@jstn-sdk/ma 0.1.13 → 0.14.1

package/scripts/release-sync.js

@@ -31,6 +31,8 @@ const WATCHED_FILES = new Set([
 function parseArgs(argv) {
   const args = {
     bump: "",
+    version: "",
+    refreshFrom: "",
     fromRef: "",
     toRef: "",
     githubOutput: "",
@@ -44,6 +46,16 @@ function parseArgs(argv) {
       index += 1;
       continue;
     }
+    if (token === "--version") {
+      args.version = argv[index + 1] ?? "";
+      index += 1;
+      continue;
+    }
+    if (token === "--refresh-from") {
+      args.refreshFrom = argv[index + 1] ?? "";
+      index += 1;
+      continue;
+    }
     if (token === "--from-ref") {
       args.fromRef = argv[index + 1] ?? "";
       index += 1;
@@ -184,6 +196,12 @@ function updateCurrentSurfaceFile(file, oldVersion, nextVersion) {
   writeText(file, content);
 }
 
+function syncReadmeReleaseSurface(_nextVersion) {
+  const readmePath = "README.md";
+  // The README uses a dynamic GitHub release badge; no version replacement is needed.
+  writeText(readmePath, readText(readmePath));
+}
+
 function syncPackageVersion(nextVersion) {
   const pkg = readJson("package.json");
   const lock = readJson("package-lock.json");
@@ -196,10 +214,19 @@ function syncPackageVersion(nextVersion) {
   writeJson("package-lock.json", lock);
 }
 
+function syncSupportBundleVersion(nextVersion) {
+  const manifestPath = "support-bundle.json";
+  if (!fs.existsSync(manifestPath)) return;
+  const manifest = readJson(manifestPath);
+  manifest.bundleVersion = nextVersion;
+  writeJson(manifestPath, manifest);
+}
+
 function syncPluginVersions(nextVersion) {
   for (const file of [
     path.join("plugins", "meta-architect", ".app.json"),
     path.join("plugins", "meta-architect", ".mcp.json"),
+    path.join("plugins", "meta-architect", "obsidian", "manifest.json"),
   ]) {
     const value = readJson(file);
     value.version = nextVersion;
@@ -210,14 +237,28 @@ function syncPluginVersions(nextVersion) {
   const pluginManifest = readJson(pluginManifestFile);
   pluginManifest.version = nextVersion;
   writePluginManifestJson(pluginManifestFile, pluginManifest);
+
+  const claudePluginFile = path.join("plugins", "meta-architect", ".claude-plugin", "plugin.json");
+  const claudePlugin = readJson(claudePluginFile);
+  claudePlugin.version = nextVersion;
+  writeJson(claudePluginFile, claudePlugin);
+
+  const claudeMarketplaceFile = path.join(".claude-plugin", "marketplace.json");
+  const claudeMarketplace = readJson(claudeMarketplaceFile);
+  claudeMarketplace.metadata.version = nextVersion;
+  writeJson(claudeMarketplaceFile, claudeMarketplace);
 }
 
 function syncCurrentReleaseFiles(oldVersion, nextVersion) {
   for (const file of [
     "README.md",
+    "DEMO.md",
+    "COVERAGE.md",
     "RELEASE.md",
     path.join("docs", "README.md"),
     path.join("docs", "getting-started.md"),
+    path.join("docs", "onboarding.md"),
+    path.join("docs", "skills.md"),
     path.join("docs", "release-spec.md"),
     path.join("plugins", "meta-architect", "README.md"),
   ]) {
@@ -228,16 +269,17 @@ function syncCurrentReleaseFiles(oldVersion, nextVersion) {
   const nextQa = path.join("docs", "qa", `release-readiness-${nextVersion}.md`);
   fs.renameSync(oldQa, nextQa);
   updateCurrentSurfaceFile(nextQa, oldVersion, nextVersion);
+
+  const oldIssueGates = path.join("docs", "qa", `release-issue-gates-${oldVersion}.json`);
+  const nextIssueGates = path.join("docs", "qa", `release-issue-gates-${nextVersion}.json`);
+  if (fs.existsSync(oldIssueGates)) {
+    fs.renameSync(oldIssueGates, nextIssueGates);
+    updateCurrentSurfaceFile(nextIssueGates, oldVersion, nextVersion);
+  }
 }
 
 function syncSupportingCode(oldVersion, nextVersion) {
   const replacements = [
-    {
-      file: path.join("src", "skills.js"),
-      search: `release-readiness-${oldVersion}.md`,
-      replacement: `release-readiness-${nextVersion}.md`,
-      label: "skills QA path",
-    },
     {
       file: path.join("test", "package-install-smoke.test.js"),
       search: `jstn-sdk-ma-${oldVersion}.tgz`,
@@ -259,6 +301,9 @@ function syncSupportingCode(oldVersion, nextVersion) {
 
   const mcpLiveClientFile = path.join("src", "mcp-live-client.js");
   const mcpLiveClient = readText(mcpLiveClientFile);
+  if (/resolveMcpClientVersion\(packageMetadata\)/.test(mcpLiveClient)) {
+    return;
+  }
   if (!/version: "[0-9]+\.[0-9]+\.[0-9]+(?:-dev)?"/.test(mcpLiveClient)) {
     throw new Error("Expected to find mcp live client version declaration");
   }
@@ -271,6 +316,27 @@ function syncSupportingCode(oldVersion, nextVersion) {
   );
 }
 
+function refreshCurrentReleaseFiles(oldVersion, currentVersion) {
+  for (const file of [
+    "README.md",
+    "DEMO.md",
+    "COVERAGE.md",
+    "RELEASE.md",
+    path.join("docs", "README.md"),
+    path.join("docs", "getting-started.md"),
+    path.join("docs", "onboarding.md"),
+    path.join("docs", "skills.md"),
+    path.join("docs", "release-spec.md"),
+    path.join("plugins", "meta-architect", "README.md"),
+    path.join("docs", "qa", `release-readiness-${currentVersion}.md`),
+    path.join("docs", "qa", `release-issue-gates-${currentVersion}.json`),
+    path.join("scripts", "install.sh"),
+    path.join("plugins", "meta-architect", "obsidian", "manifest.json"),
+  ]) {
+    if (fs.existsSync(file)) updateCurrentSurfaceFile(file, oldVersion, currentVersion);
+  }
+}
+
 function rewriteReleaseState(nextVersion, previousVersion) {
   const releasePath = "RELEASE.md";
   const qaPath = path.join("docs", "qa", `release-readiness-${nextVersion}.md`);
@@ -319,6 +385,13 @@ function main() {
   const args = parseArgs(process.argv.slice(2));
   const pkg = readJson("package.json");
   const currentVersion = pkg.version;
+  if (args.refreshFrom) {
+    refreshCurrentReleaseFiles(args.refreshFrom, currentVersion);
+    console.log(
+      JSON.stringify({ updated: true, refreshed: true, version: currentVersion }, null, 2),
+    );
+    return;
+  }
   const changedFiles = getChangedFiles(args);
   const relevantChanges = args.force ? ["<forced>"] : changedFiles.filter(isWatchedPath);
 
@@ -342,12 +415,15 @@ function main() {
   }
 
   const bumpKind = args.bump || "patch";
-  const nextVersion = bumpVersion(currentVersion, bumpKind);
+  const nextVersion = args.version || bumpVersion(currentVersion, bumpKind);
+  parseVersion(nextVersion);
 
   syncPackageVersion(nextVersion);
+  syncSupportBundleVersion(nextVersion);
   syncPluginVersions(nextVersion);
   prependChangelog(nextVersion);
   syncCurrentReleaseFiles(currentVersion, nextVersion);
+  syncReadmeReleaseSurface(nextVersion);
   syncSupportingCode(currentVersion, nextVersion);
   rewriteReleaseState(nextVersion, currentVersion);
 

package/scripts/release-verify.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 
+import { execFileSync } from "node:child_process";
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -7,8 +9,6 @@ import { validateReleaseIssueGates } from "../src/release-issue-gates.js";
 
 const CANONICAL_PACKAGE = "@jstn-sdk/ma";
 const CANONICAL_INSTALL = "npm i -g @openai/codex@latest @jstn-sdk/ma@latest";
-const CDN_INSTALL =
-  "curl -fsSL https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@main/scripts/install.sh | sh";
 const CANONICAL_LAUNCH = "ma --madmax --high";
 const UNINSTALL_MA = "npm uninstall -g @jstn-sdk/ma";
 const UNINSTALL_BOTH = "npm uninstall -g @jstn-sdk/ma @openai/codex";
@@ -41,13 +41,29 @@ function parseVersion(version) {
   return match.groups;
 }
 
+function latestCdnInstall() {
+  return "curl -fsSLo install.sh https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh && curl -fsSLo install.sh.sha256 https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh.sha256 && sed 's#scripts/install.sh#install.sh#' install.sh.sha256 | sha256sum -c - && sh install.sh";
+}
+
 function verifyInstallBlock(file) {
   const content = readText(file);
-  if (!content.includes(CANONICAL_INSTALL) && !content.includes(CDN_INSTALL)) {
+  const cdnInstall = latestCdnInstall();
+  const htmlCdnInstall = cdnInstall.replaceAll("&&", "&&");
+  const normalizedContent = content.replaceAll("\\|", "|");
+  const splitCdnInstall = [
+    "curl -fsSLo install.sh https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh",
+    "curl -fsSLo install.sh.sha256 https://cdn.jsdelivr.net/gh/JustineDevs/meta-architect@latest/scripts/install.sh.sha256",
+    "sed 's#scripts/install.sh#install.sh#' install.sh.sha256 | sha256sum -c -",
+    "sh install.sh",
+  ].every((command) => normalizedContent.includes(command));
+  if (!content.includes(CANONICAL_INSTALL) && !content.includes(cdnInstall) && !splitCdnInstall) {
     return;
   }
 
-  assert(content.includes(CDN_INSTALL), `${file}: missing jsDelivr POSIX installer command`);
+  assert(
+    content.includes(cdnInstall) || content.includes(htmlCdnInstall) || splitCdnInstall,
+    `${file}: missing jsDelivr POSIX installer command`,
+  );
   assert(content.includes(CANONICAL_INSTALL), `${file}: missing canonical npm install command`);
   assert(content.includes(CANONICAL_LAUNCH), `${file}: missing canonical launch command`);
   assert(content.includes(UNINSTALL_MA), `${file}: missing uninstall Meta-Architect command`);
@@ -77,12 +93,29 @@ function verifyNpmIgnore() {
   }
 }
 
+function verifyDistPolicy() {
+  const tracked = execFileSync("git", ["ls-files", "dist/"], { encoding: "utf8" }).trim();
+  assert(!tracked, `dist/: generated release artifacts must not be tracked:\n${tracked}`);
+}
+
+function verifyInstallerIntegrity() {
+  const installer = readText("scripts/install.sh");
+  const checksum = readText("scripts/install.sh.sha256").trim().split(/\s+/)[0];
+  const actual = crypto.createHash("sha256").update(installer).digest("hex");
+  assert(checksum === actual, "scripts/install.sh.sha256: checksum does not match installer");
+  assert(
+    !installer.includes("raw.githubusercontent.com") && !installer.includes("jsdelivr"),
+    "scripts/install.sh: must not fetch mutable installer sources at runtime",
+  );
+}
+
 function verifyDemoDoc({ version, gitTag }) {
+  const cdnInstall = latestCdnInstall();
   assert(fs.existsSync("DEMO.md"), "DEMO.md: missing demo guide");
   const content = readText("DEMO.md");
   assert(content.includes(`Release line: \`${gitTag}\``), "DEMO.md: wrong release line");
   assert(content.includes("Package: `@jstn-sdk/ma`"), "DEMO.md: missing package name");
-  assert(content.includes(CDN_INSTALL), "DEMO.md: missing jsDelivr installer");
+  assert(content.includes(cdnInstall), "DEMO.md: missing versioned installer");
   assert(content.includes(CANONICAL_INSTALL), "DEMO.md: missing canonical npm install");
   assert(content.includes(CANONICAL_LAUNCH), "DEMO.md: missing canonical launch");
   assert(content.includes(UNINSTALL_MA), "DEMO.md: missing MA uninstall command");
@@ -131,6 +164,77 @@ function verifyCoverageDoc({ version, gitTag }) {
   assert(!content.includes("v0.1.0 release bar"), "COVERAGE.md: stale release bar");
 }
 
+function verifyReadmeReleaseSurface({ gitTag }) {
+  const content = readText("README.md");
+  const demoImage = `<img src="https://raw.githubusercontent.com/JustineDevs/meta-architect/${gitTag}/docs/assets/DEMO_VIDEO.gif" alt="Meta-Architect demo video" width="800">`;
+  const bannerImage = `<img src="./docs/assets/banner.png" alt="Meta-Architect: quality gates and evidence verification for AI coding agents" width="1000">`;
+  assert(content.includes("> [!NOTE]"), "README.md: missing product-positioning note admonition");
+  assert(
+    content.includes(
+      "> Meta-Architect is a workflow layer for teams that want architecture, evidence, review, and release discipline before build execution.",
+    ),
+    "README.md: missing workflow-layer positioning note",
+  );
+  assert(
+    content.includes("> Meta-Architect does not replace your coding runtime."),
+    "README.md: missing runtime-wrapper boundary note",
+  );
+  assert(
+    content.includes(
+      "> It wraps that runtime with architecture, evidence, gate enforcement, and release-sensitive workflow control.",
+    ),
+    "README.md: missing runtime-wrapper behavior note",
+  );
+  assert(content.includes(demoImage), "README.md: missing requested 800px demo GIF");
+  assert(
+    content.includes("<summary><strong>🔌 All 33 plugins & features</strong></summary>"),
+    "README.md: missing all 33 plugins/features toggle",
+  );
+  assert(
+    content.includes(
+      "https://img.shields.io/github/v/release/JustineDevs/meta-architect?display_name=tag&sort=semver",
+    ),
+    "README.md: missing GitHub release badge",
+  );
+  assert(
+    fs.existsSync(path.join("docs", "assets", "banner.png")),
+    "docs/assets/banner.png: missing",
+  );
+  assert(content.includes(bannerImage), "README.md: banner image missing");
+  assert(
+    !content.includes("raw.githubusercontent.com/JustineDevs/meta-architect/main/"),
+    "README.md: stable docs must not reference mutable main",
+  );
+}
+
+function verifyRealDemoKit() {
+  const runbook = readText(path.join("docs", "demo", "REAL_DEMO_RUNBOOK.md"));
+  const story = readText(path.join("docs", "demo", "DEMO_STORY.md"));
+  const checklist = readText(path.join("docs", "demo", "PROSPECT_CHECKLIST.md"));
+  assert(fs.existsSync(path.join("scripts", "demo-smoke.js")), "scripts/demo-smoke.js: missing");
+  assert(
+    runbook.includes("npm run demo:smoke"),
+    "REAL_DEMO_RUNBOOK.md: missing demo smoke command",
+  );
+  assert(runbook.includes("$maestro"), "REAL_DEMO_RUNBOOK.md: missing maestro scenario");
+  assert(
+    runbook.includes("vault_context"),
+    "REAL_DEMO_RUNBOOK.md: missing Obsidian context boundary",
+  );
+  assert(story.includes("Northstar Logistics"), "DEMO_STORY.md: missing realistic buyer story");
+  assert(story.includes("npm run release:verify"), "DEMO_STORY.md: missing release proof close");
+  assert(
+    checklist.includes("Remove `Demo Account`, `Test Company`, `Sample Co`"),
+    "PROSPECT_CHECKLIST.md: missing no-test-branding check",
+  );
+  for (const forbidden of ["Demo Account", "Test Company", "Sample Co"]) {
+    assert(
+      !runbook.includes(forbidden) && !story.includes(forbidden),
+      `demo docs: forbidden visible demo branding ${forbidden}`,
+    );
+  }
+}
+
 function verifyCanonicalSemanticSurfaces({ version, gitTag }) {
   const usageWorkflow = readText(path.join("example", "usage-workflow.md"));
   assert(
@@ -178,7 +282,7 @@ function verifyCanonicalSemanticSurfaces({ version, gitTag }) {
 
   const currentQa = readText(path.join("docs", "qa", `release-readiness-${version}.md`));
   assert(
-    currentQa.includes("Harden Meta-Architect v0.1.13 semantic core"),
+    currentQa.includes(`Harden Meta-Architect ${gitTag} semantic core`),
     `docs/qa/release-readiness-${version}.md: missing realistic semantic smoke idea`,
   );
   assert(
@@ -217,8 +321,12 @@ function main() {
   assert(pkg.files?.includes("COVERAGE.md"), "package.json: files must include COVERAGE.md");
 
   verifyNpmIgnore();
+  verifyDistPolicy();
+  verifyInstallerIntegrity();
   verifyDemoDoc({ version, gitTag });
   verifyCoverageDoc({ version, gitTag });
+  verifyReadmeReleaseSurface({ gitTag });
+  verifyRealDemoKit();
   verifyCanonicalSemanticSurfaces({ version, gitTag });
 
   const changelog = readText("CHANGELOG.md");
@@ -263,12 +371,28 @@ function main() {
   const pluginManifest = readJson(
     path.join("plugins", "meta-architect", ".codex-plugin", "plugin.json"),
   );
+  const claudeMarketplace = readJson(path.join(".claude-plugin", "marketplace.json"));
+  const claudePlugin = readJson(
+    path.join("plugins", "meta-architect", ".claude-plugin", "plugin.json"),
+  );
   assert(pluginApp.version === version, "plugins/meta-architect/.app.json: version drift");
   assert(pluginMcp.version === version, "plugins/meta-architect/.mcp.json: version drift");
   assert(
     pluginManifest.version === version,
     "plugins/meta-architect/.codex-plugin/plugin.json: version drift",
   );
+  assert(
+    claudeMarketplace.metadata?.version === version,
+    ".claude-plugin/marketplace.json: version drift",
+  );
+  assert(
+    claudeMarketplace.plugins?.some((plugin) => plugin.source === "./plugins/meta-architect"),
+    ".claude-plugin/marketplace.json: missing Meta-Architect plugin source",
+  );
+  assert(
+    claudePlugin.version === version,
+    "plugins/meta-architect/.claude-plugin/plugin.json: version drift",
+  );
 
   for (const file of [
     "README.md",
@@ -279,7 +403,7 @@ function main() {
     path.join("docs", "skills.md"),
     path.join("plugins", "meta-architect", "README.md"),
   ]) {
-    verifyInstallBlock(file);
+    verifyInstallBlock(file, gitTag);
   }
 
   const envTag =

package/scripts/setup-npmrc.js

@@ -1,39 +1,64 @@
 #!/usr/bin/env node
 
+import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import process from "node:process";
+import { fileURLToPath } from "node:url";
 
-function normalizeRegistry(registryUrl) {
-  return registryUrl.endsWith("/") ? registryUrl : `${registryUrl}/`;
+export async function createTemporaryNpmConfig({
+  token,
+  registry = "https://registry.npmjs.org/",
+  scope = "",
+  tempRoot = process.env.RUNNER_TEMP || os.tmpdir(),
+} = {}) {
+  if (!token) return null;
+  const normalizedRegistry = registry.endsWith("/") ? registry : `${registry}/`;
+  const host = new URL(normalizedRegistry).host;
+  const configPath = path.join(tempRoot, `meta-architect-npmrc-${randomUUID()}`);
+  const content = [
+    `registry=${normalizedRegistry}`,
+    ...(scope ? [`${scope}:registry=${normalizedRegistry}`] : []),
+    `//${host}/:_authToken=${token}`,
+    "",
+  ].join("\n");
+
+  await fs.writeFile(configPath, content, { encoding: "utf8", mode: 0o600 });
+  await fs.chmod(configPath, 0o600);
+  return configPath;
+}
+
+export async function cleanupTemporaryNpmConfig(configPath) {
+  if (!configPath) return false;
+  await fs.rm(configPath, { force: true });
+  return true;
 }
 
 async function main() {
   const token = process.env.NPM_TOKEN || process.env.NODE_AUTH_TOKEN;
   if (!token) {
-    console.log("No npm token detected. Skipping .npmrc generation.");
+    console.log("No npm token detected. Skipping temporary npm auth config.");
     return;
   }
 
-  const registry = normalizeRegistry(process.env.NPM_REGISTRY_URL || "https://registry.npmjs.org/");
-  const scope = process.env.NPM_SCOPE || "";
-  const host = new URL(registry).host;
-  const npmrcPath = path.join(process.cwd(), ".npmrc");
-
-  const content = [
-    `registry=${registry}`,
-    ...(scope ? [`${scope}:registry=${registry}`] : []),
-    `//${host}/:_authToken=${token}`,
-    "",
-  ].join("\n");
-
-  await fs.writeFile(npmrcPath, content, "utf8");
-  console.log(
-    `Wrote CI .npmrc for ${scope ? `scope ${scope}` : "the canonical unscoped package"}.`,
-  );
+  const configPath = await createTemporaryNpmConfig({
+    token,
+    registry: process.env.NPM_REGISTRY_URL || "https://registry.npmjs.org/",
+    scope: process.env.NPM_SCOPE || "",
+  });
+  if (process.env.GITHUB_ENV) {
+    await fs.appendFile(process.env.GITHUB_ENV, `NPM_CONFIG_USERCONFIG=${configPath}\n`);
+  }
+  console.log("Created temporary npm auth config outside the workspace.");
+  if (!process.env.GITHUB_ENV) {
+    console.log(`Use NPM_CONFIG_USERCONFIG=${configPath} for the current command.`);
+  }
 }
 
-main().catch((error) => {
-  console.error(error.message);
-  process.exitCode = 1;
-});
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}

package/scripts/skills-install.js

@@ -1,22 +1,29 @@
 #!/usr/bin/env node
 
 import process from "node:process";
-import { installSkills } from "../src/skill-installer.js";
+import { installSkills, rollbackInstalledAssets } from "../src/skill-installer.js";
 
 function parseArgs(argv) {
-  const args = { path: null };
+  const args = { path: null, rollback: false };
   for (let index = 0; index < argv.length; index += 1) {
     const token = argv[index];
     if (token === "--path") {
       args.path = argv[index + 1];
       index += 1;
     }
+    if (token === "--rollback") args.rollback = true;
   }
   return args;
 }
 
 async function main() {
   const args = parseArgs(process.argv.slice(2));
+  if (args.rollback) {
+    console.log(
+      JSON.stringify(await rollbackInstalledAssets({ targetRoot: args.path ?? undefined })),
+    );
+    return;
+  }
   const { installed } = await installSkills({ targetRoot: args.path ?? undefined });
   for (const skill of installed) {
     console.log(`installed ${skill.name} -> ${skill.dest}`);

package/scripts/skills-manifest.js

@@ -3,31 +3,12 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
+import { parseSkillFrontmatter, validateSkillFrontmatter } from "../src/skill-frontmatter.js";
 
 const repoRoot = process.cwd();
 const skillsRoot = path.join(repoRoot, "skills");
 const manifestPath = path.join(skillsRoot, "index.json");
 
-function parseFrontmatterNameAndDescription(content) {
-  const match = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!match) {
-    throw new Error("Missing SKILL.md frontmatter");
-  }
-
-  const lines = match[1].split("\n");
-  let name = "";
-  let description = "";
-  for (const line of lines) {
-    if (line.startsWith("name:")) {
-      name = line.slice("name:".length).trim();
-    }
-    if (line.startsWith("description:")) {
-      description = line.slice("description:".length).trim().replace(/^"|"$/g, "");
-    }
-  }
-  return { name, description };
-}
-
 async function main() {
   const entries = await fs.readdir(skillsRoot, { withFileTypes: true });
   const skills = [];
@@ -39,7 +20,7 @@ async function main() {
 
     const skillPath = path.join(skillsRoot, entry.name, "SKILL.md");
     const content = await fs.readFile(skillPath, "utf8");
-    const meta = parseFrontmatterNameAndDescription(content);
+    const meta = validateSkillFrontmatter(parseSkillFrontmatter(content), entry.name);
     skills.push({
       name: meta.name,
       path: `skills/${entry.name}`,

package/scripts/skills-pack.js

@@ -2,9 +2,9 @@
 
 import { spawnSync } from "node:child_process";
 import fs from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
 import process from "node:process";
+import { createTestNamespace } from "../src/test-fixtures.js";
 
 const repoRoot = process.cwd();
 const distRoot = path.join(repoRoot, "dist");
@@ -28,7 +28,7 @@ async function copyDir(src, dest) {
 async function main() {
   await fs.mkdir(distRoot, { recursive: true });
   await fs.rm(bundlePath, { force: true });
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "meta-architect-skills-"));
+  const tempRoot = createTestNamespace("meta-architect-skills");
   const frozenSkillsRoot = path.join(tempRoot, "skills");
   await copyDir(skillsRoot, frozenSkillsRoot);
 

package/scripts/skills-validate.js

@@ -3,6 +3,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
+import { parseSkillFrontmatter, validateSkillFrontmatter } from "../src/skill-frontmatter.js";
 
 const repoRoot = process.cwd();
 const skillsRoot = path.join(repoRoot, "skills");
@@ -12,42 +13,6 @@ function fail(message) {
   process.exitCode = 1;
 }
 
-function extractFrontmatter(content) {
-  const match = content.match(/^---\n([\s\S]*?)\n---\n?/);
-  if (!match) {
-    return null;
-  }
-
-  const yaml = match[1];
-  const result = {};
-
-  for (const rawLine of yaml.split("\n")) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) {
-      continue;
-    }
-
-    const separator = line.indexOf(":");
-    if (separator === -1) {
-      continue;
-    }
-
-    const key = line.slice(0, separator).trim();
-    let value = line.slice(separator + 1).trim();
-
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-
-    result[key] = value;
-  }
-
-  return result;
-}
-
 async function validateSkillDir(skillDir) {
   const skillName = path.basename(skillDir);
   const skillPath = path.join(skillDir, "SKILL.md");
@@ -58,25 +23,10 @@ async function validateSkillDir(skillDir) {
     throw new Error(`${skillName}: missing SKILL.md`);
   }
 
-  const frontmatter = extractFrontmatter(skillContent);
-  if (!frontmatter) {
-    throw new Error(`${skillName}: SKILL.md missing frontmatter`);
-  }
-
-  if (!frontmatter.name) {
-    throw new Error(`${skillName}: frontmatter missing name`);
-  }
-
-  if (frontmatter.name !== skillName) {
-    throw new Error(`${skillName}: frontmatter name must match directory name`);
-  }
-
-  if (!/^[a-z0-9-]+$/.test(frontmatter.name)) {
-    throw new Error(`${skillName}: frontmatter name must be lowercase kebab-case`);
-  }
-
-  if (!frontmatter.description || frontmatter.description.length < 10) {
-    throw new Error(`${skillName}: frontmatter description is missing or too short`);
+  try {
+    validateSkillFrontmatter(parseSkillFrontmatter(skillContent), skillName);
+  } catch (error) {
+    throw new Error(`${skillName}: ${error.message}`);
   }
 
   const agentContent = await fs.readFile(agentPath, "utf8").catch(() => null);