xingkongliang/skills-manager v1.36.2 on GitHub

Skills Manager v1.36.2

发布日期：2026-09-05
递交范围：v1.36.1...v1.36.2

从 tag 安装的 skill（.../tree/v1.2.3/...）不再常驻「检查失败」。安装一直是接受 tag 的，但检查更新只按同名分支去找，找不到，所以重试多少次都不会好。
私有仓库的 skill 现在可以在桌面端检查更新和安装。此前会报 libgit2 的原文「remote authentication required but no callback set」，而同样的 skill 用命令行却正常——因为应用没有给 git 提供取凭据的途径。现在依次从应用钥匙串、系统的 git 凭据助手（osxkeychain / Git Credential Manager / libsecret）、ssh-agent 获取。
取不到凭据时，提示会说明是哪个主机需要登录，而不是抛出 libgit2 的错误码。
tag 来源不再每次检查更新都重新下载整个仓库。
技能详情页的来源字段此前固定标为「分支」，即使值是 tag；现在显示「分支 / 标签」。

两处 revision 解析改为跨 refs/heads 与 refs/tags 按完整 ref 名精确匹配，优先级为分支 → annotated tag 的 peeled commit → tag 对象。此前「取 ls-remote 输出的第一行」会拿到 annotated tag 的对象 sha，导致每次检查都误报有更新。
tree URL 消歧同时列出 tag，并放在第二轮匹配——分支优先，避免名为 main/v1 的 tag 抢走本该是分支 main 加子路径的 URL。
git2 的 clone 回退现在能检出 tag：初始化空仓库后直接浅取 tag ref，而不是先 clone 默认分支再多下一份快照。
git_fetcher 里三处 git2 网络入口全部接入凭据回调，而不只是报告点名的那一处——另两处是 clone 路径，只修一处会导致私有来源「查得动、装不上」。钥匙串改为在回调内部读取，公开来源不再触碰钥匙串。
备份引擎 git2_engine 保持不动：它有自己的凭据路径且已在生产运行，不因此缺陷去改动它。
新增测试覆盖 ref 优先级、annotated 与 lightweight tag、分支优先的消歧规则，以及凭据回调。三个依赖网络的测试默认 ignored，其中一个会清空 PATH，用于验证无 git 机器上的回退链路。

English release notes

Release date: 2026-09-05
Commit range: v1.36.1...v1.36.2

Two git source fixes: a skill pinned to a tag no longer fails its update check forever, and skills hosted on a private repository work in the desktop app.

A skill installed from a tag (.../tree/v1.2.3/...) no longer shows a permanent "check failed" badge. Installation always accepted a tag, but the update check looked for a branch of that name and never found one, so the failure could not be cleared by retrying.
Skills on a private repository can now be checked and installed from the desktop app. They previously failed with libgit2's own wording — "remote authentication required but no callback set" — while the same skills worked from the CLI, because the app never handed git a way to obtain credentials. Credentials now come from the app's keychain entry, your git credential helper (osxkeychain, Git Credential Manager, libsecret), or ssh-agent.
When no credentials are available, the message says which host needs a sign-in instead of quoting a libgit2 error code.
A tag source no longer re-downloads its repository on every update check.
The skill detail panel labelled the source ref "Branch" even when it held a tag; it now reads "Branch / Tag".

Both revision resolvers match refs by exact name across refs/heads and refs/tags, preferring a branch, then an annotated tag's peeled commit, then the tag object. Taking the first line of ls-remote output would have adopted an annotated tag's object sha and reported an update on every check.
Tree-URL disambiguation lists tags as well as heads, matched in a second pass so a tag cannot claim a URL a branch explains.
The git2 clone fallback can check out a tag: it inits an empty repository and shallow-fetches the tag ref, rather than cloning the default branch first.
All three git2 network entry points in git_fetcher install credentials, not just the one the bug report named — the two clone paths meant a private source could be diagnosed but not installed. The keychain is read from inside the callback, so a public source no longer touches it at all.
The backup engine (git2_engine) is deliberately untouched; it has its own credentials path already in production.
New tests cover ref ordering, annotated vs lightweight tags, branch-beats-tag disambiguation, and the credentials callback. Three network-dependent tests are ignored by default; one of them empties PATH to exercise the fallback on a machine with no git.

✅ Cross-platform build passed (macOS Intel / macOS ARM / Windows x64 / Linux x64 / Linux ARM64)
✅ TypeScript typecheck passed

Full changelog files: English | 中文