@skilltap/core 0.5.2 → 0.5.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skilltap/core",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Core library for skilltap — agent skill management",
   "type": "module",
   "license": "MIT",

package/src/config.ts

@@ -164,9 +164,14 @@ export async function saveConfig(config: Config): Promise<Result<void>> {
 
 const _DEFAULT_INSTALLED: InstalledJson = { version: 1, skills: [] };
 
-export async function loadInstalled(): Promise<Result<InstalledJson>> {
-  const dir = getConfigDir();
-  const file = join(dir, "installed.json");
+function getInstalledPath(projectRoot?: string): string {
+  return projectRoot
+    ? join(projectRoot, ".agents", "installed.json")
+    : join(getConfigDir(), "installed.json");
+}
+
+export async function loadInstalled(projectRoot?: string): Promise<Result<InstalledJson>> {
+  const file = getInstalledPath(projectRoot);
 
   const f = Bun.file(file);
   const exists = await f.exists();
@@ -194,12 +199,20 @@ export async function loadInstalled(): Promise<Result<InstalledJson>> {
 
 export async function saveInstalled(
   installed: InstalledJson,
+  projectRoot?: string,
 ): Promise<Result<void>> {
-  const dir = getConfigDir();
-  const file = join(dir, "installed.json");
+  const file = getInstalledPath(projectRoot);
 
-  const dirsResult = await ensureDirs();
-  if (!dirsResult.ok) return dirsResult;
+  if (projectRoot) {
+    try {
+      await mkdir(join(projectRoot, ".agents"), { recursive: true });
+    } catch (e) {
+      return err(new UserError(`Failed to create .agents directory: ${e}`));
+    }
+  } else {
+    const dirsResult = await ensureDirs();
+    if (!dirsResult.ok) return dirsResult;
+  }
 
   try {
     await Bun.write(file, JSON.stringify(installed, null, 2));

package/src/doctor.ts

@@ -346,7 +346,6 @@ async function checkSkills(installed: InstalledJson): Promise<DoctorCheck> {
   const trackedNames = new Set<string>();
 
   for (const skill of installed.skills) {
-    if (skill.scope === "project") continue;
     trackedNames.add(skill.name);
 
     if (skill.scope === "linked") {
@@ -407,7 +406,7 @@ async function checkSkills(installed: InstalledJson): Promise<DoctorCheck> {
     }
   }
 
-  const total = installed.skills.filter((s) => s.scope !== "project").length;
+  const total = installed.skills.length;
   const missing = issues.filter((i) => i.fixable).length;
   const onDisk = total - missing;
 
@@ -434,7 +433,7 @@ async function checkSymlinks(installed: InstalledJson): Promise<DoctorCheck> {
   let valid = 0;
 
   for (const skill of installed.skills) {
-    if (skill.scope === "project" || skill.also.length === 0) continue;
+    if (skill.also.length === 0) continue;
 
     for (const agent of skill.also) {
       const agentRelDir = AGENT_PATHS[agent];

package/src/install.test.ts

@@ -213,6 +213,59 @@ describe("installSkill — project scope", () => {
       await removeTmpDir(projectRoot);
     }
   });
+
+  test("saves to project installed.json, not global", async () => {
+    const repo = await createStandaloneSkillRepo();
+    const projectRoot = await makeTmpDir();
+    try {
+      await $`git -C ${projectRoot} init`.quiet();
+      await installSkill(repo.path, { scope: "project", projectRoot, skipScan: true });
+
+      // Project file should have the record
+      const projectInstalled = await loadInstalled(projectRoot);
+      expect(projectInstalled.ok).toBe(true);
+      if (!projectInstalled.ok) return;
+      expect(projectInstalled.value.skills.map((s) => s.name)).toContain("standalone-skill");
+
+      // Global file should be empty
+      const globalInstalled = await loadInstalled();
+      expect(globalInstalled.ok).toBe(true);
+      if (!globalInstalled.ok) return;
+      expect(globalInstalled.value.skills).toHaveLength(0);
+    } finally {
+      await repo.cleanup();
+      await removeTmpDir(projectRoot);
+    }
+  });
+
+  test("same skill in two projects coexist independently", async () => {
+    const repo = await createStandaloneSkillRepo();
+    const projectA = await makeTmpDir();
+    const projectB = await makeTmpDir();
+    try {
+      await $`git -C ${projectA} init`.quiet();
+      await $`git -C ${projectB} init`.quiet();
+
+      await installSkill(repo.path, { scope: "project", projectRoot: projectA, skipScan: true });
+      await installSkill(repo.path, { scope: "project", projectRoot: projectB, skipScan: true });
+
+      // Both project files have the record
+      const aInstalled = await loadInstalled(projectA);
+      const bInstalled = await loadInstalled(projectB);
+      expect(aInstalled.ok && aInstalled.value.skills).toHaveLength(1);
+      expect(bInstalled.ok && bInstalled.value.skills).toHaveLength(1);
+
+      // Global file is empty
+      const globalInstalled = await loadInstalled();
+      expect(globalInstalled.ok).toBe(true);
+      if (!globalInstalled.ok) return;
+      expect(globalInstalled.value.skills).toHaveLength(0);
+    } finally {
+      await repo.cleanup();
+      await removeTmpDir(projectA);
+      await removeTmpDir(projectB);
+    }
+  });
 });
 
 describe("removeSkill", () => {

package/src/install.ts

@@ -365,7 +365,8 @@ export async function installSkill(
   const allSemanticWarnings: SemanticWarning[] = [];
 
   // 1. Check already-installed
-  const installedResult = await loadInstalled();
+  const fileRoot = options.scope === "project" ? options.projectRoot : undefined;
+  const installedResult = await loadInstalled(fileRoot);
   if (!installedResult.ok) return installedResult;
   const installed = installedResult.value;
 
@@ -563,7 +564,7 @@ export async function installSkill(
 
     // 10. Save installed.json
     installed.skills.push(...newRecords);
-    const saveResult = await saveInstalled(installed);
+    const saveResult = await saveInstalled(installed, fileRoot);
     if (!saveResult.ok) return saveResult;
 
     return ok({

package/src/link.ts

@@ -38,7 +38,8 @@ export async function linkSkill(
   const skill = scanned[0]!;
 
   // 3. Load installed to check for conflicts
-  const installedResult = await loadInstalled();
+  const fileRoot = options.scope === "project" ? options.projectRoot : undefined;
+  const installedResult = await loadInstalled(fileRoot);
   if (!installedResult.ok) return installedResult;
   const installed = installedResult.value;
 
@@ -99,7 +100,7 @@ export async function linkSkill(
 
   // 8. Save installed.json
   installed.skills.push(record);
-  const saveResult = await saveInstalled(installed);
+  const saveResult = await saveInstalled(installed, fileRoot);
   if (!saveResult.ok) return saveResult;
 
   return ok(record);

package/src/remove.ts

@@ -17,7 +17,8 @@ export async function removeSkill(
   options: RemoveOptions = {},
 ): Promise<Result<void, UserError>> {
   debug("removeSkill", { name, scope: options.scope });
-  const installedResult = await loadInstalled();
+  const fileRoot = options.scope === "project" ? options.projectRoot : undefined;
+  const installedResult = await loadInstalled(fileRoot);
   if (!installedResult.ok) return installedResult;
   const installed = installedResult.value;
 
@@ -79,7 +80,7 @@ export async function removeSkill(
   }
 
   installed.skills.splice(idx, 1);
-  const saveResult = await saveInstalled(installed);
+  const saveResult = await saveInstalled(installed, fileRoot);
   if (!saveResult.ok) return saveResult;
 
   return ok(undefined);

package/src/self-update.ts

@@ -164,7 +164,7 @@ export async function downloadAndInstall(
     const buffer = await response.arrayBuffer();
     await Bun.write(tmpPath, buffer);
     await Bun.$`chmod +x ${tmpPath}`.quiet();
-    await Bun.$`cp -a ${tmpPath} ${execPath} && rm -f ${tmpPath}`.quiet();
+    await Bun.$`mv -f ${tmpPath} ${execPath}`.quiet();
   } catch (e) {
     // Clean up temp file if possible
     Bun.$`rm -f ${tmpPath}`.quiet();

package/src/symlink.ts

@@ -63,7 +63,7 @@ export async function removeAgentSymlinks(
   scope: "global" | "project" | "linked",
   projectRoot?: string,
 ): Promise<Result<void, UserError>> {
-  const effectiveScope = scope === "linked" ? "global" : scope;
+  const effectiveScope = scope === "linked" ? (projectRoot ? "project" : "global") : scope;
   for (const agent of agents) {
     const linkPath = symlinkPath(skillName, agent, effectiveScope, projectRoot);
     if (!linkPath) continue;

package/src/update.test.ts

@@ -314,4 +314,74 @@ describe("updateSkill — multi-skill", () => {
       await repo.cleanup();
     }
   });
+
+  test("both skills from same repo are checked when both installed", async () => {
+    const repo = await createMultiSkillRepo();
+    try {
+      // Install BOTH skills from the multi-skill repo
+      await installSkill(repo.path, { scope: "global", skipScan: true });
+
+      // Add a commit that changes BOTH skill paths
+      await addFileAndCommit(repo.path, ".agents/skills/skill-a/patch.md", "# Patch A");
+      await addFileAndCommit(repo.path, ".agents/skills/skill-b/patch.md", "# Patch B");
+
+      const result = await updateSkill({ yes: true });
+      expect(result.ok).toBe(true);
+      if (!result.ok) return;
+
+      expect(result.value.updated).toContain("skill-a");
+      expect(result.value.updated).toContain("skill-b");
+    } finally {
+      await repo.cleanup();
+    }
+  });
+
+  test("skill with no path changes is upToDate even when repo has changes", async () => {
+    const repo = await createMultiSkillRepo();
+    try {
+      // Install BOTH skills from the multi-skill repo
+      await installSkill(repo.path, { scope: "global", skipScan: true });
+
+      // Add a commit that ONLY changes skill-a's path
+      await addFileAndCommit(repo.path, ".agents/skills/skill-a/only-a.md", "# Only A");
+
+      const result = await updateSkill({ yes: true });
+      expect(result.ok).toBe(true);
+      if (!result.ok) return;
+
+      // skill-a has changes → updated
+      expect(result.value.updated).toContain("skill-a");
+      // skill-b has no path-specific changes → upToDate (not skipped, not updated)
+      expect(result.value.upToDate).toContain("skill-b");
+      expect(result.value.skipped).not.toContain("skill-b");
+    } finally {
+      await repo.cleanup();
+    }
+  });
+});
+
+describe("updateSkill — project scope", () => {
+  test("updates skills in project installed.json when projectRoot provided", async () => {
+    const repo = await createStandaloneSkillRepo();
+    const projectRoot = await makeTmpDir();
+    try {
+      await installSkill(repo.path, { scope: "project", projectRoot, skipScan: true });
+      await addFileAndCommit(repo.path, "new-file.md", "# New content");
+
+      const result = await updateSkill({ yes: true, projectRoot });
+      expect(result.ok).toBe(true);
+      if (!result.ok) return;
+
+      expect(result.value.updated).toContain("standalone-skill");
+
+      // Project installed.json should have updated SHA
+      const projectInstalled = await loadInstalled(projectRoot);
+      expect(projectInstalled.ok).toBe(true);
+      if (!projectInstalled.ok) return;
+      expect(projectInstalled.value.skills[0]?.sha).toBeTruthy();
+    } finally {
+      await repo.cleanup();
+      await removeTmpDir(projectRoot);
+    }
+  });
 });

package/src/update.ts

@@ -14,7 +14,7 @@ import {
   resolveVersion,
 } from "./npm-registry";
 import { skillCacheDir, skillInstallDir } from "./paths";
-import type { InstalledSkill } from "./schemas/installed";
+import type { InstalledJson, InstalledSkill } from "./schemas/installed";
 import type { StaticWarning } from "./security";
 import { scanDiff, scanStatic } from "./security";
 import type { SemanticWarning } from "./security/semantic";
@@ -41,7 +41,7 @@ export type UpdateOptions = {
   yes?: boolean;
   /** Skip skills that have security warnings in their diff */
   strict?: boolean;
-  /** Project root for project-scoped symlink re-creation */
+  /** Project root — also processes project-scoped skills from {projectRoot}/.agents/installed.json */
   projectRoot?: string;
   onProgress?: (
     skillName: string,
@@ -291,7 +291,7 @@ async function updateNpmSkill(
   }
 }
 
-/** Handle updates for git-sourced skills (SHA comparison, diff scanning). */
+/** Handle updates for standalone git skills (path === null; workDir is the install dir). */
 async function updateGitSkill(
   record: InstalledSkill,
   installed: { skills: InstalledSkill[] },
@@ -299,27 +299,11 @@ async function updateGitSkill(
   result: UpdateResult,
   _resolveTrust: ResolveTrustFn,
 ): Promise<Result<void, UserError | GitError | ScanError>> {
-  // Standalone: work dir is the install path. Multi-skill: work dir is the cache.
-  const isMulti = record.path !== null;
-  const workDir = isMulti
-    ? skillCacheDir(record.repo!)
-    : skillInstallDir(
-        record.name,
-        record.scope as "global" | "project",
-        options.projectRoot,
-      );
-
-  // For multi-skill, verify cache exists
-  if (isMulti) {
-    const cacheGitExists = await lstat(join(workDir, ".git"))
-      .then(() => true)
-      .catch(() => false);
-    if (!cacheGitExists) {
-      result.skipped.push(record.name);
-      options.onProgress?.(record.name, "skipped");
-      return ok(undefined);
-    }
-  }
+  const workDir = skillInstallDir(
+    record.name,
+    record.scope as "global" | "project",
+    options.projectRoot,
+  );
 
   const fetchResult = await fetch(workDir);
   if (!fetchResult.ok) return fetchResult;
@@ -338,69 +322,42 @@ async function updateGitSkill(
     return ok(undefined);
   }
 
-  // Get diff (path-filtered for multi-skill)
-  const pathSpec = record.path ?? undefined;
-  const diffResult = await diff(workDir, "HEAD", "FETCH_HEAD", pathSpec);
+  const diffResult = await diff(workDir, "HEAD", "FETCH_HEAD");
   if (!diffResult.ok) return diffResult;
-  const diffOutput = diffResult.value;
 
-  const statResult = await diffStat(workDir, "HEAD", "FETCH_HEAD", pathSpec);
+  const statResult = await diffStat(workDir, "HEAD", "FETCH_HEAD");
   if (!statResult.ok) return statResult;
   const stat = statResult.value;
 
-  // If skill-specific path has no changes, mark as up to date
-  if (stat.filesChanged === 0) {
-    result.upToDate.push(record.name);
-    options.onProgress?.(record.name, "upToDate");
-    return ok(undefined);
-  }
-
   options.onDiff?.(record.name, stat, localSha, remoteSha);
 
-  // Security scan on diff + confirmation
-  const warnings = scanDiff(diffOutput);
+  const warnings = scanDiff(diffResult.value);
   if (await shouldSkipUpdate(warnings, options, record.name)) {
     result.skipped.push(record.name);
     options.onProgress?.(record.name, "skipped");
     return ok(undefined);
   }
 
-  // Apply update
   const pullResult = await pull(workDir);
   if (!pullResult.ok) return pullResult;
 
-  if (isMulti) {
-    const recopyResult = await recopyMultiSkill(workDir, record, options.projectRoot);
-    if (!recopyResult.ok) return recopyResult;
-  }
-
-  const installDir = skillInstallDir(
-    record.name,
-    record.scope as "global" | "project",
-    options.projectRoot,
-  );
-
-  // Semantic scan on updated skill directory
-  if (await runUpdateSemanticScan(installDir, record.name, options)) {
+  if (await runUpdateSemanticScan(workDir, record.name, options)) {
     result.skipped.push(record.name);
     options.onProgress?.(record.name, "skipped");
     return ok(undefined);
   }
 
-  // Get new SHA
   const newShaResult = await revParse(workDir, "HEAD");
   if (!newShaResult.ok) return newShaResult;
 
-  // Re-verify trust for the updated skill
   const newTrust = await _resolveTrust({
     adapter: "git",
     url: record.repo ?? "",
     tap: record.tap,
-    skillDir: installDir,
+    skillDir: workDir,
     githubRepo: record.repo ? parseGitHubRepo(record.repo) : null,
   });
 
-  // Update the record in place
   patchRecord(installed, record, {
     sha: newShaResult.value,
     updatedAt: new Date().toISOString(),
@@ -414,19 +371,232 @@ async function updateGitSkill(
   return ok(undefined);
 }
 
+/** Handle updates for a group of skills sharing the same multi-skill git repo cache. */
+async function updateGitSkillGroup(
+  repo: string,
+  skills: InstalledSkill[],
+  installed: { skills: InstalledSkill[] },
+  options: UpdateOptions,
+  result: UpdateResult,
+  _resolveTrust: ResolveTrustFn,
+): Promise<Result<void, UserError | GitError | ScanError>> {
+  const workDir = skillCacheDir(repo);
+
+  // Verify cache exists
+  const cacheGitExists = await lstat(join(workDir, ".git"))
+    .then(() => true)
+    .catch(() => false);
+  if (!cacheGitExists) {
+    for (const skill of skills) {
+      result.skipped.push(skill.name);
+      options.onProgress?.(skill.name, "skipped");
+    }
+    return ok(undefined);
+  }
+
+  // Fetch once for the whole group
+  const fetchResult = await fetch(workDir);
+  if (!fetchResult.ok) return fetchResult;
+
+  // Capture SHAs BEFORE any pull
+  const localShaResult = await revParse(workDir, "HEAD");
+  if (!localShaResult.ok) return localShaResult;
+  const remoteShaResult = await revParse(workDir, "FETCH_HEAD");
+  if (!remoteShaResult.ok) return remoteShaResult;
+
+  const localSha = localShaResult.value;
+  const remoteSha = remoteShaResult.value;
+
+  // If the whole repo is up to date, all skills in the group are too
+  if (localSha === remoteSha) {
+    for (const skill of skills) {
+      result.upToDate.push(skill.name);
+      options.onProgress?.(skill.name, "upToDate");
+    }
+    return ok(undefined);
+  }
+
+  // Per-skill: check path-specific diff, scan, confirm
+  const toUpdate: InstalledSkill[] = [];
+  for (const skill of skills) {
+    options.onProgress?.(skill.name, "checking");
+
+    // biome-ignore lint/style/noNonNullAssertion: multi-skill records always have path
+    const pathSpec = skill.path!;
+
+    const statResult = await diffStat(workDir, "HEAD", "FETCH_HEAD", pathSpec);
+    if (!statResult.ok) return statResult;
+    const stat = statResult.value;
+
+    if (stat.filesChanged === 0) {
+      result.upToDate.push(skill.name);
+      options.onProgress?.(skill.name, "upToDate");
+      continue;
+    }
+
+    options.onDiff?.(skill.name, stat, localSha, remoteSha);
+
+    const diffResult = await diff(workDir, "HEAD", "FETCH_HEAD", pathSpec);
+    if (!diffResult.ok) return diffResult;
+
+    const warnings = scanDiff(diffResult.value);
+    if (await shouldSkipUpdate(warnings, options, skill.name)) {
+      result.skipped.push(skill.name);
+      options.onProgress?.(skill.name, "skipped");
+      continue;
+    }
+
+    toUpdate.push(skill);
+  }
+
+  if (toUpdate.length === 0) return ok(undefined);
+
+  // Pull once for the whole group
+  const pullResult = await pull(workDir);
+  if (!pullResult.ok) return pullResult;
+
+  const newShaResult = await revParse(workDir, "HEAD");
+  if (!newShaResult.ok) return newShaResult;
+  const newSha = newShaResult.value;
+
+  // Apply update to each confirmed skill
+  for (const skill of toUpdate) {
+    const recopyResult = await recopyMultiSkill(workDir, skill, options.projectRoot);
+    if (!recopyResult.ok) return recopyResult;
+
+    const installDir = skillInstallDir(
+      skill.name,
+      skill.scope as "global" | "project",
+      options.projectRoot,
+    );
+
+    if (await runUpdateSemanticScan(installDir, skill.name, options)) {
+      result.skipped.push(skill.name);
+      options.onProgress?.(skill.name, "skipped");
+      continue;
+    }
+
+    const newTrust = await _resolveTrust({
+      adapter: "git",
+      url: skill.repo ?? "",
+      tap: skill.tap,
+      skillDir: installDir,
+      githubRepo: skill.repo ? parseGitHubRepo(skill.repo) : null,
+    });
+
+    patchRecord(installed, skill, {
+      sha: newSha,
+      updatedAt: new Date().toISOString(),
+      trust: newTrust,
+    });
+
+    await refreshAgentSymlinks(skill, options.projectRoot);
+
+    result.updated.push(skill.name);
+    options.onProgress?.(skill.name, "updated");
+  }
+
+  return ok(undefined);
+}
+
+type SkillGroup =
+  | { type: "linked"; skill: InstalledSkill }
+  | { type: "npm"; skill: InstalledSkill }
+  | { type: "git-standalone"; skill: InstalledSkill }
+  | { type: "git-multi"; repo: string; skills: InstalledSkill[] };
+
+/** Group skills by update strategy. Multi-skill records sharing a repo cache are grouped together. */
+function groupSkillsByRepo(skills: InstalledSkill[]): SkillGroup[] {
+  const multiGroups = new Map<string, InstalledSkill[]>();
+  const solo: SkillGroup[] = [];
+
+  for (const skill of skills) {
+    if (skill.scope === "linked") {
+      solo.push({ type: "linked", skill });
+      continue;
+    }
+    if (skill.repo?.startsWith("npm:")) {
+      solo.push({ type: "npm", skill });
+      continue;
+    }
+    if (skill.path !== null && skill.repo) {
+      const existing = multiGroups.get(skill.repo);
+      if (existing) {
+        existing.push(skill);
+      } else {
+        multiGroups.set(skill.repo, [skill]);
+      }
+    } else {
+      solo.push({ type: "git-standalone", skill });
+    }
+  }
+
+  const groups: SkillGroup[] = [...solo];
+  for (const [repo, skills] of multiGroups) {
+    groups.push({ type: "git-multi", repo, skills });
+  }
+  return groups;
+}
+
+async function runUpdatePass(
+  skills: InstalledSkill[],
+  installed: InstalledJson,
+  options: UpdateOptions,
+  result: UpdateResult,
+  _resolveTrust: ResolveTrustFn,
+): Promise<Result<void, UserError | GitError | ScanError | NetworkError>> {
+  const groups = groupSkillsByRepo(skills);
+
+  for (const group of groups) {
+    if (group.type === "linked") {
+      options.onProgress?.(group.skill.name, "linked");
+      continue;
+    }
+
+    if (group.type === "npm") {
+      options.onProgress?.(group.skill.name, "checking");
+      const r = await updateNpmSkill(group.skill, installed, options, result, _resolveTrust);
+      if (!r.ok) return r;
+    } else if (group.type === "git-standalone") {
+      options.onProgress?.(group.skill.name, "checking");
+      const r = await updateGitSkill(group.skill, installed, options, result, _resolveTrust);
+      if (!r.ok) return r;
+    } else {
+      const r = await updateGitSkillGroup(group.repo, group.skills, installed, options, result, _resolveTrust);
+      if (!r.ok) return r;
+    }
+  }
+
+  return ok(undefined);
+}
+
 export async function updateSkill(
   options: UpdateOptions = {},
   _resolveTrust: ResolveTrustFn = resolveTrust,
 ): Promise<Result<UpdateResult, UserError | GitError | ScanError | NetworkError>> {
   debug("updateSkill", { name: options.name ?? "all" });
-  const installedResult = await loadInstalled();
-  if (!installedResult.ok) return installedResult;
-  const installed = installedResult.value;
 
-  let skills = installed.skills;
+  // Load global installed
+  const globalInstalledResult = await loadInstalled();
+  if (!globalInstalledResult.ok) return globalInstalledResult;
+  const globalInstalled = globalInstalledResult.value;
+
+  // Optionally load project installed
+  let projectInstalled: InstalledJson | null = null;
+  if (options.projectRoot) {
+    const r = await loadInstalled(options.projectRoot);
+    if (!r.ok) return r;
+    projectInstalled = r.value;
+  }
+
+  // Filter by name if specified — check both files
+  let globalSkills = globalInstalled.skills;
+  let projectSkills = projectInstalled?.skills ?? [];
+
   if (options.name) {
-    const found = skills.filter((s) => s.name === options.name);
-    if (found.length === 0) {
+    globalSkills = globalSkills.filter((s) => s.name === options.name);
+    projectSkills = projectSkills.filter((s) => s.name === options.name);
+    if (globalSkills.length === 0 && projectSkills.length === 0) {
       return err(
         new UserError(
           `Skill '${options.name}' is not installed.`,
@@ -434,31 +604,28 @@ export async function updateSkill(
         ),
       );
     }
-    skills = found;
   }
 
   const result: UpdateResult = { updated: [], skipped: [], upToDate: [] };
 
-  for (const record of skills) {
-    if (record.scope === "linked") {
-      options.onProgress?.(record.name, "linked");
-      continue;
-    }
-
-    options.onProgress?.(record.name, "checking");
+  // Process global skills
+  const globalPass = await runUpdatePass(globalSkills, globalInstalled, options, result, _resolveTrust);
+  if (!globalPass.ok) return globalPass;
 
-    // Dispatch to adapter-specific update handler
-    if (record.repo?.startsWith("npm:")) {
-      const npmResult = await updateNpmSkill(record, installed, options, result, _resolveTrust);
-      if (!npmResult.ok) return npmResult;
-    } else {
-      const gitResult = await updateGitSkill(record, installed, options, result, _resolveTrust);
-      if (!gitResult.ok) return gitResult;
-    }
+  // Process project skills
+  if (projectInstalled) {
+    const projectPass = await runUpdatePass(projectSkills, projectInstalled, { ...options, projectRoot: options.projectRoot }, result, _resolveTrust);
+    if (!projectPass.ok) return projectPass;
   }
 
-  const saveResult = await saveInstalled(installed);
-  if (!saveResult.ok) return saveResult;
+  // Save both files
+  const globalSave = await saveInstalled(globalInstalled);
+  if (!globalSave.ok) return globalSave;
+
+  if (projectInstalled && options.projectRoot) {
+    const projectSave = await saveInstalled(projectInstalled, options.projectRoot);
+    if (!projectSave.ok) return projectSave;
+  }
 
   return ok(result);
 }