@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/skills/bundled/git-commit.skill.md

@@ -0,0 +1,66 @@
+---
+name: git-commit
+description: Create a git commit with a well-formatted message
+version: 1.0.0
+author: Code Buddy
+tags:
+  - git
+  - commit
+  - vcs
+requires:
+  tools:
+    - bash
+nativeEngine:
+  category: development
+  priority: 85
+  triggers:
+    - commit
+    - git commit
+    - create commit
+    - save changes
+  examples:
+    - "Commit my changes"
+    - "Create a commit with message 'fix bug'"
+---
+
+# Git Commit
+
+Create a git commit following conventional commit format.
+
+## When to Use
+
+- User wants to commit their changes
+- User asks to save changes to git
+- User wants to create a commit with a message
+
+## Examples
+
+- Commit my changes
+  > Creates a commit with auto-generated message based on changes
+- Create a commit with message "fix login bug"
+  > Creates a commit with the specified message
+
+## Steps
+
+1. Run `git status` to see changed files
+2. Run `git diff --staged` to see what will be committed
+3. If no files staged, suggest running `git add`
+4. Generate or use provided commit message in conventional format
+5. Run `git commit -m "message"`
+6. Show confirmation with commit hash
+
+## Tools
+
+- `bash(git status)`: Check repository status
+- `bash(git diff --staged)`: View staged changes
+- `bash(git commit -m "message")`: Create the commit
+
+## Commit Message Format
+
+Use conventional commits format:
+- `feat:` New feature
+- `fix:` Bug fix
+- `docs:` Documentation
+- `refactor:` Code refactoring
+- `test:` Adding tests
+- `chore:` Maintenance

package/dist/skills/bundled/pubcommander-control/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: pubcommander-control
+description: Pilot PubCommander editorial and social campaigns through its MCP tools. Use for listing, drafting, revising, submitting, scheduling, or publishing posts while preserving human approval and dry-run safety.
+---
+
+# PubCommander Control
+
+Use the PubCommander MCP server as the system of record for social posts. Keep creation reversible and require an explicit human decision before any external publication.
+
+## Safe workflow
+
+1. Inspect existing work with `list_posts`, then use `get_post` before changing a specific post.
+2. Create with `create_draft_post` or revise an eligible post with `update_draft_post`.
+3. Show the final content, platform variants, hashtags, and targets to the user.
+4. Call `submit_post_for_approval`; do not interpret submission as approval.
+5. After PubCommander reports the post as `approved`, validate scheduling or publication with `dryRun: true`.
+6. Call `schedule_post` or `publish_post` with `dryRun: false` only after the user explicitly confirms that exact action and targets.
+7. Report the returned status and proof. Never claim publication succeeded without a successful tool result.
+
+## Guardrails
+
+- Never invent a `postId`; obtain it from PubCommander.
+- Never pass or request a user identity through tool arguments. The MCP server binds operations to its configured service user.
+- Treat `schedule_post` and `publish_post` as external side effects even if content was already approved.
+- Approval is state held by PubCommander, not a phrase inferred from conversation.
+- If a live action fails, preserve the draft and report the platform-level error; do not retry repeatedly without diagnosis.
+- Prefer platform-specific variants when the audience or format differs. Keep the shared draft as the canonical intent.
+
+## Common requests
+
+- “Prépare trois variantes LinkedIn et Instagram” → create or update a draft, then present it for review.
+- “Envoie-le en validation” → call `submit_post_for_approval`; stop before scheduling or publishing.
+- “Publie maintenant” → inspect status, run a dry run, request explicit confirmation if not already given for this exact live action, then publish and return the proof.

package/dist/skills/bundled/pubcommander-control/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "PubCommander Control"
+  short_description: "Piloter PubCommander avec validation humaine"
+  default_prompt: "Prépare et pilote cette campagne PubCommander avec validation avant toute publication."

package/dist/skills/bundled/typescript-expert.skill.md

@@ -0,0 +1,21 @@
+---
+name: typescript-expert
+description: Expert TypeScript developer for complex type issues
+version: 1.0.0
+tags: [typescript, types, generics, inference, type-error, tsc]
+tier: bundled
+requires:
+  tools: [view_file, search, str_replace_editor]
+---
+
+# TypeScript Expert
+
+You are a TypeScript expert. Focus on:
+
+1. Complex generic types and type inference
+2. Declaration file (.d.ts) issues
+3. Type guards and narrowing
+4. Conditional types and mapped types
+5. Module resolution and imports
+
+Provide precise type solutions with explanations.

package/dist/skills/bundled/weather.skill.md

@@ -0,0 +1,48 @@
+---
+name: weather
+description: Get current weather and forecasts using the weather tool (Open-Meteo, no API key)
+version: 1.0.0
+author: Code Buddy
+tags:
+  - weather
+  - meteo
+  - forecast
+requires:
+  tools:
+    - weather
+nativeEngine:
+  category: assistant
+  priority: 85
+  triggers:
+    - météo
+    - meteo
+    - quel temps
+    - weather
+    - forecast
+    - température demain
+    - il va pleuvoir
+  examples:
+    - "Quelle est la météo à Paris demain"
+    - "What's the weather in Berlin this week"
+---
+
+# Weather
+
+Use this skill when the user asks about the weather, the forecast, or the
+temperature somewhere.
+
+## How to answer
+
+- ALWAYS call the `weather` tool — never `web_search` — for weather questions.
+  It returns real Open-Meteo data (no API key) plus a ready French summary.
+- Pass the city exactly as the user said it; the tool echoes the resolved
+  "name, country" — mention it if the name was ambiguous (e.g. several
+  cities share it).
+- Ask for `days: 2..7` only when the user asks about tomorrow or the week.
+- Answer in French by default.
+
+## Voice replies
+
+When answering ALOUD (the companion/voice path), keep it to **1–2 spoken
+sentences**: current temperature + sky, add tomorrow only if asked. Skip
+humidity and wind unless the user explicitly requested them.

package/dist/skills/bundled/web-app-testing.skill.md

@@ -0,0 +1,71 @@
+---
+name: web-app-testing
+description: Test a web app you built or changed — launch its dev server, browse it, verify with evidence (web_test), fix, re-run
+version: 1.0.0
+author: Code Buddy
+tags:
+  - testing
+  - web
+  - browser
+requires:
+  tools:
+    - app_server
+    - web_test
+    - browser
+nativeEngine:
+  category: development
+  priority: 85
+  triggers:
+    - test the app
+    - teste l'application
+    - tester l'appli
+    - vérifie que ça marche
+    - check it works
+    - dev server
+    - web app testing
+    - test ui
+  examples:
+    - "Build the login page and test that it works"
+    - "Ajoute le formulaire et vérifie que ça marche dans le navigateur"
+---
+
+# Web App Testing
+
+Use this skill whenever you have built or changed a web UI and need to prove
+it actually works — never claim a UI works without having loaded it in the
+browser.
+
+This loop also tests **Code Buddy itself**: after changing server or UI code
+in this repo, self-test with `app_server` start `npx tsx src/index.ts server
+--port <free>` (readiness url `/api/health`) then `web_test` asserting
+`"status":"ok"` — and that protected pages (e.g. the dashboard) still answer
+UNAUTHORIZED without a token.
+
+## The loop (develop → launch → browse → verify)
+
+1. **Launch the server**: `app_server` action `start` with the dev command
+   (e.g. `npm run dev`) and its loopback URL (e.g. `http://127.0.0.1:5173/`).
+   The URL becomes browsable only while this server runs. If the port is
+   already in use, pick another (configure the dev server) — the tool refuses
+   to adopt pre-existing services.
+2. **Test with evidence**: `web_test` with the URL and assertions for what
+   the page MUST show (`text`, `selector`, `title`). The report contains the
+   console/page errors (client face), the server logs (server face), an
+   interactive-element snapshot, and a screenshot path.
+3. **Read a FAILED report, don't retry blindly**: the console error and the
+   server log usually point at the same bug from two sides. Fix the code,
+   then re-run `web_test` with the SAME assertions until it passes.
+4. **Interact when needed**: for flows (forms, navigation), use the `browser`
+   tool — `snapshot` gives numbered refs, then `click`/`type`/`fill` by ref.
+   Prefer refs over pixel coordinates.
+5. **Tear down**: `app_server` action `stop` when testing is done.
+
+## Rules
+
+- Show the evidence (report lines, screenshot path) instead of asserting
+  success.
+- Server-side errors live in `app_server` action `logs`; client-side errors
+  in `browser_console` — `web_test` aggregates both.
+- Only loopback dev servers started by `app_server` (or origins the user
+  declared in `CODEBUDDY_BROWSER_DEV_ORIGINS`) are browsable; everything
+  else on localhost stays blocked by design.

package/dist/skills/bundled/web-search.skill.md

@@ -0,0 +1,56 @@
+---
+name: web-search
+description: Search the web for information and return relevant results
+version: 1.0.0
+author: Code Buddy
+tags:
+  - search
+  - web
+  - research
+requires:
+  tools:
+    - web_search
+nativeEngine:
+  category: research
+  priority: 80
+  triggers:
+    - search for
+    - look up
+    - find information about
+    - google
+    - search the web
+  examples:
+    - "Search for TypeScript best practices"
+    - "Look up the latest React news"
+---
+
+# Web Search
+
+Use this skill when the user wants to search the web for information.
+
+## When to Use
+
+- User asks to search for something
+- User wants to find information about a topic
+- User asks "what is X" for current events or recent topics
+- User wants to look something up online
+
+## Examples
+
+- Search for TypeScript best practices
+  > Returns top results about TypeScript best practices with links
+- Find information about the latest AI developments
+  > Returns recent news and articles about AI
+- Look up how to configure ESLint
+  > Returns documentation and tutorials for ESLint configuration
+
+## Steps
+
+1. Parse the user's query to extract the search terms
+2. Use `web_search` tool to search the web
+3. Format the results with titles, snippets, and URLs
+4. Summarize the key findings
+
+## Tools
+
+- `web_search`: Search the web and return results

package/dist/skills/hub.js

@@ -14,6 +14,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as yaml from 'yaml';
 import { logger } from '../utils/logger.js';
+import { readJsonAtomicSync, writeFileAtomicSync, writeJsonAtomicSync } from '../utils/atomic-write.js';
 import { generateDiff } from '../utils/diff-generator.js';
 import { parseSkillFile, validateSkill } from './parser.js';
 import { generateSkillSigningKeyPair, signSkillContent, resolveSignatureVerification, resolveRegistryIndexSignatureVerification, validateEd25519PublicKey, meetsTrust, isSkillKeyTrust, } from './hub-signing.js';
@@ -141,8 +142,9 @@ export class SkillsHub extends EventEmitter {
     readLockfile() {
         try {
             if (fs.existsSync(this.config.lockfilePath)) {
-                const raw = fs.readFileSync(this.config.lockfilePath, 'utf-8');
-                const parsed = JSON.parse(raw);
+                const parsed = readJsonAtomicSync(this.config.lockfilePath, null);
+                if (!parsed)
+                    throw new Error('lockfile unavailable');
                 if (parsed.version === LOCKFILE_VERSION && parsed.skills) {
                     return parsed;
                 }
@@ -165,8 +167,7 @@ export class SkillsHub extends EventEmitter {
      */
     writeLockfile() {
         this.lockfile.updatedAt = new Date().toISOString();
-        const content = JSON.stringify(this.lockfile, null, 2);
-        fs.writeFileSync(this.config.lockfilePath, content, 'utf-8');
+        writeJsonAtomicSync(this.config.lockfilePath, this.lockfile);
         logger.debug('Hub lockfile written', { path: this.config.lockfilePath });
     }
     /**
@@ -369,8 +370,9 @@ export class SkillsHub extends EventEmitter {
     readTapsFile() {
         try {
             if (fs.existsSync(this.config.tapsPath)) {
-                const raw = fs.readFileSync(this.config.tapsPath, 'utf-8');
-                const parsed = JSON.parse(raw);
+                const parsed = readJsonAtomicSync(this.config.tapsPath, null);
+                if (!parsed)
+                    throw new Error('taps file unavailable');
                 if (parsed.version === TAPS_FILE_VERSION
                     && Array.isArray(parsed.taps)) {
                     const taps = parsed.taps
@@ -399,7 +401,7 @@ export class SkillsHub extends EventEmitter {
     writeTapsFile(tapsFile) {
         tapsFile.updatedAt = new Date().toISOString();
         tapsFile.taps.sort((left, right) => left.repo.localeCompare(right.repo));
-        fs.writeFileSync(this.config.tapsPath, JSON.stringify(tapsFile, null, 2), 'utf-8');
+        writeJsonAtomicSync(this.config.tapsPath, tapsFile);
         logger.debug('Hub taps file written', { path: this.config.tapsPath });
     }
     normalizeTapRecord(tap) {
@@ -549,7 +551,7 @@ export class SkillsHub extends EventEmitter {
             version ? path.join(this.config.cacheDir, `${skillName}@${version}.skill.md`) : null,
         ].filter((target) => Boolean(target));
         for (const target of targets) {
-            fs.writeFileSync(target, content, 'utf-8');
+            writeFileAtomicSync(target, content);
         }
     }
     encodeGitHubContentPath(filePath) {
@@ -578,8 +580,9 @@ export class SkillsHub extends EventEmitter {
             if (!fs.existsSync(cacheFile)) {
                 return [];
             }
-            const raw = fs.readFileSync(cacheFile, 'utf-8');
-            const parsed = JSON.parse(raw);
+            const parsed = readJsonAtomicSync(cacheFile, null);
+            if (!parsed)
+                return [];
             return Array.isArray(parsed.skills) ? parsed.skills : [];
         }
         catch {
@@ -589,7 +592,7 @@ export class SkillsHub extends EventEmitter {
     writeTapCache(skills, cachedAt) {
         const cacheFile = this.getTapCacheFile();
         fs.mkdirSync(path.dirname(cacheFile), { recursive: true });
-        fs.writeFileSync(cacheFile, JSON.stringify({ cachedAt, skills }, null, 2), 'utf-8');
+        writeJsonAtomicSync(cacheFile, { cachedAt, skills });
     }
     mergeTapCache(skills, cachedAt) {
         const merged = new Map();
@@ -860,6 +863,13 @@ export class SkillsHub extends EventEmitter {
         return requested && requested.length > 0 ? requested : derived;
     }
     enforceSignaturePolicy(skillName, verification) {
+        // A supplied signature is an explicit trust claim. Never downgrade a bad
+        // or unknown signer to the same posture as an intentionally unsigned local
+        // skill, even when signed installs are optional.
+        if (verification.status === 'invalid' || verification.status === 'untrusted') {
+            throw new Error(`Refusing to install '${skillName}': signature is '${verification.status}'`
+                + (verification.reason ? ` (${verification.reason})` : ''));
+        }
         if (!this.config.requireSignedInstalls) {
             return;
         }
@@ -876,8 +886,9 @@ export class SkillsHub extends EventEmitter {
     readTrustedKeysFile() {
         try {
             if (fs.existsSync(this.config.trustedKeysPath)) {
-                const raw = fs.readFileSync(this.config.trustedKeysPath, 'utf-8');
-                const parsed = JSON.parse(raw);
+                const parsed = readJsonAtomicSync(this.config.trustedKeysPath, null);
+                if (!parsed)
+                    throw new Error('trusted keys file unavailable');
                 if (parsed.version === TRUSTED_KEYS_FILE_VERSION && Array.isArray(parsed.keys)) {
                     const keys = parsed.keys
                         .map((key) => this.normalizeTrustedKeyRecord(key))
@@ -906,7 +917,7 @@ export class SkillsHub extends EventEmitter {
         keysFile.keys = keysFile.keys.filter((key) => !this.isOfficialSkillPublisherKey(key.keyId));
         keysFile.updatedAt = new Date().toISOString();
         keysFile.keys.sort((left, right) => left.keyId.localeCompare(right.keyId));
-        fs.writeFileSync(this.config.trustedKeysPath, JSON.stringify(keysFile, null, 2), 'utf-8');
+        writeJsonAtomicSync(this.config.trustedKeysPath, keysFile);
         logger.debug('Hub trusted keys file written', { path: this.config.trustedKeysPath });
     }
     withOfficialTrustedKeys(keys) {
@@ -1058,8 +1069,9 @@ export class SkillsHub extends EventEmitter {
         const cacheFile = path.join(this.config.cacheDir, 'registry-cache.json');
         try {
             if (fs.existsSync(cacheFile)) {
-                const raw = fs.readFileSync(cacheFile, 'utf-8');
-                const data = JSON.parse(raw);
+                const data = readJsonAtomicSync(cacheFile, null);
+                if (!data)
+                    return [];
                 return data.skills || [];
             }
         }
@@ -1074,7 +1086,7 @@ export class SkillsHub extends EventEmitter {
     writeLocalCache(skills) {
         const cacheFile = path.join(this.config.cacheDir, 'registry-cache.json');
         try {
-            fs.writeFileSync(cacheFile, JSON.stringify({ skills, cachedAt: new Date().toISOString() }), 'utf-8');
+            writeJsonAtomicSync(cacheFile, { skills, cachedAt: new Date().toISOString() });
         }
         catch {
             logger.debug('Failed to write local cache');
@@ -1122,7 +1134,7 @@ export class SkillsHub extends EventEmitter {
             fs.mkdirSync(skillDir, { recursive: true });
         }
         const skillPath = path.join(skillDir, 'SKILL.md');
-        fs.writeFileSync(skillPath, content, 'utf-8');
+        writeFileAtomicSync(skillPath, content);
         // Update lockfile
         const installed = {
             name: skillName,
@@ -1190,7 +1202,7 @@ export class SkillsHub extends EventEmitter {
             fs.mkdirSync(skillDir, { recursive: true });
         }
         const skillPath = path.join(skillDir, 'SKILL.md');
-        fs.writeFileSync(skillPath, content, 'utf-8');
+        writeFileAtomicSync(skillPath, content);
         const installed = {
             name: skillName,
             version,
@@ -1258,10 +1270,20 @@ export class SkillsHub extends EventEmitter {
             return false;
         }
         logger.info('Uninstalling skill', { name: skillName });
-        // Remove skill directory
-        const skillDir = path.join(this.config.skillsDir, skillName);
-        if (fs.existsSync(skillDir)) {
-            fs.rmSync(skillDir, { recursive: true, force: true });
+        // Release registry handles before Windows removal, and wait for the
+        // operating system to hand the directory back: closing a watcher only
+        // starts that release. Transient external locks (for example antivirus
+        // scans) are then retried by Node's asynchronous rm.
+        const { awaitSkillRegistryWatchersClosed, pauseSkillRegistryWatching } = await import('./registry.js');
+        const resumeWatching = pauseSkillRegistryWatching();
+        try {
+            await awaitSkillRegistryWatchersClosed();
+            await fs.promises.rm(path.dirname(installed.path), {
+                recursive: true, force: true, maxRetries: 10, retryDelay: 100,
+            });
+        }
+        finally {
+            resumeWatching();
         }
         // Remove from lockfile
         delete this.lockfile.skills[skillName];
@@ -1449,7 +1471,7 @@ export class SkillsHub extends EventEmitter {
             updatedAt: options.updatedAt,
         });
         const fromVersion = installed.version;
-        fs.writeFileSync(installed.path, content, 'utf-8');
+        writeFileAtomicSync(installed.path, content);
         installed.version = resolvedVersion;
         installed.checksum = computeChecksum(content);
         installed.lifecycle = {
@@ -1495,7 +1517,7 @@ export class SkillsHub extends EventEmitter {
             : undefined;
         const fromVersion = installed.version;
         fs.mkdirSync(path.dirname(installed.path), { recursive: true });
-        fs.writeFileSync(installed.path, content, 'utf-8');
+        writeFileAtomicSync(installed.path, content);
         installed.version = resolvedVersion;
         installed.checksum = toChecksum;
         installed.lifecycle = {
@@ -1733,7 +1755,7 @@ export class SkillsHub extends EventEmitter {
             reason: options.reason,
             updatedAt: options.updatedAt,
         });
-        fs.writeFileSync(installed.path, content, 'utf-8');
+        writeFileAtomicSync(installed.path, content);
         installed.checksum = computeChecksum(content);
         installed.version = this.extractVersionFromContent(content) || installed.version;
         installed.lifecycle = {
@@ -1794,7 +1816,7 @@ export class SkillsHub extends EventEmitter {
             reason: options.reason,
             updatedAt: options.updatedAt,
         });
-        fs.writeFileSync(targetPath, updatedContent, 'utf-8');
+        writeFileAtomicSync(targetPath, updatedContent);
         if (targetIsSkillMd) {
             installed.checksum = computeChecksum(updatedContent);
             installed.version = this.extractVersionFromContent(updatedContent) || installed.version;
@@ -1833,7 +1855,7 @@ export class SkillsHub extends EventEmitter {
             updatedAt: options.updatedAt,
         });
         fs.mkdirSync(path.dirname(targetPath), { recursive: true });
-        fs.writeFileSync(targetPath, fileContent, 'utf-8');
+        writeFileAtomicSync(targetPath, fileContent);
         installed.lifecycle = {
             status: installed.enabled === false ? 'disabled' : 'active',
             updatedAt: options.updatedAt ?? Date.now(),
@@ -1927,7 +1949,7 @@ export class SkillsHub extends EventEmitter {
                 : `before rollback to ${restoredSnapshot.id}`,
             updatedAt: options.updatedAt,
         });
-        fs.writeFileSync(installed.path, restoredContent, 'utf-8');
+        writeFileAtomicSync(installed.path, restoredContent);
         installed.checksum = computeChecksum(restoredContent);
         installed.version = this.extractVersionFromContent(restoredContent) || restoredSnapshot.version;
         installed.lifecycle = {
@@ -2044,7 +2066,7 @@ export class SkillsHub extends EventEmitter {
         const snapshotDir = path.join(this.config.cacheDir, 'history', installed.name.replace(/[^a-zA-Z0-9_-]/g, '_'));
         const snapshotPath = path.join(snapshotDir, `${id}.SKILL.md`);
         fs.mkdirSync(snapshotDir, { recursive: true });
-        fs.writeFileSync(snapshotPath, content, 'utf-8');
+        writeFileAtomicSync(snapshotPath, content);
         return {
             id,
             createdAt,

package/dist/skills/index.d.ts

@@ -26,9 +26,12 @@ export type { LegacySkill as LegacySkillShape, LegacySkillScript as LegacySkillS
 /**
  * Get the path to bundled SKILL.md skills.
  *
- * Strategy: walk up from the entry script (process.argv[1]) or cwd
- * to find .codebuddy/skills/bundled. This avoids __dirname (unavailable
- * in ESM) and import.meta.url (breaks ts-jest).
+ * Resolution order: explicit env override → walk-up to a user-populated
+ * `.codebuddy/skills/bundled` → the skills SHIPPED WITH THE PACKAGE, resolved
+ * relative to this module (`src/skills/bundled/` in dev, `dist/skills/bundled/`
+ * in a build — copied there by scripts/copy-bundled-skills.mjs). Before the
+ * module-relative candidate existed, a normal checkout resolved to a
+ * non-existent path and the bundled tier silently never loaded.
  */
 export declare function getBundledSkillsPath(): string;
 import type { Skill as SkillMdType, SkillExecutionContext, SkillExecutionResult, SkillMatch as SkillMdMatchType, UnifiedSkill } from './types.js';

package/dist/skills/index.js

@@ -25,18 +25,22 @@ export { legacyToUnified, legacyLoadedToUnified, unifiedToLegacy, skillMdToUnifi
 // ============================================================================
 import * as path from 'path';
 import * as fs from 'fs';
+import { fileURLToPath } from 'url';
 /**
  * Get the path to bundled SKILL.md skills.
  *
- * Strategy: walk up from the entry script (process.argv[1]) or cwd
- * to find .codebuddy/skills/bundled. This avoids __dirname (unavailable
- * in ESM) and import.meta.url (breaks ts-jest).
+ * Resolution order: explicit env override → walk-up to a user-populated
+ * `.codebuddy/skills/bundled` → the skills SHIPPED WITH THE PACKAGE, resolved
+ * relative to this module (`src/skills/bundled/` in dev, `dist/skills/bundled/`
+ * in a build — copied there by scripts/copy-bundled-skills.mjs). Before the
+ * module-relative candidate existed, a normal checkout resolved to a
+ * non-existent path and the bundled tier silently never loaded.
  */
 export function getBundledSkillsPath() {
     // Explicit override — a host (e.g. the Cowork desktop app) can point the
     // bundled-skills tier at its own resolved skills directory so the embedded
     // engine surfaces the same skills the host ships. Unset for the CLI, which
-    // falls back to the .codebuddy/skills/bundled walk below.
+    // falls back to the candidates below.
     const envDir = process.env.CODEBUDDY_BUNDLED_SKILLS_DIR;
     if (envDir && fs.existsSync(envDir)) {
         return envDir;
@@ -54,6 +58,17 @@ export function getBundledSkillsPath() {
             break;
         dir = parent;
     }
+    // Skills shipped with the package, next to this module. (The old
+    // "import.meta.url breaks ts-jest" concern is obsolete — the test runner is
+    // vitest/ESM and src/index.ts uses import.meta.url; see model-registry.ts.)
+    try {
+        const shipped = path.join(path.dirname(fileURLToPath(import.meta.url)), 'bundled');
+        if (fs.existsSync(shipped))
+            return shipped;
+    }
+    catch (_error) {
+        // Exotic host without import.meta.url support — fall through.
+    }
     // Fallback to cwd
     return path.join(process.cwd(), '.codebuddy', 'skills', 'bundled');
 }

package/dist/skills/parser.js

@@ -95,6 +95,8 @@ function parseMetadata(yamlContent, sourcePath) {
             pinned: parsed.pinned === true,
             imported: parsed.imported === true,
             source: parsed.source,
+            exchange: parsed.exchange === true,
+            installedAt: parsed.installedAt,
         };
     }
     catch (error) {