@newlandnpt/pep-cli 0.6.0 → 0.6.1

package/README.md

@@ -153,9 +153,12 @@ A skill's name is the folder name **inside** the repository, not the repository'
 different repositories that each ship a `semi-integration/SKILL.md` both want
 `~/.agents/skills/semi-integration/`, and the second would silently overwrite the first.
 
-Adding a second such repository is refused, and the error names the one already there. If you
-already have a colliding pair from an older version, nothing breaks — every command reports it
-until you `remove` one:
+`add` refuses, and the error names the repository already there — it will not pick a winner for
+you. `update` never fails over it: the contested skill is left exactly as it is, everything else in
+that repository still refreshes, and the clash is reported every run until you `remove` one. That
+matters because a clash can appear **later**, when one repository adds a folder the other already
+has — you did nothing, and one upstream mistake must not stop every other repository from
+updating.
 
 ```
 ⚠ 3 repositories all install "semi-integration" here:
@@ -166,6 +169,9 @@ until you `remove` one:
 
 Installing them into **different** directories is fine — that is what `-p` is for.
 
+A contested skill stays frozen at whichever copy is on disk until you remove one of the claimants.
+That is deliberate: stable and loudly reported beats "whoever runs update last wins".
+
 `remove` leaves a shared skill's files on disk (which copy it is can no longer be told) and says
 so, rather than deleting what might be the other repository's content.
 

package/dist/pep.cjs

@@ -1272,7 +1272,19 @@ async function updateSkills(dependencies) {
   }
   const inArchive = [...bySkill.keys()].sort();
   const skipped = dependencies.restoreMissing ? [] : inArchive.filter((skill) => gone.has(skill));
-  const skills = inArchive.filter((skill) => !skipped.includes(skill));
+  const candidates = inArchive.filter((skill) => !skipped.includes(skill));
+  const conflicts = [];
+  for (const skill of candidates) {
+    const owner = claimedElsewhere(skill);
+    if (owner === void 0) continue;
+    if (dependencies.restoreMissing) {
+      throw new Error(
+        `${owner} already installs a skill named "${skill}" in ${dependencies.directory}. Two repositories cannot both provide "${skill}" there \u2014 the second would silently overwrite the first. Install this one elsewhere (-p, or --dir <path>), or run \`pep skills remove ${owner}\` first.`
+      );
+    }
+    conflicts.push({ skill, owner });
+  }
+  const skills = candidates.filter((skill) => !conflicts.some((one) => one.skill === skill));
   const hashes = {};
   const updated = [];
   const unchanged = [];
@@ -1284,18 +1296,6 @@ async function updateSkills(dependencies) {
     else if (before !== void 0 && before !== "" && before === hash) unchanged.push(skill);
     else updated.push(skill);
   }
-  const conflicts = [];
-  for (const skill of skills) {
-    const owner = claimedElsewhere(skill);
-    if (owner === void 0) continue;
-    if (previous !== void 0 && skill in previous.skills) {
-      conflicts.push({ skill, owner });
-      continue;
-    }
-    throw new Error(
-      `${owner} already installs a skill named "${skill}" in ${dependencies.directory}. Two repositories cannot both provide "${skill}" there \u2014 the second would silently overwrite the first. Install this one elsewhere (-p, or --dir <path>), or run \`pep skills remove ${owner}\` first.`
-    );
-  }
   const removed = Object.keys(previous?.skills ?? {}).filter((skill) => !inArchive.includes(skill));
   if (previous !== void 0) {
     const stale = sameTarget ? removed : Object.keys(previous.skills);
@@ -1309,8 +1309,9 @@ async function updateSkills(dependencies) {
   for (const skill of skills) {
     await (0, import_promises4.rm)((0, import_node_path4.join)(dependencies.directory, skill), { recursive: true, force: true });
   }
+  const untouched = /* @__PURE__ */ new Set([...skipped, ...conflicts.map((one) => one.skill)]);
   for (const file of files) {
-    if (skipped.includes(file.skill)) continue;
+    if (untouched.has(file.skill)) continue;
     const target = (0, import_node_path4.join)(dependencies.directory, file.skill, ...file.path.split("/"));
     await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(target), { recursive: true });
     await (0, import_promises4.writeFile)(target, file.data);
@@ -1337,7 +1338,12 @@ async function updateSkills(dependencies) {
         ...dependencies.linkInto !== void 0 ? { linkedInto: dependencies.linkInto } : {},
         // 跳过的那些**原样留着上次的哈希** —— 账上仍然认它是这个包的（将来 add 能补回来，
         // 上游删掉时也还清得动），只是这次没去碰它。
-        skills: { ...pickSkipped(previous, skipped), ...hashes }
+        // 跳过的与让开的都**原样留着上次的哈希** —— 账上仍然认它是这个包的（将来 add
+        // 能补回来、`remove` 也还清得动），只是这次没去碰它。
+        skills: {
+          ...pickSkipped(previous, [...skipped, ...conflicts.map((one) => one.skill)]),
+          ...hashes
+        }
       }
     }
   });
@@ -1359,7 +1365,7 @@ async function updateSkills(dependencies) {
 }
 
 // src/cli.ts
-var VERSION = false ? "0.0.0-dev" : "0.6.0";
+var VERSION = false ? "0.0.0-dev" : "0.6.1";
 function usage() {
   return `PEP CLI ${VERSION}
 
@@ -1421,8 +1427,10 @@ list. It only removes what it installed itself, and it needs no login. A skill t
 repository also installs is left on disk (which copy it is can no longer be told) and reported.
 
 Two repositories cannot both provide a skill with the SAME NAME in one directory \u2014 the skill name
-is the folder name inside the repository, so they would overwrite each other. Adding a second one
-is refused; if you already have such a pair, every command says so until you remove one.
+is the folder name inside the repository, so they would overwrite each other. add refuses, naming
+the repository already there. update never fails over it: it leaves that one skill untouched,
+refreshes everything else, and reports it every run until you remove one. Installing them into
+different directories (-p, or --dir) is fine.
 
 Delete a skill folder by hand and update LEAVES IT DELETED \u2014 it refreshes what is still there and
 reports the ones it left alone. Run \`pep skills add <repo>\` to put them back; add is the command

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newlandnpt/pep-cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "PEP CLI —— 凭 PEP 身份读取 Newland 开发者文档与 agent skills",
   "license": "UNLICENSED",
   "type": "module",