@rhize/skill-forge 0.16.0 → 0.17.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +17 -5
  2. package/dist/cli.js +1089 -350
  3. package/dist/cli.js.map +1 -1
  4. package/package.json +1 -1
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  **The supply-chain gate for agent skills.**
4
4
 
5
- Status: published — `@rhize/skill-forge@0.14.0` on npm (`0.16.0` in this repo, pending release),
5
+ Status: published — `@rhize/skill-forge@0.17.1` on npm (released 2026-09-05),
6
6
  0.x beta (Pro features free until 1.0)
7
7
 
8
8
  > This project is unrelated to the [`skillforge`](https://www.npmjs.com/package/skillforge)
@@ -56,6 +56,18 @@ To gate a skill without installing it (always cleans up afterward):
56
56
  npx @rhize/skill-forge scan <owner>/<skill-name>
57
57
  ```
58
58
 
59
+ ### Plugin-heavy setups (v0.17)
60
+
61
+ If most of your skills arrive through Claude Code plugins rather than `npx skills add`, the
62
+ install gate rarely fires — the audit is where the value is. `skill-forge audit --claude-plugins`
63
+ reads Claude Code's enabled-plugin registry, walks each plugin's manifest-declared skill dirs, and
64
+ reports every enabled plugin (safety findings, skill count, and — with `--usage-snapshot
65
+ <file|dir>` pointing at skill-monitor snapshots — an advisory `keep` / `review` / `unobserved` /
66
+ `unknown` recommendation). Plugin roots are never promotion targets, the safety scan surface
67
+ never shrinks, and nothing here changes an `add`/`scan` verdict. `init` asks once whether to
68
+ enable this; `routine` carries the same flags for cron. See
69
+ [docs/commands/audit.md](docs/commands/audit.md).
70
+
59
71
  `<source>` accepts a `skills.sh` `owner/name` slug, a git URL (`https://...`, `git@...`, or
60
72
  anything ending in `.git`), or a local filesystem path.
61
73
 
@@ -63,19 +75,19 @@ anything ending in `.git`), or a local filesystem path.
63
75
 
64
76
  | Command | Description | Docs |
65
77
  |---|---|---|
66
- | `init [options]` | Detect installed agents and set gate targets / handoff agent | [docs/commands/init.md](docs/commands/init.md) |
78
+ | `init [options]` | Detect installed agents, set gate targets / handoff agent, opt in to Claude plugin audits | [docs/commands/init.md](docs/commands/init.md) |
67
79
  | `add <source> [options]` | Quarantine-install a skill and run it through the gate | [docs/commands/add.md](docs/commands/add.md) |
68
80
  | `scan <source> [options]` | Gate a skill without installing it (always cleans up) | [docs/commands/scan.md](docs/commands/scan.md) |
69
81
  | `evolve <skill-dir> [options]` (Pro) | Self-evolve an installed skill via SkillOpt-Sleep, re-gate, decide | [docs/commands/evolve.md](docs/commands/evolve.md) |
70
- | `audit [options]` (alias `doctor`) | Doctor-style health check over the configured skill/MCP set | [docs/commands/audit.md](docs/commands/audit.md) |
82
+ | `audit [options]` (alias `doctor`) | Doctor-style health check over the configured skill/MCP set — and, with `--claude-plugins`, every enabled Claude Code plugin's skills, plus a usage join and per-plugin advisory summary | [docs/commands/audit.md](docs/commands/audit.md) |
71
83
  | `finding accept\|revoke\|list` | Acknowledge, revoke, or list reviewed audit findings (human-only, no gate effect) | [docs/commands/finding.md](docs/commands/finding.md) |
72
- | `organize [options]` (Pro) | Set-level capability registry + dependency graph across configured skills roots | [docs/commands/organize.md](docs/commands/organize.md) |
84
+ | `organize [options]` (Pro) | Set-level capability registry + dependency graph across configured skills roots (reads flat or nested `metadata.rhize` frontmatter) | [docs/commands/organize.md](docs/commands/organize.md) |
73
85
  | `find [query] [options]` | Discover skills via skills.sh and check partner security audits (free) | [docs/commands/find.md](docs/commands/find.md) |
74
86
  | `watch [options]` (Pro) | Drift check across every `SOURCES.md` provenance ledger | [docs/commands/watch.md](docs/commands/watch.md) |
75
87
  | `ingest [options]` / `queue close <id>` (Pro) | Hand the pending-ingestion queue off to a coding agent for the decide/absorb pass | [docs/commands/ingest.md](docs/commands/ingest.md) |
76
88
  | `refine [options]` (Pro) | Capture, list, review, promote, and roll back project-scope skill overrides | [docs/commands/refine.md](docs/commands/refine.md) |
77
89
  | `insight <subcommand>` (Pro) | Turn sources into evidence-backed capability plans and Jira manifests | [docs/commands/insight.md](docs/commands/insight.md) |
78
- | `routine [options]` (Pro) | One scheduled maintenance pass: audit + drift + registry, cron-friendly | [docs/commands/routine.md](docs/commands/routine.md) |
90
+ | `routine [options]` (Pro) | One scheduled maintenance pass: audit (plugins + usage aware) + drift + registry, cron-friendly | [docs/commands/routine.md](docs/commands/routine.md) |
79
91
  | `promote <id>` / `reject <id>` [options] | Re-gate and finish a held quarantine decision, or discard it | [docs/commands/promote-reject.md](docs/commands/promote-reject.md) |
80
92
  | `config <sub> [args]` | Read/write open-ended preferences (`list`\|`get`\|`set`\|`unset`\|`propose`\|`review`) | [docs/commands/config.md](docs/commands/config.md) |
81
93
  | `list` / `status` | List held quarantine entries, or show configuration and quarantine summary | [docs/commands/list-status.md](docs/commands/list-status.md) |