@floomhq/skills 1.1.2 → 1.1.4

package/bin/floom-skills.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * `@floomhq/skills` 1.1.4: the last release under this name, and a working one.
+ *
+ * The installer was renamed to `cyborg-skills` on 2026-09-06, because the
+ * company is Cyborg Society and an installer that introduced itself as Floom
+ * Skills named the wrong thing on every line it printed.
+ *
+ * WHY THIS EXISTS RATHER THAN A BARE DEPRECATION. `npm deprecate` prints its
+ * notice at install time and then gets scrolled past, and a package whose last
+ * version stops working strands whoever pinned it in a script. So this release
+ * does both jobs: it still installs and runs every command exactly as 1.1.3
+ * did, by handing the process to `cyborg-skills`, and it says the new name on
+ * every run. Every version of this package, this one included, also carries an
+ * `npm deprecate` notice naming `cyborg-skills`; `scripts/verify-npm-deprecations.mjs`
+ * fails if that stops being true.
+ *
+ * IT DELEGATES IN PROCESS, not through a subprocess. `await import()` of the
+ * real entry keeps one process: the same argv, the same stdin/stdout/stderr
+ * (which matters for `mcp`, which speaks JSON-RPC on stdout, and for `--json`,
+ * which a caller pipes), the same TTY detection, the same exit code, the same
+ * signal handling. A spawned child would break every one of those in a way
+ * that is invisible until someone pipes the output.
+ *
+ * THE NOTICE GOES TO STDERR, always, never stdout. stdout is the MCP protocol
+ * channel and the `--json` channel; one stray line there corrupts a machine
+ * reader. Nothing here is suppressible, because a rename nobody is told about
+ * is the failure this file is here to prevent.
+ */
+
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const require = createRequire(import.meta.url);
+
+process.stderr.write(
+  "@floomhq/skills is now cyborg-skills.\n" +
+    "This is the last release under the old name. It still works: it runs cyborg-skills for you.\n" +
+    "Switch with:  npm i -g cyborg-skills   (then the command you type is `cyborg`)\n" +
+    "Or one-shot:  npx -y cyborg-skills <command>\n\n",
+);
+
+/**
+ * The real entry, resolved from the dependency's own manifest rather than
+ * hardcoded as `cyborg-skills/dist/index.js`.
+ *
+ * Reading `bin` is what keeps this correct if the bundle output ever moves: a
+ * hardcoded path would fail at runtime, in a stranger's terminal, on a release
+ * where every test still passed because the tests import the source.
+ */
+function resolveDelegateEntry() {
+  const manifestPath = require.resolve("cyborg-skills/package.json");
+  const manifest = require("cyborg-skills/package.json");
+  const bin = manifest.bin;
+  const relative = typeof bin === "string" ? bin : Object.values(bin ?? {})[0];
+  if (typeof relative !== "string" || relative.length === 0) {
+    throw new Error("cyborg-skills declares no bin entry to forward to");
+  }
+  const entry = resolve(join(dirname(manifestPath), relative));
+  return pathToFileURL(entry).href;
+}
+
+try {
+  await import(resolveDelegateEntry());
+} catch (error) {
+  process.stderr.write(
+    `Could not run cyborg-skills: ${error instanceof Error ? error.message : String(error)}\n` +
+      "Install it directly:  npm i -g cyborg-skills\n",
+  );
+  process.exitCode = 1;
+}

package/package.json

@@ -1,51 +1,34 @@
 {
   "name": "@floomhq/skills",
-  "version": "1.1.2",
-  "description": "Floom Skills CLI \u2014 publish, install, sync, and share AI agent skills.",
+  "version": "1.1.4",
+  "description": "Renamed to cyborg-skills. This release still works and forwards to it.",
   "license": "MIT",
-  "homepage": "https://skills.floom.dev",
+  "homepage": "https://cyborg.floom.dev",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/floomhq/skills-mvp.git"
   },
-  "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "bin"
   ],
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
   "bin": {
-    "floom-skills": "dist/index.js"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.typecheck.json --noEmit && node scripts/build-bundle.mjs",
-    "dev": "tsx watch src/index.ts",
-    "lint": "tsc -p tsconfig.typecheck.json --noEmit --pretty false",
-    "pack:check": "node scripts/verify-package.mjs",
-    "pack:smoke": "pnpm run build && node scripts/verify-package.mjs --install-smoke",
-    "prepack": "pnpm run build",
-    "prepublishOnly": "pnpm run build && pnpm run pack:check",
-    "start": "node dist/index.js",
-    "test": "tsx --tsconfig tsconfig.typecheck.json --test --experimental-test-isolation=none --test-concurrency=1 \"src/**/*.test.ts\"",
-    "typecheck": "tsc -p tsconfig.typecheck.json --noEmit"
+    "floom-skills": "bin/floom-skills.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.2",
-    "chalk": "^5.3.0",
-    "commander": "^12.1.0",
-    "ora": "^8.1.0",
-    "prompts": "^2.4.2",
-    "tar": "^7.4.3",
-    "zod": "^3.23.8"
+    "cyborg-skills": "2.0.0"
   },
   "devDependencies": {
-    "@floom/shared": "workspace:*",
-    "esbuild": "^0.27.7",
-    "@types/node": "^22.0.0",
-    "@types/prompts": "^2.4.9",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
+    "@types/node": "^22.0.0"
+  },
+  "scripts": {
+    "build": "node --version > /dev/null",
+    "lint": "node --check bin/floom-skills.mjs",
+    "pack:check": "node scripts/verify-package.mjs",
+    "test": "node --test test/forwards.test.mjs",
+    "typecheck": "node --check bin/floom-skills.mjs"
   }
-}
+}

package/README.md

@@ -1,162 +0,0 @@
-# @floomhq/skills
-
-The Floom Skills CLI: publish, install, sync, and share AI agent skills.
-
-Docs: <https://skills.floom.dev/docs>
-
-## Install
-
-```bash
-npm i -g @floomhq/skills
-```
-
-Pinned no-install form for automation:
-
-```bash
-npx -y @floomhq/skills@1.1.0 --help
-```
-
-## Login
-
-```bash
-floom-skills login
-```
-
-The login command starts a browser device flow. Sign in at skills.floom.dev with
-Google or email, approve the device code, and the CLI stores the session at
-`~/.floom/auth.json`.
-
-Check the active account:
-
-```bash
-floom-skills account
-```
-
-## First Skill
-
-```bash
-floom-skills push ~/.claude/skills/my-skill
-```
-
-The folder must contain `SKILL.md`. Each push creates a Library version.
-
-Create a starter skill when the folder does not exist yet:
-
-```bash
-floom-skills new my-skill --agent claude
-```
-
-## Bulk Sync
-
-```bash
-floom-skills sync
-```
-
-Zero-arg `floom-skills sync` detects installed agents and supported scopes, reviews
-local-to-Library and Library-to-local differences, and applies the selected
-plan. Use `--dry-run` to preview the plan without changing files or Library
-records.
-
-Library-to-local only:
-
-```bash
-floom-skills pull
-floom-skills pull --agent claude,codex
-```
-
-Local-to-Library only:
-
-```bash
-floom-skills push
-```
-
-Use the installed `floom-skills` command for interactive terminal work. Use the pinned
-`npx -y @floomhq/skills@1.1.0 <command>` form for automation and agent-run
-commands that need reproducible CLI behavior.
-
-## Releasing
-
-Releases publish the exact smoke-tested npm tarball via
-`.github/workflows/publish-cli.yml`, triggered by a `skills-v*` tag.
-Provenance is disabled while the source repository remains private.
-
-### Hard pre-publish smoke gate
-
-Every `npm publish` is gated by `packages/cli/scripts/pre-publish-smoke.sh`,
-which packs the tarball, installs it into an isolated `$HOME`, and drives
-every subcommand the way a real user would. If anything fails, the workflow
-fails BEFORE `npm publish` runs — no broken CLI can reach npm `latest`.
-
-Background: in 2026-05 we shipped `3.0.0` → `3.0.1` → `3.0.2` within hours
-because `3.0.0` hit npm `latest` with three P0s that code review missed:
-`--help` ran the destructive body, `--help | head` threw an unhandled EPIPE,
-and unknown commands silently rendered the dashboard. Only an out-of-band
-real-terminal smoke caught them. This script is that smoke, baked into the
-publish pipeline.
-
-### Before pushing a `skills-v*` tag
-
-Run the same local gates from the repo root:
-
-```bash
-pnpm --filter @floomhq/skills --fail-if-no-match lint
-pnpm --filter @floomhq/skills --fail-if-no-match test
-pnpm --filter @floomhq/skills --fail-if-no-match pack:smoke
-packages/cli/scripts/pre-publish-smoke.sh
-```
-
-If anything fails, fix the issue first. Do not push the tag.
-
-### Smoke-only workflow run
-
-To validate the smoke script itself without publishing (e.g. after editing
-`scripts/pre-publish-smoke.sh`):
-
-```
-GitHub → Actions → Publish @floomhq/skills → Run workflow
-  smoke_only: true
-```
-
-The workflow will build, run the smoke, and stop. No `npm publish`, no
-Homebrew dispatch.
-
-### Manual publish (rare)
-
-To publish without a tag (e.g. retag an existing version under a different
-dist-tag), use `workflow_dispatch` with `smoke_only: false` and the desired
-`tag` input. The smoke gate still runs first.
-
-## What the pre-publish smoke checks
-
-See `scripts/pre-publish-smoke.sh` for the full assertion list. Summary:
-
-| Stage | Asserts |
-|------|---------|
-| 1 | Tarball builds, packs, installs cleanly into isolated `$HOME`; installed `floom-skills --version` matches `package.json` |
-| 2 | **Every** subcommand `--help` exits 0, starts with `Usage: floom-skills`, writes no `~/.floom/auth.json`, prints no "Signed (in|out)" / "Waiting for browser" (P0 #1 from 3.0.0) |
-| 3 | `floom-skills --help \| head -3` and `floom-skills push --help \| head -1` print no EPIPE / "Unhandled error event" (P0 #2 from 3.0.0) |
-| 4 | `floom-skills <unknown>` exits non-zero with "unknown command" + "did you mean" hint (P0 #3 from 3.0.0) |
-| 5 | Bare `floom-skills --help` exits 0 with grouped help |
-| 6 | Unauth `whoami` / `account` / `logout` exit 0 idempotent; unauth `status` / `sync --json` / `push --json` exit non-zero with no stack trace |
-| 7 | `floom-skills logout extra-positional` is rejected with non-zero exit AND `~/.floom/auth.json` is preserved (no destructive body) |
-| 8 | **Agent detection** picks up fake `.claude/`, `.codex/`, `.cursor/` marker dirs in the isolated `$HOME` (verified by parsing `floom-skills doctor --json`); bare `floom-skills sync` / `floom-skills pull` with planted agents do not crash unauth (clean `signedIn:false` envelope). Note: fan-out *behaviour itself* requires real auth, so it is exercised at the **unit-test layer** by `src/commands/sync.fanout.test.ts`, which the publish workflow runs as a separate hard gate before the smoke. |
-
-If any assertion fails, the publish job fails. The smoke script exits non-zero
-on the first failure and prints a summary of every failed check.
-
-## Files
-
-```
-packages/cli/
-├── src/                          # TypeScript source
-│   ├── index.ts                  # CLI entry point (commander)
-│   ├── commands/                 # one file per subcommand
-│   ├── lib/                      # shared helpers
-│   └── cli-smoke.test.ts         # unit-level smoke (P0 lock-ins)
-├── scripts/
-│   ├── build-bundle.mjs          # esbuild → dist/index.js
-│   ├── verify-package.mjs        # pre-pack file allowlist check
-│   └── pre-publish-smoke.sh      # E2E smoke driven against tarball
-├── package.json
-└── CHANGELOG.md
-```

package/dist/index.d.ts

@@ -1 +0,0 @@
-export {};