@sassywares/skills 0.3.2 → 0.4.0

package/README.md

@@ -271,44 +271,39 @@ sassy-skills/
 
 ## Installation
 
-The suite ships as the npm package **`@sassywares/skills`**. Pin it, don't symlink it into a global directory — the version in your lockfile is the pin, and upgrading is one command.
-
-### As a project dependency (recommended for teams)
-
-```bash
-bun add --dev --exact @sassywares/skills@0.3.2
-```
-
-Nothing scans `node_modules` on its own, so link it where harnesses look — the package does that itself:
+The suite installs from this repository with the open `skills` CLI. That CLI vendors the skill files into your project and pins them, so a clone needs no network and every checkout runs the same skills.
 
 ```bash
-bunx sassy-skills sync
+npx skills add sassywares/sassy-skills
 ```
 
-That writes `.agents/skills/sassy-*` (read by pi and Cursor) and the `.claude/skills` link Claude Code needs. Add it as `"postinstall": "sassy-skills sync"` and teammates need nothing beyond `bun install`.
-
-Ignore both paths — they're derived from the lockfile, like any build output. `sassy-setup` does all of this for you, including the gitignore lines and the pinned version.
+That writes three things:
 
-### As a pi package
+- `.agents/skills/sassy-*` — the skill files themselves, read by pi and Cursor
+- `.claude/skills/sassy-*` — links for Claude Code, which reads only its own directory
+- `skills-lock.json` — source and content hash per skill
 
-pi resolves packages directly, so no links are needed:
+Commit the vendored skills and the lock; ignore `.claude/skills`, which is a link created at install time.
 
 ```bash
-pi install npm:@sassywares/skills@0.3.2            # user-level, all projects
-pi install npm:@sassywares/skills@0.3.2 --local     # project-level → commit .pi/settings.json
+npx skills update -y              # pull the latest from this repo
+npx skills experimental_install   # restore exactly what the lock pins
+npx skills remove                 # take the suite out again
 ```
 
+`sassy-setup` does all of this for you, including the ignore line and the two package scripts.
+
 ### While editing the suite
 
-Point a consumer at your checkout instead of a published version:
+`.pi/settings.json` in this repo declares `./skills`, so pi loads your working copy directly. Consumers see a change once it is pushed to `main` and they run `npx skills update` — no release step in between.
 
-```bash
-bun link @sassywares/skills
-```
+### Also published as a package
 
-Inside this repo, `.pi/settings.json` already declares `./skills`, so pi loads the working copy directly.
+`@sassywares/skills` is on npm for harnesses that install packages rather than skill directories:
 
-Get the skills however they arrive — package, link, or vendored copy — and invoke them with your harness's skill syntax.
+```bash
+pi install npm:@sassywares/skills@0.4.0
+```
 
 ## Repository maintenance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sassywares/skills",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Lean, explicit-invocation Agent Skills for shipping fast: plan, work, review, validate, ship.",
   "type": "module",
   "license": "MIT",
@@ -24,7 +24,6 @@
   ],
   "files": [
     "skills",
-    "bin",
     "README.md",
     "CONCEPTS.md",
     "LICENSE"
@@ -37,9 +36,6 @@
       "./skills"
     ]
   },
-  "bin": {
-    "sassy-skills": "./bin/sassy-skills.mjs"
-  },
   "engines": {
     "node": ">=18"
   }

package/skills/sassy-debug/SKILL.md

@@ -25,8 +25,6 @@ Trivial bugs whose cause is readable from the input may skip the scout, but stil
 
 **Search prior learnings first.** Resolve `.sassywares/config.yaml` (nearest, walking up) per the `sassy-setup` skill's `references/config.md`. For every existing path in `knowledge.read`, search the docs for the symptom's keywords, the module, and the failure type. A matching doc **seeds or confirms** a hypothesis — it never replaces the causal chain or the reproduction. Name the docs you consulted, and say plainly when none matched: no match is not evidence that nothing similar has happened.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 ## Phase 1 — Diagnose inline, with `scout` as a helper
 
 You own the diagnosis. The causal reasoning happens here, in the main context, because that is where the full picture lives and where the fix gate is presented.

package/skills/sassy-lfg/SKILL.md

@@ -16,8 +16,6 @@ disable-model-invocation: true
 
 **Config.** Resolve `.sassywares/config.yaml` (nearest, walking up) per the `sassy-setup` skill's `references/config.md`. Precedence: explicit token > session instruction > config > skill default. Plans live under `artifacts.plans`; `git.repo` decides how the close-out persists.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 ## Input
 
 Detect the shape from the argument:

package/skills/sassy-plan/SKILL.md

@@ -17,8 +17,6 @@ disable-model-invocation: true
 
 **Config.** Resolve `.sassywares/config.yaml` (nearest, walking up) per the `sassy-setup` skill's `references/config.md`. Precedence: explicit token > session instruction > config > skill default. Plans land in `artifacts.plans`.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 ## Phase A — Discuss (brainstorm)
 
 Have one focused discussion to turn the idea into something plannable.

package/skills/sassy-review/SKILL.md

@@ -13,8 +13,6 @@ disable-model-invocation: true
 
 **Outcome:** the scope reviewed with concrete findings; the approved fixes applied; everything left uncommitted.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 **Orchestrator only.** Never edit code yourself. The `reviewer` finds; the `worker` fixes.
 
 ## Review dimensions

package/skills/sassy-setup/SKILL.md

@@ -30,16 +30,14 @@ disable-model-invocation: true
    - **`pr.*`** — default `babysit: true`, `merge: false`, `delete_branch: false`. Say plainly that `merge: true` authorizes merging every babysat PR in this project without asking.
    - **Hooks** — offer, do not impose. Ask whether the project wants steps injected at `before_create`, `after_create`, `before_merge`, or `after_merge`, and write the skills they name. Leave them `[]` when they have nothing to add. **Never write a hook skill yourself** — hooks are project skills, and copying one of ours into that role is the fork this mechanism exists to prevent.
 4. **Write the config.** Build the file from the proposal plus the answers. It is written **fully commented**: every key keeps a description and its allowed values, exactly as the detector emits them. Never strip those comments to save lines — for a teammate opening the file, the comments are the documentation. If a config already exists, show what changes and ask before writing — never silently overwrite. Keep every key; an unset key falls back to its documented default, so a short file is legal when nothing deviates.
-5. **Wire the skills.** The suite is the package `@sassywares/skills`, and its own CLI creates the links. Never copy skill files into a project.
+5. **Wire the skills.** The suite is installed from upstream with the open `skills` CLI, which vendors the skill files into the project and pins them. Never copy skill files in by hand, never add the suite as a dependency.
 
-   - **It needs a `package.json`.** With none, say so and ask whether to add a minimal manifest or skip the wiring. Do not create one unasked, and do not invent a second distribution mechanism for non-JS projects.
-   - **Detect the package manager** from the lockfile: `bun.lock`/`bun.lockb`, `pnpm-lock.yaml`, `yarn.lock`, `package-lock.json`. Ask when several disagree or none exists.
-   - **Add the dependency pinned exactly** — `bun add --dev --exact @sassywares/skills@<version>`, `npm install --save-dev --save-exact …`, `pnpm add --save-dev --save-exact …`, `yarn add --dev --exact …`. Exact, because one pinned version for every teammate and every harness is the entire point.
-   - **Scripts**, adding only what is missing: `"skills:sync": "sassy-skills sync"`, `"skills:update": "sassy-skills update"`, and `"postinstall": "sassy-skills sync"`. **Never overwrite an existing `postinstall`** — if one is there, leave it alone and tell the user to chain `&& sassy-skills sync`, so setup cannot erase someone's install steps.
-   - **Run `sassy-skills sync`.** The package's CLI is now in `node_modules/.bin`; it links `.agents/skills/sassy-*` and creates `.claude/skills → ../.agents/skills`. The linking rules travel with the lockfile, so they upgrade with the suite instead of drifting in the repo.
-   - **Ignore the derived links — `repo` topology only.** Add `/.agents/skills/sassy-*` and `/.claude/skills` to `.gitignore` when missing, creating it only when there is none. In `workspace` topology never touch the project's root `.gitignore`; the snapshot's own ignore file covers that case.
+   - **Install it**: `npx -y skills add sassywares/sassy-skills -y`. That writes `.agents/skills/sassy-*` (real files), per-agent links such as `.claude/skills/sassy-*`, and `skills-lock.json`.
+   - **Scripts**, adding only what is missing: `"skills:sync": "npx -y skills experimental_install"` (restores exactly what the lock pins) and `"skills:update": "npx -y skills update -y"` (pulls the latest from upstream). **Never rewrite an existing `postinstall`** — leave it alone and tell the user to chain what they need.
+   - **Commit the vendored skills and the lock.** `.agents/skills/sassy-*` and `skills-lock.json` are the pin; a clone then needs no network.
+   - **Ignore `.claude/skills` only.** It is a link created at install time. Create `.gitignore` only when there is none — and in `workspace` topology never touch the project's root `.gitignore` at all.
    - **Write `.sassywares/README.md`** from `assets/sassywares-readme.md` when absent. Never overwrite it — it may carry project notes.
-   - **Tell the user to `/reload`.** The links are invisible to the harness until it rescans.
+   - **Tell the user to `/reload`.** The skills are invisible to the harness until it rescans.
 
 6. **Install the snapshot, `workspace` only.** Read `references/workspace.md` and follow it.
 
@@ -55,9 +53,9 @@ disable-model-invocation: true
 | No silent overwrite | An existing config or an existing `.sassywares/workspace/snapshot` is shown and asked about, never replaced blind. |
 | Version is reported | Setup names the snapshot version it installed; `--check` flags an installed copy older than the skill's. |
 | Never commit | Setup writes files and stops. Committing is `sassy-commit`. |
-| Skills are a dependency | Pin `@sassywares/skills`; never copy skill files into a project or maintain hand-made links. |
+| Skills come from upstream | Install with `npx skills add`; never hand-copy skill files or maintain the links yourself. |
 | Scripts are shared | Adding a missing script is fine; rewriting an existing `postinstall` or `skills:*` entry is not. |
-| Write boundary | Only `.sassywares/`, the `package.json` scripts and devDependency, the lockfile, and — in `repo` topology — two `.gitignore` lines. Never skill content, and never a root `.gitignore` in a workspace. |
+| Write boundary | Only `.sassywares/`, the vendored `.agents/skills/sassy-*`, `skills-lock.json`, two `package.json` scripts, and one `.gitignore` line. Never a root `.gitignore` in a workspace. |
 | Detect, don't guess | An unknown base branch stays unknown and gets asked about. A probed value is reported as probed. |
 | Comments are part of the file | Every key keeps its description and allowed values. A stripped config is an incomplete config. |
 | Hooks are named, not written | Setup records hook skill names. Creating those skills is the project's work. |

package/skills/sassy-setup/assets/sassywares-readme.md

@@ -4,14 +4,16 @@ Project config and tooling for the Sassy Skills suite. Written by `sassy-setup`.
 
 ## Skills
 
-Installed as the npm package `@sassywares/skills`, pinned exactly in `package.json`. The entries in `.agents/skills/` and the `.claude/skills` symlink are **derived** from that package — never edit them by hand and never commit them.
+Installed from upstream with the open `skills` CLI, which vendors the skills into
+`.agents/skills/` and pins them in `skills-lock.json`:
 
 ```bash
-bun run skills:sync     # recreate the links after a fresh clone
-bun run skills:update   # bump to the latest published version, then relink
+npx skills add sassywares/sassy-skills   # first install
+bun run skills:sync                       # restore exactly what the lock pins
+bun run skills:update                     # pull the latest from upstream
 ```
 
-Skills print a one-line nudge when a newer version is published — once a day, and silently nothing when offline. It is never a blocker.
+The vendored skills and the lock are committed; `.claude/skills` is a link and is not.
 
 `.agents/skills/` is read by pi and Cursor; Claude Code reads `.claude/skills/` only, which is why that symlink exists. After any change, `/reload` your harness.
 
@@ -22,7 +24,7 @@ If a skill tells you another skill is missing, run `skills:sync` and restart. Su
 `config.yaml` holds the project's paths, git topology, and PR defaults. Every key is documented inline, including its allowed values, and the full schema is in the `sassy-setup` skill's `references/config.md`. Verify the file still matches the tree:
 
 ```bash
-node_modules/@sassywares/skills/skills/sassy-setup/scripts/detect.sh --root . --check
+.agents/skills/sassy-setup/scripts/detect.sh --root . --check
 ```
 
 ## Hooks

package/skills/sassy-ship/SKILL.md

@@ -18,8 +18,6 @@ disable-model-invocation: true
 
 **Config.** Resolve `.sassywares/config.yaml` (nearest, walking up) per the `sassy-setup` skill's `references/config.md`. Precedence: explicit token > session instruction > config > skill default. `pr.babysit`, `pr.merge`, and `pr.delete_branch` seed the close-out; `git.repo` decides whether this run commits, snapshots, or refuses; `hooks.pr.*` adds project steps to the PR pipeline.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 **Subagent-maximal by design.** The orchestrator delegates every heavy step (docs, tree reads, git, gh) to subagents and only receives compact summaries. It never reads diffs, file contents, or the tree itself.
 
 ## Steps (in order)

package/skills/sassy-validate/SKILL.md

@@ -13,8 +13,6 @@ disable-model-invocation: true
 
 **Outcome:** a grounded conformance judgment against an intent; the approved gaps closed; everything left uncommitted.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 **Orchestrator only.** Never edit code yourself. The `validator` finds gaps; the `worker` closes them.
 
 **This skill needs an intent.** Validation without something to validate against is meaningless. If the user gave no plan path or intent, ask for one before doing anything.

package/skills/sassy-work/SKILL.md

@@ -19,8 +19,6 @@ disable-model-invocation: true
 
 **Config.** Resolve `.sassywares/config.yaml` (nearest, walking up) per the `sassy-setup` skill's `references/config.md`. Precedence: explicit token > session instruction > config > skill default. `git.repo` decides what the phase commit does, `artifacts.plans` decides where the plan lives.
 
-**Update nudge.** Once per run, if `node_modules/.bin/sassy-skills` exists, run `node_modules/.bin/sassy-skills outdated`. It is throttled to once a day per machine and silently does nothing offline. Pass any newer version on in one line; never block, retry, or fail on it.
-
 ## Input
 
 Detect the shape from the argument:

package/bin/sassy-skills.mjs

@@ -1,250 +0,0 @@
-#!/usr/bin/env node
-// sassy-skills — wire this package's skills into a project.
-//
-// Nothing scans node_modules on its own, so the harnesses that read a project
-// skills directory need links. This tool creates them, checks them, and updates
-// the pinned version.
-//
-//   sassy-skills sync            link skills into .agents/skills (and .claude/skills)
-//   sassy-skills check           exit 1 if the wiring is missing or stale
-//   sassy-skills update          bump to the latest published version, then sync
-//   sassy-skills outdated        one-line nudge when a newer version is published
-//
-// Options: --root <dir>  --quiet  --force  --help
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { execFileSync } from "node:child_process";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const SKILLS_DIR = resolve(HERE, "..", "skills");
-const PKG = JSON.parse(readFileSync(resolve(HERE, "..", "package.json"), "utf8"));
-const NAME = PKG.name;
-const VERSION = PKG.version;
-const REGISTRY = process.env.SASSY_SKILLS_REGISTRY ?? "https://registry.npmjs.org";
-
-const args = process.argv.slice(2);
-const quiet = args.includes("--quiet");
-const rootFlag = args.indexOf("--root");
-const rootValueIndex = rootFlag >= 0 ? rootFlag + 1 : -1;
-const rootArg = rootFlag >= 0 ? args[rootFlag + 1] : undefined;
-if (rootFlag >= 0 && (!rootArg || rootArg.startsWith("-"))) {
-  console.error("  ✗ --root needs a directory");
-  process.exit(2);
-}
-const ROOT = rootArg ? resolve(rootArg) : process.cwd();
-if (rootFlag >= 0) {
-  let ok = false;
-  try { ok = statSync(ROOT).isDirectory(); } catch { ok = false; }
-  if (!ok) { console.error(`  ✗ --root ${ROOT} is not an existing directory`); process.exit(2); }
-}
-if (args.includes("--help") || args.includes("-h")) {
-  console.log(`sassy-skills@${VERSION}\n\n  sync     link skills into .agents/skills and .claude/skills\n  check    exit 1 when the wiring is missing or stale\n  update   bump ${NAME} to the latest version, then sync\n  outdated print a one-line nudge when a newer version is published (throttled, offline-safe)\n\nOptions: --root <dir>  --quiet  --force`);
-  process.exit(0);
-}
-
-const command = args.find((a, i) => !a.startsWith("-") && i !== rootValueIndex) ?? "sync";
-
-const log = (...a) => { if (!quiet) console.log(...a); };
-const ok = (m) => log(`  ✓ ${m}`);
-const warn = (m) => console.error(`  ! ${m}`);
-const die = (m) => { console.error(`  ✗ ${m}`); process.exit(1); };
-
-const IS_WIN = process.platform === "win32";
-
-function linkedSkills() {
-  if (!existsSync(SKILLS_DIR)) die(`package has no skills/ directory at ${SKILLS_DIR}`);
-  return readdirSync(SKILLS_DIR, { withFileTypes: true })
-    .filter((e) => e.isDirectory() && existsSync(join(SKILLS_DIR, e.name, "SKILL.md")))
-    .map((e) => e.name)
-    .sort();
-}
-
-// Returns "linked", "kept", or "blocked". A blocked path is a real directory the
-// user owns: never replaced, and always a failure, because the wiring is then
-// incomplete and nothing the tool can do will fix it.
-function makeLink(target, linkPath) {
-  try {
-    const st = lstatSync(linkPath);
-    if (st.isSymbolicLink()) {
-      if (resolve(dirname(linkPath), readlinkSync(linkPath)) === target) return "kept";
-      rmSync(linkPath);
-    } else {
-      warn(`${linkPath} is a real directory, not a link — move it aside; nothing was replaced`);
-      return "blocked";
-    }
-  } catch { /* does not exist */ }
-  symlinkSync(target, linkPath, IS_WIN ? "junction" : "dir");
-  return "linked";
-}
-
-function sync() {
-  const skills = linkedSkills();
-  const agents = join(ROOT, ".agents", "skills");
-  mkdirSync(agents, { recursive: true });
-
-  let linked = 0;
-  let blocked = 0;
-  for (const name of skills) {
-    const target = resolve(SKILLS_DIR, name);
-    const result = makeLink(target, join(agents, name));
-    if (result === "linked") linked++;
-    else if (result === "blocked") blocked++;
-  }
-  if (blocked) {
-    console.error(`  ✗ ${blocked} of ${skills.length} skills could not be linked — see above`);
-    return 1;
-  }
-  ok(linked
-    ? `${skills.length} skills linked into .agents/skills (${NAME}@${VERSION})`
-    : `${skills.length} skills already linked (${NAME}@${VERSION})`);
-
-  // Claude Code reads .claude/skills only. A directory symlink is enough, and it
-  // is the least invasive form when the directory does not already exist.
-  const claude = join(ROOT, ".claude", "skills");
-  try {
-    const st = lstatSync(claude);
-    if (!st.isSymbolicLink()) {
-      warn(".claude/skills is a real directory — Claude Code will not see the project skills until you link them");
-      return 1;
-    }
-    const points = resolve(dirname(claude), readlinkSync(claude));
-    if (points !== resolve(agents)) {
-      warn(`.claude/skills points at ${points}, not .agents/skills — relink it`);
-      return 1;
-    }
-  } catch {
-    mkdirSync(dirname(claude), { recursive: true });
-    symlinkSync(IS_WIN ? join(ROOT, ".agents", "skills") : "../.agents/skills", claude, IS_WIN ? "junction" : "dir");
-    ok("linked .claude/skills → .agents/skills");
-  }
-
-  if (linked) log(`\nRestart or /reload your harness to pick up the new skills.`);
-  return 0;
-}
-
-function check() {
-  const skills = linkedSkills();
-  const agents = join(ROOT, ".agents", "skills");
-  let problems = 0;
-
-  for (const name of skills) {
-    const link = join(agents, name);
-    const target = resolve(SKILLS_DIR, name);
-    try {
-      const st = lstatSync(link);
-      if (!st.isSymbolicLink()) { warn(`${name}: real directory, not a link`); problems++; continue; }
-      const points = resolve(agents, readlinkSync(link));
-      if (points !== target) { warn(`${name}: points at ${points}, expected ${target}`); problems++; }
-    } catch {
-      warn(`${name}: not linked`);
-      problems++;
-    }
-  }
-  const claude = join(ROOT, ".claude", "skills");
-  try {
-    const st = lstatSync(claude);
-    if (!st.isSymbolicLink()) { warn(".claude/skills is a real directory, so Claude Code sees none of these"); problems++; }
-    else if (resolve(dirname(claude), readlinkSync(claude)) !== resolve(agents)) {
-      warn(".claude/skills points somewhere else"); problems++;
-    }
-  } catch { warn(".claude/skills missing (Claude Code only)"); }
-  if (problems) { console.error(`  ✗ ${problems} skill link(s) need attention — run: sassy-skills sync`); return 1; }
-  ok(`${skills.length} skills correctly linked (${NAME}@${VERSION})`);
-  return 0;
-}
-
-function detectPM() {
-  if (existsSync(join(ROOT, "bun.lock")) || existsSync(join(ROOT, "bun.lockb"))) return "bun";
-  if (existsSync(join(ROOT, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(join(ROOT, "yarn.lock"))) return "yarn";
-  if (existsSync(join(ROOT, "package-lock.json"))) return "npm";
-  return null;
-}
-
-function update() {
-  const pm = detectPM();
-  if (!pm) die("no lockfile found — cannot tell which package manager to update with");
-  const spec = `${NAME}@latest`;
-  const cmd = {
-    bun: ["bun", ["add", "--dev", "--exact", spec]],
-    npm: ["npm", ["install", "--save-dev", "--save-exact", spec]],
-    pnpm: ["pnpm", ["add", "--save-dev", "--save-exact", spec]],
-    yarn: ["yarn", ["add", "--dev", "--exact", spec]],
-  }[pm];
-  log(`Updating ${NAME} with ${pm}…`);
-  try {
-    execFileSync(cmd[0], cmd[1], { cwd: ROOT, stdio: "inherit" });
-  } catch {
-    die(`${pm} could not update ${NAME} — nothing was relinked`);
-  }
-  // The running copy is the old version; its skills directory may be gone. Hand
-  // over to the freshly installed binary so the linker matches the new package.
-  const fresh = join(ROOT, "node_modules", ".bin", "sassy-skills");
-  if (existsSync(fresh)) {
-    try {
-      execFileSync(fresh, ["sync", "--root", ROOT], { stdio: "inherit" });
-    } catch {
-      die("updated, but the new binary could not relink — run: sassy-skills sync");
-    }
-    return 0;
-  }
-  return sync();
-}
-
-function newerThan(a, b) {
-  const pa = String(a).split(/[.+-]/).map((x) => parseInt(x, 10) || 0);
-  const pb = String(b).split(/[.+-]/).map((x) => parseInt(x, 10) || 0);
-  for (let i = 0; i < 3; i++) {
-    if ((pa[i] ?? 0) !== (pb[i] ?? 0)) return (pa[i] ?? 0) > (pb[i] ?? 0);
-  }
-  return false;
-}
-
-function updateHint() {
-  const pm = detectPM();
-  const script = pm === "bun" ? "bun run skills:update"
-    : pm ? `${pm} run skills:update`
-    : "sassy-skills update";
-  return script;
-}
-
-// Non-blocking version nudge. Throttled to once a day per machine, silent when
-// offline, and it never fails a run — a stale pin is worth mentioning, not
-// worth blocking work over.
-async function outdated(force = false) {
-  const cacheFile = join(tmpdir(), "sassy-skills-version-check.json");
-  const TTL = 24 * 60 * 60 * 1000;
-  let cached = null;
-  try { cached = JSON.parse(readFileSync(cacheFile, "utf8")); } catch { /* first run */ }
-
-  let latest = null;
-  const fresh = cached && typeof cached.checkedAt === "number" && Date.now() - cached.checkedAt < TTL;
-  if (fresh && !force) {
-    latest = cached.latest ?? null;
-  } else {
-    try {
-      const res = await fetch(`${REGISTRY}/${encodeURIComponent(NAME)}/latest`, {
-        signal: AbortSignal.timeout(2000),
-        headers: { accept: "application/json" },
-      });
-      const body = await res.json();
-      latest = typeof body?.version === "string" ? body.version : null;
-    } catch { latest = null; }
-    try { writeFileSync(cacheFile, JSON.stringify({ checkedAt: Date.now(), latest })); } catch { /* read-only tmp */ }
-  }
-
-  if (!latest || !newerThan(latest, VERSION)) return 0;
-  console.log(`  ↑ ${NAME} ${VERSION} → ${latest} available — ${updateHint()}`);
-  return 0;
-}
-
-switch (command) {
-  case "outdated": process.exit(await outdated(args.includes("--force")));
-  case "sync": process.exit(sync());
-  case "check": process.exit(check());
-  case "update": process.exit(update());
-  default:
-    die(`unknown command: ${command} (try --help)`);
-}