ali-skills 0.1.2 → 0.1.4

package/node_modules/@ali/cli-skills/dist/_chunks/plugin.mjs

@@ -2,7 +2,7 @@ import { i as __toESM } from "./rolldown-runtime.mjs";
 import { l as pD, u as require_picocolors } from "./libs/@clack/core.mjs";
 import { a as Y, n as M, s as fe } from "./libs/@clack/prompts.mjs";
 import { i as SKILLS_API_BASE_URL, n as findPluginPackageRoots, t as validatePluginPackage } from "./plugin-manifest-validate.mjs";
-import { A as getDisplaySource, D as redactCliSnippet, F as resolveSourceInput, I as toInternalHttpsCloneUrl, P as parseSource, T as cloneRepo, b as AGENTS_DIR, f as saveSelectedAgents, k as embedInternalGitCredentials, s as getLastSelectedAgents, v as trackPluginCommand, x as PLUGINS_SUBDIR, y as trackPluginInstall } from "./skill-lock.mjs";
+import { A as getDisplaySource, D as redactCliSnippet, F as resolveSourceInput, I as toInternalHttpsCloneUrl, P as parseSource, _ as trackPluginCommand, b as PLUGINS_SUBDIR, d as saveSelectedAgents, k as embedInternalGitCredentials, o as getLastSelectedAgents, v as trackPluginInstall, w as cloneRepo, y as AGENTS_DIR } from "./skill-lock.mjs";
 import "./libs/@kwsites/file-exists.mjs";
 import "./libs/@kwsites/promise-deferred.mjs";
 import "./libs/simple-git.mjs";

package/node_modules/@ali/cli-skills/dist/_chunks/publish.mjs

@@ -741,4 +741,4 @@ async function runPluginPublish(_options = {}) {
 	spinner.stop(`${import_picocolors.default.green("✓")} Registered ${items.length} plugin(s)`);
 	Se(import_picocolors.default.green("插件录入成功，已可在平台检索安装。"));
 }
-export { addSkillToLocalLock as a, discoverSkills as c, isValidSkillName as d, parseSkillMd as f, logSkillParseFailures as i, filterSkills as l, runPluginPublish as n, computeSkillFolderHash as o, runPublish as r, readLocalLock as s, parsePublishOptions as t, getSkillDisplayName as u };
+export { addSkillToLocalLock as a, writeLocalLock as c, getSkillDisplayName as d, isValidSkillName as f, logSkillParseFailures as i, discoverSkills as l, runPluginPublish as n, computeSkillFolderHash as o, parseSkillMd as p, runPublish as r, readLocalLock as s, parsePublishOptions as t, filterSkills as u };

package/node_modules/@ali/cli-skills/dist/_chunks/skill-lock.mjs

@@ -6,10 +6,17 @@ import { dirname, isAbsolute, join, normalize, resolve, sep } from "path";
 import { homedir, tmpdir } from "os";
 import { createHash } from "crypto";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "fs/promises";
+function stripGitSuffix(value) {
+	return value.replace(/\.git$/i, "");
+}
 function resolveSourceInput(source, options = {}) {
 	let resolved = source.replace(/\bgitlab\.alibaba-inc\.com\b/g, "code.alibaba-inc.com");
 	if (!options.github) {
-		if (resolved.match(/^([^/]+)\/([^/]+)$/) && !resolved.includes(":") && !resolved.startsWith(".") && !resolved.startsWith("/")) resolved = `https://${GITLAB_ACCOUNT.user}:${GITLAB_ACCOUNT.token}@code.alibaba-inc.com/${resolved}.git`;
+		const shorthandMatch = resolved.match(/^([^/]+)\/([^/]+)$/);
+		if (shorthandMatch && !resolved.includes(":") && !resolved.startsWith(".") && !resolved.startsWith("/")) {
+			const [, owner, repo] = shorthandMatch;
+			resolved = `https://${GITLAB_ACCOUNT.user}:${GITLAB_ACCOUNT.token}@code.alibaba-inc.com/${owner}/${stripGitSuffix(repo)}.git`;
+		}
 	}
 	if (/^https?:\/\/code\.alibaba-inc\.com\//.test(resolved) && !resolved.includes("@")) resolved = resolved.replace(/^(https?):\/\/code\.alibaba-inc\.com\//, `$1://${GITLAB_ACCOUNT.user}:${GITLAB_ACCOUNT.token}@code.alibaba-inc.com/`);
 	return resolved;
@@ -36,14 +43,14 @@ function getOwnerRepo(parsed) {
 	const sshMatch = parsed.url.match(/^git@[^:]+:(.+)$/);
 	if (sshMatch) {
 		let path = sshMatch[1];
-		path = path.replace(/\.git$/, "");
+		path = stripGitSuffix(path);
 		if (path.includes("/")) return path;
 		return null;
 	}
 	if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
 	try {
 		let path = new URL(parsed.url).pathname.slice(1);
-		path = path.replace(/\.git$/, "");
+		path = stripGitSuffix(path);
 		if (path.includes("/")) return path;
 	} catch {}
 	return null;
@@ -57,7 +64,15 @@ function parseOwnerRepo(ownerRepo) {
 	return null;
 }
 async function isRepoPrivate(owner, repo) {
-	return false;
+	try {
+		const source = encodeURIComponent(`${owner}/${repo}`);
+		const res = await fetch(`${SKILLS_API_BASE_URL}/github/repository?source=${source}`);
+		if (!res.ok) return null;
+		const data = await res.json();
+		return data.success && typeof data.data?.private === "boolean" ? data.data.private : null;
+	} catch {
+		return null;
+	}
 }
 function sanitizeSubpath(subpath) {
 	const segments = subpath.replace(/\\/g, "/").split("/");
@@ -165,7 +180,7 @@ function parseSource(input) {
 		const [, owner, repo, skillFilter] = atSkillMatch;
 		return {
 			type: "github",
-			url: `https://github.com/${owner}/${repo}.git`,
+			url: `https://github.com/${owner}/${stripGitSuffix(repo)}.git`,
 			skillFilter
 		};
 	}
@@ -174,7 +189,7 @@ function parseSource(input) {
 		const [, owner, repo, subpath] = shorthandMatch;
 		return {
 			type: "github",
-			url: `https://github.com/${owner}/${repo}.git`,
+			url: `https://github.com/${owner}/${stripGitSuffix(repo)}.git`,
 			subpath: subpath ? sanitizeSubpath(subpath) : subpath
 		};
 	}
@@ -353,6 +368,9 @@ async function cloneRepo(url, ref) {
 		throw new GitCloneError(`Failed to clone ${safeUrl}: ${safeErrorMessage}`, safeUrl, false, false);
 	}
 }
+async function getGitHeadHash(repoDir) {
+	return (await esm_default(repoDir).revparse(["HEAD"])).trim();
+}
 async function listRemoteBranches(url) {
 	const git = esm_default({
 		timeout: { block: 15e3 },
@@ -548,72 +566,63 @@ async function writeSkillLock(lock) {
 	await mkdir(dirname(lockPath), { recursive: true });
 	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
-function getGitHubToken() {
-	if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
-	if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
-	try {
-		const token = execSync("gh auth token", {
-			encoding: "utf-8",
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		}).trim();
-		if (token) return token;
-	} catch {}
-	return null;
-}
-async function fetchSkillFolderHash(ownerRepo, skillPath, token) {
-	let folderPath = skillPath.replace(/\\/g, "/");
-	if (folderPath.endsWith("/SKILL.md")) folderPath = folderPath.slice(0, -9);
-	else if (folderPath.endsWith("SKILL.md")) folderPath = folderPath.slice(0, -8);
-	if (folderPath.endsWith("/")) folderPath = folderPath.slice(0, -1);
-	for (const ref of [
-		"HEAD",
-		"master",
-		"main"
-	]) try {
-		const url = `https://api.github.com/repos/${ownerRepo}/git/trees/${ref}?recursive=1`;
-		const headers = {
-			Accept: "application/vnd.github.v3+json",
-			"User-Agent": "skills-cli"
-		};
-		if (token) headers["Authorization"] = `Bearer ${token}`;
-		const response = await fetch(url, { headers });
-		if (!response.ok) continue;
-		const data = await response.json();
-		if (!folderPath) return data.sha;
-		const folderEntry = data.tree.find((entry) => entry.type === "tree" && entry.path === folderPath);
-		if (folderEntry) return folderEntry.sha;
-	} catch {
-		continue;
-	}
-	return null;
-}
-async function fetchAliInternalCommitHash(source, skillPath = "", token) {
+async function fetchAliInternalSkillVersion(source, skillPath = "", token) {
 	const refs = [
 		"HEAD",
 		"master",
 		"main"
 	];
 	const privateToken = token || process.env.GITLAB_PRIVATE_TOKEN || process.env.CODE_ALIBABA_TOKEN || GITLAB_ACCOUNT.token;
-	for (const ref of refs) try {
-		let url = `https://code.alibaba-inc.com/api/v4/projects/${encodeURIComponent(source)}/repository/commits?ref_name=${ref}&per_page=1`;
-		if (skillPath) url += `&path=${encodeURIComponent(skillPath)}`;
-		const headers = {
-			Accept: "application/json",
-			"User-Agent": "skills-cli",
-			"Private-Token": privateToken
-		};
-		const response = await fetch(url, { headers });
-		if (!response.ok) continue;
-		const latestCommit = (await response.json())[0];
-		if (latestCommit?.id) return latestCommit.id;
-	} catch {
-		continue;
+	const encodedSource = encodeURIComponent(source);
+	const normalizedPath = skillPath.trim().replace(/\\/g, "/").replace(/^\/+|\/+$/g, "").replace(/\/?SKILL\.md$/i, "").replace(/\/+$/g, "");
+	const skillFile = normalizedPath ? `${normalizedPath}/SKILL.md` : "SKILL.md";
+	const headers = {
+		Accept: "application/json",
+		"User-Agent": "skills-cli",
+		"Private-Token": privateToken
+	};
+	let sawNotFound = false;
+	for (const ref of refs) {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), 8e3);
+		try {
+			const fileUrl = `https://code.alibaba-inc.com/api/v4/projects/${encodedSource}/repository/files/${encodeURIComponent(skillFile)}?ref=${encodeURIComponent(ref)}`;
+			const fileResponse = await fetch(fileUrl, {
+				headers,
+				signal: controller.signal
+			});
+			if (fileResponse.status === 404) {
+				sawNotFound = true;
+				continue;
+			}
+			if (fileResponse.status === 401 || fileResponse.status === 403) return { status: "unauthorized" };
+			if (fileResponse.status === 429) return { status: "rate-limited" };
+			if (!fileResponse.ok) return { status: "upstream-error" };
+			let commitUrl = `https://code.alibaba-inc.com/api/v4/projects/${encodedSource}/repository/commits?ref_name=${encodeURIComponent(ref)}&per_page=1`;
+			if (normalizedPath) commitUrl += `&path=${encodeURIComponent(normalizedPath)}`;
+			const commitResponse = await fetch(commitUrl, {
+				headers,
+				signal: controller.signal
+			});
+			if (commitResponse.status === 401 || commitResponse.status === 403) return { status: "unauthorized" };
+			if (commitResponse.status === 429) return { status: "rate-limited" };
+			if (!commitResponse.ok) return { status: "upstream-error" };
+			const commits = await commitResponse.json();
+			return commits[0]?.id ? {
+				status: "ok",
+				latestHash: commits[0].id
+			} : { status: "upstream-error" };
+		} catch (error) {
+			return { status: error instanceof Error && error.name === "AbortError" ? "timeout" : "upstream-error" };
+		} finally {
+			clearTimeout(timer);
+		}
 	}
-	return null;
+	return { status: sawNotFound ? "not-found" : "upstream-error" };
+}
+async function fetchAliInternalCommitHash(source, skillPath = "", token) {
+	const result = await fetchAliInternalSkillVersion(source, skillPath, token);
+	return result.status === "ok" ? result.latestHash ?? null : null;
 }
 async function addSkillToLock(skillName, entry) {
 	const lock = await readSkillLock();
@@ -682,4 +691,4 @@ function sanitizeSourceUrl(url) {
 	}
 	return url;
 }
-export { getDisplaySource as A, GitCloneError as C, redactCliSnippet as D, listRemoteBranches as E, resolveSourceInput as F, toInternalHttpsCloneUrl as I, isRepoPrivate as M, parseOwnerRepo as N, redactSensitiveText as O, parseSource as P, SKILLS_SUBDIR as S, cloneRepo as T, track as _, getAllLockedSkills as a, AGENTS_DIR$1 as b, getSkillFromLock as c, sanitizeSourceUrl as d, saveSelectedAgents as f, setVersion as g, getPendingTelemetryCount as h, fetchSkillFolderHash as i, getOwnerRepo as j, embedInternalGitCredentials as k, isPromptDismissed as l, flushTelemetry as m, dismissPrompt as n, getGitHubToken as o, fetchAuditData as p, fetchAliInternalCommitHash as r, getLastSelectedAgents as s, addSkillToLock as t, removeSkillFromLock as u, trackPluginCommand as v, cleanupTempDir as w, PLUGINS_SUBDIR as x, trackPluginInstall as y };
+export { getDisplaySource as A, cleanupTempDir as C, redactCliSnippet as D, listRemoteBranches as E, resolveSourceInput as F, toInternalHttpsCloneUrl as I, isRepoPrivate as M, parseOwnerRepo as N, redactSensitiveText as O, parseSource as P, GitCloneError as S, getGitHeadHash as T, trackPluginCommand as _, getAllLockedSkills as a, PLUGINS_SUBDIR as b, isPromptDismissed as c, saveSelectedAgents as d, fetchAuditData as f, track as g, setVersion as h, fetchAliInternalSkillVersion as i, getOwnerRepo as j, embedInternalGitCredentials as k, removeSkillFromLock as l, getPendingTelemetryCount as m, dismissPrompt as n, getLastSelectedAgents as o, flushTelemetry as p, fetchAliInternalCommitHash as r, getSkillFromLock as s, addSkillToLock as t, sanitizeSourceUrl as u, trackPluginInstall as v, cloneRepo as w, SKILLS_SUBDIR as x, AGENTS_DIR$1 as y };

package/node_modules/@ali/cli-skills/dist/cli.mjs

@@ -3,24 +3,24 @@ import { i as __toESM, n as __exportAll, r as __require } from "./_chunks/rolldo
 import { l as pD, u as require_picocolors } from "./_chunks/libs/@clack/core.mjs";
 import { a as Y, c as ge, d as ye, i as Se, l as ve, n as M, o as be, r as Me, s as fe, t as Ie, u as xe } from "./_chunks/libs/@clack/prompts.mjs";
 import { i as SKILLS_API_BASE_URL, r as GITLAB_ACCOUNT } from "./_chunks/plugin-manifest-validate.mjs";
-import { A as getDisplaySource, C as GitCloneError, E as listRemoteBranches, F as resolveSourceInput, I as toInternalHttpsCloneUrl, M as isRepoPrivate, N as parseOwnerRepo, O as redactSensitiveText, P as parseSource, S as SKILLS_SUBDIR, T as cloneRepo, _ as track, a as getAllLockedSkills, b as AGENTS_DIR$1, c as getSkillFromLock, d as sanitizeSourceUrl, f as saveSelectedAgents, g as setVersion, h as getPendingTelemetryCount, i as fetchSkillFolderHash, j as getOwnerRepo, l as isPromptDismissed, m as flushTelemetry, n as dismissPrompt, o as getGitHubToken, p as fetchAuditData, r as fetchAliInternalCommitHash, s as getLastSelectedAgents, t as addSkillToLock, u as removeSkillFromLock, w as cleanupTempDir } from "./_chunks/skill-lock.mjs";
+import { A as getDisplaySource, C as cleanupTempDir, E as listRemoteBranches, F as resolveSourceInput, I as toInternalHttpsCloneUrl, M as isRepoPrivate, N as parseOwnerRepo, O as redactSensitiveText, P as parseSource, S as GitCloneError, T as getGitHeadHash, a as getAllLockedSkills, c as isPromptDismissed, d as saveSelectedAgents, f as fetchAuditData, g as track, h as setVersion, i as fetchAliInternalSkillVersion, j as getOwnerRepo, l as removeSkillFromLock, m as getPendingTelemetryCount, n as dismissPrompt, o as getLastSelectedAgents, p as flushTelemetry, r as fetchAliInternalCommitHash, s as getSkillFromLock, t as addSkillToLock, u as sanitizeSourceUrl, w as cloneRepo, x as SKILLS_SUBDIR, y as AGENTS_DIR$1 } from "./_chunks/skill-lock.mjs";
 import "./_chunks/libs/@kwsites/file-exists.mjs";
 import "./_chunks/libs/@kwsites/promise-deferred.mjs";
 import "./_chunks/libs/simple-git.mjs";
 import { t as require_gray_matter } from "./_chunks/libs/gray-matter.mjs";
 import "./_chunks/libs/extend-shallow.mjs";
 import "./_chunks/libs/esprima.mjs";
-import { a as addSkillToLocalLock, c as discoverSkills, d as isValidSkillName, f as parseSkillMd, i as logSkillParseFailures, l as filterSkills, o as computeSkillFolderHash, r as runPublish, s as readLocalLock, t as parsePublishOptions, u as getSkillDisplayName } from "./_chunks/publish.mjs";
+import { a as addSkillToLocalLock, c as writeLocalLock, d as getSkillDisplayName, f as isValidSkillName, i as logSkillParseFailures, l as discoverSkills, o as computeSkillFolderHash, p as parseSkillMd, r as runPublish, s as readLocalLock, t as parsePublishOptions, u as filterSkills } from "./_chunks/publish.mjs";
 import { t as xdgConfig } from "./_chunks/libs/xdg-basedir.mjs";
-import { execSync, spawn } from "child_process";
+import { spawn } from "child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { basename, dirname, join, normalize, relative, resolve, sep } from "path";
-import { homedir, platform as platform$1, tmpdir } from "os";
+import { homedir, platform as platform$1 } from "os";
 import { createHash } from "crypto";
 import { URL as URL$1, fileURLToPath } from "url";
 import * as readline from "readline";
 import { Writable } from "stream";
-import { access, cp, lstat, mkdir, mkdtemp, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
+import { access, cp, lstat, mkdir, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
 import * as http from "http";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const silentOutput = new Writable({ write(_chunk, _encoding, callback) {
@@ -202,67 +202,32 @@ async function getGitLabProject(ownerRepo, token) {
 		return null;
 	}
 }
-async function getSkillLastCommitAuthor(projectId, filePath, token) {
+async function getSkillLastCommitInfo(projectId, filePath, token) {
 	try {
 		const url = `${CODE_HOST}/api/v3/projects/${projectId}/repository/files/last_commit?filepath=${encodeURIComponent(filePath)}&sha=HEAD&private_token=${token}&projectId=${projectId}`;
 		const res = await fetch(url);
 		if (!res.ok) return null;
-		const author = (await res.json())?.user;
-		if (!author) return null;
+		const commit = await res.json();
+		const hash = commit?.id ?? commit?.short_id ?? "";
+		const committedAt = commit?.committed_date ?? commit?.authored_date ?? commit?.created_at ?? "";
+		if (!hash && !committedAt) return null;
+		const author = commit?.user;
 		return {
-			employeeId: author.extern_uid ?? "",
-			email: author.email ?? "",
-			name: author.name ?? "",
-			avatarUrl: author.avatar_url ?? "",
-			username: author.username ?? ""
+			hash,
+			committedAt,
+			...author && { author: {
+				employeeId: author.extern_uid ?? "",
+				email: author.email ?? "",
+				name: author.name ?? "",
+				avatarUrl: author.avatar_url ?? "",
+				username: author.username ?? ""
+			} }
 		};
 	} catch (error) {
-		console.error("[GitLab] Failed to get skill last commit author:", error);
+		console.error("[GitLab] Failed to get skill last commit info:", error);
 		return null;
 	}
 }
-const RESOLVE_URL = `${SKILLS_API_BASE_URL}/resolve`;
-async function resolveFromOss(source, sourceType, skillName) {
-	try {
-		const params = new URLSearchParams({
-			source,
-			sourceType
-		});
-		if (skillName) params.set("skillName", skillName);
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), 5e3);
-		const res = await fetch(`${RESOLVE_URL}?${params.toString()}`, { signal: controller.signal });
-		clearTimeout(timeout);
-		if (!res.ok) return null;
-		const json = await res.json();
-		if (!json.success || !json.data) return null;
-		return json.data;
-	} catch (err) {
-		console.error("[OSS Fallback] Failed to resolve from OSS:", err);
-		return null;
-	}
-}
-async function downloadAndExtractZip(zipUrl) {
-	const tempDir = await mkdtemp(join(tmpdir(), "skills-oss-"));
-	const zipPath = join(tempDir, "skill.zip");
-	try {
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), 6e4);
-		const res = await fetch(zipUrl, { signal: controller.signal });
-		clearTimeout(timeout);
-		if (!res.ok) throw new Error(`Download failed: ${res.status}`);
-		await writeFile(zipPath, Buffer.from(await res.arrayBuffer()));
-		execSync(`unzip -q -o "${zipPath}" -d "${tempDir}"`, { stdio: "pipe" });
-		await rm(zipPath, { force: true }).catch(() => {});
-		return tempDir;
-	} catch (error) {
-		await rm(tempDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
-		throw error;
-	}
-}
 const home = homedir();
 const configHome = xdgConfig ?? join(home, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home, ".codex");
@@ -947,6 +912,33 @@ async function copyDirectory(src, dest) {
 		}
 	}));
 }
+async function installSkillCanonical(skill, options = {}) {
+	const canonicalBase = getCanonicalSkillsDir(options.global ?? false, options.cwd);
+	const canonicalDir = join(canonicalBase, sanitizeName(skill.name || basename(skill.path)));
+	if (!isPathSafe(canonicalBase, canonicalDir)) return {
+		success: false,
+		path: canonicalDir,
+		mode: "symlink",
+		error: "Invalid skill name: potential path traversal detected"
+	};
+	try {
+		await cleanAndCreateDirectory(canonicalDir);
+		await copyDirectory(skill.path, canonicalDir);
+		return {
+			success: true,
+			path: canonicalDir,
+			canonicalPath: canonicalDir,
+			mode: "symlink"
+		};
+	} catch (error) {
+		return {
+			success: false,
+			path: canonicalDir,
+			mode: "symlink",
+			error: error instanceof Error ? error.message : "Unknown error"
+		};
+	}
+}
 async function isSkillInstalled(skillName, agentType, options = {}) {
 	const agent = agents[agentType];
 	const sanitized = sanitizeName(skillName);
@@ -1394,7 +1386,178 @@ var WellKnownProvider = class {
 	}
 };
 const wellKnownProvider = new WellKnownProvider();
-var version$1 = "2.1.2";
+var version$1 = "2.1.5";
+async function checkGithubVersions$1(requests, debugLog = () => {}) {
+	const results = [];
+	for (let offset = 0; offset < requests.length; offset += 100) results.push(...await checkGithubVersionBatch(requests.slice(offset, offset + 100), debugLog));
+	return results;
+}
+async function checkGithubVersionBatch(requests, debugLog) {
+	const startedAt = Date.now();
+	const endpoint = `${SKILLS_API_BASE_URL}/check-updates`;
+	debugLog(`POST ${endpoint} skills=${requests.length}`);
+	try {
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ skills: requests })
+		});
+		debugLog(`POST ${endpoint} status=${response.status} durationMs=${Date.now() - startedAt}`);
+		if (!response.ok) return requests.map((request) => ({
+			...request,
+			status: "upstream-error"
+		}));
+		const payload = await response.json();
+		return payload.success && Array.isArray(payload.data?.results) ? payload.data.results : requests.map((request) => ({
+			...request,
+			status: "upstream-error"
+		}));
+	} catch (error) {
+		debugLog(`POST ${endpoint} failed durationMs=${Date.now() - startedAt} error=${error instanceof Error ? error.name : "unknown"}`);
+		return requests.map((request) => ({
+			...request,
+			status: "upstream-error"
+		}));
+	}
+}
+function normalizeSkillPath(skillPath) {
+	return (skillPath ?? "").trim().replace(/\\/g, "/").replace(/^\/+|\/+$/g, "").replace(/\/?SKILL\.md$/i, "").replace(/\/+$/g, "");
+}
+function remoteKey(request) {
+	return `${request.name}\0${request.source}\0${request.skillPath}`;
+}
+function fromRemote(entry, skillPath, remote, localHash) {
+	const base = {
+		name: entry.name,
+		source: entry.source,
+		entry,
+		skillPath
+	};
+	if (!remote) return {
+		...base,
+		status: "check-failed",
+		reason: "missing-response"
+	};
+	if (remote.status === "not-found") return {
+		...base,
+		status: "invalid-skill-path",
+		reason: "SKILL.md not found"
+	};
+	if (remote.status !== "ok" || !remote.latestHash) return {
+		...base,
+		status: "check-failed",
+		reason: remote.status
+	};
+	if (!localHash) return {
+		...base,
+		status: "update-required",
+		reason: "missing-version",
+		latestHash: remote.latestHash
+	};
+	if (localHash !== remote.latestHash) return {
+		...base,
+		status: "update-required",
+		reason: "version-changed",
+		latestHash: remote.latestHash
+	};
+	return {
+		...base,
+		status: "up-to-date",
+		latestHash: remote.latestHash
+	};
+}
+function fromGithubRemote(entry, skillPath, remote) {
+	const base = {
+		name: entry.name,
+		source: entry.source,
+		entry,
+		skillPath
+	};
+	if (!remote) return {
+		...base,
+		status: "check-failed",
+		reason: "missing-response"
+	};
+	if (remote.status === "not-found") return {
+		...base,
+		status: "invalid-skill-path",
+		reason: "SKILL.md not found"
+	};
+	if (remote.status !== "ok" || !remote.latestHash) return {
+		...base,
+		status: "check-failed",
+		reason: remote.status
+	};
+	if (entry.commitHash) return fromRemote(entry, skillPath, remote, entry.commitHash);
+	if (entry.skillFolderHash) {
+		if (!remote.latestTreeHash) return {
+			...base,
+			status: "check-failed",
+			reason: "missing-legacy-tree"
+		};
+		if (entry.skillFolderHash !== remote.latestTreeHash) return {
+			...base,
+			status: "update-required",
+			reason: "version-changed",
+			latestHash: remote.latestHash
+		};
+		return {
+			...base,
+			status: "up-to-date",
+			latestHash: remote.latestHash,
+			migrationCommitHash: remote.latestHash
+		};
+	}
+	return {
+		...base,
+		status: "update-required",
+		reason: "missing-version",
+		latestHash: remote.latestHash
+	};
+}
+async function checkSkillUpdates(entries, dependencies) {
+	const results = /* @__PURE__ */ new Map();
+	const githubEntries = entries.filter((entry) => entry.sourceType === "github");
+	const githubRequests = githubEntries.map((entry) => ({
+		name: entry.name,
+		source: entry.checkSource ?? entry.source,
+		skillPath: normalizeSkillPath(entry.skillPath),
+		...!entry.commitHash && entry.skillFolderHash ? { legacySkillFolderHash: entry.skillFolderHash } : {}
+	}));
+	const githubResults = githubRequests.length ? await dependencies.checkGithub(githubRequests) : [];
+	const githubByKey = new Map(githubResults.map((result) => [remoteKey(result), result]));
+	for (const entry of githubEntries) {
+		const skillPath = normalizeSkillPath(entry.skillPath);
+		const request = {
+			name: entry.name,
+			source: entry.checkSource ?? entry.source,
+			skillPath
+		};
+		results.set(entry.name, fromGithubRemote(entry, skillPath, githubByKey.get(remoteKey(request))));
+	}
+	await Promise.all(entries.filter((entry) => entry.sourceType === "internal").map(async (entry) => {
+		const skillPath = normalizeSkillPath(entry.skillPath);
+		const remote = await dependencies.checkInternal({
+			name: entry.name,
+			source: entry.source,
+			skillPath
+		}).catch(() => void 0);
+		results.set(entry.name, fromRemote(entry, skillPath, remote, entry.commitHash));
+	}));
+	for (const entry of entries) {
+		if (results.has(entry.name)) continue;
+		const skillPath = normalizeSkillPath(entry.skillPath);
+		results.set(entry.name, {
+			name: entry.name,
+			source: entry.source,
+			entry,
+			skillPath,
+			status: "unsupported",
+			reason: entry.sourceType === "local" ? "Local path" : "Version tracking not supported"
+		});
+	}
+	return entries.map((entry) => results.get(entry.name));
+}
 const isCancelled$1 = (value) => typeof value === "symbol";
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
@@ -1939,7 +2102,6 @@ async function runAdd(args, options = {}) {
 			return;
 		}
 		let skillsDir;
-		let usedOssFallback = false;
 		if (parsed.type === "local") {
 			spinner.start("Validating local path...");
 			if (!existsSync(parsed.localPath)) {
@@ -1951,47 +2113,10 @@ async function runAdd(args, options = {}) {
 			spinner.stop("Local path validated");
 		} else {
 			spinner.start("Cloning repository...");
-			try {
-				const ref = parsed.ref === "HEAD" ? void 0 : parsed.ref;
-				tempDir = await cloneRepo(parsed.url, ref);
-				skillsDir = tempDir;
-				spinner.stop("Repository cloned");
-			} catch (cloneError) {
-				if (![
-					"github",
-					"internal",
-					"git"
-				].includes(parsed.type)) throw cloneError;
-				if (cloneError instanceof GitCloneError && cloneError.isAuthError && cloneError.url.includes("code.alibaba-inc.com")) {
-					spinner.stop(import_picocolors.default.yellow("Git clone failed: 无访问权限"));
-					const gitlabUser = GITLAB_ACCOUNT.user;
-					console.log();
-					M.warn(import_picocolors.default.yellow(`仓库未授权给 ${import_picocolors.default.bold(gitlabUser)} 账号，请按以下步骤授权：`));
-					M.message([
-						`  ${import_picocolors.default.cyan("推荐")}  在 ${import_picocolors.default.bold("Group")} 层级将 ${import_picocolors.default.cyan(gitlabUser)} 添加为 ${import_picocolors.default.bold("Owner")} 角色`,
-						`        路径：GitLab Group → Manage → Members → Invite members`,
-						`  ${import_picocolors.default.dim("最低")}  在 ${import_picocolors.default.bold("Project")} 层级将 ${import_picocolors.default.cyan(gitlabUser)} 添加为 ${import_picocolors.default.bold("Reporter")} 及以上角色（可下载代码）`,
-						`        路径：GitLab Project → Manage → Members → Invite members`
-					].join("\n"));
-					console.log();
-					M.info("正在尝试 OSS 备用下载...");
-				} else spinner.stop(import_picocolors.default.yellow("Git clone failed, trying OSS fallback..."));
-				const normalizedSource = getOwnerRepo(parsed);
-				if (!normalizedSource) throw cloneError;
-				const singleSkillForOss = parsed.skillFilter ?? (options.skill?.length === 1 && !options.skill.includes("*") ? options.skill[0] : void 0);
-				try {
-					const resolved = await resolveFromOss(normalizedSource, parsed.type, singleSkillForOss);
-					if (!resolved) throw cloneError;
-					spinner.start("Downloading skill package from OSS...");
-					const extractedDir = await downloadAndExtractZip(resolved.zipUrl);
-					tempDir = extractedDir;
-					skillsDir = extractedDir;
-					usedOssFallback = true;
-					spinner.stop("Skill package downloaded");
-				} catch {
-					throw cloneError;
-				}
-			}
+			const ref = parsed.ref === "HEAD" ? void 0 : parsed.ref;
+			tempDir = await cloneRepo(parsed.url, ref);
+			skillsDir = tempDir;
+			spinner.stop("Repository cloned");
 		}
 		if (parsed.skillFilter) {
 			options.skill = options.skill || [];
@@ -2005,33 +2130,7 @@ async function runAdd(args, options = {}) {
 			parseFailures: skillParseFailures
 		};
 		spinner.start("Discovering skills...");
-		let skills = await discoverSkills(skillsDir, parsed.subpath, discoverOpts);
-		if (skills.length === 0 && !usedOssFallback && [
-			"github",
-			"internal",
-			"git"
-		].includes(parsed.type)) {
-			const normalizedSource = getOwnerRepo(parsed);
-			if (normalizedSource) {
-				spinner.stop(import_picocolors.default.yellow("默认分支未找到 skill，检查 OSS 已发布版本..."));
-				const singleSkillForOss = options.skill?.length === 1 && !options.skill.includes("*") ? options.skill[0] : void 0;
-				try {
-					const resolved = await resolveFromOss(normalizedSource, parsed.type, singleSkillForOss);
-					if (resolved) {
-						spinner.start("Downloading skill package from OSS...");
-						const ossDir = await downloadAndExtractZip(resolved.zipUrl);
-						await cleanup(tempDir);
-						tempDir = ossDir;
-						skillsDir = ossDir;
-						usedOssFallback = true;
-						spinner.stop("Skill package downloaded");
-						spinner.start("Discovering skills...");
-						skillParseFailures.length = 0;
-						skills = await discoverSkills(skillsDir, parsed.subpath, discoverOpts);
-					}
-				} catch {}
-			}
-		}
+		const skills = await discoverSkills(skillsDir, parsed.subpath, discoverOpts);
 		if (skills.length === 0) {
 			spinner.stop(import_picocolors.default.red("No skills found"));
 			logSkillParseFailures(skillParseFailures);
@@ -2039,7 +2138,7 @@ async function runAdd(args, options = {}) {
 			await cleanup(tempDir);
 			process.exit(1);
 		}
-		spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}${usedOssFallback ? import_picocolors.default.dim(" (OSS)") : ""}`);
+		spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
 		if (options.list) {
 			console.log();
 			M.step(import_picocolors.default.bold("Available Skills"));
@@ -2140,7 +2239,8 @@ async function runAdd(args, options = {}) {
 		const auditPromise = ownerRepoForAudit ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s)), parsed.type) : Promise.resolve(null);
 		let targetAgents;
 		const validAgents = Object.keys(agents);
-		if (options.agent?.includes("*")) {
+		if (options.canonicalOnly) targetAgents = [];
+		else if (options.agent?.includes("*")) {
 			targetAgents = validAgents;
 			M.info(`Installing to all ${targetAgents.length} agents`);
 		} else if (options.agent && options.agent.length > 0) {
@@ -2189,7 +2289,7 @@ async function runAdd(args, options = {}) {
 				targetAgents = selected;
 			}
 		}
-		let installGlobally = options.global ?? false;
+		let installGlobally = options.canonicalOnly ? true : options.global ?? false;
 		const supportsGlobal = targetAgents.some((a) => agents[a].globalSkillsDir !== void 0);
 		if (options.global === void 0 && !options.yes && supportsGlobal) {
 			const scope = await ve({
@@ -2248,7 +2348,8 @@ async function runAdd(args, options = {}) {
 				if (summaryLines.length > 0) summaryLines.push("");
 				const shortCanonical = shortenPath$2(getEntityPath(skill.name, installMode, installGlobally, cwd), cwd);
 				summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-				summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
+				if (options.canonicalOnly) summaryLines.push(`  ${import_picocolors.default.dim("shared entity only (not linked)")}`);
+				else summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
 				const skillOverwrites = overwriteStatus.get(skill.name);
 				const overwriteAgents = targetAgents.filter((a) => skillOverwrites?.get(a)).map((a) => agents[a].displayName);
 				if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
@@ -2291,17 +2392,29 @@ async function runAdd(args, options = {}) {
 		spinner.start("Installing skills...");
 		const results = [];
 		const effectiveAgents = installMode === "copy" || installMode === "copy-isolated" ? targetAgents.filter((a, i, arr) => arr.findIndex((b) => agents[b].skillsDir === agents[a].skillsDir) === i) : targetAgents;
-		for (const skill of selectedSkills) for (const agent of effectiveAgents) {
-			const result = await installSkillForAgent(skill, agent, {
-				global: installGlobally,
-				mode: installMode
-			});
-			results.push({
-				skill: getSkillDisplayName(skill),
-				agent: agents[agent].displayName,
-				pluginName: skill.pluginName,
-				...result
-			});
+		for (const skill of selectedSkills) {
+			if (options.canonicalOnly) {
+				const result = await installSkillCanonical(skill, { global: true });
+				results.push({
+					skill: getSkillDisplayName(skill),
+					agent: "Shared",
+					pluginName: skill.pluginName,
+					...result
+				});
+				continue;
+			}
+			for (const agent of effectiveAgents) {
+				const result = await installSkillForAgent(skill, agent, {
+					global: installGlobally,
+					mode: installMode
+				});
+				results.push({
+					skill: getSkillDisplayName(skill),
+					agent: agents[agent].displayName,
+					pluginName: skill.pluginName,
+					...result
+				});
+			}
 		}
 		spinner.stop("Installation complete");
 		console.log();
@@ -2328,6 +2441,7 @@ async function runAdd(args, options = {}) {
 		const lockSource = parsed.url.startsWith("git@") ? parsed.url : normalizedSource;
 		const trackableSkillNames = selectedSkills.filter((s) => isValidSkillName(s.name)).map((s) => s.name);
 		const skillMdLastCommitAuthors = {};
+		const skillMdLatestVersions = {};
 		if (parsed.type === "internal" && normalizedSource) {
 			const gitlabToken = GITLAB_ACCOUNT.token;
 			if (gitlabToken) {
@@ -2335,7 +2449,12 @@ async function runAdd(args, options = {}) {
 				if (project) for (const skillName of trackableSkillNames) {
 					const skillFilePath = skillFiles[skillName];
 					if (skillFilePath) {
-						const author = await getSkillLastCommitAuthor(project.id, skillFilePath, gitlabToken);
+						const commitInfo = await getSkillLastCommitInfo(project.id, skillFilePath, gitlabToken);
+						if (commitInfo?.hash || commitInfo?.committedAt) skillMdLatestVersions[skillName] = {
+							hash: commitInfo.hash,
+							committedAt: commitInfo.committedAt
+						};
+						const author = commitInfo?.author;
 						if (author) {
 							const formattedName = author.username ? `${author.name}/${author.username}` : author.name;
 							skillMdLastCommitAuthors[skillName] = {
@@ -2360,6 +2479,7 @@ async function runAdd(args, options = {}) {
 					skillFiles: JSON.stringify(skillFiles),
 					sourceType: effectiveSourceType,
 					skillMdLastCommitAuthors: JSON.stringify(skillMdLastCommitAuthors),
+					skillMdLatestVersions: JSON.stringify(skillMdLatestVersions),
 					skillMdConfigAuthors: JSON.stringify(skillMdAuthors),
 					descriptions: JSON.stringify(skillDescriptions)
 				});
@@ -2372,27 +2492,37 @@ async function runAdd(args, options = {}) {
 				skillFiles: JSON.stringify(skillFiles),
 				sourceType: effectiveSourceType,
 				skillMdLastCommitAuthors: JSON.stringify(skillMdLastCommitAuthors),
+				skillMdLatestVersions: JSON.stringify(skillMdLatestVersions),
 				skillMdConfigAuthors: JSON.stringify(skillMdAuthors),
 				descriptions: JSON.stringify(skillDescriptions)
 			});
 		}
+		const githubCommitHashes = /* @__PURE__ */ new Map();
+		if (successful.length > 0 && effectiveSourceType === "github" && tempDir) try {
+			const successfulSkillNames = new Set(successful.map((result) => result.skill));
+			const source = normalizedSource || getOwnerRepo(parsed);
+			if (source) {
+				const ref = await getGitHeadHash(tempDir);
+				(await checkGithubVersions$1(selectedSkills.filter((skill) => successfulSkillNames.has(getSkillDisplayName(skill))).map((skill) => ({
+					name: skill.name,
+					source,
+					skillPath: normalizeSkillPath(skillFiles[skill.name]),
+					ref
+				})))).forEach((version) => {
+					if (version.status === "ok" && version.latestHash) githubCommitHashes.set(version.name, version.latestHash);
+				});
+			}
+		} catch {}
 		if (successful.length > 0 && installGlobally && normalizedSource) {
 			const successfulSkillNames = new Set(successful.map((r) => r.skill));
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
-					let skillFolderHash;
 					let commitHash;
 					const skillPathValue = skillFiles[skill.name];
-					let skillPath = skillPathValue;
-					if (skillPath) {
-						if (skillPath.endsWith("/SKILL.md")) skillPath = skillPath.slice(0, -9);
-						else if (skillPath.endsWith("SKILL.md")) skillPath = skillPath.slice(0, -8);
-					}
-					if (effectiveSourceType === "github" && skillPathValue) {
-						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue, getGitHubToken());
-						if (hash) skillFolderHash = hash;
-					} else if (effectiveSourceType === "internal" && skillPath !== void 0) {
+					const skillPath = normalizeSkillPath(skillPathValue);
+					if (effectiveSourceType === "github") commitHash = githubCommitHashes.get(skill.name);
+					else if (effectiveSourceType === "internal") {
 						const hash = await fetchAliInternalCommitHash(normalizedSource, skillPath, null);
 						if (hash) commitHash = hash;
 					}
@@ -2401,7 +2531,6 @@ async function runAdd(args, options = {}) {
 						sourceType: effectiveSourceType,
 						sourceUrl: sanitizeSourceUrl(parsed.url),
 						skillPath,
-						...skillFolderHash && { skillFolderHash },
 						...commitHash && { commitHash },
 						pluginName: skill.pluginName
 					});
@@ -2421,10 +2550,10 @@ async function runAdd(args, options = {}) {
 						sourceType: effectiveSourceType,
 						computedHash
 					};
-					if (effectiveSourceType === "github" && skillFilePath && normalizedSource) {
-						const folderHash = await fetchSkillFolderHash(normalizedSource, skillFilePath, getGitHubToken());
-						if (folderHash) lockEntry.skillFolderHash = folderHash;
-						lockEntry.skillPath = skillFilePath.replace(/\/?SKILL\.md$/i, "").replace(/\/+$/, "");
+					if (effectiveSourceType === "github") {
+						const commitHash = githubCommitHashes.get(skill.name);
+						if (commitHash) lockEntry.commitHash = commitHash;
+						lockEntry.skillPath = normalizeSkillPath(skillFilePath);
 					}
 					if (effectiveSourceType === "internal") {
 						const source = normalizedSource || getOwnerRepo(parsed) || parsed.url;
@@ -5740,16 +5869,6 @@ async function runPlatformLogin(platformArgs) {
 	}
 	await configurePlatform(platform, platform === "yuque" ? extraArgs[0] : void 0);
 }
-function getUpdateComparisonStrategy(entry) {
-	if (entry.sourceType === "internal") return {
-		field: "commitHash",
-		value: entry.commitHash
-	};
-	return {
-		field: "skillFolderHash",
-		value: entry.skillFolderHash
-	};
-}
 function parseScopeFromArgs(args) {
 	let scopeGlobal;
 	let isScopeSpecified = false;
@@ -5768,6 +5887,20 @@ function parseScopeFromArgs(args) {
 		positionalArgs
 	};
 }
+function resolveUpdateInstallTarget(installedAgents, global) {
+	if (!installedAgents) return { mode: "skip" };
+	if (installedAgents.length > 0) return {
+		mode: "agents",
+		agents: installedAgents
+	};
+	return global ? { mode: "canonical" } : { mode: "skip" };
+}
+function migrateGithubTreeToCommit(entry, expectedTreeHash, commitHash) {
+	if (entry?.sourceType !== "github" || entry.commitHash || entry.skillFolderHash !== expectedTreeHash) return false;
+	entry.commitHash = commitHash;
+	delete entry.skillFolderHash;
+	return true;
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
 	try {
@@ -5793,6 +5926,13 @@ function isTruthyEnv(value) {
 function isUpdateDebugEnabled() {
 	return isTruthyEnv(process.env.ALI_SKILLS_DEBUG_UPDATE) || isTruthyEnv(process.env.DEBUG);
 }
+function isCheckDebugEnabled() {
+	return isTruthyEnv(process.env.ALI_SKILLS_DEBUG_CHECK) || isTruthyEnv(process.env.DEBUG);
+}
+function checkDebugLog(message) {
+	if (!isCheckDebugEnabled() && !isUpdateDebugEnabled()) return;
+	console.log(`${DIM}[check-debug]${RESET} ${message}`);
+}
 function updateDebugLog(enabled, message) {
 	if (!enabled) return;
 	console.log(`${DIM}[update-debug]${RESET} ${message}`);
@@ -6465,88 +6605,83 @@ function readSkillLock() {
 		};
 	}
 }
-function getSkipReason(entry) {
-	if (entry.sourceType === "local") return "Local path";
-	if (entry.sourceType === "git") return "Git URL (hash tracking not supported)";
-	if (!getUpdateComparisonStrategy(entry).value) return "No version hash available";
-	if (!entry.skillPath) return "No skill path recorded";
-	return "No version tracking";
-}
-async function checkSkillsForUpdates(skills, token) {
-	const updates = [];
-	const errors = [];
-	const skipped = [];
-	for (const [skillName, entry] of Object.entries(skills)) {
-		if (entry.sourceType === "internal") {
-			if (!entry.commitHash || !entry.skillPath) {
-				skipped.push({
-					name: skillName,
-					reason: getSkipReason(entry),
-					sourceUrl: entry.sourceUrl
-				});
-				continue;
-			}
-			try {
-				const latestCommit = await fetchAliInternalCommitHash(entry.source, entry.skillPath, null);
-				if (!latestCommit) {
-					errors.push({
-						name: skillName,
-						source: entry.source,
-						error: "Could not fetch from GitLab"
-					});
-					continue;
-				}
-				if (latestCommit !== entry.commitHash) updates.push({
-					name: skillName,
-					source: entry.source,
-					entry
-				});
-			} catch (err) {
-				errors.push({
-					name: skillName,
-					source: entry.source,
-					error: err instanceof Error ? err.message : "Unknown error"
-				});
-			}
-			continue;
-		}
-		if (!entry.skillFolderHash || !entry.skillPath) {
-			skipped.push({
-				name: skillName,
-				reason: getSkipReason(entry),
-				sourceUrl: entry.sourceUrl
-			});
-			continue;
-		}
-		try {
-			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token);
-			if (!latestHash) {
-				errors.push({
-					name: skillName,
-					source: entry.source,
-					error: "Could not fetch from GitHub"
-				});
-				continue;
-			}
-			if (latestHash !== entry.skillFolderHash) updates.push({
-				name: skillName,
-				source: entry.source,
-				entry
-			});
-		} catch (err) {
-			errors.push({
-				name: skillName,
-				source: entry.source,
-				error: err instanceof Error ? err.message : "Unknown error"
-			});
-		}
+function printCheckErrors(errors) {
+	if (errors.length === 0) return;
+	console.log();
+	console.log(`${YELLOW}${errors.length} skill(s) failed during update checking:${RESET}`);
+	for (const error of errors) console.log(`  ${YELLOW}⚠${RESET} ${error.name} ${DIM}(${error.source}: ${error.error})${RESET}`);
+	console.log(`${DIM}Re-run with ALI_SKILLS_DEBUG_CHECK=1 for sanitized request diagnostics.${RESET}`);
+}
+async function checkGithubVersions(requests) {
+	return checkGithubVersions$1(requests, checkDebugLog);
+}
+async function checkInternalVersion(request) {
+	try {
+		const result = await fetchAliInternalSkillVersion(request.source, request.skillPath, null);
+		return {
+			...request,
+			...result
+		};
+	} catch {
+		return {
+			...request,
+			status: "upstream-error"
+		};
 	}
+}
+async function checkSkillsForUpdates(skills) {
+	const results = await checkSkillUpdates(Object.entries(skills).map(([name, entry]) => ({
+		...entry,
+		name,
+		...entry.sourceType === "github" ? { checkSource: getOwnerRepo(parseSource(entry.source)) ?? getOwnerRepo(parseSource(entry.sourceUrl)) ?? entry.source } : {}
+	})), {
+		checkGithub: checkGithubVersions,
+		checkInternal: checkInternalVersion
+	});
 	return {
-		updates,
-		errors,
-		skipped
+		updates: results.filter((result) => result.status === "update-required").map((result) => ({
+			name: result.name,
+			source: result.source,
+			entry: result.entry
+		})),
+		errors: results.filter((result) => result.status === "check-failed").map((result) => ({
+			name: result.name,
+			source: result.source,
+			error: result.reason ?? "Unknown error"
+		})),
+		skipped: results.filter((result) => result.status === "unsupported" || result.status === "invalid-skill-path").map((result) => ({
+			name: result.name,
+			reason: result.reason ?? "No version tracking",
+			sourceUrl: result.entry.sourceUrl
+		})),
+		migrations: results.filter((result) => result.status === "up-to-date" && Boolean(result.migrationCommitHash) && Boolean(result.entry.skillFolderHash)).map((result) => ({
+			name: result.name,
+			expectedTreeHash: result.entry.skillFolderHash,
+			commitHash: result.migrationCommitHash
+		}))
 	};
 }
+async function applySafeGithubLockMigrations(migrations, isGlobal) {
+	if (migrations.length === 0) return 0;
+	if (isGlobal) {
+		const { lock } = readSkillLock();
+		let changed = 0;
+		for (const migration of migrations) {
+			const entry = lock.skills[migration.name];
+			if (migrateGithubTreeToCommit(entry, migration.expectedTreeHash, migration.commitHash)) changed++;
+		}
+		if (changed > 0) writeFileSync(getSkillLockPath(), JSON.stringify(lock, null, 2), "utf-8");
+		return changed;
+	}
+	const { lock } = await readLocalLock();
+	let changed = 0;
+	for (const migration of migrations) {
+		const entry = lock.skills[migration.name];
+		if (migrateGithubTreeToCommit(entry, migration.expectedTreeHash, migration.commitHash)) changed++;
+	}
+	if (changed > 0) await writeLocalLock(lock);
+	return changed;
+}
 async function runCheck(args = []) {
 	const { isGlobal, isScopeSpecified, positionalArgs: skillArgs } = parseScopeFromArgs(args);
 	console.log(`${TEXT}Checking for skill updates...${RESET}`);
@@ -6555,8 +6690,8 @@ async function runCheck(args = []) {
 		console.log(`${DIM}提示: 当前为项目级检查（skills-lock.json）。如需检查全局技能，请执行: ${TEXT}npx ali-skills check -g${RESET}`);
 		console.log();
 	}
-	const token = getGitHubToken();
 	let updates = [];
+	let errors = [];
 	let skipped = [];
 	let skillCount = 0;
 	if (isGlobal) {
@@ -6582,11 +6717,12 @@ async function runCheck(args = []) {
 		skillCount = selectedGlobalSkillNames.length;
 		console.log(`${BOLD}Global skills${RESET}`);
 		console.log(`${DIM}Checking ${selectedGlobalSkillNames.length} skill(s)...${RESET}`);
-		const result = await checkSkillsForUpdates(globalSkillsToCheck, token);
+		const result = await checkSkillsForUpdates(globalSkillsToCheck);
 		updates = result.updates;
-		result.errors;
+		errors = result.errors;
 		skipped = result.skipped;
-		if (updates.length === 0) console.log(`${TEXT}  ✓ ${skillArgs.length > 0 ? "All selected global skills are up to date" : "All global skills are up to date"}${RESET}`);
+		if (updates.length === 0 && errors.length === 0) console.log(`${TEXT}  ✓ ${skillArgs.length > 0 ? "All selected global skills are up to date" : "All global skills are up to date"}${RESET}`);
+		else if (updates.length === 0) console.log(`${YELLOW}  No updates confirmed; some skills could not be checked.${RESET}`);
 		else {
 			console.log(`${TEXT}  ${updates.length} update(s) available:${RESET}`);
 			for (const update of updates) console.log(`    ${TEXT}↑${RESET} ${update.name} ${DIM}(${update.source})${RESET}`);
@@ -6601,6 +6737,7 @@ async function runCheck(args = []) {
 				console.log(`      ${DIM}To update: ${TEXT}npx ali-skills add ${displaySource} -g -y${RESET}`);
 			}
 		}
+		printCheckErrors(errors);
 		console.log();
 		if (updates.length > 0) {
 			console.log(`${TEXT}${updates.length} update(s) available${RESET}`);
@@ -6630,82 +6767,21 @@ async function runCheck(args = []) {
 		skillCount = selectedProjectSkillNames.length;
 		console.log(`${BOLD}Project-level skills${RESET}`);
 		console.log(`${DIM}Checking ${selectedProjectSkillNames.length} skill(s)...${RESET}`);
-		for (const [skillName, entry] of Object.entries(projectSkillsToCheck)) {
-			if (entry.sourceType === "internal") {
-				if (!entry.commitHash) {
-					skipped.push({
-						name: skillName,
-						reason: "Reinstall required to enable update checking (missing commit hash)",
-						sourceUrl: `https://code.alibaba-inc.com/${entry.source}`
-					});
-					continue;
-				}
-				const skillPath = (entry.skillPath || "").replace(/\/?SKILL\.md$/i, "");
-				const latestCommit = await fetchAliInternalCommitHash(entry.source, skillPath, null);
-				if (latestCommit === null) skipped.push({
-					name: skillName,
-					reason: "Ali internal repository (API authentication failed)",
-					sourceUrl: `https://code.alibaba-inc.com/${entry.source}`
-				});
-				else if (latestCommit !== entry.commitHash) updates.push({
-					name: skillName,
-					source: entry.source,
-					entry: {
-						source: entry.source,
-						sourceType: entry.sourceType,
-						sourceUrl: `https://code.alibaba-inc.com/${entry.source}`,
-						skillPath,
-						skillFolderHash: entry.computedHash,
-						installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-						updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-					}
-				});
-				continue;
-			}
-			if (entry.sourceType === "github") {
-				if (!entry.skillFolderHash) {
-					skipped.push({
-						name: skillName,
-						reason: "Reinstall required to enable update checking (missing folder hash)",
-						sourceUrl: `https://github.com/${entry.source}`
-					});
-					continue;
-				}
-				const possiblePaths = entry.skillPath ? [entry.skillPath] : [`skills/${skillName}`, `skills/${skillName}/SKILL.md`];
-				let foundMatch = false;
-				for (const skillPath of possiblePaths) try {
-					const latestHash = await fetchSkillFolderHash(entry.source, skillPath, token);
-					if (latestHash === null) continue;
-					foundMatch = true;
-					if (latestHash !== entry.skillFolderHash) updates.push({
-						name: skillName,
-						source: entry.source,
-						entry: {
-							source: entry.source,
-							sourceType: entry.sourceType,
-							sourceUrl: `https://github.com/${entry.source}`,
-							skillPath,
-							skillFolderHash: entry.skillFolderHash,
-							installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-							updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-						}
-					});
-					break;
-				} catch {
-					continue;
-				}
-				if (!foundMatch) skipped.push({
-					name: skillName,
-					reason: "Unable to verify (API failed for all possible paths)",
-					sourceUrl: `https://github.com/${entry.source}`
-				});
-			} else skipped.push({
-				name: skillName,
-				reason: `${entry.sourceType} source type not supported for update checking`,
-				sourceUrl: entry.source
-			});
-		}
-		if (updates.length === 0) console.log(`${TEXT}  ✓ ${skillArgs.length > 0 ? "All selected project skills are up to date" : "All project skills are up to date"}${RESET}`);
+		const result = await checkSkillsForUpdates(Object.fromEntries(Object.entries(projectSkillsToCheck).map(([name, entry]) => [name, {
+			source: entry.source,
+			sourceType: entry.sourceType,
+			sourceUrl: entry.sourceType === "github" ? `https://github.com/${entry.source}` : entry.sourceType === "internal" ? `https://code.alibaba-inc.com/${entry.source}` : entry.source,
+			skillPath: entry.skillPath ?? "",
+			skillFolderHash: entry.skillFolderHash,
+			commitHash: entry.commitHash,
+			installedAt: "",
+			updatedAt: ""
+		}])));
+		updates = result.updates;
+		errors = result.errors;
+		skipped = result.skipped;
+		if (updates.length === 0 && errors.length === 0) console.log(`${TEXT}  ✓ ${skillArgs.length > 0 ? "All selected project skills are up to date" : "All project skills are up to date"}${RESET}`);
+		else if (updates.length === 0) console.log(`${YELLOW}  No updates confirmed; some skills could not be checked.${RESET}`);
 		else {
 			console.log(`${TEXT}  ${updates.length} update(s) available:${RESET}`);
 			for (const update of updates) console.log(`    ${TEXT}↑${RESET} ${update.name} ${DIM}(${update.source})${RESET}`);
@@ -6716,6 +6792,7 @@ async function runCheck(args = []) {
 			if (isLocalLockOutdated) console.log(`${YELLOW}  Note: Your lock file may be outdated. Re-adding these skills may fix this.${RESET}`);
 			for (const skill of skipped) console.log(`    ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
 		}
+		printCheckErrors(errors);
 		console.log();
 		if (updates.length > 0) {
 			console.log(`${TEXT}${updates.length} update(s) available${RESET}`);
@@ -6742,7 +6819,6 @@ async function runUpdate(args = []) {
 		console.log();
 	}
 	updateDebugLog(debugUpdate, `scope=${isGlobal ? "global" : "project"}, yes=${yesFlag}, requestedSkills=${skillArgs.length > 0 ? skillArgs.join(",") : "(all)"}`);
-	const token = getGitHubToken();
 	let skillsToCheck = {};
 	let scopeLabel = "project";
 	if (isGlobal) {
@@ -6760,9 +6836,9 @@ async function runUpdate(args = []) {
 				source: entry.source,
 				sourceType: entry.sourceType,
 				sourceUrl,
-				skillPath: entry.skillPath || "",
+				skillPath: entry.skillPath ?? "",
 				commitHash: entry.commitHash,
-				skillFolderHash: entry.skillFolderHash || entry.computedHash,
+				skillFolderHash: entry.skillFolderHash,
 				installedAt: (/* @__PURE__ */ new Date()).toISOString(),
 				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
 			};
@@ -6775,81 +6851,17 @@ async function runUpdate(args = []) {
 		console.log();
 		return;
 	}
-	const availableUpdates = [];
-	const skipped = [];
-	const projectLock = (!isGlobal ? await readLocalLock() : null)?.lock ?? null;
-	for (const skillName of skillNames) {
-		const entry = skillsToCheck[skillName];
-		if (!entry) continue;
-		if (entry.sourceType === "internal") {
-			const localEntry = projectLock?.skills[skillName];
-			const commitHash = getUpdateComparisonStrategy(entry).value || getUpdateComparisonStrategy(localEntry || {}).value;
-			const storedSkillPath = entry.skillPath || localEntry?.skillPath || "";
-			updateDebugLog(debugUpdate, `checking internal skill=${skillName}, repo=${entry.source}, skillPath=${storedSkillPath || "(root)"}, hasCommitHash=${commitHash ? "yes" : "no"}`);
-			if (!commitHash) {
-				skipped.push({
-					name: skillName,
-					reason: "Reinstall required to enable update checking (missing commit hash)",
-					sourceUrl: entry.sourceUrl
-				});
-				continue;
-			}
-			try {
-				const skillPath = storedSkillPath.replace(/\/?SKILL\.md$/i, "");
-				const latestCommit = await fetchAliInternalCommitHash(entry.source, skillPath, null);
-				if (latestCommit && latestCommit !== commitHash) {
-					availableUpdates.push({
-						name: skillName,
-						source: entry.source,
-						entry
-					});
-					updateDebugLog(debugUpdate, `update available for ${skillName}: local=${commitHash?.slice(0, 12)} remote=${latestCommit.slice(0, 12)}`);
-				} else updateDebugLog(debugUpdate, `no update for ${skillName}: local=${commitHash?.slice(0, 12)} remote=${latestCommit?.slice(0, 12) || "(empty)"}`);
-			} catch {
-				updateDebugLog(debugUpdate, `failed to check internal skill=${skillName}`);
-				skipped.push({
-					name: skillName,
-					reason: "Ali internal repository (API check failed)",
-					sourceUrl: entry.sourceUrl
-				});
-			}
-			continue;
-		}
-		if (!entry.skillFolderHash) {
-			skipped.push({
-				name: skillName,
-				reason: getSkipReason(entry),
-				sourceUrl: entry.sourceUrl
-			});
-			continue;
-		}
-		if (entry.sourceType === "github") {
-			const possiblePaths = entry.skillPath ? [entry.skillPath] : [`skills/${skillName}`, `skills/${skillName}/SKILL.md`];
-			for (const skillPath of possiblePaths) try {
-				const latestHash = await fetchSkillFolderHash(entry.source, skillPath, token);
-				if (latestHash === null) continue;
-				if (latestHash !== entry.skillFolderHash) availableUpdates.push({
-					name: skillName,
-					source: entry.source,
-					entry
-				});
-				break;
-			} catch {
-				continue;
-			}
-			continue;
-		}
-		try {
-			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath || "", token);
-			if (latestHash && latestHash !== entry.skillFolderHash) availableUpdates.push({
-				name: skillName,
-				source: entry.source,
-				entry
-			});
-		} catch {}
+	const updateCheck = await checkSkillsForUpdates(skillsToCheck);
+	const migratedCount = await applySafeGithubLockMigrations(updateCheck.migrations, isGlobal);
+	if (migratedCount > 0) console.log(`${DIM}Migrated ${migratedCount} GitHub skill version(s) to commit hashes.${RESET}`);
+	const availableUpdates = updateCheck.updates;
+	for (const error of updateCheck.errors) {
+		updateDebugLog(debugUpdate, `failed to check skill=${error.name}, source=${error.source}, reason=${error.error}`);
+		console.log(`${DIM}⚠ Could not check ${error.name} (${error.source}): ${error.error}${RESET}`);
 	}
 	if (availableUpdates.length === 0) {
-		console.log(`${TEXT}✓ All ${scopeLabel} skills are up to date${RESET}`);
+		if (updateCheck.errors.length > 0) console.log(`${YELLOW}No updates confirmed; ${updateCheck.errors.length} skill(s) could not be checked.${RESET}`);
+		else console.log(`${TEXT}✓ All ${scopeLabel} skills are up to date${RESET}`);
 		console.log();
 		return;
 	}
@@ -6920,8 +6932,8 @@ async function runUpdate(args = []) {
 			installUrl = `${installUrl}/tree/HEAD/${skillFolder}`;
 		} else installUrl = sourceUrl;
 		try {
-			const installedAgents = installedAgentsBySkillName.get(update.name.toLowerCase());
-			if (!installedAgents || installedAgents.length === 0) {
+			const installTarget = resolveUpdateInstallTarget(installedAgentsBySkillName.get(update.name.toLowerCase()), isGlobal);
+			if (installTarget.mode === "skip") {
 				failCount++;
 				safeSkipCount++;
 				const nearMatches = installedSkills.filter((s) => s.name.toLowerCase().includes(update.name.toLowerCase())).map((s) => s.name);
@@ -6936,9 +6948,10 @@ async function runUpdate(args = []) {
 			await runAdd([installUrl], {
 				yes: true,
 				global: isGlobal,
-				agent: installedAgents
+				...installTarget.mode === "agents" ? { agent: installTarget.agents } : {},
+				canonicalOnly: installTarget.mode === "canonical"
 			});
-			updateDebugLog(debugUpdate, `updated ${update.name} with installUrl=${installUrl} targetAgents=${installedAgents.join(",")}`);
+			updateDebugLog(debugUpdate, `updated ${update.name} with installUrl=${installUrl} targetAgents=${installTarget.mode === "agents" ? installTarget.agents.join(",") : "(canonical-only)"}`);
 			successCount++;
 			console.log(`  ${TEXT}✓${RESET} Updated ${update.name}`);
 		} catch {

package/node_modules/@ali/cli-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ali/cli-skills",
-  "version": "2.1.2",
+  "version": "2.1.5",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ali-skills",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -32,7 +32,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@ali/cli-skills": "^2.1.2"
+    "@ali/cli-skills": "^2.1.5"
   },
   "bundleDependencies": [
     "@ali/cli-skills"