@skillsmith/cli 0.7.4 → 0.8.1

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.1
+
+- **Cadence**: Mechanical cadence alignment (no changes since v0.8.0).
+- **Fix**: reduced displayed tier quota constants 10x (SMI-5558) — Community was 1,000/mo now 100/mo, Individual was 10,000/mo now 1,000/mo, Team was 100,000/mo now 10,000/mo. Display-only; actual enforcement is in `@skillsmith/mcp-server`.
+
+## v0.8.0
+
+- **Feature**: per-user inventory purge, hard-delete (SMI-5510, R0 Wave 1a) (#1684)
+- **Fix**: 0.7.4 security hotfix — interactive-search quarantine bypass (SMI-5447) (#1656)
+- **Feature**: `sklx agent install` / `uninstall` command group — installs portable agent pack (SKILL.md + shims + hooks) to detected harnesses with per-harness MCP registration (SMI-5456)
+
 ## v0.7.4
 
 - **Security**: fix an interactive-search install path that bypassed the quarantine gate — `skillsmith search -i` → "Install this skill" no longer installs a quarantined skill (consolidated onto the quarantine-aware registry lookup shared with `install`) (SMI-5447).

package/README.md

@@ -6,19 +6,20 @@ Command-line interface for Skillsmith - discover, manage, and author agent skill
 
 ## Contents
 
-- [What's New](#whats-new-in-v050)
+- [What's New](#whats-new-in-v080)
 - [Installation](#installation)
 - [Commands](#commands)
+  - [inventory](#inventory)
 - [Configuration](#configuration)
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.5.0
+## What's New in v0.8.0
 
-- **`skillsmith create` command**: Scaffold a new agent skill directly into `~/.claude/skills/<name>/` — interactive prompts or non-interactive flags (`--description`, `--author`, `--type`, `--dry-run`, `--yes`)
-- **Stricter name validation**: `author init` and `create` share registry-safe validation (lowercase + hyphens only)
-
-> v0.5.1 is a version-bump-only release fixing an npm registry regression. No source changes.
+- **`sklx agent install` / `uninstall`**: New command group installs a portable agent pack (SKILL.md + shims + hooks) to detected harnesses with per-harness MCP registration.
+- **Per-user inventory purge**: New hard-delete path for clearing a user's full skill inventory.
+- **`sklx audit collisions` / `audit advisories`**: Namespace-collision and legacy security-advisory audit subcommands, plus `sklx config set audit_mode <preventative|power_user|governance|off>`.
+- **Remote-default search + provenance**: `search` now defaults to the remote registry with safety filters, and install provenance is reported as Local / source-identified / Pending.
 
 See [CHANGELOG.md](./CHANGELOG.md) for previous releases.
 
@@ -132,16 +133,83 @@ skillsmith remove author/skill-name --force
 
 ### update
 
-Update installed skills.
+Update installed skills. Requires an explicit selector — a skill name, several
+names, or `--all` — bare `skillsmith update` with none of those prints usage
+guidance instead of updating anything.
 
 ```bash
 # Update all skills
-skillsmith update
+skillsmith update --all
+
+# Update one skill
+skillsmith update skill-name
+
+# Update a specific set of skills
+skillsmith update skill-name another-skill
+
+# Preview changes without applying them
+skillsmith update skill-name --dry-run
+```
+
+**Options:**
+- `-a, --all` - Update all installed skills
+- `-n, --dry-run` - Show what would update without installing
+- `-d, --db <path>` - Database file path
 
-# Update specific skill
-skillsmith update author/skill-name
+### inventory
+
+Cross-machine skill inventory for viewing which agent skills are installed across your machines and harnesses. Requires `skillsmith login` and opt-in via the [Cross-machine skill inventory toggle](https://www.skillsmith.app/account/telemetry) at skillsmith.app/account/telemetry (off by default). Once enabled, view your inventory at [skillsmith.app/account/skills](https://www.skillsmith.app/account/skills).
+
+**Privacy:** Only skill IDs, versions, content hashes, declared SKILL.md front-matter fields (author, license, repository), and device platform metadata are uploaded. File contents, paths, and your raw hostname are never transmitted. Set `SKILLSMITH_INVENTORY_DISABLE=1` to hard-disable, or run `skillsmith inventory purge` to delete everything already stored.
+
+#### inventory push
+
+Push this device's installed-skill snapshot to your Skillsmith account.
+
+```bash
+skillsmith inventory push
 ```
 
+Requires:
+- Active authentication via `skillsmith login`
+- "Cross-machine skill inventory" toggle enabled at skillsmith.app/account/telemetry
+
+#### inventory status
+
+Show local device inventory status (read-only, no network call).
+
+```bash
+skillsmith inventory status
+
+# Verbose output
+skillsmith inventory status --verbose
+```
+
+**Options:**
+- `--verbose` - List the individual skill IDs found under each harness
+
+#### inventory forget-device
+
+Clear the local device registration; the next push creates a fresh device ID and registers as a new machine.
+
+```bash
+skillsmith inventory forget-device
+```
+
+#### inventory purge
+
+Permanently delete this account's entire stored cross-machine inventory from Skillsmith's servers (all devices and their skill rows). Irreversible. Prompts for confirmation unless `--yes` is passed.
+
+```bash
+skillsmith inventory purge
+skillsmith inventory purge --yes
+```
+
+**Options:**
+- `-y, --yes` - Skip the confirmation prompt (for scripts)
+
+See [Cross-machine skill inventory](https://www.skillsmith.app/docs/inventory) for details.
+
 ### init
 
 Initialize a new skill project.
@@ -602,6 +670,49 @@ By default, the CLI uses `~/.skillsmith/skills.db`. Override with:
 SKILLSMITH_DB_PATH=/custom/path/skills.db skillsmith search "testing"
 ```
 
+### Error Logging
+
+Structured error logs are automatically persisted to disk for debugging and diagnostics.
+
+**Log Location:** `~/.skillsmith/logs/skillsmith-cli-<YYYY-MM-DD>.jsonl`
+
+**Log Format:** One JSON-line record per error, with fields:
+- `ts` — ISO 8601 timestamp
+- `level` — log level (`debug`, `info`, `warn`, `error`)
+- `surface` — invocation surface (`cli`, `mcp`, or `vscode`)
+- `event` — short machine-readable category tag
+- `msg` — human-readable message (redacted)
+- `err` — normalized error object with `name`, `message`, and first 20 stack frames (all redacted)
+- `correlationId` — trace ID linking related log entries and telemetry events
+- `toolOrCommand` — CLI command name or MCP tool name
+- `skillId` — skill ID when applicable
+- `version` — package version
+- `pid` — process ID
+- `details` — additional structured context beyond the fields above, when provided (redacted)
+
+**Redaction:** Secrets, tokens, API keys, passwords, connection strings, and PEM keys are automatically redacted before any record is written to disk — this applies to the message, error stack, and any structured context. Redaction happens synchronously at the call site, so disk logs are already safe to inspect or share.
+
+**Rotation & Retention:** Log files rotate daily (new file per UTC calendar date) and are capped at ~10MB with `.1`, `.2` continuation files. Files older than 14 days are automatically deleted on startup (CLI or MCP server, whichever runs first).
+
+**Control Logging:**
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `SKILLSMITH_ERROR_LOG_DISABLE` | unset (logging ON) | Set to `'1'` or `'true'` to disable error logging entirely |
+| `SKILLSMITH_LOG_LEVEL` | `warn` | Filter log verbosity: `debug`, `info`, `warn`, or `error` |
+
+Examples:
+
+```bash
+# Turn off error logging
+SKILLSMITH_ERROR_LOG_DISABLE=1 skillsmith search "testing"
+
+# Enable debug-level verbosity (noisier, more detailed logs)
+SKILLSMITH_LOG_LEVEL=debug skillsmith search "testing"
+```
+
+**Inspect Logs:** Run `skillsmith diagnose` to view a redacted summary of recent error records, or `skillsmith logs --tail` to follow logs in real-time. Both commands redact secrets inline, so output is always safe to paste in chat or share.
+
 ## Privacy & Data Handling
 
 Skillsmith is designed with privacy as a core principle.
@@ -715,7 +826,7 @@ npm run dev
 
 ```bash
 # Update all installed skills
-skillsmith update
+skillsmith update --all
 
 # Remove a skill
 skillsmith remove community/old-skill

package/dist/.skillsmith-dist-hash

@@ -0,0 +1 @@
+75c45d14dcefcb6f809b81c62c82679b31256451