ali-skills 0.0.14 → 0.0.16

package/node_modules/@ali/cli-skills/dist/cli.mjs

@@ -94,9 +94,32 @@ function parseSource(input) {
 	const githubRepoMatch = input.match(/github\.com\/([^/]+)\/([^/]+)/);
 	if (githubRepoMatch) {
 		const [, owner, repo] = githubRepoMatch;
+		const cleanRepo = repo.replace(/\.git$/, "");
+		const credentialMatch = input.match(/^(https?:\/\/)(?:([^@]+)@)?github\.com/);
+		const protocol = credentialMatch?.[1] ?? "https://";
+		const credential = credentialMatch?.[2];
 		return {
 			type: "github",
-			url: `https://github.com/${owner}/${repo.replace(/\.git$/, "")}.git`
+			url: credential ? `${protocol}${credential}@github.com/${owner}/${cleanRepo}.git` : `${protocol}github.com/${owner}/${cleanRepo}.git`
+		};
+	}
+	const internalTreeWithPathMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)\/(.+)/);
+	if (internalTreeWithPathMatch) {
+		const [, host, repoPath, ref, subpath] = internalTreeWithPathMatch;
+		if (repoPath && repoPath.includes("/")) return {
+			type: "internal",
+			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
+			ref,
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath
+		};
+	}
+	const internalTreeMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)$/);
+	if (internalTreeMatch) {
+		const [, host, repoPath, ref] = internalTreeMatch;
+		if (repoPath && repoPath.includes("/")) return {
+			type: "internal",
+			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
+			ref
 		};
 	}
 	const gitlabTreeWithPathMatch = input.match(/^(https?):\/\/([^/]+)\/(.+?)\/-\/tree\/([^/]+)\/(.+)/);
@@ -144,23 +167,14 @@ function parseSource(input) {
 			subpath: subpath ? sanitizeSubpath(subpath) : subpath
 		};
 	}
-	const internalTreeWithPathMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)\/(.+)/);
-	if (internalTreeWithPathMatch) {
-		const [, host, repoPath, ref, subpath] = internalTreeWithPathMatch;
-		if (repoPath && repoPath.includes("/")) return {
-			type: "internal",
-			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
-			ref,
-			subpath: subpath ? sanitizeSubpath(subpath) : subpath
-		};
-	}
-	const internalTreeMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)$/);
-	if (internalTreeMatch) {
-		const [, host, repoPath, ref] = internalTreeMatch;
-		if (repoPath && repoPath.includes("/")) return {
+	const internalRepoWithSubpathMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/([^/]+)\/([^/]+)\/(.+)$/);
+	if (internalRepoWithSubpathMatch) {
+		const [, host, owner, repo, subpath] = internalRepoWithSubpathMatch;
+		if (!owner || !repo) throw new Error(`Invalid internal URL format: ${input}`);
+		return {
 			type: "internal",
-			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
-			ref
+			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${owner}/${repo.replace(/\.git$/, "")}.git`,
+			subpath: sanitizeSubpath(subpath)
 		};
 	}
 	if (isInternalUrl(input)) return {
@@ -210,6 +224,26 @@ function isWellKnownUrl(input) {
 		return false;
 	}
 }
+function getDisplaySource(sourceUrl) {
+	if (sourceUrl.startsWith("/") || sourceUrl.startsWith(".") || sourceUrl.startsWith("~")) return sourceUrl;
+	const sshMatch = sourceUrl.match(/^git@([^:]+):(.+)$/);
+	if (sshMatch) {
+		const [, host, path] = sshMatch;
+		if (!host || !path) return sourceUrl;
+		const cleanPath = path.replace(/\.git$/, "");
+		if (host === "code.alibaba-inc.com" || host === "gitlab.alibaba-inc.com") return cleanPath;
+		return `https://${host}/${cleanPath}`;
+	}
+	if (sourceUrl.startsWith("http://") || sourceUrl.startsWith("https://")) try {
+		const url = new URL(sourceUrl);
+		const cleanPath = url.pathname.replace(/\.git$/, "").replace(/^\//, "");
+		if (url.hostname === "code.alibaba-inc.com" || url.hostname === "gitlab.alibaba-inc.com") return cleanPath;
+		return `https://${url.hostname}/${cleanPath}`;
+	} catch {
+		return sourceUrl.replace(/^https?:\/\/[^@]+@/, "https://");
+	}
+	return sourceUrl;
+}
 const silentOutput = new Writable({ write(_chunk, _encoding, callback) {
 	callback();
 } });
@@ -2046,6 +2080,25 @@ async function saveSelectedAgents(agents) {
 	lock.lastSelectedAgents = agents;
 	await writeSkillLock(lock);
 }
+function sanitizeSourceUrl(url) {
+	const sshMatch = url.match(/^git@([^:]+):(.+)$/);
+	if (sshMatch) {
+		const [, host, path] = sshMatch;
+		if (!host || !path) return url;
+		return `https://${host}/${path.replace(/\.git$/, "")}.git`;
+	}
+	if (url.startsWith("http://") || url.startsWith("https://")) try {
+		const parsed = new URL(url);
+		parsed.username = "";
+		parsed.password = "";
+		let cleanUrl = parsed.toString();
+		if (!cleanUrl.endsWith(".git")) cleanUrl += ".git";
+		return cleanUrl;
+	} catch {
+		return url;
+	}
+	return url;
+}
 const LOCAL_LOCK_FILE = "skills-lock.json";
 const CURRENT_VERSION = 1;
 function getLocalLockPath(cwd) {
@@ -2056,11 +2109,27 @@ async function readLocalLock(cwd) {
 	try {
 		const content = await readFile(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
-		if (parsed.version < CURRENT_VERSION) return createEmptyLocalLock();
-		return parsed;
+		if (typeof parsed.version !== "number") return {
+			lock: parsed,
+			isOutdated: true
+		};
+		if (parsed.version < CURRENT_VERSION) return {
+			lock: parsed,
+			isOutdated: true
+		};
+		if (!parsed.skills) return {
+			lock: createEmptyLocalLock(),
+			isOutdated: false
+		};
+		return {
+			lock: parsed,
+			isOutdated: false
+		};
 	} catch {
-		return createEmptyLocalLock();
+		return {
+			lock: createEmptyLocalLock(),
+			isOutdated: false
+		};
 	}
 }
 async function writeLocalLock(lock, cwd) {
@@ -2102,7 +2171,7 @@ async function collectFiles(baseDir, currentDir, results) {
 	}));
 }
 async function addSkillToLocalLock(skillName, entry, cwd) {
-	const lock = await readLocalLock(cwd);
+	const { lock } = await readLocalLock(cwd);
 	lock.skills[skillName] = entry;
 	await writeLocalLock(lock, cwd);
 }
@@ -2122,7 +2191,7 @@ function logSkillParseFailures(failures) {
 		if (f.hint) M.message(import_picocolors.default.yellow(`  提示: ${f.hint}`));
 	}
 }
-var version$1 = "2.0.14";
+var version$1 = "2.0.16";
 const isCancelled$1 = (value) => typeof value === "symbol";
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
@@ -2376,7 +2445,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 				value: key,
 				label: config.displayName
 			})));
-			if (pD(selected)) {
+			if (isCancelled$1(selected)) {
 				xe("Installation cancelled");
 				process.exit(0);
 			}
@@ -2390,7 +2459,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 			} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
 		} else {
 			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
+			if (isCancelled$1(selected)) {
 				xe("Installation cancelled");
 				process.exit(0);
 			}
@@ -2514,8 +2583,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 			await addSkillToLock(skill.installName, {
 				source: sourceIdentifier,
 				sourceType: "well-known",
-				sourceUrl: skill.sourceUrl,
-				skillFolderHash: ""
+				sourceUrl: sanitizeSourceUrl(skill.sourceUrl)
 			});
 		} catch {}
 	}
@@ -2662,7 +2730,8 @@ async function runAdd(args, options = {}) {
 		} else {
 			spinner.start("Cloning repository...");
 			try {
-				tempDir = await cloneRepo(parsed.url, parsed.ref);
+				const ref = parsed.ref === "HEAD" ? void 0 : parsed.ref;
+				tempDir = await cloneRepo(parsed.url, ref);
 				skillsDir = tempDir;
 				spinner.stop("Repository cloned");
 			} catch (cloneError) {
@@ -2875,7 +2944,7 @@ async function runAdd(args, options = {}) {
 					value: key,
 					label: config.displayName
 				})));
-				if (pD(selected)) {
+				if (isCancelled$1(selected)) {
 					xe("Installation cancelled");
 					await cleanup(tempDir);
 					process.exit(0);
@@ -2890,7 +2959,7 @@ async function runAdd(args, options = {}) {
 				} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
 			} else {
 				const selected = await selectAgentsInteractive({ global: options.global });
-				if (pD(selected)) {
+				if (isCancelled$1(selected)) {
 					xe("Installation cancelled");
 					await cleanup(tempDir);
 					process.exit(0);
@@ -3106,18 +3175,28 @@ async function runAdd(args, options = {}) {
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
-					let skillFolderHash = "";
+					let skillFolderHash;
+					let commitHash;
 					const skillPathValue = skillFiles[skill.name];
-					if (parsed.type === "github" && skillPathValue) {
+					let skillPath = skillPathValue;
+					if (skillPath) {
+						if (skillPath.endsWith("/SKILL.md")) skillPath = skillPath.slice(0, -9);
+						else if (skillPath.endsWith("SKILL.md")) skillPath = skillPath.slice(0, -8);
+					}
+					if (effectiveSourceType === "github" && skillPathValue) {
 						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue, getGitHubToken());
 						if (hash) skillFolderHash = hash;
+					} else if (effectiveSourceType === "internal" && skillPath !== void 0) {
+						const hash = await fetchAliInternalCommitHash(normalizedSource, skillPath, null);
+						if (hash) commitHash = hash;
 					}
 					await addSkillToLock(skill.name, {
 						source: lockSource || normalizedSource,
 						sourceType: effectiveSourceType,
-						sourceUrl: parsed.url,
-						skillPath: skillPathValue,
-						skillFolderHash,
+						sourceUrl: sanitizeSourceUrl(parsed.url),
+						skillPath,
+						...skillFolderHash && { skillFolderHash },
+						...commitHash && { commitHash },
 						pluginName: skill.pluginName
 					});
 				} catch {}
@@ -3130,8 +3209,9 @@ async function runAdd(args, options = {}) {
 				if (successfulSkillNames.has(skillDisplayName)) try {
 					const computedHash = await computeSkillFolderHash(skill.path);
 					const skillFilePath = skillFiles[skill.name];
+					const rawSource = lockSource || parsed.url;
 					const lockEntry = {
-						source: lockSource || parsed.url,
+						source: effectiveSourceType === "internal" || effectiveSourceType === "github" ? rawSource.replace(/^https?:\/\/[^@]+@/, "https://") : rawSource,
 						sourceType: effectiveSourceType,
 						computedHash
 					};
@@ -3294,7 +3374,7 @@ const BOLD$2 = "\x1B[1m";
 const DIM$5 = "\x1B[38;5;102m";
 const TEXT$4 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
-const YELLOW$4 = "\x1B[33m";
+const YELLOW$5 = "\x1B[33m";
 const SKILLS_API_URL = process.env.SKILLS_API_URL;
 const SEARCH_ENDPOINT = SKILLS_API_URL ? `${SKILLS_API_URL.replace(/\/+$/, "")}/search` : "https://next-ai-base.pre-fn.alibaba-inc.com/api/skills/search";
 function formatInstalls(count) {
@@ -3364,7 +3444,7 @@ async function runSearchPrompt(initialQuery = "") {
 				const source = skill.source ? ` ${DIM$5}${skill.source}${RESET$5}` : "";
 				const installs = formatInstalls(skill.installs);
 				const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$5}` : "";
-				const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$4}GitHub${RESET$5}` : "";
+				const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$5}GitHub${RESET$5}` : "";
 				const loadingIndicator = loading && i === 0 ? ` ${DIM$5}...${RESET$5}` : "";
 				lines.push(`  ${arrow} ${name}${source}${githubBadge}${installsBadge}${loadingIndicator}`);
 			}
@@ -3473,7 +3553,7 @@ ${DIM$5}  2) npx @ali/cli-skills add <owner/repo@skill>${RESET$5}`;
 		for (const skill of results.slice(0, 6)) {
 			const pkg = skill.source || skill.slug;
 			const installs = formatInstalls(skill.installs);
-			const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$4}GitHub${RESET$5}` : "";
+			const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$5}GitHub${RESET$5}` : "";
 			console.log(`${TEXT$4}${pkg}@${skill.name}${RESET$5}${githubBadge}${installs ? ` ${CYAN$1}${installs}${RESET$5}` : ""}`);
 			const skillUrl = buildSkillUrl(skill);
 			console.log(`${DIM$5}└ ${skillUrl}${RESET$5}`);
@@ -3601,7 +3681,7 @@ async function runSync(args, options = {}) {
 		M.info(`${import_picocolors.default.cyan(skill.name)} ${import_picocolors.default.dim(`from ${skill.packageName}`)}`);
 		if (skill.description) M.message(import_picocolors.default.dim(`  ${skill.description}`));
 	}
-	const localLock = await readLocalLock(cwd);
+	const { lock: localLock } = await readLocalLock(cwd);
 	const toInstall = [];
 	const upToDate = [];
 	if (options.force) {
@@ -3801,7 +3881,8 @@ function parseSyncOptions(args) {
 	return { options };
 }
 async function runInstallFromLock(args) {
-	const lock = await readLocalLock(process.cwd());
+	const { lock, isOutdated } = await readLocalLock(process.cwd());
+	if (isOutdated) M.warn("Project lock file may be outdated. Some skills might not install correctly.");
 	const skillEntries = Object.entries(lock.skills);
 	if (skillEntries.length === 0) {
 		M.warn("No project skills found in skills-lock.json");
@@ -3852,7 +3933,7 @@ const RESET$4 = "\x1B[0m";
 const BOLD$1 = "\x1B[1m";
 const DIM$4 = "\x1B[38;5;102m";
 const CYAN = "\x1B[36m";
-const YELLOW$3 = "\x1B[33m";
+const YELLOW$4 = "\x1B[33m";
 function shortenPath(fullPath, cwd) {
 	const home = homedir();
 	if (fullPath.startsWith(home)) return fullPath.replace(home, "~");
@@ -3886,7 +3967,7 @@ async function runList(args) {
 		const validAgents = Object.keys(agents);
 		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
 		if (invalidAgents.length > 0) {
-			console.log(`${YELLOW$3}Invalid agents: ${invalidAgents.join(", ")}${RESET$4}`);
+			console.log(`${YELLOW$4}Invalid agents: ${invalidAgents.join(", ")}${RESET$4}`);
 			console.log(`${DIM$4}Valid agents: ${validAgents.join(", ")}${RESET$4}`);
 			process.exit(1);
 		}
@@ -3923,7 +4004,7 @@ async function runList(args) {
 		const prefix = indent ? "  " : "";
 		const shortPath = shortenPath(skill.canonicalPath, cwd);
 		const agentNames = skill.agents.map((a) => agents[a].displayName);
-		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW$3}not linked${RESET$4}`;
+		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW$4}not linked${RESET$4}`;
 		console.log(`${prefix}${CYAN}${skill.name}${RESET$4} ${DIM$4}${shortPath}${RESET$4}`);
 		console.log(`${prefix}  ${DIM$4}Agents:${RESET$4} ${agentInfo}`);
 	}
@@ -4526,7 +4607,7 @@ const DIM$3 = "\x1B[38;5;102m";
 const TEXT$3 = "\x1B[38;5;145m";
 const RESET$3 = "\x1B[0m";
 const GREEN$2 = "\x1B[32m";
-const YELLOW$2 = "\x1B[33m";
+const YELLOW$3 = "\x1B[33m";
 function startLocalServer() {
 	return new Promise((resolve) => {
 		let resolveCallback;
@@ -4674,7 +4755,7 @@ async function status() {
 	console.log(`  工号: ${auth.empId}`);
 	console.log(`  网关: ${auth.gatewayUrl}`);
 	if (expired) {
-		console.log(`  Token: ${YELLOW$2}即将过期${RESET$3}`);
+		console.log(`  Token: ${YELLOW$3}即将过期${RESET$3}`);
 		console.log(`${TEXT$3}建议重新登录: npx ali-skills login${RESET$3}`);
 	} else console.log(`  Token: ${GREEN$2}有效${RESET$3} (还剩 ${remainingDays} 天)`);
 }
@@ -4762,7 +4843,7 @@ const TEXT$2 = "\x1B[38;5;145m";
 const RESET$2 = "\x1B[0m";
 const GREEN$1 = "\x1B[32m";
 const RED$1 = "\x1B[31m";
-const YELLOW$1 = "\x1B[33m";
+const YELLOW$2 = "\x1B[33m";
 function openBrowser$1(url) {
 	const platform = process.platform;
 	spawn(platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open", [url], {
@@ -4797,7 +4878,7 @@ function getPlatformPrivateToken(platformKey, explicitToken) {
 }
 async function promptConfigureToken(platformKey, platform) {
 	console.log();
-	console.log(`${YELLOW$1}⚠️  ${platform.name} 需要配置 Private Token${RESET$2}`);
+	console.log(`${YELLOW$2}⚠️  ${platform.name} 需要配置 Private Token${RESET$2}`);
 	if (platform.tokenDocUrl) console.log(`${DIM$2}Token 获取地址: ${platform.tokenDocUrl}${RESET$2}`);
 	if (!await ye({
 		message: "是否现在配置?",
@@ -5027,7 +5108,7 @@ const DIM$1 = "\x1B[38;5;102m";
 const TEXT$1 = "\x1B[38;5;145m";
 const RESET$1 = "\x1B[0m";
 const GREEN = "\x1B[32m";
-const YELLOW = "\x1B[33m";
+const YELLOW$1 = "\x1B[33m";
 const RED = "\x1B[31m";
 function showConfigHelp() {
 	console.log(`
@@ -5097,12 +5178,12 @@ async function configurePlatform(platformKey) {
 			console.log(`${GREEN}✓ ${platform.name} 使用内置凭证，无需配置${RESET$1}`);
 			break;
 		case "app_code+buc":
-			console.log(`${YELLOW}! ${platform.name} 需要 BUC 登录${RESET$1}`);
+			console.log(`${YELLOW$1}! ${platform.name} 需要 BUC 登录${RESET$1}`);
 			console.log(`${DIM$1}请运行: npx ali-skills login${RESET$1}`);
 			break;
 		case "buc_sso_refresh":
 		case "buc_sso_ticket":
-			console.log(`${YELLOW}! ${platform.name} 需要 BUC 登录${RESET$1}`);
+			console.log(`${YELLOW$1}! ${platform.name} 需要 BUC 登录${RESET$1}`);
 			console.log(`${DIM$1}请运行: npx ali-skills login${RESET$1}`);
 			break;
 		default:
@@ -5199,6 +5280,7 @@ const RESET = "\x1B[0m";
 const BOLD = "\x1B[1m";
 const DIM = "\x1B[38;5;102m";
 const TEXT = "\x1B[38;5;145m";
+const YELLOW = "\x1B[33m";
 const LOGO_LINES = [
 	" █████╗ ██╗     ██╗    ███████╗██╗  ██╗██╗██╗     ██╗     ███████╗",
 	"██╔══██╗██║     ██║    ██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝",
@@ -5560,26 +5642,42 @@ function readSkillLock() {
 	try {
 		const content = readFileSync(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
+		if (typeof parsed.version !== "number") return {
+			lock: {
+				...parsed,
+				version: CURRENT_LOCK_VERSION
+			},
+			isOutdated: true
 		};
 		if (parsed.version < CURRENT_LOCK_VERSION) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
+			lock: parsed,
+			isOutdated: true
+		};
+		if (!parsed.skills) return {
+			lock: {
+				version: CURRENT_LOCK_VERSION,
+				skills: {}
+			},
+			isOutdated: false
+		};
+		return {
+			lock: parsed,
+			isOutdated: false
 		};
-		return parsed;
 	} catch {
 		return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
+			lock: {
+				version: CURRENT_LOCK_VERSION,
+				skills: {}
+			},
+			isOutdated: false
 		};
 	}
 }
 function getSkipReason(entry) {
 	if (entry.sourceType === "local") return "Local path";
 	if (entry.sourceType === "git") return "Git URL (hash tracking not supported)";
-	if (!entry.skillFolderHash) return "No version hash available";
+	if (!(entry.sourceType === "internal" ? entry.commitHash : entry.skillFolderHash)) return "No version hash available";
 	if (!entry.skillPath) return "No skill path recorded";
 	return "No version tracking";
 }
@@ -5588,6 +5686,39 @@ async function checkSkillsForUpdates(skills, token) {
 	const errors = [];
 	const skipped = [];
 	for (const [skillName, entry] of Object.entries(skills)) {
+		if (entry.sourceType === "internal") {
+			if (!entry.commitHash || !entry.skillPath) {
+				skipped.push({
+					name: skillName,
+					reason: getSkipReason(entry),
+					sourceUrl: entry.sourceUrl
+				});
+				continue;
+			}
+			try {
+				const latestCommit = await fetchAliInternalCommitHash(entry.source, entry.skillPath, null);
+				if (!latestCommit) {
+					errors.push({
+						name: skillName,
+						source: entry.source,
+						error: "Could not fetch from GitLab"
+					});
+					continue;
+				}
+				if (latestCommit !== entry.commitHash) updates.push({
+					name: skillName,
+					source: entry.source,
+					entry
+				});
+			} catch (err) {
+				errors.push({
+					name: skillName,
+					source: entry.source,
+					error: err instanceof Error ? err.message : "Unknown error"
+				});
+			}
+			continue;
+		}
 		if (!entry.skillFolderHash || !entry.skillPath) {
 			skipped.push({
 				name: skillName,
@@ -5634,7 +5765,7 @@ async function runCheck(args = []) {
 	let skipped = [];
 	let skillCount = 0;
 	if (isGlobal) {
-		const globalLock = readSkillLock();
+		const { lock: globalLock, isOutdated: isGlobalLockOutdated } = readSkillLock();
 		const globalSkillNames = Object.keys(globalLock.skills);
 		skillCount = globalSkillNames.length;
 		if (globalSkillNames.length === 0) {
@@ -5656,9 +5787,11 @@ async function runCheck(args = []) {
 		if (skipped.length > 0) {
 			console.log();
 			console.log(`${DIM}  ${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
+			if (isGlobalLockOutdated) console.log(`${YELLOW}  Note: Your lock file may be outdated. Re-adding these skills may fix this.${RESET}`);
 			for (const skill of skipped) {
 				console.log(`    ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
-				console.log(`      ${DIM}To update: ${TEXT}npx ali-skills add ${skill.sourceUrl} -g -y${RESET}`);
+				const displaySource = getDisplaySource(skill.sourceUrl);
+				console.log(`      ${DIM}To update: ${TEXT}npx ali-skills add ${displaySource} -g -y${RESET}`);
 			}
 		}
 		console.log();
@@ -5668,7 +5801,7 @@ async function runCheck(args = []) {
 			console.log(`${DIM}Run${RESET} ${TEXT}npx ali-skills update -g${RESET} ${DIM}to update all global skills${RESET}`);
 		}
 	} else {
-		const projectLock = await readLocalLock();
+		const { lock: projectLock, isOutdated: isLocalLockOutdated } = await readLocalLock();
 		const projectSkillNames = Object.keys(projectLock.skills);
 		skillCount = projectSkillNames.length;
 		if (projectSkillNames.length === 0) {
@@ -5762,6 +5895,7 @@ async function runCheck(args = []) {
 		if (skipped.length > 0) {
 			console.log();
 			console.log(`${DIM}  ${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
+			if (isLocalLockOutdated) console.log(`${YELLOW}  Note: Your lock file may be outdated. Re-adding these skills may fix this.${RESET}`);
 			for (const skill of skipped) console.log(`    ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
 		}
 		console.log();
@@ -5789,10 +5923,11 @@ async function runUpdate(args = []) {
 	let skillsToCheck = {};
 	let scopeLabel = "project";
 	if (isGlobal) {
-		skillsToCheck = readSkillLock().skills;
+		const { lock: globalLock } = readSkillLock();
+		skillsToCheck = globalLock.skills;
 		scopeLabel = "global";
 	} else {
-		const projectLock = await readLocalLock();
+		const { lock: projectLock } = await readLocalLock();
 		for (const [name, entry] of Object.entries(projectLock.skills)) {
 			let sourceUrl;
 			if (entry.sourceType === "github") sourceUrl = `https://github.com/${entry.source}`;
@@ -5818,7 +5953,7 @@ async function runUpdate(args = []) {
 	}
 	const availableUpdates = [];
 	const skipped = [];
-	const projectLock = !isGlobal ? await readLocalLock() : null;
+	const projectLock = (!isGlobal ? await readLocalLock() : null)?.lock ?? null;
 	for (const skillName of skillNames) {
 		const entry = skillsToCheck[skillName];
 		if (!entry) continue;
@@ -5935,11 +6070,14 @@ async function runUpdate(args = []) {
 		if (skillFolder.endsWith("/SKILL.md")) skillFolder = skillFolder.slice(0, -9);
 		else if (skillFolder.endsWith("SKILL.md")) skillFolder = skillFolder.slice(0, -8);
 		if (skillFolder.endsWith("/")) skillFolder = skillFolder.slice(0, -1);
+		let sourceUrl = update.entry.sourceUrl || update.entry.source;
+		if (update.entry.sourceType === "internal" && !sourceUrl.startsWith("http") && !sourceUrl.startsWith("git@")) sourceUrl = `https://code.alibaba-inc.com/${sourceUrl}.git`;
+		else if (update.entry.sourceType === "github" && !sourceUrl.startsWith("http") && !sourceUrl.startsWith("git@")) sourceUrl = `https://github.com/${sourceUrl}.git`;
 		let installUrl;
 		if (skillFolder) {
-			installUrl = update.entry.sourceUrl.replace(/\.git$/, "").replace(/\/$/, "");
-			installUrl = `${installUrl}/tree/main/${skillFolder}`;
-		} else installUrl = update.entry.sourceUrl;
+			installUrl = sourceUrl.replace(/\.git$/, "").replace(/\/$/, "");
+			installUrl = `${installUrl}/tree/HEAD/${skillFolder}`;
+		} else installUrl = sourceUrl;
 		try {
 			await runAdd([installUrl], {
 				yes: true,

package/node_modules/@ali/cli-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ali/cli-skills",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ali-skills",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -31,7 +31,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@ali/cli-skills": "^2.0.14"
+    "@ali/cli-skills": "^2.0.16"
   },
   "bundleDependencies": [
     "@ali/cli-skills"