@1aboveio/skills 0.12.0 → 0.13.0

package/README.md

@@ -16,6 +16,26 @@ for packages built from a private source repository.
 - Installed content is canonical under `~/.agents/skills`, with per-skill links under
   `~/.claude/skills`. No copied store is created under any other agent directory.
 
+### External prerequisites
+
+External skills are not package members: this package never installs, updates, or removes them.
+Run the reviewed shell prerequisites separately when you need their capabilities:
+
+#### Matt Pocock Toolkit
+
+```sh
+SKILLS_DOWNLOAD_MAX_BYTES=33554432 SKILLS_EXTRACT_MAX_FILES=4096 SKILLS_EXTRACT_MAX_BYTES=67108864 npx skills@1.5.22 add https://codeload.github.com/mattpocock/skills/tar.gz/ed37663cc5fbef691ddfecd080dff42f7e7e350d --global --agent universal claude-code --skill batch-grill-me code-review codebase-design diagnosing-bugs domain-modeling grill-me grill-with-docs grilling handoff improve-codebase-architecture prototype research resolving-merge-conflicts setup-matt-pocock-skills tdd to-spec to-tickets triage wayfinder
+```
+
+#### Impeccable
+
+```sh
+IMPECCABLE_BUNDLE="$(mktemp "${TMPDIR:-/tmp}/impeccable-skill-v4.1.1.XXXXXX")"
+curl --fail --location --output "$IMPECCABLE_BUNDLE" https://github.com/pbakaus/impeccable/releases/download/skill-v4.1.1/universal.zip
+printf '%s  %s\n' 'e16133fcf240c042e5b6bdc20ac9f3a996a3ab9652723c6d9d1291dd1760dab4' "$IMPECCABLE_BUNDLE" | shasum -a 256 --check -
+IMPECCABLE_BUNDLE_PATH="$IMPECCABLE_BUNDLE" npx --yes impeccable@3.6.0 install --yes --force --providers=claude,codex --scope=global --no-hooks
+```
+
 ## Usage
 
 ```
@@ -25,16 +45,18 @@ npx @1aboveio/skills install --group engineering-workflow
 npx @1aboveio/skills update --group engineering-workflow
 ```
 
-Running `install` with no `--group` opens the interactive bundle picker. The automation flags:
+Running `install` with no `--group` opens the interactive bundle picker; `update` with no
+`--group` replays the remembered selection instead (see Updating). The automation flags:
 
 - `--group <id>` — select one group; repeat the flag, or pass a comma-separated list, for several.
 - `--all` — select every group in the catalog below. Mutually exclusive with `--group`.
-- `--dry-run` — print the planned native commands, in order, and run none of them.
-- `--yes` — answer the native CLI's prompts, including the overwrite prompt, with yes.
+- `--dry-run` — print the planned buckets and native commands, in order, and run none of them.
+- `--yes` — answer the native CLI's prompts, including the overwrite prompt, with yes, and accept
+  every newly declared group member without prompting.
 
-Selecting several groups (interactive picker, repeated `--group`, or `--all`) coalesces to one
-native `skills add` per upstream source, so the installation-method prompt appears once per
-source rather than once per group.
+Selecting several groups (interactive picker, repeated `--group`, or `--all`) installs their
+members as one native `skills add` per skill from the unpacked package, so one skill's failure is
+reported by name and never aborts the rest of the selection.
 
 Without `--yes`, an existing same-named skill produces the native overwrite summary and a prompt.
 Declining leaves the existing content and its links exactly as they were.
@@ -44,8 +66,7 @@ Declining leaves the existing content and its links exactly as they were.
 - `engineering-workflow` — Engineering Workflow: e2e-test, ensure-coverage, implement-and-pr, resolve-issues, resolve-release, review-pr, smoke, engineering-runtime
 - `delivery-infrastructure` — Delivery Infrastructure: cloud-build, cloud-debug, cloud-deploy, docker, google-cloud, mergify, podman
 - `backend` — Backend: airflow-dag-develop, app-debug, pyspark, python-backend
-- `fullstack` — Fullstack: better-auth, monorepo, nextjs-fullstack, prisma-setup, shadcn, zod-v4, impeccable — impeccable is fetched from its upstream owner and not included in this package
-- `matt-pocock-toolkit` — Matt Pocock Toolkit: batch-grill-me, code-review, codebase-design, diagnosing-bugs, domain-modeling, grill-me, grill-with-docs, grilling, handoff, improve-codebase-architecture, prototype, research, resolving-merge-conflicts, setup-matt-pocock-skills, tdd, to-spec, to-tickets, triage, wayfinder — every member is fetched from its upstream owner and is not included in this package
+- `fullstack` — Fullstack: better-auth, monorepo, nextjs-fullstack, prisma-setup, shadcn, zod-v4
 
 Internal dependencies, installed with the groups above and not selectable on their own: `harness-runtime`.
 They are an implementation detail of those groups, so `list` and the picker do not offer them and
@@ -53,7 +74,34 @@ They are an implementation detail of those groups, so `list` and the picker do n
 
 ## Updating
 
-`update` reruns the selected group's install recipe from the @1aboveio/skills version you
+`update` with no `--group` replays the selection remembered in
+`${XDG_STATE_HOME:-~/.local/state}/1aboveio-skills/selection.json` from the last run that
+recorded one. A repository checkout and this
+package share that one file, so switching transports keeps the same groups. Missing or corrupt memory
+is an error — the coordinator never infers groups from the filesystem — and remembered groups that are
+no longer selectable are dropped with a warning.
+
+An accepted skill whose installed content already matches this package version's published digest is
+skipped entirely: no native add, no overwrite prompt. When everything remembered is unchanged and no
+new skill is accepted, the run exits 0 as an explicit no-op. `--dry-run` prints the unchanged,
+would-refresh, and would-add buckets without writing state or invoking the native CLI.
+
+When the version you invoke declares a member your remembered group has not accepted — a skill that
+joined the group after your remembered acceptance was last recorded — update asks about that skill
+by name before adding it. Each new-member prompt defaults to No; `--yes` accepts every new member
+non-interactively.
+Declined skills are never uninstalled by the coordinator and stay out of the remembered acceptance,
+so the next update asks again.
+
+Install and update are best-effort per skill: they continue after a single skill failure, summarize
+every skill as succeeded, unchanged, declined, or failed, and exit non-zero if anything failed. There
+is no rollback or transactional group update; the native CLI remains the sole write and
+overwrite-consent authority. Selection memory follows the same per-skill rule: it is rewritten when
+at least one user-facing member succeeded or was already unchanged, holding exactly those members —
+failed and declined members are omitted — and a run with no user-facing success leaves the prior
+file untouched.
+
+`update --group ...` refreshes an explicit selection from the @1aboveio/skills version you
 invoke, so the installed result is whatever that exact version carries. Public first-party
 content follows the package version you select, not a branch: pin a version and rerunning it
 reproduces the same installation.
@@ -71,24 +119,20 @@ npx skills@1.5.22 remove --global --agent universal claude-code --skill cloud-bu
 # Backend
 npx skills@1.5.22 remove --global --agent universal claude-code --skill airflow-dag-develop app-debug pyspark python-backend
 # Fullstack
-npx skills@1.5.22 remove --global --agent universal claude-code --skill better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 impeccable
-# Matt Pocock Toolkit
-npx skills@1.5.22 remove --global --agent universal claude-code --skill batch-grill-me code-review codebase-design diagnosing-bugs domain-modeling grill-me grill-with-docs grilling handoff improve-codebase-architecture prototype research resolving-merge-conflicts setup-matt-pocock-skills tdd to-spec to-tickets triage wayfinder
+npx skills@1.5.22 remove --global --agent universal claude-code --skill better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4
 ```
 
 Removing a group leaves its dependency groups and every unrelated skill installed.
 
 ## Lifecycle
 
-`skills@1.5.22` is the only lifecycle authority. This package plans and orders
-commands; the native CLI owns installation, linking, overwrite consent, update and removal.
-Multi-source writes are sequential and non-transactional: there is no rollback and no atomic
-installation, an approved overwrite is destructive, and a failed source stops the recipe before
-the next source runs rather than continuing past an incomplete prerequisite.
+`skills@1.5.22` is the only lifecycle authority for this package. The package
+plans first-party commands; the native CLI owns installation, linking, overwrite consent, update
+and removal. External prerequisites have separate upstream lifecycle and are never package steps.
 
 ## Licensing
 
 First-party skills in this package are MIT, and each installed skill carries its `LICENSE`.
-Externally owned skills are not republished, mirrored or relicensed here: they are fetched from
-their own upstream repositories at the reviewed immutable revisions printed by `--dry-run`, and
-their licensing stays with their authors.
+Externally owned skills are not republished, mirrored, installed, updated, or removed by this
+package. Their reviewed standalone shell commands pin upstream identities, and their licensing
+and lifecycle stay with their authors.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1aboveio/skills",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Install the 1AboveIO first-party skill groups through the native Skills CLI.",
   "license": "MIT",
   "type": "module",