf8");
+        await fsp2.writeFile(referenceTemp, reference.content, "utf8");
         staged.push({ temp: referenceTemp, target: referenceTarget });
       }
     }
-    for (const file of staged) await fsp.rename(file.temp, file.target);
+    for (const stale of removals) {
+      assertSafeReferencePath2(stale.path);
+      const original = path6.join(baseDir, stale.id, "references", stale.path);
+      const parked = `${original}.${process.pid}.${Date.now()}.removed`;
+      await fsp2.rename(original, parked);
+      removed.push({ parked, original });
+    }
+    for (const file of staged) await fsp2.rename(file.temp, file.target);
+    await Promise.all(removed.map((r) => fsp2.unlink(r.parked).catch(() => void 0)));
   } catch (cause) {
-    await Promise.all(staged.map((file) => fsp.unlink(file.temp).catch(() => void 0)));
+    await Promise.all(staged.map((file) => fsp2.unlink(file.temp).catch(() => void 0)));
+    await Promise.all(removed.map((r) => fsp2.rename(r.parked, r.original).catch(() => void 0)));
     throw cause;
   }
 }
 async function recordInstalled(baseDir, documents, meta2) {
   const state = await readSkillsState(baseDir) ?? {
-    version: 1,
+    version: 2,
     target: meta2.target ?? "claude",
     updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     skills: {}
   };
-  state.version = 1;
+  state.version = 2;
   if (meta2.target) state.target = meta2.target;
   if (meta2.endpoint) state.endpoint = meta2.endpoint;
   if (meta2.base !== void 0) state.base = meta2.base;
@@ -5797,12 +6289,15 @@ async function recordInstalled(baseDir, documents, meta2) {
     const previous = state.skills[document.id];
     state.skills[document.id] = {
       source: document.source,
-      sha256: sha2563(document.markdown),
+      // 🔴 两个键同值：`source` 留给旧 CLI 读（降级不炸），新代码只读 `sourceLocator`。
+      sourceKind: document.sourceKind ?? previous?.sourceKind ?? "chiron",
+      sourceLocator: document.source,
+      sha256: sha2564(document.markdown),
       installedAt: meta2.keepInstalledAt?.has(document.id) && previous ? previous.installedAt : state.updatedAt,
       // 已经是直接安装的，不因为这次作为依赖被带进来就降级
       direct: meta2.directIds.has(document.id) || Boolean(previous?.direct),
       references: Object.fromEntries(
-        (document.references ?? []).map((reference) => [reference.path, sha2563(reference.content)])
+        (document.references ?? []).map((reference) => [reference.path, sha2564(reference.content)])
       )
     };
   }
@@ -5810,11 +6305,11 @@ async function recordInstalled(baseDir, documents, meta2) {
   return state;
 }
 function invalid3(message) {
-  return new CliError16({ code: CliErrorCode15.INVALID_ARGUMENT, message });
+  return new CliError18({ code: CliErrorCode17.INVALID_ARGUMENT, message });
 }
 async function readInstalled(baseDir, id) {
   try {
-    return await fsp.readFile(path4.join(baseDir, id, "SKILL.md"), "utf8");
+    return await fsp2.readFile(path6.join(baseDir, id, "SKILL.md"), "utf8");
   } catch (cause) {
     if (cause?.code === "ENOENT") return void 0;
     throw cause;
@@ -5822,63 +6317,106 @@ async function readInstalled(baseDir, id) {
 }
 async function readInstalledReference(baseDir, id, relative2) {
   try {
-    return await fsp.readFile(path4.join(baseDir, id, "references", relative2), "utf8");
+    return await fsp2.readFile(path6.join(baseDir, id, "references", relative2), "utf8");
   } catch (cause) {
     if (cause?.code === "ENOENT") return void 0;
     throw cause;
   }
 }
 async function planSkillUpdate(options) {
-  const { state, manifest: manifest2, baseDir, force, fetchDocument } = options;
+  const { state, baseDir, force, fetchDocument } = options;
+  const manifest2 = options.manifest;
+  const catalog = options.catalog ?? buildUnifiedCatalog({ source: "chiron", chironManifest: manifest2, cliVersion: CLI_VERSION });
+  const fetchBundled = options.fetchBundled ?? ((id) => readBundledSkillDocument(id));
   const all = options.all ?? Boolean(state.all);
   const recorded = Object.entries(state.skills);
   const directIds = recorded.some(([, r]) => r.direct) ? recorded.filter(([, r]) => r.direct).map(([id]) => id) : recorded.map(([id]) => id);
-  const wanted = all ? [.../* @__PURE__ */ new Set([...directIds, ...flattenSkills(manifest2).map((skill) => skill.id)])] : directIds;
   const entries = [];
+  const live = [];
+  for (const id of directIds.sort()) {
+    const record = state.skills[id];
+    const status = classifyInstalledSource(id, record, catalog);
+    if (status === "present") {
+      live.push({ id, kind: (record.sourceKind ?? "chiron") === "cli" ? "cli" : "chiron" });
+      continue;
+    }
+    entries.push({ id, status, note: SOURCE_STATUS_NOTE[status] });
+  }
+  if (all) {
+    const known = new Set(live.map((x) => x.id));
+    for (const kind of ["chiron", "cli"]) {
+      const half = kind === "chiron" ? catalog.chiron : catalog.cli;
+      if (half.status !== "fetched") continue;
+      for (const id of half.entries.keys()) {
+        if (known.has(id)) continue;
+        known.add(id);
+        live.push({ id, kind });
+      }
+    }
+  }
   const closure = /* @__PURE__ */ new Map();
-  for (const id of wanted.sort()) {
+  const chironNeeded = /* @__PURE__ */ new Set();
+  for (const item of live) {
+    if (item.kind === "cli") {
+      const queue = [item.id];
+      while (queue.length > 0) {
+        const id = queue.shift();
+        if (closure.has(id)) continue;
+        const entry = catalog.cli.entries.get(id);
+        if (!entry) {
+          chironNeeded.add(id);
+          continue;
+        }
+        closure.set(id, { kind: "cli" });
+        for (const need of entry.meta.requires ?? []) queue.push(need);
+      }
+      continue;
+    }
+    chironNeeded.add(item.id);
+  }
+  for (const id of chironNeeded) {
+    if (!manifest2) continue;
     try {
       for (const skill of resolveSkillInstallOrder2(manifest2, id)) {
-        if (!closure.has(skill.id)) closure.set(skill.id, skill);
+        if (!closure.has(skill.id)) closure.set(skill.id, { kind: "chiron", skill });
       }
     } catch {
-      entries.push({
-        id,
-        status: "removed-upstream",
-        note: "\u4EA7\u54C1\u8FD9\u4E00\u7248\u7684\u6280\u80FD\u76EE\u5F55\u91CC\u5DF2\u7ECF\u6CA1\u6709\u5B83\u4E86\uFF1B\u672C\u5730\u6587\u4EF6\u4FDD\u7559\u4E0D\u52A8"
-      });
+      if (!entries.some((e) => e.id === id)) {
+        entries.push({ id, status: "removed-upstream", note: SOURCE_STATUS_NOTE["removed-upstream"] });
+      }
     }
   }
   const documents = [];
-  for (const skill of closure.values()) {
-    const record = state.skills[skill.id];
-    const onDisk = await readInstalled(baseDir, skill.id);
+  for (const [id, item] of closure) {
+    const record = state.skills[id];
+    const onDisk = await readInstalled(baseDir, id);
+    const fetch = async () => item.kind === "cli" ? await fetchBundled(id) : await fetchDocument(item.skill);
     if (onDisk === void 0) {
-      documents.push(await fetchDocument(skill));
+      documents.push(await fetch());
       entries.push({
-        id: skill.id,
+        id,
         status: "added",
         note: record ? "\u672C\u5730\u6587\u4EF6\u7F3A\u5931\uFF0C\u91CD\u65B0\u88C5\u56DE" : all ? "\u4EA7\u54C1\u8FD9\u4E00\u7248\u65B0\u589E\u7684\u6280\u80FD" : "\u4EA7\u54C1\u65B0\u589E\u7684\u524D\u7F6E\u6280\u80FD"
       });
       continue;
     }
-    const remote = await fetchDocument(skill);
+    const remote = await fetch();
     const remoteReferences = remote.references ?? [];
     let differsFromRemote = remote.markdown !== onDisk;
-    let editedLocally = record !== void 0 && sha2563(onDisk) !== record.sha256;
+    let editedLocally = record !== void 0 && sha2564(onDisk) !== record.sha256;
     for (const reference of remoteReferences) {
-      const installed = await readInstalledReference(baseDir, skill.id, reference.path);
+      const installed = await readInstalledReference(baseDir, id, reference.path);
       if (installed !== reference.content) differsFromRemote = true;
       const recordedSha = record?.references?.[reference.path];
-      if (installed !== void 0 && recordedSha && sha2563(installed) !== recordedSha) editedLocally = true;
+      if (installed !== void 0 && recordedSha && sha2564(installed) !== recordedSha) editedLocally = true;
     }
     if (!differsFromRemote) {
-      entries.push({ id: skill.id, status: "unchanged" });
+      entries.push({ id, status: "unchanged" });
       continue;
     }
     if (editedLocally && !force) {
       entries.push({
-        id: skill.id,
+        id,
         status: "locally-modified",
         note: "\u672C\u5730\u6539\u8FC7\uFF0C\u6CA1\u6709\u8986\u76D6\uFF1B\u786E\u5B9A\u8981\u7528\u4EA7\u54C1\u8FD9\u4E00\u7248\u5C31\u52A0 --force"
       });
@@ -5886,7 +6424,7 @@ async function planSkillUpdate(options) {
     }
     documents.push(remote);
     entries.push({
-      id: skill.id,
+      id,
       status: "updated",
       note: editedLocally ? "\u672C\u5730\u6539\u8FC7\uFF0C--force \u5DF2\u8986\u76D6" : void 0
     });
@@ -5899,37 +6437,54 @@ var UPDATE_STATUS_LABEL = {
   added: "\u5DF2\u8865\u88C5",
   unchanged: "\u5DF2\u662F\u6700\u65B0",
   "locally-modified": "\u672C\u5730\u6539\u8FC7\xB7\u8DF3\u8FC7",
-  "removed-upstream": "\u4EA7\u54C1\u5DF2\u79FB\u9664"
+  "removed-upstream": "\u4EA7\u54C1\u5DF2\u79FB\u9664",
+  "removed-in-cli": "CLI \u4E0D\u518D\u81EA\u5E26",
+  // 🔴 这一档不是结论，是「这一趟没核」。文案上必须看得出区别，
+  // 否则顾问会把它读成「没问题」，而它可能正藏着一份真的被移除了的技能。
+  "not-checked": "\u672C\u8F6E\u672A\u6838",
+  local: "\u672C\u5730\u6765\u6E90\xB7\u4E0D\u7BA1"
 };
 async function skillsUpdateCommand(args) {
   try {
     const layout = await resolveInstallLayout(args);
     const state = await readSkillsState(layout.baseDir);
     if (!state || Object.keys(state.skills).length === 0) {
-      throw new CliError16({
-        code: CliErrorCode15.INVALID_ARGUMENT,
-        message: `${path4.join(layout.baseDir, SKILLS_STATE_FILE)} \u4E0D\u5B58\u5728\u6216\u4E3A\u7A7A \u2014\u2014 \u8FD9\u4E2A\u76EE\u5F55\u4E0B\u8FD8\u6CA1\u6709\u7528\u672C CLI \u88C5\u8FC7\u6280\u80FD\u3002\u5148 \`hcm skills install <id>\`\uFF1B\u5982\u679C\u6280\u80FD\u662F\u624B\u5DE5\u62F7\u8FDB\u6765\u7684\uFF0C\u91CD\u88C5\u4E00\u6B21\u5373\u53EF\u63A5\u7BA1\u5347\u7EA7\u3002`
+      throw new CliError18({
+        code: CliErrorCode17.INVALID_ARGUMENT,
+        message: `${path6.join(layout.baseDir, SKILLS_STATE_FILE)} \u4E0D\u5B58\u5728\u6216\u4E3A\u7A7A \u2014\u2014 \u8FD9\u4E2A\u76EE\u5F55\u4E0B\u8FD8\u6CA1\u6709\u7528\u672C CLI \u88C5\u8FC7\u6280\u80FD\u3002\u5148 \`hcm skills install <id>\`\uFF1B\u5982\u679C\u6280\u80FD\u662F\u624B\u5DE5\u62F7\u8FDB\u6765\u7684\uFF0C\u91CD\u88C5\u4E00\u6B21\u5373\u53EF\u63A5\u7BA1\u5347\u7EA7\u3002`
       });
     }
+    const source = parseSourceFilter(args.source);
     const endpoint = decideTrackedEndpoint({
       explicit: Boolean(args.endpoint || args.env),
       current: await resolveEndpoint(args).catch(() => void 0),
       recorded: state.endpoint
     });
-    const { http, base } = await chironClient({ ...args, endpoint });
-    const manifest2 = await fetchSkillCatalog(http, base);
+    let manifest2;
+    let base;
+    let http;
+    if (source !== "cli") {
+      const client3 = await chironClient({ ...args, endpoint });
+      http = client3.http;
+      base = client3.base;
+      manifest2 = await fetchSkillCatalog(http, base);
+    }
+    const bundled = source === "chiron" ? void 0 : listBundledSkills();
+    const catalog = buildUnifiedCatalog({ source, chironManifest: manifest2, bundled, cliVersion: CLI_VERSION });
     const all = Boolean(args.all) || Boolean(state.all);
     const plan = await planSkillUpdate({
       state,
       manifest: manifest2,
+      catalog,
       baseDir: layout.baseDir,
       force: Boolean(args.force),
       all,
       fetchDocument: (skill) => fetchSkillDocument(http, skill, endpoint, base)
     });
+    const stale = await planStaleReferences(state, plan.documents, layout.baseDir);
     const subscriptionChanged = all && !state.all;
     if (!args.check && (plan.documents.length > 0 || subscriptionChanged)) {
-      await writeSkillDocuments(plan.documents, layout.baseDir);
+      await writeSkillDocuments(plan.documents, layout.baseDir, stale.remove);
       await recordInstalled(layout.baseDir, plan.documents, {
         endpoint,
         base,
@@ -5942,18 +6497,24 @@ async function skillsUpdateCommand(args) {
     const changed = plan.entries.filter((e) => e.status === "updated" || e.status === "added");
     const fmt = args.output ?? "table";
     if (fmt === "json" || fmt === "yaml") {
-      process.stdout.write(formatObject13({
+      process.stdout.write(formatObject14({
         endpoint,
         baseDir: layout.baseDir,
         target: layout.target,
         dryRun: Boolean(args.check),
         all,
         changed: changed.length,
+        sources: {
+          cli: { status: catalog.cli.status, count: catalog.cli.entries.size },
+          chiron: { status: catalog.chiron.status, count: catalog.chiron.entries.size }
+        },
+        cliVersion: CLI_VERSION,
+        staleReferences: stale,
         entries: plan.entries
       }, { format: fmt }) + "\n");
       process.exit(0);
     }
-    process.stdout.write(`\u777F\u620E\u6280\u80FD\u5347\u7EA7 \u2014 ${endpoint}
+    process.stdout.write(`\u6280\u80FD\u5347\u7EA7 \u2014 ${source === "cli" ? `@hcmai/cli@${CLI_VERSION}\uFF08\u672A\u8FDE\u7F51\uFF09` : endpoint}
 `);
     process.stdout.write(`\u843D\u70B9 ${layout.baseDir}\uFF08${layout.target}\uFF09` + (all ? "  \u8DDF\u968F\u5168\u96C6\uFF1A\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\u4F1A\u81EA\u52A8\u8865\u4E0A\n\n" : "\n\n"));
     for (const entry of plan.entries) {
@@ -5966,10 +6527,38 @@ async function skillsUpdateCommand(args) {
     process.stdout.write("\n");
     const skipped = plan.entries.filter((e) => e.status === "locally-modified").length;
     const removed = plan.entries.filter((e) => e.status === "removed-upstream").length;
+    const removedInCli = plan.entries.filter((e) => e.status === "removed-in-cli").length;
+    const notChecked = plan.entries.filter((e) => e.status === "not-checked").length;
     const tail = [
       skipped > 0 ? `${skipped} \u4E2A\u672C\u5730\u6539\u8FC7\u88AB\u8DF3\u8FC7\uFF08--force \u8986\u76D6\uFF09` : "",
-      removed > 0 ? `${removed} \u4E2A\u4EA7\u54C1\u5DF2\u79FB\u9664\uFF08\u672C\u5730\u6587\u4EF6\u4FDD\u7559\uFF09` : ""
+      removed > 0 ? `${removed} \u4E2A\u4EA7\u54C1\u5DF2\u79FB\u9664\uFF08\u672C\u5730\u6587\u4EF6\u4FDD\u7559\uFF09` : "",
+      removedInCli > 0 ? `${removedInCli} \u4E2A\u8FD9\u4E00\u7248 CLI \u4E0D\u518D\u81EA\u5E26\uFF08\u672C\u5730\u6587\u4EF6\u4FDD\u7559\uFF09` : "",
+      notChecked > 0 ? `${notChecked} \u4E2A\u672C\u8F6E\u672A\u6838\uFF08\u90A3\u4E00\u534A\u8FD9\u8D9F\u6CA1\u770B\uFF09` : ""
     ].filter(Boolean).join("\uFF0C");
+    const cliCount = plan.entries.filter(
+      (e) => (state.skills[e.id]?.sourceKind ?? "chiron") === "cli"
+    ).length;
+    if (cliCount > 0) {
+      process.stdout.write(`  \u81EA\u5E26\u6280\u80FD ${cliCount} \u4E2A\u5DF2\u8DDF\u968F\u5F53\u524D CLI ${CLI_VERSION}
+`);
+    }
+    if (source === "cli" && all) {
+      process.stdout.write(
+        "  \u672C\u8D9F\u53EA\u770B\u4E86\u81EA\u5E26\u90A3\u4E00\u534A\uFF1B\u8FD9\u4E2A\u76EE\u5F55\u8BA2\u9605\u7684\u662F\u5168\u5E93\uFF0C\u8054\u7F51\u540E update \u4F1A\u8865\u9F50\u777F\u620E\u90A3\u4E00\u534A\n"
+      );
+    }
+    if (stale.remove.length > 0) {
+      process.stdout.write(
+        `  ${args.check ? "\u4F1A\u5220\u6389" : "\u5DF2\u5220\u6389"} ${stale.remove.length} \u4E2A\u4EA7\u54C1\u8FD9\u4E00\u7248\u64A4\u6389\u7684\u53C2\u8003\u6587\u4EF6\uFF08${stale.remove.map((r) => `${r.id}/references/${r.path}`).join("\u3001")}\uFF09
+`
+      );
+    }
+    if (stale.keptLocallyModified.length > 0) {
+      process.stdout.write(
+        `  ${stale.keptLocallyModified.length} \u4E2A\u4EA7\u54C1\u5DF2\u64A4\u6389\u4F46\u672C\u5730\u6539\u8FC7\u7684\u53C2\u8003\u6587\u4EF6\u4FDD\u7559\u4E86\uFF08${stale.keptLocallyModified.map((r) => `${r.id}/references/${r.path}`).join("\u3001")}\uFF09
+`
+      );
+    }
     if (changed.length === 0 && skipped === 0 && removed === 0) {
       process.stdout.write(args.check ? "  \u5168\u90E8\u5DF2\u662F\u6700\u65B0\uFF08--check \u53EA\u770B\u4E0D\u52A8\uFF09\n" : "  \u5168\u90E8\u5DF2\u662F\u6700\u65B0\uFF0C\u6CA1\u6709\u6539\u52A8\n");
     } else {
@@ -5987,13 +6576,13 @@ async function skillsUpdateCommand(args) {
 import {
   bootstrapTenant,
   createHttpClient as createHttpClient3,
-  formatObject as formatObject14,
+  formatObject as formatObject15,
   fromAxiosError as fromAxiosError14,
   loadEnv as loadEnv6,
   loadGlobalConfig as loadGlobalConfig7,
   resolveActiveEnv as resolveActiveEnv4,
-  CliError as CliError17,
-  CliErrorCode as CliErrorCode16
+  CliError as CliError19,
+  CliErrorCode as CliErrorCode18
 } from "@hcmai/sdk";
 init_exit();
 async function resolveBootstrapKey(args, stdinTaken) {
@@ -6001,8 +6590,8 @@ async function resolveBootstrapKey(args, stdinTaken) {
   if (fromEnv) return fromEnv;
   if (args.bootstrapKeyStdin) {
     if (stdinTaken) {
-      throw new CliError17({
-        code: CliErrorCode16.INVALID_ARGUMENT,
+      throw new CliError19({
+        code: CliErrorCode18.INVALID_ARGUMENT,
         message: "--bootstrap-key-stdin \u4E0E --admin-password-stdin \u4E0D\u80FD\u540C\u65F6\u7528\uFF08stdin \u53EA\u6709\u4E00\u8DEF\uFF09\uFF1B\u628A\u5176\u4E2D\u4E00\u4E2A\u6539\u8D70 HCM_BOOTSTRAP_KEY \u73AF\u5883\u53D8\u91CF\u6216\u4EA4\u4E92\u8F93\u5165"
       });
     }
@@ -6032,8 +6621,8 @@ async function resolveEndpoint2(args) {
   const envName = resolveActiveEnv4({ envFlag: args.env }, process.env, g);
   const env2 = await loadEnv6(envName).catch(() => null);
   if (!env2?.endpoint) {
-    throw new CliError17({
-      code: CliErrorCode16.MISSING_FLAG,
+    throw new CliError19({
+      code: CliErrorCode18.MISSING_FLAG,
       message: "\u672A\u89E3\u6790\u5230 endpoint \u2014\u2014 \u4F20 --endpoint <url>\uFF0C\u6216\u5148 `hcm env add <name> --endpoint <url>`"
     });
   }
@@ -6042,8 +6631,8 @@ async function resolveEndpoint2(args) {
 async function tenantBootstrapCommand(args) {
   try {
     if (!args.tenantId || !args.adminUsername) {
-      throw new CliError17({
-        code: CliErrorCode16.MISSING_FLAG,
+      throw new CliError19({
+        code: CliErrorCode18.MISSING_FLAG,
         message: "--tenant-id \u4E0E --admin-username \u5FC5\u586B"
       });
     }
@@ -6079,7 +6668,7 @@ async function tenantBootstrapCommand(args) {
 `
       );
     }
-    process.stdout.write(formatObject14(result2, { format: fmt }) + "\n");
+    process.stdout.write(formatObject15(result2, { format: fmt }) + "\n");
     process.exit(0);
   } catch (e) {
     const err = e;
@@ -6094,17 +6683,17 @@ async function tenantBootstrapCommand(args) {
 }
 
 // src/commands/meta.ts
-import { promises as fsp2 } from "fs";
+import { promises as fsp3 } from "fs";
 import {
   HcmClient as HcmClient15,
-  formatObject as formatObject15,
+  formatObject as formatObject16,
   fromAxiosError as fromAxiosError15,
   listTenantMeta,
   getTenantMeta,
   saveTenantMeta,
   deleteTenantMeta,
-  CliError as CliError18,
-  CliErrorCode as CliErrorCode17
+  CliError as CliError20,
+  CliErrorCode as CliErrorCode19
 } from "@hcmai/sdk";
 init_exit();
 init_auth_guard();
@@ -6134,27 +6723,27 @@ async function metaListCommand(args) {
     const fmt = args.output ?? "json";
     if (fmt !== "json") process.stdout.write(`\u{1F4C4} ${items.length} \u4EFD${total ? ` / \u5171 ${total}` : ""}
 `);
-    process.stdout.write(formatObject15(items, { format: fmt }) + "\n");
+    process.stdout.write(formatObject16(items, { format: fmt }) + "\n");
     process.exit(0);
   } catch (e) {
     fail4(e, args);
   }
 }
-async function metaGetCommand(path7, args) {
+async function metaGetCommand(path9, args) {
   try {
     const c = await client2(args);
-    const content = await getTenantMeta(c.raw(), path7);
+    const content = await getTenantMeta(c.raw(), path9);
     process.stdout.write(content.endsWith("\n") ? content : content + "\n");
     process.exit(0);
   } catch (e) {
     fail4(e, args);
   }
 }
-async function metaSetCommand(path7, args) {
+async function metaSetCommand(path9, args) {
   try {
     if (!args.file) {
-      throw new CliError18({
-        code: CliErrorCode17.MISSING_FLAG,
+      throw new CliError20({
+        code: CliErrorCode19.MISSING_FLAG,
         message: "--file <path> \u5FC5\u586B\uFF08\u4ECE\u6587\u4EF6\u8BFB\u53D6 meta \u539F\u6587\uFF1B\u7528 - \u8868\u793A stdin\uFF09"
       });
     }
@@ -6164,10 +6753,10 @@ async function metaSetCommand(path7, args) {
       process.stdin.on("data", (d) => buf += d);
       process.stdin.on("end", () => resolve3(buf));
       process.stdin.on("error", reject);
-    }) : await fsp2.readFile(args.file, "utf8");
+    }) : await fsp3.readFile(args.file, "utf8");
     if (args.dryRun) {
       process.stdout.write(
-        `[dry-run] \u5C06\u5199\u5165 ${path7}\uFF08${Buffer.byteLength(content)} B\uFF09\u2014\u2014\u672A\u5B9E\u9645\u5199\u5165
+        `[dry-run] \u5C06\u5199\u5165 ${path9}\uFF08${Buffer.byteLength(content)} B\uFF09\u2014\u2014\u672A\u5B9E\u9645\u5199\u5165
 ---
 ${content}
 `
@@ -6175,35 +6764,35 @@ ${content}
       process.exit(0);
     }
     const c = await client2(args);
-    const result2 = await saveTenantMeta(c.raw(), path7, content);
+    const result2 = await saveTenantMeta(c.raw(), path9, content);
     const fmt = args.output ?? "json";
     if (fmt !== "json") {
-      process.stdout.write(`\u2705 \u5DF2\u5199\u5165 ${path7}
+      process.stdout.write(`\u2705 \u5DF2\u5199\u5165 ${path9}
    \u8BB0\u5F97\u6E05\u7F13\u5B58\uFF1Ahcm cache clear-meta <Model>
 `);
     }
-    process.stdout.write(formatObject15(result2, { format: fmt }) + "\n");
+    process.stdout.write(formatObject16(result2, { format: fmt }) + "\n");
     process.exit(0);
   } catch (e) {
     if (e?.code === "ENOENT") exitWithError(new Error(`\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${args.file}`));
     fail4(e, args);
   }
 }
-async function metaDeleteCommand(path7, args) {
+async function metaDeleteCommand(path9, args) {
   try {
     if (!args.yes) {
-      const ok = await promptConfirm(`\u5C06\u5220\u9664\u5143\u6570\u636E ${path7}\uFF0C\u6B64\u64CD\u4F5C\u4E0D\u53EF\u9006\u3002\u7EE7\u7EED\uFF1F`);
+      const ok = await promptConfirm(`\u5C06\u5220\u9664\u5143\u6570\u636E ${path9}\uFF0C\u6B64\u64CD\u4F5C\u4E0D\u53EF\u9006\u3002\u7EE7\u7EED\uFF1F`);
       if (!ok) {
         process.stderr.write("\u5DF2\u53D6\u6D88\n");
         process.exit(1);
       }
     }
     const c = await client2(args);
-    const result2 = await deleteTenantMeta(c.raw(), path7);
+    const result2 = await deleteTenantMeta(c.raw(), path9);
     const fmt = args.output ?? "json";
-    if (fmt !== "json") process.stdout.write(`\u{1F5D1}\uFE0F  \u5DF2\u5220\u9664 ${path7}
+    if (fmt !== "json") process.stdout.write(`\u{1F5D1}\uFE0F  \u5DF2\u5220\u9664 ${path9}
 `);
-    process.stdout.write(formatObject15(result2, { format: fmt }) + "\n");
+    process.stdout.write(formatObject16(result2, { format: fmt }) + "\n");
     process.exit(0);
   } catch (e) {
     fail4(e, args);
@@ -6215,14 +6804,14 @@ init_exit();
 init_auth_guard();
 import * as crypto from "crypto";
 import * as fs7 from "fs/promises";
-import * as path5 from "path";
+import * as path7 from "path";
 import {
   buildMiniPreviewTargets,
   buildMiniVerifyAgentReport,
   createWorkspaceFile,
   deleteWorkspaceFile,
   formatMiniVerifyReport,
-  formatObject as formatObject16,
+  formatObject as formatObject17,
   formatRows as formatRows5,
   getMiniStatus,
   HcmClient as HcmClient16,
@@ -6432,7 +7021,7 @@ async function workspacePullCommand(args) {
         http: client3.raw(),
         appCode,
         workspaceKey,
-        targetDir: path5.join(rootDir, MINI_APPS_DIR, appCode),
+        targetDir: path7.join(rootDir, MINI_APPS_DIR, appCode),
         tenantId: client3.tenantId,
         endpoint: client3.endpoint,
         profile: args.profile ?? client3.profile,
@@ -6447,7 +7036,7 @@ async function workspacePullCommand(args) {
     const rawRemoteByLocalPath = /* @__PURE__ */ new Map();
     for (const file of rawFiles) {
       const content = await loadWorkspaceFileContent(client3.raw(), file.id);
-      const target = path5.join(rootDir, content.relativePath);
+      const target = path7.join(rootDir, content.relativePath);
       await writeTextFile(target, content.content, !!args.force);
       pulledRawFiles.push(content.relativePath);
       rawRemoteByLocalPath.set(content.relativePath, file);
@@ -6497,7 +7086,7 @@ async function workspaceAddMiniCommand(appCode, args) {
     const result2 = await initMiniAppProject({
       appCode,
       workspaceKey: context.workspaceKey,
-      targetDir: path5.join(rootDir, MINI_APPS_DIR, appCode),
+      targetDir: path7.join(rootDir, MINI_APPS_DIR, appCode),
       name: args.name,
       defaultSurface: parseSurface(args.surface),
       templateKind,
@@ -6551,7 +7140,7 @@ async function workspaceStatusCommand(args) {
     }
     if (args.output === "json" || args.output === "yaml") {
       process.stdout.write(
-        formatObject16({ rootDir, miniApps: rows }, { format: args.output }) + "\n"
+        formatObject17({ rootDir, miniApps: rows }, { format: args.output }) + "\n"
       );
     } else {
       process.stdout.write(formatRows5(rows, { format: "table" }) + "\n");
@@ -6627,7 +7216,7 @@ async function workspacePreviewCommand(args) {
       );
     }
     if (args.output === "json" || args.output === "yaml") {
-      process.stdout.write(formatObject16(rows, { format: args.output }) + "\n");
+      process.stdout.write(formatObject17(rows, { format: args.output }) + "\n");
     } else {
       process.stdout.write(formatRows5(rows, { format: "table" }) + "\n");
     }
@@ -6738,7 +7327,7 @@ function removedMiniCommand() {
   );
 }
 function resolveRootDir(dir) {
-  return path5.resolve(dir ?? ".");
+  return path7.resolve(dir ?? ".");
 }
 function buildWorkspaceContext(args) {
   return {
@@ -6754,7 +7343,7 @@ function buildWorkspaceContext(args) {
 async function readWorkspaceContext(rootDir) {
   try {
     const parsed = JSON.parse(
-      await fs7.readFile(path5.join(rootDir, WORKSPACE_CONTEXT_FILE), "utf-8")
+      await fs7.readFile(path7.join(rootDir, WORKSPACE_CONTEXT_FILE), "utf-8")
     );
     if (parsed.kind !== WORKSPACE_CONTEXT_KIND || parsed.version !== WORKSPACE_CONTEXT_VERSION) {
       throw new Error(`${WORKSPACE_CONTEXT_FILE} is not an HCM workspace context`);
@@ -6784,7 +7373,7 @@ async function requireWorkspaceContext(rootDir) {
 }
 async function writeWorkspaceContext(rootDir, context) {
   await fs7.writeFile(
-    path5.join(rootDir, WORKSPACE_CONTEXT_FILE),
+    path7.join(rootDir, WORKSPACE_CONTEXT_FILE),
     JSON.stringify(context, null, 2) + "\n"
   );
 }
@@ -6795,13 +7384,13 @@ async function writeTextFile(file, content, force) {
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
-  await fs7.mkdir(path5.dirname(file), { recursive: true });
+  await fs7.mkdir(path7.dirname(file), { recursive: true });
   await fs7.writeFile(file, content);
 }
 async function readWorkspaceRawManifest(rootDir, context) {
   try {
     const parsed = JSON.parse(
-      await fs7.readFile(path5.join(rootDir, WORKSPACE_STATE_DIR, WORKSPACE_PULL_MANIFEST_FILE), "utf-8")
+      await fs7.readFile(path7.join(rootDir, WORKSPACE_STATE_DIR, WORKSPACE_PULL_MANIFEST_FILE), "utf-8")
     );
     if (parsed.version !== WORKSPACE_CONTEXT_VERSION || parsed.workspaceKey !== context.workspaceKey) {
       throw new Error(`${WORKSPACE_PULL_MANIFEST_FILE} does not match workspace ${context.workspaceKey}`);
@@ -6819,7 +7408,7 @@ async function readWorkspaceRawManifest(rootDir, context) {
   }
 }
 async function writeWorkspaceRawState(rootDir, context, files, remoteByLocalPath) {
-  const stateDir = path5.join(rootDir, WORKSPACE_STATE_DIR);
+  const stateDir = path7.join(rootDir, WORKSPACE_STATE_DIR);
   await fs7.mkdir(stateDir, { recursive: true });
   const snapshots = files.map((file) => ({
     localPath: file.localPath,
@@ -6830,7 +7419,7 @@ async function writeWorkspaceRawState(rootDir, context, files, remoteByLocalPath
     lastModified: remoteByLocalPath.get(file.localPath)?.lastModified
   }));
   await fs7.writeFile(
-    path5.join(stateDir, WORKSPACE_PULL_MANIFEST_FILE),
+    path7.join(stateDir, WORKSPACE_PULL_MANIFEST_FILE),
     JSON.stringify(
       {
         version: WORKSPACE_CONTEXT_VERSION,
@@ -6852,7 +7441,7 @@ async function readWorkspaceRawLocalFiles(rootDir) {
   return files;
 }
 async function walkWorkspaceRawFiles(rootDir, relativeDir, files) {
-  const absoluteDir = path5.join(rootDir, relativeDir);
+  const absoluteDir = path7.join(rootDir, relativeDir);
   let entries;
   try {
     entries = await fs7.readdir(absoluteDir, { withFileTypes: true });
@@ -6863,8 +7452,8 @@ async function walkWorkspaceRawFiles(rootDir, relativeDir, files) {
   for (const entry of entries) {
     if (entry.isDirectory() && RAW_WORKSPACE_EXCLUDED_DIRS.has(entry.name)) continue;
     if (entry.isFile() && RAW_WORKSPACE_EXCLUDED_FILES.has(entry.name)) continue;
-    const localPath = normalizeRelativePath(path5.posix.join(toPosix(relativeDir), entry.name));
-    const absolutePath = path5.join(rootDir, localPath);
+    const localPath = normalizeRelativePath(path7.posix.join(toPosix(relativeDir), entry.name));
+    const absolutePath = path7.join(rootDir, localPath);
     if (entry.isDirectory()) {
       await walkWorkspaceRawFiles(rootDir, localPath, files);
       continue;
@@ -6875,7 +7464,7 @@ async function walkWorkspaceRawFiles(rootDir, relativeDir, files) {
       localPath,
       absolutePath,
       content,
-      sha256: sha2564(content),
+      sha256: sha2565(content),
       size: Buffer.byteLength(content, "utf-8")
     });
   }
@@ -6942,7 +7531,7 @@ function buildWorkspaceRawPushPlan(manifest2, localFiles, remoteFiles) {
   for (const entry of status) {
     const remote = remoteByLocal.get(entry.localPath);
     const base = baseByLocal.get(entry.localPath);
-    const remoteSha = remote ? sha2564(remote.content) : void 0;
+    const remoteSha = remote ? sha2565(remote.content) : void 0;
     if (entry.status === "added") {
       if (remote) {
         conflicts.push(workspaceRawConflict(entry, "remote file already exists but was not in local snapshot"));
@@ -7044,7 +7633,7 @@ function workspaceRawConflict(entry, reason) {
   };
 }
 async function discoverMiniApps(rootDir) {
-  const appsRoot = path5.join(rootDir, MINI_APPS_DIR);
+  const appsRoot = path7.join(rootDir, MINI_APPS_DIR);
   let entries;
   try {
     entries = await fs7.readdir(appsRoot, { withFileTypes: true });
@@ -7052,7 +7641,7 @@ async function discoverMiniApps(rootDir) {
     if (e.code === "ENOENT") return [];
     throw e;
   }
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => ({ appCode: entry.name, dir: path5.join(appsRoot, entry.name) })).sort((a, b) => a.appCode.localeCompare(b.appCode));
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => ({ appCode: entry.name, dir: path7.join(appsRoot, entry.name) })).sort((a, b) => a.appCode.localeCompare(b.appCode));
 }
 function detectRemoteMiniApps(files) {
   const appCodes = /* @__PURE__ */ new Set();
@@ -7205,9 +7794,9 @@ function normalizeRelativePath(value) {
   return normalized;
 }
 function toPosix(value) {
-  return value.split(path5.sep).join("/");
+  return value.split(path7.sep).join("/");
 }
-function sha2564(content) {
+function sha2565(content) {
   return crypto.createHash("sha256").update(content, "utf-8").digest("hex");
 }
 function stringRequired(value, field) {
@@ -7233,7 +7822,7 @@ function optionalText(value) {
 }
 function writeWorkspaceListResult(rows, format, total) {
   if (format !== "table") {
-    process.stdout.write(formatObject16({ rows, total }, { format }) + "\n");
+    process.stdout.write(formatObject17({ rows, total }, { format }) + "\n");
     return;
   }
   process.stdout.write(formatRows5(toWorkspaceListRows(rows), { format: "table" }) + "\n");
@@ -7244,7 +7833,7 @@ function writeWorkspaceListResult(rows, format, total) {
 }
 function writeWorkspaceActiveResult(view, format) {
   if (format !== "table") {
-    process.stdout.write(formatObject16(view, { format }) + "\n");
+    process.stdout.write(formatObject17(view, { format }) + "\n");
     return;
   }
   const rows = [
@@ -7262,7 +7851,7 @@ function writeWorkspaceActiveResult(view, format) {
 }
 function writeWorkspaceBindResult(context, rootDir, format) {
   if (format !== "table") {
-    process.stdout.write(formatObject16({ ...context, rootDir }, { format }) + "\n");
+    process.stdout.write(formatObject17({ ...context, rootDir }, { format }) + "\n");
     return;
   }
   process.stdout.write(
@@ -7276,7 +7865,7 @@ function writeWorkspaceBindResult(context, rootDir, format) {
 }
 function writeWorkspaceCreateResult(result2, format) {
   if (format !== "table") {
-    process.stdout.write(formatObject16(result2, { format }) + "\n");
+    process.stdout.write(formatObject17(result2, { format }) + "\n");
     return;
   }
   process.stdout.write(
@@ -7292,7 +7881,7 @@ function writeWorkspaceCreateResult(result2, format) {
 }
 function writeWorkspacePullResult(result2, format) {
   if (format !== "table") {
-    process.stdout.write(formatObject16(result2, { format }) + "\n");
+    process.stdout.write(formatObject17(result2, { format }) + "\n");
     return;
   }
   const lines = [
@@ -7310,7 +7899,7 @@ function writeWorkspacePullResult(result2, format) {
 }
 function writeWorkspaceAddMiniResult(result2, rootDir, format) {
   if (format !== "table") {
-    process.stdout.write(formatObject16({ ...result2, workspaceRoot: rootDir }, { format }) + "\n");
+    process.stdout.write(formatObject17({ ...result2, workspaceRoot: rootDir }, { format }) + "\n");
     return;
   }
   process.stdout.write(
@@ -7326,7 +7915,7 @@ function writeWorkspaceAddMiniResult(result2, rootDir, format) {
 function writeWorkspaceValidateResult(results, format) {
   if (format !== "table") {
     process.stdout.write(
-      formatObject16(
+      formatObject17(
         results.map((item) => ({ artifact: `mini:${item.app.appCode}`, ...item.result })),
         { format }
       ) + "\n"
@@ -7354,7 +7943,7 @@ mini:${item.app.appCode}
 function writeWorkspacePushResult(rawResult, results, format) {
   if (format !== "table") {
     process.stdout.write(
-      formatObject16(
+      formatObject17(
         {
           workspaceFiles: { artifact: "workspace", ...rawResult },
           miniApps: results.map((item) => ({ artifact: `mini:${item.app.appCode}`, ...item.result }))
@@ -7410,7 +7999,7 @@ function writeWorkspaceVerifyResult(context, rootDir, raw, reports, format) {
   const ok = rawOk && reports.every((item) => item.report.ok);
   if (format === "json") {
     process.stdout.write(
-      formatObject16(
+      formatObject17(
         {
           ok,
           workspaceKey: context.workspaceKey,
@@ -7437,7 +8026,7 @@ function writeWorkspaceVerifyResult(context, rootDir, raw, reports, format) {
   }
   if (format !== "table") {
     process.stdout.write(
-      formatObject16(
+      formatObject17(
         {
           ok,
           workspaceKey: context.workspaceKey,
@@ -7504,8 +8093,8 @@ import {
   deleteIdentity as deleteIdentity2,
   loadGlobalConfig as loadGlobalConfig8,
   TokenStore as TokenStore3,
-  CliError as CliError19,
-  CliErrorCode as CliErrorCode18
+  CliError as CliError21,
+  CliErrorCode as CliErrorCode20
 } from "@hcmai/sdk";
 async function identityList(args) {
   try {
@@ -7533,8 +8122,8 @@ async function identityUse(name) {
   try {
     const meta2 = await loadIdentity4(name);
     const env2 = await loadEnv7(meta2.env).catch(() => {
-      throw new CliError19({
-        code: CliErrorCode18.IDENTITY_NOT_IN_ENV,
+      throw new CliError21({
+        code: CliErrorCode20.IDENTITY_NOT_IN_ENV,
         message: `identity '${name}' references env '${meta2.env}' which no longer exists. Re-create the env, or remove this orphan: hcm identity remove ${name}`
       });
     });
@@ -7568,9 +8157,15 @@ async function identityRemove(name) {
   }
 }
 
+// src/commands/delivery-action-policy.ts
+init_auth_guard();
+import {
+  HcmClient as HcmClient17,
+  formatObject as formatObject18
+} from "@hcmai/sdk";
+
 // src/commands/delivery.ts
-import { createHash as createHash5 } from "crypto";
-import { formatObject as formatObject17 } from "@hcmai/sdk";
+import { createHash as createHash6 } from "crypto";
 var APPROVAL_BYPASS_FLAGS = /* @__PURE__ */ new Set(["-y", "--yes", "--force", "--auto-approve"]);
 var CREDENTIAL_FLAGS = /* @__PURE__ */ new Set([
   "--password",
@@ -7587,11 +8182,12 @@ var GUARDED_EXECUTOR_REASON_CODES = /* @__PURE__ */ new Set([
   "record-update",
   "cache-mutation",
   "setting-write",
-  "credential-reset"
+  "credential-reset",
+  "action-write"
 ]);
-function assessDeliveryCommand(inputArgv) {
+function assessDeliveryCommand(inputArgv, options = {}) {
   const argv = inputArgv[0] === "--" ? inputArgv.slice(1) : [...inputArgv];
-  const commandSha256 = sha2565(JSON.stringify(argv));
+  const commandSha256 = sha2566(JSON.stringify(argv));
   const name = argv[0] ?? "";
   const subcommand = argv[1] && !argv[1].startsWith("-") ? argv[1] : void 0;
   const envAlias = flagValue(argv, "--env");
@@ -7599,8 +8195,8 @@ function assessDeliveryCommand(inputArgv) {
   const sensitiveFlags = [
     ...new Set([...PAYLOAD_FLAGS, ...CREDENTIAL_FLAGS].filter((flag) => hasFlag(argv, flag)))
   ];
-  const target = summarizeTarget(argv);
-  let classification = classify(argv);
+  const target = summarizeTarget(argv, options.actionResolution);
+  let classification = classify(argv, options.actionResolution);
   const invalidPayload = payloadError(argv);
   if (invalidPayload) {
     classification = forbidden("invalid-input", "JSON payload \u65E0\u6548\uFF0C\u4E0D\u80FD\u8FDB\u5165\u4EFB\u4F55\u6267\u884C\u8DEF\u5F84\u3002");
@@ -7621,8 +8217,8 @@ function assessDeliveryCommand(inputArgv) {
   const allowed = classification.risk === "R0" || classification.risk === "R1";
   return {
     schemaVersion: 1,
-    contractVersion: "2026-08-28",
-    assessmentId: sha2565(`2026-08-28
+    contractVersion: "2026-08-29",
+    assessmentId: sha2566(`2026-08-29
 ${commandSha256}`).slice(0, 24),
     commandSha256,
     command: { name: name || "(empty)", ...subcommand ? { subcommand } : {} },
@@ -7642,11 +8238,7 @@ ${commandSha256}`).slice(0, 24),
     }
   };
 }
-function deliveryAssessCommand(argv, args) {
-  const assessment = assessDeliveryCommand(argv);
-  process.stdout.write(formatObject17(assessment, { format: args.output ?? "json" }) + "\n");
-}
-function classify(argv) {
+function classify(argv, actionResolution) {
   const name = argv[0] ?? "";
   const subcommand = argv[1] ?? "";
   if (argv.some((arg) => APPROVAL_BYPASS_FLAGS.has(flagName(arg)))) {
@@ -7747,9 +8339,15 @@ function classify(argv) {
   if (name === "upload") return guarded("tenant-write", "document-upload");
   if (name === "download") return direct("R1", "managed-local-write", "document-download");
   if (name === "action") {
+    if (actionResolution?.status === "resolved") {
+      return classifyAction(actionResolution.policy);
+    }
+    if (actionResolution?.status === "failed") {
+      return forbidden(actionResolution.reasonCode, actionResolution.reason);
+    }
     return forbidden(
       "action-effect-unclassified",
-      "Action \u5C1A\u65E0\u7EDF\u4E00 destructive/publish \u8BED\u4E49\uFF0C\u9996\u7248\u4E0D\u80FD\u6309\u540D\u79F0\u731C\u6D4B\u540E\u653E\u884C\u3002"
+      "\u5C1A\u672A\u8BFB\u53D6 Core Action \u98CE\u63A7\u58F0\u660E\uFF0C\u4E0D\u80FD\u6309\u540D\u79F0\u731C\u6D4B\u540E\u653E\u884C\u3002"
     );
   }
   if (name === "delete" || name === "meta" && subcommand === "delete") {
@@ -7766,14 +8364,19 @@ function classify(argv) {
   }
   return forbidden("unknown-command", "\u672A\u77E5\u547D\u4EE4\u6309\u6700\u9AD8\u98CE\u9669\u5173\u95ED\u3002");
 }
-function summarizeTarget(argv) {
+function summarizeTarget(argv, actionResolution) {
   const name = argv[0] ?? "";
   const subcommand = argv[1] ?? "";
   const target = {};
   if (["query", "describe", "create", "update", "delete"].includes(name) && subcommand) {
     target.model = subcommand;
   }
-  if (name === "action" && subcommand) target.action = subcommand;
+  if (name === "action" && subcommand) {
+    target.action = subcommand;
+    if (actionResolution?.status === "resolved") {
+      target.actionPolicy = { ...actionResolution.policy };
+    }
+  }
   if (name === "skills" && argv[2] && !argv[2].startsWith("-")) target.skill = argv[2];
   if (name === "meta" && argv[2] && !argv[2].startsWith("-")) target.path = argv[2];
   if (name === "cache" && argv[2] && !argv[2].startsWith("-")) {
@@ -7787,17 +8390,17 @@ function summarizeTarget(argv) {
   }
   const id = flagValue(argv, "--id");
   if (name === "user" && subcommand === "reset-password") {
-    if (id) target.userIdSha256 = sha2565(id);
+    if (id) target.userIdSha256 = sha2566(id);
     const username = flagValue(argv, "--username");
-    if (username) target.usernameSha256 = sha2565(username);
+    if (username) target.usernameSha256 = sha2566(username);
     target.forceChangeOnNextLogin = !hasFlag(argv, "--no-force-change");
   } else if (id) {
-    target.recordIdSha256 = sha2565(id);
+    target.recordIdSha256 = sha2566(id);
   }
   for (const flag of PAYLOAD_FLAGS) {
     const raw = flagValue(argv, flag);
     if (!raw) continue;
-    target.payloadSha256 = sha2565(raw);
+    target.payloadSha256 = sha2566(raw);
     try {
       const parsed = JSON.parse(raw);
       if (isPlainObject(parsed)) target.fieldNames = Object.keys(parsed).sort();
@@ -7837,6 +8440,18 @@ function guarded(effect, reasonCode) {
     reason: "\u666E\u901A\u526F\u4F5C\u7528\u64CD\u4F5C\uFF1B\u53EA\u5141\u8BB8\u5728 controlled \u9879\u76EE\u4E2D\u901A\u8FC7 delivery prepare + delivery execute \u5355\u6B21\u53D7\u63A7\u6267\u884C\u3002"
   };
 }
+function classifyAction(policy) {
+  if (policy.readOnly) {
+    return {
+      risk: "R1",
+      execution: "direct",
+      effect: "remote-read",
+      reasonCode: "action-read-only",
+      reason: "Core \u58F0\u660E\u8BE5 Action \u4E3A\u53EA\u8BFB\uFF0C\u4E0E Moirai \u7684\u53EA\u8BFB Action \u8DEF\u5F84\u4E00\u81F4\uFF0C\u53EF\u76F4\u63A5\u6267\u884C\u3002"
+    };
+  }
+  return guarded("tenant-write", "action-write");
+}
 function forbidden(reasonCode, reason) {
   return { risk: "R3", execution: "forbidden", effect: reasonCode, reasonCode, reason };
 }
@@ -7882,19 +8497,159 @@ function valuesAfterFlag(argv, flag) {
   }
   return values;
 }
-function sha2565(value) {
-  return createHash5("sha256").update(value).digest("hex");
+function sha2566(value) {
+  return createHash6("sha256").update(value).digest("hex");
 }
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/commands/delivery-action-policy.ts
+async function assessEffectiveDeliveryCommand(inputArgv, dependencies = {}) {
+  const local = assessDeliveryCommand(inputArgv);
+  if (local.reasonCode !== "action-effect-unclassified") return local;
+  const request = parseActionRequest(inputArgv);
+  if ("status" in request) {
+    return assessDeliveryCommand(inputArgv, { actionResolution: request });
+  }
+  const resolution = await (dependencies.resolveAction ?? resolveCoreAction)(request);
+  return assessDeliveryCommand(inputArgv, { actionResolution: resolution });
+}
+async function deliveryAssessCommand(argv, args) {
+  const assessment = await assessEffectiveDeliveryCommand(argv);
+  process.stdout.write(formatObject18(assessment, { format: args.output ?? "json" }) + "\n");
+}
+async function resolveCoreAction(request) {
+  try {
+    const auth = await getActiveAuthContextFromCli({
+      env: request.env,
+      as: request.identity,
+      profile: request.profile
+    });
+    const description = await HcmClient17.fromAuthContext(auth).describe(request.model);
+    const matches = description.actions.filter((action2) => matchesRequest(action2, request));
+    if (matches.length === 0) {
+      return failed(
+        "action-metadata-not-found",
+        "Core \u5143\u6570\u636E\u4E2D\u6CA1\u6709\u4E0E\u672C\u6B21 method/scope \u7CBE\u786E\u5339\u914D\u7684 Action\uFF0C\u62D2\u7EDD\u6267\u884C\u3002"
+      );
+    }
+    if (matches.length > 1) {
+      return failed(
+        "action-metadata-ambiguous",
+        "Core \u5143\u6570\u636E\u5B58\u5728\u591A\u4E2A\u4E0E\u672C\u6B21 method/scope \u5339\u914D\u7684 Action\uFF0C\u65E0\u6CD5\u552F\u4E00\u5224\u5B9A\uFF0C\u62D2\u7EDD\u6267\u884C\u3002"
+      );
+    }
+    const action = matches[0];
+    if (typeof action.readOnly !== "boolean") {
+      return failed(
+        "action-readonly-unclassified",
+        "Core \u672A\u8FD4\u56DE Action \u7684 readOnly \u58F0\u660E\uFF0C\u6309\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD\u6267\u884C\u3002"
+      );
+    }
+    return {
+      status: "resolved",
+      policy: {
+        scope: action.scope,
+        httpMethod: action.httpMethod.toUpperCase(),
+        readOnly: action.readOnly,
+        ...action.source ? { source: action.source } : {}
+      }
+    };
+  } catch {
+    return failed(
+      "action-metadata-unavailable",
+      "\u65E0\u6CD5\u8BFB\u53D6 Core Action \u5143\u6570\u636E\uFF0C\u6309\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD\u6267\u884C\u3002"
+    );
+  }
+}
+function matchesRequest(action, request) {
+  return action.name === request.action && action.httpMethod?.toUpperCase() === request.httpMethod && action.scope?.toLowerCase() === request.scope;
+}
+function parseActionRequest(inputArgv) {
+  const argv = inputArgv[0] === "--" ? inputArgv.slice(1) : [...inputArgv];
+  const spec = argv[1] ?? "";
+  const separator = spec.indexOf(".");
+  if (separator <= 0 || separator === spec.length - 1) {
+    return failed("invalid-action-spec", "Action \u5FC5\u987B\u4F7F\u7528 <Model>.<Action> \u683C\u5F0F\u3002");
+  }
+  const httpMethod = (flagValue2(argv, "--method") ?? "POST").toUpperCase();
+  if (!["GET", "POST", "PUT", "DELETE"].includes(httpMethod)) {
+    return failed("invalid-action-method", "Action method \u5FC5\u987B\u662F GET\u3001POST\u3001PUT \u6216 DELETE\u3002");
+  }
+  const explicitScope = flagValue2(argv, "--scope");
+  const scope = explicitScope ?? (flagValue2(argv, "--id") ? "object" : "class");
+  if (scope !== "class" && scope !== "object") {
+    return failed("invalid-action-scope", "Action scope \u5FC5\u987B\u662F class \u6216 object\u3002");
+  }
+  return {
+    model: spec.slice(0, separator),
+    action: spec.slice(separator + 1),
+    httpMethod,
+    scope,
+    env: flagValue2(argv, "--env"),
+    identity: flagValue2(argv, "--as"),
+    profile: flagValue2(argv, "--profile")
+  };
+}
+function failed(reasonCode, reason) {
+  return { status: "failed", reasonCode, reason };
+}
+function flagValue2(argv, flag) {
+  const equals = argv.find((arg) => arg.startsWith(`${flag}=`));
+  if (equals) return equals.slice(flag.length + 1);
+  const index = argv.indexOf(flag);
+  return index >= 0 ? argv[index + 1] : void 0;
+}
+
+// src/commands/delivery-doctor.ts
+init_auth_guard();
+init_exit();
+import {
+  HcmClient as HcmClient18,
+  fetchReconIdentity,
+  formatObject as formatObject19,
+  fromAxiosError as fromAxiosError17,
+  httpProbe,
+  runDoctor
+} from "@hcmai/sdk";
+var DEFAULT_CAPABILITIES = "default";
+function render2(report) {
+  const lines = [];
+  for (const c of report.checks) {
+    lines.push(`${c.ok ? "\u2705" : "\u274C"} ${c.anchor.padEnd(13)} ${c.detail}`);
+  }
+  lines.push("");
+  lines.push(
+    report.ok ? "\u56DB\u6761\u951A\u70B9\u5168\u7EFF\uFF1A\u53EF\u4EE5\u5F00\u59CB recon\u3002" : "\u6709\u951A\u70B9\u6CA1\u8FC7\u2014\u2014\u5148\u6309\u4E0A\u9762\u5404\u6761\u7684\u4E0B\u4E00\u6B65\u5904\u7406\uFF0C\u4E0D\u8981\u5728\u8FD9\u4E2A\u72B6\u6001\u4E0A\u722C\u57FA\u7EBF\u3002"
+  );
+  return lines.join("\n");
+}
+async function deliveryDoctorCommand(args) {
+  try {
+    const ctx = await getActiveAuthContextFromCli(args);
+    const client3 = HcmClient18.fromAuthContext(ctx);
+    const probe = httpProbe(client3.raw(), args.capabilities ?? DEFAULT_CAPABILITIES);
+    const identity2 = await fetchReconIdentity(probe, ctx.tenantId);
+    const report = await runDoctor(probe, identity2);
+    const fmt = args.output ?? "json";
+    if (fmt !== "json") process.stdout.write(render2(report) + "\n");
+    process.stdout.write(formatObject19(report, { format: fmt }) + "\n");
+    process.exit(report.ok ? 0 : 1);
+  } catch (e) {
+    const err = e;
+    if (err?.isAxiosError) exitWithError(fromAxiosError17(err, args.env));
+    exitWithError(e);
+    process.exit(1);
+  }
+}
+
 // src/commands/delivery-execution.ts
-import { createHash as createHash6, randomBytes as secureRandomBytes } from "crypto";
+import { createHash as createHash7, randomBytes as secureRandomBytes } from "crypto";
 import { spawn } from "child_process";
 import { createReadStream as createReadStream2, promises as fs8 } from "fs";
-import path6 from "path";
-import { CliError as CliError20, CliErrorCode as CliErrorCode19, formatObject as formatObject18 } from "@hcmai/sdk";
+import path8 from "path";
+import { CliError as CliError22, CliErrorCode as CliErrorCode21, formatObject as formatObject20 } from "@hcmai/sdk";
 init_exit();
 var EXECUTION_CONTRACT_VERSION = "2026-08-28.controlled-v1";
 var DEFAULT_TTL_SECONDS = 15 * 60;
@@ -7904,7 +8659,7 @@ var PLAN_ID_PATTERN = /^[a-f0-9]{24}$/;
 async function prepareDeliveryExecution(input) {
   const project = await realProject(input.project);
   await readProjectMode(project);
-  const assessment = assessDeliveryCommand(input.argv);
+  const assessment = await (input.assessCommand ?? assessEffectiveDeliveryCommand)(input.argv);
   assertGuardedAssessment(assessment, input.argv);
   const ttlSeconds = input.ttlSeconds ?? DEFAULT_TTL_SECONDS;
   if (!Number.isInteger(ttlSeconds) || ttlSeconds < MIN_TTL_SECONDS || ttlSeconds > MAX_TTL_SECONDS) {
@@ -7921,20 +8676,20 @@ async function prepareDeliveryExecution(input) {
   const core = {
     schemaVersion: 1,
     contractVersion: EXECUTION_CONTRACT_VERSION,
-    nonceSha256: sha2566((input.randomBytes ?? secureRandomBytes)(12)),
+    nonceSha256: sha2567((input.randomBytes ?? secureRandomBytes)(12)),
     createdAt: created.toISOString(),
     expiresAt: new Date(created.getTime() + ttlSeconds * 1e3).toISOString(),
-    chironLockSha256: sha2566(lockBytes),
+    chironLockSha256: sha2567(lockBytes),
     runtime,
     assessment,
     documents: { change, rollback },
     evidenceDir: evidence.relative
   };
-  const planId = sha2566(canonicalJson(core)).slice(0, 24);
+  const planId = sha2567(canonicalJson(core)).slice(0, 24);
   const plan = { ...core, planId };
-  const plansDir = path6.join(project, ".hcm-delivery", "execution-plans");
+  const plansDir = path8.join(project, ".hcm-delivery", "execution-plans");
   await safeManagedDirectory(project, ".hcm-delivery/execution-plans", plansDir);
-  const planFile = path6.join(plansDir, `${planId}.json`);
+  const planFile = path8.join(plansDir, `${planId}.json`);
   try {
     await fs8.writeFile(planFile, `${JSON.stringify(plan, null, 2)}
 `, {
@@ -7953,7 +8708,7 @@ async function executeDeliveryPlan(input) {
   if (await readProjectMode(project) !== "controlled") {
     throw invalid4("\u9879\u76EE\u4E0D\u662F controlled\uFF0C\u4E0D\u80FD\u6267\u884C R2 \u8BA1\u5212");
   }
-  const planFile = path6.join(project, ".hcm-delivery", "execution-plans", `${input.planId}.json`);
+  const planFile = path8.join(project, ".hcm-delivery", "execution-plans", `${input.planId}.json`);
   const plan = await readPlan(project, planFile);
   if (plan.planId !== input.planId || computePlanId(plan) !== input.planId) {
     throw invalid4("\u6267\u884C\u8BA1\u5212\u5185\u5BB9\u4E0E planId \u6458\u8981\u4E0D\u4E00\u81F4");
@@ -7967,13 +8722,13 @@ async function executeDeliveryPlan(input) {
   }
   if (now.getTime() < createdAt - 5e3) throw invalid4("\u5F53\u524D\u65F6\u95F4\u65E9\u4E8E\u8BA1\u5212\u521B\u5EFA\u65F6\u95F4");
   if (now.getTime() > expiresAt) throw invalid4("\u6267\u884C\u8BA1\u5212\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0 prepare");
-  const assessment = assessDeliveryCommand(input.argv);
+  const assessment = await (input.assessCommand ?? assessEffectiveDeliveryCommand)(input.argv);
   assertGuardedAssessment(assessment, input.argv);
   if (canonicalJson(assessment) !== canonicalJson(plan.assessment)) {
     throw invalid4("\u5B9E\u9645 argv \u4E0E\u6267\u884C\u8BA1\u5212\u7684\u547D\u4EE4\u6458\u8981\u6216\u98CE\u9669\u4E8B\u5B9E\u4E0D\u4E00\u81F4");
   }
   const { bytes: lockBytes, runtime: lockedRuntime } = await readChironLock(project);
-  if (sha2566(lockBytes) !== plan.chironLockSha256) {
+  if (sha2567(lockBytes) !== plan.chironLockSha256) {
     throw invalid4("Chiron \u9501\u6458\u8981\u5DF2\u6F02\u79FB\uFF0C\u8BF7\u91CD\u65B0\u8BC4\u4F30\u5E76 prepare");
   }
   const runtime = await (input.runtimeIdentity ?? currentRuntimeIdentity)();
@@ -7984,11 +8739,11 @@ async function executeDeliveryPlan(input) {
   await assertDocumentUnchanged(project, plan.documents.change, "\u53D8\u66F4\u8BF4\u660E");
   await assertDocumentUnchanged(project, plan.documents.rollback, "\u56DE\u6EDA\u8BF4\u660E");
   const evidenceDir = await bindEvidenceDirectory(project, plan.evidenceDir);
-  const receiptFile = path6.join(evidenceDir.absolute, `${plan.planId}.receipt.json`);
+  const receiptFile = path8.join(evidenceDir.absolute, `${plan.planId}.receipt.json`);
   if (await pathExists(receiptFile)) throw invalid4(`\u6267\u884C\u6536\u636E\u5DF2\u5B58\u5728\uFF0C\u62D2\u7EDD\u518D\u6B21\u6267\u884C\uFF1A${plan.planId}`);
-  const claimsDir = path6.join(project, ".hcm-delivery", "execution-claims");
+  const claimsDir = path8.join(project, ".hcm-delivery", "execution-claims");
   await safeManagedDirectory(project, ".hcm-delivery/execution-claims", claimsDir);
-  const claimFile = path6.join(claimsDir, `${plan.planId}.json`);
+  const claimFile = path8.join(claimsDir, `${plan.planId}.json`);
   try {
     await fs8.writeFile(
       claimFile,
@@ -7999,8 +8754,8 @@ async function executeDeliveryPlan(input) {
   } catch (cause) {
     throw invalid4(`\u6267\u884C\u8BA1\u5212\u5DF2\u6D88\u8D39\uFF0C\u62D2\u7EDD\u91CD\u590D\u6267\u884C\uFF1A${plan.planId}`, cause);
   }
-  const stdoutHash = createHash6("sha256");
-  const stderrHash = createHash6("sha256");
+  const stdoutHash = createHash7("sha256");
+  const stderrHash = createHash7("sha256");
   const run = input.runCommand ?? runCurrentCliCommand;
   let exitCode;
   try {
@@ -8047,7 +8802,7 @@ async function deliveryPrepareCommand(argv, args) {
       evidenceDir: args.evidenceDir,
       ...ttlSeconds === void 0 ? {} : { ttlSeconds }
     });
-    process.stdout.write(formatObject18(plan, { format: args.output ?? "json" }) + "\n");
+    process.stdout.write(formatObject20(plan, { format: args.output ?? "json" }) + "\n");
   } catch (cause) {
     exitWithError(cause);
   }
@@ -8059,14 +8814,14 @@ async function deliveryExecuteCommand(planId, argv, args) {
       planId,
       argv
     });
-    process.stdout.write(formatObject18(receipt, { format: args.output ?? "json" }) + "\n");
+    process.stdout.write(formatObject20(receipt, { format: args.output ?? "json" }) + "\n");
     process.exitCode = receipt.exitCode;
   } catch (cause) {
     exitWithError(cause);
   }
 }
 async function readProjectMode(project) {
-  const file = path6.join(project, ".hcm-delivery", "project.yml");
+  const file = path8.join(project, ".hcm-delivery", "project.yml");
   const content = await readSafeFile(project, file, "\u9879\u76EE\u914D\u7F6E");
   const match = content.toString("utf8").match(
     /^deliveryMode:\s*(?:"(plan-only|controlled)"|'(plan-only|controlled)'|(plan-only|controlled))\s*$/m
@@ -8078,7 +8833,7 @@ async function readProjectMode(project) {
   return mode;
 }
 async function readChironLock(project) {
-  const file = path6.join(project, ".hcm-delivery", "chiron.lock.json");
+  const file = path8.join(project, ".hcm-delivery", "chiron.lock.json");
   const bytes = await readSafeFile(project, file, "Chiron \u9501");
   let parsed;
   try {
@@ -8095,9 +8850,9 @@ async function bindDocument(project, reference, label) {
   if (!(relative2.startsWith("work/") || relative2.startsWith("decisions/"))) {
     throw invalid4(`${label}\u5FC5\u987B\u4F4D\u4E8E\u9879\u76EE work/ \u6216 decisions/ \u4E0B`);
   }
-  const file = path6.join(project, relative2);
+  const file = path8.join(project, relative2);
   const bytes = await readSafeFile(project, file, label);
-  return { path: relative2, sha256: sha2566(bytes) };
+  return { path: relative2, sha256: sha2567(bytes) };
 }
 async function assertDocumentUnchanged(project, document, label) {
   const current = await bindDocument(project, document.path, label);
@@ -8108,7 +8863,7 @@ async function bindEvidenceDirectory(project, reference) {
   if (!(relative2 === "evidence" || relative2.startsWith("evidence/"))) {
     throw invalid4("evidence \u76EE\u5F55\u5FC5\u987B\u4F4D\u4E8E\u9879\u76EE evidence/ \u4E0B");
   }
-  const absolute = path6.join(project, relative2);
+  const absolute = path8.join(project, relative2);
   await assertNoSymlinkComponents(project, relative2);
   const stat = await fs8.stat(absolute).catch((cause) => {
     throw invalid4(`evidence \u76EE\u5F55\u4E0D\u53EF\u7528\uFF1A${relative2}`, cause);
@@ -8130,7 +8885,7 @@ async function readPlan(project, file) {
 function computePlanId(plan) {
   const core = { ...plan };
   delete core.planId;
-  return sha2566(canonicalJson(core)).slice(0, 24);
+  return sha2567(canonicalJson(core)).slice(0, 24);
 }
 function assertGuardedAssessment(assessment, argv) {
   if (assessment.risk !== "R2") throw invalid4("\u53EA\u6709 R2 \u547D\u4EE4\u53EF\u4EE5\u8FDB\u5165\u53D7\u63A7\u6267\u884C\u8BA1\u5212");
@@ -8269,13 +9024,13 @@ async function writeReceiptExclusive(target, receipt) {
     });
     await fs8.link(temp, target);
   } catch (cause) {
-    throw invalid4(`\u6267\u884C\u6536\u636E\u5199\u5165\u5931\u8D25\u6216\u5DF2\u5B58\u5728\uFF1A${path6.basename(target)}`, cause);
+    throw invalid4(`\u6267\u884C\u6536\u636E\u5199\u5165\u5931\u8D25\u6216\u5DF2\u5B58\u5728\uFF1A${path8.basename(target)}`, cause);
   } finally {
     await fs8.unlink(temp).catch(() => void 0);
   }
 }
 async function safeManagedDirectory(project, relative2, absolute) {
-  await assertNoSymlinkComponents(project, path6.dirname(relative2));
+  await assertNoSymlinkComponents(project, path8.dirname(relative2));
   const existing = await fs8.lstat(absolute).catch(() => void 0);
   if (existing?.isSymbolicLink()) throw invalid4(`\u53D7\u7BA1\u76EE\u5F55\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\uFF1A${relative2}`);
   if (existing && !existing.isDirectory()) throw invalid4(`\u53D7\u7BA1\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55\uFF1A${relative2}`);
@@ -8292,8 +9047,8 @@ async function pathExists(file) {
   );
 }
 async function readSafeFile(project, file, label) {
-  const relative2 = path6.relative(project, file).split(path6.sep).join("/");
-  if (relative2.startsWith("../") || path6.isAbsolute(relative2))
+  const relative2 = path8.relative(project, file).split(path8.sep).join("/");
+  if (relative2.startsWith("../") || path8.isAbsolute(relative2))
     throw invalid4(`${label}\u8DEF\u5F84\u9003\u9038\u9879\u76EE`);
   await assertNoSymlinkComponents(project, relative2);
   let stat;
@@ -8310,14 +9065,14 @@ async function assertNoSymlinkComponents(project, relative2) {
   const parts = relative2.split("/").filter(Boolean);
   let current = project;
   for (const part of parts) {
-    current = path6.join(current, part);
+    current = path8.join(current, part);
     const stat = await fs8.lstat(current).catch(() => void 0);
     if (stat?.isSymbolicLink()) throw invalid4(`\u8DEF\u5F84\u5305\u542B\u7B26\u53F7\u94FE\u63A5\uFF1A${relative2}`);
     if (!stat) break;
   }
 }
 async function realProject(requested) {
-  const absolute = path6.resolve(requested);
+  const absolute = path8.resolve(requested);
   let project;
   try {
     project = await fs8.realpath(absolute);
@@ -8329,10 +9084,10 @@ async function realProject(requested) {
   return project;
 }
 function safeRelative(reference, label) {
-  if (!reference || path6.isAbsolute(reference) || /[\r\n\0]/.test(reference)) {
+  if (!reference || path8.isAbsolute(reference) || /[\r\n\0]/.test(reference)) {
     throw invalid4(`${label}\u5FC5\u987B\u662F\u9879\u76EE\u5185\u76F8\u5BF9\u8DEF\u5F84`);
   }
-  const normalized = path6.normalize(reference).split(path6.sep).join("/");
+  const normalized = path8.normalize(reference).split(path8.sep).join("/");
   if (normalized === ".." || normalized.startsWith("../") || normalized === ".") {
     throw invalid4(`${label}\u8DEF\u5F84\u9003\u9038\u9879\u76EE`);
   }
@@ -8368,11 +9123,11 @@ function canonicalJson(value) {
   }
   return JSON.stringify(value) ?? "null";
 }
-function sha2566(value) {
-  return createHash6("sha256").update(value).digest("hex");
+function sha2567(value) {
+  return createHash7("sha256").update(value).digest("hex");
 }
 async function sha256File2(file) {
-  const hash = createHash6("sha256");
+  const hash = createHash7("sha256");
   await new Promise((resolve3, reject) => {
     const stream = createReadStream2(file);
     stream.on("data", (chunk) => hash.update(chunk));
@@ -8382,32 +9137,32 @@ async function sha256File2(file) {
   return hash.digest("hex");
 }
 function invalid4(message, cause) {
-  return new CliError20({ code: CliErrorCode19.INVALID_ARGUMENT, message, cause });
+  return new CliError22({ code: CliErrorCode21.INVALID_ARGUMENT, message, cause });
 }
 
 // src/commands/user.ts
 init_auth_guard();
 init_exit();
 import {
-  HcmClient as HcmClient17,
+  HcmClient as HcmClient19,
   adminResetPassword,
-  formatObject as formatObject19,
-  fromAxiosError as fromAxiosError17,
-  CliError as CliError21,
-  CliErrorCode as CliErrorCode20
+  formatObject as formatObject21,
+  fromAxiosError as fromAxiosError18,
+  CliError as CliError23,
+  CliErrorCode as CliErrorCode22
 } from "@hcmai/sdk";
 function buildAdminResetPasswordRequest(args, password) {
   const hasId = Boolean(args.id);
   const hasUsername = Boolean(args.username);
   if (hasId === hasUsername) {
-    throw new CliError21({
-      code: CliErrorCode20.INVALID_ARGUMENT,
+    throw new CliError23({
+      code: CliErrorCode22.INVALID_ARGUMENT,
       message: "--id <uuid> \u4E0E --username <user> \u5FC5\u987B\u4E14\u53EA\u80FD\u63D0\u4F9B\u4E00\u4E2A"
     });
   }
   if (!password) {
-    throw new CliError21({
-      code: CliErrorCode20.INVALID_ARGUMENT,
+    throw new CliError23({
+      code: CliErrorCode22.INVALID_ARGUMENT,
       message: "\u65B0\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A"
     });
   }
@@ -8423,12 +9178,12 @@ async function userResetPasswordCommand(args) {
   try {
     const password = args.passwordStdin ? await readSecretFromStdin() : await promptPasswordTwice();
     const request = buildAdminResetPasswordRequest(args, password);
-    const client3 = HcmClient17.fromAuthContext(await getActiveAuthContextFromCli(args));
+    const client3 = HcmClient19.fromAuthContext(await getActiveAuthContextFromCli(args));
     const result2 = await adminResetPassword(client3.raw(), request);
-    process.stdout.write(formatObject19(result2, { format: args.output ?? "json" }) + "\n");
+    process.stdout.write(formatObject21(result2, { format: args.output ?? "json" }) + "\n");
   } catch (cause) {
     const err = cause;
-    if (err?.isAxiosError) exitWithError(fromAxiosError17(err, args.env));
+    if (err?.isAxiosError) exitWithError(fromAxiosError18(err, args.env));
     exitWithError(cause);
   }
 }
@@ -8436,8 +9191,8 @@ async function promptPasswordTwice() {
   const password = await promptSecret("\u65B0\u5BC6\u7801: ");
   const confirmation = await promptSecret("\u518D\u6B21\u8F93\u5165\u65B0\u5BC6\u7801: ");
   if (password !== confirmation) {
-    throw new CliError21({
-      code: CliErrorCode20.INVALID_ARGUMENT,
+    throw new CliError23({
+      code: CliErrorCode22.INVALID_ARGUMENT,
       message: "\u4E24\u6B21\u8F93\u5165\u7684\u65B0\u5BC6\u7801\u4E0D\u4E00\u81F4"
     });
   }
@@ -8483,8 +9238,9 @@ identity.command("use <name>").description("\u628A identity \u8BBE\u4E3A\u5176 e
 identity.command("remove <name>").description("\u5220\u9664 identity\uFF08\u6E05 token + \u82E5\u662F env default \u5219\u6E05\u7A7A\uFF09").action((name) => identityRemove(name));
 var user = program.command("user").description("\u7BA1\u7406\u79DF\u6237\u7528\u6237\u7684\u4E13\u7528\u51ED\u636E\u6D41\u7A0B");
 user.command("reset-password").description("\u7531 admin.system \u5B89\u5168\u91CD\u7F6E\u7528\u6237\u5BC6\u7801\uFF0C\u5E76\u4F7F\u65E2\u6709\u4F1A\u8BDD\u5931\u6548").option("--id <uuid>", "\u76EE\u6807\u7528\u6237 ID\uFF08\u4E0E --username \u4E8C\u9009\u4E00\uFF09").option("--username <user>", "\u76EE\u6807\u7528\u6237\u540D\uFF08\u4E0E --id \u4E8C\u9009\u4E00\uFF09").option("--password-stdin", "\u4ECE\u6807\u51C6\u8F93\u5165\u8BFB\u53D6\u65B0\u5BC6\u7801\uFF08Agent/\u53D7\u63A7\u4EA4\u4ED8\u5FC5\u987B\u4F7F\u7528\uFF09").option("--no-force-change", "\u4E0B\u6B21\u767B\u5F55\u4E0D\u5F3A\u5236\u6539\u5BC6\uFF08\u4EC5\u9650\u5DF2\u6279\u51C6\u7684\u9694\u79BB\u6D4B\u8BD5\u73AF\u5883\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u5FC5\u987B\u5177\u5907 admin.system\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => userResetPasswordCommand(opts));
-var delivery = program.command("delivery").description("\u987E\u95EE\u4EA4\u4ED8\u547D\u4EE4\u7684\u98CE\u9669\u8BC4\u4F30\u4E0E\u4E00\u6B21\u6027\u53D7\u63A7\u6267\u884C\u5408\u540C");
-delivery.command("assess").description("\u7EAF\u672C\u5730\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1B\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
+var delivery = program.command("delivery").description("\u987E\u95EE\u4EA4\u4ED8\uFF1A\u73B0\u573A\u63A2\u6D3B\u3001\u98CE\u9669\u8BC4\u4F30\u4E0E\u4E00\u6B21\u6027\u53D7\u63A7\u6267\u884C\u5408\u540C");
+delivery.command("assess").description("\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1BAction \u98CE\u63A7\u58F0\u660E\u8BFB\u53D6\u81EA\u76EE\u6807 Core\uFF0C\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
+delivery.command("doctor").description("\u56DB\u6761\u951A\u70B9\u63A2\u6D3B\uFF1A\u8FDE\u901A / \u6211\u662F\u8C01 / configAdmin / \u7AD9\u5728\u54EA\u4E00\u5C42").option("--env <name>", "\u76EE\u6807\u73AF\u5883\u522B\u540D").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").option("--capabilities <s>", "\u722C\u53D6\u65F6\u58F0\u660E\u7684 capability \u4E32\uFF08\u4F1A\u968F\u56DB\u5143\u7EC4\u7559\u6863\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => deliveryDoctorCommand(opts));
 delivery.command("prepare").description("\u628A\u53D7\u652F\u6301\u7684 R2 argv \u4E0E\u9501\u3001\u8FD0\u884C\u65F6\u548C\u53D8\u66F4/\u56DE\u6EDA\u8BF4\u660E\u7ED1\u5B9A\u4E3A\u77ED\u65F6\u6267\u884C\u8BA1\u5212").requiredOption("--change-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u53D8\u66F4\u8BF4\u660E").requiredOption("--rollback-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u56DE\u6EDA\u8BF4\u660E").requiredOption("--evidence-dir <dir>", "\u9879\u76EE evidence/ \u4E0B\u7684\u6536\u636E\u76EE\u5F55").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--ttl-seconds <n>", "\u6709\u6548\u671F\u79D2\u6570\uFF0860-3600\uFF09", "900").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u7ED1\u5B9A\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryPrepareCommand(command, opts));
 delivery.command("execute <planId>").description("\u9010\u6B21\u6279\u51C6\u540E\u6D88\u8D39\u77ED\u65F6\u8BA1\u5212\uFF0C\u5E76\u6267\u884C\u4E00\u6B21\u4E0E\u8BA1\u5212\u5B8C\u5168\u76F8\u540C\u7684 R2 argv").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--output <fmt>", "\u6536\u636E\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u4E0E prepare \u5B8C\u5168\u76F8\u540C\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570").action((planId, command, opts) => deliveryExecuteCommand(planId, command, opts));
 program.command("query <Model>").description("\u67E5\u8BE2 Model \u5217\u8868\u6570\u636E\uFF08\u901A\u8FC7 ModelQueryDsl JSON \u8868\u8FBE\u8FC7\u6EE4/\u6392\u5E8F/\u5206\u9875\uFF09").option(
@@ -8546,12 +9302,13 @@ meta.command("list").description("\u5217\u51FA\u79DF\u6237\u5143\u6570\u636E\u65
 meta.command("get <path>").description("\u6253\u5370 meta \u539F\u6587\uFF08\u5982 metas/Employee.list.yml\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").action((p, opts) => metaGetCommand(p, opts));
 meta.command("set <path>").description("\u5199\u5165 meta \u539F\u6587\uFF1B\u5199\u5B8C\u987B hcm cache clear-meta <Model> \u624D\u751F\u6548").requiredOption("--file <file>", "\u4ECE\u6587\u4EF6\u8BFB\u53D6\u539F\u6587\uFF08- \u8868\u793A stdin\uFF09").option("--dry-run", "\u53EA\u663E\u793A\u5C06\u5199\u5165\u7684\u5185\u5BB9\uFF0C\u4E0D\u5B9E\u9645\u5199\u5165").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((p, opts) => metaSetCommand(p, opts));
 meta.command("delete <path>").description("\u5220\u9664 meta\uFF08\u4E0D\u53EF\u9006\uFF0C\u9ED8\u8BA4\u8FC7\u786E\u8BA4\u95F8\uFF09").option("-y, --yes", "\u8DF3\u8FC7\u786E\u8BA4").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((p, opts) => metaDeleteCommand(p, opts));
-var skills = program.command("skills").description("\u777F\u620E Chiron \u4EA4\u4ED8\u6280\u80FD\u5E93\uFF1A\u5217\u51FA / \u67E5\u770B / \u5B89\u88C5\u4EA4\u4ED8\u6280\u80FD\uFF08\u514D\u8BA4\u8BC1\uFF0C\u65E0\u9700\u5148 login\uFF09");
-skills.command("list [keyword]").description("\u5217\u51FA\u76EE\u6807\u73AF\u5883\u8FD9\u4E00\u7248\u7684\u4EA4\u4ED8\u6280\u80FD\uFF1B--installed \u6539\u770B\u672C\u5730\u88C5\u4E86\u54EA\u4E9B\uFF08\u4E0D\u8FDE\u7F51\uFF09").option("--installed", "\u53EA\u770B\u672C\u5730\u5DF2\u88C5\u7684\u6280\u80FD\uFF08\u8BFB .hcm-skills.json\uFF0C\u4E0D\u8FDE\u7F51\uFF09").option("--target <agent>", "\u914D\u5408 --installed\uFF1Aclaude | codex | auto", "auto").option("--global", "\u914D\u5408 --installed\uFF1A\u770B\u7528\u6237\u7EA7\u76EE\u5F55").option("--dir <path>", "\u914D\u5408 --installed\uFF1A\u770B\u6307\u5B9A\u76EE\u5F55").option("--category <key>", "\u53EA\u770B\u67D0\u4E2A\u5206\u7C7B").option("--stage <key>", "\u53EA\u770B\u67D0\u4E2A\u4EA4\u4ED8\u9636\u6BB5\uFF1Ahandover | baseline | configure | migrate | integrate | golive | operate").option("--by-stage", "\u6309\u4EA4\u4ED8\u751F\u547D\u5468\u671F\u5206\u7EC4\u5C55\u793A\uFF08\u9ED8\u8BA4\u6309\u529F\u80FD\u5206\u7C7B\uFF09").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((kw, opts) => skillsListCommand(kw, opts));
-skills.command("show <id>").description("\u6253\u5370\u6280\u80FD\u539F\u6587\uFF08\u7BA1\u9053\u53CB\u597D\uFF09").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").action((id, opts) => skillsShowCommand(id, opts));
-skills.command("install [id]").description("\u8FDE\u540C requires \u524D\u7F6E\u6280\u80FD\u4E0E\u53C2\u8003\u6587\u4EF6\u88C5\u5230 agent \u6280\u80FD\u76EE\u5F55\uFF1B--all \u88C5\u6574\u4E2A\u6280\u80FD\u5E93").option("--all", "\u88C5\u6574\u4E2A\u6280\u80FD\u5E93\uFF0C\u5E76\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D\uFF08\u5F80\u540E update \u4F1A\u81EA\u52A8\u8865\u4E0A\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\uFF09").option("--target <agent>", "\u88C5\u7ED9\u54EA\u4E2A agent\uFF1Aclaude\uFF08.claude/skills/\uFF09| codex\uFF08hcm-skills/ + AGENTS.md\uFF09| auto", "auto").option("--global", "\u88C5\u5230\u7528\u6237\u7EA7\u76EE\u5F55\u800C\u975E\u5F53\u524D\u9879\u76EE").option("--dir <path>", "\u88C5\u5230\u6307\u5B9A\u76EE\u5F55").option("--from <dir>", "\u4ECE\u672C\u5730\u76EE\u5F55\u88C5\uFF08\u73B0\u573A\u6539\u8FC7\u7684\u7248\u672C\uFF09\uFF0C\u4E0D\u8D70\u7F51\u7EDC").option("--force", "\u8986\u76D6\u5DF2\u5B58\u5728\u7684\u540C\u540D\u6280\u80FD").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((id, opts) => skillsInstallCommand(id, opts));
+var skills = program.command("skills").description("\u4EA4\u4ED8\u6280\u80FD\uFF1A\u777F\u620E Chiron \u6280\u80FD\u5E93 + CLI \u81EA\u5E26\u6280\u80FD\uFF08\u514D\u8BA4\u8BC1\uFF0C\u65E0\u9700\u5148 login\uFF09");
+skills.command("list [keyword]").description("\u5217\u51FA\u76EE\u6807\u73AF\u5883\u8FD9\u4E00\u7248\u7684\u4EA4\u4ED8\u6280\u80FD\uFF1B--installed \u6539\u770B\u672C\u5730\u88C5\u4E86\u54EA\u4E9B\uFF08\u4E0D\u8FDE\u7F51\uFF09").option("--installed", "\u53EA\u770B\u672C\u5730\u5DF2\u88C5\u7684\u6280\u80FD\uFF08\u8BFB .hcm-skills.json\uFF0C\u4E0D\u8FDE\u7F51\uFF09").option("--target <agent>", "\u914D\u5408 --installed\uFF1Aclaude | codex | auto", "auto").option("--global", "\u914D\u5408 --installed\uFF1A\u770B\u7528\u6237\u7EA7\u76EE\u5F55").option("--dir <path>", "\u914D\u5408 --installed\uFF1A\u770B\u6307\u5B9A\u76EE\u5F55").option("--category <key>", "\u53EA\u770B\u67D0\u4E2A\u5206\u7C7B").option("--stage <key>", "\u53EA\u770B\u67D0\u4E2A\u4EA4\u4ED8\u9636\u6BB5\uFF1Ahandover | baseline | configure | migrate | integrate | golive | operate").option("--by-stage", "\u6309\u4EA4\u4ED8\u751F\u547D\u5468\u671F\u5206\u7EC4\u5C55\u793A\uFF08\u9ED8\u8BA4\u6309\u529F\u80FD\u5206\u7C7B\uFF09").option("--source <kind>", "\u8FD9\u4E00\u8D9F\u770B\u54EA\u4E9B\u6765\u6E90\uFF1Acli\uFF08\u53EA\u770B\u81EA\u5E26\uFF0C\u4E0D\u8FDE\u7F51\uFF09| chiron | all", "all").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((kw, opts) => skillsListCommand(kw, opts));
+skills.command("manifest").description("\u6253\u5370\u672C CLI \u7684\u547D\u4EE4\u9762\u4E0E\u81EA\u5E26\u6280\u80FD\u6E05\u5355\uFF08\u4E0D\u8FDE\u7F51\uFF0C\u4F9B\u5B88\u536B\u4E0E\u5916\u90E8\u5DE5\u5177\u6BD4\u5BF9\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => skillsManifestCommand(program, opts));
+skills.command("show <id>").description("\u6253\u5370\u6280\u80FD\u539F\u6587\uFF08\u7BA1\u9053\u53CB\u597D\uFF09\uFF1B\u81EA\u5E26\u6280\u80FD\u76F4\u63A5\u8BFB\u672C\u5730\uFF0C\u4E0D\u8FDE\u7F51").option("--source <kind>", "\u8FD9\u4E00\u8D9F\u770B\u54EA\u4E9B\u6765\u6E90\uFF1Acli\uFF08\u53EA\u770B\u81EA\u5E26\uFF0C\u4E0D\u8FDE\u7F51\uFF09| chiron | all", "all").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").action((id, opts) => skillsShowCommand(id, opts));
+skills.command("install [id]").description("\u8FDE\u540C requires \u524D\u7F6E\u6280\u80FD\u4E0E\u53C2\u8003\u6587\u4EF6\u88C5\u5230 agent \u6280\u80FD\u76EE\u5F55\uFF1B--all \u88C5\u6574\u4E2A\u6280\u80FD\u5E93").option("--all", "\u88C5\u6574\u4E2A\u6280\u80FD\u5E93\uFF0C\u5E76\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D\uFF08\u5F80\u540E update \u4F1A\u81EA\u52A8\u8865\u4E0A\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\uFF09").option("--target <agent>", "\u88C5\u7ED9\u54EA\u4E2A agent\uFF1Aclaude\uFF08.claude/skills/\uFF09| codex\uFF08hcm-skills/ + AGENTS.md\uFF09| auto", "auto").option("--global", "\u88C5\u5230\u7528\u6237\u7EA7\u76EE\u5F55\u800C\u975E\u5F53\u524D\u9879\u76EE").option("--dir <path>", "\u88C5\u5230\u6307\u5B9A\u76EE\u5F55").option("--from <dir>", "\u4ECE\u672C\u5730\u76EE\u5F55\u88C5\uFF08\u73B0\u573A\u6539\u8FC7\u7684\u7248\u672C\uFF09\uFF0C\u4E0D\u8D70\u7F51\u7EDC").option("--source <kind>", "\u8FD9\u4E00\u8D9F\u770B\u54EA\u4E9B\u6765\u6E90\uFF1Acli\uFF08\u53EA\u770B\u81EA\u5E26\uFF0C\u4E0D\u8FDE\u7F51\uFF09| chiron | all", "all").option("--force", "\u8986\u76D6\u5DF2\u5B58\u5728\u7684\u540C\u540D\u6280\u80FD").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((id, opts) => skillsInstallCommand(id, opts));
 skills.command("sync <id>").description("\u4ECE\u76EE\u6807\u5B9E\u4F8B\u540C\u6B65 Skill \u95ED\u5305\u5230 WorkBuddy \u9879\u76EE\u5E76\u5199 chiron.lock").requiredOption("--target <agent>", "\u76EE\u6807 Agent \u5BBF\u4E3B\uFF1B\u5F53\u524D\u652F\u6301 workbuddy").requiredOption("--project <path>", "WorkBuddy \u9879\u76EE\u6839\u76EE\u5F55").option("--cli <path>", "\u663E\u5F0F\u6307\u5B9A\u8981\u9501\u5B9A\u5230\u9879\u76EE\u7684 HCM CLI\uFF1B\u9ED8\u8BA4\u4F7F\u7528\u5F53\u524D\u8FD9\u4EFD CLI").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((id, opts) => skillsSyncCommand(id, opts));
-skills.command("update").description("\u628A\u88C5\u8FC7\u7684\u6280\u80FD\u5347\u5230\u76EE\u6807\u73AF\u5883\u8FD9\u4E00\u7248\uFF08\u4EA7\u54C1\u5347\u7EA7\u540E\u8DD1\u5B83\uFF09").option("--all", "\u8FDE\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\u4E00\u8D77\u88C5\u4E0A\uFF0C\u5E76\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D").option("--check", "\u53EA\u770B\u4F1A\u53D8\u4EC0\u4E48\uFF0C\u4E0D\u5199\u76D8").option("--target <agent>", "claude | codex | auto\uFF08\u9ED8\u8BA4\u6309\u5DF2\u5B89\u88C5\u76EE\u5F55\u63A2\uFF09", "auto").option("--global", "\u5347\u7EA7\u7528\u6237\u7EA7\u76EE\u5F55\u91CC\u7684\u6280\u80FD").option("--dir <path>", "\u5347\u7EA7\u6307\u5B9A\u76EE\u5F55\u91CC\u7684\u6280\u80FD").option("--force", "\u8FDE\u672C\u5730\u6539\u8FC7\u7684\u6280\u80FD\u4E00\u8D77\u8986\u76D6\u6210\u4EA7\u54C1\u8FD9\u4E00\u7248").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6\u5B89\u88C5\u65F6\u8BB0\u5F55\u7684\u5730\u5740\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((opts) => skillsUpdateCommand(opts));
+skills.command("update").description("\u628A\u88C5\u8FC7\u7684\u6280\u80FD\u5347\u5230\u76EE\u6807\u73AF\u5883\u8FD9\u4E00\u7248\uFF08\u4EA7\u54C1\u5347\u7EA7\u540E\u8DD1\u5B83\uFF09").option("--all", "\u8FDE\u4EA7\u54C1\u65B0\u589E\u7684\u6280\u80FD\u4E00\u8D77\u88C5\u4E0A\uFF0C\u5E76\u8BB0\u4E3A\u300C\u8DDF\u968F\u5168\u96C6\u300D").option("--check", "\u53EA\u770B\u4F1A\u53D8\u4EC0\u4E48\uFF0C\u4E0D\u5199\u76D8").option("--target <agent>", "claude | codex | auto\uFF08\u9ED8\u8BA4\u6309\u5DF2\u5B89\u88C5\u76EE\u5F55\u63A2\uFF09", "auto").option("--global", "\u5347\u7EA7\u7528\u6237\u7EA7\u76EE\u5F55\u91CC\u7684\u6280\u80FD").option("--dir <path>", "\u5347\u7EA7\u6307\u5B9A\u76EE\u5F55\u91CC\u7684\u6280\u80FD").option("--force", "\u8FDE\u672C\u5730\u6539\u8FC7\u7684\u6280\u80FD\u4E00\u8D77\u8986\u76D6\u6210\u4EA7\u54C1\u8FD9\u4E00\u7248").option("--source <kind>", "\u8FD9\u4E00\u8D9F\u770B\u54EA\u4E9B\u6765\u6E90\uFF1Acli\uFF08\u53EA\u770B\u81EA\u5E26\uFF0C\u4E0D\u8FDE\u7F51\uFF09| chiron | all", "all").option("--endpoint <url>", "\u6280\u80FD\u5E93\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6\u5B89\u88C5\u65F6\u8BB0\u5F55\u7684\u5730\u5740\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "table").action((opts) => skillsUpdateCommand(opts));
 program.command("update <Model>").description("\u66F4\u65B0\u4E00\u6761 Model \u8BB0\u5F55\uFF08\u8D70\u540E\u7AEF\u5B8C\u6574\u6821\u9A8C\uFF09").requiredOption("--id <id>", "\u8BB0\u5F55 ID").option("--data <JSON>", `\u8981\u66F4\u65B0\u7684\u5B57\u6BB5 JSON\uFF0C\u4F8B\u5982 '{"name":"\u65B0\u540D\u79F0"}'`).option("--data-file <path>", "\u4ECE UTF-8 JSON \u6587\u4EF6\u8BFB\u53D6\u66F4\u65B0\u5B57\u6BB5\uFF08\u4E0E --data \u4E92\u65A5\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u8986\u76D6 env defaultIdentity\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((model, opts) => updateCommand(model, opts));
 program.command("version").description("\u67E5\u540E\u7AEF\u7248\u672C\uFF08commit / tag / \u6784\u5EFA\u65F6\u95F4\uFF09\u2014\u2014\u514D\u8BA4\u8BC1\uFF0C\u65E0\u9700\u5148 login").option("--endpoint <url>", "\u540E\u7AEF\u5730\u5740\uFF08\u9ED8\u8BA4\u53D6 activeEnv \u7684 endpoint\uFF09").option("--env <name>", "\u4ECE\u8BE5 env \u89E3\u6790 endpoint").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => versionCommand(opts));
 var setting = program.command("setting").description("\u79DF\u6237\u7CFB\u7EDF\u53C2\u6570\uFF08\u767B\u5F55\u7B56\u7565 / \u5BC6\u7801\u7B56\u7565 / \u529F\u80FD\u5F00\u5173 / \u96C6\u6210\u53C2\u6570\uFF09");
@@ -8571,9 +9328,14 @@ async function main() {
   }
   await program.parseAsync(process.argv);
 }
-main().catch((e) => {
-  process.stderr.write(`[hcm] fatal: ${String(e.message)}
+if (process.env.HCM_CLI_IMPORT_ONLY !== "1") {
+  main().catch((e) => {
+    process.stderr.write(`[hcm] fatal: ${String(e.message)}
 `);
-  process.exit(1);
-});
+    process.exit(1);
+  });
+}
+export {
+  program
+};
 //# sourceMappingURL=index.js.map