@jesdi/skills 0.0.3 → 0.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jesdi/skills",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "jesdi's agent skills (content package consumed by @jesdi/skills-cli)",
   "license": "MIT",
   "repository": {

package/skills/backlog/rank.py

@@ -139,16 +139,25 @@ def render(result):
     return "\n".join(lines)
 
 
-def _gh_json(args):
-    completed = subprocess.run(args, capture_output=True, text=True, check=True)
+def _gh_json(args, env=None):
+    completed = subprocess.run(args, capture_output=True, text=True, check=True,
+                               env=env)
     return json.loads(completed.stdout)
 
 
+def _project_env():
+    """User-owned Projects v2 are invisible to fine-grained PATs, so when
+    GH_PROJECT_TOKEN is set, `gh project` calls run with GH_TOKEN swapped to
+    it; every other gh call keeps the stored auth (which can read the repo)."""
+    token = os.environ.get("GH_PROJECT_TOKEN")
+    return {**os.environ, "GH_TOKEN": token} if token else None
+
+
 def main(owner, project_number, repo):
     payload = _gh_json([
         "gh", "project", "item-list", str(project_number),
         "--owner", owner, "--format", "json", "--limit", "200",
-    ])
+    ], env=_project_env())
     project_items = payload.get("items", [])
     issue_rows = _gh_json([
         "gh", "issue", "list", "--repo", repo, "--state", "all",

package/skills/backlog/test_rank.py

@@ -206,6 +206,38 @@ def test_find_project_meta_nearest_ancestor_wins(tmp_path, monkeypatch):
     assert rank.find_project_meta() == str(inner_meta)
 
 
+def test_project_env_absent_without_token(monkeypatch):
+    monkeypatch.delenv("GH_PROJECT_TOKEN", raising=False)
+    assert rank._project_env() is None
+
+
+def test_project_env_swaps_gh_token(monkeypatch):
+    monkeypatch.setenv("GH_PROJECT_TOKEN", "classic-tok")
+    env = rank._project_env()
+    assert env["GH_TOKEN"] == "classic-tok"
+
+
+def test_main_uses_project_token_only_for_project_call(monkeypatch):
+    monkeypatch.setenv("GH_PROJECT_TOKEN", "classic-tok")
+    calls = []
+
+    def fake_run(args, capture_output, text, check, env=None):
+        calls.append((args, env))
+
+        class R:
+            stdout = "{\"items\": []}" if args[1] == "project" else "[]"
+
+        return R()
+
+    monkeypatch.setattr(rank.subprocess, "run", fake_run)
+    rank.main("acme", 1, "acme/private-repo")
+    project_call, issue_call = calls
+    assert project_call[0][1] == "project"
+    assert project_call[1]["GH_TOKEN"] == "classic-tok"
+    assert issue_call[0][1] == "issue"
+    assert issue_call[1] is None  # stored gh auth (repo PAT) stays active
+
+
 def test_find_project_meta_errors_clearly_when_absent(tmp_path, monkeypatch):
     monkeypatch.chdir(tmp_path)
     with pytest.raises(FileNotFoundError) as exc:

package/skills-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-07-16T10:07:19.685Z",
+  "generatedAt": "2026-07-23T11:12:36.101Z",
   "skills": [
     {
       "name": "backlog",
-      "version": "0.1.0",
-      "hash": "sha256-ac26c0313981666dfc143bb6eabbf603e0b02111c13ea543e1c86c2900e40559",
+      "version": "0.1.1",
+      "hash": "sha256-2a594bc97cd045b92b5771f6c462b861b8adcfaee0135c59820af092bdf02a2f",
       "description": "Manage a GitHub-Issues-backed backlog and a Projects-v2 work graph via five verbs. Use when the user wants to CAPTURE an idea/research thread (\"add to backlog\", \"capture this\", \"note this idea\", \"log a task\"), TRIAGE the inbox (\"triage the backlog\", \"score the inbox\"), see what to work on NEXT (\"what's next\", \"what should I work on\", \"ranked backlog\", \"next actionable task\"), LAND a finished item (\"mark done\", \"close out #N\"), or SETUP the board the first time. Ranks open issues by impact÷effort, respecting `Blocked by:` edges, so only actionable work surfaces."
     },
     {