feat: cache update check result for 24h (#5)

## Summary

Ports the auto-update check improvement from the private upstream
(commit `eca17a0`) to the public repo, with the `REPO` variable
re-pointed at `chainbase-labs/agentkey`.

### What changed

- `skills/agentkey/SKILL.md` — Step 0 now runs `check-update.sh`
silently before the MCP-tool check; surfaces `UPDATED: vX.Y.Z` /
`UPDATE_FAILED: …` and stays quiet on `UP_TO_DATE`.
- `skills/agentkey/scripts/check-update.sh` — caches the check result in
`TMPDIR` (24h for success, 1h for failure) so repeat skill invocations
are ~10ms instead of ~1.5s. Shallow tag fetch replaces full `--tags`
fetch when applying an update.

### Why

Without caching, every skill invocation blocks ~1.5s on a GitHub API
round-trip. That adds up over a busy session. Caching with TTL retains
the "agent discovers new releases within a day" property without the
per-call cost.

## Test plan

- [x] `bash -n skills/agentkey/scripts/check-update.sh` passes
- [x] `REPO="chainbase-labs/agentkey"` (not `AgentKey-Skill`) — verified
via grep
- [x] commitlint passes on PR title
- [ ] Post-merge: release-please opens a Release PR bumping to v1.1.0
(minor, because `feat:`)

Co-authored-by: 不白 <31078449+Nowhitestar@users.noreply.github.com>

Co-authored-by: lxcong <lxhtheresa@gmail.com>

skills/agentkey/SKILL.md

@@ -8,7 +8,17 @@ version: 1.0.0
 
 <SUBAGENT-CONTEXT>Skip to Query Mode.</SUBAGENT-CONTEXT>
 
-**Step 0 (always run first):** confirm the 4 MCP tools — `list_tools`, `find_tools`, `describe_tool`, `execute_tool` — are visible in the current toolset. If **any** are missing → **Setup** (regardless of what the user asked). Do not attempt Query without all 4.
+**Step 0 (always run first):**
+
+1. Run the auto-update check silently (cached 24h — repeat calls are <10ms):
+   ```bash
+   bash "${CLAUDE_PLUGIN_ROOT:-$HOME/.claude}/skills/agentkey/scripts/check-update.sh" 2>/dev/null
+   ```
+   - `UPDATED: vX.Y.Z` → Tell the user once: "✓ AgentKey Skill updated to vX.Y.Z."
+   - `UPDATE_FAILED: ...` → Show the message verbatim to the user.
+   - `UP_TO_DATE` or empty → continue silently.
+
+2. Confirm the 4 MCP tools — `list_tools`, `find_tools`, `describe_tool`, `execute_tool` — are visible in the current toolset. If **any** are missing → **Setup** (regardless of what the user asked). Do not attempt Query without all 4.
 
 Then route by intent:
 - "setup"/"install"/"api key"/"reinstall" → **Setup**

skills/agentkey/scripts/check-update.sh

@@ -1,43 +1,70 @@
 #!/bin/bash
 # AgentKey — Auto-update to latest GitHub Release.
-# Outputs: UP_TO_DATE | UPDATED: vX.Y.Z | UPDATE_FAILED: <reason>
+# Result cached in TMPDIR to keep repeat skill invocations fast.
+# Outputs a single line: UP_TO_DATE | UPDATED: vX.Y.Z | UPDATE_FAILED: <reason>
 
 REPO="chainbase-labs/agentkey"
+CACHE_TTL_SUCCESS=86400   # 24h for UP_TO_DATE
+CACHE_TTL_FAILURE=3600    # 1h for UPDATE_FAILED (retry sooner)
+CURL_TIMEOUT=3
 
-# Locate plugin root: prefer ${CLAUDE_PLUGIN_ROOT}, fall back to relative path from script
 PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." 2>/dev/null && pwd)}"
 VERSION_FILE="$PLUGIN_ROOT/version"
+CACHE_FILE="${TMPDIR:-/tmp}/agentkey-update-check"
 
-LOCAL_VERSION=$(cat "$VERSION_FILE" 2>/dev/null | tr -d '[:space:]')
+LOCAL_VERSION=$(tr -d '[:space:]' < "$VERSION_FILE" 2>/dev/null)
 if [ -z "$LOCAL_VERSION" ]; then
     echo "UP_TO_DATE"
     exit 0
 fi
 
-# Fetch latest release tag from GitHub API
-LATEST_TAG=$(curl -sf --max-time 5 \
-    "https://api.github.com/repos/$REPO/releases/latest" \
-    2>/dev/null | grep '"tag_name"' | head -1 | sed 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
-
-LATEST_VERSION=$(echo "$LATEST_TAG" | sed 's/^[vV]//')
-
-if [ -z "$LATEST_VERSION" ]; then
-    echo "UP_TO_DATE"  # Can't reach GitHub — proceed silently
-    exit 0
+# Fast path: recent cache hit — avoids the GitHub API round-trip (~1.5s).
+if [ -f "$CACHE_FILE" ]; then
+    MTIME=$(stat -f %m "$CACHE_FILE" 2>/dev/null || stat -c %Y "$CACHE_FILE" 2>/dev/null || echo 0)
+    AGE=$(( $(date +%s) - MTIME ))
+    case "$(head -1 "$CACHE_FILE" 2>/dev/null)" in
+        "UPDATE_FAILED:"*) TTL=$CACHE_TTL_FAILURE ;;
+        *)                 TTL=$CACHE_TTL_SUCCESS ;;
+    esac
+    if [ "$AGE" -ge 0 ] && [ "$AGE" -lt "$TTL" ]; then
+        cat "$CACHE_FILE"
+        exit 0
+    fi
 fi
 
-if [ "$LOCAL_VERSION" = "$LATEST_VERSION" ]; then
+# Remote check — fetch latest release tag.
+LATEST_TAG=$(curl -sf --max-time "$CURL_TIMEOUT" \
+    "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null \
+    | grep -m1 '"tag_name"' \
+    | sed 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
+LATEST_VERSION=${LATEST_TAG#[vV]}
+
+# Network failure — stay silent; skip caching so we retry on the next call.
+if [ -z "$LATEST_VERSION" ]; then
     echo "UP_TO_DATE"
     exit 0
 fi
 
-# Newer version available — attempt auto-update via git
+# Already current.
+if [ "$LOCAL_VERSION" = "$LATEST_VERSION" ]; then
+    echo "UP_TO_DATE" > "$CACHE_FILE" 2>/dev/null
+    echo "UP_TO_DATE"
+    exit 0
+fi
+
+# Newer version available — attempt git auto-update.
+# Shallow-fetch only the target tag (not all tags) for speed.
 if [ -d "$PLUGIN_ROOT/.git" ]; then
-    git -C "$PLUGIN_ROOT" fetch --quiet --tags origin 2>/dev/null || true
-    if git -C "$PLUGIN_ROOT" checkout --quiet "$LATEST_TAG" 2>/dev/null; then
+    if git -C "$PLUGIN_ROOT" fetch --quiet --depth=1 origin \
+           "+refs/tags/$LATEST_TAG:refs/tags/$LATEST_TAG" 2>/dev/null \
+       && git -C "$PLUGIN_ROOT" checkout --quiet "$LATEST_TAG" 2>/dev/null; then
+        # After a successful checkout, subsequent checks are UP_TO_DATE.
+        echo "UP_TO_DATE" > "$CACHE_FILE" 2>/dev/null
         echo "UPDATED: v$LATEST_VERSION"
         exit 0
     fi
 fi
 
-echo "UPDATE_FAILED: Run \`/plugin update agentkey\` to update to v$LATEST_VERSION"
+MSG="UPDATE_FAILED: Run \`/plugin update agentkey\` to update to v$LATEST_VERSION"
+echo "$MSG" > "$CACHE_FILE" 2>/dev/null
+echo "$MSG"