@iseoane/agent-depot 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.1] - 2026-09-30
+
+### Fixed
+
+- A project manifest that pins a built-in Skill to another Agent Depot version stays loadable; `install --manifest` skips that Skill with its reason and installs the rest.
+- `install --manifest` now fails with exit code 1 ("Nothing to install") when every Skill is skipped, and prints a summary line when only some are.
+- `--help`, `-h` and `help` print the usage and exit 0.
+- The Updates view names the reason on the collapsed "cannot be checked" row.
+- Unmanaged symlink identity includes birth time and size, so a replaced symlink is no longer mistaken for the original.
+- Bulk actions in the TUI detect drift strictly: a change to the installation records outside the batch stops the affected item and leaves it untouched.
+- The TUI only treats real terminal escape sequences as escape remnants, so pasting text such as `Ok` into an input keeps it.
+- Updates scope keys (`t`, `p`, `g`) are looked up in a Map, so prototype property names can never match.
+
+### Changed
+
+- The npm tarball is smaller: source maps and Skill tests are excluded.
+- README links are absolute GitHub URLs so they work on npm.
+
+### Internal
+
+- Every source file is covered by a dependency-boundary zone (fallow audit); the version test path was fixed.
+- Duplicated blocks removed (18 clone groups down to 3) in project installation and the TUI views.
+- Cognitive complexity reduced in the catalog, updates and installations views and their key handlers; `installations-view.tsx` and `catalog-view.tsx` split into focused modules.
+- Characterization tests for the complex functions in `src/path-safety.ts`.
+
 ## [0.2.0] - 2026-09-30
 
 ### BREAKING

package/README.md

@@ -47,7 +47,9 @@ Agent Depot is reported as not updatable (update Agent Depot first).
 
 ## Usage
 
-With the package installed (or via `npx @iseoane/agent-depot`):
+With the package installed (or via `npx @iseoane/agent-depot`). `agent-depot --help`
+(also `-h` or `help`) prints the usage and exits 0; running it without arguments
+or with an unknown command is a usage error and exits 1.
 
 ```sh
 agent-depot source list
@@ -249,7 +251,10 @@ Sources require a fixed 40- or 64-character Git commit. For the built-in
 Source, `latest` tracks the installed Agent Depot package, while a fixed policy
 is accepted only when its value exactly equals that package's current version;
 other values fail closed because the requested package version cannot be
-reproduced. The built-in Source does not support `--ref`, and the CLI rejects it
+reproduced. A manifest written by another Agent Depot stays loadable: a built-in
+Skill pinned to a different version shows as unknown in `update check` ("pinned
+to Agent Depot X; running Y") and is skipped by `install --manifest`, while the
+other Skills keep working. The built-in Source does not support `--ref`, and the CLI rejects it
 explicitly. External `latest` may track an explicit mutable safe ref, but an
 immutable commit ref must use a fixed policy matching that commit. The
 `--portable-v1` flag requires the validated portable format rule; compatibility
@@ -410,7 +415,7 @@ Safety model:
 - Batch installs and removals apply item by item; one failure does not stop the
   others and each item reports its own result.
 
-See [CONTEXT.md](CONTEXT.md) for the domain terms and [docs/adr](docs/adr) for the
+See [CONTEXT.md](https://github.com/iseoane/agent-depot/blob/main/CONTEXT.md) for the domain terms and [docs/adr](https://github.com/iseoane/agent-depot/tree/main/docs/adr) for the
 decisions behind the TUI.
 
 ## Configuration and cache