@skillsmith/cli 0.5.11 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to `@skillsmith/cli` are documented here.
 
+## [Unreleased]
+
+## v0.6.0
+
+- **Feature**: SMI-4590 Wave 4 PR 5/6 — new `sklx audit collisions` subcommand runs the consumer namespace audit (mirrors the `skill_inventory_audit` MCP tool); new `sklx config get audit_mode` / `sklx config set audit_mode <preventative|power_user|governance|off>` for managing audit verbosity. Tier-revalidated: Free/Individual cannot select `power_user`/`governance`. (#950)
+- **Feature**: SMI-4590 Wave 4 PR 1/6 — new `sklx audit advisories` subcommand for legacy security-advisory checks (the original `audit` semantic). Step 0b extracts shared audit-tool-dispatch into a reusable module. (#899)
+- **Feature**: SMI-4590 Wave 4 PR 2/6 — `FrameworkAdapter`/`claudeCodeAdapter` plumbing wired through the CLI to support multi-framework audits in future. (#913)
+- **Chore**: SMI-4575 npm keywords add `agent-skills`, `cursor`, `copilot` — unblocks discovery beyond the `claude-code` keyword as the rebrand sweep generalises to multi-client. No CLI behaviour change.
+- **Bump**: `@skillsmith/core` dep range to `^0.6.0` — pulls in the new audit subpath exports and multi-client install paths.
+- **Bump**: `@skillsmith/mcp-server` dep range to `^0.5.0` — required because `audit-collisions.ts` imports from `@skillsmith/mcp-server/audit`, which gained new types and exports in mcp-server 0.5.0.
+- **Bump**: minor version (0.5.12 → 0.6.0) signals new CLI subcommand surface — `audit collisions`, `audit advisories`, `config set audit_mode`.
+
+## v0.5.12
+
+- **Bump**: requires `@skillsmith/core` ≥ 0.5.6 to pick up the SMI-4486 schema-init fix that finally lets fresh installs run `skillsmith sync` without missing-table errors (#795).
+
 ## v0.5.11
 
 - **Fix**: SMI-4486 call initializeSchema after createDatabaseAsync in sync + audit (#791)

package/README.md

@@ -15,13 +15,15 @@ Command-line interface for Skillsmith - discover, manage, and author agent skill
 
 ## What's New in v0.5.0
 
-- **`skillsmith create` command**: Scaffold a new Claude Code skill directly into `~/.claude/skills/<name>/` — interactive prompts or non-interactive flags (`--description`, `--author`, `--type`, `--dry-run`, `--yes`)
+- **`skillsmith create` command**: Scaffold a new agent skill directly into `~/.claude/skills/<name>/` — interactive prompts or non-interactive flags (`--description`, `--author`, `--type`, `--dry-run`, `--yes`)
 - **Stricter name validation**: `author init` and `create` share registry-safe validation (lowercase + hyphens only)
 
 > v0.5.1 is a version-bump-only release fixing an npm registry regression. No source changes.
 
 See [CHANGELOG.md](./CHANGELOG.md) for previous releases.
 
+**Local-first by design.** Skillsmith caches the registry in a local SQLite database at `~/.skillsmith/skills.db`, shared across the MCP server, the CLI, and the VS Code extension. Search is FTS5 (SQLite's built-in keyword search) by default; semantic search is opt-in (`SKILLSMITH_USE_HNSW=true`) and runs over local ONNX embeddings (an open ML model format that runs on CPU — no API call). [Inside the Local Skill Database](https://skillsmith.app/blog/inside-the-local-skill-database) walks through the schema, the FTS5 / HNSW search paths, and how `sync` keeps the cache fresh.
+
 ## Installation
 
 ```bash
@@ -161,7 +163,7 @@ skillsmith init my-skill --path ./skills/my-skill
 
 ### create
 
-Scaffold a new Claude Code skill at `~/.claude/skills/<name>/`.
+Scaffold a new agent skill at `~/.claude/skills/<name>/`.
 
 ```bash
 # Interactive mode
@@ -435,6 +437,94 @@ skillsmith sync config --enable --frequency weekly
 - `--disable` - Disable automatic sync
 - `--frequency <freq>` - Set frequency: `daily` or `weekly`
 
+### audit
+
+#### audit advisories
+
+Check installed skills against known security advisories (Team+ tier). Use `--fix` to attempt updating skills with available patches.
+
+```bash
+# Check all installed skills
+skillsmith audit advisories
+
+# Output as JSON
+skillsmith audit advisories --json
+
+# Auto-update skills with patches
+skillsmith audit advisories --fix
+```
+
+**Options:**
+- `--json` - Emit results as JSON
+- `--fix` - Attempt `skillsmith update` for each advisory with a patch available
+
+#### audit collisions
+
+Audit installed skills for namespace collisions — duplicate tool names across multiple skills that could cause invocation conflicts (Community+).
+
+```bash
+# Interactive audit (prompts for each collision)
+skillsmith audit collisions
+
+# Include semantic-overlap detector pass
+skillsmith audit collisions --deep
+
+# Output raw JSON (no prompts, no file writes)
+skillsmith audit collisions --json
+
+# Accept every suggestion automatically (requires typing APPLY ALL)
+skillsmith audit collisions --apply-all
+
+# Write report only, no interactive prompts
+skillsmith audit collisions --report-only
+
+# Clear the namespace-override ledger (requires typing RESET LEDGER)
+skillsmith audit collisions --reset-ledger
+```
+
+**Options:**
+- `--deep` - Enable semantic-overlap detector pass
+- `--json` - Emit `RunInventoryAuditResult` as JSON; bypasses prompts and file mutation
+- `--apply-all` - Accept every rename suggestion; requires typing `APPLY ALL` to confirm
+- `--report-only` - Write audit report without prompts or apply
+- `--reset-ledger` - Clear `~/.skillsmith/namespace-overrides.json` (backs up first); requires typing `RESET LEDGER`
+
+### config
+
+Get or set Skillsmith configuration values in `~/.skillsmith/config.json`.
+
+#### config get
+
+Print the resolved value of a configuration key.
+
+```bash
+skillsmith config get audit_mode
+```
+
+**Supported keys:** `audit_mode`
+
+The resolved value reflects the config-file entry when set, else the tier default:
+- `community` / `individual` → `preventative`
+- `team` → `power_user`
+- `enterprise` → `governance`
+
+#### config set
+
+Write a configuration value. Tier-revalidated on write — `community` and `individual` users cannot select `power_user` or `governance`.
+
+```bash
+skillsmith config set audit_mode preventative
+skillsmith config set audit_mode power_user    # team/enterprise only
+skillsmith config set audit_mode governance    # enterprise only
+skillsmith config set audit_mode off
+```
+
+**Valid values for `audit_mode`:** `preventative`, `power_user`, `governance`, `off`
+
+**Error codes (stderr, exit 1):**
+- `audit.mode.invalid_value` — value not in the supported set
+- `audit.mode.tier_ineligible` — your tier cannot select the requested mode
+
 ### login
 
 Authenticate the Skillsmith CLI with your API key. Opens your browser to [skillsmith.app/account/cli-token](https://skillsmith.app/account/cli-token), where you generate and copy a key, then paste it into the terminal prompt.