@hasna/skills 0.1.61 → 0.1.63

package/agent-skills/merge-pr/tests/fixtures/trailer-free-provider.json

@@ -1,28 +0,0 @@
-{
-  "pr_view": {
-    "state": "MERGED",
-    "mergedAt": "2026-07-23T15:36:23Z",
-    "mergeCommit": {
-      "oid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-    },
-    "headRefOid": "2797e3264c416018c06608434c0c57340f647330",
-    "baseRefName": "main",
-    "url": "https://github.com/hasna/tai/pull/4"
-  },
-  "source_commits": [
-    {
-      "oid": "5d38cd4fe95556a06f7d9f31481ce88c8bb78e85",
-      "message": "ci: add provider-native validation workflow"
-    },
-    {
-      "oid": "2797e3264c416018c06608434c0c57340f647330",
-      "message": "ci: disable setup action cache and token"
-    }
-  ],
-  "commit": {
-    "sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-    "commit": {
-      "message": "ci: add provider-native validation workflow (#4)\n\nMerge validated changes with an explicit sanitized message."
-    }
-  }
-}

package/agent-skills/skill-goal-execute/SKILL.md

@@ -1,115 +0,0 @@
----
-name: skill-goal-execute
-description: Take a high-level goal and drive it to done — break it into tasks via the todos CLI, open a goal thread in the project's conversations channel, create a plan in todos, generate the tasks under that plan, then execute them one by one until complete. Use for 'execute this goal', 'break down and do X', 'set a goal and run it'.
-user_invocable: true
----
-
-# skill-goal-execute — Goal → Channel Thread → Plan → Tasks → Execute
-
-Turn a stated goal into structured, tracked, executed work. This skill is the bridge
-between "here's what I want" and "it's done", using the three canonical systems:
-**conversations** (one goal thread in the project's channel), **todos** (a plan +
-tasks), and **mementos** (learnings as you go).
-
-## Inputs
-
-- **The goal** — what the user wants achieved (one or more sentences).
-- **The project** — the project this goal belongs to. If global / not tied to a
-  project, use the **machine-name** project returned by `hostname`.
-
-## Workflow
-
-### 0. Log in & route
-
-Ensure you're logged in as an agent (`skill-login`). Determine the target
-project; for global work ensure the machine-name project exists
-(`todos projects --add "$HOME" --name "$(hostname | sed 's/\.local$//')"`).
-
-### 1. Open a goal thread in the project's conversations channel
-
-Every project has ONE channel, named per the channel classes (flat repo name
-for repo/package projects, full name for `platform-*`/`iapp-*`/`cweb-*`/
-`community-*` products, `oss-*`/`internal-*`/`research-*` for initiatives —
-same naming as `skill-project-create`). Goals do NOT get their own channels:
-one thread per goal inside the project channel, updated in-thread.
-
-```bash
-# Ensure the project's channel exists (create if missing; "already exists" is fine)
-conversations channel create "<project-channel>" --description "<project> coordination" --from <agent> 2>/dev/null || true
-conversations channel join "<project-channel>" --from <agent>
-
-# Open the goal thread: post the kickoff and capture its message id
-GOAL_MSG_ID=$(conversations send "🎯 Goal: <goal>. Breaking into a plan + tasks now." \
-  --channel "<project-channel>" --from <agent> -j \
-  | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
-```
-
-Machines have no channels of their own (machine traffic folds into `ops`), so
-for global / machine-level goals open the thread in `ops` instead.
-
-### 2. Create a plan in todos
-
-```bash
-todos plans --add "<goal title>" -d "<the goal, in full>"
-# capture the returned PLAN_ID
-```
-
-### 3. Break the goal into tasks under that plan
-
-Decompose the goal into concrete, ordered, individually-verifiable steps. Create each
-as a task assigned to the plan and the project:
-
-```bash
-todos add "<step 1>" --plan "<PLAN_ID>" --project "<project>" -p high
-todos add "<step 2>" --plan "<PLAN_ID>" --project "<project>" -p high
-# ... one per step. Use --parent for sub-steps and deps for ordering if needed.
-```
-
-Post the breakdown to the goal thread so it's visible:
-
-```bash
-conversations reply "<plan id + task list>" --to $GOAL_MSG_ID --from <agent>
-```
-
-### 4. Execute the tasks ONE BY ONE
-
-Work strictly one task at a time — never batch:
-
-```
-for each task in plan order:
-  todos start <id>                 # claim + in_progress
-  ... do the work, verify it actually works ...
-  todos comment <id> "<what was done / result>"
-  todos done <id>                  # only after verified
-  conversations reply "✓ <task title>" --to $GOAL_MSG_ID --from <agent>
-  (save a memory with skill-memory-save if something non-obvious was learned)
-```
-
-Respect the "execute tasks one by one — never in bulk" rule: each task gets individual
-attention and verification before moving on.
-
-### 5. Close out
-
-When all tasks are done:
-
-```bash
-todos plans --complete "<PLAN_ID>"
-conversations reply "🏁 Goal complete: <goal>. <summary of what shipped>." --to $GOAL_MSG_ID --from <agent>
-```
-
-Save a summary memory (`skill-memory-save`) capturing the outcome and any decisions.
-
-## Rules
-
-- ALWAYS: goal thread (project channel) → plan (todos) → tasks (todos) → execute one
-  by one. Don't skip the plan or the thread.
-- One thread per goal in the project's channel — never a per-goal channel, never
-  duplicate threads; update in-thread (`conversations reply --to <goal-msg-id>`).
-- The project channel follows the channel-class naming (see `skill-project-create`);
-  global/machine goals thread into `ops`.
-- Route the plan/tasks to the specific project, or the machine-name project for global
-  goals.
-- Execute tasks individually and verify each before completing — never bulk-complete.
-- Post progress to the goal thread; save learnings to mementos. Never go dark.
-- Prefer the CLIs (`todos`, `conversations`, `mementos`); fall back from MCP to CLI if
-  an MCP is stale/broken.

package/agent-skills/skill-login/SKILL.md

@@ -1,109 +0,0 @@
----
-name: skill-login
-description: Full session start — reuse or register an agent identity across todos, conversations, and mementos, send a heartbeat, join your duty channels per agent class, then check unread messages and pending tasks. Run this at the very start of EVERY session. (Replaces the former skill-agent-login.)
-user_invocable: true
----
-
-# skill-login — Session Start
-
-Log in at the very start of every session: make sure the session has an agent
-identity, signal you're active, join the channels your class owes attention to,
-and catch up on what you missed. This is the full flow; for bare registration
-only, see **`skill-register`**.
-
-**Subagent carve-out (hard rule): SUBAGENTS NEVER REGISTER, JOIN, OR
-SUBSCRIBE.** A subagent inherits its parent's identity and context and posts
-only where the parent directs. If you were spawned by another agent, skip this
-skill entirely.
-
-## Workflow
-
-### 1. Reuse or register an identity
-
-Register only if the session lacks an identity — never mint a duplicate.
-Standing roles (chief, loop runners, named coordinators) keep their stable
-identity across sessions.
-
-```bash
-conversations whoami            # already have an identity? reuse it, go to step 2
-```
-
-If the session has no identity: pick an unused Roman name and register across
-**todos + conversations + mementos** (see **`skill-register`** for the name
-pool and exact commands):
-
-```bash
-todos agents                          # see who's active, pick an unused Roman name
-todos init <name>                     # or mcp__todos__register_agent(name, working_dir)
-conversations agents register <name>  # or mcp__conversations__register_agent(name)
-mementos register-agent <name>        # or mcp__mementos__register_agent(name)
-```
-
-### 2. Send a heartbeat
-
-```bash
-todos heartbeat <name>          # or conversations agents heartbeat
-```
-
-Repeat every 30 minutes while active, and immediately after claiming or
-completing a task.
-
-### 3. Join your duty channels (per agent class)
-
-Join = membership + unread tracking (`conversations channel join`). Subscribe =
-preview-only notifications (`conversations channel subscribe`).
-
-| Class | Join | Subscribe |
-|---|---|---|
-| Interactive coordinator | `announcements`, `incidents`, `agent-policy` + owned project channels | `help`, `oss-cloud-runtime` |
-| Interactive worker | `announcements` + current task's channel (at claim; may leave at completion) | `incidents` |
-| Headless loop identity (stable, per-loop) | its `loops-*` lane + serviced package channel | `announcements` |
-| chief (standing) | all fleet-tier channels | all `loops-*` |
-| Subagent | NOTHING — never register, join, or subscribe | — |
-
-```bash
-# interactive worker example
-conversations channel join announcements --from <name>
-conversations channel subscribe incidents --from <name>
-# join the task's project channel when you claim the task
-```
-
-### 4. Check in — unread messages and pending tasks
-
-Bounded to 7 days so a fresh identity is never handed full history as unread.
-`--since` requires an ISO timestamp (durations like `7d` silently match
-nothing):
-
-```bash
-SINCE=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-7d +%Y-%m-%dT%H:%M:%SZ)
-conversations context                              # one-shot boot context
-conversations blockers -j --from <name>            # unread blocking messages
-conversations digest announcements --unread --since "$SINCE" --mark-read --from <name>
-conversations digest incidents --unread --since "$SINCE" --from <name>
-todos list --status pending --agent <name>         # tasks waiting on you
-todos list --status in_progress                    # anything mid-flight
-```
-
-Clear mentions directed at you before starting work. An unread `[FREEZE]`
-means stop and escalate to `help`.
-
-### 5. Report
-
-```
-Logged in as <name> (todos id: <id>).
-- Blockers: N | unread announcements/incidents: N
-- Channels joined: <list per class matrix>
-- Pending/assigned tasks: N
-- Ready to work.
-```
-
-## Rules
-
-- Run at the start of EVERY session, before doing work. Mandatory.
-- Register only when the session has no identity; reuse standing identities.
-- SUBAGENTS NEVER REGISTER, JOIN, OR SUBSCRIBE — they inherit the parent's context.
-- When registering: ALWAYS all three systems; ALWAYS heartbeat; ALWAYS check
-  messages+tasks; ALWAYS apply your class's duty-channel row right after.
-- Pick a Roman name not currently active to avoid collisions.
-- If any MCP is unavailable, use its CLI immediately.
-- For just (re)registering identity without the check-in, use `skill-register`.

package/agent-skills/skill-project-create/SKILL.md

@@ -1,91 +0,0 @@
----
-name: skill-project-create
-description: Bootstrap a brand-new Hasna repo project or work project with the current `projects create`/`start` workflow, register todos/conversations, create the project's conversations channel, and preserve the intended category and naming convention.
-user_invocable: true
----
-
-# skill-project-create
-
-Create a new project end to end: folder, Projects registry row, todos tracking,
-the project conversations channel, and launch session. First classify it as a
-repo project or work project.
-
-## Inputs
-
-- Name or idea from the user.
-- Description derived from the prompt.
-- Division/root, inferred when obvious.
-- Category: repo project or work project.
-
-## Naming
-
-Repo projects are code repositories/apps such as `open-*`, platform repos, and
-internal apps. Work projects are business/research/operations folders under
-`.../project/<project-name>`.
-
-For new work projects, follow the user's requested name and the local root
-convention. Existing work folders may already use `project-*`; do not rename or
-collapse those names during import. For new repo projects, use the repo's naming
-convention, such as `open-<name>` for Hasna OSS apps.
-
-The project channel is named after the slug (flat repo name for repo projects).
-Channel class for the topic line: `package` for `open-*` and other repo/package
-projects, `product` for `platform-*`/`iapp-*`/`cweb-*`/`community-*`, and
-`initiative` for work projects (`oss-*`/`internal-*`/`research-*`) — initiative
-topics must carry `owner:<agent> until:<date|gate-id>`. When the installed
-conversations CLI supports `--class` on `channel create` (newer than 0.3.3),
-pass `--class <package|product|initiative>` as well so the class lands in
-`metadata.channel_schema.class`; the topic line stays either way.
-
-## Workflow
-
-```bash
-export HASNA_PROJECTS_DB_PATH="$HOME/.hasna/projects/projects.db"
-export HASNA_PROJECTS_HOME="$HOME/.hasna/projects"
-projects roots list --json
-mkdir -p "<path>"
-projects create \
-  --name "<Name>" \
-  --slug "<slug>" \
-  --path "<path>" \
-  --kind "<project|open-source|internal-app|platform>" \
-  --description "<description>" \
-  --tmux
-todos projects --add "<path>" --name "<slug>"
-# Every project has a conversations channel — create it if missing, then join.
-# "Already exists" is fine; join and continue.
-conversations channel create "<slug>" \
-  --description "<description>" \
-  --topic "class:<package|product|initiative> owner:<agent>" \
-  --from <agent>
-conversations channel join "<slug>" --from <agent>
-conversations send "project created: <slug> — <description>" \
-  --channel "<slug>" --from <agent>
-projects show "<slug>" --json
-projects status "<slug>" --json
-projects context "<slug>" --for-agent
-```
-
-Use `projects publish <slug>` only for repo projects and only when the user wants
-a GitHub repository now.
-
-The project channel is the project's coordination home from this point on:
-post there when you claim a task, get blocked, hit a milestone, or finish
-(max 3 lines: task id, state, next step).
-
-## Safety
-
-- Keep secrets out of the repo; use vaults or gitignored `.secrets/`.
-- `cleanup-create` is for rollback of a creation run only; do not use it for
-  imported rows.
-- Do not delete source directories without backup and a clear registry/import
-  undo plan.
-- Store/canvas/loop commands are allowed only when `projects --help` on the
-  active machine shows `store`, `canvases`, and `loops`.
-
-## Done When
-
-The folder exists, `projects show` resolves it, `projects status` reports the
-launch state, todos is registered, the project conversations channel exists
-with you joined and the creation message posted, and the description and path
-are reported.

package/agent-skills/skill-publish/SKILL.md

@@ -1,207 +0,0 @@
----
-name: skill-publish
-description: Full publish workflow for @hasna npm packages. Runs tests, logical commits, push, OSS checks (if hasna org), posts publish intent to git-publishing, publishes to npm, installs locally via bun, verifies via CLI, confirms in-thread. Never uses npm to install.
-user_invocable: true
----
-
-# skill-publish — Full Publish Workflow
-
-Complete end-to-end publish for `@hasna/*` packages. Covers OSS requirements,
-version bump, validation, PR merge, publish intent to `git-publishing`, npm
-registry publish, bun install, CLI verification, and in-thread confirmation.
-
-## Workflow
-
-### 1. Pre-flight checks
-
-```bash
-# Detect org from git remote
-REMOTE=$(git remote get-url origin)
-ORG=$(echo $REMOTE | grep -oP '(?<=github\.com[:/])[^/]+')
-PKG=$(cat package.json | python3 -c "import sys,json; print(json.load(sys.stdin)['name'])")
-echo "Org: $ORG | Package: $PKG"
-```
-
-### 2. OSS checks (hasna org only)
-
-If org is `hasna` (public open source), verify before doing anything else:
-
-**LICENSE** — Must be Apache 2.0:
-```bash
-[ -f LICENSE ] || echo "MISSING: LICENSE file"
-grep -q "Apache" LICENSE 2>/dev/null || echo "WRONG LICENSE: must be Apache-2.0"
-```
-If missing, create it (full Apache 2.0 text). Update `package.json` → `"license": "Apache-2.0"`.
-
-**README.md** — Must exist with at minimum: package name, description, install command, basic usage.
-
-**package.json** fields required:
-- `"license": "Apache-2.0"`
-- `"description"` — non-empty
-- `"repository"` — pointing to github.com/hasna/<name>
-- `"publishConfig": { "registry": "https://registry.npmjs.org", "access": "public" }`
-
-**GitHub repo visibility** — Hasna OSS packages must be public, but changing
-repo visibility is a risky disclosure action. Check it and stop for explicit
-human approval if it is private; do not auto-flip visibility inside this skill.
-```bash
-if gh repo view --json isPrivate -q '.isPrivate' | grep -q true; then
-  echo "BLOCKED: repo is private; get explicit approval and complete a full history/secret review before making it public"
-  exit 1
-fi
-```
-
-If org is `hasnaxyz` (private), ensure:
-- `"publishConfig": { "access": "restricted" }`
-
-### 3. Bump version on a release branch
-
-Do release edits on a branch, never directly on `main`.
-
-```bash
-git switch -c "release/${PKG##*/}-$(date -u +%Y%m%d%H%M%S)"
-
-# Check current published version. Prefer bun; fall back to npm only if present.
-CURRENT=$(bun pm view "$PKG" version 2>/dev/null || npm view "$PKG" version 2>/dev/null || echo "0.0.0")
-echo "Current: $CURRENT"
-
-# Bump patch in package.json unless the user explicitly requested another level.
-node -e "
-const fs = require('fs');
-const pkg = JSON.parse(fs.readFileSync('package.json'));
-const parts = pkg.version.split('.').map(Number);
-parts[2]++;
-pkg.version = parts.join('.');
-fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
-console.log('New version:', pkg.version);
-"
-```
-
-### 4. Run tests and build
-
-```bash
-bun test 2>&1
-[ "$(cat package.json | python3 -c "import sys,json; print('build' in json.load(sys.stdin).get('scripts',{}))")" = "True" ] && bun run build
-```
-If tests fail → fix them before continuing. Never publish broken tests.
-
-### 5. Secrets scan
-
-```bash
-git add package.json bun.lock
-SECRET_PATTERN='sk-(ant|proj)-|npm_[[:alpha:]]|gh[op]_|AKIA[[:upper:][:digit:]]|xai[-]|AI[z]a'
-if git diff --cached --diff-filter=ACM --unified=0 | grep -iE "^\\+[^+].*($SECRET_PATTERN)"; then
-  echo "SECRETS - STOP"
-  exit 1
-fi
-```
-
-### 6. Logical commit, push, PR, and merge
-
-```bash
-NEW_VERSION=$(cat package.json | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])")
-git commit -m "chore: release $PKG@$NEW_VERSION"
-git push -u origin HEAD
-```
-
-Open a PR for the release branch. Wait for required CI and an independent review,
-then merge it. After merge, update local `main` and verify that `package.json`
-on `main` contains the exact version you are about to publish. Do not publish
-from an unmerged branch or unreviewed local commit.
-
-```bash
-gh pr create --fill
-# after CI/review approval:
-gh pr merge --squash --delete-branch
-git switch main
-git pull --ff-only origin main
-test "$(cat package.json | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])")" = "$NEW_VERSION"
-```
-
-### 7. Post publish intent to git-publishing (BEFORE publishing)
-
-Fleet rule: publish intent goes to the `git-publishing` channel BEFORE any
-`bun publish`/`npm publish`, and the result is confirmed in the same thread
-after. Re-check blockers first — an unread `[FREEZE]` means stop and escalate
-to `help`.
-
-```bash
-conversations blockers --from <agent>    # unread [FREEZE] → STOP
-NEW_VERSION=$(cat package.json | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])")
-INTENT_ID=$(conversations send "publish intent: $PKG@$NEW_VERSION — <one-line changelog>" \
-  --channel git-publishing --from <agent> -j \
-  | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
-echo "Intent posted: message $INTENT_ID"
-```
-
-### 8. Publish
-
-```bash
-ACCESS=public
-[ "$ORG" = "hasnaxyz" ] && ACCESS=restricted
-if command -v bun >/dev/null 2>&1; then
-  bun publish --access "$ACCESS"
-elif command -v npm >/dev/null 2>&1; then
-  npm publish --access "$ACCESS"
-else
-  echo "BLOCKED: neither bun nor npm publish is available"
-  exit 1
-fi
-```
-
-### 9. Install locally via bun (NOT npm)
-
-```bash
-bun install -g $PKG
-```
-
-Remove any npm global install if it exists:
-```bash
-if command -v npm >/dev/null 2>&1 && npm list -g "$PKG" 2>/dev/null | grep -q "$PKG"; then
-  npm uninstall -g "$PKG" && echo "Removed npm global install"
-fi
-```
-
-### 10. Verify via CLI
-
-Get the CLI binary name from `package.json#bin`, then test it:
-```bash
-BIN=$(cat package.json | python3 -c "import sys,json; bins=json.load(sys.stdin).get('bin',{}); print(next(iter(bins), '')) if isinstance(bins, dict) else print('')" 2>/dev/null)
-if [ -z "$BIN" ]; then
-  echo "BLOCKED: package.json has no CLI bin to verify"
-  exit 1
-fi
-"$BIN" --version || "$BIN" --help 2>&1 | head -3
-echo "$PKG published and verified via $BIN"
-```
-
-### 11. Confirm in-thread on git-publishing
-
-Reply to the intent message — success or failure, always close the thread:
-
-```bash
-conversations reply "published: $PKG@$NEW_VERSION — verified via $BIN" --to $INTENT_ID --from <agent>
-```
-
-If the publish failed or was aborted after the intent post:
-```bash
-conversations reply "publish aborted: $PKG@$NEW_VERSION — <reason>" --to $INTENT_ID --from <agent>
-```
-
-Repo releases (GitHub tags/releases) are announced on `git-releases`, not
-`git-publishing`.
-
-## Rules
-
-- NEVER `npm install -g` — always `bun install -g`
-- NEVER publish from an unmerged branch or unreviewed local commit
-- NEVER push release changes directly to `main`; use a branch, PR, CI, review, and merge
-- NEVER publish without running tests and build first
-- NEVER publish with secrets in the staged diff
-- NEVER publish without posting intent to `git-publishing` first (step 7)
-- ALWAYS confirm in the intent thread after — published or aborted, no silent exits
-- NEVER bump minor or major — patch only unless user explicitly says otherwise
-- NEVER skip the CLI verification step
-- NEVER auto-change GitHub repo visibility; stop for explicit approval and full history/secret review
-- If `hasna` org: Apache 2.0 + public + README required — no exceptions
-- If `hasnaxyz` org: restricted access required

package/skills/_common/auth.ts

@@ -1,45 +0,0 @@
-/**
- * Skill Authentication Check
- * Add this to the top of any skill's main function
- */
-
-export function checkSkillAuth(): void {
-  const skillsApiKey = process.env.SKILLS_API_KEY || process.env.SKILL_API_KEY;
-  
-  if (!skillsApiKey) {
-    console.error('Error: SKILLS_API_KEY environment variable not set');
-    console.error('');
-    console.error('To use hosted execution, set your SKILLS_API_KEY:');
-    console.error('');
-    console.error('  export SKILLS_API_KEY=your-api-key-here');
-    console.error('');
-    console.error('You can also use the root `skills auth login` command.');
-    process.exit(1);
-  }
-
-  if (!skillsApiKey.startsWith('sk-skill-')) {
-    console.error('Error: Invalid SKILLS_API_KEY format');
-    console.error('Expected format: sk-skill-xxxxxxxxxxxx');
-    process.exit(1);
-  }
-}
-
-/**
- * Check if running remotely (via SSH or network)
- */
-export function isRemoteExecution(): boolean {
-  return !!(
-    process.env.SSH_CONNECTION ||
-    process.env.SSH_CLIENT ||
-    process.env.SSH_TTY
-  );
-}
-
-/**
- * Require auth only if remote execution
- */
-export function requireAuthIfRemote(): void {
-  if (isRemoteExecution()) {
-    checkSkillAuth();
-  }
-}