@sayknow-cli/coding-agent 0.5.13 → 0.5.14

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.5.14] - 2026-09-16
+
+### Added
+
+- Bundled frontend UI/UX craft skills so SKC sessions can invoke them without a separate user install: Emil Kowalski's web craft set (`emil-design-eng`, `animate`, `review-animations`, `improve-animations`, `find-animation-opportunities`, `pick-ui-library`, `prototype`, `mobile-native`, `animation-vocabulary`, `apple-design`, `ask-sonner`) and Appllama's native mobile build bar (`appllama-app-design-skill`). These are not public workflow skills; the four workflows remain `deep-interview`, `ralplan`, `ultragoal`, and `team`. `appllama-usage` is deliberately excluded because it only drives the paid Appllama MCP, which SKC does not ship. Each skill's companion reference files are inlined as appendices by `scripts/build-ui-skill-bundle.ts`, since only `SKILL.md` is compiled into the binary and a bundled skill's `baseDir` is a virtual path.
+- The native `UserPromptSubmit` hook routes frontend UI/UX prompts to the matching bundled UI skill automatically, in English and Korean, so the agent loads `animate`, `review-animations`, `pick-ui-library`, `mobile-native`, `appllama-app-design-skill`, `ask-sonner`, or the `emil-design-eng` baseline without the user naming a skill. Detection is additive to workflow-keyword activation, seeds no workflow mode state, and stays silent for non-frontend prompts and for SKC's own terminal-only UI work.
+- Transition-shaped prompts route to the `transitions-dev` skill ([transitions.dev](https://github.com/Jakubantalik/transitions.dev)). When it is absent the agent installs it itself with upstream's own non-interactive command (`-a universal`, landing in `<project>/.agents/skills/`, a root SKC loads) through the `bash` tool, so the user never types an install command; when present it is loaded directly. The collection is deliberately **not** vendored: upstream licenses only its CLI and Refine tooling under MIT, while the transitions carry a clause forbidding repackaging or publishing the collection — which is what bundling into the SKC binary would do. Installing into the user's own project is explicitly permitted.
+- `skc setup ui-skills` installs the routed-but-unbundled frontend skills into the current project (`<project>/.agents/skills/`, a root SKC's agents provider loads), with `--check` to audit and `--force` to reinstall. It runs upstream's own publisher CLI and verifies the payload landed, so a silent installer failure is reported instead of being treated as success.
+- Animated-React-component prompts route to a new bundled `react-bits` skill covering the [React Bits](https://reactbits.dev) registry: when to reach for it, the per-component `npx shadcn@latest add @react-bits/<Component>-<Variant>` install, the `components.json` precondition that otherwise hangs a non-interactive run, post-install duties (dependency weight, reduced-motion guards), and a catalog of all 169 component names. The skill is SKC-authored guidance plus factual metadata — React Bits ships no agent skill of its own, and its MIT + Commons Clause license forbids redistributing the components, so no component source is bundled.
+
+### Fixed
+
+- Runtime skill discovery ranks project `.skc/skills` ahead of the user-home catalog before applying the result limit, so a populated `~/.skc/skills` cannot hide a project skill (ported from upstream v0.16.5 skill-convention budget ranking).
+- Session-import URL redaction no longer caps the scheme at 16 characters. The scheme-character run is boundary-anchored so long and digit-prefixed credential URLs still redact without quadratic scanning (ported from upstream #5402).
+
 ## [0.5.13] - 2026-09-15
 ### Fixed
 

package/dist/types/cli/setup-cli.d.ts

@@ -5,7 +5,7 @@
  */
 import { AuthStorage, SqliteAuthCredentialStore } from "@sayknow-cli/ai";
 import { runExternalCredentialAutoImport } from "../setup/credential-auto-import";
-export type SetupComponent = "claude" | "codex" | "credentials" | "defaults" | "hermes" | "hooks" | "provider" | "python" | "stt";
+export type SetupComponent = "claude" | "codex" | "credentials" | "defaults" | "hermes" | "hooks" | "provider" | "python" | "stt" | "ui-skills";
 export interface SetupCommandArgs {
     component: SetupComponent;
     flags: {

package/dist/types/defaults/skc-ui-skills.d.ts

@@ -0,0 +1,12 @@
+import type { Skill } from "../extensibility/skills";
+/**
+ * Bundled frontend UI/UX craft skills. These are NOT public SKC workflow skills.
+ * The four public workflows remain deep-interview, ralplan, ultragoal, and team.
+ *
+ * Sources and deliberate exclusions are documented in
+ * `skc/ui-skills/NOTICE.md`; regenerate with `scripts/build-ui-skill-bundle.ts`.
+ */
+export declare const BUNDLED_SKC_UI_SKILL_NAMES: readonly ["emil-design-eng", "animate", "review-animations", "improve-animations", "find-animation-opportunities", "pick-ui-library", "prototype", "mobile-native", "animation-vocabulary", "apple-design", "ask-sonner", "appllama-app-design-skill", "react-bits"];
+export type BundledSkcUiSkillName = (typeof BUNDLED_SKC_UI_SKILL_NAMES)[number];
+export declare function getEmbeddedSkcUiSkills(): Skill[];
+export declare function withEmbeddedSkcUiSkills(skills: Skill[]): Skill[];

package/dist/types/hooks/ui-skill-keywords.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Automatic frontend UI/UX skill routing.
+ *
+ * The bundled UI craft skills (see `defaults/skc-ui-skills.ts`) are compiled
+ * into the binary, so the agent can invoke them without any user install. This
+ * module decides WHEN: the native `UserPromptSubmit` hook matches the prompt
+ * against the patterns below and injects a directive naming the skill to load.
+ *
+ * Unlike the canonical workflow skills, UI skills have no `skc state` mode
+ * state. Detection here never seeds workflow state; it only advertises the
+ * skill for the current turn.
+ *
+ * Patterns cover English and Korean because prompts arrive in both.
+ */
+import type { BundledSkcUiSkillName } from "../defaults/skc-ui-skills";
+export interface UiSkillKeywordDefinition {
+    skill: BundledSkcUiSkillName;
+    /** Higher wins when several patterns match the same prompt. */
+    priority: number;
+    pattern: RegExp;
+}
+/** Base craft skill paired with any specialized web frontend match. */
+export declare const UI_SKILL_BASE: BundledSkcUiSkillName;
+/**
+ * Ordered specialized detectors. The first (highest priority) match selects the
+ * lead skill; `emil-design-eng` is added as the craft baseline for build and
+ * review work.
+ */
+export declare const UI_SKILL_KEYWORD_DEFINITIONS: readonly UiSkillKeywordDefinition[];
+export interface UiSkillKeywordMatch {
+    skill: BundledSkcUiSkillName;
+    keyword: string;
+    priority: number;
+}
+/**
+ * Detect frontend UI/UX intent. Returns matches ordered by priority, most
+ * specific first, with `emil-design-eng` appended as the craft baseline.
+ */
+export declare function detectUiSkillKeywords(text: string): UiSkillKeywordMatch[];
+/**
+ * Build the `UserPromptSubmit` directive that makes the agent load the matching
+ * bundled UI skill for this turn. Returns null when the prompt is not frontend
+ * UI/UX work.
+ */
+export declare function buildUiSkillActivationContext(text: string): string | null;
+/**
+ * Frontend skills SKC routes to but deliberately does NOT vendor.
+ *
+ * `transitions.dev` publishes an agent skill, but its terms license only the
+ * CLI and Refine tooling under MIT; the transition collection itself carries a
+ * separate clause that forbids repackaging or publishing the collection (or a
+ * substantial part of it). Compiling it into the SKC binary and shipping that
+ * to every user is exactly the prohibited redistribution, while installing it
+ * into your own project is explicitly allowed. So SKC routes to a user-owned
+ * install and never carries the content.
+ */
+export interface ExternalUiSkillDefinition {
+    skill: string;
+    priority: number;
+    pattern: RegExp;
+    /**
+     * Upstream's own non-interactive install. `-a universal` lands the skill in
+     * `<project>/.agents/skills/`, which SKC's agents provider loads. It is the
+     * agent that runs this through its normal bash tool, so the install stays a
+     * visible, permissioned tool call — never a silent fetch inside the hook.
+     */
+    installCommand: string;
+    source: string;
+}
+export declare const EXTERNAL_UI_SKILL_DEFINITIONS: readonly ExternalUiSkillDefinition[];
+export declare function detectExternalUiSkills(text: string): ExternalUiSkillDefinition[];
+/**
+ * Directive for frontend skills SKC routes to but does not vendor.
+ *
+ * Installed: load it. Missing: the agent runs upstream's own non-interactive
+ * install itself, so the user never types the command. The install runs through
+ * the agent's bash tool — visible and permissioned — rather than as a silent
+ * network fetch inside this hook.
+ */
+export declare function buildExternalUiSkillContext(input: {
+    cwd: string;
+    home: string;
+    text: string;
+}): Promise<string | null>;

package/dist/types/session-import/redact.d.ts

@@ -8,7 +8,7 @@
  */
 export declare const IMPORT_REDACTED_PLACEHOLDER = "[REDACTED]";
 /** Bumped when patterns change; persisted in import provenance. */
-export declare const IMPORT_SANITIZER_VERSION = 4;
+export declare const IMPORT_SANITIZER_VERSION = 5;
 export interface ImportRedactionResult {
     value: string;
     redacted: number;

package/dist/types/setup/external-ui-skills.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Install the frontend UI skills SKC routes to but cannot bundle.
+ *
+ * Most UI craft skills are compiled into the binary (see
+ * `defaults/skc-ui-skills.ts`). A few upstreams license their content for use
+ * but forbid redistributing the collection, so SKC must not carry them. For
+ * those, this installs upstream's own published payload into the project, where
+ * SKC's skill discovery picks it up like any other project skill.
+ *
+ * Target is `<project>/.agents/skills/<name>/`, which SKC's agents provider
+ * loads on the project walk-up.
+ */
+export type ExternalUiSkillStatus = "installed" | "already-present" | "failed" | "missing";
+export interface ExternalUiSkillResult {
+    skill: string;
+    source: string;
+    status: ExternalUiSkillStatus;
+    path: string;
+    detail?: string;
+}
+export interface ExternalUiSkillsReport {
+    projectDir: string;
+    installed: number;
+    alreadyPresent: number;
+    failed: number;
+    missing: number;
+    skills: ExternalUiSkillResult[];
+}
+export interface InstallExternalUiSkillsOptions {
+    cwd: string;
+    /** Report what would happen without running any installer. */
+    check?: boolean;
+    /** Reinstall even when the skill is already present. */
+    force?: boolean;
+}
+export declare function installExternalUiSkills(options: InstallExternalUiSkillsOptions): Promise<ExternalUiSkillsReport>;
+export declare function formatExternalUiSkillsReport(report: ExternalUiSkillsReport): string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/coding-agent",
-	"version": "0.5.13",
+	"version": "0.5.14",
 	"description": "Sayknow-CLI CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -54,12 +54,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@sayknow-cli/stats": "0.5.13",
-		"@sayknow-cli/agent-core": "0.5.13",
-		"@sayknow-cli/ai": "0.5.13",
-		"@sayknow-cli/natives": "0.5.13",
-		"@sayknow-cli/tui": "0.5.13",
-		"@sayknow-cli/utils": "0.5.13",
+		"@sayknow-cli/stats": "0.5.14",
+		"@sayknow-cli/agent-core": "0.5.14",
+		"@sayknow-cli/ai": "0.5.14",
+		"@sayknow-cli/natives": "0.5.14",
+		"@sayknow-cli/tui": "0.5.14",
+		"@sayknow-cli/utils": "0.5.14",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/cli/setup-cli.ts

@@ -23,6 +23,7 @@ import {
 	getAutoImportOAuthCredentialSkips,
 	isAutoImportOAuthCredential,
 } from "../setup/credential-import";
+import { formatExternalUiSkillsReport, installExternalUiSkills } from "../setup/external-ui-skills";
 import {
 	formatHermesSetupResult,
 	type HermesSetupFlags,
@@ -46,7 +47,8 @@ export type SetupComponent =
 	| "hooks"
 	| "provider"
 	| "python"
-	| "stt";
+	| "stt"
+	| "ui-skills";
 
 export interface SetupCommandArgs {
 	component: SetupComponent;
@@ -290,6 +292,25 @@ export async function runSetupCommand(cmd: SetupCommandArgs): Promise<void> {
 		case "credentials":
 			await handleCredentialsSetup(cmd.flags);
 			break;
+		case "ui-skills":
+			await handleUiSkillsSetup(cmd.flags);
+			break;
+	}
+}
+
+async function handleUiSkillsSetup(flags: SetupCommandArgs["flags"]): Promise<void> {
+	const report = await installExternalUiSkills({
+		cwd: process.cwd(),
+		check: flags.check,
+		force: flags.force,
+	});
+	if (flags.json) {
+		process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+	} else {
+		process.stdout.write(`${formatExternalUiSkillsReport(report)}\n`);
+	}
+	if (report.failed > 0 || (flags.check && report.missing > 0)) {
+		process.exitCode = 1;
 	}
 }
 

package/src/cli/skills-cli.ts

@@ -1,11 +1,13 @@
 /**
- * Handles `skc skills` for inspecting bundled workflow skill definitions.
+ * Handles `skc skills` for inspecting bundled workflow and UI skill definitions.
  */
 import {
 	DEFAULT_SKC_DEFINITION_NAMES,
 	type EmbeddedDefaultSkcSkill,
 	getEmbeddedDefaultSkcSkills,
 } from "../defaults/skc-defaults";
+import { getEmbeddedSkcUiSkills } from "../defaults/skc-ui-skills";
+import type { Skill } from "../extensibility/skills";
 
 export type SkillsAction = "list" | "read";
 
@@ -28,17 +30,21 @@ interface SkillsReadEntry extends SkillsListEntry {
 	content: string;
 }
 
-function getEmbeddedSkill(name: string): EmbeddedDefaultSkcSkill | undefined {
-	return getEmbeddedDefaultSkcSkills().find(skill => skill.name === name);
+function getEmbeddedSkill(name: string): EmbeddedDefaultSkcSkill | Skill | undefined {
+	return (
+		getEmbeddedDefaultSkcSkills().find(skill => skill.name === name) ??
+		getEmbeddedSkcUiSkills().find(skill => skill.name === name)
+	);
 }
 
 function listEmbeddedSkills(): SkillsListEntry[] {
-	return getEmbeddedDefaultSkcSkills().map(skill => ({
+	const toEntry = (skill: EmbeddedDefaultSkcSkill | Skill): SkillsListEntry => ({
 		name: skill.name,
 		description: skill.description,
 		path: skill.filePath,
 		source: skill.source,
-	}));
+	});
+	return [...getEmbeddedDefaultSkcSkills().map(toEntry), ...getEmbeddedSkcUiSkills().map(toEntry)];
 }
 
 function writeJson(value: unknown): void {
@@ -60,14 +66,27 @@ export async function runSkillsCommand(cmd: SkillsCommandArgs): Promise<void> {
 
 	const name = cmd.name?.trim();
 	if (!name) {
-		process.stderr.write(`error: skill name is required for read (${DEFAULT_SKC_DEFINITION_NAMES.join(", ")})\n`);
+		process.stderr.write(
+			`error: skill name is required for read (${DEFAULT_SKC_DEFINITION_NAMES.join(", ")}, or a bundled UI skill such as emil-design-eng)\n`,
+		);
 		process.exitCode = 1;
 		return;
 	}
 
 	const skill = getEmbeddedSkill(name);
 	if (!skill) {
-		process.stderr.write(`error: unknown embedded skill "${name}" (${DEFAULT_SKC_DEFINITION_NAMES.join(", ")})\n`);
+		process.stderr.write(
+			`error: unknown embedded skill "${name}" (${DEFAULT_SKC_DEFINITION_NAMES.join(", ")}, or a bundled UI skill such as emil-design-eng)\n`,
+		);
+		process.exitCode = 1;
+		return;
+	}
+
+	// Every embedded skill carries inline content; a missing body means the
+	// bundle was built wrong, so fail loudly instead of printing "undefined".
+	const content = skill.content;
+	if (typeof content !== "string" || content.length === 0) {
+		process.stderr.write(`error: embedded skill "${name}" has no bundled content\n`);
 		process.exitCode = 1;
 		return;
 	}
@@ -77,12 +96,12 @@ export async function runSkillsCommand(cmd: SkillsCommandArgs): Promise<void> {
 		description: skill.description,
 		path: skill.filePath,
 		source: skill.source,
-		content: skill.content,
+		content,
 	};
 	if (cmd.flags?.json) {
 		writeJson(entry);
 		return;
 	}
-	process.stdout.write(skill.content);
-	if (!skill.content.endsWith("\n")) process.stdout.write("\n");
+	process.stdout.write(content);
+	if (!content.endsWith("\n")) process.stdout.write("\n");
 }

package/src/commands/setup.ts

@@ -15,6 +15,7 @@ const COMPONENTS: SetupComponent[] = [
 	"provider",
 	"python",
 	"stt",
+	"ui-skills",
 ];
 
 export default class Setup extends Command {

package/src/defaults/skc/ui-skills/LICENSE.appllama

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Antmind Ventures Private Limited (appllama.io)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/defaults/skc/ui-skills/LICENSE.emilkowalski

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Emil Kowalski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/defaults/skc/ui-skills/NOTICE.md

@@ -0,0 +1,43 @@
+# Bundled frontend UI/UX skills
+
+These `SKILL.md` files are vendored from upstream skill repositories so SKC
+sessions can invoke frontend UI/UX craft skills without a separate user
+install. They are **not** SKC public workflow skills: the four public
+workflows remain `deep-interview`, `ralplan`, `ultragoal`, and `team`.
+
+Regenerate with:
+
+```bash
+bun scripts/build-ui-skill-bundle.ts \
+  --source emilkowalski=<checkout> \
+  --source appllama=<checkout>
+```
+
+Only `SKILL.md` is compiled into the binary, and a bundled skill's `baseDir`
+is a virtual `embedded:skc/...` path. Companion reference files are therefore
+inlined into each `SKILL.md` as appendices by the generator; do not add
+loose companion files here expecting them to be readable at runtime.
+
+## Sources
+
+| Upstream | License | Vendored skills |
+| --- | --- | --- |
+| [emilkowalski/skills](https://github.com/emilkowalski/skills) | MIT (`LICENSE.emilkowalski`), Copyright (c) 2026 Emil Kowalski | `emil-design-eng`, `animate`, `review-animations`, `improve-animations`, `find-animation-opportunities`, `pick-ui-library`, `prototype`, `mobile-native`, `animation-vocabulary`, `apple-design`, `ask-sonner` |
+| [Appllama/appllama-skills](https://github.com/Appllama/appllama-skills) | MIT (`LICENSE.appllama`) | `appllama-app-design-skill` |
+
+## Deliberate exclusions
+
+- `write-swift`, `animate-expo` (emilkowalski) — not web frontend craft.
+- `appllama-usage` (Appllama) — it exists only to drive the paid Appllama MCP
+  (`mcp.appllama.io`). SKC neither ships nor enables that connector, so
+  bundling it would instruct the agent to call tools that do not exist.
+  `appllama-app-design-skill` is upstream-documented as standalone.
+
+- [`Jakubantalik/transitions.dev`](https://github.com/Jakubantalik/transitions.dev) — **not vendored.** Its terms license only the `transitions-dev` CLI and Refine tooling under MIT; the transition collection is governed by a separate "Using the transitions" clause that permits unlimited use in your own projects but forbids repackaging or publishing the collection (or a substantial part of it). SKC therefore never carries the content: the agent installs it into the user's own project on demand via `npx -y skills@latest add Jakubantalik/transitions.dev --skill transitions-dev -a universal -y`. See `hooks/ui-skill-keywords.ts`.
+- [`DavidHDev/react-bits`](https://github.com/DavidHDev/react-bits) — **components not vendored.** React Bits is a shadcn component registry, not an agent skill repo (it ships no `SKILL.md`), and its MIT + Commons Clause license forbids selling, sublicensing, or redistributing the components "alone, in a bundle, or as a ported version". The bundled `react-bits` skill is therefore **SKC-authored guidance**: when to reach for the registry, how to install one component (`npx shadcn@latest add @react-bits/<Component>-<Variant>`), the `components.json` precondition, and a factual catalog of component names. No upstream component source is included; components are installed from the registry into the user's own project.
+
+## Trademarks
+
+The Appllama name, llama, and logo are trademarks of Antmind Ventures Private
+Limited. The MIT license does not grant rights to use them; they appear here
+only to attribute the source of the vendored skill.