From 4e6ae9036ad2f5b4fe790b1d66e326084a397c4e Mon Sep 17 00:00:00 2001
From: John Qiu <qiudl@zhiyuncai.com>
Date: Sat, 22 Aug 2026 08:53:46 +0930
Subject: [PATCH] fix(installer): detect same-metadata content updates

---
 install-skills.sh            | 2 +-
 tests/install-skills.test.sh | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/install-skills.sh b/install-skills.sh
index c516efd..32d93c9 100755
--- a/install-skills.sh
+++ b/install-skills.sh
@@ -365,7 +365,7 @@ install_plugin() {
     else
       mkdir -p "$dst_dir"
       # rsync resolved source (handles nested skills/ structures)
-      rsync -a --delete "$src_dir/" "$dst_dir/"
+      rsync -a --checksum --delete "$src_dir/" "$dst_dir/"
       state_set "$install_name" "$version" "$effective_install_type" "$source_digest"
       ok "$install_name → skill (v$version)"
       INSTALL_ACTION=true
diff --git a/tests/install-skills.test.sh b/tests/install-skills.test.sh
index 722570f..0a1ff88 100755
--- a/tests/install-skills.test.sh
+++ b/tests/install-skills.test.sh
@@ -42,6 +42,9 @@ description: Installer fixture version two.
 ---
 version two
 EOF
+# Reproduce rsync's quick-check edge case: changed content with identical size
+# and mtime must still replace the recorded, unmodified installation.
+touch -r "$TEST_HOME/.agents/skills/example/SKILL.md" "$FIXTURE_REPO/skills-dev/example-plugin/skills/SKILL.md"
 HOME="$TEST_HOME" "$FIXTURE_REPO/install-skills.sh" >/dev/null
 grep -q 'version two' "$TEST_HOME/.agents/skills/example/SKILL.md"
 grep -q '"version": "2.0.0"' "$TEST_HOME/.agents/.ai-proj-helper-installed-skills.json"