bip-skills 1.4.8 → 1.4.10

package/dist/cli.mjs

@@ -9,15 +9,18 @@ import { t as require_gray_matter } from "./_chunks/libs/gray-matter.mjs";
 import "./_chunks/libs/extend-shallow.mjs";
 import "./_chunks/libs/esprima.mjs";
 import { t as xdgConfig } from "./_chunks/libs/xdg-basedir.mjs";
-import { execSync, spawn, spawnSync } from "child_process";
+import { execSync, spawnSync } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join, normalize, posix, relative, resolve, sep } from "path";
 import { homedir, platform, tmpdir } from "os";
-import { createHash } from "crypto";
 import { fileURLToPath } from "url";
 import * as readline from "readline";
 import { Writable } from "stream";
+import { Buffer } from "node:buffer";
 import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
+import http from "node:http";
+import https from "node:https";
+import { createHash } from "crypto";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const AGENTS_DIR$2 = ".agents";
 const SKILLS_SUBDIR = "skills";
@@ -31,9 +34,13 @@ const DEFAULT_GIT_HOST = "git.yyrd.com";
 const DEFAULT_GIT_BASE_URL = `https://${DEFAULT_GIT_HOST}`;
 const DEFAULT_GIT_FALLBACK_SSH_HOST = "git.yyrd.com";
 const DEFAULT_INSTALL_REPORT_URL = "https://sun.yyuap.com/api/install-report";
+const TLS_RELAXED_HOSTS = ["sun.yyuap.com"];
 function isYyuapHost(hostname) {
 	return hostname === "yyuap.com" || hostname.endsWith(".yyuap.com");
 }
+function shouldRelaxTlsForHost(hostname) {
+	return TLS_RELAXED_HOSTS.includes(hostname);
+}
 function isYyrdHost(hostname) {
 	return hostname === "yyrd.com" || hostname.endsWith(".yyrd.com");
 }
@@ -515,13 +522,41 @@ async function hasSkillMd(dir) {
 		return false;
 	}
 }
+function getYamlHeuristicHint(content, frontmatterKeys) {
+	if (frontmatterKeys.length > 0 || !content.startsWith("---\n")) return null;
+	const closingMarkerIndex = content.indexOf("\n---", 4);
+	if (closingMarkerIndex === -1) return "frontmatter start marker was found, but the closing --- marker may be missing or malformed";
+	const suspiciousLine = content.slice(4, closingMarkerIndex).split(/\r?\n/).find((line) => /^[A-Za-z0-9_-]+:\s.+:\s/.test(line) && !/^[A-Za-z0-9_-]+:\s*["'|>]/.test(line));
+	if (suspiciousLine) return `frontmatter looks present but YAML may be invalid; this line contains an unquoted ": " inside a scalar value: ${JSON.stringify(suspiciousLine)}`;
+	return "frontmatter looks present but YAML parsing produced no keys; check for hidden characters, invalid YAML syntax, or unquoted \": \" inside values";
+}
 async function parseSkillMd(skillMdPath, options) {
 	try {
 		const content = await readFile(skillMdPath, "utf-8");
 		const { data } = (0, import_gray_matter.default)(content);
-		if (!data.name || !data.description) return null;
-		if (typeof data.name !== "string" || typeof data.description !== "string") return null;
-		if (data.metadata?.internal === true && !shouldInstallInternalSkills() && !options?.includeInternal) return null;
+		const frontmatterKeys = Object.keys(data);
+		const frontmatterSummary = frontmatterKeys.length === 0 ? "(none)" : frontmatterKeys.map((key) => {
+			const value = data[key];
+			return `${key}:${Array.isArray(value) ? "array" : typeof value}`;
+		}).join(", ");
+		const leadingPreview = JSON.stringify(content.slice(0, 80));
+		const firstLine = JSON.stringify(content.split(/\r?\n/, 1)[0] ?? "");
+		const leadingCharCodes = Array.from(content.slice(0, 8)).map((char) => `U+${char.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`).join(", ");
+		const heuristicHint = getYamlHeuristicHint(content, frontmatterKeys);
+		if (!data.name || !data.description) {
+			debugLog(`[discover] skipped ${skillMdPath}: missing required frontmatter fields "name" and/or "description" (parsed keys: ${frontmatterSummary}, firstLine: ${firstLine}, leadingChars: ${leadingCharCodes}, leadingPreview: ${leadingPreview})`);
+			if (heuristicHint) debugLog(`[discover] hint ${skillMdPath}: ${heuristicHint}`);
+			return null;
+		}
+		if (typeof data.name !== "string" || typeof data.description !== "string") {
+			debugLog(`[discover] skipped ${skillMdPath}: frontmatter "name" and "description" must be strings (name=${typeof data.name}, description=${typeof data.description}, parsed keys: ${frontmatterSummary})`);
+			return null;
+		}
+		if (data.metadata?.internal === true && !shouldInstallInternalSkills() && !options?.includeInternal) {
+			debugLog(`[discover] skipped ${skillMdPath}: internal skill hidden (set INSTALL_INTERNAL_SKILLS=1 or request it explicitly)`);
+			return null;
+		}
+		debugLog(`[discover] accepted ${skillMdPath}: name="${data.name}" (parsed keys: ${frontmatterSummary})`);
 		return {
 			name: data.name,
 			description: data.description,
@@ -529,7 +564,8 @@ async function parseSkillMd(skillMdPath, options) {
 			rawContent: content,
 			metadata: data.metadata
 		};
-	} catch {
+	} catch (error) {
+		debugLog(`[discover] failed to read ${skillMdPath}: ${error instanceof Error ? error.message : String(error)}`);
 		return null;
 	}
 }
@@ -548,6 +584,7 @@ async function discoverSkills(basePath, subpath, options) {
 	const skills = [];
 	const seenNames = /* @__PURE__ */ new Set();
 	const searchPath = subpath ? join(basePath, subpath) : basePath;
+	debugLog(`[discover] start basePath=${basePath} searchPath=${searchPath} includeInternal=${options?.includeInternal === true} fullDepth=${options?.fullDepth === true}`);
 	const pluginGroupings = await getPluginGroupings(searchPath);
 	const enhanceSkill = (skill) => {
 		const resolvedPath = resolve(skill.path);
@@ -555,6 +592,7 @@ async function discoverSkills(basePath, subpath, options) {
 		return skill;
 	};
 	if (await hasSkillMd(searchPath)) {
+		debugLog(`[discover] found root SKILL.md at ${join(searchPath, "SKILL.md")}`);
 		let skill = await parseSkillMd(join(searchPath, "SKILL.md"), options);
 		if (skill) {
 			skill = enhanceSkill(skill);
@@ -595,31 +633,38 @@ async function discoverSkills(basePath, subpath, options) {
 		join(searchPath, ".zencoder/skills")
 	];
 	prioritySearchDirs.push(...await getPluginSkillPaths(searchPath));
+	debugLog(`[discover] scanning priority directories (${prioritySearchDirs.length}): ${prioritySearchDirs.join(", ")}`);
 	for (const dir of prioritySearchDirs) try {
 		const entries = await readdir(dir, { withFileTypes: true });
 		for (const entry of entries) if (entry.isDirectory()) {
 			const skillDir = join(dir, entry.name);
 			if (await hasSkillMd(skillDir)) {
+				debugLog(`[discover] candidate skill directory ${skillDir}`);
 				let skill = await parseSkillMd(join(skillDir, "SKILL.md"), options);
 				if (skill && !seenNames.has(skill.name)) {
 					skill = enhanceSkill(skill);
 					skills.push(skill);
 					seenNames.add(skill.name);
-				}
+				} else if (skill) debugLog(`[discover] skipped ${join(skillDir, "SKILL.md")}: duplicate skill name "${skill.name}"`);
 			}
 		}
-	} catch {}
+	} catch (error) {
+		debugLog(`[discover] unable to scan ${dir}: ${error instanceof Error ? error.message : String(error)}`);
+	}
 	if (skills.length === 0 || options?.fullDepth) {
+		debugLog(`[discover] ${skills.length === 0 ? "no skills from priority scan" : "fullDepth enabled"}; starting recursive search from ${searchPath}`);
 		const allSkillDirs = await findSkillDirs(searchPath);
+		debugLog(`[discover] recursive candidates (${allSkillDirs.length}): ${allSkillDirs.join(", ") || "(none)"}`);
 		for (const skillDir of allSkillDirs) {
 			let skill = await parseSkillMd(join(skillDir, "SKILL.md"), options);
 			if (skill && !seenNames.has(skill.name)) {
 				skill = enhanceSkill(skill);
 				skills.push(skill);
 				seenNames.add(skill.name);
-			}
+			} else if (skill) debugLog(`[discover] skipped ${join(skillDir, "SKILL.md")}: duplicate skill name "${skill.name}"`);
 		}
 	}
+	debugLog(`[discover] completed searchPath=${searchPath}; found ${skills.length} skill${skills.length === 1 ? "" : "s"}`);
 	return skills;
 }
 function getSkillDisplayName(skill) {
@@ -1411,6 +1456,106 @@ async function listInstalledSkills(options = {}) {
 	} catch {}
 	return Array.from(skillsMap.values());
 }
+function getRequestUrl(input) {
+	if (input instanceof URL) return input;
+	if (typeof input === "string") return new URL(input);
+	return new URL(input.url);
+}
+function shouldUseRelaxedTls(input) {
+	try {
+		const url = getRequestUrl(input);
+		return url.protocol === "https:" && shouldRelaxTlsForHost(url.hostname);
+	} catch {
+		return false;
+	}
+}
+function normalizeRequestMethod(input, init) {
+	if (init?.method) return init.method.toUpperCase();
+	if (typeof Request !== "undefined" && input instanceof Request) return input.method.toUpperCase();
+	return "GET";
+}
+function buildHeaders(input, init) {
+	const headers = new Headers(typeof Request !== "undefined" && input instanceof Request ? input.headers : void 0);
+	if (init?.headers) new Headers(init.headers).forEach((value, key) => {
+		headers.set(key, value);
+	});
+	return headers;
+}
+async function readRequestBody(init) {
+	const body = init?.body;
+	if (body == null) return;
+	if (typeof body === "string") return Buffer.from(body);
+	if (body instanceof URLSearchParams) return Buffer.from(body.toString());
+	if (body instanceof ArrayBuffer) return Buffer.from(body);
+	if (ArrayBuffer.isView(body)) return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+	if (body instanceof Blob) return Buffer.from(await body.arrayBuffer());
+	throw new TypeError("Unsupported request body for relaxed TLS fetch");
+}
+async function relaxedTlsFetch(input, init, redirectCount = 0) {
+	if (redirectCount > 5) throw new Error("Too many redirects");
+	const url = getRequestUrl(input);
+	const method = normalizeRequestMethod(input, init);
+	const headers = buildHeaders(input, init);
+	const body = await readRequestBody(init);
+	const transport = url.protocol === "https:" ? https : http;
+	return await new Promise((resolve, reject) => {
+		const request = transport.request(url, {
+			method,
+			headers: Object.fromEntries(headers.entries()),
+			rejectUnauthorized: url.protocol === "https:" ? false : void 0
+		}, (response) => {
+			const status = response.statusCode ?? 500;
+			const location = response.headers.location;
+			if (location && [
+				301,
+				302,
+				303,
+				307,
+				308
+			].includes(status) && init?.redirect !== "manual") {
+				response.resume();
+				const nextUrl = new URL(location, url);
+				const nextInit = {
+					...init,
+					method: status === 303 ? "GET" : method
+				};
+				delete nextInit.body;
+				relaxedTlsFetch(nextUrl, nextInit, redirectCount + 1).then(resolve).catch(reject);
+				return;
+			}
+			const chunks = [];
+			response.on("data", (chunk) => {
+				chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+			});
+			response.on("end", () => {
+				const responseHeaders = Object.entries(response.headers).flatMap(([key, value]) => value == null ? [] : Array.isArray(value) ? value.map((item) => [key, item]) : [[key, value]]);
+				resolve(new Response(method === "HEAD" ? null : Buffer.concat(chunks), {
+					status,
+					statusText: response.statusMessage ?? "",
+					headers: new Headers(responseHeaders)
+				}));
+			});
+		});
+		request.on("error", reject);
+		if (init?.signal) {
+			const abort = () => {
+				request.destroy(new DOMException("The operation was aborted.", "AbortError"));
+			};
+			if (init.signal.aborted) {
+				abort();
+				return;
+			}
+			init.signal.addEventListener("abort", abort, { once: true });
+			request.on("close", () => init.signal?.removeEventListener("abort", abort));
+		}
+		if (body) request.write(body);
+		request.end();
+	});
+}
+async function fetchWithSelectiveTls(input, init) {
+	if (!shouldUseRelaxedTls(input)) return fetch(input, init);
+	return relaxedTlsFetch(input, init);
+}
 function getAllowedReportingUrl(envVarName) {
 	const value = process.env[envVarName];
 	if (!value) return null;
@@ -1439,7 +1584,7 @@ async function fetchAuditData(source, skillSlugs, timeoutMs = 3e3) {
 		});
 		const controller = new AbortController();
 		const timeout = setTimeout(() => controller.abort(), timeoutMs);
-		const response = await fetch(`${AUDIT_URL}?${params.toString()}`, { signal: controller.signal });
+		const response = await fetchWithSelectiveTls(`${AUDIT_URL}?${params.toString()}`, { signal: controller.signal });
 		clearTimeout(timeout);
 		if (!response.ok) return null;
 		return await response.json();
@@ -1454,7 +1599,7 @@ function sendTelemetry(url, data) {
 		if (cliVersion) params.set("v", cliVersion);
 		if (isCI()) params.set("ci", "1");
 		for (const [key, value] of Object.entries(data)) if (value !== void 0 && value !== null) params.set(key, String(value));
-		fetch(`${url}?${params.toString()}`).catch(() => {});
+		fetchWithSelectiveTls(`${url}?${params.toString()}`).catch(() => {});
 	} catch {}
 }
 function track(data) {
@@ -1566,7 +1711,7 @@ var WellKnownProvider = class {
 			});
 			for (const { indexUrl, baseUrl: resolvedBase } of urlsToTry) try {
 				debugLog(`[well-known] requesting index: ${indexUrl}`);
-				const response = await fetch(indexUrl);
+				const response = await fetchWithSelectiveTls(indexUrl);
 				if (!response.ok) {
 					debugLog(`[well-known] index response status: ${response.status} ${response.statusText}`);
 					continue;
@@ -1650,7 +1795,7 @@ var WellKnownProvider = class {
 				indexEntry: entry,
 				installTarget
 			};
-			const response = await fetch(installTarget.skillMdUrl);
+			const response = await fetchWithSelectiveTls(installTarget.skillMdUrl);
 			if (!response.ok) return null;
 			const content = await response.text();
 			const { data } = (0, import_gray_matter.default)(content);
@@ -1660,8 +1805,7 @@ var WellKnownProvider = class {
 				try {
 					const normalizedFilePath = filePath.replace(/^\/+/, "");
 					const fileRelativePath = installTarget.skillRoot ? posix.join(installTarget.skillRoot, normalizedFilePath) : normalizedFilePath;
-					const fileUrl = this.buildUrl(this.resolveInlineBaseUrl(installTarget.repositoryUrl) || baseUrl, fileRelativePath);
-					const fileResponse = await fetch(fileUrl);
+					const fileResponse = await fetchWithSelectiveTls(this.buildUrl(this.resolveInlineBaseUrl(installTarget.repositoryUrl) || baseUrl, fileRelativePath));
 					if (fileResponse.ok) return {
 						path: normalizedFilePath,
 						content: await fileResponse.text()
@@ -1926,7 +2070,7 @@ function createEmptyLocalLock() {
 		skills: {}
 	};
 }
-var version$1 = "1.4.8";
+var version$1 = "1.4.10";
 const isCancelled$1 = (value) => typeof value === "symbol";
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
@@ -1939,6 +2083,14 @@ function initTelemetry(version) {
 function getWellKnownFileCount(skill) {
 	return skill.declaredFiles.length > 0 ? skill.declaredFiles.length : skill.files.size;
 }
+function getWellKnownSkillHash(skill) {
+	return skill.indexEntry.hash || skill.indexEntry.contentHash || skill.indexEntry.skillFolderHash || "";
+}
+function getWellKnownSkillPath(skill) {
+	if (skill.indexEntry.entry) return skill.indexEntry.entry;
+	if (skill.installTarget.type === "inline") return skill.installTarget.skillRoot ? posix.join(skill.installTarget.skillRoot, "SKILL.md") : "SKILL.md";
+	return skill.installTarget.subpath ? posix.join(skill.installTarget.subpath, "SKILL.md") : "SKILL.md";
+}
 function getWellKnownEmptyStateMessage(status, totalSkillCount, invalidSkillCount) {
 	switch (status) {
 		case "no-valid-entries": return totalSkillCount > 0 ? `Found a skills index, but all ${totalSkillCount} entr${totalSkillCount === 1 ? "y is" : "ies are"} invalid. Check that each entry has a top-level SKILL.md in files[].` : "Found a skills index, but it does not contain any valid skill entries.";
@@ -2446,7 +2598,8 @@ async function handleWellKnownSkills(source, url, options, spinner, allowFallbac
 					source: sourceIdentifier,
 					sourceType: "well-known",
 					sourceUrl: skill.sourceUrl,
-					skillFolderHash: ""
+					skillPath: getWellKnownSkillPath(skill),
+					skillFolderHash: getWellKnownSkillHash(skill)
 				});
 			} catch {}
 		}
@@ -2590,6 +2743,7 @@ async function runAdd(args, options = {}) {
 			fullDepth: options.fullDepth
 		});
 		if (skills.length === 0) {
+			debugLog(`[add] discoverSkills returned 0 skills for source=${parsed.type === "local" ? parsed.localPath : parsed.url} searchSubpath=${parsed.subpath ?? "(root)"} includeInternal=${includeInternal} fullDepth=${options.fullDepth === true}`);
 			spinner.stop(import_picocolors.default.red("No skills found"));
 			Se(import_picocolors.default.red("No valid skills found. Skills require a SKILL.md with name and description."));
 			await cleanup(tempDir);
@@ -3145,7 +3299,7 @@ async function searchSkillsAPI(query) {
 	try {
 		const url = `${SEARCH_API_BASE}/api/search?q=${encodeURIComponent(query)}&limit=10`;
 		debugLog(`[find] requesting search: ${url}`);
-		const res = await fetch(url);
+		const res = await fetchWithSelectiveTls(url);
 		debugLog(`[find] search response status: ${res.status} ${res.statusText}`);
 		const responseText = await res.text();
 		debugLog(`[find] search response body: ${responseText}`);
@@ -3961,6 +4115,146 @@ function parseRemoveOptions(args) {
 		options
 	};
 }
+function getUpdateCheckApiBase() {
+	return process.env.SKILLS_API_URL || DEFAULT_SEARCH_API_BASE;
+}
+function canCheckWithServer(skill) {
+	return skill.entry.sourceType !== "github";
+}
+function canCheckWithGitHub(skill) {
+	return skill.entry.sourceType === "github" && Boolean(skill.entry.skillFolderHash) && Boolean(skill.entry.skillPath);
+}
+function buildUpdateCheckRequest(skills) {
+	return {
+		forceRefresh: true,
+		skills: skills.map(({ name, entry }) => ({
+			name,
+			source: entry.source,
+			sourceType: entry.sourceType,
+			sourceUrl: entry.sourceUrl,
+			skillPath: entry.skillPath,
+			skillFolderHash: entry.skillFolderHash
+		}))
+	};
+}
+async function checkServerUpdates(skills, apiBaseUrl) {
+	if (skills.length === 0) return {
+		checkedCount: 0,
+		skippedCount: 0,
+		updates: [],
+		errors: []
+	};
+	const byName = new Map(skills.map((skill) => [skill.name, skill]));
+	const url = `${apiBaseUrl.replace(/\/$/, "")}/api/check-updates`;
+	const request = buildUpdateCheckRequest(skills);
+	debugLog(`[update] requesting update check: ${url}`);
+	debugLog(`[update] update check request: ${JSON.stringify(request)}`);
+	const response = await fetchWithSelectiveTls(url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Accept: "application/json"
+		},
+		body: JSON.stringify(request)
+	});
+	debugLog(`[update] update check response status: ${response.status} ${response.statusText}`);
+	if (!response.ok) throw new Error(`Update check failed with status ${response.status}`);
+	const responseText = await response.text();
+	debugLog(`[update] update check response body: ${responseText}`);
+	const data = JSON.parse(responseText);
+	return {
+		checkedCount: data.checked ?? skills.length,
+		skippedCount: data.skipped ?? 0,
+		updates: (data.updates || []).flatMap((update) => {
+			const skill = byName.get(update.name);
+			if (!skill) return [];
+			return [{
+				name: update.name,
+				source: update.source,
+				entry: skill.entry,
+				currentHash: update.currentHash,
+				latestHash: update.latestHash
+			}];
+		}),
+		errors: data.errors || []
+	};
+}
+async function checkGitHubUpdates(skills, token) {
+	const updates = [];
+	const errors = [];
+	for (const { name, entry } of skills) try {
+		const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token);
+		if (!latestHash) {
+			errors.push({
+				name,
+				source: entry.source,
+				error: "Could not fetch from GitHub"
+			});
+			continue;
+		}
+		if (latestHash !== entry.skillFolderHash) updates.push({
+			name,
+			source: entry.source,
+			entry,
+			currentHash: entry.skillFolderHash,
+			latestHash
+		});
+	} catch (err) {
+		errors.push({
+			name,
+			source: entry.source,
+			error: err instanceof Error ? err.message : "Unknown error"
+		});
+	}
+	return {
+		checkedCount: skills.length,
+		skippedCount: 0,
+		updates,
+		errors
+	};
+}
+async function checkSkillUpdates(skills, options = {}) {
+	const serverSkills = skills.filter(canCheckWithServer);
+	const githubSkills = skills.filter(canCheckWithGitHub);
+	let checkedCount = 0;
+	let skippedCount = skills.length - serverSkills.length - githubSkills.length;
+	const updates = [];
+	const errors = [];
+	debugLog(`[update] prepared ${serverSkills.length} server skill(s), ${githubSkills.length} github skill(s), ${skippedCount} skipped`);
+	for (const skill of skills) {
+		if (serverSkills.includes(skill)) {
+			debugLog(`[update] server check ${skill.name}: sourceType=${skill.entry.sourceType} hash=${skill.entry.skillFolderHash || "(empty)"}`);
+			continue;
+		}
+		if (githubSkills.includes(skill)) {
+			debugLog(`[update] github check ${skill.name}: path=${skill.entry.skillPath || "(missing)"} hash=${skill.entry.skillFolderHash || "(empty)"}`);
+			continue;
+		}
+		debugLog(`[update] skipped ${skill.name}: sourceType=${skill.entry.sourceType} path=${skill.entry.skillPath || "(missing)"} hash=${skill.entry.skillFolderHash || "(empty)"}`);
+	}
+	if (serverSkills.length > 0) try {
+		const serverResult = await checkServerUpdates(serverSkills, options.apiBaseUrl || getUpdateCheckApiBase());
+		checkedCount += serverResult.checkedCount;
+		skippedCount += serverResult.skippedCount;
+		updates.push(...serverResult.updates);
+		errors.push(...serverResult.errors);
+	} catch (err) {
+		debugLog(`[update] server update check failed: ${err instanceof Error ? err.message : "Unknown error"}`);
+	}
+	if (githubSkills.length > 0) {
+		const githubResult = await checkGitHubUpdates(githubSkills, options.githubToken);
+		checkedCount += githubResult.checkedCount;
+		skippedCount += githubResult.skippedCount;
+		updates.push(...githubResult.updates);
+		errors.push(...githubResult.errors);
+	}
+	return {
+		checkedCount,
+		skippedCount,
+		updates,
+		errors
+	};
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
 	try {
@@ -3977,12 +4271,12 @@ const BOLD = "\x1B[1m";
 const DIM = "\x1B[38;5;102m";
 const TEXT = "\x1B[38;5;145m";
 const LOGO_LINES = [
-	"███████╗██╗  ██╗██╗██╗     ██╗     ███████╗",
-	"██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝",
-	"███████╗█████╔╝ ██║██║     ██║     ███████╗",
-	"╚════██║██╔═██╗ ██║██║     ██║     ╚════██║",
-	"███████║██║  ██╗██║███████╗███████╗███████║",
-	"╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝"
+	"██████╗   ██╗   ██████╗       ███████╗██╗  ██╗██╗██╗     ██╗     ███████╗",
+	"██╔══██╗  ██║   ██╔══██╗      ██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝",
+	"██████╔╝  ██║   ██████╔╝█████╗███████╗█████╔╝ ██║██║     ██║     ███████╗",
+	"██╔══██╗  ██║   ██╔═══╝ ╚════╝╚════██║██╔═██╗ ██║██║     ██║     ╚════██║",
+	"██████╔╝  ██║   ██║           ███████║██║  ██╗██║███████╗███████╗███████║",
+	"╚═════╝   ╚═╝   ╚═╝           ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝"
 ];
 const GRAYS = [
 	"\x1B[38;5;250m",
@@ -4001,6 +4295,8 @@ function showLogo() {
 function showBanner() {
 	showLogo();
 	console.log();
+	console.log(`${BOLD}${TEXT}BIP-SKILLS${RESET}`);
+	console.log();
 	console.log(`${DIM}The open agent skills ecosystem${RESET}`);
 	console.log();
 	console.log(`  ${DIM}$${RESET} ${TEXT}${CLI_NPX_COMMAND} add ${DIM}<package>${RESET}    ${DIM}Add a new skill${RESET}`);
@@ -4198,82 +4494,69 @@ function readSkillLock() {
 		};
 	}
 }
+function getLockedSkillsForUpdate(lock) {
+	return Object.entries(lock.skills).map(([name, entry]) => ({
+		name,
+		entry
+	}));
+}
+function buildWellKnownUpdateUrl(name, entry) {
+	try {
+		if (entry.sourceUrl.startsWith("http://") || entry.sourceUrl.startsWith("https://")) {
+			const parsed = new URL(entry.sourceUrl);
+			const markerIndex = parsed.pathname.indexOf("/.well-known/skills");
+			const basePath = markerIndex >= 0 ? parsed.pathname.slice(0, markerIndex) : "";
+			return `${parsed.origin}${basePath}@${name}`;
+		}
+	} catch {}
+	if (entry.source.startsWith("http://") || entry.source.startsWith("https://")) return `${entry.source.replace(/\/$/, "")}@${name}`;
+	if (entry.source.includes(".")) return `https://${entry.source.replace(/\/$/, "")}@${name}`;
+	return entry.sourceUrl;
+}
+function buildUpdateInstallUrl(name, entry) {
+	if (entry.sourceType === "well-known") return buildWellKnownUpdateUrl(name, entry);
+	if (entry.sourceType !== "github" || !entry.skillPath) return entry.sourceUrl;
+	let skillFolder = entry.skillPath;
+	if (skillFolder.endsWith("/SKILL.md")) skillFolder = skillFolder.slice(0, -9);
+	else if (skillFolder.endsWith("SKILL.md")) skillFolder = skillFolder.slice(0, -8);
+	if (skillFolder.endsWith("/")) skillFolder = skillFolder.slice(0, -1);
+	return `${entry.sourceUrl.replace(/\.git$/, "").replace(/\/$/, "")}/tree/main/${skillFolder}`;
+}
 async function runCheck(args = []) {
 	console.log(`${TEXT}Checking for skill updates...${RESET}`);
 	console.log();
 	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	if (skillNames.length === 0) {
+	if (Object.keys(lock.skills).length === 0) {
 		console.log(`${DIM}No skills tracked in lock file.${RESET}`);
 		console.log(`${DIM}Install skills with${RESET} ${TEXT}${CLI_NPX_COMMAND} add <package>${RESET}`);
 		return;
 	}
-	const token = getGitHubToken();
-	const skillsBySource = /* @__PURE__ */ new Map();
-	let skippedCount = 0;
-	for (const skillName of skillNames) {
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (entry.sourceType !== "github" || !entry.skillFolderHash || !entry.skillPath) {
-			skippedCount++;
-			continue;
-		}
-		const existing = skillsBySource.get(entry.source) || [];
-		existing.push({
-			name: skillName,
-			entry
-		});
-		skillsBySource.set(entry.source, existing);
-	}
-	const totalSkills = skillNames.length - skippedCount;
-	if (totalSkills === 0) {
-		console.log(`${DIM}No GitHub skills to check.${RESET}`);
+	const result = await checkSkillUpdates(getLockedSkillsForUpdate(lock), { githubToken: getGitHubToken() });
+	if (result.checkedCount === 0) {
+		console.log(`${DIM}No skills to check.${RESET}`);
 		return;
 	}
-	console.log(`${DIM}Checking ${totalSkills} skill(s) for updates...${RESET}`);
-	const updates = [];
-	const errors = [];
-	for (const [source, skills] of skillsBySource) for (const { name, entry } of skills) try {
-		const latestHash = await fetchSkillFolderHash(source, entry.skillPath, token);
-		if (!latestHash) {
-			errors.push({
-				name,
-				source,
-				error: "Could not fetch from GitHub"
-			});
-			continue;
-		}
-		if (latestHash !== entry.skillFolderHash) updates.push({
-			name,
-			source
-		});
-	} catch (err) {
-		errors.push({
-			name,
-			source,
-			error: err instanceof Error ? err.message : "Unknown error"
-		});
-	}
+	console.log(`${DIM}Checking ${result.checkedCount} skill(s) for updates...${RESET}`);
 	console.log();
-	if (updates.length === 0) console.log(`${TEXT}✓ All skills are up to date${RESET}`);
+	if (result.updates.length === 0) console.log(`${TEXT}✓ All skills are up to date${RESET}`);
 	else {
-		console.log(`${TEXT}${updates.length} update(s) available:${RESET}`);
+		console.log(`${TEXT}${result.updates.length} update(s) available:${RESET}`);
 		console.log();
-		for (const update of updates) {
+		for (const update of result.updates) {
 			console.log(`  ${TEXT}↑${RESET} ${update.name}`);
 			console.log(`    ${DIM}source: ${update.source}${RESET}`);
 		}
 		console.log();
 		console.log(`${DIM}Run${RESET} ${TEXT}${CLI_NPX_COMMAND} update${RESET} ${DIM}to update all skills${RESET}`);
 	}
-	if (errors.length > 0) {
+	if (result.errors.length > 0) {
 		console.log();
-		console.log(`${DIM}Could not check ${errors.length} skill(s) (may need reinstall)${RESET}`);
+		console.log(`${DIM}Could not check ${result.errors.length} skill(s) (may need reinstall)${RESET}`);
 	}
 	track({
 		event: "check",
-		skillCount: String(totalSkills),
-		updatesAvailable: String(updates.length)
+		skillCount: String(result.checkedCount),
+		updatesAvailable: String(result.updates.length)
 	});
 	console.log();
 }
@@ -4281,58 +4564,32 @@ async function runUpdate() {
 	console.log(`${TEXT}Checking for skill updates...${RESET}`);
 	console.log();
 	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	if (skillNames.length === 0) {
+	if (Object.keys(lock.skills).length === 0) {
 		console.log(`${DIM}No skills tracked in lock file.${RESET}`);
 		console.log(`${DIM}Install skills with${RESET} ${TEXT}${CLI_NPX_COMMAND} add <package>${RESET}`);
 		return;
 	}
-	const token = getGitHubToken();
-	const updates = [];
-	let checkedCount = 0;
-	for (const skillName of skillNames) {
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (entry.sourceType !== "github" || !entry.skillFolderHash || !entry.skillPath) continue;
-		checkedCount++;
-		try {
-			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token);
-			if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-				name: skillName,
-				source: entry.source,
-				entry
-			});
-		} catch {}
-	}
-	if (checkedCount === 0) {
+	const result = await checkSkillUpdates(getLockedSkillsForUpdate(lock), { githubToken: getGitHubToken() });
+	if (result.checkedCount === 0) {
 		console.log(`${DIM}No skills to check.${RESET}`);
 		return;
 	}
-	if (updates.length === 0) {
+	if (result.updates.length === 0) {
 		console.log(`${TEXT}✓ All skills are up to date${RESET}`);
 		console.log();
 		return;
 	}
-	console.log(`${TEXT}Found ${updates.length} update(s)${RESET}`);
+	console.log(`${TEXT}Found ${result.updates.length} update(s)${RESET}`);
 	console.log();
 	let successCount = 0;
 	let failCount = 0;
-	for (const update of updates) {
+	for (const update of result.updates) {
 		console.log(`${TEXT}Updating ${update.name}...${RESET}`);
-		let installUrl = update.entry.sourceUrl;
-		if (update.entry.skillPath) {
-			let skillFolder = update.entry.skillPath;
-			if (skillFolder.endsWith("/SKILL.md")) skillFolder = skillFolder.slice(0, -9);
-			else if (skillFolder.endsWith("SKILL.md")) skillFolder = skillFolder.slice(0, -8);
-			if (skillFolder.endsWith("/")) skillFolder = skillFolder.slice(0, -1);
-			installUrl = update.entry.sourceUrl.replace(/\.git$/, "").replace(/\/$/, "");
-			installUrl = `${installUrl}/tree/main/${skillFolder}`;
-		}
 		if (spawnSync("npx", [
 			"-y",
 			CLI_PACKAGE_NAME,
 			"add",
-			installUrl,
+			buildUpdateInstallUrl(update.name, update.entry),
 			"-g",
 			"-y"
 		], { stdio: [
@@ -4352,7 +4609,7 @@ async function runUpdate() {
 	if (failCount > 0) console.log(`${DIM}Failed to update ${failCount} skill(s)${RESET}`);
 	track({
 		event: "update",
-		skillCount: String(updates.length),
+		skillCount: String(result.updates.length),
 		successCount: String(successCount),
 		failCount: String(failCount)
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bip-skills",
-  "version": "1.4.8",
+  "version": "1.4.10",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -14,20 +14,6 @@
     "README.md",
     "ThirdPartyNoticeText.txt"
   ],
-  "scripts": {
-    "build": "obuild && node scripts/generate-licenses.ts",
-    "generate-licenses": "node scripts/generate-licenses.ts",
-    "dev": "node src/cli.ts",
-    "exec:test": "node scripts/execute-tests.ts",
-    "pack:check": "npm pack --dry-run --ignore-scripts --cache .npm-cache",
-    "prepublishOnly": "npm run build",
-    "format": "prettier --write 'src/**/*.ts' 'scripts/**/*.ts'",
-    "format:check": "prettier --check 'src/**/*.ts' 'scripts/**/*.ts'",
-    "prepare": "husky",
-    "test": "vitest",
-    "type-check": "tsc --noEmit",
-    "publish:snapshot": "npm version prerelease --preid=snapshot --no-git-tag-version && npm publish --tag snapshot"
-  },
   "lint-staged": {
     "src/**/*.ts": "prettier --write",
     "scripts/**/*.ts": "prettier --write",
@@ -88,7 +74,8 @@
   "author": "",
   "license": "MIT",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
   },
   "devDependencies": {
     "@clack/prompts": "^0.11.0",
@@ -108,5 +95,16 @@
   "engines": {
     "node": ">=18"
   },
-  "packageManager": "pnpm@10.17.1"
-}
+  "scripts": {
+    "build": "obuild && node scripts/generate-licenses.ts",
+    "generate-licenses": "node scripts/generate-licenses.ts",
+    "dev": "node src/cli.ts",
+    "exec:test": "node scripts/execute-tests.ts",
+    "pack:check": "npm pack --dry-run --ignore-scripts --cache .npm-cache",
+    "format": "prettier --write 'src/**/*.ts' 'scripts/**/*.ts'",
+    "format:check": "prettier --check 'src/**/*.ts' 'scripts/**/*.ts'",
+    "test": "vitest",
+    "type-check": "tsc --noEmit",
+    "publish:snapshot": "npm version prerelease --preid=snapshot --no-git-tag-version && npm publish --tag snapshot"
+  }
+}