@rhize/skill-forge 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -0
- package/dist/cli.js +259 -175
- package/dist/cli.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -270,6 +270,14 @@ map — it never touches a skills root:
|
|
|
270
270
|
- **Missing target file/parent dirs:** created.
|
|
271
271
|
- A candidate config listing more than one server gates/promotes the first (same "N found — using
|
|
272
272
|
the first" convention `add`/`scan` already use for a multi-skill source), noted on stderr.
|
|
273
|
+
- **Version pinning is enforced, including on a candidate's own documented entry (v0.7).** A
|
|
274
|
+
candidate's `.mcp.json` server entry is used for `command`/`args` when present, but an unpinned
|
|
275
|
+
`npx` spec there (`"args": ["-y", "pkg@latest"]`) is no longer written through as-is: it's
|
|
276
|
+
**auto-pinned** to `<package>@<version>` when it matches the version skill-forge scanned from the
|
|
277
|
+
candidate's own (self-declared) `package.json`, or **promotion is refused** (with an explanation
|
|
278
|
+
and no override flag) when it can't be safely auto-pinned — a different package name, no version
|
|
279
|
+
found, or a more complex shape (e.g. a `-p`/`--package` dependency, or more than one spec).
|
|
280
|
+
See [docs/gate-policy.md](docs/gate-policy.md#mcp-promote-version-pin-enforcement-v07).
|
|
273
281
|
|
|
274
282
|
There's no MCP equivalent of the skill provenance ledger (`SOURCES.md`) — the pending-ingestion
|
|
275
283
|
queue (Pro) and `--ingest` handoff both apply the same way, keyed on the written config file path
|