@1aboveio/skills 1.0.7 → 1.0.9

package/skills/app-dev/android-foundation/references/gotchas.md

@@ -177,8 +177,10 @@ matches, [confirm the suspected cause](#confirm-a-suspected-cause) before changi
 
 ### Postgres setup hooks time out
 
-- **Cause:** durability is on.
-- **Fix:** disable `fsync` and `synchronous_commit` on the disposable service.
+- **Possible cause:** durability overhead, if timing or database logs establish it.
+- **Fix:** investigate the slow hook first. Disable `fsync` and `synchronous_commit`
+  only on a disposable service when measured and when tests do not require persistence
+  or recovery semantics. A timeout by itself does not establish this cause.
 
 ### The job never starts
 
@@ -200,11 +202,13 @@ matches, [confirm the suspected cause](#confirm-a-suspected-cause) before changi
 - **Cause:** the journey's Backend runs on the runner itself, and the self-hosted runner
   image has no browser (or other app-launched tool). A developer machine does, so it only
   fails in CI.
-- **Fix:** don't install it on the runner, and don't treat it as a product bug. Point the
-  app's browser variable (`CHROMIUM_PATH`) at a wrapper that runs the pinned Playwright
-  image's browser: `github-actions` → `references/runners.md`, "A host process that needs
-  a browser binary". Prove it in CI; Docker Desktop on macOS cannot reach the wrapper's
-  host-network port.
+- **Fix:** inspect the runner's supported browser packaging first. One option is the
+  pinned Playwright-image wrapper described by `github-actions` →
+  `references/runners.md`, "A host process that needs a browser binary". Reproduce the
+  failing command and verify the wrapper on a compatible isolated Linux environment
+  before CI acceptance; Docker Desktop on macOS cannot prove that host-network path.
+  If no compatible diagnostic environment is available, report that gap and collect
+  targeted evidence rather than sending an unverified configuration fix to CI.
 
 ### A failed run's Metro log is gone
 
@@ -215,7 +219,12 @@ matches, [confirm the suspected cause](#confirm-a-suspected-cause) before changi
 
 ## Confirm a suspected cause
 
-Inject the suspected cause on purpose, for example `adb reverse --remove tcp:8081` right
-before the failing step, and check that it reproduces the exact failure signature: the same
-step, error and error count. Then show that the fix passes the same injection. A cause that
-does not reproduce its signature is a guess, and a fix for a guess is not proof.
+Choose a test that can distinguish the suspected cause from its alternatives, as described
+in [diagnosis.md](diagnosis.md#choose-a-test-that-can-expose-the-defect). A regression test
+that reproduces the defect and passes with the correction may suffice. When safe and
+relevant, deliberate fault injection can strengthen the evidence: for example, remove a
+reverse mapping on an owned test device and compare the failure signature before and
+after the correction. Injection and A/B/A are optional techniques, not universal gates.
+For intermittent failures, compare bounded samples under equivalent conditions rather
+than requiring an identical error count. Report a cause as unconfirmed when the evidence
+does not distinguish it; do not manufacture certainty from a passing run.

package/skills/app-dev/android-foundation/references/setup.md

@@ -50,6 +50,8 @@ export SETUP_AVD=<new-unique-avd-name>
 export EMULATOR_PORT=<even-port-5554-5584>
 export ANDROID_BACKEND_PORT=<free-port>
 export ANDROID_METRO_PORT=<free-port>
+# Choose the whole-journey deadline; zero disables it and is not suitable for unattended runs.
+export JOURNEY_SECONDS=<positive-journey-timeout-seconds>
 ENV
 source .cache/android-env.sh
 mkdir -p "$TMPDIR" "$npm_config_cache" "$npm_config_devdir" \
@@ -63,8 +65,10 @@ for component in platforms/android-<api> build-tools/<build-tools> ndk/<ndk> cma
 done
 ```
 
-If the wrapper reads its port or Python variables under other names, export those names in
-`android-env.sh` instead.
+If the wrapper reads ports or Python under other names, export aliases in
+`android-env.sh` **as well as** the bundled runner's required names. For example,
+`export APP_METRO_PORT="$ANDROID_METRO_PORT"`; both must select the same port. Adapt
+`DB_URL_VAR` and `DB_NAME_VAR` to the actual harness, not its fallback defaults.
 
 ## 2. Install and check
 
@@ -152,13 +156,18 @@ Pass each command as separate words, not as one quoted string. The script:
 2. Refuses an emulator port outside 5554–5584 and any busy port.
 3. Starts the ADB server, then the emulator (its PID recorded), then `postgres` with
    `--cidfile` on a random loopback port. Override the image with `POSTGRES_IMAGE`.
-4. Waits for `sys.boot_completed=1` and `pg_isready`. Every command has a 30-second limit
-   (`BOUNDED_SECONDS`) that kills the command's whole process group; exit 124 is terminal.
+4. Waits for `sys.boot_completed=1` and `pg_isready`. Startup/readiness and cleanup
+   commands have a 30-second limit (`BOUNDED_SECONDS`); exit 124 is terminal. The journey
+   uses the separate `JOURNEY_SECONDS` deadline. Leave time for cleanup after that deadline.
 5. Exports `$DB_URL_VAR`, `$DB_NAME_VAR` (`$DB_NAME_PREFIX` plus a unique suffix) and
    `ANDROID_EMULATOR_SERIAL`, then runs the journey.
 6. Drops the database, stops the emulator PID (`TERM`, then `KILL` after 10 seconds),
    removes the container by its CID, and prints `original_stage_exit=<n> cleanup_exit=<n>`.
    It exits with the journey's status if the journey failed, else the cleanup status.
 
-The journey stops its own backend and Metro children. Capture the command's exit status and
-the last output line for the evidence record.
+The runner supervises the journey's process group. Journey children must stay in that
+group; a wrapper that deliberately creates detached services must stop those services
+through its own owner. Send TERM to the launcher and allow its cleanup to finish rather
+than killing it immediately. The generic runner inherits the caller's ADB endpoint and
+does not stop that server: use a verified private endpoint on a shared host and close it
+through the caller's owner. Capture the command's exit status and final summary line.

package/skills/app-dev/android-foundation/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/android-foundation/scripts/device-run.sh

@@ -16,6 +16,13 @@
 # Optional environment:
 #   POSTGRES_IMAGE (postgres:17)  DB_URL_VAR (SHARD_ADMIN_URL)  DB_NAME_VAR (SHARD_DB_NAME)
 #   LOG_DIR (.cache/logs)  BOUNDED_SECONDS (30)  BOOT_ATTEMPTS (60)  KILL_GRACE_SECONDS (10)
+#   JOURNEY_SECONDS (0 = no deadline; caller chooses a positive whole-journey limit)
+#
+# ADB_SERVER_SOCKET / ANDROID_ADB_SERVER_PORT are inherited unchanged. The caller
+# selects a private ADB endpoint before entry; this script never stops that server.
+# Journey children must stay in their process group (no daemonizing / setsid).
+# Send TERM to this launcher and allow cleanup to finish, rather than killing it.
+# A forced kill or host crash cannot clean up; keep the printed resource directory.
 #
 # Exports ANDROID_EMULATOR_SERIAL, $DB_URL_VAR and $DB_NAME_VAR to both commands.
 # Prints `original_stage_exit=<n> cleanup_exit=<n>` last and exits with the
@@ -47,6 +54,26 @@ LOG_DIR="${LOG_DIR:-.cache/logs}"
 BOUNDED_SECONDS="${BOUNDED_SECONDS:-30}"
 BOOT_ATTEMPTS="${BOOT_ATTEMPTS:-60}"
 KILL_GRACE_SECONDS="${KILL_GRACE_SECONDS:-10}"
+JOURNEY_SECONDS="${JOURNEY_SECONDS:-0}"
+
+# Reject invalid limits before creating any owned resources.
+python3 -c 'import math, sys
+for value in sys.argv[1:4]:
+    number = float(value)
+    if not math.isfinite(number) or number < 0: sys.exit("limits must be finite and non-negative")
+if float(sys.argv[1]) == 0: sys.exit("BOUNDED_SECONDS must be positive")
+if not sys.argv[4].isdigit() or int(sys.argv[4]) < 1: sys.exit("BOOT_ATTEMPTS must be a positive integer")' \
+  "$BOUNDED_SECONDS" "$KILL_GRACE_SECONDS" "$JOURNEY_SECONDS" "$BOOT_ATTEMPTS" || exit 2
+for variable in "$DB_URL_VAR" "$DB_NAME_VAR"; do
+  if ! [[ "$variable" =~ ^[a-zA-Z_][a-zA-Z_0-9]*$ ]]; then
+    echo "invalid database environment variable: $variable" >&2
+    exit 2
+  fi
+done
+if test "$DB_URL_VAR" = "$DB_NAME_VAR"; then
+  echo "DB_URL_VAR and DB_NAME_VAR must differ" >&2
+  exit 2
+fi
 
 if ! [[ "$EMULATOR_PORT" =~ ^[0-9]+$ ]] || (( EMULATOR_PORT < 5554 || EMULATOR_PORT > 5584 || EMULATOR_PORT % 2 )); then
   echo "EMULATOR_PORT must be an even port in 5554-5584: $EMULATOR_PORT" >&2
@@ -56,67 +83,139 @@ fi
 mkdir -p "$LOG_DIR"
 run_dir="$(mktemp -d "${TMPDIR:-/tmp}/android-device-run.XXXXXX")"
 emulator_pid=""
+active_pid=""
 db_ready=""
+container_started=""
+launch_in_progress=0
+pending_signal=0
+handle_signal() {
+  pending_signal="$1"
+  # Do not abandon a spawned supervisor before its PID has been recorded.
+  if test "$launch_in_progress" -eq 0; then exit "$pending_signal"; fi
+}
+honor_pending_signal() {
+  if test "$pending_signal" -ne 0; then exit "$pending_signal"; fi
+}
+echo "Owned resource records: $run_dir" >&2
 export ANDROID_EMULATOR_SERIAL="emulator-$EMULATOR_PORT"
 
-bounded() {
-  # Kill the whole process group on timeout: a surviving grandchild would hold
-  # the output pipe open and stall the caller past the deadline.
-  python3 -c 'import os, signal, subprocess, sys
-limit = float(sys.argv[1])
-child = subprocess.Popen(sys.argv[2:], start_new_session=True)
+supervise() {
+  # Only called in a background subshell: exec makes $! the signal-aware owner.
+  # Keep the process group owned even if its original leader exits first.
+  exec python3 -c 'import os, signal, subprocess, sys, time
+limit, grace = map(float, sys.argv[1:3])
+mode = sys.argv[3]
+cancelled = 0
+def cancel(signum, frame):
+    global cancelled
+    cancelled = 128 + signum
+signal.signal(signal.SIGTERM, cancel)
+signal.signal(signal.SIGINT, cancel)
 try:
-    sys.exit(child.wait(timeout=limit))
-except subprocess.TimeoutExpired:
-    os.killpg(child.pid, signal.SIGKILL)
-    child.wait()
-    print("Command exceeded %s seconds: %s" % (sys.argv[1], " ".join(sys.argv[2:])), file=sys.stderr)
-    sys.exit(124)' "$BOUNDED_SECONDS" "$@"
+    child = subprocess.Popen(sys.argv[4:], start_new_session=True)
+except FileNotFoundError as error:
+    print(error, file=sys.stderr)
+    sys.exit(127)
+except OSError as error:
+    print(error, file=sys.stderr)
+    sys.exit(126)
+def group_alive():
+    # Ignore unreapable orphan zombies. macOS can return EPERM, not ESRCH, for
+    # an empty group under a sandbox, so inspect membership before signalling.
+    listing = subprocess.check_output(["ps", "-A", "-o", "pgid=,stat="], text=True)
+    return any(int(parts[0]) == child.pid and not parts[1].startswith("Z")
+               for line in listing.splitlines() if len(parts := line.split()) == 2)
+def send(sig):
+    try: os.killpg(child.pid, sig)
+    except ProcessLookupError: pass
+    except PermissionError:
+        if group_alive(): raise
+end = time.monotonic() + limit if limit else float("inf")
+timed_out = False
+while child.poll() is None and not cancelled:
+    if time.monotonic() >= end:
+        timed_out = True
+        break
+    time.sleep(0.02)
+forced = False
+if timed_out:
+    send(signal.SIGKILL)
+else:
+    send(signal.SIGTERM)
+    stop = time.monotonic() + grace
+    while group_alive() and time.monotonic() < stop:
+        child.poll()
+        time.sleep(0.02)
+    if group_alive():
+        forced = True
+        send(signal.SIGKILL)
+status = child.wait()
+status = 128 - status if status < 0 else status
+if timed_out:
+    print("Command exceeded %s seconds: %s" % (sys.argv[1], " ".join(sys.argv[4:])), file=sys.stderr)
+    sys.exit(124)
+if mode == "emulator" and forced: sys.exit(1)
+sys.exit(cancelled or status or (1 if forced else 0))' "$1" "$KILL_GRACE_SECONDS" "${@:2}"
+}
+
+managed() {
+  local limit="$1" status=0
+  shift
+  launch_in_progress=1
+  supervise "$limit" command "$@" <&0 &
+  active_pid=$!
+  launch_in_progress=0
+  honor_pending_signal
+  # Bash defers signal traps for foreground commands, but not for this wait.
+  wait "$active_pid" || status=$?
+  active_pid=""
+  return "$status"
 }
 
+bounded() { managed "$BOUNDED_SECONDS" "$@"; }
+
 cleanup() {
   original_status=$?
-  trap - EXIT INT TERM
+  trap - EXIT
+  trap '' INT TERM
+  pending_signal=0
+  launch_in_progress=0
   set +e
   cleanup_status=0
+  if test -n "$active_pid"; then
+    kill -TERM "$active_pid" 2>/dev/null
+    wait "$active_pid" || :
+    active_pid=""
+  fi
   if test -n "$db_ready"; then
     bounded "${drop_cmd[@]}" || cleanup_status=1
   fi
   if test -n "$emulator_pid"; then
-    if kill -0 "$emulator_pid" 2>/dev/null; then
-      kill -TERM "$emulator_pid" || cleanup_status=1
-    fi
-    for _ in $(seq 1 "$KILL_GRACE_SECONDS"); do
-      kill -0 "$emulator_pid" 2>/dev/null || break
-      sleep 1
-    done
-    if kill -0 "$emulator_pid" 2>/dev/null; then
-      cleanup_status=1
-      kill -KILL "$emulator_pid"
-      sleep 1
-    fi
-    if kill -0 "$emulator_pid" 2>/dev/null; then
-      cleanup_status=1
-    else
-      wait "$emulator_pid"
-      emulator_status=$?
-      # 0 = clean exit; 143 = ended by our TERM. A KILL was already counted above.
-      case "$emulator_status" in 0|143) ;; *) cleanup_status=1 ;; esac
-    fi
+    kill -TERM "$emulator_pid" 2>/dev/null
+    emulator_status=0
+    wait "$emulator_pid" || emulator_status=$?
+    case "$emulator_status" in 0|143) ;; *) cleanup_status=1 ;; esac
   fi
   if test -s "$run_dir/postgres.cid"; then
     container_id="$(< "$run_dir/postgres.cid")"
     bounded docker rm --force "$container_id" >/dev/null || cleanup_status=1
-    remaining="$(bounded docker ps -a --no-trunc --filter "id=$container_id" --format '{{.ID}}')" || cleanup_status=1
-    test -z "$remaining" || cleanup_status=1
+    bounded docker ps -a --no-trunc --filter "id=$container_id" --format '{{.ID}}' \
+      > "$run_dir/remaining" || cleanup_status=1
+    test ! -s "$run_dir/remaining" || cleanup_status=1
+  elif test -n "$container_started"; then
+    echo "Container startup not acknowledged; ownership unknown, inspect $run_dir before recovery" >&2
+    cleanup_status=1
   fi
-  printf 'original_stage_exit=%s cleanup_exit=%s\n' "$original_status" "$cleanup_status"
+  printf 'original_stage_exit=%s cleanup_exit=%s\n' "$original_status" "$cleanup_status" >&3
   if test "$original_status" -ne 0; then exit "$original_status"; fi
   exit "$cleanup_status"
 }
+# EXIT can run inside a redirected function (notably docker run >/dev/null).
+# Keep the caller's output for the final status line, even on startup failure.
+exec 3>&1
 trap cleanup EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
+trap 'handle_signal 130' INT
+trap 'handle_signal 143' TERM
 
 # Every port this run listens on or dials must be free before anything starts.
 python3 -c 'import socket, sys
@@ -130,21 +229,28 @@ bounded adb start-server
 
 # -memory 4096 overrides the AVD's hw.ramSize, so a reused 2 GB AVD cannot starve the
 # guest kernel's vsock allocations and drop adb mid-journey (references/gotchas.md).
-"$ANDROID_HOME/emulator/emulator" -avd "$SETUP_AVD" -port "$EMULATOR_PORT" -memory 4096 \
+launch_in_progress=1
+supervise 0 emulator "$ANDROID_HOME/emulator/emulator" -avd "$SETUP_AVD" -port "$EMULATOR_PORT" -memory 4096 \
   -no-window -no-audio -no-snapshot -gpu swiftshader_indirect -accel on \
   > "$LOG_DIR/emulator.log" 2>&1 &
 emulator_pid=$!
+launch_in_progress=0
+honor_pending_signal
 
 container_name="android-device-run-$(date +%s)-$$"
+container_started=1
+printf '%s\n' "$container_name" > "$run_dir/container-name"
 bounded docker run --detach --name "$container_name" --cidfile "$run_dir/postgres.cid" \
   --publish 127.0.0.1::5432 --env POSTGRES_USER=postgres \
   --env POSTGRES_PASSWORD=postgres --env POSTGRES_DB=postgres "$POSTGRES_IMAGE" >/dev/null
-db_port="$(bounded docker port "$container_name" 5432/tcp | head -1 | awk -F: '{print $NF}')"
+bounded docker port "$container_name" 5432/tcp > "$run_dir/postgres.port"
+db_port="$(head -1 "$run_dir/postgres.port" | awk -F: '{print $NF}')"
 test -n "$db_port"
 
 boot_state=""
 for _ in $(seq 1 "$BOOT_ATTEMPTS"); do
-  if boot_state="$(bounded adb -s "$ANDROID_EMULATOR_SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r')"; then
+  if bounded adb -s "$ANDROID_EMULATOR_SERIAL" shell getprop sys.boot_completed > "$run_dir/boot" 2>/dev/null; then
+    boot_state="$(tr -d '\r' < "$run_dir/boot")"
     if test "$boot_state" = 1; then break; fi
   else
     probe_status=$?
@@ -173,4 +279,4 @@ export "$DB_URL_VAR=postgresql://postgres:postgres@127.0.0.1:$db_port/postgres"
 export "$DB_NAME_VAR=${DB_NAME_PREFIX}$(date +%s)_$$"
 db_ready=1
 
-"${journey_cmd[@]}"
+managed "$JOURNEY_SECONDS" "${journey_cmd[@]}"

package/skills/app-dev/app-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: app-debug
 description: "Diagnose runtime failures in deployed Cloud Run services — 5xx/422 errors, tracebacks, Next.js SSR/hydration or Server Action failures, DB/Secret Manager connection errors, cold-start timeouts, container OOM. NOT for build or deploy failures (cloud-debug)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # App Debug

package/skills/app-dev/app-debug/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/better-auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: better-auth
 description: "Add or debug Better Auth for Next.js App Router: login, sessions, protected routes, middleware, OAuth (including Feishu/Lark), cookies, Prisma, and Auth.js migration."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Better Auth for Next.js

package/skills/app-dev/better-auth/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/data-catalog/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-catalog
 description: "Column definitions for warehouse tables, written inside the Spark/PySpark or SQL script that builds each table (CATALOG_TABLE / CATALOG_FIELDS, or a `-- @field` comment block), with a generated markdown catalog in docs/catalog/ and a CI check that fails a PR whose catalog is stale. Use when writing or changing a table script that adds, renames, removes, or changes the meaning of an output column or feature; when asked what a warehouse column or feature means; to set a repo up ('init the data catalog', 'generate the data dictionary', '字段字典', 'add catalog CI'); or to audit existing SQL or Spark scripts for undocumented columns. NOT for implementing or tuning the Spark job itself (pyspark), DAG wiring (airflow), or general workflow YAML (github-actions)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data catalog

package/skills/app-dev/data-catalog/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/data-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-quality
 description: "Check a published warehouse table's data against its data-catalog definitions with read-only SELECTs: columns never filled or stuck at one value, counts below zero, ratios outside 0–1, declared values that never appear and undeclared values that do. Then classify each finding as a wrong definition, wrong code, or wrong data. Use when asked whether a table's data is right, to profile or sanity-check a dwd/ads table, to find dead or constant columns, to check a column's values against its documented list, after a pipeline change ships, or when a data-catalog definition and the data might disagree. NOT for validating a Spark change before it ships (pyspark canary and reconciliation), writing definitions (data-catalog), or monitoring dashboards."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data quality

package/skills/app-dev/data-quality/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/ios-foundation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ios-foundation
 description: "Set up and prove an Expo / React Native native iOS workspace from a clean checkout to a manual Login smoke on an owned iOS Simulator: isolated worktree and private caches, Xcode/runtime/CocoaPods preflight, frozen install with `pod install --deployment`, platform-scoped prebuild, an ad-hoc-signed Debug simulator build, a private simulator by exact UDID, Metro on a free port, a disposable PostgreSQL backend with owned cleanup, and the evidence record (setup proof only; feature work reports the smoke result). Use for 'set up iOS', 'build the iOS app', 'run the app on the iOS simulator', 'add iOS to the React Native app', 'prove the iOS build', or when a pod install, xcodebuild, simulator boot, Metro connection or Keychain session fails. NOT for Android (android-foundation), signing, TestFlight or App Store release, or general workflow YAML (github-actions)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # iOS foundation

package/skills/app-dev/ios-foundation/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/monorepo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: monorepo
 description: Turborepo architecture for shared packages, pnpm workspaces, DAL boundaries, and pipelines.
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Turborepo Monorepo Architecture

package/skills/app-dev/monorepo/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/nextjs-fullstack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nextjs-fullstack
 description: "Build or debug Next.js App Router features with React 19 — pages/layouts/route handlers, Server/Client Components, Server Actions, forms, middleware, DAL, strict TypeScript, Zod — plus our conventions: nuqs URL state, SWR cache, Skeleton/Progress + Sonner feedback, drag-and-drop upload, the portal app shell, list pages as filter/sort/paginate tables. shadcn component mechanics: see the shadcn skill."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Next.js 16 Fullstack Development

package/skills/app-dev/nextjs-fullstack/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/prisma-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: prisma-setup
 description: Use when adding or debugging Prisma with PostgreSQL, Next.js, or Turborepo, including schema.prisma, prisma.config.ts, client generation, migrations, seeds, relations, adapters, and DAL/database-layer setup. Triggers on phrases like "Prisma schema", "prisma migrate", "schema.prisma", "seed the database", "PrismaClient error", "relation issue", or "database layer".
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Prisma v7 Setup Guide

package/skills/app-dev/prisma-setup/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/app-dev/pyspark/SKILL.md

@@ -12,7 +12,7 @@ description: >
   Connect, spark-submit, Hudi commits, backfills, validate-only canaries,
   cluster reconciliation, or Spark event-log profiling — including warehouse
   job timeouts, empty Hudi writes, or EMR/Dataproc performance regressions.
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # PySpark

package/skills/app-dev/pyspark/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));