skills-manager-cli 2026.10.26 → 2026.10.27

package/README.md

@@ -46,7 +46,7 @@ npx skills-manager-cli
 
 ![skills-manager demo](docs/assets/demo.gif)
 
-*`--help` and the resident context-cost ledger (`cost`) in action.*
+*`--help` and the resident context-cost ledger (`cost`) in action. After bootstrap, try `cost --share` and `doctor` — both are printed as pasteable demos.*
 
 That is the whole setup. Bootstrap creates the skill hub (`~/.skills-manager`), installs the **manager skill** into it from the bundled copy, and mounts it (symlink) into the agents it detects on your machine — you confirm the list in the one prompt it shows.
 
@@ -70,8 +70,41 @@ npx skills-manager-cli                 # bootstrap the hub + manager skill
 skills-manager init --dry-run          # preview importing existing runtime skills
 # or ask your agent: Import my existing skills into skills-manager
 skills-manager cost --share            # privacy-safe paste card of your resident skill tax
+skills-manager doctor --share          # privacy-safe hub health card (counts only)
+skills-manager update --check          # freshness vs skill subtree tree-SHA (git) — no cry-wolf
+skills-manager audit security --strict  # CI gate: fail only on high-severity findings
+skills-manager audit overlap           # which skills compete for the same request (wrong-skill triggers)
+skills-manager audit descriptions      # descriptions that will never trigger (no "use when", vague, too long)
+skills-manager sync init --remote <url> # multi-machine hub git sync (unique vs installers)
+skills-manager sync status --share      # privacy-safe paste card of sync posture
 ```
 
+`cost --share` prints a paste-ready card (no absolute paths). Example shape:
+
+```text
+Resident skill tax · char-approx · skills-manager
+≈1.2k tokens / message · 12 skill(s) · 2 path(s)
+Paths: user/claude-code+zed · project/cursor
+Heaviest: big-skill ≈400 · mid ≈200 · small ≈80
+Try: npx skills-manager-cli
+Reproduce: skills-manager cost --share
+https://github.com/shenysun/skills-manager
+```
+
+**CI?** Drop [`examples/github-actions/audit-security.yml`](examples/github-actions/audit-security.yml) into `.github/workflows/` on a hub repo (`skills/` + `registry.yaml`). It runs `audit security --strict --format github` on PR/push — fails only on high-severity findings, and annotates the PR Files tab.
+
+Every gate exits 1 on failure and writes its verdict to stderr, so stdout (text/JSON) stays stable:
+
+| Gate | Command | Fails when | Network |
+| --- | --- | --- | --- |
+| Security | `audit security --strict` | any high-severity finding | no |
+| Provenance | `provenance list --fail-on-imported` | an imported skill has no usable source (can't get updates) | no |
+| Resident cost | `cost --budget <tokens>` | total resident tokens exceed the budget | no |
+| Freshness | `update --check --fail-on-stale` | any skill is stale, or a check fails | yes (`GH_TOKEN` helps) |
+| **All of the above** | `check [--budget <tokens>] [--freshness]` | any enabled gate fails (security + provenance always; budget/freshness opt-in) — copy [`examples/github-actions/hub-check.yml`](examples/github-actions/hub-check.yml) | only with `--freshness` |
+
+Details: [docs/CLI.md](docs/CLI.md).
+
 Runtime copies become hub-backed; originals are backed up first.
 
 ## How it works
@@ -132,10 +165,12 @@ Skill home resolution priority:
 npx skills-manager-cli                            # bootstrap (default when no subcommand)
 skills-manager bootstrap --agent claude-code      # scripted bootstrap / mount later
 skills-manager doctor
+skills-manager doctor --share                     # privacy-safe hub health paste card
 skills-manager list
 skills-manager add owner/repo --all --yes
 skills-manager distribute --to user --skill my-skill --agent claude-code
 skills-manager update --plan
+skills-manager update --check                     # tree-SHA freshness (git/marketplace)
 skills-manager update --skill my-skill
 skills-manager init --dry-run                    # preview runtime-skill import
 skills-manager init --prefer claude-code hub     # this-run conflict priority
@@ -144,11 +179,16 @@ skills-manager backup list                       # inspect init backups
 skills-manager backup restore my-skill           # roll one import back
 skills-manager edit my-skill --source-git owner/repo --subpath skills/my-skill
 skills-manager provenance list                   # skills still missing a source
+skills-manager provenance list --fail-on-imported # fail (exit 1) when any imported skill still lacks a source
 skills-manager provenance adopt                  # backfill lockfile evidence
 skills-manager categories set my-skill frontend     # tag with a domain category
 skills-manager categories apply frontend -a claude-code  # load only that domain
 skills-manager categories status                  # applied sets + drift
 skills-manager cost                              # resident context-cost ledger (report-only recall suggestions)
+skills-manager cost --budget 2000                # fail (exit 1) when resident context tax exceeds a token budget
+skills-manager sync init --remote <url>          # multi-machine hub git sync
+skills-manager sync status --share               # privacy-safe paste card of sync posture
+skills-manager update --check --fail-on-stale    # fail (exit 1) when any hub skill is stale vs upstream tree-SHA
 skills-manager archive old-skill
 ```
 

package/README.zh-CN.md

@@ -46,7 +46,7 @@ npx skills-manager-cli
 
 ![skills-manager demo](docs/assets/demo.gif)
 
-*演示：`--help` 与常驻上下文成本账本（`cost`）。*
+*演示：`--help` 与常驻上下文成本账本（`cost`）。bootstrap 结束后还会打印可粘贴的 `cost --share` 与 `doctor` demo。*
 
 这就是全部的安装步骤。bootstrap 会创建技能库（`~/.skills-manager`），从包内副本把 **manager skill** 种进库，并（以软链接）挂载到它检测到的 agent——展示一次多选让你确认清单。
 
@@ -70,8 +70,41 @@ npx skills-manager-cli                 # 引导创建 hub + manager skill
 skills-manager init --dry-run          # 预览导入现有运行时 skill
 # 或对 agent 说：把我现有的 skills 导入 skills-manager
 skills-manager cost --share            # 可粘贴分享的常驻 skill 税卡片（无绝对路径）
+skills-manager doctor --share          # 可粘贴的 hub 健康卡片（仅计数，无路径/技能名）
+skills-manager update --check          # 新鲜度：skill 子目录 tree-SHA（git）——不上游无关提交的狼来了
+skills-manager audit security --strict  # CI 闸：仅 high 严重度发现时失败
+skills-manager audit overlap           # 哪些 skill 在抢同一个请求（误触发错的 skill）
+skills-manager audit descriptions      # 永远不会被触发的 description（缺「何时用」、太含糊、太长）
+skills-manager sync init --remote <url> # 多机 hub git 同步（相对安装器的差异化）
+skills-manager sync status --share      # 可粘贴分享的同步姿态卡片（无 hub 路径 / remote URL）
 ```
 
+`cost --share` 输出可直接粘贴的卡片（不含绝对路径）。示例形状：
+
+```text
+Resident skill tax · char-approx · skills-manager
+≈1.2k tokens / message · 12 skill(s) · 2 path(s)
+Paths: user/claude-code+zed · project/cursor
+Heaviest: big-skill ≈400 · mid ≈200 · small ≈80
+Try: npx skills-manager-cli
+Reproduce: skills-manager cost --share
+https://github.com/shenysun/skills-manager
+```
+
+**上 CI？** 把 [`examples/github-actions/audit-security.yml`](examples/github-actions/audit-security.yml) 拷进 hub 仓库的 `.github/workflows/`（仓库根需是 `skills/` + `registry.yaml`）。PR/push 时跑 `audit security --strict --format github`——仅 high 严重度发现会失败，并在 PR Files 页打注解。
+
+每个闸失败即退出 1，结论写 stderr，stdout（文本/JSON）保持稳定：
+
+| 闸 | 命令 | 何时失败 | 联网 |
+| --- | --- | --- | --- |
+| 安全 | `audit security --strict` | 存在 high 严重度发现 | 否 |
+| 来源 | `provenance list --fail-on-imported` | 有导入 skill 缺可用来源（拿不到更新） | 否 |
+| 常驻成本 | `cost --budget <tokens>` | 常驻总 token 超出预算 | 否 |
+| 新鲜度 | `update --check --fail-on-stale` | 任一 skill 过期，或检测失败 | 是（建议设 `GH_TOKEN`） |
+| **以上全部** | `check [--budget <tokens>] [--freshness]` | 任一启用的闸失败（安全 + 来源必跑；预算/新鲜度按需开启）——可直接拷贝 [`examples/github-actions/hub-check.yml`](examples/github-actions/hub-check.yml) | 仅 `--freshness` 时 |
+
+详见 [docs/CLI.zh-CN.md](docs/CLI.zh-CN.md)。
+
 运行时副本改为由 hub 托管；原文件会先备份。
 
 ## 工作原理
@@ -132,10 +165,12 @@ apply 是显式的、可逆的快照：缺的分发、集合外（含未打标
 npx skills-manager-cli                            # bootstrap（不带子命令时的默认行为）
 skills-manager bootstrap --agent claude-code      # 脚本化 bootstrap / 之后再挂载
 skills-manager doctor
+skills-manager doctor --share                     # 可粘贴的 hub 健康卡片（仅计数）
 skills-manager list
 skills-manager add owner/repo --all --yes
 skills-manager distribute --to user --skill my-skill --agent claude-code
 skills-manager update --plan
+skills-manager update --check                     # tree-SHA 新鲜度（git/marketplace）
 skills-manager update --skill my-skill
 skills-manager init --dry-run                    # 预览运行时技能导入
 skills-manager init --prefer claude-code hub     # 本次导入的冲突优先级
@@ -144,11 +179,16 @@ skills-manager backup list                       # 查看 init 备份
 skills-manager backup restore my-skill           # 回滚某次导入
 skills-manager edit my-skill --source-git owner/repo --subpath skills/my-skill
 skills-manager provenance list                   # 仍缺来源的技能清单
+skills-manager provenance list --fail-on-imported # 仍有「导入却无来源」的 skill 时失败（exit 1）
 skills-manager provenance adopt                  # 补采锁文件证据
 skills-manager categories set my-skill 前端       # 打领域类别标签
 skills-manager categories apply 前端 -a claude-code  # 只加载该领域
 skills-manager categories status                  # 已应用集合 + 漂移
 skills-manager cost                              # 常驻上下文成本账本（只报告不执行的收回建议）
+skills-manager cost --budget 2000                # 常驻上下文税超出 token 预算时失败（exit 1）
+skills-manager sync init --remote <url>          # 多机 hub git 同步
+skills-manager sync status --share               # 可粘贴分享的同步姿态卡片
+skills-manager update --check --fail-on-stale    # 任一 hub skill 相对上游树 SHA 过期时失败（exit 1）
 skills-manager archive old-skill
 ```
 

package/dist/cli/bootstrap.js

@@ -67,6 +67,11 @@ export async function runBootstrap(opts, cmd) {
     console.log('\nAll set. Go back to your agent and say:');
     console.log(`  “${STARTER_PROMPT_ZH}”`);
     console.log(`  (“${STARTER_PROMPT_EN}”)`);
+    // Growth wedge: surface the pasteable demos that land after the next npm cut
+    // (cost --share + doctor already ships security.high / residentCost rollups).
+    console.log('\nAlso try (CLI demos — paste anywhere):');
+    console.log('  skills-manager cost --share   # privacy-safe resident skill tax card');
+    console.log('  skills-manager doctor         # health + security.high + residentCost');
 }
 /** `--agent` wins; one detected agent needs no question; several get the picker in a TTY, all of them otherwise. */
 async function chooseAgents(opts, detected, resolveGlobalDir) {

package/dist/cli/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/cli/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAA2B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAqB,MAAM,uBAAuB,CAAC;AAEvE,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAuD,CAAC;AACvH,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AACnE,MAAM,iBAAiB,GAAG,8FAA8F,CAAC;AACzH,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAElE,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,yBAAyB,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAChH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB,EAAE,GAAY;IACrE,MAAM,UAAU,GAAI,GAAG,CAAC,eAAe,EAAwB,CAAC;IAChE,MAAM,CAAC,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAA2B;QACxC,MAAM,EAAE,gDAAgD,MAAM,CAAC,OAAO,GAAG;QACzE,SAAS,EAAE,iCAAiC,MAAM,CAAC,OAAO,EAAE;QAC5D,YAAY,EAAE,mCAAmC,MAAM,CAAC,OAAO,GAAG;QAClE,cAAc,EAAE,+EAA+E;KAChG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtI,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACtF,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,GAAG,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;YACvI,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;IAED,yFAAyF;IACzF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,wCAAwC,SAAS,GAAG,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,yCAAyC,gBAAgB,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IAED,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,MAAM,CAAC,MAAM,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9K,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,OAAO,iBAAiB,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,oHAAoH;AACpH,KAAK,UAAU,YAAY,CAAC,IAAsB,EAAE,QAA2B,EAAE,gBAA+C;IAC9H,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IACnE,MAAM,OAAO,GAAmB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;IACrH,OAAO,WAAW,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/cli/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAA2B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAqB,MAAM,uBAAuB,CAAC;AAEvE,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAuD,CAAC;AACvH,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AACnE,MAAM,iBAAiB,GAAG,8FAA8F,CAAC;AACzH,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAElE,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,yBAAyB,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAChH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB,EAAE,GAAY;IACrE,MAAM,UAAU,GAAI,GAAG,CAAC,eAAe,EAAwB,CAAC;IAChE,MAAM,CAAC,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAA2B;QACxC,MAAM,EAAE,gDAAgD,MAAM,CAAC,OAAO,GAAG;QACzE,SAAS,EAAE,iCAAiC,MAAM,CAAC,OAAO,EAAE;QAC5D,YAAY,EAAE,mCAAmC,MAAM,CAAC,OAAO,GAAG;QAClE,cAAc,EAAE,+EAA+E;KAChG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtI,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACtF,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,GAAG,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;YACvI,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;IAED,yFAAyF;IACzF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,wCAAwC,SAAS,GAAG,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,yCAAyC,gBAAgB,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IAED,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,MAAM,CAAC,MAAM,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9K,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,OAAO,iBAAiB,IAAI,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;AACzF,CAAC;AAED,oHAAoH;AACpH,KAAK,UAAU,YAAY,CAAC,IAAsB,EAAE,QAA2B,EAAE,gBAA+C;IAC9H,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IACnE,MAAM,OAAO,GAAmB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;IACrH,OAAO,WAAW,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC"}

package/dist/cli/cost-output.js

@@ -68,7 +68,7 @@ export function renderPresetCostLine(cost) {
 /**
  * Privacy-safe paste card for `skills-manager cost --share` (growth wedge):
  * no absolute paths, agent-family labels only, top skills by total tokens,
- * a one-line CTA + repo URL. Same ledger, thinner surface.
+ * Try/Reproduce CTA + repo URL (not a circular "Share: cost --share"). Same ledger, thinner surface.
  */
 export function renderCostShare(ledger) {
     const skillTotals = new Map();
@@ -105,7 +105,8 @@ export function renderCostShare(ledger) {
     }
     if (ledger.unmanaged > 0)
         lines.push(`${ledger.unmanaged} unmanaged skill(s) not counted`);
-    lines.push('Share: skills-manager cost --share');
+    lines.push('Try: npx skills-manager-cli');
+    lines.push('Reproduce: skills-manager cost --share');
     lines.push('https://github.com/shenysun/skills-manager');
     return `${lines.join('\n')}\n`;
 }

package/dist/cli/cost-output.js.map

@@ -1 +1 @@
-{"version":3,"file":"cost-output.js","sourceRoot":"","sources":["../../src/cli/cost-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAwC,MAAM,yCAAyC,CAAC;AAEnH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,aAAa,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,kBAAkB,CAAC,CAAC;IAC9J,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,aAAa,MAAM,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrH,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,iCAAiC,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAClI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC/D,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACzE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,eAAe,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACjG,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,8BAA8B,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAChF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;QAC5G,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClG,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;oBAEoB;AACpB,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,OAAO,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAC,MAAM,GAAG,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,UAAU,eAAe,MAAM,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;IACnI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;IACtD,IAAI,QAAQ,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,6BAA6B,CAAC,CAAC;QACvE,IAAI,SAAS,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,iCAAiC,CAAC,CAAC;IAC3F,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACzD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"cost-output.js","sourceRoot":"","sources":["../../src/cli/cost-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAwC,MAAM,yCAAyC,CAAC;AAEnH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,aAAa,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,kBAAkB,CAAC,CAAC;IAC9J,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,aAAa,MAAM,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrH,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,iCAAiC,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAClI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC/D,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACzE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,eAAe,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACjG,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,8BAA8B,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAChF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;QAC5G,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClG,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;oBAEoB;AACpB,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,OAAO,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAC,MAAM,GAAG,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,UAAU,eAAe,MAAM,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;IACnI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;IACtD,IAAI,QAAQ,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,6BAA6B,CAAC,CAAC;QACvE,IAAI,SAAS,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,iCAAiC,CAAC,CAAC;IAC3F,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACzD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/cli/doctor-output.js

@@ -0,0 +1,29 @@
+import { formatApproxTokens } from '../core/services/cost-ledger-service.js';
+/**
+ * Privacy-safe paste card for `skills-manager doctor --share` (growth wedge):
+ * counts and magnitudes only — never skillHome, broken-link paths, skill names,
+ * or warning text that may embed absolute paths. Try/Reproduce CTA + repo URL.
+ */
+export function renderDoctorShare(report) {
+    const cost = report.residentCost;
+    const dist = report.distribution;
+    const lines = [];
+    lines.push('Hub health · skills-manager');
+    lines.push(`${report.skillCount} skill(s) · managed ${dist.managedEntries} · outdated ${dist.outdated} · foreign ${dist.foreign}`);
+    lines.push(`Resident: ${formatApproxTokens(cost.totalTokens)} tokens / message · ${cost.method}`);
+    const scattered = cost.suggestions.scattered.length;
+    if (scattered > 0)
+        lines.push(`Watch: ${scattered} scattered`);
+    lines.push(`Security: ${report.security.high} high · ${report.security.scanner} · scanned ${report.security.scanned}`);
+    lines.push(report.warnings.length === 0 ? 'Warnings: none' : `Warnings: ${report.warnings.length}`);
+    if (report.brokenLinks.length > 0)
+        lines.push(`Broken links: ${report.brokenLinks.length}`);
+    if (report.importedWithoutSource.length > 0) {
+        lines.push(`Imported without source: ${report.importedWithoutSource.length}`);
+    }
+    lines.push('Try: npx skills-manager-cli');
+    lines.push('Reproduce: skills-manager doctor --share');
+    lines.push('https://github.com/shenysun/skills-manager');
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=doctor-output.js.map

package/dist/cli/doctor-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-output.js","sourceRoot":"","sources":["../../src/cli/doctor-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAG7E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,UAAU,uBAAuB,IAAI,CAAC,cAAc,eAAe,IAAI,CAAC,QAAQ,cAAc,IAAI,CAAC,OAAO,EAAE,CACvH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;IACpD,IAAI,SAAS,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,SAAS,YAAY,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CACR,aAAa,MAAM,CAAC,QAAQ,CAAC,IAAI,WAAW,MAAM,CAAC,QAAQ,CAAC,OAAO,cAAc,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAC3G,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACzD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/cli/main.js

@@ -5,6 +5,8 @@ import { createRuntimeServices, projectRootFromImportMeta } from '../infra/runti
 import { isInsecureHttpSource, normalizeGitSourceUrl } from '../core/services/source-service.js';
 import { isUpdatableSourceType } from '../core/services/update-service.js';
 import { parseFormatFlag } from '../core/services/url-payload.js';
+import { findDescriptionOverlaps, renderOverlapReport } from '../core/services/description-overlap.js';
+import { lintDescriptions, renderDescriptionLint } from '../core/services/description-lint.js';
 import { confirmInsecureHttp } from './insecure-http-confirm.js';
 import { SkillsManagerError } from '../shared/errors.js';
 import { redactCheckout, redactDiscovered } from '../shared/redact.js';
@@ -14,6 +16,9 @@ import { HttpDownloadClient } from '../infra/http-download-client.js';
 import { DetectionService, detectionLogPath } from '../core/services/detection-service.js';
 import { runBootstrap, managerSkillBundle } from './bootstrap.js';
 import { renderCostLedger, renderCostShare, renderPresetCostLine } from './cost-output.js';
+import { renderDoctorShare } from './doctor-output.js';
+import { renderSyncShare } from './sync-output.js';
+import { formatGithubAnnotations } from '../core/services/security-scan.js';
 const pkg = createRequire(import.meta.url)('../../package.json');
 const projectRoot = projectRootFromImportMeta(import.meta.url);
 function services(cmd, options = {}) {
@@ -82,6 +87,9 @@ const webCommand = (cmd, description) => cmd
     .option('--host <host>', 'host', '127.0.0.1')
     .option('--no-open', 'do not open a browser')
     .action(async (opts, self) => {
+    const port = Number(opts.port);
+    if (!/^\d+$/.test(String(opts.port)) || port > 65535)
+        throw new Error(`--port expects an integer from 0 to 65535, got "${opts.port}"`);
     const globalOpts = self.optsWithGlobals();
     // Single entry point (ADR-0014): the dashboard never creates the hub — bootstrap does.
     const probe = createRuntimeServices({ home: globalOpts.home }, projectRoot);
@@ -91,23 +99,31 @@ const webCommand = (cmd, description) => cmd
     selfCheckManagerSkill(probe);
     // Lazy: fastify/shiki/markdown load only for the dashboard command, not on every CLI invocation.
     const { startDashboardServer } = await import('../dashboard/server/main.js');
-    return startDashboardServer({ home: globalOpts.home, port: Number(opts.port), host: opts.host, open: opts.open, projectRoot });
+    return startDashboardServer({ home: globalOpts.home, port, host: opts.host, open: opts.open, projectRoot });
 });
 webCommand(program.command('web'), 'Start the local web dashboard');
 webCommand(program.command('dashboard', { hidden: true }), 'Deprecated alias for web');
 program.command('doctor')
     .description('Run health checks')
+    .option('--share', 'privacy-safe paste card (counts only — no paths / skill names) for X / HN / chat')
     .option('--migrate-views', 'distribute leftover hub views to user runtimes')
     .option('--delete-views', 'with --migrate-views, remove generated view symlinks')
     .option('--force', 'with --migrate-views, overwrite unmanaged runtime paths')
     .action((opts, cmd) => {
     const s = services(cmd);
+    if (opts.share && opts.migrateViews)
+        throw new Error('use either --share or --migrate-views, not both');
     if (opts.migrateViews) {
         const migrated = s.distribute.migrateViews({ deleteViews: Boolean(opts.deleteViews), force: Boolean(opts.force) });
         s.activity.record({ action: 'cli-migrate-views', summary: 'Migrated leftover hub views', details: migrated });
         return print({ migrated, doctor: s.doctor.check() });
     }
-    print(s.doctor.check());
+    const report = s.doctor.check();
+    if (opts.share) {
+        process.stdout.write(renderDoctorShare(report));
+        return;
+    }
+    print(report);
 });
 program.command('status')
     .description('Summarize managed distribution health (managed/foreign/outdated/stale)')
@@ -393,16 +409,31 @@ provenance.command('adopt')
 provenance.command('list')
     .description('List skills still missing a source: imported-without-source vs locally authored')
     .option('--json', 'machine-readable output for agents')
+    .option('--fail-on-imported', 'exit 1 when any imported-without-source skill remains (CI / hub-hygiene gate; locally authored never fails)')
     .action((opts, cmd) => {
     const pending = services(cmd).provenance.pending();
     if (opts.json)
-        return print(pending);
-    console.log(`Imported without source (${pending.importedWithoutSource.length}):`);
-    for (const item of pending.importedWithoutSource)
-        console.log(`  ${item.skill}${item.importedAt ? ` (imported ${item.importedAt})` : ''}`);
-    console.log(`Locally authored, no upstream recorded (${pending.locallyAuthored.length}):`);
-    for (const skill of pending.locallyAuthored)
-        console.log(`  ${skill}`);
+        print(pending);
+    else {
+        console.log(`Imported without source (${pending.importedWithoutSource.length}):`);
+        for (const item of pending.importedWithoutSource)
+            console.log(`  ${item.skill}${item.importedAt ? ` (imported ${item.importedAt})` : ''}`);
+        console.log(`Locally authored, no upstream recorded (${pending.locallyAuthored.length}):`);
+        for (const skill of pending.locallyAuthored)
+            console.log(`  ${skill}`);
+    }
+    // Hygiene gate: imported skills without a source cannot get tree-SHA updates.
+    // Locally authored skills are intentional and never trip this flag.
+    if (opts.failOnImported) {
+        const n = pending.importedWithoutSource.length;
+        if (n > 0) {
+            process.stderr.write(`Provenance: ${n} imported skill(s) still missing a source — FAIL (--fail-on-imported); run \`skills-manager provenance adopt\` or \`edit --source-*\`\n`);
+            process.exitCode = 1;
+        }
+        else {
+            process.stderr.write('Provenance: no imported-without-source skills — within hygiene gate\n');
+        }
+    }
 });
 // Hub git-ification for multi-machine sync (ADR-0020): each command thin, git
 // stays the merge tool, and the operator keeps every git decision.
@@ -429,10 +460,17 @@ sync.command('init')
 sync.command('status')
     .description('Read-only sync status: git-ification, remote, dirty files, ahead/behind (last fetch), last sync commit — zero network')
     .option('--json', 'machine-readable output for agents')
+    .option('--share', 'privacy-safe paste card (no hub path / remote URL) for X / HN / chat')
     .action((opts, cmd) => {
     const result = services(cmd).sync.status();
+    if (opts.json && opts.share)
+        throw new Error('use either --json or --share, not both');
     if (opts.json)
         return print(result);
+    if (opts.share) {
+        process.stdout.write(renderSyncShare(result));
+        return;
+    }
     // Read-only probe: no activity record — status itself must not dirty the hub.
     console.log(`hub: ${result.home}`);
     if (!result.gitified) {
@@ -588,17 +626,29 @@ program.command('cost')
     .option('--json', 'machine-readable output for agents')
     .option('--share', 'privacy-safe paste card (no absolute paths) for X / HN / chat')
     .option('--top <n>', 'how many of the most expensive descriptions to list', '5')
+    .option('--budget <tokens>', 'exit 1 when total resident tokens exceed this budget (CI / pre-commit gate)')
     .action((opts, cmd) => {
-    const s = services(cmd);
     const top = Number.parseInt(opts.top, 10);
     if (!Number.isInteger(top) || top < 0)
         throw new Error(`--top expects a non-negative integer, got "${opts.top}"`);
     if (opts.json && opts.share)
         throw new Error('use either --json or --share, not both');
+    const budget = opts.budget === undefined ? null : Number(opts.budget);
+    if (budget !== null && (!Number.isInteger(budget) || budget < 0))
+        throw new Error(`--budget expects a non-negative integer token count, got "${opts.budget}"`);
+    const s = services(cmd);
     const ledger = s.cost.ledger(top);
     if (opts.json)
-        return print(ledger);
-    process.stdout.write(opts.share ? renderCostShare(ledger) : renderCostLedger(ledger));
+        print(ledger);
+    else
+        process.stdout.write(opts.share ? renderCostShare(ledger) : renderCostLedger(ledger));
+    // Budget gate on stderr so stdout (JSON / card) stays script-stable.
+    if (budget !== null) {
+        const over = ledger.totalTokens > budget;
+        process.stderr.write(`Resident budget: ${ledger.totalTokens} / ${budget} tokens — ${over ? 'OVER (exit 1); see Suggestions or run `skills-manager cost` for recalls' : 'within budget'}\n`);
+        if (over)
+            process.exitCode = 1;
+    }
 });
 program.command('add')
     .description('Discover from a source, then install selected skills')
@@ -646,8 +696,11 @@ program.command('update')
     .option('-s, --skill <skill...>', 'skill(s) to update')
     .option('--source <key>', 'source group key from updates plan')
     .option('--plan', 'print update plan (candidates only)')
-    .option('--check', 'run upstream freshness detection: stale / upToDate / failed / skipped per skill (uncalibrated entries adopt their observed anchor, ADR-0013)')
+    .option('--check', 'run upstream freshness detection: stale / upToDate / failed / skipped per skill (git/marketplace: skill subdirectory tree SHA, not whole-repo HEAD; uncalibrated entries adopt their observed anchor, ADR-0013)')
+    .option('--fail-on-stale', 'with --check: also exit 1 when any skill is stale (failed checks already exit 1; CI / hub-freshness gate)')
     .action(async (opts, cmd) => {
+    if (opts.failOnStale && !opts.check)
+        throw new Error('--fail-on-stale requires --check');
     const s = services(cmd);
     if (opts.check) {
         const detection = new DetectionService({ githubApi: new GitHubApiClient(), http: new HttpDownloadClient(), fs: new NodeFileSystem() });
@@ -675,9 +728,22 @@ program.command('update')
                 upToDate.push(skill.name);
         }
         print({ checked: stale.length + failed.length + upToDate.length + skipped.length, stale, upToDate, failed, skipped });
+        // Growth tip (stderr): JSON stdout stays script-stable; the differentiator is the git/marketplace tree-SHA anchor.
+        console.error('Update signal (git/marketplace): skill subdirectory tree SHA — upstream noise outside the skill never lights an update.');
         // A failed check is a failed check — scripts read the exit code (adversary M6).
         if (failed.length > 0)
             process.exitCode = 1;
+        // Optional CI gate: stale skills are informational by default; --fail-on-stale
+        // turns the tree-SHA freshness signal into a nonzero exit (stdout JSON unchanged).
+        if (opts.failOnStale) {
+            if (stale.length > 0) {
+                process.stderr.write(`Update check: ${stale.length} stale skill(s) — FAIL (--fail-on-stale); run \`skills-manager update --plan\` then update\n`);
+                process.exitCode = 1;
+            }
+            else if (failed.length === 0) {
+                process.stderr.write('Update check: no stale skills — within freshness gate\n');
+            }
+        }
         return;
     }
     if (opts.plan || (!opts.skill && !opts.source))
@@ -688,15 +754,139 @@ program.command('update')
     remindSecurityScan(s, result.updated);
     remindStaleTargets(s);
 });
-const audit = program.command('audit').description('Report-only audits over hub skills (security today; more subcommands later)');
+// One exit code for CI: the offline hub gates (security high, imported-without-source)
+// always run; the resident budget and the networked freshness check are opt-in.
+program.command('check')
+    .description('Run the hub CI gates in one go: audit security (high) + provenance (imported-without-source), plus optional --budget, --freshness, --overlap and --descriptions; exit 1 if any gate fails')
+    .option('--budget <tokens>', 'also fail when total resident tokens exceed this budget (same as cost --budget)')
+    .option('--freshness', 'also run update --check (network) and fail on stale or failed detection')
+    .option('--overlap', 'also fail when any two skill descriptions compete (same as audit overlap --strict, threshold 0.3)')
+    .option('--descriptions', 'also fail on error-level description lint findings (same as audit descriptions --strict; warnings never fail)')
+    .option('--json', 'machine-readable gate results')
+    .action(async (opts, cmd) => {
+    const budget = opts.budget === undefined ? null : Number(opts.budget);
+    if (budget !== null && (!Number.isInteger(budget) || budget < 0))
+        throw new Error(`--budget expects a non-negative integer token count, got "${opts.budget}"`);
+    const s = services(cmd);
+    const gates = [];
+    const names = s.registry.listSkills().map((skill) => skill.name);
+    const high = s.security.countHighFindings(s.security.scanSkills(names));
+    gates.push({ gate: 'security', ok: high === 0, detail: `${high} high finding(s) across ${names.length} skill(s)${high ? ' — run `skills-manager audit security --strict`' : ''}` });
+    const imported = s.provenance.pending().importedWithoutSource.length;
+    gates.push({ gate: 'provenance', ok: imported === 0, detail: `${imported} imported skill(s) missing a source${imported ? ' — run `skills-manager provenance adopt`' : ''}` });
+    if (budget !== null) {
+        const total = s.cost.ledger(0).totalTokens;
+        gates.push({ gate: 'budget', ok: total <= budget, detail: `${total} / ${budget} resident tokens${total > budget ? ' — run `skills-manager cost` for recalls' : ''}` });
+    }
+    if (opts.overlap || opts.descriptions) {
+        const inputs = s.registry.listSkills().map((skill) => ({ name: skill.name, description: skill.description }));
+        if (opts.overlap) {
+            const pairs = findDescriptionOverlaps(inputs, 0.3).pairs.length;
+            gates.push({ gate: 'overlap', ok: pairs === 0, detail: `${pairs} competing description pair(s)${pairs ? ' — run `skills-manager audit overlap`' : ''}` });
+        }
+        if (opts.descriptions) {
+            const lint = lintDescriptions(inputs);
+            gates.push({ gate: 'descriptions', ok: lint.errors === 0, detail: `${lint.errors} error(s), ${lint.warnings} warning(s) in skill descriptions${lint.errors ? ' — run `skills-manager audit descriptions`' : ''}` });
+        }
+    }
+    if (opts.freshness) {
+        const detection = new DetectionService({ githubApi: new GitHubApiClient(), http: new HttpDownloadClient(), fs: new NodeFileSystem() });
+        const listed = s.registry.listSkills({ includeArchived: false });
+        const outcomes = await detection.detect(s, listed);
+        let stale = 0;
+        let failed = 0;
+        for (const outcome of outcomes.values()) {
+            if (outcome.detection === 'failed')
+                failed += 1;
+            else if (outcome.detection !== 'skipped' && outcome.hasUpdate)
+                stale += 1;
+        }
+        gates.push({ gate: 'freshness', ok: stale === 0 && failed === 0, detail: `${stale} stale, ${failed} failed (tree-SHA)${stale || failed ? ' — run `skills-manager update --check`' : ''}` });
+    }
+    const ok = gates.every((g) => g.ok);
+    if (opts.json)
+        print({ ok, gates });
+    else {
+        for (const g of gates)
+            console.log(`${g.ok ? 'PASS' : 'FAIL'} ${g.gate}: ${g.detail}`);
+        console.log(`check: ${ok ? 'PASS' : 'FAIL'} (${gates.filter((g) => g.ok).length}/${gates.length} gates)`);
+    }
+    if (!ok)
+        process.exitCode = 1;
+});
+const audit = program.command('audit').description('Report-only audits over hub skills (security, description overlap, description lint)');
 audit.command('security')
-    .description('Scan skill tree(s) for high-signal risks: shell exec, network calls, credential paths, secret-like strings (never blocks)')
+    .description('Scan skill tree(s) for high-signal risks: shell exec, network calls, credential paths, secret-like strings (report-only by default)')
     .argument('[skills...]', 'canonical skill names; omit to scan every non-archived hub skill')
-    .action((skills, _opts, cmd) => {
+    .option('--strict', 'exit 1 when any high-severity finding is present (warn/info never fail; default stays report-only)')
+    .option('--format <format>', 'json (default) or github (Actions ::error/::warning/::notice annotations for the PR file UI)', 'json')
+    .action((skills, opts, cmd) => {
+    const format = opts.format ?? 'json';
+    if (format !== 'json' && format !== 'github') {
+        throw new SkillsManagerError('invalid_format_flag', `--format must be json or github (got ${JSON.stringify(format)})`);
+    }
     const s = services(cmd);
     const names = skills.length > 0 ? skills : s.registry.listSkills().map((skill) => skill.name);
     const reports = s.security.scanSkills(names);
-    print(reports.length === 1 ? reports[0] : reports);
+    if (format === 'github') {
+        const annotations = formatGithubAnnotations(reports);
+        if (annotations)
+            console.log(annotations);
+    }
+    else {
+        print(reports.length === 1 ? reports[0] : reports);
+    }
+    if (opts.strict && s.security.failsStrict(reports))
+        process.exitCode = 1;
+});
+audit.command('overlap')
+    .description('Find skills whose descriptions compete for the same trigger words (the agent may pick the wrong one); offline, report-only')
+    .argument('[skills...]', 'canonical skill names; omit to compare every non-archived hub skill')
+    .option('--threshold <score>', 'minimum overlap score from 0 to 1 to report', '0.3')
+    .option('--strict', 'exit 1 when any pair is reported (CI gate)')
+    .option('--json', 'machine-readable report')
+    .action((skills, opts, cmd) => {
+    const threshold = Number(opts.threshold);
+    if (!/^(0(\.\d+)?|1(\.0+)?|\.\d+)$/.test(opts.threshold) || !(threshold >= 0 && threshold <= 1)) {
+        throw new Error(`--threshold expects a number from 0 to 1, got "${opts.threshold}"`);
+    }
+    const s = services(cmd);
+    const all = s.registry.listSkills();
+    const missing = skills.filter((name) => !all.some((skill) => skill.name === name));
+    if (missing.length > 0)
+        throw new Error(`Skill not found: ${missing.join(', ')}. Run \`skills-manager list\` to see hub skills.`);
+    const picked = skills.length > 0 ? all.filter((skill) => skills.includes(skill.name)) : all;
+    const report = findDescriptionOverlaps(picked.map((skill) => ({ name: skill.name, description: skill.description })), threshold);
+    if (opts.json)
+        print(report);
+    else
+        process.stdout.write(renderOverlapReport(report));
+    if (opts.strict && report.pairs.length > 0) {
+        process.stderr.write(`Overlap: ${report.pairs.length} competing pair(s) — FAIL (--strict); sharpen the descriptions above\n`);
+        process.exitCode = 1;
+    }
+});
+audit.command('descriptions')
+    .description('Lint skill descriptions for what makes them fail to trigger: missing, too long, no "use when", wrong point of view, vague; offline, report-only')
+    .argument('[skills...]', 'canonical skill names; omit to lint every non-archived hub skill')
+    .option('--strict', 'exit 1 when any error-level finding is present (warnings never fail)')
+    .option('--json', 'machine-readable report')
+    .action((skills, opts, cmd) => {
+    const s = services(cmd);
+    const all = s.registry.listSkills();
+    const missing = skills.filter((name) => !all.some((skill) => skill.name === name));
+    if (missing.length > 0)
+        throw new Error(`Skill not found: ${missing.join(', ')}. Run \`skills-manager list\` to see hub skills.`);
+    const picked = skills.length > 0 ? all.filter((skill) => skills.includes(skill.name)) : all;
+    const report = lintDescriptions(picked.map((skill) => ({ name: skill.name, description: skill.description })));
+    if (opts.json)
+        print(report);
+    else
+        process.stdout.write(renderDescriptionLint(report));
+    if (opts.strict && report.errors > 0) {
+        process.stderr.write(`Description lint: ${report.errors} error(s) — FAIL (--strict)\n`);
+        process.exitCode = 1;
+    }
 });
 const distribute = program.command('distribute')
     .description('Distribute hub skills to user or project runtime directories')