@1aboveio/skills 1.0.1 → 1.0.3

package/README.md

@@ -6,14 +6,20 @@ Every 1aboveio skill package in one: install once, then choose which packages Pi
 
 ```sh
 pi install npm:@1aboveio/skills
-npx @1aboveio/skills                   # choose packages interactively
+pi config                          # turn single skills on or off
+npx @1aboveio/skills                   # or choose whole packages interactively
 npx @1aboveio/skills engineering cicd  # or name them
 ```
 
-The command writes a Pi package filter (`skills/<package>/**`) to `~/.pi/agent/settings.json`
-(`--local`: the project's `.pi/settings.json`), adds core when a chosen package uses it, and
-hides Skills CLI copies of the loaded skills from Pi so these versions win. Until you run it,
-Pi loads every package. `pi config` toggles single skills.
+Pi loads every package after install. `pi config` toggles single skills. The select command
+writes a Pi package filter (`skills/<package>/**`) to `~/.pi/agent/settings.json` (`--local`:
+the project's `.pi/settings.json`), adds core when a chosen package uses it, and installs the
+third-party sources you pick.
+
+At startup the package's extension hides from Pi the Skills CLI copies in `~/.agents/skills` of
+the skills it loads (Pi ranks package skills last, so those copies would win). It writes
+`-<path>` entries to Pi's personal settings and deletes nothing: Claude Code and Codex keep
+using the copies. Run `/reload` after the first start.
 
 Each package also publishes on its own; install either this bundle or the packages, not both.
 
@@ -21,11 +27,22 @@ Each package also publishes on its own; install either this bundle or the packag
 
 | Package | Also published as | Skills |
 |---|---|---|
-| `core` | `@1aboveio/core-skills` | distill-writing, doc-to-md, editorial-review, house-style, polish-cn, reg-parser, terminology, write-doc |
-| `engineering` | `@1aboveio/engineering-skills` | better-review, e2e-test, engineering-runtime, ensure-coverage, golden-path, harness-runtime, resolve-issues, resolve-release, rush-issues, rush-release, test-quality |
+| `core` | `@1aboveio/core-skills` | distill-writing, doc-to-md, editorial-review, house-style, plain-language, polish-cn, reg-parser, terminology, write-doc |
+| `engineering` | `@1aboveio/engineering-skills` | better-review, contributing, e2e-test, engineering-runtime, ensure-coverage, golden-path, harness-runtime, resolve-issues, resolve-release, rush-issues, rush-release, test-quality |
 | `cicd` | `@1aboveio/cicd-skills` | cloud-build, cloud-debug, cloud-deploy, docker, github-actions, github-flow, google-cloud, mergify, podman |
-| `app-dev` | `@1aboveio/app-dev-skills` | airflow, android-foundation, app-debug, better-auth, data-catalog, ios-foundation, monorepo, nextjs-fullstack, prisma-setup, pyspark, python-backend, shadcn, zod-v4 |
+| `app-dev` | `@1aboveio/app-dev-skills` | airflow, android-foundation, app-debug, better-auth, data-catalog, data-quality, ios-foundation, monorepo, nextjs-fullstack, prisma-setup, pyspark, python-backend, shadcn, zod-v4 |
 | `risk-compliance` | `@1aboveio/risk-compliance-skills` | compliance-audit, contract-compare, contract-review, doc-authenticity, fraud-analysis, payment-analysis, report-writing, similar-domain, tld-detection |
 | `content` | `@1aboveio/content-skills` | article-review, article-to-image, flowchart-svg, image-gen, mermaid, wechat-article-writer, wechat-publisher, wechat-search, xai-search |
 
+## Third-party sources
+
+Not shipped in this package. Selecting one downloads it from its repository at the revision
+1aboveio/ai reviewed (one archive, no git history), keeps only the skills below and its
+license, and installs them as a local Pi package in `~/.pi/agent/1aboveio-skills/<id>/`.
+
+| Source | Repository | Skills |
+|---|---|---|
+| `matt-pocock` | https://github.com/mattpocock/skills | batch-grill-me, code-review, codebase-design, diagnosing-bugs, domain-modeling, grill-me, grill-with-docs, grilling, handoff, improve-codebase-architecture, prototype, research, resolving-merge-conflicts, setup-matt-pocock-skills, tdd, to-spec, to-tickets, triage, wayfinder |
+| `impeccable` | https://github.com/pbakaus/impeccable | impeccable |
+
 Generated from [1aboveio/ai](https://github.com/1aboveio/ai) `skills/distribution/packages/`. Do not edit.

package/bin/select-core.mjs

@@ -3,15 +3,26 @@
 // The package ships every skill under skills/<package-id>/<skill>/, so a selection is one Pi
 // package filter per package id (`skills/<id>/**`); a skill added to a selected package later loads
 // on the next `pi update` without selecting again. Selecting a package that uses core skills adds
-// core. In personal settings it also hides the Skills CLI copies of selected skills
-// (~/.agents/skills/<name> installed from 1aboveio/ai): Pi keeps the first skill of a name and
-// ranks package skills last, so those copies would otherwise win. Claude Code still reads them.
+// core.
 //
-// Ships in the package as bin/select-core.mjs, an import-only core run by bin/cli.mjs; it has no
-// dependencies.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+// Third-party sources (meta.external: Matt Pocock's skills, impeccable) are not shipped. Selecting
+// one downloads the source at the revision the repository reviewed, as one archive without git
+// history, keeps only the reviewed skill folders and the LICENSE, and installs them as a local Pi
+// package in <agent dir>/1aboveio-skills/<id>/, the way the Skills CLI copies a skill out of a
+// shallow clone. Pi's own git install keeps the full clone and finds no skills in impeccable.
+//
+// Pi keeps the first skill of a name and ranks package skills last, so copies in ~/.agents/skills
+// (Skills CLI installs, also read by Claude Code and Codex) would win. They are hidden from Pi with
+// `-<path>` entries in the personal settings, never deleted: a copy whose lock entry names the
+// skill's own source, or that has no lock entry. The bundle's hide-copies extension runs the same
+// hiding at Pi startup, so a plain `pi install` with `pi config` needs no select run.
+//
+// Ships in the package as bin/select-core.mjs, an import-only core run by bin/cli.mjs and
+// extensions/hide-copies.ts; it has no dependencies.
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { basename, dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 
 const USAGE = `Usage: npx @1aboveio/skills [select] [<package>... | --all] [--local] [--dry-run]
@@ -19,11 +30,13 @@ const USAGE = `Usage: npx @1aboveio/skills [select] [<package>... | --all] [--lo
 
   (no arguments)    choose interactively which packages Pi loads
   <id>...           load only these packages (core is added when they need it)
-  --all             load every package
+  --all             load every package, third-party sources included
   --local           write the project's .pi/settings.json instead of ~/.pi/agent/settings.json
-  --dry-run         print the settings change without writing it
+  --dry-run         print the settings change without writing or downloading anything
   list              print the packages and their skills`;
 
+export const FIRST_PARTY_SOURCE = '1aboveio/ai';
+
 // select is the default command, so a bare `npx @1aboveio/skills` asks interactively.
 export function parseArgs(argv) {
   const [command, ...rest] = ['select', 'list'].includes(argv[0]) ? argv : ['select', ...argv];
@@ -39,6 +52,15 @@ export function parseArgs(argv) {
   return options;
 }
 
+function externals(meta) {
+  return meta.external ?? [];
+}
+
+// Every selectable id: the bundle's packages, then the third-party sources.
+export function allIds(meta) {
+  return [...meta.groups.map((group) => group.id), ...externals(meta).map((ext) => ext.id)];
+}
+
 function filterFor(id) {
   return `skills/${id}/**`;
 }
@@ -51,16 +73,32 @@ function entrySource(entry) {
   return typeof entry === 'string' ? entry : entry?.source;
 }
 
-// The package ids an existing settings entry loads; every id when it has no skills filter.
-export function currentSelection(entry, meta) {
-  const all = meta.groups.map((group) => group.id);
-  if (typeof entry === 'string' || !Array.isArray(entry.skills)) return all;
-  return all.filter((id) => entry.skills.includes(filterFor(id)));
+export function agentDir(home) {
+  return process.env.PI_CODING_AGENT_DIR ? resolve(process.env.PI_CODING_AGENT_DIR) : join(home, '.pi/agent');
+}
+
+// Where a third-party source is installed: personal, whichever settings file loads it.
+export function externalDir(home, id) {
+  return join(agentDir(home), '1aboveio-skills', id);
 }
 
-// The ids to load, in package order, with core added when a chosen package needs it.
+function bundleEntry(settings, meta) {
+  return (settings.packages ?? []).find((entry) => matchesSource(entrySource(entry) ?? '', meta.name));
+}
+
+// The ids a settings file loads: bundle packages by its skills filter (every package when it has
+// none), third-party sources by their local package entry.
+export function currentSelection(settings, meta, home) {
+  const entry = bundleEntry(settings, meta);
+  const groups = meta.groups.map((group) => group.id);
+  const loaded = !entry ? [] : typeof entry === 'string' || !Array.isArray(entry.skills) ? groups : groups.filter((id) => entry.skills.includes(filterFor(id)));
+  const sources = new Set((settings.packages ?? []).map(entrySource));
+  return [...loaded, ...externals(meta).filter((ext) => sources.has(externalDir(home, ext.id))).map((ext) => ext.id)];
+}
+
+// The ids to load, in list order, with core added when a chosen package needs it.
 export function planSelection(meta, ids) {
-  const known = new Map(meta.groups.map((group) => [group.id, group]));
+  const known = new Map([...meta.groups, ...externals(meta)].map((item) => [item.id, item]));
   const unknown = ids.filter((id) => !known.has(id));
   if (unknown.length) throw new Error(`Unknown package: ${unknown.join(', ')}. Packages: ${[...known.keys()].join(', ')}`);
   if (!ids.length) throw new Error('Select at least one package.');
@@ -70,92 +108,182 @@ export function planSelection(meta, ids) {
     chosen.add(meta.core);
     added.push(meta.core);
   }
-  return { ids: meta.groups.map((group) => group.id).filter((id) => chosen.has(id)), added };
+  return { ids: allIds(meta).filter((id) => chosen.has(id)), added };
 }
 
-// Skills CLI copies of these skills: ~/.agents/skills/<name> whose lock entry names 1aboveio/ai.
-export function skillsCliCopies(home, names) {
+// [{ name, source }] for every skill the selected ids load; source is the Skills CLI lock source.
+function loadedSkills(meta, ids) {
+  return [
+    ...meta.groups.filter((group) => ids.includes(group.id)).flatMap((group) => group.skills.map((name) => ({ name, source: FIRST_PARTY_SOURCE }))),
+    ...externals(meta).filter((ext) => ids.includes(ext.id)).flatMap((ext) => ext.skills.map((skill) => ({ name: skill.name, source: ext.lockSource }))),
+  ];
+}
+
+// Copies in ~/.agents/skills that duplicate a loaded skill: the lock entry names the skill's own
+// source, or there is none (an older installer). A lock entry from another source is a different
+// skill that shares the name, and stays.
+export function skillsCliCopies(home, skills) {
   const lockPath = join(home, '.agents/.skill-lock.json');
-  if (!existsSync(lockPath)) return [];
-  const lock = JSON.parse(readFileSync(lockPath, 'utf8')).skills ?? {};
-  return names.filter((name) => lock[name]?.source === '1aboveio/ai' && existsSync(join(home, '.agents/skills', name, 'SKILL.md')));
+  const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')).skills ?? {} : {};
+  return skills
+    .filter(({ name, source }) => !lock[name] || lock[name].source === source)
+    .map(({ name }) => name)
+    .filter((name) => existsSync(join(home, '.agents/skills', name, 'SKILL.md')));
 }
 
-// Returns { settings, notes } with the package entry narrowed to `ids` and, when `hide` is given
-// (personal settings), the Skills CLI copies of the loaded skills hidden from Pi. Hide entries this
-// command wrote before are recomputed, so deselecting a package shows its copies again.
+// Recomputes the `-<path>` entries this package owns in the personal `skills` list, so
+// deselecting a package shows its copies again. Returns the copy names now hidden.
+function hideCopies(next, meta, ids, home) {
+  const agentsSkills = join(home, '.agents/skills');
+  const hideEntry = (name) => `-${join(agentsSkills, name)}`;
+  const ours = new Set(loadedSkills(meta, allIds(meta)).map(({ name }) => hideEntry(name)));
+  const kept = (next.skills ?? []).filter((entry) => !ours.has(entry));
+  const copies = [...new Set(skillsCliCopies(home, loadedSkills(meta, ids)))];
+  const skills = [...kept, ...copies.map(hideEntry)];
+  if (skills.length) next.skills = skills;
+  else delete next.skills;
+  return copies;
+}
+
+function hiddenNote(home, copies) {
+  return `Hid ${copies.length} Skills CLI cop${copies.length === 1 ? 'y' : 'ies'} in ${join(home, '.agents/skills')} from Pi so the package versions load (Claude Code and Codex still use them): ${copies.join(', ')}.`;
+}
+
+// Returns { settings, notes } with the bundle entry narrowed to the selected packages, one local
+// package entry per selected third-party source, and, when `hide` is given (personal settings),
+// the Skills CLI copies of the loaded skills hidden from Pi.
 export function applySelection(settings, meta, ids, { home, hide } = {}) {
   const next = structuredClone(settings);
   const packages = next.packages ?? [];
   const index = packages.findIndex((entry) => matchesSource(entrySource(entry) ?? '', meta.name));
   if (index < 0) throw new Error(`${meta.name} is not installed here. Run: pi install npm:${meta.name}${next.packages ? '' : ' (or pass --local for a project install)'}`);
   const source = entrySource(packages[index]);
-  const everything = ids.length === meta.groups.length;
-  if (typeof packages[index] === 'string') packages[index] = everything ? source : { source, skills: ids.map(filterFor) };
+  const groupIds = meta.groups.map((group) => group.id).filter((id) => ids.includes(id));
+  const everything = groupIds.length === meta.groups.length;
+  if (typeof packages[index] === 'string') packages[index] = everything ? source : { source, skills: groupIds.map(filterFor) };
   else if (everything) delete packages[index].skills;
-  else packages[index].skills = ids.map(filterFor);
+  else packages[index].skills = groupIds.map(filterFor);
   if (typeof packages[index] === 'object' && Object.keys(packages[index]).length === 1) packages[index] = source;
 
+  for (const ext of externals(meta)) {
+    const dir = externalDir(home, ext.id);
+    const at = packages.findIndex((entry) => entrySource(entry) === dir);
+    if (ids.includes(ext.id) && at < 0) packages.push(dir);
+    if (!ids.includes(ext.id) && at >= 0) packages.splice(at, 1);
+  }
+
   const notes = [];
   const domain = packages.map(entrySource).filter((s) => s && meta.groups.some((group) => matchesSource(s, group.packageName)));
   if (domain.length) notes.push(`Also installed: ${domain.join(', ')}. Their skills duplicate this package's; remove them with pi remove, or Pi keeps whichever loads first.`);
-
   if (hide) {
-    const agentsSkills = join(home, '.agents/skills');
-    const ours = new Set(meta.groups.flatMap((group) => group.skills).map((name) => `-${join(agentsSkills, name)}`));
-    const kept = (next.skills ?? []).filter((entry) => !ours.has(entry));
-    const loaded = meta.groups.filter((group) => ids.includes(group.id)).flatMap((group) => group.skills);
-    const copies = skillsCliCopies(home, loaded);
-    const skills = [...kept, ...copies.map((name) => `-${join(agentsSkills, name)}`)];
-    if (skills.length) next.skills = skills;
-    else delete next.skills;
-    if (copies.length) notes.push(`Hid ${copies.length} Skills CLI cop${copies.length === 1 ? 'y' : 'ies'} in ${agentsSkills} from Pi so this package's versions load; Claude Code still uses them.`);
+    const copies = hideCopies(next, meta, ids, home);
+    if (copies.length) notes.push(hiddenNote(home, copies));
   }
   return { settings: next, notes };
 }
 
+// Run by the hide-copies extension at Pi startup: when the personal settings load this bundle,
+// hide the Skills CLI copies of what it loads. Returns a note when the settings changed, else null.
+export function syncHiddenCopies(meta, { home }) {
+  const path = settingsPath({ local: false, home });
+  if (!existsSync(path)) return null;
+  const settings = JSON.parse(readFileSync(path, 'utf8'));
+  if (!bundleEntry(settings, meta)) return null;
+  const next = structuredClone(settings);
+  const copies = hideCopies(next, meta, currentSelection(settings, meta, home), home);
+  if (JSON.stringify(next.skills ?? []) === JSON.stringify(settings.skills ?? [])) return null;
+  writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`);
+  return copies.length ? hiddenNote(home, copies) : 'Showed Skills CLI copies again for packages no longer loaded.';
+}
+
+async function download(url, file) {
+  const response = await fetch(url);
+  if (!response.ok) throw new Error(`Download failed: ${url} (HTTP ${response.status})`);
+  writeFileSync(file, Buffer.from(await response.arrayBuffer()));
+}
+
+// Installs a third-party source at its reviewed revision in dir: the reviewed skill folders under
+// skills/<name>/, its LICENSE, and a package.json that makes the folder a Pi package. Skips the
+// download when dir already holds that revision.
+export async function installExternal(ext, dir, { fetchArchive = download } = {}) {
+  const manifestPath = join(dir, 'package.json');
+  if (existsSync(manifestPath) && JSON.parse(readFileSync(manifestPath, 'utf8')).skillsSource?.revision === ext.revision) return false;
+  const work = mkdtempSync(join(tmpdir(), `1aboveio-skills-${ext.id}-`));
+  try {
+    const archive = join(work, 'source.tar.gz');
+    await fetchArchive(ext.archive, archive);
+    const members = [...ext.skills.map((skill) => `${ext.root}/${skill.path}`), ...(ext.license ? [`${ext.root}/${ext.license}`] : [])];
+    execFileSync('tar', ['-xzf', archive, '-C', work, ...members], { stdio: ['ignore', 'ignore', 'pipe'] });
+    const staged = join(work, 'package');
+    for (const skill of ext.skills) {
+      mkdirSync(join(staged, 'skills'), { recursive: true });
+      renameSync(join(work, ext.root, skill.path), join(staged, 'skills', skill.name));
+    }
+    if (ext.license) renameSync(join(work, ext.root, ext.license), join(staged, basename(ext.license)));
+    const manifest = {
+      name: `${ext.id}-skills`,
+      private: true,
+      description: `${ext.description} Installed by @1aboveio/skills from ${ext.repository} at ${ext.revision}.`,
+      pi: { skills: ['./skills'] },
+      skillsSource: { repository: ext.repository, revision: ext.revision },
+    };
+    writeFileSync(join(staged, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+    rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dirname(dir), { recursive: true });
+    renameSync(staged, dir);
+    return true;
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
 export function settingsPath({ local, home, cwd }) {
-  return local ? join(cwd, '.pi/settings.json') : join(process.env.PI_CODING_AGENT_DIR ? resolve(process.env.PI_CODING_AGENT_DIR) : join(home, '.pi/agent'), 'settings.json');
+  return local ? join(cwd, '.pi/settings.json') : join(agentDir(home), 'settings.json');
 }
 
 function describe(meta, ids) {
   const mark = (on) => `[${on ? 'x' : ' '}]`;
-  const total = meta.groups.reduce((sum, group) => sum + group.skills.length, 0);
+  const items = [
+    ...meta.groups.map((group) => ({ id: group.id, count: group.skills.length, description: group.description })),
+    ...externals(meta).map((ext) => ({ id: ext.id, count: ext.skills.length, description: `${ext.description} (downloaded from ${ext.repository})` })),
+  ];
+  const total = items.reduce((sum, item) => sum + item.count, 0);
   return [
-    `  0. ${mark(ids.length === meta.groups.length)} ${'all'.padEnd(16)} ${total} skills — every package`,
-    ...meta.groups.map((group, i) => `  ${i + 1}. ${mark(ids.includes(group.id))} ${group.id.padEnd(16)} ${group.skills.length} skills — ${group.description}`),
+    `  0. ${mark(ids.length === items.length)} ${'all'.padEnd(16)} ${total} skills — every package`,
+    ...items.map((item, i) => `  ${i + 1}. ${mark(ids.includes(item.id))} ${item.id.padEnd(16)} ${item.count} skills — ${item.description}`),
   ].join('\n');
 }
 
 // Reads a selection from the terminal: numbers or ids, 0 or "all", or nothing to keep the current one.
 async function ask(meta, current, input, output) {
   const rl = createInterface({ input, output });
+  const ids = allIds(meta);
   try {
     output.write(`${meta.name}: choose which packages Pi loads\n${describe(meta, current)}\n`);
     const keep = current.length ? 'Enter keeps the current selection' : 'Enter loads all';
     const answer = (await rl.question(`Packages to load (numbers or ids, 0 for all; ${keep}): `)).trim();
     const tokens = answer.split(/[\s,]+/).filter(Boolean);
-    if (!tokens.length) return current.length ? current : meta.groups.map((group) => group.id);
-    if (tokens.some((token) => token === '0' || token === 'all')) return meta.groups.map((group) => group.id);
-    return tokens.map((token) => (/^\d+$/.test(token) ? meta.groups[Number(token) - 1]?.id ?? token : token));
+    if (!tokens.length) return current.length ? current : ids;
+    if (tokens.some((token) => token === '0' || token === 'all')) return ids;
+    return tokens.map((token) => (/^\d+$/.test(token) ? ids[Number(token) - 1] ?? token : token));
   } finally {
     rl.close();
   }
 }
 
-export async function main(argv, { meta, log = console.log, home = homedir(), cwd = process.cwd(), input = process.stdin, output = process.stdout } = {}) {
+export async function main(argv, { meta, log = console.log, home = homedir(), cwd = process.cwd(), input = process.stdin, output = process.stdout, fetchArchive } = {}) {
   const options = parseArgs(argv);
   if (options.command === 'list') {
     for (const group of meta.groups) log(`${group.id} (${group.packageName}): ${group.skills.join(', ')}`);
+    for (const ext of externals(meta)) log(`${ext.id} (${ext.repository} at ${ext.revision.slice(0, 12)}): ${ext.skills.map((skill) => skill.name).join(', ')}`);
     return 0;
   }
   const path = settingsPath({ local: options.local, home, cwd });
   const settings = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {};
-  const entry = (settings.packages ?? []).find((e) => matchesSource(entrySource(e) ?? '', meta.name));
-  let ids = options.all ? meta.groups.map((group) => group.id) : options.ids;
+  let ids = options.all ? allIds(meta) : options.ids;
   if (!ids.length) {
     if (!input.isTTY) throw new Error(`No packages given and no terminal to ask.\n\n${USAGE}`);
-    ids = await ask(meta, entry ? currentSelection(entry, meta) : [], input, output);
+    ids = await ask(meta, bundleEntry(settings, meta) ? currentSelection(settings, meta, home) : [], input, output);
   }
   const plan = planSelection(meta, ids);
   const { settings: next, notes } = applySelection(settings, meta, plan.ids, { home, hide: !options.local });
@@ -163,6 +291,10 @@ export async function main(argv, { meta, log = console.log, home = homedir(), cw
   if (options.dryRun) {
     log(JSON.stringify(next, null, 2));
   } else {
+    for (const ext of externals(meta).filter((item) => plan.ids.includes(item.id))) {
+      const dir = externalDir(home, ext.id);
+      if (await installExternal(ext, dir, { fetchArchive })) log(`Installed ${ext.id} (${ext.skills.length} skills) from ${ext.repository} at ${ext.revision.slice(0, 12)} in ${dir}.`);
+    }
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`);
   }

package/extensions/hide-copies.ts

@@ -0,0 +1,21 @@
+// Shipped in @1aboveio/skills. At Pi startup, hides from Pi the Skills CLI copies in ~/.agents/skills
+// of the skills this bundle loads, so the package versions win without running the select
+// command. Writes only Pi's personal settings; the copies stay for Claude Code and Codex.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { syncHiddenCopies } from "../bin/select-core.mjs";
+
+const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const meta = { name: manifest.name, ...manifest.skillsPackage };
+
+export default function (pi: ExtensionAPI) {
+	pi.on("session_start", (_event, ctx) => {
+		try {
+			const note = syncHiddenCopies(meta, { home: process.env.HOME || homedir() });
+			if (note) ctx.ui.notify(`${manifest.name}: ${note} Run /reload to apply.`, "info");
+		} catch (error) {
+			ctx.ui.notify(`${manifest.name}: could not hide Skills CLI copies: ${(error as Error).message}`, "warning");
+		}
+	});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1aboveio/skills",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Every 1aboveio skill package in one: install once, then choose which packages Pi loads with npx @1aboveio/skills select.",
   "license": "MIT",
   "repository": {
@@ -21,11 +21,15 @@
   "files": [
     "skills",
     "bin",
+    "extensions",
     "README.md"
   ],
   "pi": {
     "skills": [
       "./skills"
+    ],
+    "extensions": [
+      "./extensions/hide-copies.ts"
     ]
   },
   "skillsPackage": {
@@ -34,13 +38,14 @@
       {
         "id": "core",
         "packageName": "@1aboveio/core-skills",
-        "description": "Shared writing and document foundation: house style, editorial review, Chinese polish, terminology, write-doc, distill-writing, doc-to-md and reg-parser.",
+        "description": "Shared writing and document foundation: house style, plain-language replies, editorial review, Chinese polish, terminology, write-doc, distill-writing, doc-to-md and reg-parser.",
         "needsCore": false,
         "skills": [
           "distill-writing",
           "doc-to-md",
           "editorial-review",
           "house-style",
+          "plain-language",
           "polish-cn",
           "reg-parser",
           "terminology",
@@ -54,6 +59,7 @@
         "needsCore": false,
         "skills": [
           "better-review",
+          "contributing",
           "e2e-test",
           "engineering-runtime",
           "ensure-coverage",
@@ -94,6 +100,7 @@
           "app-debug",
           "better-auth",
           "data-catalog",
+          "data-quality",
           "ios-foundation",
           "monorepo",
           "nextjs-fullstack",
@@ -139,7 +146,113 @@
         ]
       }
     ],
-    "digest": "0ff8c0fb72780cd0c50dfbeb86b50015c24ea65a76541075531b52e627d221a8"
+    "external": [
+      {
+        "id": "matt-pocock",
+        "description": "Matt Pocock's engineering skills: TDD, domain modeling, codebase design, grilling, triage and specs.",
+        "repository": "https://github.com/mattpocock/skills",
+        "lockSource": "mattpocock/skills",
+        "revision": "ed37663cc5fbef691ddfecd080dff42f7e7e350d",
+        "archive": "https://codeload.github.com/mattpocock/skills/tar.gz/ed37663cc5fbef691ddfecd080dff42f7e7e350d",
+        "root": "skills-ed37663cc5fbef691ddfecd080dff42f7e7e350d",
+        "license": "LICENSE",
+        "skills": [
+          {
+            "name": "batch-grill-me",
+            "path": "skills/in-progress/batch-grill-me"
+          },
+          {
+            "name": "code-review",
+            "path": "skills/engineering/code-review"
+          },
+          {
+            "name": "codebase-design",
+            "path": "skills/engineering/codebase-design"
+          },
+          {
+            "name": "diagnosing-bugs",
+            "path": "skills/engineering/diagnosing-bugs"
+          },
+          {
+            "name": "domain-modeling",
+            "path": "skills/engineering/domain-modeling"
+          },
+          {
+            "name": "grill-me",
+            "path": "skills/productivity/grill-me"
+          },
+          {
+            "name": "grill-with-docs",
+            "path": "skills/engineering/grill-with-docs"
+          },
+          {
+            "name": "grilling",
+            "path": "skills/productivity/grilling"
+          },
+          {
+            "name": "handoff",
+            "path": "skills/productivity/handoff"
+          },
+          {
+            "name": "improve-codebase-architecture",
+            "path": "skills/engineering/improve-codebase-architecture"
+          },
+          {
+            "name": "prototype",
+            "path": "skills/engineering/prototype"
+          },
+          {
+            "name": "research",
+            "path": "skills/engineering/research"
+          },
+          {
+            "name": "resolving-merge-conflicts",
+            "path": "skills/engineering/resolving-merge-conflicts"
+          },
+          {
+            "name": "setup-matt-pocock-skills",
+            "path": "skills/engineering/setup-matt-pocock-skills"
+          },
+          {
+            "name": "tdd",
+            "path": "skills/engineering/tdd"
+          },
+          {
+            "name": "to-spec",
+            "path": "skills/engineering/to-spec"
+          },
+          {
+            "name": "to-tickets",
+            "path": "skills/engineering/to-tickets"
+          },
+          {
+            "name": "triage",
+            "path": "skills/engineering/triage"
+          },
+          {
+            "name": "wayfinder",
+            "path": "skills/engineering/wayfinder"
+          }
+        ]
+      },
+      {
+        "id": "impeccable",
+        "description": "impeccable frontend design skill: design, critique, audit and polish interfaces.",
+        "repository": "https://github.com/pbakaus/impeccable",
+        "lockSource": "pbakaus/impeccable",
+        "revision": "5a149f3fdb1b5793f10567233b1dcab98fc305fd",
+        "archive": "https://codeload.github.com/pbakaus/impeccable/tar.gz/5a149f3fdb1b5793f10567233b1dcab98fc305fd",
+        "root": "impeccable-5a149f3fdb1b5793f10567233b1dcab98fc305fd",
+        "license": "LICENSE",
+        "skills": [
+          {
+            "name": "impeccable",
+            "path": ".agents/skills/impeccable"
+          }
+        ]
+      }
+    ],
+    "digest": "2fd562d9ed92abc75cc42a5011e004bc254744244b9ea99a99df8d62461afd40"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skills/app-dev/airflow/SKILL.md

@@ -2,7 +2,7 @@
 name: airflow
 description: Airflow DAG architecture and conventions. Use when designing, writing, reviewing, testing, or debugging Airflow DAGs and tasks, including TaskGroups, data intervals, timezone-aware date parameters, CLI validation, environment-based scheduling, and pytest integrity tests.
 user-invocable: true
-release-version: 0.38.0
+release-version: 0.40.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Airflow DAG Development Patterns

package/skills/app-dev/android-foundation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: android-foundation
 description: "Prove an Expo / React Native app on a native Android emulator, and fix it when that proof fails. Use before you fix and re-run or re-dispatch a failed Android CI job (`gh workflow run android.yml`, `gh run rerun`): a re-run is not a debugger, so reproduce the failing journey checkpoint off CI first. Also use when a UiAutomator journey or its Python harness tests fail (a CHECK/FAIL line, a wait that timed out, a control not found, adb offline, a lost Metro bridge, a fixture failing on the runner), to build the debug APK and run the device journey, to set up a fresh Android workspace (SDK/NDK/JDK, Gradle caches, private AVD, disposable PostgreSQL), or to add the emulator job to CI. NOT for workflow YAML, CI speed or runner design (github-actions), browser tests (e2e-test), iOS (ios-foundation), plain Jest component tests, or signing and store release."
-release-version: 0.38.0
+release-version: 0.40.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Android foundation

package/skills/app-dev/app-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: app-debug
 description: "Diagnose runtime failures in deployed Cloud Run services — 5xx/422 errors, tracebacks, Next.js SSR/hydration or Server Action failures, DB/Secret Manager connection errors, cold-start timeouts, container OOM. NOT for build or deploy failures (cloud-debug)."
-release-version: 0.38.0
+release-version: 0.40.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # App Debug

package/skills/app-dev/better-auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: better-auth
 description: "Add or debug Better Auth for Next.js App Router: login, sessions, protected routes, middleware, OAuth (including Feishu/Lark), cookies, Prisma, and Auth.js migration."
-release-version: 0.38.0
+release-version: 0.40.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Better Auth for Next.js

package/skills/app-dev/data-catalog/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-catalog
 description: "Column definitions for warehouse tables, written inside the Spark/PySpark or SQL script that builds each table (CATALOG_TABLE / CATALOG_FIELDS, or a `-- @field` comment block), with a generated markdown catalog in docs/catalog/ and a CI check that fails a PR whose catalog is stale. Use when writing or changing a table script that adds, renames, removes, or changes the meaning of an output column or feature; when asked what a warehouse column or feature means; to set a repo up ('init the data catalog', 'generate the data dictionary', '字段字典', 'add catalog CI'); or to audit existing SQL or Spark scripts for undocumented columns. NOT for implementing or tuning the Spark job itself (pyspark), DAG wiring (airflow), or general workflow YAML (github-actions)."
-release-version: 0.38.0
+release-version: 0.40.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data catalog
@@ -42,6 +42,7 @@ Never document tables during setup unless the task asks for it.
 | CI says the catalog is stale | `python3 <engine> generate`, commit the pages |
 | Before committing a table-script change, or reviewing one | `python3 <engine> drift` (`--base origin/main` for a whole branch) |
 | `Field`/`Table` arguments, the SQL block, config keys, exit codes | [references/format.md](references/format.md) |
+| Does the table's data match its definitions? | the data-quality skill |
 
 `<engine>` is `scripts/data-catalog/data_catalog.py` in the repo, or
 `<skill-base-dir>/scripts/data_catalog.py` before the repo has a copy. When