ali-skills 0.0.25 → 0.0.27

package/node_modules/@ali/cli-skills/dist/cli.mjs

@@ -2340,7 +2340,7 @@ function logSkillParseFailures(failures) {
 		if (f.hint) M.message(import_picocolors.default.yellow(`  提示: ${f.hint}`));
 	}
 }
-var version$1 = "2.0.25";
+var version$1 = "2.0.28";
 const isCancelled$1 = (value) => typeof value === "symbol";
 function redactSensitiveText(text) {
 	return text.replace(/(https?:\/\/)([^/\s:@]+)(?::([^@/\s]*))?@/gi, "$1").replace(/([?&](?:private_token|access_token|token|api_key|access_key|secret|password)=)[^&\s]+/gi, "$1***");
@@ -2531,6 +2531,18 @@ async function selectAgentsInteractive(options) {
 	return [];
 }
 setVersion(version$1);
+function isCiEnvironment() {
+	if (process.env.CI) return true;
+	if (process.env.GITHUB_ACTIONS) return true;
+	if (process.env.GITLAB_CI) return true;
+	if (process.env.BUILDKITE) return true;
+	if (process.env.JENKINS_URL) return true;
+	return false;
+}
+function resolveInstallMode(options) {
+	if (options.installMode) return options.installMode;
+	return options.copy ? "copy" : "symlink";
+}
 async function handleWellKnownSkills(source, url, options, spinner) {
 	spinner.start("Discovering skills from well-known endpoint...");
 	const skills = await wellKnownProvider.fetchAllSkills(url);
@@ -2661,8 +2673,8 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		}
 		installGlobally = scope;
 	}
-	let installMode = options.copy ? "copy" : "symlink";
-	if (!options.copy && !options.yes) {
+	let installMode = resolveInstallMode(options);
+	if (!options.installMode && !options.copy && !options.yes) {
 		const modeChoice = await ve({
 			message: "Installation method",
 			options: getInstallMethodOptions()
@@ -2819,6 +2831,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 async function runAdd(args, options = {}) {
 	const source = args[0];
 	let installTipShown = false;
+	const ciMode = options.ci ?? isCiEnvironment();
 	const showInstallTip = () => {
 		if (installTipShown) return;
 		M.message(import_picocolors.default.dim("Tip: use the --yes (-y) and --global (-g) flags to install without prompts."));
@@ -2836,6 +2849,7 @@ async function runAdd(args, options = {}) {
 		console.log();
 		process.exit(1);
 	}
+	if (ciMode && !options.yes) options.yes = true;
 	if (options.all) {
 		options.skill = ["*"];
 		options.agent = ["*"];
@@ -3161,8 +3175,8 @@ async function runAdd(args, options = {}) {
 			}
 			installGlobally = scope;
 		}
-		let installMode = options.copy ? "copy" : "symlink";
-		if (!options.copy && !options.yes) {
+		let installMode = resolveInstallMode(options);
+		if (!options.installMode && !options.copy && !options.yes) {
 			const modeChoice = await ve({
 				message: "Installation method",
 				options: getInstallMethodOptions()
@@ -3498,6 +3512,12 @@ async function promptForFindSkills(options, targetAgents) {
 function parseAddOptions(args) {
 	const options = {};
 	const source = [];
+	const installModes = [
+		"symlink",
+		"copy",
+		"symlink-isolated",
+		"copy-isolated"
+	];
 	for (let i = 0; i < args.length; i++) {
 		const arg = args[i];
 		if (arg === "-g" || arg === "--global") options.global = true;
@@ -3531,7 +3551,13 @@ function parseAddOptions(args) {
 			options.branch = args[i];
 		} else if (arg === "--full-depth") options.fullDepth = true;
 		else if (arg === "--copy") options.copy = true;
-		else if (arg && !arg.startsWith("-")) source.push(arg);
+		else if (arg === "--ci") options.ci = true;
+		else if (arg === "--install-mode") {
+			i++;
+			const mode = args[i];
+			if (!mode || !installModes.includes(mode)) throw new Error(`Invalid value for --install-mode: ${mode ?? "(empty)"} (expected: symlink, copy, symlink-isolated, copy-isolated)`);
+			options.installMode = mode;
+		} else if (arg && !arg.startsWith("-")) source.push(arg);
 	}
 	return {
 		source,
@@ -4720,6 +4746,10 @@ function readConfig() {
 function saveConfig(config) {
 	safeWriteFile(CONFIG_FILE, JSON.stringify(config, null, 2));
 }
+function getSsoRefreshCookieTtlMs() {
+	const sec = Number(process.env.ALI_SKILLS_SSO_REFRESH_COOKIE_TTL_SECONDS?.trim() || process.env.BUC_SSO_REFRESH_COOKIE_TTL_SECONDS?.trim() || "7200");
+	return (Number.isFinite(sec) && sec > 0 ? sec : 7200) * 1e3;
+}
 function readAuth() {
 	try {
 		if (!existsSync(AUTH_FILE)) return null;
@@ -4951,6 +4981,9 @@ function startLocalServer() {
 				const name = url.searchParams.get("name") || "";
 				const privateToken = url.searchParams.get("private_token") || "";
 				const ssoRefreshToken = url.searchParams.get("sso_refresh_token") || "";
+				const ssoRtExpRaw = url.searchParams.get("sso_refresh_token_expires_at") || "";
+				const ssoRtExpSec = parseInt(ssoRtExpRaw, 10);
+				const ssoRefreshTokenExpiresAtMs = ssoRefreshToken && ssoRtExpRaw !== "" && Number.isFinite(ssoRtExpSec) && ssoRtExpSec > 0 ? ssoRtExpSec * 1e3 : void 0;
 				const expiresAt = url.searchParams.get("expires_at") || "0";
 				if (!empId || !privateToken) {
 					res.writeHead(400, { "Content-Type": "text/html" });
@@ -5107,6 +5140,7 @@ function startLocalServer() {
 					name,
 					privateToken,
 					ssoRefreshToken,
+					ssoRefreshTokenExpiresAtMs,
 					expiresAt: parseInt(expiresAt, 10)
 				});
 				setTimeout(() => server.close(), 1e3);
@@ -5132,13 +5166,51 @@ function openBrowser$2(url) {
 		stdio: "ignore"
 	});
 }
-async function login() {
-	const existingAuth = readAuth();
-	if (existingAuth && !isAuthExpired(existingAuth)) {
-		console.log(`${YELLOW$3}! 您已经登录为: ${existingAuth.name} (${existingAuth.account})${RESET$3}`);
-		console.log();
-		console.log(`${DIM$3}如需重新登录，请先执行: npx ali-skills logout${RESET$3}`);
-		return;
+async function revokeGatewaySessionIfPossible(auth) {
+	try {
+		const revokeUrl = `${auth.gatewayUrl || getGatewayUrl()}/api/gateway/revoke`;
+		const revokeRes = await fetch(revokeUrl, {
+			method: "POST",
+			headers: { "X-Private-Token": auth.privateToken }
+		});
+		if (revokeRes.ok) console.log(`${GREEN$2}✓ 已撤销当前网关会话${RESET$3}`);
+		else if (revokeRes.status === 404) console.log(`${DIM$3}服务端暂不支持撤销网关会话，继续本机登出${RESET$3}`);
+		else console.log(`${YELLOW$3}⚠️ 撤销网关会话失败，继续本机登出${RESET$3}`);
+	} catch {
+		console.log(`${YELLOW$3}⚠️ 撤销网关会话失败，继续本机登出${RESET$3}`);
+	}
+}
+function getEffectiveSsoRefreshCookieExpiresAtMs(auth) {
+	if (!auth.ssoRefreshToken?.trim()) return null;
+	if (typeof auth.ssoRefreshTokenExpiresAt === "number" && auth.ssoRefreshTokenExpiresAt > 0) return auth.ssoRefreshTokenExpiresAt;
+	if (typeof auth.ssoRefreshTokenFetchedAt === "number" && auth.ssoRefreshTokenFetchedAt > 0) return auth.ssoRefreshTokenFetchedAt + getSsoRefreshCookieTtlMs();
+	return null;
+}
+function exitIfSsoRefreshCookieExpired(auth, opts) {
+	const exp = getEffectiveSsoRefreshCookieExpiresAtMs(auth);
+	if (exp === null) return;
+	if (Date.now() < exp) return;
+	if (!opts?.quiet) {
+		console.error(`${YELLOW$3}SSO_REFRESH_TOKEN 已超过预估有效期，根域 cookie 直连会鉴权失败${RESET$3}`);
+		console.log(`${DIM$3}请执行: npx ali-skills login --reauth${RESET$3}`);
+	}
+	process.exit(1);
+}
+async function login(options) {
+	if (options?.reauth) {
+		const auth = readAuth();
+		if (auth) {
+			await revokeGatewaySessionIfPossible(auth);
+			removeAuth();
+		}
+	} else {
+		const existingAuth = readAuth();
+		if (existingAuth && !isAuthExpired(existingAuth)) {
+			console.log(`${YELLOW$3}! 您已经登录为: ${existingAuth.name} (${existingAuth.account})${RESET$3}`);
+			console.log();
+			console.log(`${DIM$3}如需重新登录，请执行: npx ali-skills login --reauth${RESET$3}`);
+			return;
+		}
 	}
 	console.log(`${TEXT$3}正在启动本地服务...${RESET$3}`);
 	const { port, waitForCallback, close } = await startLocalServer();
@@ -5151,7 +5223,9 @@ async function login() {
 	openBrowser$2(loginUrl);
 	console.log(`${TEXT$3}等待授权完成...${RESET$3}`);
 	try {
-		const { empId, account, name, privateToken, ssoRefreshToken, expiresAt } = await waitForCallback();
+		const { empId, account, name, privateToken, ssoRefreshToken, ssoRefreshTokenExpiresAtMs, expiresAt } = await waitForCallback();
+		let ssoRtExpStored;
+		if (ssoRefreshToken) ssoRtExpStored = ssoRefreshTokenExpiresAtMs ?? Date.now() + getSsoRefreshCookieTtlMs();
 		saveAuth({
 			empId,
 			account,
@@ -5161,13 +5235,19 @@ async function login() {
 			ssoRefreshToken,
 			ssoRefreshTokenFetchedAt: ssoRefreshToken ? Date.now() : void 0,
 			ssoRefreshTokenLastCheckedAt: ssoRefreshToken ? Date.now() : void 0,
+			ssoRefreshTokenExpiresAt: ssoRtExpStored,
 			expiresAt: expiresAt * 1e3
 		});
 		console.log();
 		console.log(`${GREEN$2}✓ 登录成功！${RESET$3}`);
 		console.log(`${TEXT$3}欢迎: ${name} (${account})${RESET$3}`);
 		console.log(`${DIM$3}Token 有效期至: ${(/* @__PURE__ */ new Date(expiresAt * 1e3)).toLocaleDateString()}${RESET$3}`);
-		if (!ssoRefreshToken) console.log(`${DIM$3}注意: SSO_REFRESH_TOKEN 未获取，需要时将从服务端获取${RESET$3}`);
+		if (ssoRefreshToken && ssoRtExpStored) console.log(`${DIM$3}SSO_REFRESH 预估过期: ${new Date(ssoRtExpStored).toLocaleString()}${RESET$3}`);
+		if (!ssoRefreshToken) {
+			console.log();
+			console.log(`${YELLOW$3}⚠ SSO_REFRESH_TOKEN 获取异常：本次授权回调未携带该凭证，网关代理等依赖 SSO Cookie 的能力可能不可用${RESET$3}`);
+			console.log(`${DIM$3}可尝试：在网页端（https://ali-skills.alibaba-inc.com）退出平台登录后重新执行 login 命令。同时请将此问题反馈给本工具开发者处理，感谢！${RESET$3}`);
+		}
 	} catch (error) {
 		close();
 		throw error;
@@ -5262,18 +5342,7 @@ async function logout(platformInput, yuqueGroup, clearAll) {
 		return;
 	}
 	try {
-		try {
-			const revokeUrl = `${getGatewayUrl()}/api/gateway/revoke`;
-			const revokeRes = await fetch(revokeUrl, {
-				method: "POST",
-				headers: { "X-Private-Token": auth.privateToken }
-			});
-			if (revokeRes.ok) console.log(`${GREEN$2}✓ 已撤销当前网关会话${RESET$3}`);
-			else if (revokeRes.status === 404) console.log(`${DIM$3}服务端暂不支持撤销网关会话，继续本机登出${RESET$3}`);
-			else console.log(`${YELLOW$3}⚠️ 撤销网关会话失败，继续本机登出${RESET$3}`);
-		} catch {
-			console.log(`${YELLOW$3}⚠️ 撤销网关会话失败，继续本机登出${RESET$3}`);
-		}
+		await revokeGatewaySessionIfPossible(auth);
 		removeAuth();
 		console.log(`${GREEN$2}✓ 已登出${RESET$3}`);
 	} catch (error) {
@@ -5433,6 +5502,11 @@ async function status(args = {}) {
 	console.log(`  工号: ${auth.empId}`);
 	console.log(`  网关: ${getGatewayUrl()}`);
 	console.log(`  SSO_REFRESH_TOKEN: ${auth.ssoRefreshToken ? `${GREEN$2}已缓存${RESET$3}` : `${YELLOW$3}未缓存${RESET$3}`}`);
+	const ssoRtExp = getEffectiveSsoRefreshCookieExpiresAtMs(auth);
+	if (auth.ssoRefreshToken && ssoRtExp) {
+		const rtDead = Date.now() >= ssoRtExp;
+		console.log(`  SSO_REFRESH 预估过期: ${new Date(ssoRtExp).toLocaleString()}${rtDead ? ` ${YELLOW$3}(已过期)${RESET$3}` : ""}`);
+	} else if (auth.ssoRefreshToken) console.log(`  SSO_REFRESH 预估过期: ${YELLOW$3}未知${RESET$3} ${DIM$3}(可 login --reauth 重新写入)${RESET$3}`);
 	if (expired) {
 		console.log(`  Token: ${YELLOW$3}即将过期${RESET$3}`);
 		console.log(`${TEXT$3}建议重新登录: npx ali-skills login${RESET$3}`);
@@ -5461,13 +5535,14 @@ async function ensureSsoRefreshToken() {
 		});
 		if (response.status === 200) {
 			const data = await response.json();
+			const mergedRtExp = typeof data.ssoRefreshTokenExpiresAt === "number" && data.ssoRefreshTokenExpiresAt > 0 ? data.ssoRefreshTokenExpiresAt : Date.now() + getSsoRefreshCookieTtlMs();
 			saveAuth({
 				...auth,
 				gatewayUrl: auth.gatewayUrl || getGatewayUrl(),
 				ssoRefreshToken: data.ssoRefreshToken,
 				ssoRefreshTokenFetchedAt: Date.now(),
 				ssoRefreshTokenLastCheckedAt: Date.now(),
-				ssoRefreshTokenExpiresAt: data.ssoRefreshTokenExpiresAt
+				ssoRefreshTokenExpiresAt: mergedRtExp
 			});
 			console.log(`${DIM$3}已从服务端获取 SSO_REFRESH_TOKEN${RESET$3}`);
 			return data.ssoRefreshToken;
@@ -5568,6 +5643,12 @@ function getAuthModeDescription(mode) {
 		default: return "Auto";
 	}
 }
+function maskCredential(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return "(empty)";
+	if (trimmed.length <= 8) return "******";
+	return `${trimmed.slice(0, 4)}...${trimmed.slice(-4)}`;
+}
 const O2_CREDENTIALS_BASE64 = "eyJhY2Nlc3NLZXlJZCI6IlNZS2NFNWtrbHhtT1M3WjJYYXRObiIsImFjY2Vzc0tleVNlY3JldCI6IjQ2NGNhYTc0MmNiYTk2NzFkZjM5NzJkYzdhNWI3MmQ1Nzk5ZTc2NTQyYzRiZGFjM2M3YTk5N2QzMDM3YTIyNzAifQ==";
 function getO2Credentials() {
 	const accessKeyId = process.env.O2_ACCESS_KEY_ID?.trim();
@@ -5606,8 +5687,14 @@ async function sendO2SdkRequest(targetUrl, options, withSsoTicket) {
 	const path = parsed.pathname;
 	const query = searchParamsToObject(parsed.searchParams);
 	const headers = { ...options.headers ?? {} };
+	let ssoTicketSource = null;
 	if (withSsoTicket) {
-		const ssoTicket = await ensureSsoTicket();
+		let ssoTicket = options.ssoTicket?.trim() || null;
+		if (ssoTicket) ssoTicketSource = "arg";
+		else {
+			ssoTicket = await ensureSsoTicket();
+			if (ssoTicket) ssoTicketSource = "gateway";
+		}
 		if (!ssoTicket) throw new Error("无法获取 SSO_TICKET，请重新登录后重试");
 		headers.SSO_TICKET = ssoTicket;
 	}
@@ -5632,6 +5719,10 @@ async function sendO2SdkRequest(targetUrl, options, withSsoTicket) {
 	if (!options.quiet) {
 		console.log(`${DIM$2}${method} ${parsed.toString()}${RESET$2}`);
 		console.log(`${DIM$2}→ O2 SDK 直连${withSsoTicket ? " (携带 SSO_TICKET)" : ""}${RESET$2}`);
+		if (withSsoTicket && ssoTicketSource) {
+			const sourceText = ssoTicketSource === "arg" ? "参数传入(--sso-ticket)" : "登录态获取";
+			console.log(`${DIM$2}→ SSO_TICKET 来源: ${sourceText}${RESET$2}`);
+		}
 		if (o2Env) console.log(`${DIM$2}→ O2 SDK Env: ${o2Env}${RESET$2}`);
 	}
 	let responseData;
@@ -5768,8 +5859,17 @@ async function sendDirectRequest(targetUrl, platform, token, options) {
 	if (!response.ok) process.exit(1);
 }
 async function sendSsoCookieDirectRequest(targetUrl, options) {
-	let ssoRefreshToken = null;
-	try {
+	const printReauthAndRetryHint = (location, forceStderr = false) => {
+		const log = forceStderr ? console.error : console.log;
+		log(`${YELLOW$2}检测到被重定向到登录页，当前 SSO_REFRESH_TOKEN 很可能已失效${RESET$2}`);
+		if (location) log(`${DIM$2}Location: ${location}${RESET$2}`);
+		log(`${TEXT$2}请先执行: npx ali-skills login --reauth（刷新 SSO_REFRESH_TOKEN）${RESET$2}`);
+		log(`${TEXT$2}刷新后请重新发起当前请求${RESET$2}`);
+	};
+	const explicitSsoCookie = options.ssoCookie?.trim() || "";
+	let ssoRefreshToken = explicitSsoCookie || null;
+	const ssoCookieSource = explicitSsoCookie ? "arg" : "gateway";
+	if (!ssoRefreshToken) try {
 		await ensureLogin();
 		ssoRefreshToken = await ensureSsoRefreshToken();
 	} catch (error) {
@@ -5785,6 +5885,10 @@ async function sendSsoCookieDirectRequest(targetUrl, options) {
 		console.log(`${TEXT$2}建议执行: npx ali-skills login${RESET$2}`);
 		process.exit(1);
 	}
+	if (!explicitSsoCookie) {
+		const authForRt = readAuth();
+		if (authForRt) exitIfSsoRefreshCookieExpired(authForRt, { quiet: options.quiet });
+	}
 	const requestHeaders = {
 		"User-Agent": "ali-skills-cli/1.0",
 		Cookie: `SSO_REFRESH_TOKEN=${ssoRefreshToken}`
@@ -5800,11 +5904,13 @@ async function sendSsoCookieDirectRequest(targetUrl, options) {
 	if (!options.quiet) {
 		console.log(`${DIM$2}${options.method.toUpperCase()} ${targetUrl}${RESET$2}`);
 		console.log(`${DIM$2}→ 直接请求 (Cookie: SSO_REFRESH_TOKEN)${RESET$2}`);
+		console.log(`${DIM$2}→ SSO_REFRESH_TOKEN 来源: ${ssoCookieSource === "arg" ? "参数传入(--sso-refresh-token)" : "登录态获取"}${RESET$2}`);
+		if (ssoCookieSource === "arg") console.log(`${DIM$2}→ SSO_REFRESH_TOKEN: ${maskCredential(explicitSsoCookie)}${RESET$2}`);
 	}
 	const controller = new AbortController();
 	const timeout = options.timeout || 3e4;
 	const timeoutId = setTimeout(() => controller.abort(), timeout);
-	const { response, responseBody } = await fetchWithRedirects(targetUrl, options.method.toUpperCase(), requestHeaders, body, timeout, options.quiet);
+	const { response, responseBody, loginRedirectUrl } = await fetchWithRedirects(targetUrl, options.method.toUpperCase(), requestHeaders, body, timeout, options.quiet, { stopOnAlibabaLoginRedirect: true });
 	clearTimeout(timeoutId);
 	if (!options.quiet) {
 		const statusColor = response.ok ? GREEN$1 : RED$2;
@@ -5816,7 +5922,15 @@ async function sendSsoCookieDirectRequest(targetUrl, options) {
 			console.log(`${DIM$2}  2. 目标服务未启用该认证链路${RESET$2}`);
 			console.log(`${DIM$2}  3. 当前账号在目标系统无访问权限${RESET$2}`);
 			console.log(`${TEXT$2}建议: 重新登录后重试，或联系目标系统确认登录态策略${RESET$2}`);
-		}
+		} else if (loginRedirectUrl) printReauthAndRetryHint(loginRedirectUrl);
+	}
+	if (options.includeHeaders) {
+		console.log();
+		console.log(`${TEXT$2}Response Headers:${RESET$2}`);
+		response.headers.forEach((value, key) => {
+			console.log(`  ${key}: ${value}`);
+		});
+		console.log();
 	}
 	let outputBody = responseBody;
 	if (!options.raw && options.pretty !== false) try {
@@ -5827,12 +5941,21 @@ async function sendSsoCookieDirectRequest(targetUrl, options) {
 		const { writeFileSync } = __require("fs");
 		writeFileSync(options.output, outputBody);
 		console.log(`${GREEN$1}✓ 已保存到 ${options.output}${RESET$2}`);
-	} else console.log(outputBody);
+	} else {
+		if (options.quiet && !response.ok && outputBody.trim().length === 0 && (loginRedirectUrl || response.headers.get("location"))) {
+			const location = loginRedirectUrl || response.headers.get("location") || "(empty)";
+			console.error(`HTTP ${response.status} ${response.statusText} (Location: ${location})`);
+			printReauthAndRetryHint(location, true);
+		}
+		console.log(outputBody);
+	}
 	if (!response.ok) process.exit(1);
 }
 async function sendSsoTicketDirectRequest(targetUrl, options) {
-	let ssoTicket = null;
-	try {
+	const explicitSsoTicket = options.ssoTicket?.trim() || "";
+	let ssoTicket = explicitSsoTicket || null;
+	const ssoTicketSource = explicitSsoTicket ? "arg" : "gateway";
+	if (!ssoTicket) try {
 		await ensureLogin();
 		ssoTicket = await ensureSsoTicket();
 	} catch (error) {
@@ -5859,6 +5982,8 @@ async function sendSsoTicketDirectRequest(targetUrl, options) {
 	if (!options.quiet) {
 		console.log(`${DIM$2}${options.method.toUpperCase()} ${targetUrl}${RESET$2}`);
 		console.log(`${DIM$2}→ 直接请求 (Header: SSO_TICKET)${RESET$2}`);
+		console.log(`${DIM$2}→ SSO_TICKET 来源: ${ssoTicketSource === "arg" ? "参数传入(--sso-ticket)" : "登录态获取"}${RESET$2}`);
+		if (ssoTicketSource === "arg") console.log(`${DIM$2}→ SSO_TICKET: ${maskCredential(explicitSsoTicket)}${RESET$2}`);
 	}
 	const controller = new AbortController();
 	const timeout = options.timeout || 3e4;
@@ -5932,14 +6057,14 @@ async function sendPlainDirectRequest(targetUrl, options, allowSsoCookieFallback
 	} else console.log(outputBody);
 	if (!response.ok) process.exit(1);
 }
-async function fetchWithRedirects(initialUrl, method, headers, body, timeout, quiet) {
+async function fetchWithRedirects(initialUrl, method, headers, body, timeout, quiet, opts) {
 	const controller = new AbortController();
 	const timeoutId = setTimeout(() => controller.abort(), timeout);
 	let currentUrl = initialUrl;
 	let redirects = 0;
 	let sawAlibabaLoginRedirect = false;
 	try {
-		while (true) {
+		while (redirects <= MAX_REDIRECTS) {
 			const response = await fetch(currentUrl, {
 				method,
 				headers,
@@ -5960,11 +6085,20 @@ async function fetchWithRedirects(initialUrl, method, headers, body, timeout, qu
 			};
 			if (redirects >= MAX_REDIRECTS) throw new Error(`重定向次数超过上限(${MAX_REDIRECTS})`);
 			const nextUrl = new URL(location, currentUrl).toString();
-			if (new URL(nextUrl).hostname === "login.alibaba-inc.com") sawAlibabaLoginRedirect = true;
+			if (new URL(nextUrl).hostname === "login.alibaba-inc.com") {
+				sawAlibabaLoginRedirect = true;
+				if (opts?.stopOnAlibabaLoginRedirect) return {
+					response,
+					responseBody: await response.text(),
+					sawAlibabaLoginRedirect,
+					loginRedirectUrl: nextUrl
+				};
+			}
 			redirects += 1;
 			if (!quiet) console.log(`${DIM$2}↪ 重定向 ${redirects}: ${response.status} ${response.statusText} -> ${nextUrl}${RESET$2}`);
 			currentUrl = nextUrl;
 		}
+		throw new Error(`重定向次数超过上限(${MAX_REDIRECTS})`);
 	} finally {
 		clearTimeout(timeoutId);
 	}
@@ -5978,6 +6112,8 @@ async function sendGatewayRequest(targetUrl, platformKey, options, authMode = "g
 		process.exit(1);
 	}
 	const proxyUrl = `${getGatewayUrl()}/api/gateway/proxy`;
+	const explicitSsoCookie = options.ssoCookie?.trim() || "";
+	const explicitSsoTicket = options.ssoTicket?.trim() || "";
 	const requestHeaders = {
 		Authorization: `Bearer ${credentials.privateToken}`,
 		"X-Private-Token": credentials.privateToken,
@@ -5986,6 +6122,8 @@ async function sendGatewayRequest(targetUrl, platformKey, options, authMode = "g
 		"X-Platform": platformKey,
 		"X-Auth-Mode": authMode
 	};
+	if (explicitSsoCookie) requestHeaders["X-SSO-Refresh-Token"] = explicitSsoCookie;
+	if (explicitSsoTicket) requestHeaders["X-SSO-Ticket"] = explicitSsoTicket;
 	if (options.headers) Object.entries(options.headers).forEach(([key, value]) => {
 		requestHeaders[key] = value;
 	});
@@ -5997,6 +6135,14 @@ async function sendGatewayRequest(targetUrl, platformKey, options, authMode = "g
 	if (!options.quiet) {
 		console.log(`${DIM$2}${options.method.toUpperCase()} ${targetUrl}${RESET$2}`);
 		console.log(`${DIM$2}→ Gateway: ${proxyUrl}${RESET$2}`);
+		if (explicitSsoCookie) {
+			console.log(`${DIM$2}→ SSO_REFRESH_TOKEN 来源: 参数传入(--sso-refresh-token)${RESET$2}`);
+			console.log(`${DIM$2}→ SSO_REFRESH_TOKEN: ${maskCredential(explicitSsoCookie)}${RESET$2}`);
+		}
+		if (explicitSsoTicket) {
+			console.log(`${DIM$2}→ SSO_TICKET 来源: 参数传入(--sso-ticket)${RESET$2}`);
+			console.log(`${DIM$2}→ SSO_TICKET: ${maskCredential(explicitSsoTicket)}${RESET$2}`);
+		}
 	}
 	const controller = new AbortController();
 	const timeout = options.timeout || 3e4;
@@ -6519,9 +6665,6 @@ ${BOLD}Manage Skills:${RESET}
   list, ls             List installed skills
   find [query]         Search for skills interactively
 
-${BOLD}Publish:${RESET}
-  publish [options]    Publish skills from current repo to OSS (alias: pub)
-
 ${BOLD}Updates:${RESET}
   check                Check for available skill updates (project-level by default)
   check -g             Check global skill updates
@@ -6532,9 +6675,7 @@ ${BOLD}Updates:${RESET}
   update <skill>       Update specific skill(s)
 
 ${BOLD}Project:${RESET}
-  experimental_install Restore skills from skills-lock.json
   init [name]          Initialize a skill (creates <name>/SKILL.md or ./SKILL.md)
-  experimental_sync    Sync skills from node_modules into agent directories
 
 ${BOLD}Gateway:${RESET}
   gateway              鉴权请求能力入口（login/logout/status/req）
@@ -6548,8 +6689,10 @@ ${BOLD}Add Options:${RESET}
   -s, --skill <skills>   Specify skill names to install (use '*' for all skills)
   -l, --list             List available skills in the repository without installing
   -y, --yes              Skip confirmation prompts
+  --ci                   Enable CI mode (auto non-interactive, implies --yes)
   --github               Force fetching from GitHub when using owner/repo shorthand
-  --copy                 Copy files instead of symlinking to agent directories
+  --install-mode <mode>  Install mode: symlink|copy|symlink-isolated|copy-isolated (default: symlink)
+  --copy                 Backward-compatible alias of --install-mode copy (recommended: use --install-mode)
   --all                  Shorthand for --skill '*' --agent '*' -y
   --full-depth           Search all subdirectories even when a root SKILL.md exists
 
@@ -6560,10 +6703,6 @@ ${BOLD}Remove Options:${RESET}
   -y, --yes              Skip confirmation prompts
   --all                  Shorthand for --skill '*' --agent '*' -y
   
-${BOLD}Experimental Sync Options:${RESET}
-  -a, --agent <agents>   Specify agents to install to (use '*' for all agents)
-  -y, --yes              Skip confirmation prompts
-
 ${BOLD}List Options:${RESET}
   -g, --global           List global skills (default: project)
   -a, --agent <agents>   Filter by specific agents
@@ -6573,14 +6712,12 @@ ${BOLD}Options:${RESET}
   --help, -h        Show this help message
   --version, -v     Show version number
 
-${BOLD}Debug:${RESET}
-  ALI_SKILLS_DEBUG_UPDATE=1  Print detailed logs for check/update diagnosis
-
 ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} ali-skills add group/project
   ${DIM}$${RESET} ali-skills add group/project -g
   ${DIM}$${RESET} ali-skills add group/project --agent claude-code cursor
   ${DIM}$${RESET} ali-skills add group/project --skill pr-review commit
+  ${DIM}$${RESET} ali-skills add group/project --install-mode symlink-isolated
   ${DIM}$${RESET} ali-skills remove                        ${DIM}# interactive remove${RESET}
   ${DIM}$${RESET} ali-skills remove web-design             ${DIM}# remove by name${RESET}
   ${DIM}$${RESET} ali-skills rm --global frontend-design
@@ -6593,10 +6730,7 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} ali-skills check
   ${DIM}$${RESET} ali-skills check web-design react-best-practices
   ${DIM}$${RESET} ali-skills update
-  ${DIM}$${RESET} ali-skills experimental_install            ${DIM}# restore from skills-lock.json${RESET}
   ${DIM}$${RESET} ali-skills init my-skill
-  ${DIM}$${RESET} ali-skills experimental_sync              ${DIM}# sync from node_modules${RESET}
-  ${DIM}$${RESET} ali-skills experimental_sync -y           ${DIM}# sync without prompts${RESET}
 
 Discover more skills at ${TEXT}https://ali-skills.alibaba-inc.com/${RESET}
 `);
@@ -6636,7 +6770,7 @@ function showGatewayHelp() {
 	const platformKeysForHelp = listPlatforms().filter((p) => p.key !== "aone").map((p) => p.key).join(", ");
 	console.log(`
 ${BOLD}Gateway Commands:${RESET}
-  login [platform]               Login to Gateway or configure platform token
+  login [--reauth] [platform]    Login to Gateway or configure platform token; --reauth 等价于先 logout 再登录
   logout [platform]              Logout BUC or clear platform token
   status [platform] [--all]      Show login status, single platform, or all platform statuses
   request [platform] <url|path>  Send HTTP request (supports platform + path shorthand)
@@ -6657,6 +6791,8 @@ ${BOLD}Request Options:${RESET}
   --auth, --auth-mode <mode>  Auth mode: auto/private_token/sso_cookie/sso_ticket
   --sso <cookie|ticket>   Shortcut for --auth sso_cookie/sso_ticket
   --token <token>         Explicit token for private_token mode
+  --sso-refresh-token <token>  Explicit SSO_REFRESH_TOKEN for sso_cookie mode
+  --sso-ticket <ticket>   Explicit SSO_TICKET for sso_ticket mode
   -o, --output <file>     Save response to file
   -i, --include-headers   Include response headers in output
   -t, --timeout <ms>      Request timeout (default: 30000)
@@ -6666,6 +6802,7 @@ ${BOLD}Request Options:${RESET}
 
 ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} ali-skills login
+  ${DIM}$${RESET} ali-skills login --reauth
   ${DIM}$${RESET} ali-skills login code
   ${DIM}$${RESET} ali-skills login yuque
   ${DIM}$${RESET} ali-skills login yuque group
@@ -6686,8 +6823,10 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} ali-skills logout yuque --all
   ${DIM}$${RESET} ali-skills req 'https://subdomain.alibaba-inc.com/path?q=v'
   ${DIM}$${RESET} ali-skills req 'https://subdomain.alibaba-inc.com/path?q=v' --auth sso_cookie
+  ${DIM}$${RESET} ali-skills req 'https://subdomain.alibaba-inc.com/path?q=v' --auth sso_cookie --sso-refresh-token '<SSO_REFRESH_TOKEN>'
   ${DIM}$${RESET} ali-skills req 'https://subdomain.alibaba-inc.com/path?q=v' --auth sso_cookie -X POST -b '{"k": "v"}' -h 'X-Custom-Header: value'
   ${DIM}$${RESET} ali-skills req 'https://support-buc-sso-ticket-site/path?q=v' --auth sso_ticket
+  ${DIM}$${RESET} ali-skills req 'https://support-buc-sso-ticket-site/path?q=v' --auth sso_ticket --sso-ticket '<SSO_TICKET>'
   ${DIM}$${RESET} ali-skills req code '/api/v3/project?path=clam-ng/clam'
   ${DIM}$${RESET} ali-skills req yuque '/api/v2/repos/fliggyfe-infra/ali-skills-dev/docs/mll9xim6y6lcnvyg'
   ${DIM}$${RESET} ali-skills req yuque '/api/v2/search?q=buc&type=doc&scope=fliggyfe-infra'
@@ -6758,6 +6897,16 @@ function parseRequestOptions(args) {
 			options.authMode = mapped;
 			continue;
 		}
+		const ssoCookieValue = parseLongOptionValue("sso-refresh-token") ?? parseLongOptionValue("sso-cookie");
+		if (ssoCookieValue !== void 0) {
+			options.ssoCookie = ssoCookieValue;
+			continue;
+		}
+		const ssoTicketValue = parseLongOptionValue("sso-ticket");
+		if (ssoTicketValue !== void 0) {
+			options.ssoTicket = ssoTicketValue;
+			continue;
+		}
 		switch (arg) {
 			case "-m":
 			case "-x":
@@ -6814,6 +6963,13 @@ function parseRequestOptions(args) {
 				options.authMode = mode;
 				break;
 			}
+			case "--sso-refresh-token":
+			case "--sso-cookie":
+				options.ssoCookie = args[++i];
+				break;
+			case "--sso-ticket":
+				options.ssoTicket = args[++i];
+				break;
 			case "-q":
 			case "--quiet":
 				options.quiet = true;
@@ -6842,6 +6998,13 @@ function expandRequestShorthand(args) {
 	const normalizedPath = pathArg.startsWith("/") ? pathArg : `/${pathArg}`;
 	return [`https://${platform.key === "yuque" ? "yuque-api.antfin-inc.com" : platform.config.host}${normalizedPath}`, ...args.slice(2)];
 }
+function getHostFromUrl(rawUrl) {
+	try {
+		return new URL(rawUrl).hostname;
+	} catch {
+		return "";
+	}
+}
 function parseStatusArgs(args) {
 	const showPrivateTokenFlags = new Set(["--show", "-s"]);
 	const positionals = [];
@@ -6929,6 +7092,16 @@ function parseLogoutArgs(args) {
 		clearAll
 	};
 }
+function stripReauthFlag(args) {
+	let reauth = false;
+	const rest = [];
+	for (const a of args) if (a === "--reauth") reauth = true;
+	else rest.push(a);
+	return {
+		reauth,
+		rest
+	};
+}
 async function runGatewayCommand(args) {
 	if (args.length === 0) {
 		showGatewayHelp();
@@ -6937,11 +7110,14 @@ async function runGatewayCommand(args) {
 	const command = args[0];
 	const rest = args.slice(1);
 	switch (command) {
-		case "login":
+		case "login": {
 			showLogo();
 			console.log();
-			await login();
+			const { reauth, rest: loginRest } = stripReauthFlag(rest);
+			if (loginRest.length > 0) await runPlatformLogin(loginRest);
+			else await login({ reauth });
 			break;
+		}
 		case "logout": {
 			const lo = parseLogoutArgs(rest);
 			await logout(lo.platform, lo.yuqueGroup, lo.clearAll);
@@ -6968,6 +7144,12 @@ async function runGatewayCommand(args) {
 				process.exit(1);
 			}
 			await proxyRequest(url, options);
+			track({
+				event: "req",
+				source: getHostFromUrl(url),
+				sourceType: options.authMode ?? "auto",
+				query: options.method.toUpperCase()
+			});
 			break;
 		}
 		case "--help":
@@ -7593,7 +7775,14 @@ async function main() {
 		case "a":
 		case "add": {
 			showLogo();
-			const { source: addSource, options: addOpts } = parseAddOptions(restArgs);
+			let addParsed;
+			try {
+				addParsed = parseAddOptions(restArgs);
+			} catch (error) {
+				console.error(error instanceof Error ? error.message : "Invalid add options");
+				process.exit(1);
+			}
+			const { source: addSource, options: addOpts } = addParsed;
 			await runAdd(addSource, addOpts);
 			break;
 		}
@@ -7628,10 +7817,12 @@ async function main() {
 		case "check":
 			await runCheck(restArgs);
 			break;
-		case "login":
-			if (restArgs.length > 0) await runPlatformLogin(restArgs);
-			else await login();
+		case "login": {
+			const { reauth, rest: loginRest } = stripReauthFlag(restArgs);
+			if (loginRest.length > 0) await runPlatformLogin(loginRest);
+			else await login({ reauth });
 			break;
+		}
 		case "logout": {
 			const lo = parseLogoutArgs(restArgs);
 			await logout(lo.platform, lo.yuqueGroup, lo.clearAll);
@@ -7649,6 +7840,12 @@ async function main() {
 				process.exit(1);
 			}
 			await proxyRequest(url, options);
+			track({
+				event: "req",
+				source: getHostFromUrl(url),
+				sourceType: options.authMode ?? "auto",
+				query: options.method.toUpperCase()
+			});
 			break;
 		}
 		case "gateway":

package/node_modules/@ali/cli-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ali/cli-skills",
-  "version": "2.0.25",
+  "version": "2.0.28",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ali-skills",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -31,7 +31,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@ali/cli-skills": "^2.0.25"
+    "@ali/cli-skills": "^2.0.28"
   },
   "bundleDependencies": [
     "@ali/cli-skills"