@yottameta/yotta-skills-plugin 0.19.17 → 0.19.18

package/.agents/plugins/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Developer Tools",
-      "version": "0.19.17",
+      "version": "0.19.18",
       "description": "YuanGe (元阁) - orchestration routing, inventory, and one-command installer for the YottaMeta skill family (zero dependencies, Node.js only).",
       "interface": {
         "displayName": "元阁 yotta-skills",

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Developer Tools",
-      "version": "0.19.17",
+      "version": "0.19.18",
       "description": "YuanGe (元阁) - orchestration routing, inventory, and one-command installer for the YottaMeta skill family (zero dependencies, Node.js only).",
       "interface": {
         "displayName": "元阁 yotta-skills",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-skills-plugin",
-  "version": "0.19.17",
+  "version": "0.19.18",
   "description": "YuanGe (元阁) — orchestration and routing for the YottaMeta skill family, packaged as a YottaMeta Agent Plugin.",
   "license": "MIT",
   "keywords": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "yotta-skills",
-  "version": "0.19.17",
+  "version": "0.19.18",
   "description": "YuanGe (元阁) - orchestration routing, inventory, and one-command installer for the YottaMeta skill family (zero dependencies, Node.js only).",
   "author": {
     "name": "YottaMeta",

package/skills/yotta-skills/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yotta-skills
-version: 0.19.17
+version: 0.19.18
 description: 元阁 -- 元阁全家技能的总编排策划 + 编排路由 + 一键安装器 + 技能盘点 + 运行时 hook 适配。路由层：--route / route_request 按需求摘要给出候选组合、调用顺序、角色、置信度、依据、已装/缺失状态与安装命令，只建议不自动安装；非元阁家族已装技能按 frontmatter description 机械匹配作并列候选（标注来源与未扫描状态，只读不自动调用）；策划层：按场景给出「该组合哪几个元技能、组合强在哪、怎么组合使用（安装与调用均由用户确认后执行）」；安装层：一条命令把 YottaMeta 已发布的全部 yotta-* 技能装进指定智能体或目录（默认 --pin 锁死清单精确版本）；盘点层：--inventory / --reindex 扫描本机已装技能生成/更新注册表，新装技能自动被发现（install/update 后自动 re-index，会话开工只建议跑本地 --reindex；更新检查走手动 --check 或后台 --check --scheduled）；运行时适配层：hook capabilities / evaluate / bind / unbind 按宿主能力矩阵执行六个统一事件并留证降级，元信 before_install 已接入安装管线；自包含零依赖，不依赖任何元技能；MCP 按需加载且需用户确认后写入配置（可选：list_installed_skills/describe_skill/reindex/route_request，不常驻，未加载降级 CLI）。支持 --list 清单 / --route 路由 / install / update / update --check（只读检查）/ update --check --scheduled（后台周检）/ update --auto（家族自动更新）/ hook 适配 / --inventory / --reindex / --dry-run 预览 / --pin（默认）/ --range。触发：需要批量安装或更新元阁全家技能、按场景组合多个元技能、路由或判断该用哪些技能、盘点或查看本机已装技能、重扫技能注册表、给某个智能体或目录一次性铺齐 yotta-* 技能、评估宿主 hook 能力、预览安装清单、锁版本安装、或用户说 元阁/装全家/一次装齐/yotta-skills/install-all/更新全家/检查更新/自动更新/hook 适配/该用哪个技能/路由技能/盘点技能/查看已装技能 等。边界（Do NOT trigger）：只做「组合策划 + 静态路由建议 + 清单 + 下载 + 落位 + 汇总 + 盘点 + re-index + hook 适配」，不含技能本体、不做技能内容开发、不 -g 污染全局、不自动安装缺失技能、不静默写宿主配置或全局记忆；家族安装先自举或调用元信装前门禁，DO NOT INSTALL 阻断，非元阁家族包不自动安装。
 license: MIT
 metadata:

package/skills/yotta-skills/bin/yotta-skills.js

@@ -38,7 +38,7 @@ const hookAdapterLib = require('../lib/hook-adapter');
 const { createInstaller, isSafeTarEntry } = require('../lib/install-pipeline');
 
 const PKG_ROOT = path.join(__dirname, '..');
-let VERSION = '0.19.17';
+let VERSION = '0.19.18';
 try { VERSION = require(path.join(PKG_ROOT, 'package.json')).version; } catch (_) { /* keep fallback */ }
 
 function loadManifest() {

package/skills/yotta-skills/lib/hook-adapter.js

@@ -0,0 +1,385 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const EVENTS = [
+  'before_start',
+  'before_tool',
+  'before_install',
+  'before_publish',
+  'after_milestone',
+  'before_send',
+];
+
+const CAPABILITY_LEVELS = [
+  'native-block',
+  'native-audit',
+  'wrapper-only',
+  'unsupported',
+];
+
+const EVIDENCE_KINDS = [
+  'tool_call_id',
+  'hook_event_id',
+  'host_transcript',
+  'file_path',
+  'exit_code',
+  'audit_log',
+];
+
+const FALLBACKS = ['wrapper', 'advisory', 'explicit-unverified'];
+
+const CODEX_CAPABILITIES = {
+  before_start: 'native-audit',
+  before_tool: 'native-audit',
+  before_install: 'wrapper-only',
+  before_publish: 'wrapper-only',
+  after_milestone: 'native-audit',
+  before_send: 'unsupported',
+};
+
+function unsupportedCapabilities() {
+  return EVENTS.reduce((out, event) => {
+    out[event] = 'unsupported';
+    return out;
+  }, {});
+}
+
+function capabilitiesForHost(host) {
+  if (host === 'codex') return { ...CODEX_CAPABILITIES };
+  return unsupportedCapabilities();
+}
+
+function validateHookRequirements(manifest) {
+  const errors = [];
+  const requirements = manifest && Array.isArray(manifest.hooks) ? manifest.hooks : [];
+  requirements.forEach((requirement, index) => {
+    const prefix = 'hooks[' + index + ']';
+    if (!requirement || typeof requirement !== 'object' || Array.isArray(requirement)) {
+      errors.push(prefix + ': 必须是对象');
+      return;
+    }
+    if (!EVENTS.includes(requirement.event)) {
+      errors.push(prefix + ': event 非法');
+    }
+    if (!['block', 'warn'].includes(requirement.on_fail)) {
+      errors.push(prefix + ': on_fail 非法');
+    }
+    if (!requirement.require_tool && !requirement.require_action) {
+      errors.push(prefix + ': 必须声明 require_tool 或 require_action');
+    }
+    if (!Array.isArray(requirement.evidence) || requirement.evidence.length === 0) {
+      errors.push(prefix + ': evidence 不能为空');
+    } else if (requirement.evidence.some((kind) => !EVIDENCE_KINDS.includes(kind))) {
+      errors.push(prefix + ': evidence 含不支持的来源');
+    }
+    if (requirement.fallback !== undefined && !FALLBACKS.includes(requirement.fallback)) {
+      errors.push(prefix + ': fallback 非法');
+    }
+  });
+  return { errors, requirements };
+}
+
+function actionOf(requirement, index) {
+  return requirement.require_tool || requirement.require_action || ('hook-' + index);
+}
+
+function checkFor(context, requirement) {
+  const key = requirement.require_tool || requirement.require_action;
+  return context && context.checks && context.checks[key] ? context.checks[key] : null;
+}
+
+function evidenceFor(requirement, context, check) {
+  const out = {};
+  for (const kind of requirement.evidence || []) {
+    if (check && check.evidence && check.evidence[kind] !== undefined) out[kind] = check.evidence[kind];
+    else if (context && context.evidence && context.evidence[kind] !== undefined) out[kind] = context.evidence[kind];
+  }
+  return out;
+}
+
+function evaluateOne(requirement, index, event, capability, context, skill) {
+  const action = actionOf(requirement, index);
+  const check = checkFor(context, requirement);
+  const evidence = evidenceFor(requirement, context, check);
+  const hasEvidence = Object.keys(evidence).length > 0;
+  const passed = !!check && check.ok === true;
+  const failed = !!check && check.ok === false;
+  const missing = !check;
+  let decision = 'allow';
+  let reason = '检查通过';
+  let correction = false;
+
+  if (passed) {
+    const canVerify = capability === 'native-block'
+      || capability === 'native-audit'
+      || (capability === 'wrapper-only' && context && context.wrapperRegistered === true);
+    if (!canVerify) {
+      decision = 'unverified';
+      reason = hasEvidence ? '宿主能力不足，不能声明为强制' : '缺少可验证证据';
+    } else if (!hasEvidence) {
+      decision = 'unverified';
+      reason = '缺少声明要求的可验证证据';
+    }
+  } else if (failed || missing) {
+    if (requirement.on_fail === 'warn') {
+      decision = 'warn';
+      reason = '检查未通过，按声明降级为警告';
+    } else if (capability === 'native-block') {
+      decision = 'block';
+      reason = '检查未通过，宿主支持动作前阻断';
+    } else if (capability === 'wrapper-only') {
+      if (context && context.wrapperRegistered === true) {
+        decision = 'block';
+        reason = '检查未通过，wrapper 路径可阻断';
+      } else {
+        decision = 'unverified';
+        reason = 'wrapper 未注册，无法保证拦截';
+      }
+    } else if (capability === 'native-audit') {
+      decision = 'unverified';
+      correction = true;
+      reason = '动作已发生，只能审计并触发一次纠偏';
+    } else {
+      decision = 'unverified';
+      reason = '宿主不支持该事件，按 explicit-unverified 降级';
+    }
+  }
+
+  return {
+    event,
+    skill: skill || null,
+    action,
+    capability,
+    decision,
+    passed,
+    failed,
+    missing,
+    correction,
+    evidence,
+    reason,
+    requirement,
+  };
+}
+
+function evaluateHook(input) {
+  const opts = input || {};
+  const event = opts.event;
+  const context = opts.context || {};
+  const manifest = opts.manifest || {};
+  const capabilities = opts.capabilities || capabilitiesForHost(opts.host || 'generic');
+  if (!EVENTS.includes(event)) {
+    return {
+      decision: 'block',
+      verified: false,
+      correction: false,
+      results: [],
+      evidence: [],
+      user_message: '阻断：未知 hook 事件 ' + event,
+      errors: ['未知 hook 事件: ' + event],
+    };
+  }
+
+  const validation = validateHookRequirements(manifest);
+  if (validation.errors.length > 0) {
+    return {
+      decision: 'block',
+      verified: false,
+      correction: false,
+      results: [],
+      evidence: [],
+      user_message: '阻断：manifest hook 声明非法',
+      errors: validation.errors,
+    };
+  }
+
+  const requirements = validation.requirements.filter((requirement) => requirement.event === event);
+  const results = requirements.map((requirement, index) => evaluateOne(
+    requirement,
+    index,
+    event,
+    capabilities[event] || 'unsupported',
+    context,
+    manifest.slug,
+  ));
+  const decision = results.some((result) => result.decision === 'block')
+    ? 'block'
+    : results.some((result) => result.decision === 'warn')
+      ? 'warn'
+      : results.some((result) => result.decision === 'unverified')
+        ? 'unverified'
+        : 'allow';
+  const evidence = results.map((result) => ({
+    event: result.event,
+    skill: result.skill,
+    action: result.action,
+    result: result.decision,
+    capability: result.capability,
+    evidence: result.evidence,
+    reason: result.reason,
+  }));
+  const correction = results.some((result) => result.correction);
+  const verified = decision === 'allow' && results.every((result) => result.decision === 'allow');
+  let userMessage = '已通过';
+  if (decision === 'block') userMessage = '阻断：' + results.filter((result) => result.decision === 'block').map((result) => result.reason).join('；');
+  else if (decision === 'warn') userMessage = '警告：' + results.filter((result) => result.decision === 'warn').map((result) => result.reason).join('；');
+  else if (decision === 'unverified') userMessage = 'explicit-unverified：' + results.filter((result) => result.decision === 'unverified').map((result) => result.reason).join('；');
+
+  return {
+    decision,
+    verified,
+    correction,
+    results,
+    evidence,
+    user_message: userMessage,
+    errors: [],
+  };
+}
+
+function hookLogPath(homeDir) {
+  return path.join(homeDir || os.homedir(), '.yottaskills', 'hook-log.jsonl');
+}
+
+function bindingsPath(homeDir) {
+  return path.join(homeDir || os.homedir(), '.yottaskills', 'hook-bindings.json');
+}
+
+function appendHookEvidence(entry, options) {
+  const file = hookLogPath(options && options.homeDir);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const record = {
+    ...entry,
+    timestamp: entry.timestamp || new Date().toISOString(),
+  };
+  fs.appendFileSync(file, JSON.stringify(record) + '\n', 'utf8');
+  return file;
+}
+
+function emptyBindings() {
+  return { version: 1, bindings: {} };
+}
+
+function readBindings(homeDir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(bindingsPath(homeDir), 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || !parsed.bindings) return emptyBindings();
+    return { version: 1, bindings: { ...parsed.bindings } };
+  } catch (_) {
+    return emptyBindings();
+  }
+}
+
+function writeBindings(homeDir, value) {
+  const file = bindingsPath(homeDir);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = file + '.tmp-' + process.pid + '-' + Date.now();
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', 'utf8');
+  try {
+    fs.renameSync(tmp, file);
+  } catch (_) {
+    fs.rmSync(file, { force: true });
+    fs.renameSync(tmp, file);
+  }
+  return file;
+}
+
+function bindingId(host, skill, event, action) {
+  return crypto.createHash('sha256').update([host, skill, event, action].join('|')).digest('hex').slice(0, 24);
+}
+
+function bindHookRequirements(input) {
+  const opts = input || {};
+  const manifest = opts.manifest || {};
+  const validation = validateHookRequirements(manifest);
+  if (validation.errors.length > 0) {
+    const error = new Error(validation.errors.join('; '));
+    error.errors = validation.errors;
+    throw error;
+  }
+  const capabilities = capabilitiesForHost(opts.host || 'generic');
+  const selected = opts.event
+    ? validation.requirements.filter((requirement) => requirement.event === opts.event)
+    : validation.requirements;
+  const registry = readBindings(opts.homeDir);
+  const records = selected.map((requirement, index) => {
+    const action = actionOf(requirement, index);
+    const id = bindingId(opts.host || 'generic', manifest.slug, requirement.event, action);
+    const previous = registry.bindings[id];
+    const record = {
+      id,
+      host: opts.host || 'generic',
+      skill: manifest.slug,
+      event: requirement.event,
+      action,
+      on_fail: requirement.on_fail,
+      fallback: requirement.fallback || 'explicit-unverified',
+      capability: capabilities[requirement.event] || 'unsupported',
+      created_at: previous ? previous.created_at : new Date().toISOString(),
+    };
+    registry.bindings[id] = record;
+    return record;
+  });
+  writeBindings(opts.homeDir, registry);
+  return records;
+}
+
+function listHookBindings(homeDir) {
+  return Object.values(readBindings(homeDir).bindings)
+    .sort((a, b) => String(a.created_at).localeCompare(String(b.created_at)) || a.id.localeCompare(b.id));
+}
+
+function unbindHookBinding(id, options) {
+  const registry = readBindings(options && options.homeDir);
+  if (!registry.bindings[id]) return false;
+  delete registry.bindings[id];
+  writeBindings(options && options.homeDir, registry);
+  return true;
+}
+
+function createHookAdapter(options) {
+  const opts = options || {};
+  const host = opts.host || 'generic';
+  const capabilities = capabilitiesForHost(host);
+  return {
+    host,
+    capabilities: () => ({ ...capabilities }),
+    validate: (manifest) => validateHookRequirements(manifest),
+    evaluate: (event, manifest, context) => evaluateHook({
+      host,
+      event,
+      manifest,
+      context,
+      capabilities,
+    }),
+    bind: (manifest, event) => bindHookRequirements({
+      host,
+      homeDir: opts.homeDir,
+      manifest,
+      event,
+    }),
+    unbind: (id) => unbindHookBinding(id, { homeDir: opts.homeDir }),
+    listBindings: () => listHookBindings(opts.homeDir),
+  };
+}
+
+module.exports = {
+  EVENTS,
+  CAPABILITY_LEVELS,
+  EVIDENCE_KINDS,
+  FALLBACKS,
+  CODEX_CAPABILITIES,
+  appendHookEvidence,
+  bindHookRequirements,
+  bindingId,
+  bindingsPath,
+  capabilitiesForHost,
+  createHookAdapter,
+  evaluateHook,
+  hookLogPath,
+  listHookBindings,
+  unbindHookBinding,
+  validateHookRequirements,
+};

package/skills/yotta-skills/lib/install-evidence.js

@@ -0,0 +1,18 @@
+'use strict';
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function evidencePath(options) {
+  const home = (options && options.homeDir) || os.homedir();
+  return path.join(home, '.yottaskills', 'install-log.jsonl');
+}
+
+function appendEvidence(entry, options) {
+  const file = evidencePath(options);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, JSON.stringify(entry) + '\n', 'utf8');
+  return file;
+}
+
+module.exports = { evidencePath, appendEvidence };

package/skills/yotta-skills/lib/install-health.js

@@ -0,0 +1,169 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const manifestLib = require('./manifest');
+const scanLib = require('./skills-scan');
+
+function addCheck(checks, id, ok, message, severity, hint) {
+  checks.push({
+    id,
+    ok: !!ok,
+    severity: severity || (ok ? 'info' : 'error'),
+    message,
+    hint: hint || null,
+  });
+}
+
+function readManifest(target, slug) {
+  const file = path.join(target, manifestLib.MANIFEST_FILE);
+  if (!fs.existsSync(file)) return { value: null, error: null };
+  try {
+    return { value: JSON.parse(fs.readFileSync(file, 'utf8')), error: null };
+  } catch (error) {
+    return { value: null, error: '无法解析 skill-manifest.json: ' + error.message };
+  }
+}
+
+/** 优先读取目标目录对应的副本版本，旧注册表缺少 variants 时回退聚合版本。 */
+function registryVersionForTarget(record, target) {
+  const variants = Array.isArray(record.variants) ? record.variants : [];
+  const normalizedTarget = path.resolve(target);
+  const exact = variants.find((variant) => {
+    if (!variant || !variant.dir) return false;
+    return path.resolve(variant.dir) === normalizedTarget;
+  });
+  if (exact && exact.version) {
+    return { version: String(exact.version).trim(), scope: 'target' };
+  }
+  return { version: record.version ? String(record.version).trim() : '', scope: 'aggregate' };
+}
+
+function checkInstalledSkill(context) {
+  const ctx = context || {};
+  const slug = String(ctx.slug || '');
+  const target = ctx.target ? path.resolve(ctx.target) : '';
+  const checks = [];
+  const errors = [];
+  const warnings = [];
+  const fixes = [];
+  let version = null;
+
+  if (!slug) {
+    addCheck(checks, 'slug', false, '缺少技能 slug');
+    errors.push('缺少技能 slug');
+  }
+  if (!target || !fs.existsSync(target) || !fs.statSync(target).isDirectory()) {
+    addCheck(checks, 'target', false, '技能目录不存在' + (target ? ': ' + target : ''));
+    errors.push('技能目录不存在' + (target ? ': ' + target : ''));
+    return { ok: false, slug, version, checks, errors, warnings, fixes };
+  }
+  addCheck(checks, 'target', true, '技能目录存在');
+
+  const skillFile = path.join(target, 'SKILL.md');
+  let text = null;
+  try {
+    text = fs.readFileSync(skillFile, 'utf8');
+    addCheck(checks, 'skill_file', true, 'SKILL.md 可读');
+  } catch (error) {
+    addCheck(checks, 'skill_file', false, 'SKILL.md 不可读: ' + error.message);
+    errors.push('SKILL.md 不可读: ' + error.message);
+  }
+
+  let frontmatter = null;
+  if (text !== null) {
+    frontmatter = scanLib.parseFrontmatter(text);
+    if (!frontmatter) {
+      addCheck(checks, 'frontmatter', false, 'SKILL.md 缺少有效 frontmatter');
+      errors.push('SKILL.md 缺少有效 frontmatter');
+    } else {
+      addCheck(checks, 'frontmatter', true, 'SKILL.md frontmatter 有效');
+      if (frontmatter.name !== slug) {
+        addCheck(checks, 'slug_identity', false, 'SKILL.md name 与目标 slug 不一致');
+        errors.push('SKILL.md name 与目标 slug 不一致');
+      } else {
+        addCheck(checks, 'slug_identity', true, 'SKILL.md slug 一致');
+      }
+      version = frontmatter.version ? String(frontmatter.version).trim() : null;
+      if (!version || !/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+        addCheck(checks, 'version_format', false, 'SKILL.md 版本号非法');
+        errors.push('SKILL.md 版本号非法');
+      } else {
+        addCheck(checks, 'version_format', true, 'SKILL.md 版本号有效');
+      }
+    }
+  }
+
+  if (ctx.expectedVersion && version && version !== ctx.expectedVersion) {
+    addCheck(checks, 'version_match', false, '版本不一致：已安装 v' + version + '，期望 v' + ctx.expectedVersion);
+    errors.push('版本不一致：已安装 v' + version + '，期望 v' + ctx.expectedVersion);
+  } else if (ctx.expectedVersion && version) {
+    addCheck(checks, 'version_match', true, '版本与期望一致');
+  }
+
+  const loadedManifest = readManifest(target, slug);
+  if (loadedManifest.error) {
+    addCheck(checks, 'manifest', false, loadedManifest.error);
+    errors.push(loadedManifest.error);
+  } else if (loadedManifest.value) {
+    if (loadedManifest.value.trust !== 'yottameta') {
+      addCheck(checks, 'manifest_trust', false, 'manifest trust 必须为 yottameta');
+      errors.push('manifest trust 必须为 yottameta');
+    } else {
+      addCheck(checks, 'manifest_trust', true, 'manifest trust 为 yottameta');
+    }
+    const validation = manifestLib.validateManifest(loadedManifest.value, {
+      skill: {
+        slug,
+        pkg: ctx.expectedPackage || loadedManifest.value.package,
+        version: version || loadedManifest.value.version,
+      },
+      pkgDir: target,
+      requirePackageJson: false,
+    });
+    if (!validation.ok) {
+      addCheck(checks, 'manifest', false, 'manifest 校验失败: ' + validation.errors.join('; '));
+      errors.push.apply(errors, validation.errors);
+    } else {
+      addCheck(checks, 'manifest', true, 'manifest 校验通过');
+    }
+  } else {
+    addCheck(checks, 'manifest', true, '未提供 skill-manifest.json，使用家族默认契约');
+  }
+
+  if (ctx.registry) {
+    const record = ctx.registry.skills && ctx.registry.skills[slug];
+    if (!record || record.status === 'gone') {
+      addCheck(checks, 'registry', false, '注册表未记录当前技能', 'warning');
+      warnings.push('注册表未记录当前技能');
+      fixes.push('运行 yotta-skills --reindex 重扫注册表');
+    } else {
+      const registryVersion = registryVersionForTarget(record, target);
+      if (version && registryVersion.version && registryVersion.version !== version) {
+        const scopeText = registryVersion.scope === 'target' ? '注册表版本（目标副本）' : '注册表版本（聚合）';
+        addCheck(
+          checks,
+          'registry',
+          false,
+          scopeText + ' v' + registryVersion.version + ' 与已安装 v' + version + ' 不一致',
+          'warning',
+        );
+        warnings.push(scopeText + ' v' + registryVersion.version + ' 与已安装 v' + version + ' 不一致');
+        fixes.push('运行 yotta-skills --reindex 重扫注册表');
+      } else {
+        addCheck(checks, 'registry', true, '注册表记录一致');
+      }
+    }
+  }
+
+  return {
+    ok: errors.length === 0,
+    slug,
+    version,
+    checks,
+    errors,
+    warnings,
+    fixes: Array.from(new Set(fixes)),
+  };
+}
+
+module.exports = { checkInstalledSkill };