@tec-explorer/skillpot 0.6.0 → 0.8.0

package/dist/cli.mjs

@@ -39109,7 +39109,28 @@ var DANGEROUS_PATTERNS = [
   [/\bcurl\s+[^\n|]*\|\s*(?:ba|z)?sh\b/, "curl \u7BA1\u9053\u6267\u884C\u811A\u672C"],
   [/\bwget\s+[^\n|]*\|\s*(?:ba|z)?sh\b/, "wget \u7BA1\u9053\u6267\u884C\u811A\u672C"],
   [/\bsudo\b/, "sudo \u63D0\u6743"],
-  [/\bchmod\s+777\b/, "chmod 777 \u5F00\u653E\u5199\u6743\u9650"]
+  [/\bchmod\s+777\b/, "chmod 777 \u5F00\u653E\u5199\u6743\u9650"],
+  // —— 凭据与敏感信息（§9.1：读取 env / credentials）——
+  [/\.ssh[/']|\.aws[/']|\.kube[/']|\.netrc\b/, "\u89E6\u78B0 SSH/\u4E91\u5382\u5546\u51ED\u636E\u6587\u4EF6"],
+  [
+    /\b(?:API[_-]?KEY|APIKEY|SECRET[_-]?KEY|ACCESS[_-]?TOKEN|PRIVATE[_-]?KEY|AWS_SECRET[_-]?ACCESS[_-]?KEY)\b/i,
+    "\u5F15\u7528\u5BC6\u94A5\u7C7B\u6807\u8BC6\u7B26"
+  ],
+  [/\bprintenv\b/, "printenv \u5BFC\u51FA\u73AF\u5883\u53D8\u91CF"],
+  [
+    /process\.env\.[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)\w*/i,
+    "\u8BFB\u53D6 Node \u5BC6\u94A5\u7C7B\u73AF\u5883\u53D8\u91CF"
+  ],
+  // —— 外发数据（§9.1：外发网络请求）——
+  [
+    /\bcurl\b[^\n]*(?:-X\s*(?:POST|PUT)\b|--data(?:-binary|-raw|-urlencode)?\b|--form\b|--upload-file\b|\s-T\s)/,
+    "curl \u5411\u5916\u53D1\u9001\u6570\u636E\uFF08POST/PUT/\u4E0A\u4F20\uFF09"
+  ],
+  [/\bwget\b[^\n]*--(?:post-data|post-file)\b/, "wget \u5411\u5916\u53D1\u9001\u6570\u636E"],
+  [/\bnc\b[^\n]*\s-e\b/, "nc -e \u8FDC\u7A0B\u6267\u884C/\u53CD\u5F39 shell"],
+  [/\b(?:scp|rsync)\b[^\n]*\b\w+@(?!localhost|127\.0\.0\.1)/, "\u5411\u8FDC\u7AEF\u4E3B\u673A\u62F7\u8D1D\u6587\u4EF6"],
+  // —— 反取证 ——
+  [/\.(?:bash|zsh)_history/, "\u89E6\u78B0 shell \u5386\u53F2\u6587\u4EF6"]
 ];
 var SCRIPT_EXT = /\.(sh|bash|zsh|py|js|mjs|cjs|ts|rb|pl)$/;
 function lintSkill(dir) {
@@ -39227,14 +39248,15 @@ import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 var execFileP2 = promisify2(execFile2);
 var OFFICIAL_URL = "https://github.com/anthropics/skills.git";
-var OFFICIAL = {
-  name: "Anthropic \u5B98\u65B9\u6280\u80FD\u5E93",
-  url: OFFICIAL_URL,
-  builtin: true
-};
+var BUILTIN_SOURCES = [
+  { name: "Anthropic \u5B98\u65B9\u6280\u80FD\u5E93", url: OFFICIAL_URL, builtin: true },
+  { name: "Vercel \u5B98\u65B9\u6280\u80FD\u96C6", url: "https://github.com/vercel-labs/agent-skills.git", builtin: true },
+  { name: "Superpowers \u793E\u533A\u6280\u80FD\u96C6", url: "https://github.com/obra/superpowers.git", builtin: true },
+  { name: "Matt Pocock \u6280\u80FD\u96C6", url: "https://github.com/mattpocock/skills.git", builtin: true }
+];
 function listSources() {
   const config = loadConfig();
-  return [OFFICIAL, ...(config.sources ?? []).map((s) => ({ name: s.name ?? urlLabel(s.url), url: s.url, builtin: false }))];
+  return [...BUILTIN_SOURCES, ...(config.sources ?? []).map((s) => ({ name: s.name ?? urlLabel(s.url), url: s.url, builtin: false }))];
 }
 function urlLabel(url) {
   const tail = url.replace(/\.git$/, "").replace(/\/+$/, "");
@@ -39242,7 +39264,7 @@ function urlLabel(url) {
 }
 function addSource(url, name) {
   if (!isGitSource(url)) throw new Error(`\u4E0D\u662F\u5408\u6CD5\u7684 git \u5730\u5740\uFF1A${url}`);
-  if (url === OFFICIAL_URL) throw new Error("\u5B98\u65B9\u6E90\u5DF2\u5185\u7F6E\uFF0C\u65E0\u9700\u6DFB\u52A0");
+  if (BUILTIN_SOURCES.some((s) => s.url === url)) throw new Error("\u5185\u7F6E\u6E90\u5DF2\u5B58\u5728\uFF0C\u65E0\u9700\u6DFB\u52A0");
   const config = loadConfig();
   config.sources = config.sources ?? [];
   if (config.sources.some((s) => s.url === url)) throw new Error(`\u6E90\u5DF2\u5B58\u5728\uFF1A${url}`);
@@ -39256,7 +39278,7 @@ function addSource(url, name) {
   return { name: entry.name ?? urlLabel(url), url, builtin: false };
 }
 function removeSource(url) {
-  if (url === OFFICIAL_URL) throw new Error("\u5185\u7F6E\u6E90\u4E0D\u53EF\u79FB\u9664");
+  if (BUILTIN_SOURCES.some((s) => s.url === url)) throw new Error("\u5185\u7F6E\u6E90\u4E0D\u53EF\u79FB\u9664");
   const config = loadConfig();
   const before = (config.sources ?? []).length;
   config.sources = (config.sources ?? []).filter((s) => s.url !== url);
@@ -39319,25 +39341,114 @@ async function installFromMarket(url, subdir, opts = {}) {
   return addSkill(`${url}#${subdir}`, { name: opts.name, for: opts.for });
 }
 
-// src/core/doctor.ts
+// src/tui/matrix.ts
 import fs8 from "node:fs";
 import path11 from "node:path";
+function deriveMatrix(agents) {
+  const config = loadConfig();
+  const skills = Object.keys(config.skills).sort();
+  const list = agents ?? detectAll().map((r) => ({
+    id: r.id,
+    name: r.name,
+    installed: r.installed,
+    skillsDir: r.skillsDir
+  }));
+  const cells = {};
+  for (const s of skills) {
+    cells[s] = {};
+    for (const a of list) {
+      const target = path11.join(a.skillsDir, s);
+      let actual = false;
+      let managed = false;
+      try {
+        const st = fs8.lstatSync(target);
+        actual = true;
+        managed = st.isSymbolicLink() && fs8.realpathSync(target) === fs8.realpathSync(skillDir(s));
+      } catch {
+      }
+      cells[s][a.id] = {
+        enabled: config.skills[s].expose[a.id] === true,
+        actual,
+        managed
+      };
+    }
+  }
+  return { skills, agents: list, cells };
+}
+
+// src/core/audit.ts
+function runAudit() {
+  const matrix = deriveMatrix();
+  const config = loadConfig();
+  const agents = [];
+  for (const a of matrix.agents) {
+    if (!a.installed) continue;
+    const active = [];
+    const external = [];
+    const findings = [];
+    for (const skill of matrix.skills) {
+      const cs = matrix.cells[skill]?.[a.id];
+      if (!cs) continue;
+      if (cs.actual && cs.managed) {
+        active.push({
+          skill,
+          source: config.skills[skill]?.source ?? "\u672A\u767B\u8BB0\uFF08\u4E2D\u592E\u4ED3\u5E93\u5B58\u5728\u4F46 config \u7F3A\u5931\uFF09",
+          enabled: cs.enabled
+        });
+        if (!cs.enabled) {
+          findings.push({
+            level: "warn",
+            agent: a.id,
+            message: `'${skill}' \u53D7\u7BA1\u94FE\u63A5\u4ECD\u5B58\u5728\uFF0C\u4F46\u77E9\u9635\u5DF2\u58F0\u660E\u5173\u95ED\uFF08disable \u6216 doctor --fix \u53EF\u6E05\u7406\uFF09`
+          });
+        }
+      } else if (cs.actual && !cs.managed) {
+        external.push({ name: skill, path: `${a.skillsDir}/${skill}` });
+        if (cs.enabled) {
+          findings.push({
+            level: "error",
+            agent: a.id,
+            message: `'${skill}' \u58F0\u660E\u5BF9 ${a.id} \u5F00\u653E\uFF0C\u4F46\u8BE5\u4F4D\u7F6E\u88AB\u5916\u90E8\u540C\u540D\u6761\u76EE\u5360\u7528\u2014\u2014\u5B9E\u9645\u751F\u6548\u7684\u4E0D\u662F\u4E2D\u592E\u4ED3\u5E93\u7248\u672C\uFF08\u53EF\u80FD\u88AB\u7ED5\u8FC7/\u906E\u853D\uFF09`
+          });
+        }
+      } else if (cs.enabled && !cs.actual) {
+        findings.push({
+          level: "warn",
+          agent: a.id,
+          message: `'${skill}' \u58F0\u660E\u5F00\u653E\u4F46\u94FE\u63A5\u7F3A\u5931\uFF08\u6F02\u79FB\uFF0Cdoctor --fix \u53EF\u91CD\u540C\u6B65\uFF09`
+        });
+      }
+    }
+    agents.push({
+      agent: a.id,
+      agentName: a.name,
+      active,
+      external,
+      findings
+    });
+  }
+  return { agents, generatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+
+// src/core/doctor.ts
+import fs9 from "node:fs";
+import path12 from "node:path";
 function runDoctor() {
   const issues = [];
   const config = loadConfig();
   const state = loadState();
   const home = agentHome();
   for (const [name, entry] of Object.entries(config.skills)) {
-    if (!fs8.existsSync(path11.join(skillDir(name), "SKILL.md"))) {
+    if (!fs9.existsSync(path12.join(skillDir(name), "SKILL.md"))) {
       issues.push({
         level: "error",
         message: `config \u4E2D\u7684 '${name}' \u5728\u4E2D\u592E\u4ED3\u5E93\u7F3A\u5931\uFF08source=${entry.source}\uFF09`
       });
     }
   }
-  if (fs8.existsSync(storeDir())) {
-    for (const e of fs8.readdirSync(storeDir(), { withFileTypes: true })) {
-      if (e.isDirectory() && !config.skills[e.name] && fs8.existsSync(path11.join(storeDir(), e.name, "SKILL.md"))) {
+  if (fs9.existsSync(storeDir())) {
+    for (const e of fs9.readdirSync(storeDir(), { withFileTypes: true })) {
+      if (e.isDirectory() && !config.skills[e.name] && fs9.existsSync(path12.join(storeDir(), e.name, "SKILL.md"))) {
         issues.push({
           level: "warn",
           message: `\u4E2D\u592E\u4ED3\u5E93\u4E2D\u7684 '${e.name}' \u672A\u767B\u8BB0\u8FDB config\uFF08\u624B\u52A8\u62F7\u5165\uFF1F\uFF09`,
@@ -39349,7 +39460,7 @@ function runDoctor() {
   for (const link2 of state.links) {
     let st = null;
     try {
-      st = fs8.lstatSync(link2.link_path);
+      st = fs9.lstatSync(link2.link_path);
     } catch {
     }
     if (!st) {
@@ -39367,7 +39478,7 @@ function runDoctor() {
       });
       continue;
     }
-    if (!fs8.existsSync(link2.link_path)) {
+    if (!fs9.existsSync(link2.link_path)) {
       issues.push({
         level: "error",
         message: `\u65AD\u94FE\uFF1A${link2.link_path} \u6307\u5411\u7684\u76EE\u6807\u4E0D\u5B58\u5728`,
@@ -39377,19 +39488,19 @@ function runDoctor() {
   }
   for (const agent of AGENTS) {
     const dir = agent.skillsDir(home);
-    if (!fs8.existsSync(dir)) continue;
+    if (!fs9.existsSync(dir)) continue;
     let entries = [];
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs9.readdirSync(dir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const e of entries) {
       if (!e.isSymbolicLink()) continue;
-      const linkPath = path11.join(dir, e.name);
+      const linkPath = path12.join(dir, e.name);
       let target = "";
       try {
-        target = fs8.readlinkSync(linkPath);
+        target = fs9.readlinkSync(linkPath);
       } catch {
         continue;
       }
@@ -39405,8 +39516,8 @@ function runDoctor() {
   }
   for (const [name, entry] of Object.entries(config.skills)) {
     for (const agent of AGENTS) {
-      const target = path11.join(agent.skillsDir(home), name);
-      const exposed = fs8.existsSync(target);
+      const target = path12.join(agent.skillsDir(home), name);
+      const exposed = fs9.existsSync(target);
       const wanted = entry.expose[agent.id] === true;
       if (wanted && !exposed) {
         issues.push({
@@ -39431,7 +39542,7 @@ function fixDoctor() {
   state.links = state.links.filter((l) => {
     let ok = false;
     try {
-      ok = fs8.existsSync(l.link_path) && fs8.lstatSync(l.link_path).isSymbolicLink();
+      ok = fs9.existsSync(l.link_path) && fs9.lstatSync(l.link_path).isSymbolicLink();
     } catch {
       ok = false;
     }
@@ -39444,10 +39555,10 @@ function fixDoctor() {
   saveState(state);
   const config = loadConfig();
   for (const [name, entry] of Object.entries(config.skills)) {
-    if (!fs8.existsSync(path11.join(skillDir(name), "SKILL.md"))) continue;
+    if (!fs9.existsSync(path12.join(skillDir(name), "SKILL.md"))) continue;
     for (const agent of AGENTS) {
-      const target = path11.join(agent.skillsDir(agentHome()), name);
-      const exposed = fs8.existsSync(target);
+      const target = path12.join(agent.skillsDir(agentHome()), name);
+      const exposed = fs9.existsSync(target);
       const wanted = entry.expose[agent.id] === true;
       if (wanted && !exposed) {
         try {
@@ -39469,7 +39580,7 @@ function fixDoctor() {
 function isOurSymlink(target, state, skill, agentId) {
   let isLink = false;
   try {
-    isLink = fs8.lstatSync(target).isSymbolicLink();
+    isLink = fs9.lstatSync(target).isSymbolicLink();
   } catch {
     return false;
   }
@@ -39480,13 +39591,13 @@ function isOurSymlink(target, state, skill, agentId) {
   if (inLedger) return true;
   let real = null;
   try {
-    real = fs8.realpathSync(target);
+    real = fs9.realpathSync(target);
   } catch {
     return false;
   }
   let storeReal = null;
   try {
-    storeReal = fs8.realpathSync(skillDir(skill));
+    storeReal = fs9.realpathSync(skillDir(skill));
   } catch {
     return false;
   }
@@ -39494,21 +39605,21 @@ function isOurSymlink(target, state, skill, agentId) {
 }
 function sameRealPath(a, b) {
   try {
-    return fs8.realpathSync(a) === fs8.realpathSync(b);
+    return fs9.realpathSync(a) === fs9.realpathSync(b);
   } catch {
     return false;
   }
 }
 
 // src/core/adopt.ts
-import fs9 from "node:fs";
-import path12 from "node:path";
+import fs10 from "node:fs";
+import path13 from "node:path";
 function isManagedByStore(dir) {
   try {
-    if (!fs9.lstatSync(dir).isSymbolicLink()) return false;
-    const real = fs9.realpathSync(dir);
-    const storeReal = fs9.realpathSync(storeDir());
-    return real === storeReal || real.startsWith(storeReal + path12.sep);
+    if (!fs10.lstatSync(dir).isSymbolicLink()) return false;
+    const real = fs10.realpathSync(dir);
+    const storeReal = fs10.realpathSync(storeDir());
+    return real === storeReal || real.startsWith(storeReal + path13.sep);
   } catch {
     return false;
   }
@@ -39517,13 +39628,13 @@ function scanAgentSkills(agentId) {
   const agent = getAgent(agentId);
   if (!agent) throw new Error(`\u672A\u77E5 agent '${agentId}'`);
   const dir = agent.skillsDir(agentHome());
-  if (!fs9.existsSync(dir)) return [];
+  if (!fs10.existsSync(dir)) return [];
   const out = [];
-  for (const e of fs9.readdirSync(dir, { withFileTypes: true })) {
+  for (const e of fs10.readdirSync(dir, { withFileTypes: true })) {
     if (e.name.startsWith(".")) continue;
     if (!e.isDirectory() && !e.isSymbolicLink()) continue;
-    const p = path12.join(dir, e.name);
-    if (!fs9.existsSync(path12.join(p, "SKILL.md"))) continue;
+    const p = path13.join(dir, e.name);
+    if (!fs10.existsSync(path13.join(p, "SKILL.md"))) continue;
     out.push({ name: e.name, path: p });
   }
   return out;
@@ -39531,7 +39642,7 @@ function scanAgentSkills(agentId) {
 function scanAdoptable(agentId) {
   return scanAgentSkills(agentId).filter((s) => {
     try {
-      return !fs9.lstatSync(s.path).isSymbolicLink();
+      return !fs10.lstatSync(s.path).isSymbolicLink();
     } catch {
       return false;
     }
@@ -39562,7 +39673,7 @@ function adoptSkills(opts = {}) {
       }
       let isOwnSymlink = false;
       try {
-        isOwnSymlink = fs9.lstatSync(skill.path).isSymbolicLink();
+        isOwnSymlink = fs10.lstatSync(skill.path).isSymbolicLink();
       } catch {
       }
       if (isOwnSymlink) {
@@ -39582,7 +39693,7 @@ function adoptSkills(opts = {}) {
         items.push({ agent: agentId, name: skill.name, path: skill.path, status: "skipped-invalid", detail: "\u76EE\u5F55\u540D\u4E0D\u5408\u6CD5" });
         continue;
       }
-      const existsInStore = !!config.skills[name] || fs9.existsSync(skillDir(name));
+      const existsInStore = !!config.skills[name] || fs10.existsSync(skillDir(name));
       if (opts.dryRun) {
         items.push({
           agent: agentId,
@@ -39639,7 +39750,7 @@ function adoptSkills(opts = {}) {
   saveConfig(config);
   for (const mv of pendingMoves) {
     try {
-      fs9.rmSync(mv.path, { recursive: true, force: true });
+      fs10.rmSync(mv.path, { recursive: true, force: true });
       enableSkill(mv.name, [mv.agentId]);
       items.push({
         agent: mv.agentId,
@@ -39674,30 +39785,56 @@ function adoptSkills(opts = {}) {
 }
 
 // src/core/update.ts
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import os3 from "node:os";
-import path13 from "node:path";
+import path14 from "node:path";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 var execFileP3 = promisify3(execFile3);
+function diffTree(oldDir, newDir) {
+  const IGNORED2 = /* @__PURE__ */ new Set([".git"]);
+  const collect = (root) => {
+    const map = /* @__PURE__ */ new Map();
+    const walk = (d) => {
+      for (const e of fs11.readdirSync(d, { withFileTypes: true })) {
+        if (IGNORED2.has(e.name)) continue;
+        const p = path14.join(d, e.name);
+        if (e.isDirectory()) walk(p);
+        else if (e.isFile()) map.set(path14.relative(root, p), p);
+      }
+    };
+    walk(root);
+    return map;
+  };
+  const oldFiles = collect(oldDir);
+  const newFiles = collect(newDir);
+  const diff2 = { added: [], removed: [], modified: [] };
+  for (const [rel, p] of newFiles) {
+    if (!oldFiles.has(rel)) diff2.added.push(rel);
+    else if (fs11.readFileSync(p) !== fs11.readFileSync(oldFiles.get(rel))) diff2.modified.push(rel);
+  }
+  for (const rel of oldFiles.keys()) if (!newFiles.has(rel)) diff2.removed.push(rel);
+  for (const k of ["added", "removed", "modified"]) diff2[k].sort();
+  return diff2;
+}
 function parseGitSource(source) {
   return source.startsWith("git:") ? source.slice(4) : null;
 }
 async function fetchRemote(repoSpec) {
   const [url, sub] = repoSpec.split("#");
-  const cloneDir = fs10.mkdtempSync(path13.join(os3.tmpdir(), "skillpot-update-"));
+  const cloneDir = fs11.mkdtempSync(path14.join(os3.tmpdir(), "skillpot-update-"));
   try {
     await execFileP3("git", ["clone", "--depth", "1", url, cloneDir], {
       timeout: 3e5,
       maxBuffer: 16 * 1024 * 1024
     });
-    const contentDir = sub ? path13.join(cloneDir, sub) : cloneDir;
-    if (!fs10.existsSync(path13.join(contentDir, "SKILL.md"))) {
+    const contentDir = sub ? path14.join(cloneDir, sub) : cloneDir;
+    if (!fs11.existsSync(path14.join(contentDir, "SKILL.md"))) {
       throw new Error(`\u8FDC\u7AEF ${sub ? `#${sub} ` : ""}\u4E2D\u6CA1\u6709 SKILL.md`);
     }
     return { checksum: dirChecksum(contentDir), cloneDir, sub };
   } catch (e) {
-    fs10.rmSync(cloneDir, { recursive: true, force: true });
+    fs11.rmSync(cloneDir, { recursive: true, force: true });
     throw e;
   }
 }
@@ -39716,7 +39853,7 @@ async function updateSkills(name, opts = {}) {
       results.push({ skill: n, status: "local", detail: entry.source });
       continue;
     }
-    if (!fs10.existsSync(skillDir(n))) {
+    if (!fs11.existsSync(skillDir(n))) {
       results.push({ skill: n, status: "error", detail: "\u4E2D\u592E\u4ED3\u5E93\u7F3A\u5931" });
       continue;
     }
@@ -39727,24 +39864,35 @@ async function updateSkills(name, opts = {}) {
           results.push({ skill: n, status: "up-to-date" });
           continue;
         }
+        const srcDir = fetched.sub ? path14.join(fetched.cloneDir, fetched.sub) : fetched.cloneDir;
+        const diff2 = diffTree(skillDir(n), srcDir);
         if (opts.check) {
-          results.push({ skill: n, status: "outdated", detail: `\u8FDC\u7AEF ${fetched.checksum.slice(0, 15)}` });
+          results.push({
+            skill: n,
+            status: "outdated",
+            detail: `\u8FDC\u7AEF ${fetched.checksum.slice(0, 15)}`,
+            diff: diff2
+          });
           continue;
         }
-        const staging = fs10.mkdtempSync(path13.join(os3.tmpdir(), "skillpot-new-"));
+        const staging = fs11.mkdtempSync(path14.join(os3.tmpdir(), "skillpot-new-"));
         try {
-          const srcDir = fetched.sub ? path13.join(fetched.cloneDir, fetched.sub) : fetched.cloneDir;
-          fs10.cpSync(srcDir, staging, { recursive: true });
-          fs10.rmSync(skillDir(n), { recursive: true, force: true });
-          fs10.cpSync(staging, skillDir(n), { recursive: true });
+          fs11.cpSync(srcDir, staging, { recursive: true });
+          fs11.rmSync(skillDir(n), { recursive: true, force: true });
+          fs11.cpSync(staging, skillDir(n), { recursive: true });
         } finally {
-          fs10.rmSync(staging, { recursive: true, force: true });
+          fs11.rmSync(staging, { recursive: true, force: true });
         }
         entry.checksum = dirChecksum(skillDir(n));
         entry.installed_at = (/* @__PURE__ */ new Date()).toISOString();
-        results.push({ skill: n, status: "updated", detail: entry.checksum.slice(0, 15) });
+        results.push({
+          skill: n,
+          status: "updated",
+          detail: entry.checksum.slice(0, 15),
+          diff: diff2
+        });
       } finally {
-        fs10.rmSync(fetched.cloneDir, { recursive: true, force: true });
+        fs11.rmSync(fetched.cloneDir, { recursive: true, force: true });
       }
     } catch (e) {
       results.push({ skill: n, status: "error", detail: e instanceof Error ? e.message : String(e) });
@@ -39758,21 +39906,21 @@ async function updateSkills(name, opts = {}) {
 import readline from "node:readline";
 
 // src/core/skill-detail.ts
-import fs11 from "node:fs";
-import path14 from "node:path";
+import fs12 from "node:fs";
+import path15 from "node:path";
 function readSkillDetail(name) {
   const dir = skillDir(name);
-  const mdPath = path14.join(dir, "SKILL.md");
-  if (!fs11.existsSync(mdPath)) return null;
+  const mdPath = path15.join(dir, "SKILL.md");
+  if (!fs12.existsSync(mdPath)) return null;
   const files = [];
   const walk = (d) => {
-    for (const e of fs11.readdirSync(d, { withFileTypes: true })) {
-      const p = path14.join(d, e.name);
+    for (const e of fs12.readdirSync(d, { withFileTypes: true })) {
+      const p = path15.join(d, e.name);
       if (e.isDirectory()) {
-        files.push(path14.relative(dir, p) + "/");
+        files.push(path15.relative(dir, p) + "/");
         walk(p);
       } else {
-        files.push(path14.relative(dir, p));
+        files.push(path15.relative(dir, p));
       }
     }
   };
@@ -39781,7 +39929,7 @@ function readSkillDetail(name) {
     name,
     meta: readSkillMeta(dir),
     files: files.sort(),
-    skillMd: fs11.readFileSync(mdPath, "utf8")
+    skillMd: fs12.readFileSync(mdPath, "utf8")
   };
 }
 
@@ -39918,41 +40066,6 @@ import path16 from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
-// src/tui/matrix.ts
-import fs12 from "node:fs";
-import path15 from "node:path";
-function deriveMatrix(agents) {
-  const config = loadConfig();
-  const skills = Object.keys(config.skills).sort();
-  const list = agents ?? detectAll().map((r) => ({
-    id: r.id,
-    name: r.name,
-    installed: r.installed,
-    skillsDir: r.skillsDir
-  }));
-  const cells = {};
-  for (const s of skills) {
-    cells[s] = {};
-    for (const a of list) {
-      const target = path15.join(a.skillsDir, s);
-      let actual = false;
-      let managed = false;
-      try {
-        const st = fs12.lstatSync(target);
-        actual = true;
-        managed = st.isSymbolicLink() && fs12.realpathSync(target) === fs12.realpathSync(skillDir(s));
-      } catch {
-      }
-      cells[s][a.id] = {
-        enabled: config.skills[s].expose[a.id] === true,
-        actual,
-        managed
-      };
-    }
-  }
-  return { skills, agents: list, cells };
-}
-
 // src/tui/cells.ts
 var import_picocolors = __toESM(require_picocolors());
 function cellGlyph(cs) {
@@ -40119,6 +40232,25 @@ async function handleApiRequest(method, pathname, query, body, expectedToken, go
       uninstallSkill(b.skill);
       return { status: 200, body: { ok: true, message: `\u5DF2\u5378\u8F7D ${b.skill}` } };
     }
+    if (method === "POST" && pathname === "/api/bulk") {
+      const b = body ?? {};
+      if (typeof b.agent !== "string" || typeof b.enable !== "boolean") {
+        return { status: 400, body: { error: "\u9700\u8981 agent \u5B57\u7B26\u4E32\u4E0E enable \u5E03\u5C14\u5B57\u6BB5" } };
+      }
+      const names = Object.keys(loadConfig().skills).sort();
+      const changed = [];
+      const skipped = [];
+      for (const n of names) {
+        try {
+          const r = b.enable ? enableSkill(n, [b.agent]) : disableSkill(n, [b.agent]);
+          if (r.linked.length) changed.push(n);
+          else if (r.skipped.length) skipped.push({ skill: n, reason: r.skipped[0].reason });
+        } catch (e) {
+          skipped.push({ skill: n, reason: e instanceof Error ? e.message : String(e) });
+        }
+      }
+      return { status: 200, body: { changed, skipped } };
+    }
     if (method === "GET" && pathname === "/api/market/sources") {
       return { status: 200, body: { sources: listSources() } };
     }
@@ -46268,6 +46400,45 @@ program2.command("doctor").description("\u4F53\u68C0\uFF1A\u65AD\u94FE\u3001expo
     printIssues(issues);
   })
 );
+program2.command("audit").description("\u5BA1\u8BA1\uFF1A\u6BCF\u4E2A Agent \u5B9E\u9645\u751F\u6548\u7684 skill\u3001\u6765\u6E90\u4E0E\u88AB\u7ED5\u8FC7/\u906E\u853D\u60C5\u51B5").option("--json", "\u4EE5 JSON \u8F93\u51FA").action(
+  run((opts) => {
+    const report = runAudit();
+    if (opts.json) {
+      console.log(JSON.stringify(report, null, 2));
+      return;
+    }
+    for (const a of report.agents) {
+      console.log(
+        import_picocolors2.default.bold(`${a.agentName} (${a.agent})`) + ` \u2014 \u5B9E\u9645\u751F\u6548 ${a.active.length} \u4E2A`
+      );
+      if (a.active.length) {
+        console.log(
+          renderTable(
+            ["Skill", "\u6765\u6E90", "\u58F0\u660E"],
+            a.active.map((e) => [
+              e.skill,
+              e.source.length > 64 ? e.source.slice(0, 61) + "\u2026" : e.source,
+              e.enabled ? "\u5F00\u653E" : import_picocolors2.default.yellow("\u5173\u95ED\uFF08\u94FE\u63A5\u6B8B\u7559\uFF09")
+            ])
+          )
+        );
+      } else {
+        console.log(import_picocolors2.default.dim("  \uFF08\u65E0\u751F\u6548 skill\uFF09"));
+      }
+      for (const e of a.external) {
+        console.log(import_picocolors2.default.yellow(`\u26A0 \u5916\u90E8\u540C\u540D\u6761\u76EE\uFF08\u975E\u672C\u5DE5\u5177\u521B\u5EFA\uFF09\uFF1A${e.path}`));
+      }
+      for (const f of a.findings) {
+        console.log(f.level === "error" ? import_picocolors2.default.red(`\u2717 ${f.message}`) : import_picocolors2.default.yellow(`\u26A0 ${f.message}`));
+      }
+      console.log();
+    }
+    const total = report.agents.reduce((n, a) => n + a.findings.length, 0);
+    console.log(
+      total ? import_picocolors2.default.yellow(`\u5BA1\u8BA1\u5B8C\u6210\uFF0C\u5171 ${total} \u6761\u53D1\u73B0\uFF0C\u8BE6\u89C1\u4E0A\u8868`) : import_picocolors2.default.green("\u5BA1\u8BA1\u901A\u8FC7\uFF1A\u5404 Agent \u5B9E\u9645\u751F\u6548\u72B6\u6001\u4E0E\u77E9\u9635\u4E00\u81F4")
+    );
+  })
+);
 function printIssues(issues) {
   for (const i of issues) {
     const tag = i.level === "error" ? import_picocolors2.default.red("error") : import_picocolors2.default.yellow("warn ");
@@ -46355,7 +46526,20 @@ program2.command("update [skill]").description("\u68C0\u67E5\u5E76\u5E94\u7528 g
     console.log(
       renderTable(
         ["Skill", "\u72B6\u6001", "\u5907\u6CE8"],
-        results.map((r) => [r.skill, label[r.status] ?? r.status, r.detail ?? ""])
+        results.map((r) => {
+          let note = r.detail ?? "";
+          if (r.diff) {
+            const { added, modified, removed } = r.diff;
+            const counts = [
+              added.length ? `+${added.length}` : "",
+              modified.length ? `~${modified.length}` : "",
+              removed.length ? `-${removed.length}` : ""
+            ].filter(Boolean).join(" ");
+            const paths = [...added, ...modified, ...removed];
+            note = `${note ? note + " " : ""}diff ${counts}\uFF08${paths.slice(0, 4).join("\u3001")}${paths.length > 4 ? " \u7B49" : ""}\uFF09`;
+          }
+          return [r.skill, label[r.status] ?? r.status, note];
+        })
       )
     );
   })

package/dist/gui/assets/index-D5a5y70Q.css

@@ -0,0 +1 @@
+:root{--bg: #f6f7f9;--panel: #ffffff;--ink: #1c2330;--dim: #8a93a3;--line: #e3e7ee;--accent: #2563eb;--ok: #16a34a;--warn: #d97706;--conflict: #dc2626;--muted: #c8cdd6}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);font:14px/1.6 -apple-system,PingFang SC,Segoe UI,Microsoft YaHei,sans-serif}.app{max-width:980px;margin:0 auto;padding:0 20px 60px}.topbar{display:flex;align-items:center;gap:24px;padding:14px 0;border-bottom:1px solid var(--line);margin-bottom:20px;flex-wrap:wrap}.brand{font-size:18px;font-weight:700}.brand .ver{font-size:12px;color:var(--dim);font-weight:400;margin-left:4px}.tabs{display:flex;gap:6px}.tab{border:1px solid transparent;background:none;padding:6px 14px;border-radius:8px;font-size:14px;color:var(--dim);cursor:pointer}.tab.active{background:var(--panel);border-color:var(--line);color:var(--ink);font-weight:600}.meta{margin-left:auto;color:var(--dim);font-size:12px}.toolbar{display:flex;align-items:center;gap:12px;margin-bottom:12px}.toolbar .input{min-width:200px;max-width:320px}.segment{display:inline-flex;border:1px solid var(--line);border-radius:8px;overflow:hidden;background:var(--panel)}.seg-btn{border:none;background:none;padding:6px 14px;font-size:13px;color:var(--dim);cursor:pointer}.seg-btn+.seg-btn{border-left:1px solid var(--line)}.seg-btn.active{background:var(--accent);color:#fff}.danger-btn{color:var(--conflict)}.matrix{border-collapse:collapse;background:var(--panel);border:1px solid var(--line);border-radius:10px;overflow:hidden;width:100%}.matrix th,.matrix td{border-bottom:1px solid var(--line);padding:9px 14px;text-align:center}.matrix thead th{background:#fafbfc;font-size:13px;color:var(--ink)}.col-bulk{display:flex;gap:4px;justify-content:center;margin-top:3px}.bulk-btn{border:1px solid var(--line);background:var(--panel);border-radius:5px;font-size:10.5px;padding:0 6px;color:var(--dim);cursor:pointer}.bulk-btn:hover:not(:disabled){color:var(--accent);border-color:var(--accent)}.bulk-btn:disabled{opacity:.45;cursor:not-allowed}.load-more{text-align:center;margin-top:14px}.load-more .btn{padding:8px 24px}.matrix tr:last-child td{border-bottom:none}.matrix .skill-col,.matrix .skill-name{text-align:left;font-weight:600;min-width:160px}.matrix .skill-name{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-weight:500}.matrix .agent-off{color:var(--dim)}.cell{cursor:pointer;font-size:16px;-webkit-user-select:none;user-select:none;transition:background .12s}.cell:hover{filter:brightness(.94)}.cell.busy{opacity:.4;cursor:wait}.cell.ok{color:var(--ok);background:#f0fdf4}.cell.warn{color:var(--warn);background:#fffbeb}.cell.conflict{color:var(--conflict);background:#fef2f2}.cell.muted{color:var(--muted);background:var(--panel)}.legend{color:var(--dim);font-size:12.5px;margin-top:12px}.dim{color:var(--dim)}.doctor-head{display:flex;align-items:center;justify-content:space-between;gap:16px}.doctor-head h2{font-size:16px;margin:0 0 12px}.btn{background:var(--accent);color:#fff;border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer;margin-bottom:12px}.btn:disabled{opacity:.45;cursor:not-allowed}.issue-list{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:8px}.issue{background:var(--panel);border:1px solid var(--line);border-radius:8px;padding:10px 14px;display:flex;align-items:baseline;gap:10px;flex-wrap:wrap}.issue.level-error{border-left:3px solid var(--conflict)}.issue.level-warn{border-left:3px solid var(--warn)}.issue.level-info{border-left:3px solid var(--accent)}.badge{font-size:11px;padding:1px 8px;border-radius:999px;color:#fff;flex-shrink:0}.badge-error{background:var(--conflict)}.badge-warn{background:var(--warn)}.badge-info{background:var(--accent)}.issue-msg{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:13px;word-break:break-all}.fix-hint{color:var(--dim);font-size:12px}.link{cursor:pointer;text-decoration:underline dotted;text-underline-offset:3px}.link:hover{color:var(--accent)}.update-table .src{max-width:320px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.btn.small-btn{padding:4px 12px;margin:0;font-size:12px}.btn.danger{background:var(--conflict)}.modal-mask{position:fixed;top:0;right:0;bottom:0;left:0;background:#0f172a73;display:flex;align-items:flex-start;justify-content:center;padding:48px 16px;z-index:20;overflow:auto}.modal{background:var(--panel);border-radius:12px;padding:20px 24px;width:100%;max-width:760px;box-shadow:0 16px 48px #00000040}.modal-head{display:flex;align-items:center;justify-content:space-between;gap:16px}.modal-head h2{margin:0;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:17px}.modal-actions{display:flex;gap:8px}.modal-actions .tab{border-color:var(--line)}.detail-files{margin:12px 0}.file-list{background:#fafbfc;border:1px solid var(--line);border-radius:8px;padding:8px 12px;max-height:140px;overflow:auto}.skill-md{background:#fafbfc;border:1px solid var(--line);border-radius:8px;padding:12px 16px;font-size:12.5px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;max-height:320px;overflow:auto;white-space:pre-wrap;word-break:break-word}.panel h2{font-size:16px;margin:0 0 6px}.panel{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:18px 20px}.form-row{display:flex;align-items:center;gap:16px;margin:12px 0;flex-wrap:wrap}.form-row.options{gap:24px}.input{border:1px solid var(--line);border-radius:8px;padding:8px 12px;font-size:13px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;min-width:260px}.input:focus{outline:2px solid rgb(37 99 235 / 35%);border-color:var(--accent)}.grow{flex:1}.agent-picker{display:flex;gap:12px;flex-wrap:wrap}.pick{display:inline-flex;align-items:center;gap:5px;font-size:13px;cursor:pointer;white-space:nowrap}.pick.off{color:var(--dim)}.adopt-group{margin:14px 0}.adopt-agent{font-weight:700;margin-bottom:6px}.adopt-item{display:flex;align-items:center;gap:10px;padding:7px 10px;border:1px solid var(--line);border-radius:8px;margin-bottom:6px;cursor:pointer;background:#fdfdfe}.adopt-item.off{opacity:.55;cursor:not-allowed}.adopt-item .path{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.result-box{margin-top:16px;border:1px solid var(--line);border-left:3px solid var(--ok);border-radius:8px;padding:12px 16px;display:flex;flex-direction:column;gap:4px}.result-title{font-weight:700}.lint-box{border-top:1px dashed var(--line);margin-top:6px;padding-top:8px;display:flex;flex-direction:column;gap:3px}.warn-text{color:var(--warn);font-size:13px}.mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace}.small{font-size:12px}.empty,.loading{padding:60px 0;text-align:center;color:var(--dim)}.empty code{background:#eceff3;padding:1px 6px;border-radius:4px}.toasts{position:fixed;bottom:24px;left:50%;transform:translate(-50%);display:flex;flex-direction:column;gap:8px;align-items:center;z-index:10}.toast{background:#111827;color:#f9fafb;padding:9px 18px;border-radius:8px;font-size:13px;box-shadow:0 6px 24px #0000002e;animation:rise .18s ease-out}.toast.bad{background:#7f1d1d}@keyframes rise{0%{opacity:0;transform:translateY(8px)}to{opacity:1;transform:none}}