@1aboveio/skills 1.0.7 → 1.0.9

package/skills/content/xai-search/SKILL.md

@@ -8,8 +8,8 @@ metadata:
       apiKey:
         type: secret
         required: true
-        description: xAI API key (get from console.x.ai)
-release-version: 0.43.0
+        description: API key for direct xAI or the explicitly configured Responses gateway
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # xAI Search (X/Twitter + Web)
@@ -18,10 +18,48 @@ Search X (formerly Twitter) and the web in real time using xAI's Grok live-searc
 
 ## Prerequisites
 
-1. **Get xAI API key** from [console.x.ai](https://console.x.ai)
-2. Configure in OpenClaw: `skills.entries.xai-search.apiKey`, or set `XAI_API_KEY` in the environment.
+1. Choose direct xAI or a Responses-compatible gateway, as below.
+2. Set `XAI_API_KEY`, or configure `skills.entries["xai-search"].apiKey` in
+   `~/.openclaw/openclaw.json`. A nonempty environment key takes precedence.
 3. `jq` and `curl` must be available.
 
+## Endpoint and credentials
+
+With no new configuration, requests still go to `https://api.x.ai/v1/responses`
+with the default model `grok-4-1-fast-reasoning`. Get a direct xAI key from
+[console.x.ai](https://console.x.ai).
+
+```bash
+export XAI_API_KEY='<direct-xai-key>'
+scripts/xai_search.sh x "latest xAI announcements"
+```
+
+For Sub2API, use the deployment's **public HTTPS API base ending in `/v1`**, not
+an internal OAuth proxy URL. Use a **Sub2API API key assigned to a Grok group**,
+not the direct xAI key. Select a model that this group/account actually exposes:
+
+```bash
+export XAI_BASE_URL='https://sub2api.example.com/v1'
+export XAI_API_KEY='<sub2api-grok-group-key>'
+scripts/xai_search.sh x "latest xAI announcements" --model grok-4.5
+```
+
+The example hostname is a placeholder for your deployment. `grok-4.5` is an
+example supported by the inspected Sub2API checkout, not an entitlement promise.
+Model mappings and available names depend on the deployment and subscription
+account; do not assume every public xAI model is available.
+
+`XAI_BASE_URL` defaults to `https://api.x.ai/v1`. The CLI removes all trailing
+slashes and appends `/responses` exactly once, so configure an API base, not a full
+Responses URL. An explicitly empty base is invalid. Bases must use HTTPS and
+must not contain URL credentials, query parameters, or fragments. The selected
+key goes only to this endpoint: there is no automatic direct-xAI fallback and
+redirects are not followed. Unset `XAI_BASE_URL` and restore a direct key to
+return to direct xAI. Keep keys out of prompts, command output, and committed files.
+
+Native `x_search` and `web_search` require **Responses**. Do not use REST Chat
+Completions or removed `search_parameters` for this workflow.
+
 ## Invocation
 
 Run the bundled script. Pass the skill directory's absolute path or `cd` into it first — the script lives at `scripts/xai_search.sh` relative to this SKILL.md.
@@ -43,21 +81,36 @@ scripts/xai_search.sh web "AI research" --domains arxiv.org,openai.com
 
 | Parameter | Applies to | Description |
 |-----------|------------|-------------|
-| `--handles user1,user2` | `x` | Restrict to posts from these handles |
-| `--from YYYY-MM-DD` | `x` | Start date (inclusive) |
-| `--to YYYY-MM-DD` | `x` | End date (inclusive) |
-| `--domains d1,d2` | `web` | Restrict to these domains |
+| `--handles user1,user2` | `x` | Restrict to posts from these handles; at most 20 |
+| `--from YYYY-MM-DD` | `x` | Inclusive start at UTC midnight |
+| `--to YYYY-MM-DD` | `x` | Exclusive end at UTC midnight |
+| `--domains d1,d2` | `web` | Restrict to these domains; at most 5 |
 | `--model MODEL` | both | Override model (default: `grok-4-1-fast-reasoning`) |
 | `--json` | both | Print the raw JSON response instead of formatted text + sources |
+| `--help` | both | Show configuration, date boundaries, and limits without credentials |
+
+For example, `--from 2026-01-01 --to 2026-02-01` includes January 1 at
+00:00 UTC through, but not including, February 1 at 00:00 UTC. Dates must be real
+calendar dates in `YYYY-MM-DD` form. **Handle/date filters do not constrain thread
+fetches.** CSV entries are trimmed; empty or whitespace-only entries and lists
+above the limit are rejected before a request. Options that take values require
+a nonempty value. Web domains are sent as `tools[].filters.allowed_domains`.
 
 The script prints the assistant's text answer followed by a `Sources:` block of cited URLs.
+`--json` preserves the response JSON instead. Any echoed API key is redacted in
+both modes. HTTP errors, transport failures, malformed/non-JSON responses, and
+formatted responses without text exit nonzero; upstream HTML and curl diagnostics
+are not printed because they may contain credentials.
+
+## Models and billing
 
-## Models
+`--model` overrides the unchanged direct default `grok-4-1-fast-reasoning`.
+Choose the exact name exposed by your direct account or gateway's model mapping.
+A gateway key and model must belong to the configured Grok group.
 
-| Model | Description |
-|-------|-------------|
-| `grok-4-1-fast-reasoning` | Default. Fast reasoning variant, 2M context, strong tool calling. |
-| `grok-4-1-fast-non-reasoning` | Same family, no chain-of-thought; cheaper for simple lookups. |
+Sub2API may charge a search-call surcharge. Those call counts need not match
+current upstream X pricing based on fetched posts/profiles, so do not use them
+as exact upstream cost reconciliation.
 
 ## API Usage (curl)
 
@@ -73,6 +126,28 @@ curl https://api.x.ai/v1/responses \
   }'
 ```
 
+## Verification
+
+The public CLI tests are offline, use a temporary HOME and a PATH-injected curl
+stand-in, and need no real key or network:
+
+```bash
+node --test skills/utils/xai-search/scripts/xai_search.test.mjs
+```
+
+Do not run a live smoke implicitly. It makes paid requests and requires explicit
+opt-in plus a non-secret account label. Set the endpoint, key, and model for the
+account being tested, then run from the skill directory:
+
+```bash
+XAI_LIVE_SMOKE=1 XAI_SMOKE_ACCOUNT='my-grok-group' XAI_SMOKE_MODEL='grok-4.5' \
+  bash tests/smoke_test.sh
+```
+
+The smoke prints the tested account label and model. Offline capture proves the
+client request, not live account entitlement, filter enforcement, or citation
+fidelity. Those remain unverified until an explicitly authorized live test.
+
 ## Related Skills
 
 - `gemini` skill (when installed) — alternative for general research

package/skills/content/xai-search/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/content/xai-search/scripts/xai_search.sh

@@ -1,187 +1,163 @@
 #!/usr/bin/env bash
-# xAI Search CLI - Search X (Twitter) and Web using xAI Responses API
-# Usage:
-#   xai_search.sh x "query" [--handles user1,user2] [--from YYYY-MM-DD] [--to YYYY-MM-DD]
-#   xai_search.sh web "query" [--domains domain1,domain2]
-
+# xAI Search CLI - native X/Web tools through the Responses API.
 set -euo pipefail
 
-# Get API key from config or environment
-if [[ -z "${XAI_API_KEY:-}" ]]; then
-  # Try to get from OpenClaw skill config
-  if command -v jq &>/dev/null && [[ -f ~/.openclaw/openclaw.json ]]; then
-    XAI_API_KEY=$(jq -r '.skills.entries["xai-search"].apiKey // empty' ~/.openclaw/openclaw.json 2>/dev/null || true)
-  fi
-fi
-
-if [[ -z "${XAI_API_KEY:-}" ]]; then
-  echo "ERROR: XAI_API_KEY not set. Set environment variable or configure in openclaw.json" >&2
-  exit 1
-fi
+usage() {
+  printf '%s\n' \
+    'Usage: xai_search.sh {x|web} "query" [options]' \
+    '' \
+    '  --handles user1,user2   X only; at most 20 handles' \
+    '  --from YYYY-MM-DD       X only; inclusive UTC midnight' \
+    '  --to YYYY-MM-DD         X only; exclusive UTC midnight' \
+    '  --domains d1,d2         Web only; at most 5 domains' \
+    '  --model MODEL           Default: grok-4-1-fast-reasoning' \
+    '  --json                  Raw JSON instead of text and citation URLs' \
+    '  --help                  Show this help' \
+    '' \
+    'XAI_BASE_URL defaults to https://api.x.ai/v1; trailing slashes are removed.' \
+    'Requests go only to <base>/responses (HTTPS); redirects are not followed.' \
+    'XAI_API_KEY overrides skills.entries["xai-search"].apiKey in ~/.openclaw/openclaw.json.' \
+    'For Sub2API, use its public /v1 base, a Grok-group key, and --model with an available model (e.g. grok-4.5).' \
+    'Native search requires Responses, not REST Chat Completions or legacy search_parameters.' \
+    'Handle/date filters do not constrain thread fetches. CSV entries must be nonempty.' \
+    'Sub2API search-call surcharges are not exact upstream fetched-post/profile cost reconciliation.'
+}
 
-if ! command -v jq &>/dev/null; then
-  echo "ERROR: jq is required but not installed. Install jq to use this script." >&2
-  exit 1
-fi
+fail() { printf 'ERROR: %s\n' "$1" >&2; exit "${2:-2}"; }
 
+if [[ "${1:-}" == --help || "${1:-}" == -h ]]; then usage; exit 0; fi
 MODE="${1:-}"
 QUERY="${2:-}"
-
-if [[ -z "$MODE" || -z "$QUERY" ]]; then
-  echo "Usage:" >&2
-  echo "  xai_search.sh x \"query\" [options]    # Search X (Twitter)" >&2
-  echo "  xai_search.sh web \"query\" [options]  # Search the web" >&2
-  echo "" >&2
-  echo "Options:" >&2
-  echo "  --handles user1,user2   Only search posts from these handles (X only)" >&2
-  echo "  --from YYYY-MM-DD       Start date" >&2
-  echo "  --to YYYY-MM-DD         End date" >&2
-  echo "  --domains d1,d2         Only search these domains (web only)" >&2
-  echo "  --model MODEL           Model to use (default: grok-4-1-fast-reasoning)" >&2
-  echo "  --json                  Output raw JSON response" >&2
-  exit 2
-fi
-
+if [[ -z "$MODE" || -z "$QUERY" ]]; then usage >&2; exit 2; fi
+[[ "$MODE" == x || "$MODE" == web ]] || fail "mode must be 'web' or 'x'"
 shift 2
 
-# Parse options
 HANDLES=""
 FROM_DATE=""
 TO_DATE=""
 DOMAINS=""
 MODEL="grok-4-1-fast-reasoning"
 RAW_JSON=0
-
 while [[ $# -gt 0 ]]; do
-  case $1 in
-    --handles)
-      HANDLES="$2"
-      shift 2
-      ;;
-    --from)
-      FROM_DATE="$2"
-      shift 2
-      ;;
-    --to)
-      TO_DATE="$2"
-      shift 2
-      ;;
-    --domains)
-      DOMAINS="$2"
-      shift 2
-      ;;
-    --model)
-      MODEL="$2"
-      shift 2
-      ;;
-    --json)
-      RAW_JSON=1
-      shift
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      exit 2
-      ;;
+  case "$1" in
+    --handles|--from|--to|--domains|--model)
+      [[ $# -ge 2 && -n "${2//[[:space:]]/}" && "$2" != --* ]] || fail "$1 requires a value"
+      case "$1" in
+        --handles) HANDLES="$2" ;;
+        --from) FROM_DATE="$2" ;;
+        --to) TO_DATE="$2" ;;
+        --domains) DOMAINS="$2" ;;
+        --model) MODEL="$2" ;;
+      esac
+      shift 2 ;;
+    --json) RAW_JSON=1; shift ;;
+    *) fail 'Unknown option (use --help)' ;;
   esac
 done
 
-# Convert comma-delimited list to JSON array.
+command -v jq &>/dev/null || fail 'jq is required but not installed.' 1
+command -v curl &>/dev/null || fail 'curl is required but not installed.' 1
+
 csv_to_json_array() {
-  local csv="$1"
-  if [[ -z "$csv" ]]; then
-    jq -cn '[]'
-  else
-    jq -cn --arg csv "$csv" '$csv | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))'
-  fi
+  jq -cen --arg csv "$1" --argjson max "$2" '
+    $csv | split(",") | map(gsub("^\\s+|\\s+$"; ""))
+    | select(length <= $max and all(.[]; length > 0))
+  ' 2>/dev/null
 }
 
-if [[ "$MODE" != "web" && "$MODE" != "x" ]]; then
-  echo "ERROR: mode must be 'web' or 'x'" >&2
-  exit 2
-fi
+# Validate the calendar without depending on GNU/BSD date parsing differences.
+valid_date() {
+  jq -en --arg date "$1" '
+    $date | capture("\\A(?<y>[0-9]{4})-(?<m>[0-9]{2})-(?<d>[0-9]{2})\\z")
+    | (.y|tonumber) as $y | (.m|tonumber) as $m | (.d|tonumber) as $d
+    | [31, (if ($y%400 == 0 or ($y%4 == 0 and $y%100 != 0)) then 29 else 28 end),
+       31,30,31,30,31,31,30,31,30,31] as $days
+    | $y >= 1 and $m >= 1 and $m <= 12 and $d >= 1 and $d <= $days[$m-1]
+  ' >/dev/null 2>&1
+}
 
-TOOLS_JSON=""
-if [[ "$MODE" == "web" ]]; then
+[[ -z "$FROM_DATE" ]] || valid_date "$FROM_DATE" || fail '--from requires a valid YYYY-MM-DD calendar date'
+[[ -z "$TO_DATE" ]] || valid_date "$TO_DATE" || fail '--to requires a valid YYYY-MM-DD calendar date'
+
+if [[ "$MODE" == web ]]; then
   if [[ -n "$DOMAINS" ]]; then
-    DOMAIN_ARRAY=$(csv_to_json_array "$DOMAINS")
-    TOOLS_JSON=$(jq -cn --argjson domains "$DOMAIN_ARRAY" '[{type:"web_search", allowed_domains:$domains}]')
+    DOMAIN_ARRAY=$(csv_to_json_array "$DOMAINS" 5) || fail '--domains requires 1 to 5 nonempty CSV entries'
+    TOOLS_JSON=$(jq -cn --argjson domains "$DOMAIN_ARRAY" '[{type:"web_search", filters:{allowed_domains:$domains}}]')
   else
     TOOLS_JSON='[{"type":"web_search"}]'
   fi
 else
-  HANDLE_ARRAY=$(csv_to_json_array "$HANDLES")
-  TOOLS_JSON=$(jq -cn \
-    --argjson handles "$HANDLE_ARRAY" \
-    --arg from "$FROM_DATE" \
-    --arg to "$TO_DATE" \
-    '[{
-      type: "x_search",
-      allowed_x_handles: (if ($handles | length) > 0 then $handles else null end),
-      from_date: (if $from != "" then $from else null end),
-      to_date: (if $to != "" then $to else null end)
-    }]')
+  HANDLE_ARRAY='[]'
+  if [[ -n "$HANDLES" ]]; then
+    HANDLE_ARRAY=$(csv_to_json_array "$HANDLES" 20) || fail '--handles requires 1 to 20 nonempty CSV entries'
+  fi
+  TOOLS_JSON=$(jq -cn --argjson handles "$HANDLE_ARRAY" --arg from "$FROM_DATE" --arg to "$TO_DATE" '
+    [{type:"x_search"}
+      + (if ($handles|length) > 0 then {allowed_x_handles:$handles} else {} end)
+      + (if $from != "" then {from_date:$from} else {} end)
+      + (if $to != "" then {to_date:$to} else {} end)]')
 fi
 
-REQUEST_JSON=$(jq -cn \
-  --arg model "$MODEL" \
-  --arg input "$QUERY" \
-  --argjson tools "$TOOLS_JSON" \
-  '{
-    model: $model,
-    input: $input,
-    tools: $tools,
-    tool_choice: "required"
-  }')
-
-RESPONSE=$(curl -sS https://api.x.ai/v1/responses \
-  -H "Authorization: Bearer $XAI_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d "$REQUEST_JSON")
-
-ERROR=$(echo "$RESPONSE" | jq -r '.error.message // .error // empty' 2>/dev/null || true)
-if [[ -n "$ERROR" ]]; then
-  echo "ERROR: $ERROR" >&2
-  exit 1
+BASE_URL="${XAI_BASE_URL-https://api.x.ai/v1}"
+while [[ "$BASE_URL" == */ ]]; do BASE_URL="${BASE_URL%/}"; done
+if ! jq -en --arg base "$BASE_URL" '$base | test("\\Ahttps://[^/@?#\\s]+(/[^?#\\s]*)?\\z")' >/dev/null; then
+  fail 'XAI_BASE_URL must be an HTTPS API base without credentials, query, or fragment'
 fi
 
-if [[ "$RAW_JSON" -eq 1 ]]; then
-  echo "$RESPONSE" | jq '.'
-  exit 0
+if [[ -z "${XAI_API_KEY:-}" && -f "$HOME/.openclaw/openclaw.json" ]]; then
+  XAI_API_KEY=$(jq -r '.skills.entries["xai-search"].apiKey // empty' "$HOME/.openclaw/openclaw.json" 2>/dev/null || true)
+fi
+[[ -n "${XAI_API_KEY:-}" ]] || fail 'XAI_API_KEY not set. Set environment variable or configure in openclaw.json' 1
+[[ "$XAI_API_KEY" != *$'\r'* && "$XAI_API_KEY" != *$'\n'* ]] || fail 'API key must not contain line breaks' 1
+
+REQUEST_JSON=$(jq -cn --arg model "$MODEL" --arg input "$QUERY" --argjson tools "$TOOLS_JSON" \
+  '{model:$model, input:$input, tools:$tools, tool_choice:"required"}')
+
+# Keep the key out of curl argv and private response files out of other users' reach.
+umask 077
+WORK_DIR=$(mktemp -d "${TMPDIR:-/tmp}/xai-search.XXXXXXXX")
+trap 'rm -rf "$WORK_DIR"' EXIT
+printf 'Authorization: Bearer %s\nContent-Type: application/json\n' "$XAI_API_KEY" > "$WORK_DIR/headers"
+if HTTP_STATUS=$(curl --disable --silent --show-error --globoff --proto '=https' \
+  --url "$BASE_URL/responses" --header "@$WORK_DIR/headers" \
+  --data "$REQUEST_JSON" --output "$WORK_DIR/response" --write-out '%{http_code}' 2>/dev/null); then
+  :
+else
+  CURL_STATUS=$?
+  fail "API transport failed (curl exit $CURL_STATUS); check endpoint and connectivity" 1
 fi
 
-OUTPUT_TEXT=$(echo "$RESPONSE" | jq -r '
-  if (.output_text // "") != "" then
-    .output_text
-  else
-    [
-      .output[]?
-      | select(.type == "message" and .role == "assistant")
-      | .content[]?
-      | if .type == "output_text" or .type == "text" then (.text // "") else empty end
-    ] | join("\n")
-  end
-' 2>/dev/null || true)
+# Decode before redaction so JSON escapes cannot hide an echoed credential.
+if ! RESPONSE=$(jq -cs --arg key "$XAI_API_KEY" '
+  if length == 1 and (.[0] | type == "object") then
+    .[0] | walk(
+      if type == "string" then split($key) | join("[REDACTED]")
+      elif type == "object" then with_entries(.key |= (split($key) | join("[REDACTED]")))
+      else . end)
+  else error("Expected one response object") end
+' "$WORK_DIR/response" 2>/dev/null); then
+  fail "API returned malformed or non-JSON response (HTTP $HTTP_STATUS)" 1
+fi
+ERROR=$(printf '%s' "$RESPONSE" | jq -r 'if .error then (.error | if type == "object" then (.message // "upstream error") else tostring end) else empty end' 2>/dev/null)
+if [[ ! "$HTTP_STATUS" =~ ^2[0-9][0-9]$ ]]; then
+  fail "API HTTP $HTTP_STATUS: ${ERROR:-request failed}" 1
+fi
+[[ -z "$ERROR" ]] || fail "API error: $ERROR" 1
 
-if [[ -z "${OUTPUT_TEXT// }" ]]; then
-  echo "ERROR: No response text from API" >&2
-  exit 1
+if [[ "$RAW_JSON" -eq 1 ]]; then
+  printf '%s' "$RESPONSE" | jq '.'
+  exit 0
 fi
 
-echo "$OUTPUT_TEXT"
-
-SOURCES=$(echo "$RESPONSE" | jq -r '
-  [
-    .output[]?
-    | select(.type == "message" and .role == "assistant")
-    | .content[]?
-    | .annotations[]?
-    | select(.type == "url_citation")
-    | .url?
-  ] | unique | .[]?
+OUTPUT_TEXT=$(printf '%s' "$RESPONSE" | jq -r '
+  if (.output_text // "") != "" then .output_text
+  else [.output[]? | select(.type == "message" and .role == "assistant")
+    | .content[]? | if .type == "output_text" or .type == "text" then (.text // "") else empty end] | join("\n") end
 ' 2>/dev/null || true)
-
-if [[ -n "$SOURCES" ]]; then
-  echo ""
-  echo "Sources:"
-  echo "$SOURCES"
-fi
+[[ -n "${OUTPUT_TEXT//[[:space:]]/}" ]] || fail 'No response text from API' 1
+printf '%s\n' "$OUTPUT_TEXT"
+SOURCES=$(printf '%s' "$RESPONSE" | jq -r '
+  [.output[]? | select(.type == "message" and .role == "assistant") | .content[]?
+    | .annotations[]? | select(.type == "url_citation") | .url?] | unique | .[]?
+' 2>/dev/null || true)
+if [[ -n "$SOURCES" ]]; then printf '\nSources:\n%s\n' "$SOURCES"; fi

package/skills/core/distill-writing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: distill-writing
 description: "Learn a house writing style from approved sample documents, or save an explicitly stated project document preference, into WRITING.md and writing/templates/. Use for sample-based style learning, house-style setup or refresh, and requests such as 'remember this for future PRDs' or 'make this our report default', including handoffs from write-doc or plain-language. Preserve manual edits and separate document types. NOT for drafting a document (write-doc) or saving chat-only preferences (plain-language)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Distill a writing style

package/skills/core/distill-writing/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/doc-to-md/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: doc-to-md
 description: "Convert documents (PDF, DOCX, PPTX, XLSX, images) to Markdown so agents can read them. Use as the preprocessing step whenever binary files need to enter agent context — contract review, compliance audit, document analysis, evidence review."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # doc-to-md

package/skills/core/doc-to-md/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/editorial-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: editorial-review
 description: "Review a document or generated report for what it says (does the reader get the answer, is the argument sound, is anything unsupported, obvious or repeated), then fix the content. Use to review, tighten or clarify a doc or report, and as the review step of write-doc and the report skills. NOT for Chinese wording (polish-cn) or code review (better-review)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Editorial review

package/skills/core/editorial-review/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/house-style/SKILL.md

@@ -3,7 +3,7 @@ name: house-style
 description: "Shared reference the writing skills read by path: WRITING.md lookup and precedence, template choice, gap markers, template shape, the bundled templates, and the default English and Chinese style guides. Never select or invoke it as a task."
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # House style

package/skills/core/house-style/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/plain-language/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: plain-language
 description: "Session mode: every reply and status line in plain language — lead with the point, everyday words, full sentences, no filler — in English or Chinese, until turned off. Enable by default when the project has an applicable WRITING.md, even without a slash command. Use for /plain-language, 'talk plainly', '说人话', and explicit requests to remember project reply preferences; /plain-language init persists the default and loading instructions. Save reply rules only under Agent replies; route document preferences to distill-writing. Ordinary mode toggles remain session-only. Turn off with '/plain-language off' or 'normal mode'. NOT for writing a document (write-doc) or reviewing one (editorial-review)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Plain language

package/skills/core/plain-language/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/polish-cn/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: polish-cn
 description: "Polish the Chinese wording of a finished document or report, with a script proving every number, date, identifier, link and protected term is unchanged; prefers a Chinese model and records which ran. Use for '中文润色' or as a report skill's last step. NOT for cutting or restructuring content (editorial-review) or translating (write-doc)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Polish Chinese

package/skills/core/polish-cn/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));