@hasna/skills 0.10.77 → 0.10.78

package/README.md

@@ -2030,6 +2030,14 @@ Stable command shapes:
   snapshot plan.
 - MCP registration: `mcp --register <agent> --json` returns
   `{ "registered": number, "results": [...] }`.
+  Claude re-registration updates only `mcpServers.skills` in the active user
+  `.claude.json` (respecting `CLAUDE_CONFIG_DIR` and an active legacy
+  `.config.json`). Before changing an existing file it preserves and reads back
+  a mode-0600 sibling `.skills-mcp-<id>.backup`. A competing native config lock
+  or a changed config refuses the update; retry after the other writer finishes.
+  A native policy or unknown refusal also fails closed. Updating an existing
+  entry requires Claude's exact admitted duplicate-name refusal; configuring
+  before CLI installation is supported only when the executable is missing.
 
 ## Query a caller-owned catalog
 
@@ -2276,6 +2284,15 @@ skills mcp --register claude    # Auto-register with Claude Code
 skills mcp --register all       # Register with all supported agents
 ```
 
+Register from the same credential profile you use for the product, for example
+`skills --profile customer setup agents`. Registrations retain that profile and
+any invocation-specific API origin, including
+`skills setup --api-url <origin> agents`, and start `skills-mcp --stdio`. Supported configuration-home overrides
+are retained so the later process resolves the same credential files. Keys,
+sessions and vault values are never copied into agent configuration. With no
+selectors, the MCP process keeps its usual credential resolution. Existing
+credential-to-origin checks still refuse a key bound to a different instance.
+
 ## Skills API
 
 Use a named profile for each independently operated instance. A commercial Skills instance
@@ -2346,6 +2363,8 @@ current version UUID (or `--expect-empty`). Request a code with `auth signup`
 first, then enter it over stdin; do not put verification codes in shell history.
 
 ```sh
+skills --profile customer publication create my-skill --display-name "My skill" \
+  --email you@example.com --code-stdin --confirm --json
 skills --profile customer publication publish ./my-skill \
   --skill-id <skill-uuid> --expect-empty --recovery-dir "$PWD/publication-receipt" \
   --email you@example.com --code-stdin --confirm --json
@@ -2353,6 +2372,22 @@ skills --profile customer publication status --recovery-dir "$PWD/publication-re
   --email you@example.com --code-stdin --json
 ```
 
+`publication create` creates an empty private skill and returns its `id` for
+`publication publish --skill-id`. It requires Pro and fresh interactive session
+verification; an API key cannot create or publish a private skill. Use
+`--visibility team` for a team skill. Slugs use lowercase kebab-case (at most
+128 characters), display names are nonempty (at most 256 characters), and
+descriptions are limited to 8192 UTF-8 bytes. JSON returns only validated IDs,
+the slug, visibility and source type, bound to the selected workspace. Creation
+does not write a recovery directory or save the session. If its result is
+uncertain, run `skills --profile customer info my-skill --remote --json` on
+the same workspace to recover its validated `id`, then use that ID with
+`publication publish --skill-id`. `list --remote --json` also includes server
+UUIDs when supplied. Newly created rows with no category display as `Remote`.
+Do not repeat creation to recover a lost result; the command never retries its
+create POST automatically. The selected profile, origin and credential files
+are captured before code entry; a change during that wait refuses the action.
+
 Without an enrolled named profile, also supply the observed `--user-id` and
 `--membership-id`. `publication resume` and `publication cancel` use the same
 recovery directory, fresh verification, and `--confirm`. The directory must be
@@ -2370,7 +2405,10 @@ server's current boolean capability; it does not authorize an individual run.
 
 The SDK exports `RemotePrivatePublicationsClient` through both the root and
 `./sdk`; `RemoteSkillsAuthClient.openPrivatePublications` creates one from fresh
-workspace verification. The shared `preparePrivatePublication`,
+workspace verification. Call its `createSkill({ slug, displayName, confirm: true })`
+with optional `description` and `visibility` to obtain the validated skill ID.
+`CreatePrivateSkillInput` and `CreatedPrivateSkill` are exported by both entry
+points. The shared `preparePrivatePublication`,
 `continuePrivatePublication`, `inspectPrivatePublication`, and
 `readPrivatePublicationRecovery` functions implement the same durable workflow.
 MCP exposes `publish_private_skill`, `get_private_publication`,