feat: support ssh urls in lock file

[kopfrechner]

Description

Fixes SSH URL support for lock file tracking and improves UX for skills that cannot be automatically checked for updates. SSH URLs (e.g., git@gitlab.com:owner/repo.git) were already documented and supported for installation, but skills installed via SSH were not being tracked in .skill-lock.json, preventing update checking and updates.

Problem

The README already documents SSH URLs as a supported installation method:

# Any git URL
npx skills add git@github.com:vercel-labs/agent-skills.git

However, getOwnerRepo() only handled HTTP(S) URLs, causing SSH-installed skills to:

• ✅ Install successfully
• ❌ Not appear in .skill-lock.json
• ❌ Not work with npx skills check
• ❌ Not work with npx skills update

Additionally, when skills couldn't be checked for updates (Git SSH, local paths, etc.), users received no guidance on how to update them manually.

Solution

Part 1: SSH URL Tracking

• Added SSH URL pattern matching to getOwnerRepo() to extract the owner/repo path from SSH URLs
• Works with GitHub, GitLab (including subgroups), and custom Git hosts

Part 2: UX Improvements

• npx skills check now shows skills that cannot be checked automatically
• Displays reason for each skill (e.g., "Git SSH (hash tracking not implemented)", "Local path")
• Provides exact manual update command: npx skills add <url> -g -y
• npx skills update shows similar hints when no trackable skills are found

Changes

• Added SSH URL support in getOwnerRepo() for git@host:path/to/repo.git format
• Updated test to reflect new behavior
• Added comprehensive test coverage for SSH URL formats (GitHub, GitLab, custom hosts)
• Enhanced runCheck() to collect and display non-trackable skills with helpful hints
• Enhanced runUpdate() to show manual update commands for non-trackable skills
• Uses hash-based detection instead of hardcoded source type checks

Testing

Manual testing:

• Installed GitLab skill via SSH URL → appears in lock file ✅
• npx skills check shows helpful hint with manual update command ✅
• npx skills update shows helpful hint with manual update command ✅

Unit tests:

• All tests passing in source-parser.test.ts
• New tests for SSH URL formats:
  • GitHub SSH URLs
  • GitLab SSH URLs with subgroups
  • Custom Git host SSH URLs
  • Edge cases (missing .git, no path, etc.)

Example Output

Before:

$ npx skills check
No GitHub skills to check.

After:

$ npx skills check
No GitHub skills to check.

1 skill(s) cannot be checked automatically:
  • hello-world (Git SSH (hash tracking not implemented))
    To update: npx skills add git@gitlab.com:hello-world/... -g -y

Additional Context

Git history shows SSH support was never intentionally excluded - the original getOwnerRepo() implementation used a regex pattern that only matched HTTP(S) URLs (with / after .com), while SSH URLs use : (e.g., git@github.com:owner/repo). The test "SSH format returns null" was added to document the existing behavior, not as a design decision to exclude SSH.

This change enables future enhancements like GitLab API integration for update checking.

[vercel]

@kopfrechner is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.