reskill 1.7.0 → 1.8.0-beta.0

package/dist/index.js

@@ -818,6 +818,384 @@ const git_execAsync = (0, __WEBPACK_EXTERNAL_MODULE_node_util__.promisify)(__WEB
         if (external_node_fs_.existsSync(tempArchive)) external_node_fs_.unlinkSync(tempArchive);
     }
 }
+/**
+ * Skill Parser - SKILL.md parser
+ *
+ * Following agentskills.io specification: https://agentskills.io/specification
+ *
+ * SKILL.md format requirements:
+ * - YAML frontmatter containing name and description (required)
+ * - name: max 64 characters, lowercase letters, numbers, hyphens
+ * - description: max 1024 characters
+ * - Optional fields: license, compatibility, metadata, allowed-tools
+ */ /**
+ * Skill validation error
+ */ class SkillValidationError extends Error {
+    field;
+    constructor(message, field){
+        super(message), this.field = field;
+        this.name = 'SkillValidationError';
+    }
+}
+/**
+ * Simple YAML frontmatter parser
+ * Parses --- delimited YAML header
+ *
+ * Supports:
+ * - Basic key: value pairs
+ * - Multiline strings (| and >)
+ * - Nested objects (one level deep, for metadata field)
+ */ function parseFrontmatter(content) {
+    const frontmatterRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/;
+    const match = content.match(frontmatterRegex);
+    if (!match) return {
+        data: {},
+        content
+    };
+    const yamlContent = match[1];
+    const markdownContent = match[2];
+    // Simple YAML parsing (supports basic key: value, one level of nesting,
+    // block scalars (| and >), and plain scalars spanning multiple indented lines)
+    const data = {};
+    const lines = yamlContent.split('\n');
+    let currentKey = '';
+    let currentValue = '';
+    let inMultiline = false;
+    let inNestedObject = false;
+    let inPlainScalar = false;
+    let nestedObject = {};
+    /**
+   * Save the current key/value accumulated so far, then reset state.
+   */ function flushCurrent() {
+        if (!currentKey) return;
+        if (inNestedObject) {
+            data[currentKey] = nestedObject;
+            nestedObject = {};
+            inNestedObject = false;
+        } else if (inPlainScalar || inMultiline) {
+            data[currentKey] = currentValue.trim();
+            inPlainScalar = false;
+            inMultiline = false;
+        } else data[currentKey] = parseYamlValue(currentValue.trim());
+        currentKey = '';
+        currentValue = '';
+    }
+    for (const line of lines){
+        const trimmedLine = line.trim();
+        if (!trimmedLine || trimmedLine.startsWith('#')) continue;
+        const isIndented = line.startsWith('  ');
+        // ---- Inside a block scalar (| or >) ----
+        if (inMultiline) {
+            if (isIndented) {
+                currentValue += (currentValue ? '\n' : '') + line.slice(2);
+                continue;
+            }
+            // Unindented line ends the block scalar — fall through to top-level parsing
+            flushCurrent();
+        }
+        // ---- Inside a plain scalar (multiline value without | or >) ----
+        if (inPlainScalar) {
+            if (isIndented) {
+                // Continuation line: join with a space (YAML plain scalar folding)
+                currentValue += ` ${trimmedLine}`;
+                continue;
+            }
+            // Unindented line ends the plain scalar — fall through to top-level parsing
+            flushCurrent();
+        }
+        // ---- Inside a nested object ----
+        if (inNestedObject && isIndented) {
+            const nestedMatch = line.match(/^ {2}([a-zA-Z_-]+):\s*(.*)$/);
+            if (nestedMatch) {
+                const [, nestedKey, nestedValue] = nestedMatch;
+                nestedObject[nestedKey] = parseYamlValue(nestedValue.trim());
+                continue;
+            }
+            // Indented line that isn't a nested key:value — this key was actually
+            // a plain scalar, not a nested object. Switch modes.
+            inNestedObject = false;
+            inPlainScalar = true;
+            currentValue = trimmedLine;
+            continue;
+        }
+        // ---- Top-level key: value ----
+        const keyValueMatch = line.match(/^([a-zA-Z_-]+):\s*(.*)$/);
+        if (keyValueMatch) {
+            flushCurrent();
+            currentKey = keyValueMatch[1];
+            currentValue = keyValueMatch[2];
+            if ('|' === currentValue || '>' === currentValue) {
+                inMultiline = true;
+                currentValue = '';
+            } else if ('' === currentValue) {
+                // Empty value — could be nested object or plain scalar; peek at next lines
+                inNestedObject = true;
+                nestedObject = {};
+            }
+            continue;
+        }
+        // ---- Unindented line that isn't key:value while in nested object ----
+        if (inNestedObject) flushCurrent();
+    }
+    // Save last accumulated value
+    flushCurrent();
+    return {
+        data,
+        content: markdownContent
+    };
+}
+/**
+ * Parse YAML value
+ */ function parseYamlValue(value) {
+    if (!value) return '';
+    // Boolean value
+    if ('true' === value) return true;
+    if ('false' === value) return false;
+    // Number
+    if (/^-?\d+$/.test(value)) return parseInt(value, 10);
+    if (/^-?\d+\.\d+$/.test(value)) return parseFloat(value);
+    // Remove quotes
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+    return value;
+}
+/**
+ * Validate skill name format
+ *
+ * Specification requirements:
+ * - Max 64 characters
+ * - Only lowercase letters, numbers, hyphens allowed
+ * - Cannot start or end with hyphen
+ * - Cannot contain consecutive hyphens
+ */ function validateSkillName(name) {
+    if (!name) throw new SkillValidationError('Skill name is required', 'name');
+    if (name.length > 64) throw new SkillValidationError('Skill name must be at most 64 characters', 'name');
+    if (!/^[a-z0-9]/.test(name)) throw new SkillValidationError('Skill name must start with a lowercase letter or number', 'name');
+    if (!/[a-z0-9]$/.test(name)) throw new SkillValidationError('Skill name must end with a lowercase letter or number', 'name');
+    if (/--/.test(name)) throw new SkillValidationError('Skill name cannot contain consecutive hyphens', 'name');
+    if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(name) && name.length > 1) throw new SkillValidationError('Skill name can only contain lowercase letters, numbers, and hyphens', 'name');
+    // Single character name
+    if (1 === name.length && !/^[a-z0-9]$/.test(name)) throw new SkillValidationError('Single character skill name must be a lowercase letter or number', 'name');
+}
+/**
+ * Validate skill description
+ *
+ * Specification requirements:
+ * - Max 1024 characters
+ * - Angle brackets are allowed per agentskills.io spec
+ */ function validateSkillDescription(description) {
+    if (!description) throw new SkillValidationError('Skill description is required', 'description');
+    if (description.length > 1024) throw new SkillValidationError('Skill description must be at most 1024 characters', 'description');
+// Note: angle brackets are allowed per agentskills.io spec
+}
+/**
+ * Parse SKILL.md content
+ *
+ * @param content - SKILL.md file content
+ * @param options - Parse options
+ * @returns Parsed skill info, or null if format is invalid
+ * @throws SkillValidationError if validation fails in strict mode
+ */ function parseSkillMd(content, options = {}) {
+    const { strict = false } = options;
+    try {
+        const { data, content: body } = parseFrontmatter(content);
+        // Check required fields
+        if (!data.name || !data.description) {
+            if (strict) throw new SkillValidationError('SKILL.md must have name and description in frontmatter');
+            return null;
+        }
+        const name = String(data.name);
+        const description = String(data.description);
+        // Validate field format
+        if (strict) {
+            validateSkillName(name);
+            validateSkillDescription(description);
+        }
+        // Parse allowed-tools
+        let allowedTools;
+        if (data['allowed-tools']) {
+            const toolsStr = String(data['allowed-tools']);
+            allowedTools = toolsStr.split(/\s+/).filter(Boolean);
+        }
+        return {
+            name,
+            description,
+            version: data.version ? String(data.version) : void 0,
+            license: data.license ? String(data.license) : void 0,
+            compatibility: data.compatibility ? String(data.compatibility) : void 0,
+            metadata: data.metadata,
+            allowedTools,
+            content: body,
+            rawContent: content
+        };
+    } catch (error) {
+        if (error instanceof SkillValidationError) throw error;
+        if (strict) throw new SkillValidationError(`Failed to parse SKILL.md: ${error}`);
+        return null;
+    }
+}
+/**
+ * Parse SKILL.md from file path
+ */ function skill_parser_parseSkillMdFile(filePath, options = {}) {
+    if (!external_node_fs_.existsSync(filePath)) {
+        if (options.strict) throw new SkillValidationError(`SKILL.md not found: ${filePath}`);
+        return null;
+    }
+    const content = external_node_fs_.readFileSync(filePath, 'utf-8');
+    return parseSkillMd(content, options);
+}
+/**
+ * Parse SKILL.md from skill directory
+ */ function parseSkillFromDir(dirPath, options = {}) {
+    const skillMdPath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(dirPath, 'SKILL.md');
+    return skill_parser_parseSkillMdFile(skillMdPath, options);
+}
+/**
+ * Check if directory contains valid SKILL.md
+ */ function hasValidSkillMd(dirPath) {
+    const skillMdPath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(dirPath, 'SKILL.md');
+    if (!external_node_fs_.existsSync(skillMdPath)) return false;
+    try {
+        const skill = skill_parser_parseSkillMdFile(skillMdPath);
+        return null !== skill;
+    } catch  {
+        return false;
+    }
+}
+const SKIP_DIRS = [
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '__pycache__'
+];
+const MAX_DISCOVER_DEPTH = 5;
+const PRIORITY_SKILL_DIRS = [
+    'skills',
+    '.agents/skills',
+    '.cursor/skills',
+    '.claude/skills',
+    '.windsurf/skills',
+    '.github/skills'
+];
+function findSkillDirsRecursive(dir, depth, maxDepth, visitedDirs) {
+    if (depth > maxDepth) return [];
+    const resolvedDir = __WEBPACK_EXTERNAL_MODULE_node_path__.resolve(dir);
+    if (visitedDirs.has(resolvedDir)) return [];
+    if (!external_node_fs_.existsSync(dir) || !external_node_fs_.statSync(dir).isDirectory()) return [];
+    visitedDirs.add(resolvedDir);
+    const results = [];
+    let entries;
+    try {
+        entries = external_node_fs_.readdirSync(dir);
+    } catch  {
+        return [];
+    }
+    for (const entry of entries){
+        if (SKIP_DIRS.includes(entry)) continue;
+        const fullPath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(dir, entry);
+        const resolvedFull = __WEBPACK_EXTERNAL_MODULE_node_path__.resolve(fullPath);
+        if (visitedDirs.has(resolvedFull)) continue;
+        let stat;
+        try {
+            stat = external_node_fs_.statSync(fullPath);
+        } catch  {
+            continue;
+        }
+        if (!!stat.isDirectory()) {
+            if (hasValidSkillMd(fullPath)) results.push(fullPath);
+            results.push(...findSkillDirsRecursive(fullPath, depth + 1, maxDepth, visitedDirs));
+        }
+    }
+    return results;
+}
+/**
+ * Discover all skills in a directory by scanning for SKILL.md files.
+ *
+ * Strategy:
+ * 1. Check root for SKILL.md
+ * 2. Search priority directories (skills/, .agents/skills/, .cursor/skills/, etc.)
+ * 3. Fall back to recursive search (max depth 5, skip node_modules, .git, dist, etc.)
+ *
+ * @param basePath - Root directory to search
+ * @returns List of parsed skills with their directory paths (absolute)
+ */ function discoverSkillsInDir(basePath) {
+    const resolvedBase = __WEBPACK_EXTERNAL_MODULE_node_path__.resolve(basePath);
+    const results = [];
+    const seenNames = new Set();
+    function addSkill(dirPath) {
+        const skill = parseSkillFromDir(dirPath);
+        if (skill && !seenNames.has(skill.name)) {
+            seenNames.add(skill.name);
+            results.push({
+                ...skill,
+                dirPath: __WEBPACK_EXTERNAL_MODULE_node_path__.resolve(dirPath)
+            });
+        }
+    }
+    if (hasValidSkillMd(resolvedBase)) addSkill(resolvedBase);
+    // Track visited directories to avoid redundant I/O during recursive scan
+    const visitedDirs = new Set();
+    for (const sub of PRIORITY_SKILL_DIRS){
+        const dir = __WEBPACK_EXTERNAL_MODULE_node_path__.join(resolvedBase, sub);
+        if (!!external_node_fs_.existsSync(dir) && !!external_node_fs_.statSync(dir).isDirectory()) {
+            visitedDirs.add(__WEBPACK_EXTERNAL_MODULE_node_path__.resolve(dir));
+            try {
+                const entries = external_node_fs_.readdirSync(dir);
+                for (const entry of entries){
+                    const skillDir = __WEBPACK_EXTERNAL_MODULE_node_path__.join(dir, entry);
+                    try {
+                        if (external_node_fs_.statSync(skillDir).isDirectory() && hasValidSkillMd(skillDir)) {
+                            addSkill(skillDir);
+                            visitedDirs.add(__WEBPACK_EXTERNAL_MODULE_node_path__.resolve(skillDir));
+                        }
+                    } catch  {
+                    // Skip entries that can't be stat'd (race condition, permission, etc.)
+                    }
+                }
+            } catch  {
+            // Skip if unreadable
+            }
+        }
+    }
+    const recursiveDirs = findSkillDirsRecursive(resolvedBase, 0, MAX_DISCOVER_DEPTH, visitedDirs);
+    for (const skillDir of recursiveDirs)addSkill(skillDir);
+    return results;
+}
+/**
+ * Filter skills by name (case-insensitive exact match).
+ *
+ * Note: an empty `names` array returns an empty result (not all skills).
+ * Callers should check `names.length` before calling if "no filter = all" is desired.
+ *
+ * @param skills - List of discovered skills
+ * @param names - Skill names to match (e.g. from --skill pdf commit)
+ * @returns Skills whose name matches any of the given names
+ */ function filterSkillsByName(skills, names) {
+    const normalized = names.map((n)=>n.toLowerCase());
+    return skills.filter((skill)=>{
+        // Match against SKILL.md name field
+        if (normalized.includes(skill.name.toLowerCase())) return true;
+        // Also match against the directory name (basename of dirPath)
+        // Users naturally refer to skills by their directory name
+        const dirName = __WEBPACK_EXTERNAL_MODULE_node_path__.basename(skill.dirPath).toLowerCase();
+        return normalized.includes(dirName);
+    });
+}
+/**
+ * Generate SKILL.md content
+ */ function generateSkillMd(skill) {
+    const frontmatter = [
+        '---'
+    ];
+    frontmatter.push(`name: ${skill.name}`);
+    frontmatter.push(`description: ${skill.description}`);
+    if (skill.license) frontmatter.push(`license: ${skill.license}`);
+    if (skill.compatibility) frontmatter.push(`compatibility: ${skill.compatibility}`);
+    if (skill.allowedTools && skill.allowedTools.length > 0) frontmatter.push(`allowed-tools: ${skill.allowedTools.join(' ')}`);
+    frontmatter.push('---');
+    frontmatter.push('');
+    return frontmatter.join('\n') + skill.content;
+}
 /**
  * Installer - Multi-Agent installer
  *
@@ -828,6 +1206,10 @@ const git_execAsync = (0, __WEBPACK_EXTERNAL_MODULE_node_util__.promisify)(__WEB
  * Reference: https://github.com/vercel-labs/add-skill/blob/main/src/installer.ts
  */ const installer_AGENTS_DIR = '.agents';
 const installer_SKILLS_SUBDIR = 'skills';
+/**
+ * Marker comment in auto-generated Cursor bridge rule files.
+ * Used to distinguish auto-generated files from manually created ones.
+ */ const CURSOR_BRIDGE_MARKER = '<!-- reskill:auto-generated -->';
 /**
  * Default files to exclude when copying skills
  * These files are typically used for repository metadata and should not be copied to agent directories
@@ -1006,45 +1388,50 @@ const installer_SKILLS_SUBDIR = 'skills';
             error: 'Invalid skill name: potential path traversal detected'
         };
         try {
+            let result;
             // Copy mode: directly copy to agent location
             if ('copy' === installMode) {
                 installer_ensureDir(agentDir);
                 installer_remove(agentDir);
                 copyDirectory(sourcePath, agentDir);
-                return {
+                result = {
                     success: true,
                     path: agentDir,
                     mode: 'copy'
                 };
-            }
-            // Symlink mode: copy to canonical location, then create symlink
-            installer_ensureDir(canonicalDir);
-            installer_remove(canonicalDir);
-            copyDirectory(sourcePath, canonicalDir);
-            const symlinkCreated = await installer_createSymlink(canonicalDir, agentDir);
-            if (!symlinkCreated) {
-                // Symlink failed, fallback to copy
-                try {
-                    installer_remove(agentDir);
-                } catch  {
-                // Ignore cleanup errors
-                }
-                installer_ensureDir(agentDir);
-                copyDirectory(sourcePath, agentDir);
-                return {
+            } else {
+                // Symlink mode: copy to canonical location, then create symlink
+                installer_ensureDir(canonicalDir);
+                installer_remove(canonicalDir);
+                copyDirectory(sourcePath, canonicalDir);
+                const symlinkCreated = await installer_createSymlink(canonicalDir, agentDir);
+                if (symlinkCreated) result = {
                     success: true,
                     path: agentDir,
                     canonicalPath: canonicalDir,
-                    mode: 'symlink',
-                    symlinkFailed: true
+                    mode: 'symlink'
                 };
+                else {
+                    // Symlink failed, fallback to copy
+                    try {
+                        installer_remove(agentDir);
+                    } catch  {
+                    // Ignore cleanup errors
+                    }
+                    installer_ensureDir(agentDir);
+                    copyDirectory(sourcePath, agentDir);
+                    result = {
+                        success: true,
+                        path: agentDir,
+                        canonicalPath: canonicalDir,
+                        mode: 'symlink',
+                        symlinkFailed: true
+                    };
+                }
             }
-            return {
-                success: true,
-                path: agentDir,
-                canonicalPath: canonicalDir,
-                mode: 'symlink'
-            };
+            // Create Cursor bridge rule file (project-level only)
+            if ('cursor' === agentType && !this.isGlobal) this.createCursorBridgeRule(sanitized, sourcePath);
+            return result;
         } catch (error) {
             return {
                 success: false,
@@ -1082,6 +1469,8 @@ const installer_SKILLS_SUBDIR = 'skills';
         const skillPath = this.getAgentSkillPath(skillName, agentType);
         if (!external_node_fs_.existsSync(skillPath)) return false;
         installer_remove(skillPath);
+        // Remove Cursor bridge rule file (project-level only)
+        if ('cursor' === agentType && !this.isGlobal) this.removeCursorBridgeRule(installer_sanitizeName(skillName));
         return true;
     }
     /**
@@ -1104,6 +1493,65 @@ const installer_SKILLS_SUBDIR = 'skills';
             withFileTypes: true
         }).filter((entry)=>entry.isDirectory() || entry.isSymbolicLink()).map((entry)=>entry.name);
     }
+    /**
+   * Create a Cursor bridge rule file (.mdc) for the installed skill.
+   *
+   * Cursor does not natively read SKILL.md from .cursor/skills/.
+   * This bridge file in .cursor/rules/ references the SKILL.md via @file directive,
+   * allowing Cursor to discover and activate the skill based on the description.
+   *
+   * @param skillName - Sanitized skill name
+   * @param sourcePath - Source directory containing SKILL.md
+   */ createCursorBridgeRule(skillName, sourcePath) {
+        try {
+            const skillMdPath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(sourcePath, 'SKILL.md');
+            if (!external_node_fs_.existsSync(skillMdPath)) return;
+            const content = external_node_fs_.readFileSync(skillMdPath, 'utf-8');
+            const parsed = parseSkillMd(content);
+            if (!parsed || !parsed.description) return;
+            const rulesDir = __WEBPACK_EXTERNAL_MODULE_node_path__.join(this.cwd, '.cursor', 'rules');
+            installer_ensureDir(rulesDir);
+            // Do not overwrite manually created rule files (without auto-generated marker)
+            const bridgePath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(rulesDir, `${skillName}.mdc`);
+            if (external_node_fs_.existsSync(bridgePath)) {
+                const existingContent = external_node_fs_.readFileSync(bridgePath, 'utf-8');
+                if (!existingContent.includes(CURSOR_BRIDGE_MARKER)) return;
+            }
+            // Quote description to prevent YAML injection from special characters
+            const safeDescription = parsed.description.replace(/"/g, '\\"');
+            const agent = getAgentConfig('cursor');
+            const bridgeContent = `---
+description: "${safeDescription}"
+globs: 
+alwaysApply: false
+---
+
+${CURSOR_BRIDGE_MARKER}
+@file ${agent.skillsDir}/${skillName}/SKILL.md
+`;
+            external_node_fs_.writeFileSync(bridgePath, bridgeContent, 'utf-8');
+        } catch  {
+        // Silently skip bridge file creation on errors
+        }
+    }
+    /**
+   * Remove a Cursor bridge rule file (.mdc) for the uninstalled skill.
+   *
+   * Only removes files that contain the auto-generated marker to avoid
+   * deleting manually created rule files.
+   *
+   * @param skillName - Sanitized skill name
+   */ removeCursorBridgeRule(skillName) {
+        try {
+            const bridgePath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(this.cwd, '.cursor', 'rules', `${skillName}.mdc`);
+            if (!external_node_fs_.existsSync(bridgePath)) return;
+            const content = external_node_fs_.readFileSync(bridgePath, 'utf-8');
+            if (!content.includes(CURSOR_BRIDGE_MARKER)) return;
+            external_node_fs_.rmSync(bridgePath);
+        } catch  {
+        // Silently skip bridge file removal on errors
+        }
+    }
 }
 /**
  * CacheManager - Manage global skill cache
@@ -1836,11 +2284,25 @@ const installer_SKILLS_SUBDIR = 'skills';
         }
         // Parse owner/repo and possible subPath
         // E.g.: user/repo or org/monorepo/skills/pdf
+        // Also handle GitHub web URL style: owner/repo/tree/branch/path
         const parts = remaining.split('/');
         if (parts.length < 2) throw new Error(`Invalid skill reference: ${ref}. Expected format: owner/repo[@version]`);
         const owner = parts[0];
         const repo = parts[1];
-        const subPath = parts.length > 2 ? parts.slice(2).join('/') : void 0;
+        let subPath;
+        // Check for GitHub/GitLab web URL pattern: owner/repo/(tree|blob|raw)/branch/path
+        // e.g. vercel-labs/skills/tree/main/skills/find-skills
+        // Only apply this heuristic when no explicit @version is provided.
+        // With @version, treat tree/blob/raw as literal directory names (standard monorepo subPath).
+        if (parts.length >= 4 && [
+            'tree',
+            'blob',
+            'raw'
+        ].includes(parts[2]) && !version) {
+            const branch = parts[3];
+            version = `branch:${branch}`;
+            subPath = parts.length > 4 ? parts.slice(4).join('/') : void 0;
+        } else subPath = parts.length > 2 ? parts.slice(2).join('/') : void 0;
         return {
             registry,
             owner,
@@ -2069,20 +2531,31 @@ const installer_SKILLS_SUBDIR = 'skills';
    * Check if a reference is an HTTP/OSS URL (for archive downloads)
    *
    * Returns true for:
-   * - http:// or https:// URLs pointing to archive files (.tar.gz, .tgz, .zip, .tar)
-   * - Explicit oss:// or s3:// protocol URLs
+   * - http:// or https:// URLs with archive file extensions (.tar.gz, .tgz, .zip, .tar)
+   * - Explicit oss:// or s3:// protocol URLs (always treated as archive sources)
    *
    * Returns false for:
    * - Git repository URLs (*.git)
    * - GitHub/GitLab web URLs (/tree/, /blob/, /raw/)
+   * - Bare HTTPS repo URLs without archive extensions (e.g., https://github.com/user/repo)
+   *   These are treated as Git references and handled by GitResolver.
    */ static isHttpUrl(ref) {
         // Remove version suffix for checking (e.g., url@v1.0.0)
         const urlPart = ref.split('@')[0];
-        // 排除 Git 仓库 URL（以 .git 结尾）
-        if (urlPart.endsWith('.git')) return false;
-        // 排除 GitHub/GitLab web URL（包含 /tree/, /blob/, /raw/）
-        if (/\/(tree|blob|raw)\//.test(urlPart)) return false;
-        return urlPart.startsWith('http://') || urlPart.startsWith('https://') || urlPart.startsWith('oss://') || urlPart.startsWith('s3://');
+        // oss:// and s3:// are always archive download sources
+        if (urlPart.startsWith('oss://') || urlPart.startsWith('s3://')) return true;
+        // For http:// and https:// URLs, distinguish between Git repos and archive downloads
+        if (urlPart.startsWith('http://') || urlPart.startsWith('https://')) {
+            // Exclude Git repository URLs (ending with .git)
+            if (urlPart.endsWith('.git')) return false;
+            // Exclude GitHub/GitLab web URLs (containing /tree/, /blob/, /raw/)
+            if (/\/(tree|blob|raw)\//.test(urlPart)) return false;
+            // Only classify as HTTP archive if URL has a recognized archive extension.
+            // Bare HTTPS URLs like https://github.com/user/repo are Git references,
+            // not archive downloads, and should fall through to GitResolver.
+            return /\.(tar\.gz|tgz|zip|tar)$/i.test(urlPart);
+        }
+        return false;
     }
     /**
    * Parse an HTTP/OSS URL reference
@@ -2391,46 +2864,21 @@ const installer_SKILLS_SUBDIR = 'skills';
  * Maps registry URLs to their corresponding scopes.
  * Currently hardcoded; TODO: fetch from /api/registry/info in the future.
  */ /**
- * 公共 Registry URL
- * 用于无 scope 的 skill 安装
- */ const PUBLIC_REGISTRY = 'https://reskill.info/';
+ * Public Registry URL
+ * Used for installing skills without a scope
+ */ const registry_scope_PUBLIC_REGISTRY = 'https://reskill.info/';
 /**
  * Hardcoded registry to scope mapping
  * TODO: Replace with dynamic fetching from /api/registry/info
  */ const REGISTRY_SCOPE_MAP = {
     // rush-app (private registry, new)
-    'https://rush-test.zhenguanyu.com': '@kanyun',
+    'https://rush-test.zhenguanyu.com': '@kanyun-test',
     'https://rush.zhenguanyu.com': '@kanyun',
     // reskill-app (private registry, legacy)
-    'https://reskill-test.zhenguanyu.com': '@kanyun',
+    'https://reskill-test.zhenguanyu.com': '@kanyun-test',
     // Local development
-    'http://localhost:3000': '@kanyun'
-};
-/**
- * Registry API prefix mapping
- *
- * rush-app hosts reskill APIs under /api/reskill/ prefix.
- * Default for unlisted registries: '/api'
- */ const REGISTRY_API_PREFIX = {
-    'https://rush-test.zhenguanyu.com': '/api/reskill',
-    'https://rush.zhenguanyu.com': '/api/reskill',
-    'http://localhost:3000': '/api/reskill'
+    'http://localhost:3000': '@kanyun-test'
 };
-/**
- * Get the API path prefix for a given registry URL
- *
- * @param registryUrl - Registry URL
- * @returns API prefix string (e.g., '/api' or '/api/reskill')
- *
- * @example
- * getApiPrefix('https://rush-test.zhenguanyu.com') // '/api/reskill'
- * getApiPrefix('https://reskill.info') // '/api'
- * getApiPrefix('https://unknown.com') // '/api'
- */ function getApiPrefix(registryUrl) {
-    if (!registryUrl) return '/api';
-    const normalized = registryUrl.endsWith('/') ? registryUrl.slice(0, -1) : registryUrl;
-    return REGISTRY_API_PREFIX[normalized] || '/api';
-}
 /**
  * Get the registry URL for a given scope (reverse lookup)
  *
@@ -2478,7 +2926,7 @@ const installer_SKILLS_SUBDIR = 'skills';
  * getRegistryUrl('@mycompany', { '@mycompany': 'https://my.registry.com/' }) // 'https://my.registry.com/'
  */ function getRegistryUrl(scope, customRegistries) {
     // No scope → return public Registry
-    if (!scope) return PUBLIC_REGISTRY;
+    if (!scope) return registry_scope_PUBLIC_REGISTRY;
     // With scope → lookup private Registry
     const registry = getRegistryForScope(scope, customRegistries);
     if (!registry) {
@@ -2529,21 +2977,21 @@ const installer_SKILLS_SUBDIR = 'skills';
 /**
  * Parse a skill identifier into its components (with version support)
  *
- * 支持私有 Registry（带 @scope）和公共 Registry（无 scope）两种格式。
+ * Supports both private registry (with @scope) and public registry (without scope) formats.
  *
  * @param identifier - Skill identifier string
  * @returns Parsed skill identifier with scope, name, version, and fullName
  * @throws Error if identifier is invalid
  *
  * @example
- * // 私有 Registry
+ * // Private registry
  * parseSkillIdentifier('@kanyun/planning-with-files')
  * // { scope: '@kanyun', name: 'planning-with-files', version: undefined, fullName: '@kanyun/planning-with-files' }
  *
  * parseSkillIdentifier('@kanyun/skill@2.4.5')
  * // { scope: '@kanyun', name: 'skill', version: '2.4.5', fullName: '@kanyun/skill' }
  *
- * // 公共 Registry
+ * // Public registry
  * parseSkillIdentifier('planning-with-files')
  * // { scope: null, name: 'planning-with-files', version: undefined, fullName: 'planning-with-files' }
  *
@@ -2551,18 +2999,18 @@ const installer_SKILLS_SUBDIR = 'skills';
  * // { scope: null, name: 'skill', version: 'latest', fullName: 'skill' }
  */ function parseSkillIdentifier(identifier) {
     const trimmed = identifier.trim();
-    // 空字符串或仅空白
+    // Empty string or whitespace only
     if (!trimmed) throw new Error('Invalid skill identifier: empty string');
-    // 以 @@ 开头无效
+    // Starting with @@ is invalid
     if (trimmed.startsWith('@@')) throw new Error('Invalid skill identifier: invalid scope format');
-    // 只有 @ 无效
+    // Bare @ is invalid
     if ('@' === trimmed) throw new Error('Invalid skill identifier: missing scope and name');
-    // 带 scope 的格式: @scope/name[@version]
+    // Scoped format: @scope/name[@version]
     if (trimmed.startsWith('@')) {
-        // 正则匹配: @scope/name[@version]
-        // scope: 以 @ 开头，后面跟字母数字、连字符、下划线
-        // name: 字母数字、连字符、下划线
-        // version: 可选，@ 后跟任意非空字符
+        // Regex: @scope/name[@version]
+        // scope: starts with @, followed by alphanumeric, hyphens, underscores
+        // name: alphanumeric, hyphens, underscores
+        // version: optional, @ followed by any non-empty string
         const scopedMatch = trimmed.match(/^(@[\w-]+)\/([\w-]+)(?:@(.+))?$/);
         if (!scopedMatch) throw new Error(`Invalid skill identifier: ${identifier}`);
         const [, scope, name, version] = scopedMatch;
@@ -2573,8 +3021,8 @@ const installer_SKILLS_SUBDIR = 'skills';
             fullName: `${scope}/${name}`
         };
     }
-    // 无 scope 的格式: name[@version]（公共 Registry）
-    // name 不能包含 /（否则可能是 git shorthand）
+    // Unscoped format: name[@version] (public registry)
+    // name must not contain / (otherwise it might be a git shorthand)
     const unscopedMatch = trimmed.match(/^([\w-]+)(?:@(.+))?$/);
     if (!unscopedMatch) throw new Error(`Invalid skill identifier: ${identifier}`);
     const [, name, version] = unscopedMatch;
@@ -2608,13 +3056,14 @@ class RegistryClient {
         this.config = config;
     }
     /**
-   * Get API base URL (registry + apiPrefix)
+   * Get API base URL (registry + /api)
    *
-   * @returns Base URL for API calls, e.g., 'https://example.com/api' or 'https://rush.com/api/reskill'
+   * All registries use the unified '/api' prefix.
+   *
+   * @returns Base URL for API calls, e.g., 'https://example.com/api'
    */ getApiBase() {
-        const prefix = this.config.apiPrefix || '/api';
         const registry = this.config.registry.endsWith('/') ? this.config.registry.slice(0, -1) : this.config.registry;
-        return `${registry}${prefix}`;
+        return `${registry}/api`;
     }
     /**
    * Get authorization headers
@@ -2629,7 +3078,7 @@ class RegistryClient {
     /**
    * Get current user info (whoami)
    */ async whoami() {
-        const url = `${this.getApiBase()}/auth/me`;
+        const url = `${this.getApiBase()}/skill-auth/me`;
         const response = await fetch(url, {
             method: 'GET',
             headers: this.getAuthHeaders()
@@ -2641,13 +3090,13 @@ class RegistryClient {
     /**
    * CLI login - verify token and get user info
    *
-   * Calls POST /api/auth/login-cli to validate the token and retrieve user information.
+   * Calls POST /api/skill-auth/login-cli to validate the token and retrieve user information.
    * This is the preferred method for CLI authentication.
    *
    * @returns User information if authentication succeeds
    * @throws RegistryError if authentication fails
    */ async loginCli() {
-        const url = `${this.getApiBase()}/auth/login-cli`;
+        const url = `${this.getApiBase()}/skill-auth/login-cli`;
         const response = await fetch(url, {
             method: 'POST',
             headers: this.getAuthHeaders()
@@ -2679,7 +3128,7 @@ class RegistryClient {
                 if (external_node_fs_.existsSync(filePath)) {
                     const content = external_node_fs_.readFileSync(filePath);
                     const stat = external_node_fs_.statSync(filePath);
-                    // 如果提供了 shortName，则在路径前添加顶层目录
+                    // Prepend shortName as top-level directory if provided
                     const entryName = shortName ? `${shortName}/${file}` : file;
                     tarPack.entry({
                         name: entryName,
@@ -2693,15 +3142,15 @@ class RegistryClient {
         });
     }
     // ============================================================================
-    // Skill Info Methods (页面发布适配)
+    // Skill Info Methods (web-published skill support)
     // ============================================================================
     /**
-   * 获取 skill 基本信息（包含 source_type）
-   * 用于 install 命令判断安装逻辑分支
+   * Get basic skill info (including source_type).
+   * Used by the install command to determine the installation logic branch.
    *
-   * @param skillName - 完整名称，如 @kanyun/my-skill
-   * @returns Skill 基本信息
-   * @throws RegistryError 如果 skill 不存在或请求失败
+   * @param skillName - Full skill name, e.g., @kanyun/my-skill
+   * @returns Basic skill information
+   * @throws RegistryError if skill not found or request failed
    */ async getSkillInfo(skillName) {
         const url = `${this.getApiBase()}/skills/${encodeURIComponent(skillName)}`;
         const response = await fetch(url, {
@@ -2710,15 +3159,50 @@ class RegistryClient {
         });
         if (!response.ok) {
             const data = await response.json();
-            // 404 时给出明确的 skill 不存在错误
+            // Return a clear "not found" error for 404 responses
             if (404 === response.status) throw new RegistryError(`Skill not found: ${skillName}`, response.status, data);
             throw new RegistryError(data.error || `Failed to get skill info: ${response.statusText}`, response.status, data);
         }
-        // API 返回格式: { success: true, data: { ... } }
+        // API response format: { success: true, data: { ... } }
         const responseData = await response.json();
         return responseData.data || responseData;
     }
     // ============================================================================
+    // Search Methods
+    // ============================================================================
+    /**
+   * Search for skills in the registry
+   *
+   * @param query - Search query string
+   * @param options - Search options (limit, offset)
+   * @returns Array of matching skills
+   * @throws RegistryError if the request fails
+   *
+   * @example
+   * const results = await client.search('typescript');
+   * const results = await client.search('planning', { limit: 5 });
+   */ async search(query, options = {}) {
+        const params = new URLSearchParams({
+            q: query
+        });
+        if (void 0 !== options.limit) params.set('limit', String(options.limit));
+        if (void 0 !== options.offset) params.set('offset', String(options.offset));
+        const url = `${this.getApiBase()}/skills?${params.toString()}`;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: this.getAuthHeaders()
+        });
+        if (!response.ok) {
+            const data = await response.json();
+            throw new RegistryError(data.error || `Search failed: ${response.status}`, response.status, data);
+        }
+        const data = await response.json();
+        return {
+            items: data.data || [],
+            total: data.meta?.pagination?.totalItems ?? data.data?.length ?? 0
+        };
+    }
+    // ============================================================================
     // Download Methods (Step 3.3)
     // ============================================================================
     /**
@@ -2731,12 +3215,12 @@ class RegistryClient {
    *
    * @example
    * await client.resolveVersion('@kanyun/test-skill', 'latest') // '2.4.5'
-   * await client.resolveVersion('@kanyun/test-skill', '2.4.5') // '2.4.5' (直接返回)
+   * await client.resolveVersion('@kanyun/test-skill', '2.4.5') // '2.4.5' (returned as-is)
    */ async resolveVersion(skillName, tagOrVersion) {
         const version = tagOrVersion || 'latest';
-        // 如果是 semver 版本号，直接返回
+        // If it's already a semver version number, return as-is
         if (/^\d+\.\d+\.\d+/.test(version)) return version;
-        // 否则视为 tag，需要查询 dist-tags
+        // Otherwise treat it as a tag and query dist-tags
         const url = `${this.getApiBase()}/skills/${encodeURIComponent(skillName)}`;
         const response = await fetch(url, {
             method: 'GET',
@@ -2746,14 +3230,14 @@ class RegistryClient {
             const data = await response.json();
             throw new RegistryError(data.error || `Failed to fetch skill metadata: ${response.status}`, response.status, data);
         }
-        // API 返回格式: { success: true, data: { dist_tags: [{ tag, version }] } }
+        // API response format: { success: true, data: { dist_tags: [{ tag, version }] } }
         const responseData = await response.json();
-        // 优先使用 npm 风格的 dist-tags（如果存在）
+        // Prefer npm-style dist-tags if present
         if (responseData['dist-tags']) {
             const resolvedVersion = responseData['dist-tags'][version];
             if (resolvedVersion) return resolvedVersion;
         }
-        // 使用 reskill-app 的 dist_tags 数组格式
+        // Fall back to reskill-app's dist_tags array format
         const distTags = responseData.data?.dist_tags;
         if (distTags && Array.isArray(distTags)) {
             const tagEntry = distTags.find((t)=>t.tag === version);
@@ -2834,11 +3318,11 @@ class RegistryClient {
    * @example
    * RegistryClient.verifyIntegrity(buffer, 'sha256-abc123...') // true or false
    */ static verifyIntegrity(content, expectedIntegrity) {
-        // 解析 integrity 格式: algorithm-hash
+        // Parse integrity format: algorithm-hash
         const match = expectedIntegrity.match(/^(\w+)-(.+)$/);
         if (!match) throw new Error(`Invalid integrity format: ${expectedIntegrity}`);
         const [, algorithm, expectedHash] = match;
-        // 只支持 sha256 和 sha512
+        // Only sha256 and sha512 are supported
         if ('sha256' !== algorithm && 'sha512' !== algorithm) throw new Error(`Unsupported integrity algorithm: ${algorithm}`);
         const actualHash = __WEBPACK_EXTERNAL_MODULE_node_crypto__.createHash(algorithm).update(content).digest('base64');
         return actualHash === expectedHash;
@@ -2850,7 +3334,7 @@ class RegistryClient {
    * Publish a skill to the registry
    */ async publish(skillName, payload, skillPath, options = {}) {
         const url = `${this.getApiBase()}/skills/publish`;
-        // 提取短名称作为 tarball 顶层目录（不含 scope 前缀）
+        // Extract short name as tarball top-level directory (without scope prefix)
         const shortName = getShortName(skillName);
         // Create tarball with short name as top-level directory
         const tarball = await this.createTarball(skillPath, payload.files, shortName);
@@ -3109,352 +3593,122 @@ class RegistryClient {
         let topDir = null;
         extractor.on('entry', (header, stream, next)=>{
             if (!topDir && header.name) {
-                // Get top-level directory from first entry
-                const parts = header.name.split('/');
-                if (parts.length > 0 && parts[0]) topDir = parts[0];
-            }
-            stream.resume();
-            next();
-        });
-        extractor.on('finish', ()=>{
-            resolve(topDir);
-        });
-        extractor.on('error', (err)=>{
-            reject(new Error(`Failed to read tarball: ${err.message}`));
-        });
-        gunzip.on('error', (err)=>{
-            reject(new Error(`Failed to decompress tarball: ${err.message}`));
-        });
-        gunzip.pipe(extractor);
-        gunzip.end(tarball);
-    });
-}
-/**
- * Registry Resolver (Step 5.1)
- *
- * Resolves skill references from npm-style registries:
- * - Private registry: @scope/name[@version] (e.g., @kanyun/planning-with-files@2.4.5)
- * - Public registry: name[@version] (e.g., my-skill@1.0.0)
- *
- * Uses RegistryClient to download and verify skills.
- */ // ============================================================================
-// RegistryResolver Class
-// ============================================================================
-class RegistryResolver {
-    /**
-   * Check if a reference is a registry source (not Git or HTTP)
-   *
-   * Registry formats:
-   * - @scope/name[@version] - private registry
-   * - name[@version] - public registry (if not matching other formats)
-   *
-   * Explicitly excluded:
-   * - Git SSH: git@github.com:user/repo.git
-   * - Git HTTPS: https://github.com/user/repo.git
-   * - GitHub web: https://github.com/user/repo/tree/...
-   * - HTTP/OSS: https://example.com/skill.tar.gz
-   * - Registry shorthand: github:user/repo, gitlab:org/repo
-   */ static isRegistryRef(ref) {
-        // 排除 Git SSH 格式 (git@...)
-        if (ref.startsWith('git@') || ref.startsWith('git://')) return false;
-        // 排除 .git 结尾的 URL
-        if (ref.includes('.git')) return false;
-        // 排除 HTTP/HTTPS/OSS URL
-        if (ref.startsWith('http://') || ref.startsWith('https://') || ref.startsWith('oss://') || ref.startsWith('s3://')) return false;
-        // 排除 registry shorthand 格式 (github:, gitlab:, custom.com:)
-        // 这类格式是 "registry:owner/repo" 而不是 "@scope/name"
-        if (/^[a-zA-Z0-9.-]+:[^@]/.test(ref)) return false;
-        // 检查是否是 @scope/name 格式（私有 registry）
-        if (ref.startsWith('@') && ref.includes('/')) {
-            // @scope/name 或 @scope/name@version
-            const scopeNamePattern = /^@[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+(@[a-zA-Z0-9._-]+)?$/;
-            return scopeNamePattern.test(ref);
-        }
-        // 检查是否是简单的 name 或 name@version 格式（公共 registry）
-        // 简单名称只包含字母、数字、连字符、下划线和点
-        const namePattern = /^[a-zA-Z0-9._-]+(@[a-zA-Z0-9._-]+)?$/;
-        return namePattern.test(ref);
-    }
-    /**
-   * Resolve a registry skill reference
-   *
-   * @param ref - Skill reference (e.g., "@kanyun/planning-with-files@2.4.5" or "my-skill@latest")
-   * @returns Resolved skill information including downloaded tarball
-   *
-   * @example
-   * const result = await resolver.resolve('@kanyun/planning-with-files@2.4.5');
-   * console.log(result.shortName); // 'planning-with-files'
-   * console.log(result.version); // '2.4.5'
-   */ async resolve(ref) {
-        // 1. 解析 skill 标识
-        const parsed = parseSkillIdentifier(ref);
-        const shortName = getShortName(parsed.fullName);
-        // 2. 获取 registry URL
-        const registryUrl = getRegistryUrl(parsed.scope);
-        // 3. 创建 client 并解析版本
-        const client = new RegistryClient({
-            registry: registryUrl,
-            apiPrefix: getApiPrefix(registryUrl)
-        });
-        const version = await client.resolveVersion(parsed.fullName, parsed.version);
-        // 4. 下载 tarball
-        const { tarball, integrity } = await client.downloadSkill(parsed.fullName, version);
-        // 5. 验证 integrity
-        const isValid = RegistryClient.verifyIntegrity(tarball, integrity);
-        if (!isValid) throw new Error(`Integrity verification failed for ${ref}`);
-        return {
-            parsed,
-            shortName,
-            version,
-            registryUrl,
-            tarball,
-            integrity
-        };
-    }
-    /**
-   * Extract tarball to a target directory
-   *
-   * @param tarball - Tarball buffer
-   * @param destDir - Destination directory
-   * @returns Path to the extracted skill directory
-   */ async extract(tarball, destDir) {
-        await extractTarballBuffer(tarball, destDir);
-        // 获取顶层目录名（即 skill 名称）
-        const topDir = await getTarballTopDir(tarball);
-        if (topDir) return `${destDir}/${topDir}`;
-        return destDir;
-    }
-}
-/**
- * Skill Parser - SKILL.md parser
- *
- * Following agentskills.io specification: https://agentskills.io/specification
- *
- * SKILL.md format requirements:
- * - YAML frontmatter containing name and description (required)
- * - name: max 64 characters, lowercase letters, numbers, hyphens
- * - description: max 1024 characters
- * - Optional fields: license, compatibility, metadata, allowed-tools
- */ /**
- * Skill validation error
- */ class SkillValidationError extends Error {
-    field;
-    constructor(message, field){
-        super(message), this.field = field;
-        this.name = 'SkillValidationError';
-    }
-}
-/**
- * Simple YAML frontmatter parser
- * Parses --- delimited YAML header
- *
- * Supports:
- * - Basic key: value pairs
- * - Multiline strings (| and >)
- * - Nested objects (one level deep, for metadata field)
- */ function parseFrontmatter(content) {
-    const frontmatterRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/;
-    const match = content.match(frontmatterRegex);
-    if (!match) return {
-        data: {},
-        content
-    };
-    const yamlContent = match[1];
-    const markdownContent = match[2];
-    // Simple YAML parsing (supports basic key: value format and one level of nesting)
-    const data = {};
-    const lines = yamlContent.split('\n');
-    let currentKey = '';
-    let currentValue = '';
-    let inMultiline = false;
-    let inNestedObject = false;
-    let nestedObject = {};
-    for (const line of lines){
-        const trimmedLine = line.trim();
-        if (!trimmedLine || trimmedLine.startsWith('#')) continue;
-        // Check if it's a nested key: value pair (indented with 2 spaces)
-        const nestedMatch = line.match(/^ {2}([a-zA-Z_-]+):\s*(.*)$/);
-        if (nestedMatch && inNestedObject) {
-            const [, nestedKey, nestedValue] = nestedMatch;
-            nestedObject[nestedKey] = parseYamlValue(nestedValue.trim());
-            continue;
-        }
-        // Check if it's a new key: value pair (no indent)
-        const keyValueMatch = line.match(/^([a-zA-Z_-]+):\s*(.*)$/);
-        if (keyValueMatch && !inMultiline) {
-            // Save previous nested object if any
-            if (inNestedObject && currentKey) {
-                data[currentKey] = nestedObject;
-                nestedObject = {};
-                inNestedObject = false;
-            }
-            // Save previous value
-            if (currentKey && !inNestedObject) data[currentKey] = parseYamlValue(currentValue.trim());
-            currentKey = keyValueMatch[1];
-            currentValue = keyValueMatch[2];
-            // Check if it's start of multiline string
-            if ('|' === currentValue || '>' === currentValue) {
-                inMultiline = true;
-                currentValue = '';
-            } else if ('' === currentValue) {
-                // Empty value - might be start of nested object
-                inNestedObject = true;
-                nestedObject = {};
-            }
-        } else if (inMultiline && line.startsWith('  ')) // Multiline string continuation
-        currentValue += (currentValue ? '\n' : '') + line.slice(2);
-        else if (inMultiline && !line.startsWith('  ')) {
-            // Multiline string end
-            inMultiline = false;
-            data[currentKey] = currentValue.trim();
-            // Try to parse new line
-            const newKeyMatch = line.match(/^([a-zA-Z_-]+):\s*(.*)$/);
-            if (newKeyMatch) {
-                currentKey = newKeyMatch[1];
-                currentValue = newKeyMatch[2];
-            }
-        }
-    }
-    // Save last value
-    if (inNestedObject && currentKey) data[currentKey] = nestedObject;
-    else if (currentKey) data[currentKey] = parseYamlValue(currentValue.trim());
-    return {
-        data,
-        content: markdownContent
-    };
-}
-/**
- * Parse YAML value
- */ function parseYamlValue(value) {
-    if (!value) return '';
-    // Boolean value
-    if ('true' === value) return true;
-    if ('false' === value) return false;
-    // Number
-    if (/^-?\d+$/.test(value)) return parseInt(value, 10);
-    if (/^-?\d+\.\d+$/.test(value)) return parseFloat(value);
-    // Remove quotes
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
-    return value;
-}
-/**
- * Validate skill name format
- *
- * Specification requirements:
- * - Max 64 characters
- * - Only lowercase letters, numbers, hyphens allowed
- * - Cannot start or end with hyphen
- * - Cannot contain consecutive hyphens
- */ function validateSkillName(name) {
-    if (!name) throw new SkillValidationError('Skill name is required', 'name');
-    if (name.length > 64) throw new SkillValidationError('Skill name must be at most 64 characters', 'name');
-    if (!/^[a-z0-9]/.test(name)) throw new SkillValidationError('Skill name must start with a lowercase letter or number', 'name');
-    if (!/[a-z0-9]$/.test(name)) throw new SkillValidationError('Skill name must end with a lowercase letter or number', 'name');
-    if (/--/.test(name)) throw new SkillValidationError('Skill name cannot contain consecutive hyphens', 'name');
-    if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(name) && name.length > 1) throw new SkillValidationError('Skill name can only contain lowercase letters, numbers, and hyphens', 'name');
-    // Single character name
-    if (1 === name.length && !/^[a-z0-9]$/.test(name)) throw new SkillValidationError('Single character skill name must be a lowercase letter or number', 'name');
+                // Get top-level directory from first entry
+                const parts = header.name.split('/');
+                if (parts.length > 0 && parts[0]) topDir = parts[0];
+            }
+            stream.resume();
+            next();
+        });
+        extractor.on('finish', ()=>{
+            resolve(topDir);
+        });
+        extractor.on('error', (err)=>{
+            reject(new Error(`Failed to read tarball: ${err.message}`));
+        });
+        gunzip.on('error', (err)=>{
+            reject(new Error(`Failed to decompress tarball: ${err.message}`));
+        });
+        gunzip.pipe(extractor);
+        gunzip.end(tarball);
+    });
 }
 /**
- * Validate skill description
+ * Registry Resolver (Step 5.1)
  *
- * Specification requirements:
- * - Max 1024 characters
- * - Angle brackets are allowed per agentskills.io spec
- */ function validateSkillDescription(description) {
-    if (!description) throw new SkillValidationError('Skill description is required', 'description');
-    if (description.length > 1024) throw new SkillValidationError('Skill description must be at most 1024 characters', 'description');
-// Note: angle brackets are allowed per agentskills.io spec
-}
-/**
- * Parse SKILL.md content
+ * Resolves skill references from npm-style registries:
+ * - Private registry: @scope/name[@version] (e.g., @kanyun/planning-with-files@2.4.5)
+ * - Public registry: name[@version] (e.g., my-skill@1.0.0)
  *
- * @param content - SKILL.md file content
- * @param options - Parse options
- * @returns Parsed skill info, or null if format is invalid
- * @throws SkillValidationError if validation fails in strict mode
- */ function parseSkillMd(content, options = {}) {
-    const { strict = false } = options;
-    try {
-        const { data, content: body } = parseFrontmatter(content);
-        // Check required fields
-        if (!data.name || !data.description) {
-            if (strict) throw new SkillValidationError('SKILL.md must have name and description in frontmatter');
-            return null;
-        }
-        const name = String(data.name);
-        const description = String(data.description);
-        // Validate field format
-        if (strict) {
-            validateSkillName(name);
-            validateSkillDescription(description);
-        }
-        // Parse allowed-tools
-        let allowedTools;
-        if (data['allowed-tools']) {
-            const toolsStr = String(data['allowed-tools']);
-            allowedTools = toolsStr.split(/\s+/).filter(Boolean);
+ * Uses RegistryClient to download and verify skills.
+ */ // ============================================================================
+// RegistryResolver Class
+// ============================================================================
+class RegistryResolver {
+    /**
+   * Check if a reference is a registry source (not Git or HTTP)
+   *
+   * Registry formats:
+   * - @scope/name[@version] - private registry
+   * - name[@version] - public registry (if not matching other formats)
+   *
+   * Explicitly excluded:
+   * - Git SSH: git@github.com:user/repo.git
+   * - Git HTTPS: https://github.com/user/repo.git
+   * - GitHub web: https://github.com/user/repo/tree/...
+   * - HTTP/OSS: https://example.com/skill.tar.gz
+   * - Registry shorthand: github:user/repo, gitlab:org/repo
+   */ static isRegistryRef(ref) {
+        // Exclude Git SSH format (git@...)
+        if (ref.startsWith('git@') || ref.startsWith('git://')) return false;
+        // Exclude URLs ending with .git
+        if (ref.includes('.git')) return false;
+        // Exclude HTTP/HTTPS/OSS URLs
+        if (ref.startsWith('http://') || ref.startsWith('https://') || ref.startsWith('oss://') || ref.startsWith('s3://')) return false;
+        // Exclude registry shorthand format (github:, gitlab:, custom.com:)
+        // These follow "registry:owner/repo" pattern, not "@scope/name"
+        if (/^[a-zA-Z0-9.-]+:[^@]/.test(ref)) return false;
+        // Check for @scope/name format (private registry)
+        if (ref.startsWith('@') && ref.includes('/')) {
+            // @scope/name or @scope/name@version
+            const scopeNamePattern = /^@[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+(@[a-zA-Z0-9._-]+)?$/;
+            return scopeNamePattern.test(ref);
         }
+        // Check for simple name or name@version format (public registry)
+        // Simple names contain only letters, digits, hyphens, underscores, and dots
+        const namePattern = /^[a-zA-Z0-9._-]+(@[a-zA-Z0-9._-]+)?$/;
+        return namePattern.test(ref);
+    }
+    /**
+   * Resolve a registry skill reference
+   *
+   * @param ref - Skill reference (e.g., "@kanyun/planning-with-files@2.4.5" or "my-skill@latest")
+   * @param overrideRegistryUrl - Optional registry URL override (bypasses scope-based lookup)
+   * @returns Resolved skill information including downloaded tarball
+   *
+   * @example
+   * const result = await resolver.resolve('@kanyun/planning-with-files@2.4.5');
+   * console.log(result.shortName); // 'planning-with-files'
+   * console.log(result.version); // '2.4.5'
+   */ async resolve(ref, overrideRegistryUrl) {
+        // 1. Parse skill identifier
+        const parsed = parseSkillIdentifier(ref);
+        const shortName = getShortName(parsed.fullName);
+        // 2. Get registry URL (CLI override takes precedence)
+        const registryUrl = overrideRegistryUrl || getRegistryUrl(parsed.scope);
+        // 3. Create client and resolve version
+        const client = new RegistryClient({
+            registry: registryUrl
+        });
+        const version = await client.resolveVersion(parsed.fullName, parsed.version);
+        // 4. Download tarball
+        const { tarball, integrity } = await client.downloadSkill(parsed.fullName, version);
+        // 5. Verify integrity
+        const isValid = RegistryClient.verifyIntegrity(tarball, integrity);
+        if (!isValid) throw new Error(`Integrity verification failed for ${ref}`);
         return {
-            name,
-            description,
-            version: data.version ? String(data.version) : void 0,
-            license: data.license ? String(data.license) : void 0,
-            compatibility: data.compatibility ? String(data.compatibility) : void 0,
-            metadata: data.metadata,
-            allowedTools,
-            content: body,
-            rawContent: content
+            parsed,
+            shortName,
+            version,
+            registryUrl,
+            tarball,
+            integrity
         };
-    } catch (error) {
-        if (error instanceof SkillValidationError) throw error;
-        if (strict) throw new SkillValidationError(`Failed to parse SKILL.md: ${error}`);
-        return null;
-    }
-}
-/**
- * Parse SKILL.md from file path
- */ function skill_parser_parseSkillMdFile(filePath, options = {}) {
-    if (!external_node_fs_.existsSync(filePath)) {
-        if (options.strict) throw new SkillValidationError(`SKILL.md not found: ${filePath}`);
-        return null;
     }
-    const content = external_node_fs_.readFileSync(filePath, 'utf-8');
-    return parseSkillMd(content, options);
-}
-/**
- * Parse SKILL.md from skill directory
- */ function parseSkillFromDir(dirPath, options = {}) {
-    const skillMdPath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(dirPath, 'SKILL.md');
-    return skill_parser_parseSkillMdFile(skillMdPath, options);
-}
-/**
- * Check if directory contains valid SKILL.md
- */ function hasValidSkillMd(dirPath) {
-    const skillMdPath = __WEBPACK_EXTERNAL_MODULE_node_path__.join(dirPath, 'SKILL.md');
-    if (!external_node_fs_.existsSync(skillMdPath)) return false;
-    try {
-        const skill = skill_parser_parseSkillMdFile(skillMdPath);
-        return null !== skill;
-    } catch  {
-        return false;
+    /**
+   * Extract tarball to a target directory
+   *
+   * @param tarball - Tarball buffer
+   * @param destDir - Destination directory
+   * @returns Path to the extracted skill directory
+   */ async extract(tarball, destDir) {
+        await extractTarballBuffer(tarball, destDir);
+        // Get top-level directory name (i.e. skill name)
+        const topDir = await getTarballTopDir(tarball);
+        if (topDir) return `${destDir}/${topDir}`;
+        return destDir;
     }
 }
-/**
- * Generate SKILL.md content
- */ function generateSkillMd(skill) {
-    const frontmatter = [
-        '---'
-    ];
-    frontmatter.push(`name: ${skill.name}`);
-    frontmatter.push(`description: ${skill.description}`);
-    if (skill.license) frontmatter.push(`license: ${skill.license}`);
-    if (skill.compatibility) frontmatter.push(`compatibility: ${skill.compatibility}`);
-    if (skill.allowedTools && skill.allowedTools.length > 0) frontmatter.push(`allowed-tools: ${skill.allowedTools.join(' ')}`);
-    frontmatter.push('---');
-    frontmatter.push('');
-    return frontmatter.join('\n') + skill.content;
-}
 /**
  * SkillManager - Core Skill management class
  *
@@ -3936,12 +4190,112 @@ class RegistryResolver {
    * @param options - Installation options
    */ async installToAgents(ref, targetAgents, options = {}) {
         // Detect source type and delegate to appropriate installer
-        // Priority: Registry > HTTP > Git (registry 优先，因为它的格式最受限)
+        // Priority: Registry > HTTP > Git (registry first, as its format is most constrained)
         if (this.isRegistrySource(ref)) return this.installToAgentsFromRegistry(ref, targetAgents, options);
         if (this.isHttpSource(ref)) return this.installToAgentsFromHttp(ref, targetAgents, options);
         return this.installToAgentsFromGit(ref, targetAgents, options);
     }
     /**
+   * Multi-skill install: discover skills in a Git repo and install selected ones (or list only).
+   * Only Git references are supported (including https://github.com/...); registry refs are not.
+   *
+   * @param ref - Git skill reference (e.g. github:user/repo@v1.0.0 or https://github.com/user/repo); any #fragment is stripped for resolution
+   * @param skillNames - If non-empty, install only these skills (by SKILL.md name). If empty and !listOnly, install all.
+   * @param targetAgents - Target agents
+   * @param options - Install options; listOnly: true means discover and return skills without installing
+   */ async installSkillsFromRepo(ref, skillNames, targetAgents, options = {}) {
+        const { listOnly = false, force = false, save = true, mode = 'symlink' } = options;
+        const refForResolve = ref.replace(/#.*$/, '').trim();
+        const resolved = await this.resolver.resolve(refForResolve);
+        const { parsed, repoUrl } = resolved;
+        const gitRef = resolved.ref;
+        let cacheResult = await this.cache.get(parsed, gitRef);
+        if (!cacheResult) {
+            logger_logger.debug(`Caching from ${repoUrl}@${gitRef}`);
+            cacheResult = await this.cache.cache(repoUrl, parsed, gitRef, gitRef);
+        }
+        const cachePath = this.cache.getCachePath(parsed, gitRef);
+        const discovered = discoverSkillsInDir(cachePath);
+        if (0 === discovered.length) throw new Error('No valid skills found. Skills require a SKILL.md with name and description.');
+        if (listOnly) return {
+            listOnly: true,
+            skills: discovered
+        };
+        const selected = skillNames.length > 0 ? filterSkillsByName(discovered, skillNames) : discovered;
+        if (skillNames.length > 0 && 0 === selected.length) {
+            const available = discovered.map((s)=>s.name).join(', ');
+            throw new Error(`No matching skills found for: ${skillNames.join(', ')}. Available skills: ${available}`);
+        }
+        const baseRefForSave = this.config.normalizeSkillRef(refForResolve);
+        const defaults = this.config.getDefaults();
+        // Only pass custom installDir to Installer; default '.skills' should use
+        // the Installer's built-in canonical path (.agents/skills/)
+        const customInstallDir = '.skills' !== defaults.installDir ? defaults.installDir : void 0;
+        const installer = new Installer({
+            cwd: this.projectRoot,
+            global: this.isGlobal,
+            installDir: customInstallDir
+        });
+        const installed = [];
+        const skipped = [];
+        const skillSource = `${parsed.registry}:${parsed.owner}/${parsed.repo}${parsed.subPath ? `/${parsed.subPath}` : ''}`;
+        for (const skillInfo of selected){
+            const semanticVersion = skillInfo.version ?? gitRef;
+            // Skip already-installed skills unless --force is set
+            if (!force) {
+                const existingSkill = this.getInstalledSkill(skillInfo.name);
+                if (existingSkill) {
+                    const locked = this.lockManager.get(skillInfo.name);
+                    const lockedRef = locked?.ref || locked?.version;
+                    if (lockedRef === gitRef) {
+                        const reason = `already installed at ${gitRef}`;
+                        logger_logger.info(`${skillInfo.name}@${gitRef} is already installed, skipping`);
+                        skipped.push({
+                            name: skillInfo.name,
+                            reason
+                        });
+                        continue;
+                    }
+                // Different version installed — allow upgrade without --force
+                // Only skip when the exact same ref is already locked
+                }
+            }
+            logger_logger["package"](`Installing ${skillInfo.name}@${gitRef} to ${targetAgents.length} agent(s)...`);
+            // Note: force is handled at the SkillManager level (skip-if-installed check above).
+            // The Installer always overwrites (remove + copy), so no force flag is needed there.
+            const results = await installer.installToAgents(skillInfo.dirPath, skillInfo.name, targetAgents, {
+                mode: mode
+            });
+            if (!this.isGlobal) this.lockManager.lockSkill(skillInfo.name, {
+                source: skillSource,
+                version: semanticVersion,
+                ref: gitRef,
+                resolved: repoUrl,
+                commit: cacheResult.commit
+            });
+            if (!this.isGlobal && save) {
+                this.config.ensureExists();
+                this.config.addSkill(skillInfo.name, `${baseRefForSave}#${skillInfo.name}`);
+            }
+            const successCount = Array.from(results.values()).filter((r)=>r.success).length;
+            logger_logger.success(`Installed ${skillInfo.name}@${semanticVersion} to ${successCount} agent(s)`);
+            installed.push({
+                skill: {
+                    name: skillInfo.name,
+                    path: skillInfo.dirPath,
+                    version: semanticVersion,
+                    source: skillSource
+                },
+                results
+            });
+        }
+        return {
+            listOnly: false,
+            installed,
+            skipped
+        };
+    }
+    /**
    * Install skill from Git to multiple agents
    */ async installToAgentsFromGit(ref, targetAgents, options = {}) {
         const { save = true, mode = 'symlink' } = options;
@@ -4082,14 +4436,13 @@ class RegistryResolver {
    * - Web-published skills (github/gitlab/oss_url/custom_url/local)
    */ async installToAgentsFromRegistry(ref, targetAgents, options = {}) {
         const { force = false, save = true, mode = 'symlink' } = options;
-        // 解析 skill 标识（获取 fullName 和 version）
+        // Parse skill identifier and resolve registry URL once (single source of truth)
         const parsed = parseSkillIdentifier(ref);
-        const registryUrl = getRegistryUrl(parsed.scope);
+        const registryUrl = options.registry || getRegistryUrl(parsed.scope);
         const client = new RegistryClient({
-            registry: registryUrl,
-            apiPrefix: getApiPrefix(registryUrl)
+            registry: registryUrl
         });
-        // 新增：先查询 skill 信息获取 source_type
+        // Query skill info to determine source_type
         let skillInfo;
         try {
             skillInfo = await client.getSkillInfo(parsed.fullName);
@@ -4100,12 +4453,15 @@ class RegistryResolver {
             };
             else throw error;
         }
-        // 新增：根据 source_type 分支
+        // Branch based on source_type (pass resolved registryUrl via options to avoid re-computation)
         const sourceType = skillInfo.source_type;
-        if (sourceType && 'registry' !== sourceType) return this.installFromWebPublished(skillInfo, parsed, targetAgents, options);
-        // 1. Resolve registry skill（现有流程）
+        if (sourceType && 'registry' !== sourceType) return this.installFromWebPublished(skillInfo, parsed, targetAgents, {
+            ...options,
+            registry: registryUrl
+        });
+        // 1. Resolve registry skill (pass pre-resolved registryUrl)
         logger_logger["package"](`Resolving ${ref} from registry...`);
-        const resolved = await this.registryResolver.resolve(ref);
+        const resolved = await this.registryResolver.resolve(ref, registryUrl);
         const { shortName, version, registryUrl: resolvedRegistryUrl, tarball, parsed: resolvedParsed } = resolved;
         // 2. Check if already installed (skip if --force)
         const skillPath = this.getSkillPath(shortName);
@@ -4144,101 +4500,157 @@ class RegistryResolver {
             };
         }
         logger_logger["package"](`Installing ${shortName}@${version} from ${resolvedRegistryUrl} to ${targetAgents.length} agent(s)...`);
-        // 3. Create temp directory for extraction
+        // 3. Create temp directory for extraction (clean stale files first)
         const tempDir = __WEBPACK_EXTERNAL_MODULE_node_path__.join(this.cache.getCacheDir(), 'registry-temp', `${shortName}-${version}`);
+        await remove(tempDir);
         await ensureDir(tempDir);
-        // 4. Extract tarball
-        const extractedPath = await this.registryResolver.extract(tarball, tempDir);
-        logger_logger.debug(`Extracted to ${extractedPath}`);
-        // 5. Create Installer with custom installDir from config
-        const defaults = this.config.getDefaults();
-        const installer = new Installer({
-            cwd: this.projectRoot,
-            global: this.isGlobal,
-            installDir: defaults.installDir
-        });
-        // 6. Install to all target agents
-        const results = await installer.installToAgents(extractedPath, shortName, targetAgents, {
-            mode: mode
-        });
-        // 7. Update lock file (project mode only)
-        if (!this.isGlobal) this.lockManager.lockSkill(shortName, {
-            source: `registry:${resolvedParsed.fullName}`,
-            version,
-            ref: version,
-            resolved: resolvedRegistryUrl,
-            commit: resolved.integrity
-        });
-        // 8. Update skills.json (project mode only)
-        if (!this.isGlobal && save) {
-            this.config.ensureExists();
-            // Save with full name for registry skills
-            this.config.addSkill(shortName, ref);
+        try {
+            // 4. Extract tarball
+            const extractedPath = await this.registryResolver.extract(tarball, tempDir);
+            logger_logger.debug(`Extracted to ${extractedPath}`);
+            // 5. Create Installer with custom installDir from config
+            const defaults = this.config.getDefaults();
+            const installer = new Installer({
+                cwd: this.projectRoot,
+                global: this.isGlobal,
+                installDir: defaults.installDir
+            });
+            // 6. Install to all target agents
+            const results = await installer.installToAgents(extractedPath, shortName, targetAgents, {
+                mode: mode
+            });
+            // 7. Update lock file (project mode only)
+            if (!this.isGlobal) this.lockManager.lockSkill(shortName, {
+                source: `registry:${resolvedParsed.fullName}`,
+                version,
+                ref: version,
+                resolved: resolvedRegistryUrl,
+                commit: resolved.integrity
+            });
+            // 8. Update skills.json (project mode only)
+            if (!this.isGlobal && save) {
+                this.config.ensureExists();
+                // Save with full name for registry skills
+                this.config.addSkill(shortName, ref);
+            }
+            // 9. Count results and log
+            const successCount = Array.from(results.values()).filter((r)=>r.success).length;
+            const failCount = results.size - successCount;
+            if (0 === failCount) logger_logger.success(`Installed ${shortName}@${version} to ${successCount} agent(s)`);
+            else logger_logger.warn(`Installed ${shortName}@${version} to ${successCount} agent(s), ${failCount} failed`);
+            // 10. Build the InstalledSkill to return
+            const skill = {
+                name: shortName,
+                path: extractedPath,
+                version,
+                source: `registry:${resolvedParsed.fullName}`
+            };
+            return {
+                skill,
+                results
+            };
+        } finally{
+            // Clean up temp directory after installation
+            await remove(tempDir);
         }
-        // 9. Count results and log
-        const successCount = Array.from(results.values()).filter((r)=>r.success).length;
-        const failCount = results.size - successCount;
-        if (0 === failCount) logger_logger.success(`Installed ${shortName}@${version} to ${successCount} agent(s)`);
-        else logger_logger.warn(`Installed ${shortName}@${version} to ${successCount} agent(s), ${failCount} failed`);
-        // 9. Build the InstalledSkill to return
-        const skill = {
-            name: shortName,
-            path: extractedPath,
-            version,
-            source: `registry:${resolvedParsed.fullName}`
-        };
-        return {
-            skill,
-            results
-        };
     }
     // ============================================================================
-    // Web-published skill installation (页面发布适配)
+    // Web-published skill installation
     // ============================================================================
     /**
-   * 安装页面发布的 skill
+   * Install a web-published skill.
    *
-   * 页面发布的 skill 不支持版本管理，根据 source_type 分支到不同的安装逻辑：
-   * - github/gitlab: 复用 installToAgentsFromGit
-   * - oss_url/custom_url: 复用 installToAgentsFromHttp
-   * - local: 通过 Registry API 下载 tarball
+   * Web-published skills do not support versioning. Branches to different
+   * installation logic based on source_type:
+   * - github/gitlab: reuses installToAgentsFromGit
+   * - oss_url/custom_url: reuses installToAgentsFromHttp
+   * - local: downloads tarball via Registry API
    */ async installFromWebPublished(skillInfo, parsed, targetAgents, options = {}) {
         const { source_type, source_url } = skillInfo;
-        // 页面发布的 skill 不支持版本指定
+        // Web-published skills do not support version specifiers
         if (parsed.version && 'latest' !== parsed.version) throw new Error(`Version specifier not supported for web-published skills.\n'${parsed.fullName}' was published via web and does not support versioning.\nUse: reskill install ${parsed.fullName}`);
         if (!source_url) throw new Error(`Missing source_url for web-published skill: ${parsed.fullName}`);
         logger_logger["package"](`Installing ${parsed.fullName} from ${source_type} source...`);
         switch(source_type){
             case 'github':
             case 'gitlab':
-                // source_url 是完整的 Git URL（包含 ref 和 path）
-                // 复用已有的 Git 安装逻辑
+                // source_url is a full Git URL (includes ref and path)
+                // Reuse existing Git installation logic
                 return this.installToAgentsFromGit(source_url, targetAgents, options);
             case 'oss_url':
             case 'custom_url':
-                // 直接下载 URL
+                // Direct download URL
                 return this.installToAgentsFromHttp(source_url, targetAgents, options);
             case 'local':
-                // 通过 Registry API 下载 tarball
-                return this.installFromRegistryLocal(skillInfo, parsed, targetAgents, options);
+                // Download tarball via Registry API
+                return this.installFromRegistryLocal(parsed, targetAgents, options);
             default:
                 throw new Error(`Unknown source_type: ${source_type}`);
         }
     }
     /**
-   * 安装 Local Folder 模式发布的 skill
+   * Install a skill published via "local folder" mode.
    *
-   * 通过 Registry 的 {apiPrefix}/skills/:name/download API 下载 tarball
-   * (apiPrefix 根据 registry 不同而不同，如 /api 或 /api/reskill)
-   */ async installFromRegistryLocal(_skillInfo, parsed, targetAgents, options = {}) {
-        const registryUrl = getRegistryUrl(parsed.scope);
-        // 构造下载 URL（通过 Registry API）
-        // Ensure trailing slash for proper URL concatenation (defensive coding)
-        const baseUrl = registryUrl.endsWith('/') ? registryUrl : `${registryUrl}/`;
-        const downloadUrl = `${baseUrl}api/skills/${encodeURIComponent(parsed.fullName)}/download`;
-        logger_logger.debug(`Downloading from: ${downloadUrl}`);
-        // 复用 HTTP 下载逻辑
-        return this.installToAgentsFromHttp(downloadUrl, targetAgents, options);
+   * Downloads tarball via RegistryClient (handles 302 redirects to signed OSS URLs),
+   * then extracts and installs using the same flow as registry source_type.
+   */ async installFromRegistryLocal(parsed, targetAgents, options = {}) {
+        const { save = true, mode = 'symlink' } = options;
+        const registryUrl = options.registry || getRegistryUrl(parsed.scope);
+        const shortName = getShortName(parsed.fullName);
+        const version = 'latest';
+        // Download tarball via RegistryClient (handles auth + 302 redirect to signed URL)
+        const client = new RegistryClient({
+            registry: registryUrl
+        });
+        const { tarball } = await client.downloadSkill(parsed.fullName, version);
+        logger_logger["package"](`Installing ${shortName} from ${registryUrl} to ${targetAgents.length} agent(s)...`);
+        // Extract tarball to temp directory (clean stale files first)
+        const tempDir = __WEBPACK_EXTERNAL_MODULE_node_path__.join(this.cache.getCacheDir(), 'registry-temp', `${shortName}-${version}`);
+        await remove(tempDir);
+        await ensureDir(tempDir);
+        try {
+            const extractedPath = await this.registryResolver.extract(tarball, tempDir);
+            logger_logger.debug(`Extracted to ${extractedPath}`);
+            // Install to all target agents
+            const defaults = this.config.getDefaults();
+            const installer = new Installer({
+                cwd: this.projectRoot,
+                global: this.isGlobal,
+                installDir: defaults.installDir
+            });
+            const results = await installer.installToAgents(extractedPath, shortName, targetAgents, {
+                mode: mode
+            });
+            // Get metadata from extracted path
+            const metadata = this.getSkillMetadataFromDir(extractedPath);
+            const skillName = metadata?.name ?? shortName;
+            const semanticVersion = metadata?.version ?? version;
+            // Update lock file (project mode only)
+            if (!this.isGlobal) this.lockManager.lockSkill(skillName, {
+                source: `registry:${parsed.fullName}`,
+                version: semanticVersion,
+                ref: version,
+                resolved: registryUrl,
+                commit: ''
+            });
+            // Update skills.json (project mode only)
+            if (!this.isGlobal && save) {
+                this.config.ensureExists();
+                this.config.addSkill(skillName, parsed.fullName);
+            }
+            return {
+                skill: {
+                    name: skillName,
+                    path: extractedPath,
+                    version: semanticVersion,
+                    source: `registry:${parsed.fullName}`
+                },
+                results
+            };
+        } finally{
+            // Clean up temp directory after installation
+            await remove(tempDir);
+        }
     }
     /**
    * Get default target agents