@tec-explorer/skillpot 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 所有显著变更记录于此。格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [SemVer](https://semver.org/lang/zh-CN/)。
 
+## [0.11.0] - 2026-09-04
+
+### Added
+- **主线 C——落地策略**:B 档 copy 机制(适配器 `materialize: 'copy'`,enable 即重新拷贝刷新副本;doctor/台账/矩阵全链路兼容 copy)与**广播模式** `skillpot broadcast <skill> [--off]`(跨工具共享目录 `~/.agents/skills/`,显式开关、台账化)
+- **主线 D——skills.sh 目录集成**:`skillpot search <关键词>`(匿名 `/api/search`,带安装量,与官方 npx skills CLI 同源)与 `skillpot install-search <owner/repo/slug> [--for agents]`(克隆缓存解析子目录后安装)
+- Agent 注册表扩至八家:新增 **Amp**(`~/.config/amp/skills/`,官方文档确认);Cursor 验证依据升级为官方文档;dsh verified 按调研结论如实降级
+- 英文版 `README.en.md`(中英互链)
+
+## [0.10.0] - 2026-09-04
+
+### Added
+- **GUI「团队」页签**：团队对齐可视化——填入清单路径即可**预览**（逐项标注本机安装状态/版本锁一致性/中央仓库缺失/local 仅本机有效），**对齐**一键执行（可**预演**不落地），**导出清单**从当前中央仓库生成；清单路径跨会话记忆
+- 新增 `inspectManifest`（清单体检）与 `/api/team/inspect|sync|export` 三个路由
+- 修复：清单体检对"config 有登记但中央仓库目录已删除"的损坏状态误报 ENOENT——现精确标注"中央仓库缺失（对齐将重装）"
+
 ## [0.9.0] - 2026-09-04
 
 ### Added

package/README.en.md

@@ -0,0 +1,87 @@
+# SkillPot
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/@tec-explorer/skillpot)](https://www.npmjs.com/package/@tec-explorer/skillpot)
+[![Node](https://img.shields.io/badge/node-%E2%89%A518-brightgreen.svg)](package.json)
+
+**The skill manager for coding agents — install once, expose per agent, update once.**
+
+> Coding agents (Claude Code, ZCode, Codex, OpenCode, Gemini CLI, DeepSeek CLI, Cursor, Amp…) have converged on the same `SKILL.md` open standard, but each discovers skills from its own directory: a skill installed into `~/.claude/skills` only works for Claude Code. SkillPot keeps every skill in one central store and exposes it per agent via symlinks — with a switch matrix, consistency doctor, security lint, and team alignment.
+
+[中文文档](README.md) ｜ 📖 [Feature guide with screenshots](docs/guide.md)
+
+![GUI switch matrix](docs/images/gui-matrix.png)
+
+## Why SkillPot
+
+Registries and marketplaces (skills.sh, Anthropic marketplace) answer *"where do I find skills"* — they are the **upstream**. SkillPot answers *"where does it install, who sees it, how do I stop it, how do I update it"* — the **management layer**:
+
+- **One central store** at `~/.skillpot/skills/` — a single source of truth with checksums and a lockfile
+- **Per-agent switch matrix** — `config.yaml` drives a symlink sync engine; flip switches in the GUI, the TUI, or the CLI
+- **8 agents**: Claude Code, ZCode, Codex CLI, OpenCode, Gemini CLI, DeepSeek CLI (dsh), Cursor, Amp
+- **Doctor**: broken links, drift, shadowed names, orphaned links — `--fix` repairs automatically
+- **Security lint** on install: frontmatter integrity + dangerous script patterns (`rm -rf`, `curl | sh`, credential access, data exfiltration…)
+- **Adopt** existing skills scattered across agent directories (copy or move mode)
+- **Update** git-sourced skills in place (symlinks keep working, no re-linking) with file-level diffs
+- **Market**: browse and one-click install from built-in sources — Anthropic, Vercel, Superpowers, Matt Pocock — or any custom git repo; search the skills.sh directory anonymously
+- **Team alignment**: commit a `.skillpot.yaml` manifest, teammates run `skillpot sync` to match it
+- **MCP bridge**: any MCP-capable agent can consume the central store, still filtered by the switch matrix
+- **Broadcast mode**: expose a skill to the cross-tool `~/.agents/skills/` shared directory on demand
+
+## Quick start
+
+Requires Node ≥ 18.
+
+```bash
+npm install -g @tec-explorer/skillpot   # or: npx @tec-explorer/skillpot (alias: spot)
+
+skillpot init                     # create ~/.skillpot and detect installed agents
+skillpot adopt --dry-run          # preview: existing skills found in agent dirs
+skillpot adopt --move             # adopt with move mode (original dir becomes a symlink)
+skillpot gui                      # web console: matrix / doctor / adopt / install / market / maintain / team
+skillpot add ~/demo/my-skill      # install a skill (exposed to no agent by default)
+skillpot enable my-skill --for claude-code,codex
+skillpot doctor                   # consistency check (--fix to repair)
+skillpot search "commit message"  # search the skills.sh directory
+skillpot install-search anthropics/skills/pdf   # install a directory result
+skillpot sync                     # align with a project .skillpot.yaml manifest
+```
+
+> Agents scan their skill directories at session start — restart a session after enable/disable.
+
+## How it works
+
+```
+~/.skillpot/
+├── skills/<name>/SKILL.md   # central store: the single copy (self-contained, symlinks dereferenced)
+├── config.yaml              # sources / checksums + the skill × agent switch matrix
+├── state.json               # ledger of links this tool created (uninstall only touches these)
+├── skillspot.lock.json      # machine-readable snapshot (team sharing / audit)
+└── cache/market/            # clone cache for market sources
+```
+
+`enable` creates a symlink from the agent's skills directory into the central store — agents discover it on their next session scan. `disable` removes it. The tool only ever touches paths recorded in its own ledger.
+
+Landing strategies per agent: **A** symlink (default) → **B** copy + resync (agents that don't follow symlinks) → **C** MCP bridge (universal fallback).
+
+## Documentation
+
+- [Feature guide (screenshots)](docs/guide.md) — Chinese, with screenshots of every surface
+- [Design: agent adapters](docs/design/agent-adapters.md) · [Design: MCP bridge](docs/design/mcp-bridge.md) · [Product plan](docs/product/product-plan.md)
+
+## Security
+
+Skills are instructions injected into model context plus optionally executable scripts. SkillPot's defaults: install lints before exposing, nothing is exposed to any agent until you say so, uninstall/disable only touches ledgered paths, and the web console listens on 127.0.0.1 with token-gated writes. Report vulnerabilities via [SECURITY.md](SECURITY.md).
+
+## Development
+
+```bash
+npm install
+npm test          # vitest, sandboxed (never touches your real HOME)
+npm run test:e2e  # sandboxed end-to-end smoke
+npm run build     # typecheck + esbuild bundle + web GUI build
+```
+
+## License
+
+[MIT](LICENSE)

package/README.md

@@ -9,6 +9,8 @@
 **跨编程 Agent 的 Skill 管理器 —— 一处安装，按 Agent 开关，一处更新。**
 *Cross-agent skill manager for coding agents: install once, expose per agent, update once.*
 
+[English](README.en.md) ｜ 中文
+
 > 编程 Agent(Claude Code、ZCode、Codex、OpenCode、Gemini CLI、DeepSeek CLI、Cursor…)已收敛到同一套 `SKILL.md` 开放标准,但发现路径各自为政:装进 `~/.claude/skills` 就只对 Claude Code 生效。SkillPot 把 skill 收进一个中央仓库,按 Agent 粒度开关暴露,并提供冲突体检与安全扫描。
 
 ![GUI 开关矩阵](docs/images/gui-matrix.png)

package/dist/cli.mjs

@@ -38684,7 +38684,7 @@ var AGENTS = [
     binaries: ["dsh"],
     fingerprints: (home) => [path2.join(home, ".dsh")],
     skillsDir: (home) => path2.join(home, ".dsh", "skills"),
-    verified: "\u76EE\u5F55\u7EA6\u5B9A\u540C Claude\uFF08~/.dsh/skills + SKILL.md\uFF09\uFF1B\u76EE\u5F55\u5185\u5DF2\u5B58\u5728\u7528\u6237\u624B\u5DE5\u521B\u5EFA\u5E76\u65E5\u5E38\u4F7F\u7528\u7684 symlink\uFF0C\u95F4\u63A5\u4F50\u8BC1 symlink \u53EF\u88AB\u53D1\u73B0\uFF1Bdsh CLI \u672C\u673A\u635F\u574F\uFF08@deepseek-ai/dsh \u6A21\u5757\u7F3A\u5931\uFF09\uFF0C\u5F85\u91CD\u88C5\u540E\u6700\u7EC8\u786E\u8BA4"
+    verified: "\u76EE\u5F55\u7EA6\u5B9A\u540C Claude\uFF08~/.dsh/skills + SKILL.md\uFF09\uFF1B\u4F46 0.1.2-rc.1 \u4EE3\u7801\u672A\u89C1 skills \u8BFB\u53D6\u903B\u8F91\uFF08\u8BE5\u76EE\u5F55\u7684\u6D88\u8D39\u65B9\u5F85\u786E\u8BA4\uFF09\uFF0C\u7EB3\u7BA1\u4E3A\u524D\u77BB\u6027\u7EA6\u5B9A"
   },
   {
     id: "cursor",
@@ -38692,7 +38692,15 @@ var AGENTS = [
     binaries: ["cursor"],
     fingerprints: (home) => [path2.join(home, ".cursor")],
     skillsDir: (home) => path2.join(home, ".cursor", "skills"),
-    verified: "\u5B98\u65B9 create-skill \u6280\u80FD\u660E\u786E\uFF1A\u4E2A\u4EBA\u6280\u80FD\u76EE\u5F55\u4E3A ~/.cursor/skills/\uFF08\u9879\u76EE\u4E3A .cursor/skills/\uFF09\uFF1Bsymlink \u53D1\u73B0\u4EFB\u5F85\u5B9E\u673A\u786E\u8BA4"
+    verified: "\u5B98\u65B9\u6587\u6863\u786E\u8BA4 ~/.cursor/skills/\uFF08\u4E2A\u4EBA\uFF09\u4E0E .cursor/skills/\uFF08\u9879\u76EE\uFF09\uFF1Bsymlink \u53D1\u73B0\u4EFB\u5F85\u5B9E\u673A\u786E\u8BA4"
+  },
+  {
+    id: "amp",
+    name: "Amp",
+    binaries: ["amp"],
+    fingerprints: (home) => [path2.join(home, ".config", "amp"), path2.join(home, ".amp")],
+    skillsDir: (home) => path2.join(home, ".config", "amp", "skills"),
+    verified: "\u5B98\u65B9\u6587\u6863\u786E\u8BA4 ~/.config/amp/skills/\uFF08\u7528\u6237\u7EA7\uFF0C\u591A\u76EE\u5F55\u5E76\u8BFB\uFF09\uFF1Bsymlink \u53D1\u73B0\u4EFB\u5F85\u5B9E\u673A\u786E\u8BA4"
   }
 ];
 function getAgent(id) {
@@ -38959,9 +38967,9 @@ function ledgerHas(state, skill, agent, linkPath) {
     (l) => l.skill === skill && l.agent === agent && l.link_path === linkPath
   );
 }
-function addLedger(state, skill, agent, linkPath) {
+function addLedger(state, skill, agent, linkPath, kind = "symlink") {
   if (!ledgerHas(state, skill, agent, linkPath)) {
-    state.links.push({ skill, agent, link_path: linkPath });
+    state.links.push({ skill, agent, link_path: linkPath, ...kind === "copy" ? { kind } : {} });
   }
 }
 function dropLedger(state, skill, agent) {
@@ -38972,6 +38980,13 @@ function linkTarget(agentId, skill) {
   if (!agent) throw new Error(`\u672A\u77E5 agent '${agentId}'`);
   return path7.join(agent.skillsDir(agentHome()), skill);
 }
+function materializeOf(agentId) {
+  return getAgent(agentId)?.materialize ?? "symlink";
+}
+function copyInto(src, target) {
+  fs5.mkdirSync(path7.dirname(target), { recursive: true });
+  fs5.cpSync(src, target, { recursive: true, dereference: true });
+}
 function enableSkill(skill, agentIds) {
   const src = skillDir(skill);
   if (!fs5.existsSync(path7.join(src, "SKILL.md"))) {
@@ -38985,11 +39000,34 @@ function enableSkill(skill, agentIds) {
   const skipped = [];
   for (const agentId of agentIds) {
     const target = linkTarget(agentId, skill);
+    const kind = materializeOf(agentId);
     let existing = null;
     try {
       existing = fs5.lstatSync(target);
     } catch {
     }
+    if (kind === "copy") {
+      if (existing) {
+        if (ledgerHas(state, skill, agentId, target)) {
+          fs5.rmSync(target, { recursive: true, force: true });
+          copyInto(src, target);
+          addLedger(state, skill, agentId, target, "copy");
+          entry.expose[agentId] = true;
+          linked.push(agentId);
+          continue;
+        }
+        skipped.push({
+          agent: agentId,
+          reason: `${target} \u5DF2\u5B58\u5728\u771F\u5B9E${existing.isDirectory() ? "\u76EE\u5F55" : "\u6587\u4EF6"}\uFF08\u53EF\u80FD\u662F\u540C\u540D skill\uFF09\uFF0C\u62D2\u7EDD\u8986\u76D6`
+        });
+        continue;
+      }
+      copyInto(src, target);
+      addLedger(state, skill, agentId, target, "copy");
+      entry.expose[agentId] = true;
+      linked.push(agentId);
+      continue;
+    }
     if (existing) {
       if (existing.isSymbolicLink()) {
         let resolved = null;
@@ -39053,6 +39091,13 @@ function disableSkill(skill, agentIds) {
     } catch {
     }
     if (st) {
+      if (!st.isSymbolicLink() && ledgerHas(state, skill, agentId, target)) {
+        fs5.rmSync(target, { recursive: true, force: true });
+        dropLedger(state, skill, agentId);
+        if (entry) entry.expose[agentId] = false;
+        linked.push(agentId);
+        continue;
+      }
       if (st.isSymbolicLink()) {
         let pointsToStore = false;
         try {
@@ -39101,6 +39146,61 @@ function safeReadlink(p) {
     return "?";
   }
 }
+function broadcastSkill(skill, off = false) {
+  const src = skillDir(skill);
+  const state = loadState();
+  const target = path7.join(agentHome(), ".agents", "skills", skill);
+  if (off) {
+    if (!fs5.existsSync(src)) throw new Error(`\u4E2D\u592E\u4ED3\u5E93\u4E2D\u627E\u4E0D\u5230 skill '${skill}'`);
+    let st2 = null;
+    try {
+      st2 = fs5.lstatSync(target);
+    } catch {
+    }
+    let pointsToStore = false;
+    if (st2?.isSymbolicLink()) {
+      try {
+        pointsToStore = fs5.realpathSync(target) === fs5.realpathSync(src);
+      } catch {
+        pointsToStore = false;
+      }
+    }
+    if (st2 && (pointsToStore || ledgerHas(state, skill, "broadcast", target))) {
+      fs5.rmSync(target, { recursive: true, force: true });
+      dropLedger(state, skill, "broadcast");
+      saveState(state);
+      return { changed: true, message: `'${skill}' \u5DF2\u64A4\u4E0B\u5E7F\u64AD\uFF08~/.agents/skills\uFF09` };
+    }
+    return { changed: false, message: "\u5E7F\u64AD\u76EE\u5F55\u4E2D\u6CA1\u6709\u8BE5 skill" };
+  }
+  if (!fs5.existsSync(path7.join(src, "SKILL.md"))) {
+    throw new Error(`\u4E2D\u592E\u4ED3\u5E93\u4E2D\u627E\u4E0D\u5230 skill '${skill}'\uFF08${src}\uFF09`);
+  }
+  let st = null;
+  try {
+    st = fs5.lstatSync(target);
+  } catch {
+  }
+  if (st) {
+    let pointsToStore = false;
+    if (st.isSymbolicLink()) {
+      try {
+        pointsToStore = fs5.realpathSync(target) === fs5.realpathSync(src);
+      } catch {
+        pointsToStore = false;
+      }
+    }
+    if (pointsToStore || ledgerHas(state, skill, "broadcast", target)) {
+      return { changed: false, message: `'${skill}' \u5DF2\u5728\u5E7F\u64AD\u4E2D` };
+    }
+    throw new Error(`${target} \u5DF2\u5B58\u5728\u4E14\u975E\u672C\u5DE5\u5177\u521B\u5EFA\u7684\u5E7F\u64AD\u94FE\u63A5\uFF0C\u62D2\u7EDD\u8986\u76D6`);
+  }
+  fs5.mkdirSync(path7.dirname(target), { recursive: true });
+  fs5.symlinkSync(src, target, "dir");
+  addLedger(state, skill, "broadcast", target);
+  saveState(state);
+  return { changed: true, message: `'${skill}' \u5DF2\u5E7F\u64AD\u5230 ~/.agents/skills\uFF08\u6240\u6709\u652F\u6301\u8BE5\u7EA6\u5B9A\u7684 Agent \u53EF\u89C1\uFF09` };
+}
 
 // src/core/lint.ts
 import fs6 from "node:fs";
@@ -39341,12 +39441,55 @@ async function installFromMarket(url, subdir, opts = {}) {
   }
   return addSkill(`${url}#${subdir}`, { name: opts.name, for: opts.for });
 }
+async function searchDirectory(query, limit = 20) {
+  const q = query.trim();
+  if (!q) throw new Error("\u641C\u7D22\u8BCD\u4E0D\u80FD\u4E3A\u7A7A");
+  const res = await fetch(
+    `https://skills.sh/api/search?q=${encodeURIComponent(q)}&limit=${Math.min(Math.max(limit, 1), 200)}`
+  );
+  if (!res.ok) throw new Error(`skills.sh \u641C\u7D22\u5931\u8D25\uFF1AHTTP ${res.status}`);
+  const data = await res.json();
+  return (data.skills ?? []).filter((s) => s.id && s.source).map((s) => ({
+    id: s.id,
+    name: s.name ?? s.id,
+    source: s.source,
+    installs: s.installs ?? 0
+  }));
+}
+async function resolveDirectorySkill(id) {
+  const parts = id.split("/").filter(Boolean);
+  if (parts.length < 3) throw new Error(`id \u5F62\u5982 owner/repo/slug\uFF1A${id}`);
+  const source = parts.slice(0, 2).join("/");
+  const slug = parts.slice(2).join("/").toLowerCase();
+  const repoUrl = `https://github.com/${source}.git`;
+  const { skills } = await scanSource(repoUrl);
+  const hit = matchDirectorySkill(skills, slug);
+  if (!hit) {
+    throw new Error(`\u5728 ${source} \u4E2D\u627E\u4E0D\u5230 skill '${slug}'\uFF08\u53EF\u8FD0\u884C skillpot market ${repoUrl} \u67E5\u770B\uFF09`);
+  }
+  return { repoUrl, subdir: hit.subdir };
+}
+function matchDirectorySkill(skills, slug) {
+  const q = slug.toLowerCase();
+  return skills.find((s) => s.name.toLowerCase() === q) ?? skills.find((s) => (s.subdir.split("/").pop() ?? "").toLowerCase() === q);
+}
+async function installFromDirectory(id, opts = {}) {
+  const { repoUrl, subdir } = await resolveDirectorySkill(id);
+  return installFromMarket(repoUrl, subdir, opts);
+}
+function formatInstalls(n) {
+  if (!n || n <= 0) return "";
+  if (n >= 1e6) return `${(n / 1e6).toFixed(1).replace(/\.0$/, "")}M`;
+  if (n >= 1e3) return `${(n / 1e3).toFixed(1).replace(/\.0$/, "")}K`;
+  return String(n);
+}
 
 // src/tui/matrix.ts
 import fs8 from "node:fs";
 import path11 from "node:path";
 function deriveMatrix(agents) {
   const config = loadConfig();
+  const state = loadState();
   const skills = Object.keys(config.skills).sort();
   const list = agents ?? detectAll().map((r) => ({
     id: r.id,
@@ -39355,6 +39498,9 @@ function deriveMatrix(agents) {
     skillsDir: r.skillsDir
   }));
   const cells = {};
+  const ledgeredCopy = (skill, agentId, target) => state.links.some(
+    (l) => l.skill === skill && l.agent === agentId && l.link_path === target && l.kind === "copy"
+  );
   for (const s of skills) {
     cells[s] = {};
     for (const a of list) {
@@ -39364,7 +39510,7 @@ function deriveMatrix(agents) {
       try {
         const st = fs8.lstatSync(target);
         actual = true;
-        managed = st.isSymbolicLink() && fs8.realpathSync(target) === fs8.realpathSync(skillDir(s));
+        managed = ledgeredCopy(s, a.id, target) || st.isSymbolicLink() && fs8.realpathSync(target) === fs8.realpathSync(skillDir(s));
       } catch {
       }
       cells[s][a.id] = {
@@ -39512,7 +39658,15 @@ async function syncManifest(file, opts = {}) {
         out.push({ skill: name, action: "install", detail });
         continue;
       }
-      if (entry.checksum && dirChecksum(skillDir(name)) !== entry.checksum) {
+      let drifted = false;
+      if (entry.checksum) {
+        try {
+          drifted = dirChecksum(skillDir(name)) !== entry.checksum;
+        } catch {
+          drifted = true;
+        }
+      }
+      if (drifted) {
         if (opts.dryRun) {
           out.push({
             skill: name,
@@ -39550,6 +39704,42 @@ var SYNC_ACTION_LABELS = {
   skip: "\u8DF3\u8FC7",
   error: "\u5931\u8D25"
 };
+function inspectManifest(file) {
+  const manifest = loadManifest(file);
+  const config = loadConfig();
+  const skills = [];
+  const warnings = [];
+  for (const [name, entry] of Object.entries(manifest.skills)) {
+    const installed = !!config.skills[name];
+    const localOnly = entry.source.startsWith("local:");
+    let checksumMatch = null;
+    let storeMissing = false;
+    if (installed && entry.checksum) {
+      try {
+        checksumMatch = dirChecksum(skillDir(name)) === entry.checksum;
+      } catch (e) {
+        checksumMatch = false;
+        storeMissing = !fs9.existsSync(skillDir(name));
+      }
+    }
+    if (localOnly) {
+      warnings.push(
+        installed ? `'${name}' \u4E3A local \u6765\u6E90\uFF0C\u8DF3\u8FC7\u5BF9\u9F50\uFF08\u4EC5\u672C\u673A\u6709\u610F\u4E49\uFF09` : `'${name}' \u4E3A local \u6765\u6E90\uFF08${entry.source}\uFF09\u5728\u672C\u673A\u4E0D\u5B58\u5728\uFF0Csync \u5C06\u8DF3\u8FC7`
+      );
+    }
+    skills.push({
+      skill: name,
+      source: entry.source,
+      checksum: entry.checksum,
+      expose: Object.fromEntries(Object.entries(entry.expose ?? {}).filter(([, v]) => v === true)),
+      installed,
+      checksumMatch,
+      storeMissing,
+      localOnly
+    });
+  }
+  return { file, skills, warnings };
+}
 
 // src/core/doctor.ts
 import fs10 from "node:fs";
@@ -39584,6 +39774,16 @@ function runDoctor() {
       st = fs10.lstatSync(link2.link_path);
     } catch {
     }
+    if (link2.kind === "copy") {
+      if (!st || !st.isDirectory()) {
+        issues.push({
+          level: "error",
+          message: `\u526F\u672C\u7F3A\u5931\uFF1A${link2.link_path}\uFF08${link2.skill} @ ${link2.agent}\uFF0C\u91CD\u65B0 enable \u53EF\u91CD\u5EFA\uFF09`,
+          fix: "drop-ledger"
+        });
+      }
+      continue;
+    }
     if (!st) {
       issues.push({
         level: "error",
@@ -39663,7 +39863,11 @@ function fixDoctor() {
   state.links = state.links.filter((l) => {
     let ok = false;
     try {
-      ok = fs10.existsSync(l.link_path) && fs10.lstatSync(l.link_path).isSymbolicLink();
+      if (l.kind === "copy") {
+        ok = fs10.existsSync(l.link_path) && fs10.lstatSync(l.link_path).isDirectory();
+      } else {
+        ok = fs10.existsSync(l.link_path) && fs10.lstatSync(l.link_path).isSymbolicLink();
+      }
     } catch {
       ok = false;
     }
@@ -40372,6 +40576,31 @@ async function handleApiRequest(method, pathname, query, body, expectedToken, go
       }
       return { status: 200, body: { changed, skipped } };
     }
+    if (method === "GET" && pathname === "/api/team/inspect") {
+      const file = query.get("file");
+      if (!file) return { status: 400, body: { error: "\u9700\u8981 file \u67E5\u8BE2\u53C2\u6570\uFF08\u6E05\u5355\u8DEF\u5F84\uFF09" } };
+      const report = inspectManifest(file);
+      return { status: 200, body: report };
+    }
+    if (method === "POST" && pathname === "/api/team/sync") {
+      const b = body ?? {};
+      if (typeof b.file !== "string" || !b.file) {
+        return { status: 400, body: { error: "\u9700\u8981 file \u5B57\u6BB5\uFF08\u6E05\u5355\u8DEF\u5F84\uFF09" } };
+      }
+      const items = await syncManifest(b.file, { dryRun: b.dryRun === true });
+      return { status: 200, body: { items } };
+    }
+    if (method === "POST" && pathname === "/api/team/export") {
+      const b = body ?? {};
+      if (typeof b.file !== "string" || !b.file) {
+        return { status: 400, body: { error: "\u9700\u8981 file \u5B57\u6BB5\uFF08\u5BFC\u51FA\u76EE\u6807\u8DEF\u5F84\uFF09" } };
+      }
+      const result = exportManifest(
+        b.file,
+        Array.isArray(b.skills) ? b.skills.filter((x) => typeof x === "string") : void 0
+      );
+      return { status: 200, body: result };
+    }
     if (method === "GET" && pathname === "/api/market/sources") {
       return { status: 200, body: { sources: listSources() } };
     }
@@ -46784,6 +47013,46 @@ program2.command("sync").description("\u56E2\u961F\u5BF9\u9F50\uFF1A\u6309\u9879
     if (errors.length) process.exitCode = 1;
   })
 );
+program2.command("broadcast <skill>").description("\u5E7F\u64AD\u6A21\u5F0F\uFF1A\u628A skill \u653E\u8FDB\u8DE8\u5DE5\u5177\u5171\u4EAB\u76EE\u5F55 ~/.agents/skills\uFF08\u7C97\u7C92\u5EA6\uFF0C\u6240\u6709\u652F\u6301\u8BE5\u7EA6\u5B9A\u7684 Agent \u53EF\u89C1\uFF09").option("--off", "\u64A4\u4E0B\u5E7F\u64AD").action(
+  run((skill, opts) => {
+    const r = broadcastSkill(skill, opts.off === true);
+    if (r.changed) console.log(import_picocolors2.default.green(`\u2714 ${r.message}`));
+    else console.log(import_picocolors2.default.dim(r.message));
+  })
+);
+program2.command("search <query>").description("\u5728 skills.sh \u76EE\u5F55\u4E2D\u641C\u7D22 skill\uFF08\u533F\u540D\u8054\u7F51\uFF0C\u65E0\u9700 token\uFF09").option("--limit <n>", "\u7ED3\u679C\u6570\u91CF\u4E0A\u9650\uFF08\u9ED8\u8BA4 20\uFF09").action(
+  run(async (query, opts) => {
+    const skills = await searchDirectory(query, Number(opts.limit) || 20);
+    if (!skills.length) {
+      console.log(import_picocolors2.default.dim("\u65E0\u7ED3\u679C"));
+      return;
+    }
+    console.log(
+      renderTable(
+        ["Skill", "\u5B89\u88C5\u91CF", "id"],
+        skills.map((s) => [s.name, formatInstalls(s.installs), s.id])
+      )
+    );
+    console.log(import_picocolors2.default.dim(`\u5B89\u88C5\uFF1Askillpot install-search <id>\uFF08\u4F8B\uFF1A${skills[0].id}\uFF09`));
+  })
+);
+program2.command("install-search <id>").description("\u5B89\u88C5 skills.sh \u76EE\u5F55\u4E2D\u7684 skill\uFF08id \u5F62\u5982 owner/repo/slug\uFF09").option("-f, --for <agents>", "\u5B89\u88C5\u540E\u5F00\u653E\u7ED9\u6307\u5B9A Agent\uFF08\u9017\u53F7\u5206\u9694\u6216 all\uFF09").action(
+  run(async (id, opts) => {
+    const r = await installFromDirectory(id, {
+      for: opts.for ? resolveAgentIds(opts.for) : void 0
+    });
+    console.log(import_picocolors2.default.green(`\u2714 \u5DF2\u5B89\u88C5 ${r.name}`));
+    if (r.description) console.log(import_picocolors2.default.dim(`  ${r.description.slice(0, 120)}`));
+    for (const i of r.lint) {
+      console.log(`  ${i.level === "error" ? import_picocolors2.default.red("error") : import_picocolors2.default.yellow("warn ")} ${i.message}`);
+    }
+    if (r.enabled.length) console.log(import_picocolors2.default.green(`\u5DF2\u5F00\u653E\uFF1A${r.enabled.join(", ")}`));
+    else
+      console.log(
+        import_picocolors2.default.dim("\u9ED8\u8BA4\u672A\u5F00\u653E\u3002skillpot enable <skill> --for <agents> \u6216\u5728 GUI \u77E9\u9635\u6253\u52FE")
+      );
+  })
+);
 for (const cmd of program2.commands) cmd.allowExcessArguments(false);
 await program2.parseAsync(process.argv);
 /*! Bundled license information: