ali-skills 0.0.15 → 0.0.17

package/node_modules/@ali/cli-skills/dist/cli.mjs

@@ -94,9 +94,32 @@ function parseSource(input) {
 	const githubRepoMatch = input.match(/github\.com\/([^/]+)\/([^/]+)/);
 	if (githubRepoMatch) {
 		const [, owner, repo] = githubRepoMatch;
+		const cleanRepo = repo.replace(/\.git$/, "");
+		const credentialMatch = input.match(/^(https?:\/\/)(?:([^@]+)@)?github\.com/);
+		const protocol = credentialMatch?.[1] ?? "https://";
+		const credential = credentialMatch?.[2];
 		return {
 			type: "github",
-			url: `https://github.com/${owner}/${repo.replace(/\.git$/, "")}.git`
+			url: credential ? `${protocol}${credential}@github.com/${owner}/${cleanRepo}.git` : `${protocol}github.com/${owner}/${cleanRepo}.git`
+		};
+	}
+	const internalTreeWithPathMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)\/(.+)/);
+	if (internalTreeWithPathMatch) {
+		const [, host, repoPath, ref, subpath] = internalTreeWithPathMatch;
+		if (repoPath && repoPath.includes("/")) return {
+			type: "internal",
+			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
+			ref,
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath
+		};
+	}
+	const internalTreeMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)$/);
+	if (internalTreeMatch) {
+		const [, host, repoPath, ref] = internalTreeMatch;
+		if (repoPath && repoPath.includes("/")) return {
+			type: "internal",
+			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
+			ref
 		};
 	}
 	const gitlabTreeWithPathMatch = input.match(/^(https?):\/\/([^/]+)\/(.+?)\/-\/tree\/([^/]+)\/(.+)/);
@@ -144,25 +167,6 @@ function parseSource(input) {
 			subpath: subpath ? sanitizeSubpath(subpath) : subpath
 		};
 	}
-	const internalTreeWithPathMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)\/(.+)/);
-	if (internalTreeWithPathMatch) {
-		const [, host, repoPath, ref, subpath] = internalTreeWithPathMatch;
-		if (repoPath && repoPath.includes("/")) return {
-			type: "internal",
-			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
-			ref,
-			subpath: subpath ? sanitizeSubpath(subpath) : subpath
-		};
-	}
-	const internalTreeMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/(.+?)(?:\/-)?\/tree\/([^/]+)$/);
-	if (internalTreeMatch) {
-		const [, host, repoPath, ref] = internalTreeMatch;
-		if (repoPath && repoPath.includes("/")) return {
-			type: "internal",
-			url: `${host.replace("gitlab.alibaba-inc.com", "code.alibaba-inc.com")}/${repoPath.replace(/\.git$/, "")}.git`,
-			ref
-		};
-	}
 	const internalRepoWithSubpathMatch = input.match(/^(https?:\/\/(?:[^@/]+@)?(?:code|gitlab)\.alibaba-inc\.com)\/([^/]+)\/([^/]+)\/(.+)$/);
 	if (internalRepoWithSubpathMatch) {
 		const [, host, owner, repo, subpath] = internalRepoWithSubpathMatch;
@@ -220,6 +224,27 @@ function isWellKnownUrl(input) {
 		return false;
 	}
 }
+function getDisplaySource(sourceUrl, options = {}) {
+	const format = options.format ?? "compact";
+	if (sourceUrl.startsWith("/") || sourceUrl.startsWith(".") || sourceUrl.startsWith("~")) return sourceUrl;
+	const sshMatch = sourceUrl.match(/^git@([^:]+):(.+)$/);
+	if (sshMatch) {
+		const [, host, path] = sshMatch;
+		if (!host || !path) return sourceUrl;
+		const cleanPath = path.replace(/\.git$/, "");
+		if (format === "compact" && (host === "code.alibaba-inc.com" || host === "gitlab.alibaba-inc.com")) return cleanPath;
+		return `https://${host}/${cleanPath}`;
+	}
+	if (sourceUrl.startsWith("http://") || sourceUrl.startsWith("https://")) try {
+		const url = new URL(sourceUrl);
+		const cleanPath = url.pathname.replace(/\.git$/, "").replace(/^\//, "");
+		if (format === "compact" && (url.hostname === "code.alibaba-inc.com" || url.hostname === "gitlab.alibaba-inc.com")) return cleanPath;
+		return `https://${url.hostname}/${cleanPath}`;
+	} catch {
+		return sourceUrl.replace(/^https?:\/\/[^@]+@/, "https://");
+	}
+	return sourceUrl;
+}
 const silentOutput = new Writable({ write(_chunk, _encoding, callback) {
 	callback();
 } });
@@ -384,6 +409,9 @@ async function searchMultiselect(options) {
 	});
 }
 const CLONE_TIMEOUT_MS = 6e4;
+function redactSensitiveText$1(text) {
+	return text.replace(/(https?:\/\/)([^/\s:@]+)(?::([^@/\s]*))?@/gi, "$1").replace(/([?&](?:private_token|access_token|token|api_key|access_key|secret|password)=)[^&\s]+/gi, "$1***");
+}
 function getGitUserConfig() {
 	try {
 		const name = execSync("git config user.name", {
@@ -451,11 +479,13 @@ async function cloneRepo(url, ref) {
 			force: true
 		}).catch(() => {});
 		const errorMessage = error instanceof Error ? error.message : String(error);
+		const safeUrl = getDisplaySource(url);
+		const safeErrorMessage = redactSensitiveText$1(errorMessage);
 		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
 		const isAuthError = errorMessage.includes("Authentication failed") || errorMessage.includes("could not read Username") || errorMessage.includes("Permission denied") || errorMessage.includes("Repository not found") || errorMessage.includes("HTTP Basic: Access denied") || errorMessage.includes("could not be found or you don") || errorMessage.toLowerCase().includes("you don't have permission") || /repository .+ not found/i.test(errorMessage);
-		if (isTimeout) throw new GitCloneError("Clone timed out after 60s. This often happens with private repos that require authentication.\n  Ensure you have access and your SSH keys or credentials are configured:\n  - For SSH: ssh-add -l (to check loaded keys)\n  - For HTTPS: gh auth status (if using GitHub CLI)", url, true, false);
-		if (isAuthError) throw new GitCloneError(`Authentication failed for ${url}.\n  - For private repos, ensure you have access\n  - For SSH: Check your keys with 'ssh -T git@github.com'\n  - For HTTPS: Run 'gh auth login' or configure git credentials`, url, false, true);
-		throw new GitCloneError(`Failed to clone ${url}: ${errorMessage}`, url, false, false);
+		if (isTimeout) throw new GitCloneError("Clone timed out after 60s. This often happens with private repos that require authentication.\n  Ensure you have access and your SSH keys or credentials are configured:\n  - For SSH: ssh-add -l (to check loaded keys)\n  - For HTTPS: gh auth status (if using GitHub CLI)", safeUrl, true, false);
+		if (isAuthError) throw new GitCloneError(`Authentication failed for ${safeUrl}.\n  - For private repos, ensure you have access\n  - For SSH: Check your keys with 'ssh -T git@github.com'\n  - For HTTPS: Run 'gh auth login' or configure git credentials`, safeUrl, false, true);
+		throw new GitCloneError(`Failed to clone ${safeUrl}: ${safeErrorMessage}`, safeUrl, false, false);
 	}
 }
 async function listRemoteBranches(url) {
@@ -2056,6 +2086,25 @@ async function saveSelectedAgents(agents) {
 	lock.lastSelectedAgents = agents;
 	await writeSkillLock(lock);
 }
+function sanitizeSourceUrl(url) {
+	const sshMatch = url.match(/^git@([^:]+):(.+)$/);
+	if (sshMatch) {
+		const [, host, path] = sshMatch;
+		if (!host || !path) return url;
+		return `https://${host}/${path.replace(/\.git$/, "")}.git`;
+	}
+	if (url.startsWith("http://") || url.startsWith("https://")) try {
+		const parsed = new URL(url);
+		parsed.username = "";
+		parsed.password = "";
+		let cleanUrl = parsed.toString();
+		if (!cleanUrl.endsWith(".git")) cleanUrl += ".git";
+		return cleanUrl;
+	} catch {
+		return url;
+	}
+	return url;
+}
 const LOCAL_LOCK_FILE = "skills-lock.json";
 const CURRENT_VERSION = 1;
 function getLocalLockPath(cwd) {
@@ -2066,11 +2115,27 @@ async function readLocalLock(cwd) {
 	try {
 		const content = await readFile(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
-		if (parsed.version < CURRENT_VERSION) return createEmptyLocalLock();
-		return parsed;
+		if (typeof parsed.version !== "number") return {
+			lock: parsed,
+			isOutdated: true
+		};
+		if (parsed.version < CURRENT_VERSION) return {
+			lock: parsed,
+			isOutdated: true
+		};
+		if (!parsed.skills) return {
+			lock: createEmptyLocalLock(),
+			isOutdated: false
+		};
+		return {
+			lock: parsed,
+			isOutdated: false
+		};
 	} catch {
-		return createEmptyLocalLock();
+		return {
+			lock: createEmptyLocalLock(),
+			isOutdated: false
+		};
 	}
 }
 async function writeLocalLock(lock, cwd) {
@@ -2112,7 +2177,7 @@ async function collectFiles(baseDir, currentDir, results) {
 	}));
 }
 async function addSkillToLocalLock(skillName, entry, cwd) {
-	const lock = await readLocalLock(cwd);
+	const { lock } = await readLocalLock(cwd);
 	lock.skills[skillName] = entry;
 	await writeLocalLock(lock, cwd);
 }
@@ -2132,8 +2197,11 @@ function logSkillParseFailures(failures) {
 		if (f.hint) M.message(import_picocolors.default.yellow(`  提示: ${f.hint}`));
 	}
 }
-var version$1 = "2.0.15";
+var version$1 = "2.0.17";
 const isCancelled$1 = (value) => typeof value === "symbol";
+function redactSensitiveText(text) {
+	return text.replace(/(https?:\/\/)([^/\s:@]+)(?::([^@/\s]*))?@/gi, "$1").replace(/([?&](?:private_token|access_token|token|api_key|access_key|secret|password)=)[^&\s]+/gi, "$1***");
+}
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
 	if (!ownerRepo) return false;
@@ -2386,7 +2454,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 				value: key,
 				label: config.displayName
 			})));
-			if (pD(selected)) {
+			if (isCancelled$1(selected)) {
 				xe("Installation cancelled");
 				process.exit(0);
 			}
@@ -2400,7 +2468,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 			} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
 		} else {
 			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
+			if (isCancelled$1(selected)) {
 				xe("Installation cancelled");
 				process.exit(0);
 			}
@@ -2524,8 +2592,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 			await addSkillToLock(skill.installName, {
 				source: sourceIdentifier,
 				sourceType: "well-known",
-				sourceUrl: skill.sourceUrl,
-				skillFolderHash: ""
+				sourceUrl: sanitizeSourceUrl(skill.sourceUrl)
 			});
 		} catch {}
 	}
@@ -2653,7 +2720,8 @@ async function runAdd(args, options = {}) {
 				}
 			} catch {}
 		}
-		spinner.stop(`Source: ${parsed.type === "local" ? parsed.localPath : parsed.url}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
+		const displaySource = parsed.type === "local" ? parsed.localPath : getDisplaySource(parsed.url, { format: "absolute" });
+		spinner.stop(`Source: ${displaySource}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
 		if (parsed.type === "well-known") {
 			await handleWellKnownSkills(source, parsed.url, options, spinner);
 			return;
@@ -2886,7 +2954,7 @@ async function runAdd(args, options = {}) {
 					value: key,
 					label: config.displayName
 				})));
-				if (pD(selected)) {
+				if (isCancelled$1(selected)) {
 					xe("Installation cancelled");
 					await cleanup(tempDir);
 					process.exit(0);
@@ -2901,7 +2969,7 @@ async function runAdd(args, options = {}) {
 				} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
 			} else {
 				const selected = await selectAgentsInteractive({ global: options.global });
-				if (pD(selected)) {
+				if (isCancelled$1(selected)) {
 					xe("Installation cancelled");
 					await cleanup(tempDir);
 					process.exit(0);
@@ -3117,18 +3185,28 @@ async function runAdd(args, options = {}) {
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
-					let skillFolderHash = "";
+					let skillFolderHash;
+					let commitHash;
 					const skillPathValue = skillFiles[skill.name];
-					if (parsed.type === "github" && skillPathValue) {
+					let skillPath = skillPathValue;
+					if (skillPath) {
+						if (skillPath.endsWith("/SKILL.md")) skillPath = skillPath.slice(0, -9);
+						else if (skillPath.endsWith("SKILL.md")) skillPath = skillPath.slice(0, -8);
+					}
+					if (effectiveSourceType === "github" && skillPathValue) {
 						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue, getGitHubToken());
 						if (hash) skillFolderHash = hash;
+					} else if (effectiveSourceType === "internal" && skillPath !== void 0) {
+						const hash = await fetchAliInternalCommitHash(normalizedSource, skillPath, null);
+						if (hash) commitHash = hash;
 					}
 					await addSkillToLock(skill.name, {
 						source: lockSource || normalizedSource,
 						sourceType: effectiveSourceType,
-						sourceUrl: parsed.url,
-						skillPath: skillPathValue,
-						skillFolderHash,
+						sourceUrl: sanitizeSourceUrl(parsed.url),
+						skillPath,
+						...skillFolderHash && { skillFolderHash },
+						...commitHash && { commitHash },
 						pluginName: skill.pluginName
 					});
 				} catch {}
@@ -3141,8 +3219,9 @@ async function runAdd(args, options = {}) {
 				if (successfulSkillNames.has(skillDisplayName)) try {
 					const computedHash = await computeSkillFolderHash(skill.path);
 					const skillFilePath = skillFiles[skill.name];
+					const rawSource = lockSource || parsed.url;
 					const lockEntry = {
-						source: lockSource || parsed.url,
+						source: effectiveSourceType === "internal" || effectiveSourceType === "github" ? rawSource.replace(/^https?:\/\/[^@]+@/, "https://") : rawSource,
 						sourceType: effectiveSourceType,
 						computedHash
 					};
@@ -3231,8 +3310,8 @@ async function runAdd(args, options = {}) {
 	} catch (error) {
 		if (error instanceof GitCloneError) {
 			M.error(import_picocolors.default.red("Failed to clone repository"));
-			for (const line of error.message.split("\n")) M.message(import_picocolors.default.dim(line));
-		} else M.error(error instanceof Error ? error.message : "Unknown error occurred");
+			for (const line of error.message.split("\n")) M.message(import_picocolors.default.dim(redactSensitiveText(line)));
+		} else M.error(redactSensitiveText(error instanceof Error ? error.message : "Unknown error occurred"));
 		showInstallTip();
 		Se(import_picocolors.default.red("Installation failed"));
 		process.exit(1);
@@ -3305,7 +3384,7 @@ const BOLD$2 = "\x1B[1m";
 const DIM$5 = "\x1B[38;5;102m";
 const TEXT$4 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
-const YELLOW$4 = "\x1B[33m";
+const YELLOW$5 = "\x1B[33m";
 const SKILLS_API_URL = process.env.SKILLS_API_URL;
 const SEARCH_ENDPOINT = SKILLS_API_URL ? `${SKILLS_API_URL.replace(/\/+$/, "")}/search` : "https://next-ai-base.pre-fn.alibaba-inc.com/api/skills/search";
 function formatInstalls(count) {
@@ -3375,7 +3454,7 @@ async function runSearchPrompt(initialQuery = "") {
 				const source = skill.source ? ` ${DIM$5}${skill.source}${RESET$5}` : "";
 				const installs = formatInstalls(skill.installs);
 				const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$5}` : "";
-				const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$4}GitHub${RESET$5}` : "";
+				const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$5}GitHub${RESET$5}` : "";
 				const loadingIndicator = loading && i === 0 ? ` ${DIM$5}...${RESET$5}` : "";
 				lines.push(`  ${arrow} ${name}${source}${githubBadge}${installsBadge}${loadingIndicator}`);
 			}
@@ -3484,7 +3563,7 @@ ${DIM$5}  2) npx @ali/cli-skills add <owner/repo@skill>${RESET$5}`;
 		for (const skill of results.slice(0, 6)) {
 			const pkg = skill.source || skill.slug;
 			const installs = formatInstalls(skill.installs);
-			const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$4}GitHub${RESET$5}` : "";
+			const githubBadge = skill.sourceType === "github" ? ` ${YELLOW$5}GitHub${RESET$5}` : "";
 			console.log(`${TEXT$4}${pkg}@${skill.name}${RESET$5}${githubBadge}${installs ? ` ${CYAN$1}${installs}${RESET$5}` : ""}`);
 			const skillUrl = buildSkillUrl(skill);
 			console.log(`${DIM$5}└ ${skillUrl}${RESET$5}`);
@@ -3612,7 +3691,7 @@ async function runSync(args, options = {}) {
 		M.info(`${import_picocolors.default.cyan(skill.name)} ${import_picocolors.default.dim(`from ${skill.packageName}`)}`);
 		if (skill.description) M.message(import_picocolors.default.dim(`  ${skill.description}`));
 	}
-	const localLock = await readLocalLock(cwd);
+	const { lock: localLock } = await readLocalLock(cwd);
 	const toInstall = [];
 	const upToDate = [];
 	if (options.force) {
@@ -3812,7 +3891,8 @@ function parseSyncOptions(args) {
 	return { options };
 }
 async function runInstallFromLock(args) {
-	const lock = await readLocalLock(process.cwd());
+	const { lock, isOutdated } = await readLocalLock(process.cwd());
+	if (isOutdated) M.warn("Project lock file may be outdated. Some skills might not install correctly.");
 	const skillEntries = Object.entries(lock.skills);
 	if (skillEntries.length === 0) {
 		M.warn("No project skills found in skills-lock.json");
@@ -3863,7 +3943,7 @@ const RESET$4 = "\x1B[0m";
 const BOLD$1 = "\x1B[1m";
 const DIM$4 = "\x1B[38;5;102m";
 const CYAN = "\x1B[36m";
-const YELLOW$3 = "\x1B[33m";
+const YELLOW$4 = "\x1B[33m";
 function shortenPath(fullPath, cwd) {
 	const home = homedir();
 	if (fullPath.startsWith(home)) return fullPath.replace(home, "~");
@@ -3897,7 +3977,7 @@ async function runList(args) {
 		const validAgents = Object.keys(agents);
 		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
 		if (invalidAgents.length > 0) {
-			console.log(`${YELLOW$3}Invalid agents: ${invalidAgents.join(", ")}${RESET$4}`);
+			console.log(`${YELLOW$4}Invalid agents: ${invalidAgents.join(", ")}${RESET$4}`);
 			console.log(`${DIM$4}Valid agents: ${validAgents.join(", ")}${RESET$4}`);
 			process.exit(1);
 		}
@@ -3934,7 +4014,7 @@ async function runList(args) {
 		const prefix = indent ? "  " : "";
 		const shortPath = shortenPath(skill.canonicalPath, cwd);
 		const agentNames = skill.agents.map((a) => agents[a].displayName);
-		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW$3}not linked${RESET$4}`;
+		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW$4}not linked${RESET$4}`;
 		console.log(`${prefix}${CYAN}${skill.name}${RESET$4} ${DIM$4}${shortPath}${RESET$4}`);
 		console.log(`${prefix}  ${DIM$4}Agents:${RESET$4} ${agentInfo}`);
 	}
@@ -4537,7 +4617,7 @@ const DIM$3 = "\x1B[38;5;102m";
 const TEXT$3 = "\x1B[38;5;145m";
 const RESET$3 = "\x1B[0m";
 const GREEN$2 = "\x1B[32m";
-const YELLOW$2 = "\x1B[33m";
+const YELLOW$3 = "\x1B[33m";
 function startLocalServer() {
 	return new Promise((resolve) => {
 		let resolveCallback;
@@ -4685,7 +4765,7 @@ async function status() {
 	console.log(`  工号: ${auth.empId}`);
 	console.log(`  网关: ${auth.gatewayUrl}`);
 	if (expired) {
-		console.log(`  Token: ${YELLOW$2}即将过期${RESET$3}`);
+		console.log(`  Token: ${YELLOW$3}即将过期${RESET$3}`);
 		console.log(`${TEXT$3}建议重新登录: npx ali-skills login${RESET$3}`);
 	} else console.log(`  Token: ${GREEN$2}有效${RESET$3} (还剩 ${remainingDays} 天)`);
 }
@@ -4773,7 +4853,7 @@ const TEXT$2 = "\x1B[38;5;145m";
 const RESET$2 = "\x1B[0m";
 const GREEN$1 = "\x1B[32m";
 const RED$1 = "\x1B[31m";
-const YELLOW$1 = "\x1B[33m";
+const YELLOW$2 = "\x1B[33m";
 function openBrowser$1(url) {
 	const platform = process.platform;
 	spawn(platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open", [url], {
@@ -4808,7 +4888,7 @@ function getPlatformPrivateToken(platformKey, explicitToken) {
 }
 async function promptConfigureToken(platformKey, platform) {
 	console.log();
-	console.log(`${YELLOW$1}⚠️  ${platform.name} 需要配置 Private Token${RESET$2}`);
+	console.log(`${YELLOW$2}⚠️  ${platform.name} 需要配置 Private Token${RESET$2}`);
 	if (platform.tokenDocUrl) console.log(`${DIM$2}Token 获取地址: ${platform.tokenDocUrl}${RESET$2}`);
 	if (!await ye({
 		message: "是否现在配置?",
@@ -5038,7 +5118,7 @@ const DIM$1 = "\x1B[38;5;102m";
 const TEXT$1 = "\x1B[38;5;145m";
 const RESET$1 = "\x1B[0m";
 const GREEN = "\x1B[32m";
-const YELLOW = "\x1B[33m";
+const YELLOW$1 = "\x1B[33m";
 const RED = "\x1B[31m";
 function showConfigHelp() {
 	console.log(`
@@ -5108,12 +5188,12 @@ async function configurePlatform(platformKey) {
 			console.log(`${GREEN}✓ ${platform.name} 使用内置凭证，无需配置${RESET$1}`);
 			break;
 		case "app_code+buc":
-			console.log(`${YELLOW}! ${platform.name} 需要 BUC 登录${RESET$1}`);
+			console.log(`${YELLOW$1}! ${platform.name} 需要 BUC 登录${RESET$1}`);
 			console.log(`${DIM$1}请运行: npx ali-skills login${RESET$1}`);
 			break;
 		case "buc_sso_refresh":
 		case "buc_sso_ticket":
-			console.log(`${YELLOW}! ${platform.name} 需要 BUC 登录${RESET$1}`);
+			console.log(`${YELLOW$1}! ${platform.name} 需要 BUC 登录${RESET$1}`);
 			console.log(`${DIM$1}请运行: npx ali-skills login${RESET$1}`);
 			break;
 		default:
@@ -5210,6 +5290,7 @@ const RESET = "\x1B[0m";
 const BOLD = "\x1B[1m";
 const DIM = "\x1B[38;5;102m";
 const TEXT = "\x1B[38;5;145m";
+const YELLOW = "\x1B[33m";
 const LOGO_LINES = [
 	" █████╗ ██╗     ██╗    ███████╗██╗  ██╗██╗██╗     ██╗     ███████╗",
 	"██╔══██╗██║     ██║    ██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝",
@@ -5571,26 +5652,42 @@ function readSkillLock() {
 	try {
 		const content = readFileSync(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
+		if (typeof parsed.version !== "number") return {
+			lock: {
+				...parsed,
+				version: CURRENT_LOCK_VERSION
+			},
+			isOutdated: true
 		};
 		if (parsed.version < CURRENT_LOCK_VERSION) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
+			lock: parsed,
+			isOutdated: true
+		};
+		if (!parsed.skills) return {
+			lock: {
+				version: CURRENT_LOCK_VERSION,
+				skills: {}
+			},
+			isOutdated: false
+		};
+		return {
+			lock: parsed,
+			isOutdated: false
 		};
-		return parsed;
 	} catch {
 		return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
+			lock: {
+				version: CURRENT_LOCK_VERSION,
+				skills: {}
+			},
+			isOutdated: false
 		};
 	}
 }
 function getSkipReason(entry) {
 	if (entry.sourceType === "local") return "Local path";
 	if (entry.sourceType === "git") return "Git URL (hash tracking not supported)";
-	if (!entry.skillFolderHash) return "No version hash available";
+	if (!(entry.sourceType === "internal" ? entry.commitHash : entry.skillFolderHash)) return "No version hash available";
 	if (!entry.skillPath) return "No skill path recorded";
 	return "No version tracking";
 }
@@ -5599,6 +5696,39 @@ async function checkSkillsForUpdates(skills, token) {
 	const errors = [];
 	const skipped = [];
 	for (const [skillName, entry] of Object.entries(skills)) {
+		if (entry.sourceType === "internal") {
+			if (!entry.commitHash || !entry.skillPath) {
+				skipped.push({
+					name: skillName,
+					reason: getSkipReason(entry),
+					sourceUrl: entry.sourceUrl
+				});
+				continue;
+			}
+			try {
+				const latestCommit = await fetchAliInternalCommitHash(entry.source, entry.skillPath, null);
+				if (!latestCommit) {
+					errors.push({
+						name: skillName,
+						source: entry.source,
+						error: "Could not fetch from GitLab"
+					});
+					continue;
+				}
+				if (latestCommit !== entry.commitHash) updates.push({
+					name: skillName,
+					source: entry.source,
+					entry
+				});
+			} catch (err) {
+				errors.push({
+					name: skillName,
+					source: entry.source,
+					error: err instanceof Error ? err.message : "Unknown error"
+				});
+			}
+			continue;
+		}
 		if (!entry.skillFolderHash || !entry.skillPath) {
 			skipped.push({
 				name: skillName,
@@ -5645,7 +5775,7 @@ async function runCheck(args = []) {
 	let skipped = [];
 	let skillCount = 0;
 	if (isGlobal) {
-		const globalLock = readSkillLock();
+		const { lock: globalLock, isOutdated: isGlobalLockOutdated } = readSkillLock();
 		const globalSkillNames = Object.keys(globalLock.skills);
 		skillCount = globalSkillNames.length;
 		if (globalSkillNames.length === 0) {
@@ -5667,9 +5797,11 @@ async function runCheck(args = []) {
 		if (skipped.length > 0) {
 			console.log();
 			console.log(`${DIM}  ${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
+			if (isGlobalLockOutdated) console.log(`${YELLOW}  Note: Your lock file may be outdated. Re-adding these skills may fix this.${RESET}`);
 			for (const skill of skipped) {
 				console.log(`    ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
-				console.log(`      ${DIM}To update: ${TEXT}npx ali-skills add ${skill.sourceUrl} -g -y${RESET}`);
+				const displaySource = getDisplaySource(skill.sourceUrl);
+				console.log(`      ${DIM}To update: ${TEXT}npx ali-skills add ${displaySource} -g -y${RESET}`);
 			}
 		}
 		console.log();
@@ -5679,7 +5811,7 @@ async function runCheck(args = []) {
 			console.log(`${DIM}Run${RESET} ${TEXT}npx ali-skills update -g${RESET} ${DIM}to update all global skills${RESET}`);
 		}
 	} else {
-		const projectLock = await readLocalLock();
+		const { lock: projectLock, isOutdated: isLocalLockOutdated } = await readLocalLock();
 		const projectSkillNames = Object.keys(projectLock.skills);
 		skillCount = projectSkillNames.length;
 		if (projectSkillNames.length === 0) {
@@ -5773,6 +5905,7 @@ async function runCheck(args = []) {
 		if (skipped.length > 0) {
 			console.log();
 			console.log(`${DIM}  ${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
+			if (isLocalLockOutdated) console.log(`${YELLOW}  Note: Your lock file may be outdated. Re-adding these skills may fix this.${RESET}`);
 			for (const skill of skipped) console.log(`    ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
 		}
 		console.log();
@@ -5800,10 +5933,11 @@ async function runUpdate(args = []) {
 	let skillsToCheck = {};
 	let scopeLabel = "project";
 	if (isGlobal) {
-		skillsToCheck = readSkillLock().skills;
+		const { lock: globalLock } = readSkillLock();
+		skillsToCheck = globalLock.skills;
 		scopeLabel = "global";
 	} else {
-		const projectLock = await readLocalLock();
+		const { lock: projectLock } = await readLocalLock();
 		for (const [name, entry] of Object.entries(projectLock.skills)) {
 			let sourceUrl;
 			if (entry.sourceType === "github") sourceUrl = `https://github.com/${entry.source}`;
@@ -5829,7 +5963,7 @@ async function runUpdate(args = []) {
 	}
 	const availableUpdates = [];
 	const skipped = [];
-	const projectLock = !isGlobal ? await readLocalLock() : null;
+	const projectLock = (!isGlobal ? await readLocalLock() : null)?.lock ?? null;
 	for (const skillName of skillNames) {
 		const entry = skillsToCheck[skillName];
 		if (!entry) continue;
@@ -6090,10 +6224,20 @@ async function main() {
 }
 main().then(async () => {
 	if (getPendingTelemetryCount() > 0) {
+		const syncStartAt = Date.now();
+		const longSyncThresholdMs = 800;
+		let didShowStartMessage = false;
+		const startMessageTimer = setTimeout(() => {
+			didShowStartMessage = true;
+			console.log();
+			console.log(`${DIM}Syncing telemetry data...${RESET}`);
+		}, longSyncThresholdMs);
+		await flushTelemetry();
+		clearTimeout(startMessageTimer);
 		console.log();
-		console.log(`${DIM}Syncing installation data...${RESET}`);
-	}
-	await flushTelemetry();
+		if (didShowStartMessage || Date.now() - syncStartAt >= longSyncThresholdMs) console.log(`${DIM}Telemetry data sync complete${RESET}`);
+		else console.log(`${DIM}Telemetry data synced${RESET}`);
+	} else await flushTelemetry();
 	process.exit(0);
 }).catch(async (error) => {
 	console.error(error);

package/node_modules/@ali/cli-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ali/cli-skills",
-  "version": "2.0.15",
+  "version": "2.0.17",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ali-skills",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -31,7 +31,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@ali/cli-skills": "^2.0.15"
+    "@ali/cli-skills": "^2.0.17"
   },
   "bundleDependencies": [
     "@ali/cli-skills"