feat(site): refresh community demos

README.md

@@ -25,12 +25,12 @@ responses that reach the model before they cost you — while keeping the Shell,
 Agent framework, and sandbox you already run.
 
 [中文版](README_zh.md) · [Website](https://agentic-os.sh/) ·
-[Quick Start](docs/QUICKSTART.md) ·
-[User Guide](docs/user-guide/en/README.md) ·
-[Contributing](CONTRIBUTING.md)
+[Quick Start](https://agentic-os.sh/docs/quickstart/) ·
+[User Guide](https://agentic-os.sh/docs/user-guide/) ·
+[Contributing](https://github.com/alibaba/anolisa/blob/main/CONTRIBUTING.md)
 
-[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
-[![Platform](https://img.shields.io/badge/Platform-Linux%20%7C%20macOS-lightgrey.svg)](docs/user-guide/en/installation.md)
+[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://github.com/alibaba/anolisa/blob/main/LICENSE)
+[![Platform](https://img.shields.io/badge/Platform-Linux%20%7C%20macOS-lightgrey.svg)](https://agentic-os.sh/docs/user-guide/installation/)
 
 </div>
 
@@ -42,12 +42,42 @@ execution environments. Keep the Shell, Agent framework, and sandbox you
 already use. ANOLISA CLI provides a single installation entry point, while each
 capability can be enabled independently.
 
-<p align="center">
-  <img
-    src="docs/images/readme/highlights.png"
-    alt="ANOLISA product highlights"
-  />
-</p>
+**New to ANOLISA?**
+[Choose your first outcome in the Quick Start →](https://agentic-os.sh/docs/quickstart/)
+
+## Components
+
+<table width="100%">
+  <thead>
+    <tr>
+      <th width="340">Agent entry</th>
+      <th width="340">Context efficiency</th>
+      <th width="340">Runtime &amp; security</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/user-entrypoint/cosh-ng/quickstart/">cosh-ng</a></strong><br><sub>Shell copilot</sub></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/token-saving/tokenless/quickstart/">Token-less</a></strong><br><sub>Tool-output compression</sub></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/runtime/ws-ckpt/">ws-ckpt</a></strong><br><sub>Checkpoint and rollback</sub></td>
+    </tr>
+    <tr>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/user-entrypoint/os-skills/">OS Skills</a></strong><br><sub>System and DevOps expertise</sub></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/agent-observability/agentsight/">AgentSight</a></strong><br><sub>Trace and Token visibility</sub></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/runtime/skillfs/">SkillFS</a></strong><br><sub>Focused Skill views</sub></td>
+    </tr>
+    <tr>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/user-entrypoint/ktuner/">ktuner</a></strong><br><sub>Kernel tuning</sub></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/token-saving/agent-memory/">Agent Memory</a></strong><br><sub>Cross-session memory</sub></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/agent-security/agent-sec-core/quickstart/">Agent Sec Core</a></strong><br><sub>Sandbox and verification</sub></td>
+    </tr>
+    <tr>
+      <td></td>
+      <td></td>
+      <td><strong><a href="https://agentic-os.sh/docs/user-guide/runtime/blaze/">Blaze</a></strong><br><sub>Sandbox lifecycle</sub></td>
+    </tr>
+  </tbody>
+</table>
 
 ## What it solves
 
@@ -60,17 +90,20 @@ then adds an Agent that can understand intent, use tools and Skills, and ask
 for approval before risky work. Shell commands and natural language share one
 terminal instead of forcing users into a separate chat application.
 
-[Get started with cosh-ng →](docs/user-guide/en/user-entrypoint/cosh-ng/QUICKSTART.md)
+[Get started with cosh-ng →](https://agentic-os.sh/docs/user-guide/user-entrypoint/cosh-ng/quickstart/)
 
 <p align="center"><strong>02 · CONTEXT EFFICIENCY</strong></p>
 
 <h3 align="center">See where Tokens go and cut waste before it reaches the model</h3>
 
 Token-less removes redundancy from tool schemas and responses.
-[Agent Memory](src/agent-memory/README.md) reuses context across sessions,
-[SkillFS](src/skillfs/README.md) exposes Skills as views and mounts them on
+[Agent Memory](https://agentic-os.sh/docs/user-guide/token-saving/agent-memory/)
+reuses context across sessions,
+[SkillFS](https://agentic-os.sh/docs/user-guide/runtime/skillfs/) exposes Skills
+as views and mounts them on
 demand so only the relevant ones enter the context, and
-[AgentSight](src/agentsight/README.md) records where Tokens are actually spent.
+[AgentSight](https://agentic-os.sh/docs/user-guide/agent-observability/agentsight/)
+records where Tokens are actually spent.
 
 ### Try Token-less with Claude Code in 3 minutes
 
@@ -113,13 +146,6 @@ tokenless stats list --limit 5
   </sub>
 </p>
 
-<p align="center">
-  <img
-    src="docs/images/readme/tokenless-response.png"
-    alt="Token-less response compression in the terminal"
-  />
-</p>
-
 `debug` and `trace` are dropped by the field blacklist, `metadata` as null, and
 `tags` / `extra` as empty values. Compression runs between the Agent and the
 model, so no Agent framework code changes. Dropped array items stay retrievable
@@ -131,18 +157,42 @@ through a `<<tokenless:KEY>>` marker, which keeps the compression reversible.
 | ResponseCompressor · 46.85 µs | SchemaCompressor · 11.44 µs | 198.91 µs |
 
 Savings apply to the tool responses entering the context, not to the whole
-session bill — the [Token-less README](src/tokenless/README.md) explains how to
-estimate the effect for a given workload.
+session bill. The [Token-less user manual](https://agentic-os.sh/docs/user-guide/token-saving/tokenless/user-manual/)
+explains how to estimate the effect for a given workload.
 
 <p align="center"><strong>03 · EXECUTION RUNTIME</strong></p>
 
 <h3 align="center">Give every Agent execution a boundary and a way back</h3>
 
 ANOLISA is building out the Agent execution environment:
-[Agent Sec Core](src/agent-sec-core/README.md) isolates risky operations, and
-[ws-ckpt](src/ws-ckpt/README.md) keeps recovery points for workspace changes.
+[Agent Sec Core](https://agentic-os.sh/docs/user-guide/agent-security/agent-sec-core/quickstart/)
+isolates risky operations, and
+[ws-ckpt](https://agentic-os.sh/docs/user-guide/runtime/ws-ckpt/) keeps recovery
+points for workspace changes.
+
+### Catch a changed Skill before it runs
+
+When a signed Skill changes, the Agent reports `drifted` before using it again.
+A rescan records blocking findings as `deny`.
+
+[Try the Agent demo →](https://agentic-os.sh/docs/user-guide/agent-security/agent-sec-core/qoder-skill-ledger-demo/)
+· [Skill Ledger guide](https://agentic-os.sh/docs/user-guide/agent-security/agent-sec-core/skill-ledger/)
+
+<table align="center" cellpadding="0" cellspacing="0">
+  <tr>
+    <td>
+      <video
+        controls
+        muted
+        poster="docs/images/readme/skill-ledger-demo-cover.jpg"
+        src="https://github.com/user-attachments/assets/12893b92-db86-438f-bbae-d3f76c122f6b"
+      ></video>
+    </td>
+  </tr>
+</table>
 
-[Start with ANOLISA CLI →](docs/user-guide/en/user-entrypoint/anolisa-cli.md)
+[Choose a runtime or security starting point →](https://agentic-os.sh/docs/quickstart/)
+· [Start with ANOLISA CLI](https://agentic-os.sh/docs/user-guide/user-entrypoint/anolisa-cli/)
 
 ## Install
 
@@ -159,16 +209,16 @@ anolisa install tokenless
 Run `cosh` to enter the AI-native terminal. Token-less can also optimize tool
 calls from an existing Agent without changing its framework.
 
-[Read the Quick Start →](docs/QUICKSTART.md)
+[Read the Quick Start →](https://agentic-os.sh/docs/quickstart/)
 
 ## Documentation
 
-[Quick Start](docs/QUICKSTART.md) ·
-[Installation](docs/user-guide/en/installation.md) ·
-[User Guide](docs/user-guide/en/README.md) ·
-[Troubleshooting](docs/user-guide/en/troubleshooting.md) ·
-[Build from Source](docs/BUILDING.md) ·
-[Changelog](CHANGELOG.md)
+[Quick Start](https://agentic-os.sh/docs/quickstart/) ·
+[Installation](https://agentic-os.sh/docs/user-guide/installation/) ·
+[User Guide](https://agentic-os.sh/docs/user-guide/) ·
+[Troubleshooting](https://agentic-os.sh/docs/user-guide/troubleshooting/) ·
+[Build from Source](https://agentic-os.sh/docs/building/) ·
+[Changelog](https://agentic-os.sh/changelog/)
 
 ## Community
 
@@ -182,9 +232,12 @@ Scan with DingTalk to join the ANOLISA community.
 
 - [Open an issue](https://github.com/alibaba/anolisa/issues) for bugs and
   feature requests.
-- Read [CONTRIBUTING.md](CONTRIBUTING.md) before submitting a pull request.
-- Report vulnerabilities through the [Security Policy](SECURITY.md).
+- Read [CONTRIBUTING.md](https://github.com/alibaba/anolisa/blob/main/CONTRIBUTING.md)
+  before submitting a pull request.
+- Report vulnerabilities through the
+  [Security Policy](https://github.com/alibaba/anolisa/blob/main/SECURITY.md).
 
 ## License
 
-ANOLISA is released under the [Apache License 2.0](LICENSE).
+ANOLISA is released under the
+[Apache License 2.0](https://github.com/alibaba/anolisa/blob/main/LICENSE).

README_zh.md

@@ -23,13 +23,13 @@
 让 Agent 在你的终端里直接指挥系统干活，并在工具响应进入模型之前去掉冗余，
 同时保留你现有的 Shell、Agent 框架和沙箱。
 
-[English](README.md) · [项目网站](https://agentic-os.sh/) ·
-[快速开始](docs/QUICKSTART_zh.md) ·
-[用户指南](docs/user-guide/zh/README.md) ·
-[参与贡献](CONTRIBUTING_zh.md)
+[English](README.md) · [项目网站](https://agentic-os.sh/zh/) ·
+[快速开始](https://agentic-os.sh/zh/docs/quickstart/) ·
+[用户指南](https://agentic-os.sh/zh/docs/user-guide/) ·
+[参与贡献](https://github.com/alibaba/anolisa/blob/main/CONTRIBUTING_zh.md)
 
-[![许可证](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
-[![平台](https://img.shields.io/badge/Platform-Linux%20%7C%20macOS-lightgrey.svg)](docs/user-guide/zh/installation.md)
+[![许可证](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://github.com/alibaba/anolisa/blob/main/LICENSE)
+[![平台](https://img.shields.io/badge/Platform-Linux%20%7C%20macOS-lightgrey.svg)](https://agentic-os.sh/zh/docs/user-guide/installation/)
 
 </div>
 
@@ -39,12 +39,42 @@ ANOLISA 是面向 AI Agent 工作负载的服务端操作系统层。它从终
 开销和执行环境三个方向解决 Agent 运行中的关键问题，同时保留现有的 Shell、
 Agent 框架和沙箱。ANOLISA CLI 提供统一的安装入口，各项能力可以按需启用。
 
-<p align="center">
-  <img
-    src="docs/images/readme/highlights-zh.png"
-    alt="终端原生、工具响应 Token 减少 62.9%、一行安装"
-  />
-</p>
+**第一次使用 ANOLISA？**
+[从快速入门选择你的第一个目标 →](https://agentic-os.sh/zh/docs/quickstart/)
+
+## 组件
+
+<table width="100%">
+  <thead>
+    <tr>
+      <th width="340">Agent 入口</th>
+      <th width="340">上下文效率</th>
+      <th width="340">运行与安全</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/user-entrypoint/cosh-ng/quickstart/">cosh-ng</a></strong><br><sub>Shell AI 副驾</sub></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/token-saving/tokenless/quickstart/">Token-less</a></strong><br><sub>压缩工具输出</sub></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/runtime/ws-ckpt/">ws-ckpt</a></strong><br><sub>检查点与回滚</sub></td>
+    </tr>
+    <tr>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/user-entrypoint/os-skills/">OS Skills</a></strong><br><sub>系统与 DevOps 经验</sub></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/agent-observability/agentsight/">AgentSight</a></strong><br><sub>轨迹与 Token 观测</sub></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/runtime/skillfs/">SkillFS</a></strong><br><sub>聚焦的 Skill 视图</sub></td>
+    </tr>
+    <tr>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/user-entrypoint/ktuner/">ktuner</a></strong><br><sub>内核调优</sub></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/token-saving/agent-memory/">Agent Memory</a></strong><br><sub>跨会话记忆</sub></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/agent-security/agent-sec-core/quickstart/">Agent Sec Core</a></strong><br><sub>沙箱与安全校验</sub></td>
+    </tr>
+    <tr>
+      <td></td>
+      <td></td>
+      <td><strong><a href="https://agentic-os.sh/zh/docs/user-guide/runtime/blaze/">Blaze</a></strong><br><sub>沙箱生命周期</sub></td>
+    </tr>
+  </tbody>
+</table>
 
 ## 解决什么问题
 
@@ -56,15 +86,17 @@ cosh-ng 是面向 AI 时代重构的 Linux 终端。它保留熟悉的 Bash/Zsh
 能理解意图、调用工具与 Skills、并在高风险操作前请求确认的 Agent。Shell 命令和
 自然语言共用一个终端，不必切换到独立的聊天应用。
 
-[开始使用 cosh-ng →](docs/user-guide/zh/user-entrypoint/cosh-ng/QUICKSTART.md)
+[开始使用 cosh-ng →](https://agentic-os.sh/zh/docs/user-guide/user-entrypoint/cosh-ng/quickstart/)
 
 <p align="center"><strong>02 · CONTEXT EFFICIENCY</strong></p>
 
 <h3 align="center">看清 Token 去向，在内容进入模型前减少无效消耗</h3>
 
-Token-less 去掉工具 Schema 和响应中的冗余，[Agent Memory](src/agent-memory/README_zh.md)
-复用跨会话信息，[SkillFS](src/skillfs/README_zh.md) 按视图暴露、按需挂载
-Skills，只把用得到的技能放进上下文，[AgentSight](src/agentsight/README_zh.md)
+Token-less 去掉工具 Schema 和响应中的冗余，
+[Agent Memory](https://agentic-os.sh/zh/docs/user-guide/token-saving/agent-memory/)
+复用跨会话信息，[SkillFS](https://agentic-os.sh/zh/docs/user-guide/runtime/skillfs/)
+按视图暴露、按需挂载 Skills，只把用得到的技能放进上下文，
+[AgentSight](https://agentic-os.sh/zh/docs/user-guide/agent-observability/agentsight/)
 记录 Token 实际花在哪。
 
 ### 使用 Claude Code，3 分钟体验 Token-less
@@ -108,13 +140,6 @@ tokenless stats list --limit 5
   </sub>
 </p>
 
-<p align="center">
-  <img
-    src="docs/images/readme/tokenless-response.png"
-    alt="终端中的 Token-less 响应压缩"
-  />
-</p>
-
 `debug`、`trace` 命中字段黑名单，`metadata` 为 null，`tags` / `extra` 为空值，
 均被移除。压缩在 Agent 与模型之间执行，无需改动 Agent 框架代码；被截断的数组
 元素可通过 `<<tokenless:KEY>>` 标记取回，压缩过程可逆。
@@ -125,17 +150,40 @@ tokenless stats list --limit 5
 | ResponseCompressor · 46.85 µs | SchemaCompressor · 11.44 µs | 198.91 µs |
 
 节省比例针对进入上下文的工具响应，不代表整个会话的账单。具体工作负载的估算方法
-见 [Token-less README](src/tokenless/README_zh.md)。
+见 [Token-less 用户手册](https://agentic-os.sh/zh/docs/user-guide/token-saving/tokenless/user-manual/)。
 
 <p align="center"><strong>03 · EXECUTION RUNTIME</strong></p>
 
 <h3 align="center">让 Agent 的每次执行都有边界，也留有退路</h3>
 
 ANOLISA 正在完善面向 Agent 的执行环境。
-[Agent Sec Core](src/agent-sec-core/README_zh.md) 隔离高风险操作，
-[ws-ckpt](src/ws-ckpt/README_zh.md) 为工作区变更保留恢复点。
+[Agent Sec Core](https://agentic-os.sh/zh/docs/user-guide/agent-security/agent-sec-core/quickstart/)
+隔离高风险操作，[ws-ckpt](https://agentic-os.sh/zh/docs/user-guide/runtime/ws-ckpt/)
+为工作区变更保留恢复点。
+
+### 在 Skill 运行前发现它已被改动
+
+已签名的 Skill 发生变化后，Agent 会在再次调用前报告 `drifted`。
+重新扫描发现阻断级风险时，新版本记录为 `deny`。
+
+[查看 Agent 演示 →](https://agentic-os.sh/zh/docs/user-guide/agent-security/agent-sec-core/qoder-skill-ledger-demo/)
+· [Skill Ledger 手册](https://agentic-os.sh/zh/docs/user-guide/agent-security/agent-sec-core/skill-ledger/)
+
+<table align="center" cellpadding="0" cellspacing="0">
+  <tr>
+    <td>
+      <video
+        controls
+        muted
+        poster="docs/images/readme/skill-ledger-demo-cover.jpg"
+        src="https://github.com/user-attachments/assets/12893b92-db86-438f-bbae-d3f76c122f6b"
+      ></video>
+    </td>
+  </tr>
+</table>
 
-[通过 ANOLISA CLI 开始 →](docs/user-guide/zh/user-entrypoint/anolisa-cli.md)
+[选择运行与安全能力的开始位置 →](https://agentic-os.sh/zh/docs/quickstart/)
+· [通过 ANOLISA CLI 开始](https://agentic-os.sh/zh/docs/user-guide/user-entrypoint/anolisa-cli/)
 
 ## 安装
 
@@ -152,16 +200,16 @@ anolisa install tokenless
 运行 `cosh` 进入 AI 原生终端。Token-less 也可直接优化现有 Agent 的工具调用，
 无需更换 Agent 框架。
 
-[查看快速开始 →](docs/QUICKSTART_zh.md)
+[查看快速开始 →](https://agentic-os.sh/zh/docs/quickstart/)
 
 ## 文档
 
-[快速开始](docs/QUICKSTART_zh.md) ·
-[安装指南](docs/user-guide/zh/installation.md) ·
-[用户指南](docs/user-guide/zh/README.md) ·
-[故障排查](docs/user-guide/zh/troubleshooting.md) ·
-[源码构建](docs/BUILDING_zh.md) ·
-[变更日志](CHANGELOG_zh.md)
+[快速开始](https://agentic-os.sh/zh/docs/quickstart/) ·
+[安装指南](https://agentic-os.sh/zh/docs/user-guide/installation/) ·
+[用户指南](https://agentic-os.sh/zh/docs/user-guide/) ·
+[故障排查](https://agentic-os.sh/zh/docs/user-guide/troubleshooting/) ·
+[源码构建](https://agentic-os.sh/zh/docs/building/) ·
+[变更日志](https://agentic-os.sh/zh/changelog/)
 
 ## 社区
 
@@ -174,9 +222,12 @@ anolisa install tokenless
 </div>
 
 - 遇到问题或有新的 Agent 场景，欢迎[提交 Issue](https://github.com/alibaba/anolisa/issues)。
-- 提交 Pull Request 前，请先阅读[贡献指南](CONTRIBUTING_zh.md)。
-- 安全问题请通过[安全策略](SECURITY.md)中的渠道报告。
+- 提交 Pull Request 前，请先阅读
+  [贡献指南](https://github.com/alibaba/anolisa/blob/main/CONTRIBUTING_zh.md)。
+- 安全问题请通过
+  [安全策略](https://github.com/alibaba/anolisa/blob/main/SECURITY.md)中的渠道报告。
 
 ## 许可证
 
-ANOLISA 基于 [Apache License 2.0](LICENSE) 发布。
+ANOLISA 基于
+[Apache License 2.0](https://github.com/alibaba/anolisa/blob/main/LICENSE) 发布。

docs/user-guide/en/agent-security/agent-sec-core/QUICKSTART.md

@@ -205,6 +205,14 @@ agent-sec-cli skill-ledger show /path/to/skill
 agent-sec-cli skill-ledger export /path/to/skill --output /tmp/export/
 ```
 
+#### Try the pre-use check in Qoder
+
+The Qoder adapter checks signed status before a local `Skill` Tool invocation.
+Use a deterministic test Skill to see `pass`, `drifted`, and `deny`, then cancel
+the invocation before the changed instructions run.
+
+[Open the complete Qoder Skill Ledger demo](./qoder-skill-ledger-demo.md)
+
 ### PII Checker
 
 Detects personal information and credentials in text input.