@iceinvein/agent-skills 0.18.1 → 0.18.2

package/dist/cli/index.js

@@ -468,6 +468,7 @@ async function wireSessionStartHook(settingsPath, skillName, directive, scriptPa
   const legacy = `echo ${shq(directive)}`;
   let adopted = false;
   let custom = false;
+  let customRunsScript = false;
   let changed = false;
   for (const group of settings.hooks.SessionStart) {
     const kept = [];
@@ -479,6 +480,8 @@ async function wireSessionStartHook(settingsPath, skillName, directive, scriptPa
       const plain = hook.skill !== undefined || hook.command === legacy;
       if (!plain) {
         custom = true;
+        if (scriptPath && hook.command?.includes(scriptPath))
+          customRunsScript = true;
         kept.push(hook);
         continue;
       }
@@ -499,7 +502,7 @@ async function wireSessionStartHook(settingsPath, skillName, directive, scriptPa
   }
   settings.hooks.SessionStart = settings.hooks.SessionStart.filter((group) => !group.hooks || group.hooks.length > 0);
   if (adopted || custom) {
-    if (custom && !adopted && scriptPath) {
+    if (custom && !adopted && scriptPath && !customRunsScript) {
       console.warn(`${skillName}: a hand-edited SessionStart hook already carries its directive, so it was left as is and ${scriptPath} was not wired; add it to that entry yourself if you want it.`);
     }
     if (changed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iceinvein/agent-skills",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Install agent skills into AI coding tools",
   "author": "iceinvein",
   "license": "MIT",

package/skills/index.json

@@ -283,7 +283,7 @@
     "name": "sluice",
     "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries seven rules as one-liners in the router and the full treatment in references read only on friction. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Claude Code only; stands down where the superpowers pipeline governs the repo.",
     "type": "prompt",
-    "version": "0.19.1"
+    "version": "0.19.2"
   },
   {
     "name": "temporal-coupling-detector",

package/skills/sluice/scripts/postinstall.sh

@@ -31,6 +31,52 @@ CONFIGURED="$(jq -r '.statusLine.command // empty' "$SETTINGS" 2>/dev/null || tr
 [ -n "$CONFIGURED" ] || exit 0
 
 RENDER="$(cd "$(dirname "$RENDER")" && pwd)/$(basename "$RENDER")"
+# Physical, and so is every candidate below it: a tmpdir or a home reached
+# through a symlink resolves one way from here and the other way out of a
+# settings string, and the containment check below compares the two.
+CONFIG="$(cd "$BUNDLE/../.." && pwd -P)"
+
+# Someone who pasted the two lines a release ago has nothing left to do, and
+# saying it again on every update is the one thing they cannot switch off. So
+# the script the slot runs is read before anything is printed.
+#
+# It is recovered rather than known: settings.json holds a shell command, so
+# every token carrying a slash is tried as a path, with the two variables a
+# config path is ever written through expanded by substitution. Not by eval,
+# which on a settings file means running its contents. A token that resolves to
+# nothing is skipped and the instructions print as they did before, so a command
+# this cannot read costs a notice rather than a wrong silence.
+#
+# Only paths inside the config directory this skill installed into are opened.
+# The slot is someone elses shell string and may name anything; a postinstall
+# that followed it wherever it pointed would be reading arbitrary files off a
+# line it does not control.
+statusline_script() {
+	local tok path dir
+	for tok in $(printf '%s' "$1" | tr -s "\"'| \t" '\n'); do
+		case "$tok" in */*) ;; *) continue ;; esac
+		path="$tok"
+		path="${path//\$\{CLAUDE_CONFIG_DIR:-\$HOME\/.claude\}/$CONFIG}"
+		path="${path//\$\{CLAUDE_CONFIG_DIR\}/$CONFIG}"
+		path="${path//\$CLAUDE_CONFIG_DIR/$CONFIG}"
+		path="${path//\$\{HOME\}/$HOME}"
+		path="${path//\$HOME/$HOME}"
+		case "$path" in "~/"*) path="$HOME/${path#\~/}" ;; esac
+		[ -f "$path" ] || continue
+		dir="$(cd "$(dirname "$path")" 2>/dev/null && pwd -P)"
+		[ -n "$dir" ] || continue
+		path="$dir/$(basename "$path")"
+		case "$path" in "$CONFIG"/*) ;; *) continue ;; esac
+		printf '%s\n' "$path"
+		return 0
+	done
+	return 1
+}
+
+SLOT_SCRIPT="$(statusline_script "$CONFIGURED" || true)"
+if [ -n "$SLOT_SCRIPT" ] && grep -q "skills/sluice/scripts/statusline.sh" "$SLOT_SCRIPT" 2>/dev/null; then
+	exit 0
+fi
 
 # The slot points at the bundled command: the install claimed it and there is
 # nothing for anyone to paste. Say so rather than print instructions that would

package/skills/sluice/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "sluice",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries seven rules as one-liners in the router and the full treatment in references read only on friction. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Claude Code only; stands down where the superpowers pipeline governs the repo.",
   "author": "iceinvein",
   "type": "prompt",