@hasna/skills 0.10.60 → 0.10.62

package/README.md

@@ -109,10 +109,35 @@ skills migrate native --include-unmanaged --include-vendor --apply --json
 
 # Preview the available adapters, then install one bridge plus hooks per agent.
 skills hook agents --json
-skills hook install --agent all --selection-profile default --json
-skills hook install --agent all --selection-profile default --apply --json
+skills hook install --selection-profile default --json
+skills hook install --selection-profile default --apply --json
 ```
 
+Without `--agent`, hook installation selects configured or detected consumers:
+existing managed bridge bindings, provider-specific home configuration, or an
+installed native CLI found through PATH. Detection reads metadata and never
+executes a native CLI. A provider-specific directory also identifies a GUI
+consumer without a CLI, such as Cursor. Shared `.agents/skills` or Claude
+configuration alone does not identify another provider. No detected consumers
+is an error; use `--agent <agent>` to configure a new consumer explicitly.
+
+Every selected adapter still validates its configuration and prerequisites;
+errors never silently drop a detected consumer. Explicit `--agent all` selects
+all maintained adapters and requires every adapter's discovery capability,
+including Sumi's installed read-only `sumi-paths` command. Sumi is selected by
+its managed binding, native `sumi` or `sumi-paths` executable, existing legacy
+provider home or `~/.config/sumi` configuration, a Sumi directory beneath
+`XDG_CONFIG_HOME`, or any set `SUMI_HOME`, `SUMI_CONFIG_DIR`, `SUMI_CONFIG` or
+`SUMI_CONFIG_CONTENT` selector (even empty or malformed). It then uses the
+unchanged Sumi path protocol and fails closed on unsupported configuration or
+a missing helper. Generic XDG configuration alone does not select Sumi; its
+provider directory must be present. Relative XDG paths resolve against the
+working directory, and home shorthand expands as in the native path protocol.
+Dangling or inaccessible provider roots never silently drop Sumi. Provider-defined
+roots outside these published presence locations cannot be detected without a
+binding, selector or executable; specify `--agent sumi` for that case. This is
+a detection limit, not proof that Sumi is absent.
+
 Native migration includes the current directory, every ancestor, and the global
 agent directories. Use `--project /path/to/project` to include another project
 and its ancestors. This matches the prompt hook's project discovery, including
@@ -1260,7 +1285,7 @@ of app folders, and `XDG_CONFIG_HOME` is not consulted at all.
 | `skills install [name@version] --selection-profile <id>` | | Cache selected immutable bundles; without names, sync the profile |
 | `skills load <name> --selection-profile <id>` | | Load complete instructions from the verified selection |
 | `skills context <prompt> --selection-profile <id>` | | Resolve instructions matching the prompt and profile triggers |
-| `skills hook install --agent all --selection-profile <id>` | | Plan one CLI bridge plus supported native hooks; `--apply` installs it, then restart and trust the hooks |
+| `skills hook install --selection-profile <id>` | | Plan bridges and hooks for configured/detected consumers; `--agent <agent>` selects one, explicit `--agent all` requires every adapter; `--apply` installs them, then restart and trust the hooks |
 | `skills sessions show <id> --json` | | Inspect one session's exact profile revision and receipt hash without loading payloads |
 | `skills sessions reconcile <id> --from-profile <id> --from-revision <rev> --receipt-sha256 <sha> --selection-profile <id> --profile-revision <rev>` | | Plan an explicit migration of one live session; `--apply --plan-digest <digest> --plan-issued-at <time> --plan-expires-at <time>` (within five minutes) preserves its old receipt and applies the reviewed replacement |
 | `skills hook agents --json` | | Report maintained adapters and explicit coverage limits |
@@ -1342,7 +1367,7 @@ on the exact entry, through `env -i` with an explicit environment allowlist:
 `HOME`, `PATH`, `TMPDIR`, `USER`, `LOGNAME`, `SHELL`, `TZ`, `LANG`, terminal names
 (`TERM`, `TERM_PROGRAM`, `TERM_PROGRAM_VERSION`, `COLORTERM`, `COLUMNS`, `LINES`),
 `NO_COLOR`, `FORCE_COLOR`, `CI`, `EDITOR`, `VISUAL`, `PAGER`, `SSH_AUTH_SOCK`,
-`DATABASE_URL`, the server settings `HOST`, `PORT`, `NODE_ENV`, `AGENT_ID` and
+the server settings `HOST`, `PORT`, `NODE_ENV`, `AGENT_ID` and
 `ECS_CONTAINER_METADATA_URI_V4`, the agent names `TERMINAL_CWD`, `CODEX_HOME`,
 `HERMES_HOME` and `HERMES_ENABLE_PROJECT_PLUGINS`, and every name starting with
 `HASNA_`, `SKILLS_`, `SKILL_`, `MCP_`, `XDG_`, `LC_` or `AWS_`. Your `LC_ALL` passes
@@ -1351,9 +1376,16 @@ through unchanged. Everything else never reaches the runtime, including `BUN_*`,
 (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`). A `bunfig.toml`, `.env` or `tsconfig.json`
 in the directory you run a command from is never read.
 
+New launchers use the V2 format with an explicit environment profile. The CLI and
+MCP entries use the client profile, which excludes `DATABASE_URL`,
+`HASNA_SKILLS_DATABASE_URL` and `SKILLS_DATABASE_URL` even when their prefixes are
+otherwise allowed. The API server, worker, maintenance and migration entries use
+the server profile, which preserves all three storage settings. The updater
+derives that profile from the package's bin and entry contract.
+
 Each of those entries (the CLI, the MCP server, the API server, the worker,
 maintenance and migrate) returns to your directory before anything else runs, so
-relative paths keep working, including a relative `HASNA_SKILLS_DATABASE_URL`. When
+relative paths keep working, including relative storage paths for server entries. When
 the CLI starts another copy of itself (the hook's context lookup and its
 `SessionStart` sync), the child gets the same Bun flags, the runtime version root as
 its working directory and the same environment allowlist, and also returns to your
@@ -1361,7 +1393,10 @@ directory first. The receipt records the old and new launcher shape of every pat
 the backup keeps the exact previous launcher (symlink text or pinned bytes), and
 `--rollback` restores it byte for byte. Codex hook trust, the Claude settings
 projection and `skills self-update` read a managed pinned launcher as the exact
-entry it runs and bind the launcher's own bytes as well.
+entry it runs and bind the launcher's own bytes as well. Existing V1 launchers
+remain recognized in their exact original format. Receipts without launcher
+format metadata restore V1 bytes; new receipts bind the V2 format and environment
+profile. An upgrade does not prevent rollback to the prior V1 launcher.
 
 An updater from before pinned launchers (0.10.48 and earlier) writes bare symlinks,
 including when it installs a version that has them, and an exact-version update to
@@ -1384,7 +1419,6 @@ repeat the exclusion option for package names or package globs:
 ```bash
 skills self-update --version 0.10.34 --min-release-age 7 \
   --min-release-age-exclude '@hasna/*' \
-  --min-release-age-exclude '@hasna-internal/*' \
   --min-release-age-exclude '@openai/*' \
   --min-release-age-exclude '@anthropic-ai/*' \
   --min-release-age-exclude openai