@house365/comate 0.9.6 → 0.9.7

package/bin/init.mjs

@@ -256,9 +256,9 @@ function pruneDeprecatedSkills(
   return removed;
 }
 
-// True only when the pinned `skills` dependency resolves locally. A postinstall
-// must never reach the network, so this gates syncComateSkills: if resolution
-// fails we skip rather than let skillsInvocation fall back to `npx skills@latest`.
+// True only when the pinned `skills` dependency resolves locally. This keeps a
+// postinstall from downloading an arbitrary CLI through the npx fallback. The
+// CLI may still fetch declared skill sources such as obra/superpowers.
 function skillsResolvesLocally(pkgRoot) {
   try {
     createRequire(join(pkgRoot, 'package.json')).resolve('skills/package.json');
@@ -268,19 +268,40 @@ function skillsResolvesLocally(pkgRoot) {
   }
 }
 
-// Copy comate's own skills into ~/.agents/skills via the bundled skills CLI —
-// the exact command `comate init` runs, so the layout is identical. Local-only:
-// skips (never goes to network) when the skills dep can't be resolved, leaving
-// `comate init` as the fallback. Returns { ok, skipped }.
-function syncComateSkills(pkgRoot, { home = process.env.HOME ?? process.env.USERPROFILE ?? '', runner = run } = {}) {
+// Install the user-level skills needed by comate via the bundled skills CLI.
+// Superpowers is fetched only when its marker is absent; comate's bundled skills
+// are always refreshed on npm upgrades. `comate init` remains the diagnostic
+// fallback when this best-effort postinstall sync cannot complete.
+function syncComateSkills(
+  pkgRoot,
+  {
+    home = process.env.HOME ?? process.env.USERPROFILE ?? '',
+    runner = run,
+    exists = existsSync,
+  } = {},
+) {
   if (!skillsResolvesLocally(pkgRoot)) return { ok: false, skipped: 'no-local-cli' };
-  const r = runner(
+
+  const superpowersMarker = join(home, '.agents', 'skills', 'using-superpowers', 'SKILL.md');
+  let superpowers = { ok: true };
+  if (!exists(superpowersMarker)) {
+    superpowers = runner(
+      skillsInvocation(pkgRoot, ['add', 'obra/superpowers', '-g', '-y']),
+      SKILLS_TIMEOUT_MS,
+      { quiet: true },
+    );
+  }
+
+  const comate = runner(
     skillsInvocation(pkgRoot, ['add', pkgRoot, '--skill', '*', '-g', '-y']),
     SKILLS_TIMEOUT_MS,
     { quiet: true },
   );
-  const landed = existsSync(join(home, '.agents', 'skills', 'comate', 'SKILL.md'));
-  return { ok: r.ok && landed, skipped: null };
+  const comateMarker = join(home, '.agents', 'skills', 'comate', 'SKILL.md');
+  return {
+    ok: superpowers.ok && exists(superpowersMarker) && comate.ok && exists(comateMarker),
+    skipped: null,
+  };
 }
 
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@house365/comate",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "description": "comate —— SDD (规约驱动开发) 的 AI 开发编排器（Agent Skills）",
   "type": "module",
   "license": "MIT",