@papi-ai/skills 0.1.0 → 0.1.2

package/lib/manifest.mjs

@@ -49,6 +49,47 @@ function walk(root, dir, out) {
   }
 }
 
+/**
+ * task-2163: owner-only skills that must NEVER ship in the public @papi-ai/skills
+ * pack — they expose internal owner workflow or commercial detail. This is the
+ * distribution security control expressed as a RULE, not hand-curation: the
+ * manifest build asserts none of these are present in skills/ and fails CLOSED
+ * if one ever leaks. Superset of the handoff strip-list (caveman, stream-mode,
+ * owner-actions, crm, burn, build-in-public) plus the owner/commercial and
+ * host-loop skills that are out of scope for the shared pack.
+ */
+export const OWNER_ONLY_SKILLS = new Set([
+  'caveman',
+  'stream-mode',
+  'owner-actions',
+  'crm',
+  'burn',
+  'burn-dashboard',
+  'build-in-public',
+  'broadcast-compose',
+  'cold-outbound',
+  'winback',
+  'papi-auto', // host-loop (papi-auto-class), out of scope for the pack
+]);
+
+/**
+ * Assert no owner-only skill is present in the given skill-name list. Throws a
+ * descriptive error naming the offenders so the pack build fails CLOSED rather
+ * than silently shipping internal workflow. Pure — callers pass the scanned
+ * names, so it is trivially testable and reusable by any future packer.
+ */
+export function assertNoOwnerOnlySkills(names) {
+  const leaked = names.filter((n) => OWNER_ONLY_SKILLS.has(n));
+  if (leaked.length > 0) {
+    throw new Error(
+      `@papi-ai/skills refusing to build: owner-only skill(s) present in the public pack — ${leaked.join(', ')}. ` +
+      `These expose internal owner/commercial workflow and must never ship. Remove them from packages/skills/skills/ ` +
+      `(they belong in .claude/skills/ only); if one is genuinely generalizable, remove it from OWNER_ONLY_SKILLS in ` +
+      `lib/manifest.mjs with justification.`,
+    );
+  }
+}
+
 /** Load and parse the package manifest. Throws if missing/malformed. */
 export function loadManifest(packageRoot = PACKAGE_ROOT) {
   const raw = readFileSync(join(packageRoot, 'manifest.json'), 'utf8');

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.0",
-  "generatedAt": "2026-05-25T12:07:27.744Z",
+  "packageVersion": "0.1.2",
+  "generatedAt": "2026-08-01T18:51:37.168Z",
   "skills": [
     {
       "name": "check-mcp",
@@ -28,6 +28,11 @@
       "kind": "lazy",
       "checksum": "ae5da6393e14fcd5"
     },
+    {
+      "name": "papi-install",
+      "kind": "eager",
+      "checksum": "2b8a7ae5832fcad0"
+    },
     {
       "name": "papi-plan",
       "kind": "lazy",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/skills",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "PAPI's shareable Claude Code skill bundle — single source of truth, installed (not copied) into projects with pinned versioning",
   "license": "Elastic-2.0",
   "type": "module",
@@ -35,7 +35,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/cathalos92/papi-ui.git",
+    "url": "https://github.com/getpapi/papi.git",
     "directory": "packages/skills"
   },
   "engines": {

package/skills/papi-install/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: papi-install
+description: Connect PAPI (Persistent Adaptive Project Intelligence) to this project — one command, no config editing. Use when the user says "install papi", "set up papi", "connect papi", "add papi", or asks how to get structured plan/build/review cycles for their project. Also use when PAPI tools are expected but no papi MCP server is configured.
+---
+
+# Install PAPI
+
+PAPI gives your AI coding sessions structured plan → build → review cycles
+with memory that compounds across sessions. Installing means connecting the
+PAPI MCP server — one command, no JSON editing.
+
+> Source of truth for the connection commands: `lib/install-snippets.ts` in
+> the PAPI repo (remoteClaudeCodeOAuthCommand / setup CLI). This skill embeds
+> those canonical commands verbatim — a CI test pins them; if they drift the
+> test fails. Do not improvise different URLs or flags.
+
+## Step 1: Check for an existing connection
+
+Look for a `papi` entry in `.mcp.json` (project root) or in the user's MCP
+client config. If one exists, don't reinstall — run the `orient` tool and
+report which cycle the project is on.
+
+## Step 2: Connect (pick ONE path)
+
+### Path A — remote connector (recommended, works from any directory)
+
+Run:
+
+```bash
+claude mcp add --transport http papi https://mcp.getpapi.ai/mcp
+```
+
+Claude Code opens a browser tab so the user signs in (GitHub or email) and the
+token is stored automatically. No keys to paste.
+
+### Path B — local server via device auth (when the user prefers stdio)
+
+Run in the project folder:
+
+```bash
+npx @papi-ai/server setup
+```
+
+This is an RFC 8628 device-auth flow: it opens the browser for a one-click
+approval, then mints the project and writes `.mcp.json` itself. Restart the
+MCP client afterwards so it picks up the new server.
+
+Never hand-edit tokens into files, never echo tokens into the chat, and never
+configure a direct database connection for an external user — external users
+go through the hosted proxy (Path A) or the device-auth flow (Path B) only.
+
+## Step 3: Verify
+
+After connecting (restart the session if the tools don't appear):
+
+1. Call the `setup` tool if this project has never used PAPI — it scaffolds
+   the project brief and first backlog.
+2. Call `orient` — it should return the project's cycle state.
+
+If `orient` answers, the install worked. Tell the user which cycle they're on
+and that `plan` creates their first cycle.
+
+## Troubleshooting
+
+- Tools missing after install → restart the MCP client (config is read at startup).
+- `401`/auth errors → re-run the Step 2 command; the token may not have been stored.
+- Anything else → run `npx @papi-ai/server doctor` for a read-only diagnostic.