@keystrokehq/cli 0.1.59 → 0.1.60

package/dist/skills-bundle/_AGENTS.md

@@ -46,12 +46,16 @@ my-app/
 
 Each primitive imports from `@keystrokehq/keystroke/<piece>` (`/agent`, `/action`, `/workflow`, `/trigger`, `/sandbox`). Integrations are `@keystrokehq/<slug>` packages.
 
+When you add any `@keystrokehq/*` package, pin it to `"latest"` in `package.json` — e.g. `"@keystrokehq/gmail": "latest"`. Don't use exact semver (`"1.2.3"`) or caret ranges (`"^1.2.3"`); `"latest"` matches how `keystroke init` scaffolds deps and lets build/deploy auto-update keep you current.
+
 ### Dev tooling
 
 Lint, typecheck, and test run through the CLI. Projects depend on `@keystrokehq/keystroke`, `zod`, and `@keystrokehq/cli` — not oxlint, TypeScript, vitest, or `@types/node`. Configs live in the CLI bundle; these commands write no files into the project.
 
 **Deploy is the gate.** `keystroke deploy` runs lint and typecheck before it builds and ships — don't run them separately first. Attempt deploy, fix what it reports, redeploy. Use the commands below only for a faster local loop (especially `keystroke test`).
 
+**Keep `@keystrokehq/*` on latest.** The CLI auto-updates itself on every run, and `keystroke deploy` / `keystroke build` auto-update every `@keystrokehq/*` dep to latest first — but CI (`CI=true` or `CI=1`) skips all updates, and a registry minimum-release-age setting can hold a release back. When a build or deploy fails in a way that doesn't point at your code, check versions **first**: update every `@keystrokehq/*` dep to latest, reinstall, and retry before debugging anything else.
+
 ```bash
 keystroke deploy            # lint + typecheck + build + ship dist/ — start here
 keystroke test              # optional local loop (unit + integration)
@@ -279,13 +283,14 @@ Invoke/inspect commands print JSON to stdout (exit 0 on success, 1 on failure)
 
 ## Common gotchas
 
-1. **Action calling an action** — throws at runtime and fails lint. Compose in a workflow, or attach the integration action directly.
-2. **Bad model id** — must be exact `vendor/model-id` from the catalog; don't kebab the version. Fails at deploy, not typecheck.
-3. **LLM structured output: use `.nullish()`, not `.optional()`** — models emit `"field": null` for "not applicable", and Zod `.optional()` rejects `null` (the step fails). Use `.nullish()` (or `.nullable()`) for any optional field in an `outputSchema`.
-4. **Structured output + tools is vendor-specific** — Anthropic Sonnet/Opus and OpenAI/Google/xAI are reliable; z-ai GLM uses a submit tool when tools are present; Alibaba Qwen is best-effort. See [structured output with tools](/learn/agents/build-agents#structured-output-with-tools).
-5. **Silent fallbacks hide real failures** — for live config (Sheets, DBs, credentials), don't `catch` and quietly substitute fallback/empty data in production paths; a run that "completes" with empty inputs looks like success in the trace but is a silent failure. Throw when required config is missing or empty, and validate response shape, not just status.
-6. **Side effects outside steps** — they re-run on every replay. Keep them inside `.run()` / `.prompt()`.
-7. **Schedule input** — a cron trigger passes `{}`; give the workflow `input: z.object({})`.
+1. **Stale `@keystrokehq/*` versions** — the first suspect for any build or deploy failure. Auto-update is skipped in CI and can be held back by minimum-release-age; ensure every `@keystrokehq/*` dep is on latest before debugging anything else (see [Dev tooling](#dev-tooling)).
+2. **Action calling an action** — throws at runtime and fails lint. Compose in a workflow, or attach the integration action directly.
+3. **Bad model id** — must be exact `vendor/model-id` from the catalog; don't kebab the version. Fails at deploy, not typecheck.
+4. **LLM structured output: use `.nullish()`, not `.optional()`** — models emit `"field": null` for "not applicable", and Zod `.optional()` rejects `null` (the step fails). Use `.nullish()` (or `.nullable()`) for any optional field in an `outputSchema`.
+5. **Structured output + tools is vendor-specific** — Anthropic Sonnet/Opus and OpenAI/Google/xAI are reliable; z-ai GLM uses a submit tool when tools are present; Alibaba Qwen is best-effort. See [structured output with tools](/learn/agents/build-agents#structured-output-with-tools).
+6. **Silent fallbacks hide real failures** — for live config (Sheets, DBs, credentials), don't `catch` and quietly substitute fallback/empty data in production paths; a run that "completes" with empty inputs looks like success in the trace but is a silent failure. Throw when required config is missing or empty, and validate response shape, not just status.
+7. **Side effects outside steps** — they re-run on every replay. Keep them inside `.run()` / `.prompt()`.
+8. **Schedule input** — a cron trigger passes `{}`; give the workflow `input: z.object({})`.
 
 ## Documentation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/cli",
-  "version": "0.1.59",
+  "version": "0.1.60",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/keystrokehq/keystroke.git",
@@ -42,8 +42,8 @@
     "tsx": "^4.22.3",
     "@keystrokehq/oxlint-config": "0.0.4",
     "@keystrokehq/tsconfig": "0.0.3",
-    "@keystrokehq/tsdown-config": "0.0.5",
-    "@keystrokehq/vitest-config": "0.0.7"
+    "@keystrokehq/vitest-config": "0.0.7",
+    "@keystrokehq/tsdown-config": "0.0.5"
   },
   "scripts": {
     "build": "tsdown && node scripts/copy-templates.mjs && node scripts/copy-skills-bundle.mjs && node scripts/copy-configs.mjs",