@outsidestudio/agent-kit 0.2.3 → 0.3.0

package/README.md

@@ -14,6 +14,8 @@ bunx @outsidestudio/agent-kit add product-backend web-frontend
 
 Installs **stack**: every run is additive, so installing one profile never removes another profile's entries — run them in any order, as often as you like. `agent-kit remove <target>` takes something out again.
 
+**Auto-update.** bunx caches its copy of the kit. From **0.2.3** a cached copy checks npm's `latest` on startup and transparently reruns the new version with your arguments, so bare commands stay current (`AGENT_KIT_NO_UPDATE_CHECK=1` to opt out). Copies older than 0.2.3 cannot self-update: run `bunx @outsidestudio/agent-kit@latest update` once; the bare form updates itself from then on.
+
 That command:
 
 1. Detects which tools are installed (`opencode`, `omp`). Use `--tool` to choose.
@@ -56,11 +58,11 @@ src/adapters/        one adapter per tool (opencode.ts, omp.ts)
 {
   "description": "Product backend developers",
   "extends": ["shared"],
-  "include": ["context-mode", "outside/product-backend-skills"]
+  "include": ["outside/product-backend-skills", "security-audit"]
 }
 ```
 
-`shared` is the base every department extends: the LLM provider, company skills, Superpowers, Context7 and Anthropic's document skills (docx, pdf, pptx, xlsx).
+`shared` is the base every department extends: the LLM provider, company skills, Superpowers, Context7, context-mode and Anthropic's document skills (docx, pdf, pptx, xlsx).
 
 ### Registry item kinds
 
@@ -92,16 +94,16 @@ src/adapters/        one adapter per tool (opencode.ts, omp.ts)
   "fallback": { "type": "git", "repo": "https://github.com/obra/superpowers.git", "path": "skills" } }
 ```
 
-**`provider`**: an OpenAI-compatible model endpoint (our vast.ai models). The provider id in each tool is the registry id with `/` replaced by `-`, so the model id `nvidia/Qwen2.8-Flash-Next-NVFP4` in `outside/llm` appears as `outside-llm/nvidia/Qwen2.8-Flash-Next-NVFP4`.
+**`provider`**: an OpenAI-compatible model endpoint (our vast.ai models). The provider id in each tool is the registry id with `/` replaced by `-`, so the model id `nvidia/Qwen3.8-Flash-Next-NVFP4` in `outside/llm` appears as `outside-llm/nvidia/Qwen3.8-Flash-Next-NVFP4`.
 
 ```json
 { "kind": "provider", "name": "Outside LLM",
   "baseURL": "${OUTSIDE_LLM_BASE_URL}", "apiKey": "${OUTSIDE_LLM_API_KEY}",
-  "models": { "nvidia/Qwen2.8-Flash-Next-NVFP4": {
-    "name": "Qwen2.8 Flash Next (NVFP4)", "contextWindow": 131072, "maxTokens": 32768,
+  "models": { "nvidia/Qwen3.8-Flash-Next-NVFP4": {
+    "name": "Qwen3.8 Flash Next (NVFP4)", "contextWindow": 131072, "maxTokens": 32768,
     "reasoning": true, "input": ["text", "image"],
     "thinking": { "mode": "effort", "efforts": ["low", "medium", "high"], "defaultLevel": "medium" } } },
-  "defaultModel": "nvidia/Qwen2.8-Flash-Next-NVFP4" }
+  "defaultModel": "nvidia/Qwen3.8-Flash-Next-NVFP4" }
 ```
 
 Model metadata is endpoint-specific — the same model id behind a different gateway has different limits — so each provider item carries the numbers for the server it points at. The kit maps `contextWindow`/`maxTokens` to OMP's `contextWindow`/`maxTokens` and OpenCode's `limit.context`/`limit.output`, `input` to OpenCode `modalities.input`, and passes `thinking` through to OMP.
@@ -121,27 +123,12 @@ Model metadata is endpoint-specific — the same model id behind a different gat
 
 **JSONC.** If `opencode.json` has comments, they are removed when the kit rewrites it (the backup keeps them).
 
+**Caveats.** OMP also reads other tools' configs (`opencode.json`, `.claude`, …): same-named MCP servers dedupe (OMP's own `mcp.json` wins), but a skill installed in several places may appear twice. OpenCode caches git plugins — if an update doesn't show up, clear OpenCode's plugin cache and restart it.
+
 ## Adding things
 
 - **Custom skill**: `agent-kit new skill product-backend/rate-limiting`, write the SKILL.md, open a PR. Everyone gets it on their next `update`.
 - **New department**: add `profiles/<dept>.json` and `skills/<dept>/` (`new skill <dept>/<name>` creates the registry entry for you).
 - **Third-party item**: add a `registry/<id>.json` (put your own under `registry/outside/`), then add the id to profiles.
 - **New tool** (Codex, Cursor…): write `src/adapters/<tool>.ts` implementing `Adapter` and list it in `src/adapters/index.ts`.
-
-## Publishing
-
-Pick one:
-
-- **Private npm registry** (GitHub Packages, Verdaccio): `npm publish`, then devs run `bunx @outsidestudio/agent-kit add <profile>`. Point the `@outsidestudio` scope at your registry in `~/.npmrc` or `bunfig.toml`.
-- **Straight from GitHub**, no registry: `bunx github:madebyoutside/agent-kit <profile>`.
-
-**Auto-update.** bunx reuses its cached copy of the kit; from **0.2.3** a cached copy checks npm's `latest` on startup and transparently reruns the new version with your arguments — bare commands stay current, no `@latest` needed. Set `AGENT_KIT_NO_UPDATE_CHECK=1` to opt out. Copies older than 0.2.3 cannot self-update: if a new command errors (e.g. `Unknown target "add"`), run `bunx @outsidestudio/agent-kit@latest update` once; from then on the bare form updates itself.
-
-## Things to verify for your setup
-
-- **Base URL.** Put a stable gateway (LiteLLM, Cloudflare Tunnel) in front of vast.ai so `OUTSIDE_LLM_BASE_URL` doesn't change when instances are recreated.
-- **Model list.** Replace `qwen3-coder` in `registry/outside/llm.json` with the model ids your server actually serves (`curl $OUTSIDE_LLM_BASE_URL/models`).
-- **Document skills.** Anthropic's docx/pdf/pptx/xlsx skills shell out to `python3` (and LibreOffice/pandoc for some conversions). `agent-kit doctor` warns when `python3` is missing; install the rest only if you use those flows.
-- **OMP plugins.** Superpowers has no `omp` entry yet, so OMP gets its skills via the fallback. Add `"omp": { "plugin": "..." }` if `omp plugin install` supports it.
-- **OpenCode plugin cache.** OpenCode caches git plugins. If an update doesn't show up, clear OpenCode's plugin cache and restart it.
-- **Duplicates in OMP.** OMP also reads other tools' configs (`opencode.json`, `.claude`, …). Same-named MCP servers dedupe (OMP's own `mcp.json` wins), but a skill installed in several places may appear twice.
+- **Release**: bump `version` in `package.json`, commit, `npm publish --access public`, push. `latest` propagates in ~1-2 min; machines on 0.2.3+ pick it up on their next bare `bunx` run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outsidestudio/agent-kit",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "One-command setup of skills, MCP servers and model providers for OpenCode and OMP",
   "type": "module",
   "bin": {

package/profiles/pm.json

@@ -1 +1,9 @@
-{"description":"Product managers","extends":["shared"],"include":["outside/pm-skills"]}
+{
+  "description": "Product managers",
+  "extends": [
+    "shared"
+  ],
+  "include": [
+    "outside/pm-skills"
+  ]
+}

package/profiles/product-backend.json

@@ -1 +1,10 @@
-{"description":"Product backend developers","extends":["shared"],"include":["context-mode","outside/product-backend-skills"]}
+{
+  "description": "Product backend developers",
+  "extends": [
+    "shared"
+  ],
+  "include": [
+    "outside/product-backend-skills",
+    "security-audit"
+  ]
+}

package/profiles/shared.json

@@ -1 +1,11 @@
-{"description":"Base setup every profile extends","include":["outside/llm","outside/shared-skills","superpowers","context7","anthropic/document-skills"]}
+{
+  "description": "Base setup every profile extends",
+  "include": [
+    "outside/llm",
+    "outside/shared-skills",
+    "superpowers",
+    "context7",
+    "context-mode",
+    "anthropic/document-skills"
+  ]
+}

package/profiles/web-frontend.json

@@ -1 +1,9 @@
-{"description":"Web / frontend developers","extends":["shared"],"include":["context-mode","outside/web-frontend-skills"]}
+{
+  "description": "Web / frontend developers",
+  "extends": [
+    "shared"
+  ],
+  "include": [
+    "outside/web-frontend-skills"
+  ]
+}

package/registry/security-audit.json

@@ -0,0 +1,7 @@
+{
+  "kind": "skills",
+  "description": "Cloudflare's security-audit skill: security guidance, focused reviews and full multi-agent codebase audits",
+  "source": { "type": "git", "repo": "https://github.com/cloudflare/security-audit-skill.git", "path": "skills" },
+  "only": ["security-audit"],
+  "requires": ["node"]
+}