@1aboveio/skills 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,31 @@
-# Temporary Holding Version
+# @1aboveio/skills
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Every 1aboveio skill package in one: install once, then choose which packages Pi loads with npx @1aboveio/skills select.
+
+## Install
+
+```sh
+pi install npm:@1aboveio/skills
+npx @1aboveio/skills                   # choose packages interactively
+npx @1aboveio/skills engineering cicd  # or name them
+```
+
+The command writes a Pi package filter (`skills/<package>/**`) to `~/.pi/agent/settings.json`
+(`--local`: the project's `.pi/settings.json`), adds core when a chosen package uses it, and
+hides Skills CLI copies of the loaded skills from Pi so these versions win. Until you run it,
+Pi loads every package. `pi config` toggles single skills.
+
+Each package also publishes on its own; install either this bundle or the packages, not both.
+
+## Packages
+
+| Package | Also published as | Skills |
+|---|---|---|
+| `core` | `@1aboveio/core-skills` | distill-writing, doc-to-md, editorial-review, house-style, polish-cn, reg-parser, terminology, write-doc |
+| `engineering` | `@1aboveio/engineering-skills` | better-review, e2e-test, engineering-runtime, ensure-coverage, golden-path, harness-runtime, resolve-issues, resolve-release, rush-issues, rush-release, test-quality |
+| `cicd` | `@1aboveio/cicd-skills` | cloud-build, cloud-debug, cloud-deploy, docker, github-actions, github-flow, google-cloud, mergify, podman |
+| `app-dev` | `@1aboveio/app-dev-skills` | airflow, android-foundation, app-debug, better-auth, data-catalog, ios-foundation, monorepo, nextjs-fullstack, prisma-setup, pyspark, python-backend, shadcn, zod-v4 |
+| `risk-compliance` | `@1aboveio/risk-compliance-skills` | compliance-audit, contract-compare, contract-review, doc-authenticity, fraud-analysis, payment-analysis, report-writing, similar-domain, tld-detection |
+| `content` | `@1aboveio/content-skills` | article-review, article-to-image, flowchart-svg, image-gen, mermaid, wechat-article-writer, wechat-publisher, wechat-search, xai-search |
+
+Generated from [1aboveio/ai](https://github.com/1aboveio/ai) `skills/distribution/packages/`. Do not edit.

package/bin/cli.mjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// Entry point of `npx @1aboveio/skills`; ships as bin/cli.mjs beside bin/select-core.mjs.
+import { readFileSync } from 'node:fs';
+
+import { main } from './select-core.mjs';
+
+const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+main(process.argv.slice(2), { meta: { name: manifest.name, ...manifest.skillsPackage } }).then(
+  (code) => process.exit(code),
+  (error) => {
+    console.error(error.message);
+    process.exit(1);
+  },
+);

package/bin/select-core.mjs

@@ -0,0 +1,172 @@
+// The select command of @1aboveio/skills: choose which of its packages Pi loads.
+//
+// The package ships every skill under skills/<package-id>/<skill>/, so a selection is one Pi
+// package filter per package id (`skills/<id>/**`); a skill added to a selected package later loads
+// on the next `pi update` without selecting again. Selecting a package that uses core skills adds
+// core. In personal settings it also hides the Skills CLI copies of selected skills
+// (~/.agents/skills/<name> installed from 1aboveio/ai): Pi keeps the first skill of a name and
+// ranks package skills last, so those copies would otherwise win. Claude Code still reads them.
+//
+// Ships in the package as bin/select-core.mjs, an import-only core run by bin/cli.mjs; it has no
+// dependencies.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+
+const USAGE = `Usage: npx @1aboveio/skills [select] [<package>... | --all] [--local] [--dry-run]
+       npx @1aboveio/skills list
+
+  (no arguments)    choose interactively which packages Pi loads
+  <id>...           load only these packages (core is added when they need it)
+  --all             load every package
+  --local           write the project's .pi/settings.json instead of ~/.pi/agent/settings.json
+  --dry-run         print the settings change without writing it
+  list              print the packages and their skills`;
+
+// select is the default command, so a bare `npx @1aboveio/skills` asks interactively.
+export function parseArgs(argv) {
+  const [command, ...rest] = ['select', 'list'].includes(argv[0]) ? argv : ['select', ...argv];
+  const options = { command, ids: [], all: false, local: false, dryRun: false };
+  for (const arg of rest) {
+    if (arg === '--all') options.all = true;
+    else if (arg === '--local') options.local = true;
+    else if (arg === '--dry-run') options.dryRun = true;
+    else if (arg.startsWith('-')) throw new Error(`Unknown option: ${arg}\n\n${USAGE}`);
+    else options.ids.push(...arg.split(',').filter(Boolean));
+  }
+  if (options.all && options.ids.length) throw new Error('Pass package ids or --all, not both.');
+  return options;
+}
+
+function filterFor(id) {
+  return `skills/${id}/**`;
+}
+
+function matchesSource(source, name) {
+  return source === `npm:${name}` || source.startsWith(`npm:${name}@`);
+}
+
+function entrySource(entry) {
+  return typeof entry === 'string' ? entry : entry?.source;
+}
+
+// The package ids an existing settings entry loads; every id when it has no skills filter.
+export function currentSelection(entry, meta) {
+  const all = meta.groups.map((group) => group.id);
+  if (typeof entry === 'string' || !Array.isArray(entry.skills)) return all;
+  return all.filter((id) => entry.skills.includes(filterFor(id)));
+}
+
+// The ids to load, in package order, with core added when a chosen package needs it.
+export function planSelection(meta, ids) {
+  const known = new Map(meta.groups.map((group) => [group.id, group]));
+  const unknown = ids.filter((id) => !known.has(id));
+  if (unknown.length) throw new Error(`Unknown package: ${unknown.join(', ')}. Packages: ${[...known.keys()].join(', ')}`);
+  if (!ids.length) throw new Error('Select at least one package.');
+  const chosen = new Set(ids);
+  const added = [];
+  if (!chosen.has(meta.core) && ids.some((id) => known.get(id).needsCore)) {
+    chosen.add(meta.core);
+    added.push(meta.core);
+  }
+  return { ids: meta.groups.map((group) => group.id).filter((id) => chosen.has(id)), added };
+}
+
+// Skills CLI copies of these skills: ~/.agents/skills/<name> whose lock entry names 1aboveio/ai.
+export function skillsCliCopies(home, names) {
+  const lockPath = join(home, '.agents/.skill-lock.json');
+  if (!existsSync(lockPath)) return [];
+  const lock = JSON.parse(readFileSync(lockPath, 'utf8')).skills ?? {};
+  return names.filter((name) => lock[name]?.source === '1aboveio/ai' && existsSync(join(home, '.agents/skills', name, 'SKILL.md')));
+}
+
+// Returns { settings, notes } with the package entry narrowed to `ids` and, when `hide` is given
+// (personal settings), the Skills CLI copies of the loaded skills hidden from Pi. Hide entries this
+// command wrote before are recomputed, so deselecting a package shows its copies again.
+export function applySelection(settings, meta, ids, { home, hide } = {}) {
+  const next = structuredClone(settings);
+  const packages = next.packages ?? [];
+  const index = packages.findIndex((entry) => matchesSource(entrySource(entry) ?? '', meta.name));
+  if (index < 0) throw new Error(`${meta.name} is not installed here. Run: pi install npm:${meta.name}${next.packages ? '' : ' (or pass --local for a project install)'}`);
+  const source = entrySource(packages[index]);
+  const everything = ids.length === meta.groups.length;
+  if (typeof packages[index] === 'string') packages[index] = everything ? source : { source, skills: ids.map(filterFor) };
+  else if (everything) delete packages[index].skills;
+  else packages[index].skills = ids.map(filterFor);
+  if (typeof packages[index] === 'object' && Object.keys(packages[index]).length === 1) packages[index] = source;
+
+  const notes = [];
+  const domain = packages.map(entrySource).filter((s) => s && meta.groups.some((group) => matchesSource(s, group.packageName)));
+  if (domain.length) notes.push(`Also installed: ${domain.join(', ')}. Their skills duplicate this package's; remove them with pi remove, or Pi keeps whichever loads first.`);
+
+  if (hide) {
+    const agentsSkills = join(home, '.agents/skills');
+    const ours = new Set(meta.groups.flatMap((group) => group.skills).map((name) => `-${join(agentsSkills, name)}`));
+    const kept = (next.skills ?? []).filter((entry) => !ours.has(entry));
+    const loaded = meta.groups.filter((group) => ids.includes(group.id)).flatMap((group) => group.skills);
+    const copies = skillsCliCopies(home, loaded);
+    const skills = [...kept, ...copies.map((name) => `-${join(agentsSkills, name)}`)];
+    if (skills.length) next.skills = skills;
+    else delete next.skills;
+    if (copies.length) notes.push(`Hid ${copies.length} Skills CLI cop${copies.length === 1 ? 'y' : 'ies'} in ${agentsSkills} from Pi so this package's versions load; Claude Code still uses them.`);
+  }
+  return { settings: next, notes };
+}
+
+export function settingsPath({ local, home, cwd }) {
+  return local ? join(cwd, '.pi/settings.json') : join(process.env.PI_CODING_AGENT_DIR ? resolve(process.env.PI_CODING_AGENT_DIR) : join(home, '.pi/agent'), 'settings.json');
+}
+
+function describe(meta, ids) {
+  const mark = (on) => `[${on ? 'x' : ' '}]`;
+  const total = meta.groups.reduce((sum, group) => sum + group.skills.length, 0);
+  return [
+    `  0. ${mark(ids.length === meta.groups.length)} ${'all'.padEnd(16)} ${total} skills — every package`,
+    ...meta.groups.map((group, i) => `  ${i + 1}. ${mark(ids.includes(group.id))} ${group.id.padEnd(16)} ${group.skills.length} skills — ${group.description}`),
+  ].join('\n');
+}
+
+// Reads a selection from the terminal: numbers or ids, 0 or "all", or nothing to keep the current one.
+async function ask(meta, current, input, output) {
+  const rl = createInterface({ input, output });
+  try {
+    output.write(`${meta.name}: choose which packages Pi loads\n${describe(meta, current)}\n`);
+    const keep = current.length ? 'Enter keeps the current selection' : 'Enter loads all';
+    const answer = (await rl.question(`Packages to load (numbers or ids, 0 for all; ${keep}): `)).trim();
+    const tokens = answer.split(/[\s,]+/).filter(Boolean);
+    if (!tokens.length) return current.length ? current : meta.groups.map((group) => group.id);
+    if (tokens.some((token) => token === '0' || token === 'all')) return meta.groups.map((group) => group.id);
+    return tokens.map((token) => (/^\d+$/.test(token) ? meta.groups[Number(token) - 1]?.id ?? token : token));
+  } finally {
+    rl.close();
+  }
+}
+
+export async function main(argv, { meta, log = console.log, home = homedir(), cwd = process.cwd(), input = process.stdin, output = process.stdout } = {}) {
+  const options = parseArgs(argv);
+  if (options.command === 'list') {
+    for (const group of meta.groups) log(`${group.id} (${group.packageName}): ${group.skills.join(', ')}`);
+    return 0;
+  }
+  const path = settingsPath({ local: options.local, home, cwd });
+  const settings = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {};
+  const entry = (settings.packages ?? []).find((e) => matchesSource(entrySource(e) ?? '', meta.name));
+  let ids = options.all ? meta.groups.map((group) => group.id) : options.ids;
+  if (!ids.length) {
+    if (!input.isTTY) throw new Error(`No packages given and no terminal to ask.\n\n${USAGE}`);
+    ids = await ask(meta, entry ? currentSelection(entry, meta) : [], input, output);
+  }
+  const plan = planSelection(meta, ids);
+  const { settings: next, notes } = applySelection(settings, meta, plan.ids, { home, hide: !options.local });
+  if (plan.added.length) log(`Added ${plan.added.join(', ')}: the selected packages use its skills.`);
+  if (options.dryRun) {
+    log(JSON.stringify(next, null, 2));
+  } else {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`);
+  }
+  for (const note of notes) log(note);
+  log(`${options.dryRun ? 'Would load' : 'Pi loads'}: ${plan.ids.join(', ')} (${path}). Run /reload in an open Pi session.`);
+  return 0;
+}

package/package.json

@@ -1,6 +1,148 @@
 {
   "name": "@1aboveio/skills",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Every 1aboveio skill package in one: install once, then choose which packages Pi loads with npx @1aboveio/skills select.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/1aboveio/ai.git",
+    "directory": "skills/distribution/packages"
+  },
+  "homepage": "https://github.com/1aboveio/ai/releases?q=%401aboveio%2Fskills&expanded=true",
+  "keywords": [
+    "pi-package",
+    "agent-skills",
+    "skills"
+  ],
+  "type": "module",
+  "bin": {
+    "1aboveio-skills": "bin/cli.mjs"
+  },
+  "files": [
+    "skills",
+    "bin",
+    "README.md"
+  ],
+  "pi": {
+    "skills": [
+      "./skills"
+    ]
+  },
+  "skillsPackage": {
+    "core": "core",
+    "groups": [
+      {
+        "id": "core",
+        "packageName": "@1aboveio/core-skills",
+        "description": "Shared writing and document foundation: house style, editorial review, Chinese polish, terminology, write-doc, distill-writing, doc-to-md and reg-parser.",
+        "needsCore": false,
+        "skills": [
+          "distill-writing",
+          "doc-to-md",
+          "editorial-review",
+          "house-style",
+          "polish-cn",
+          "reg-parser",
+          "terminology",
+          "write-doc"
+        ]
+      },
+      {
+        "id": "engineering",
+        "packageName": "@1aboveio/engineering-skills",
+        "description": "Issue-to-PR and release orchestrators, review, coverage, golden paths and test quality.",
+        "needsCore": false,
+        "skills": [
+          "better-review",
+          "e2e-test",
+          "engineering-runtime",
+          "ensure-coverage",
+          "golden-path",
+          "harness-runtime",
+          "resolve-issues",
+          "resolve-release",
+          "rush-issues",
+          "rush-release",
+          "test-quality"
+        ]
+      },
+      {
+        "id": "cicd",
+        "packageName": "@1aboveio/cicd-skills",
+        "description": "GitHub Actions and flow, Mergify, Docker and Podman, Cloud Build, Cloud Deploy and Google Cloud.",
+        "needsCore": false,
+        "skills": [
+          "cloud-build",
+          "cloud-debug",
+          "cloud-deploy",
+          "docker",
+          "github-actions",
+          "github-flow",
+          "google-cloud",
+          "mergify",
+          "podman"
+        ]
+      },
+      {
+        "id": "app-dev",
+        "packageName": "@1aboveio/app-dev-skills",
+        "description": "Next.js, React Native, auth, Prisma, shadcn, Python backends, Airflow and PySpark.",
+        "needsCore": false,
+        "skills": [
+          "airflow",
+          "android-foundation",
+          "app-debug",
+          "better-auth",
+          "data-catalog",
+          "ios-foundation",
+          "monorepo",
+          "nextjs-fullstack",
+          "prisma-setup",
+          "pyspark",
+          "python-backend",
+          "shadcn",
+          "zod-v4"
+        ]
+      },
+      {
+        "id": "risk-compliance",
+        "packageName": "@1aboveio/risk-compliance-skills",
+        "description": "Compliance audits, contract review, payment and fraud analysis.",
+        "needsCore": true,
+        "skills": [
+          "compliance-audit",
+          "contract-compare",
+          "contract-review",
+          "doc-authenticity",
+          "fraud-analysis",
+          "payment-analysis",
+          "report-writing",
+          "similar-domain",
+          "tld-detection"
+        ]
+      },
+      {
+        "id": "content",
+        "packageName": "@1aboveio/content-skills",
+        "description": "WeChat articles, reviews and covers, diagrams, image generation and xAI search.",
+        "needsCore": false,
+        "skills": [
+          "article-review",
+          "article-to-image",
+          "flowchart-svg",
+          "image-gen",
+          "mermaid",
+          "wechat-article-writer",
+          "wechat-publisher",
+          "wechat-search",
+          "xai-search"
+        ]
+      }
+    ],
+    "digest": "730da168eda4e3eedfb448db5dae6f8d0bc8c518bcb35a2c43e0b0acf538151e"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}

package/skills/app-dev/airflow/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/app-dev/airflow/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: airflow
+description: Airflow DAG architecture and conventions. Use when designing, writing, reviewing, testing, or debugging Airflow DAGs and tasks, including TaskGroups, data intervals, timezone-aware date parameters, CLI validation, environment-based scheduling, and pytest integrity tests.
+user-invocable: true
+release-version: 0.36.0
+---
+**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
+# Airflow DAG Development Patterns
+
+## 1. Organize Data Pipelines with TaskGroups
+
+Use `TaskGroup` to make meaningful pipeline stages visible in the Airflow graph. For data warehouse pipelines, group tasks by warehouse layer such as `stg`, `ods`, `dwd`, `dws`, and `ads`. For other pipelines, use domain-specific groups such as `features`, `exports`, `quality_checks`, or `notifications`.
+
+Keep groups aligned with real ownership or dependency boundaries; do not create a group solely to wrap one trivial task. Express dependencies between groups so the graph communicates the pipeline's high-level flow.
+
+```python
+from airflow.decorators import dag
+from airflow.utils.task_group import TaskGroup
+
+
+@dag(...)
+def customer_metrics():
+    with TaskGroup(group_id="stg") as stg:
+        load_stg_customers()
+        load_stg_orders()
+
+    with TaskGroup(group_id="dwd") as dwd:
+        build_dwd_customers()
+        build_dwd_orders()
+
+    with TaskGroup(group_id="ads") as ads:
+        build_ads_customer_metrics()
+
+    stg >> dwd >> ads
+
+
+customer_metrics()
+```
+
+## 2. Use Timezone-Aware Data Intervals
+
+Prefer Airflow's `data_interval_start` and `data_interval_end` as task date-range inputs. They are timezone-aware logical boundaries and behave correctly for scheduled runs, catchup, and daylight-saving transitions. Treat `data_interval_end` as an exclusive boundary.
+
+Prepare one shared set of templated date variables for the whole DAG, converting the interval boundaries to the DAG's business timezone. Pass those variables to every task that reads or writes partitioned data. Keep the conversion in Jinja so it happens for each DAG run, not while the scheduler parses the DAG file.
+
+```python
+import pendulum
+from airflow.decorators import dag, task
+from airflow.utils.task_group import TaskGroup
+
+LOCAL_TIMEZONE = "Asia/Shanghai"
+
+# These values are rendered separately for every DAG run. The end is exclusive.
+DATE_RANGE = {
+    "start_date": (
+        f"{{{{ data_interval_start.in_timezone('{LOCAL_TIMEZONE}') | ds }}}}"
+    ),
+    "end_date": (
+        f"{{{{ data_interval_end.in_timezone('{LOCAL_TIMEZONE}') | ds }}}}"
+    ),
+}
+
+
+@dag(
+    schedule="0 2 * * *",
+    start_date=pendulum.datetime(2024, 1, 1, tz=LOCAL_TIMEZONE),
+    catchup=True,
+)
+def daily_warehouse():
+    @task
+    def load_partition(start_date: str, end_date: str) -> None:
+        # Read records in the half-open range [start_date, end_date).
+        ...
+
+    with TaskGroup(group_id="stg"):
+        load_partition(**DATE_RANGE)
+
+
+daily_warehouse()
+```
+
+Use timestamps instead of dates when a task needs sub-day precision:
+
+```python
+INTERVAL_RANGE = {
+    "interval_start": "{{ data_interval_start.in_timezone('Asia/Shanghai').to_iso8601_string() }}",
+    "interval_end": "{{ data_interval_end.in_timezone('Asia/Shanghai').to_iso8601_string() }}",
+}
+```
+
+## 3. Operations: Wait for DAG Auto-Reload
+
+Airflow periodically scans the DAG directory and automatically reloads changed DAG files. The refresh cadence depends on the deployment's scheduler and DAG-processing configuration, and commonly takes a few minutes.
+
+After updating a DAG file, do not restart the Airflow services by default. Watch for the DAG to refresh in the Airflow UI or CLI after the configured scan interval. Investigate import errors or deployment synchronization only if the update does not appear after a reasonable interval.
+
+## 4. Quick DAG Validation with Airflow CLI
+
+Use these commands for fast feedback during development:
+
+```bash
+# List import errors (fastest check - catches syntax and import issues)
+airflow dags list-import-errors
+
+# Full lint check (comprehensive - catches best practice violations)
+airflow dags lint
+```
+
+**When to use:**
+- `list-import-errors`: During active development for quick syntax/import validation
+- `lint`: Before commits to catch style and best practice issues
+
+## 5. Environment-Based Schedule Override
+
+Disable schedules in local development to prevent accidental runs:
+
+```python
+import os
+from datetime import datetime
+from airflow import DAG
+
+def get_schedule(production_schedule: str) -> str | None:
+    """Return None for local dev, actual schedule for deployed environments.
+
+    Set AIRFLOW_ENV=local in .env for local development.
+    Cloud Run deployments set AIRFLOW_ENV=dev|staging|prod.
+    """
+    env = os.getenv("AIRFLOW_ENV", "local")
+    if env == "local":
+        return None
+    return production_schedule
+```
+
+**Usage in DAG:**
+```python
+with DAG(
+    dag_id="my_dag",
+    schedule=get_schedule("0 4 * * *"),  # Daily 4 AM in prod, None locally
+    start_date=datetime(2024, 1, 1),
+    catchup=False,
+) as dag:
+    ...
+```
+
+**Environment setup:**
+- **Local:** Add `AIRFLOW_ENV=local` to `.env`
+- **Cloud Run:** Set via cloudbuild.yaml substitutions (`_AIRFLOW_ENV: dev|staging|prod`)
+
+## 6. Pytest DAG Integrity Tests
+
+Standard pytest patterns for validating DAG quality:
+
+```python
+# tests/test_dag_integrity.py
+import pytest
+from airflow.models import DagBag
+
+@pytest.fixture(scope="session")
+def dagbag():
+    return DagBag(dag_folder="dags/", include_examples=False)
+
+def test_no_import_errors(dagbag):
+    """Verify all DAGs load without import errors."""
+    assert not dagbag.import_errors, f"DAG import errors: {dagbag.import_errors}"
+
+def test_dags_have_tags(dagbag):
+    """Verify all DAGs have at least one tag for organization."""
+    for dag_id, dag in dagbag.dags.items():
+        assert dag.tags, f"DAG {dag_id} has no tags"
+
+def test_dags_have_owner(dagbag):
+    """Verify all DAGs have an owner in default_args."""
+    for dag_id, dag in dagbag.dags.items():
+        assert dag.default_args.get("owner"), f"DAG {dag_id} missing owner"
+
+def test_no_cycles(dagbag):
+    """Verify DAGs don't have circular dependencies."""
+    for dag_id, dag in dagbag.dags.items():
+        # DagBag already validates this, but explicit test for clarity
+        assert dag.topo_sort(), f"DAG {dag_id} has cycles"
+```
+
+**Run tests:**
+```bash
+# Run all DAG tests
+pytest tests/test_dag_integrity.py -v
+
+# Run specific test
+pytest tests/test_dag_integrity.py::test_no_import_errors -v
+```
+
+## Quick Reference
+
+| Task | Command |
+|------|---------|
+| Check import errors | `airflow dags list-import-errors` |
+| Lint DAGs | `airflow dags lint` |
+| Run integrity tests | `pytest tests/test_dag_integrity.py -v` |
+| Trigger manual run | `airflow dags trigger <dag_id>` |

package/skills/app-dev/airflow/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/app-dev/android-foundation/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO