@skillsmith/cli 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.2
+
+- **Cadence**: Mechanical cadence alignment (no changes since v0.8.1).
+
+## v0.8.1
+
+- **Cadence**: Mechanical cadence alignment (no changes since v0.8.0).
+- **Fix**: reduced displayed tier quota constants 10x (SMI-5558) — Community was 1,000/mo now 100/mo, Individual was 10,000/mo now 1,000/mo, Team was 100,000/mo now 10,000/mo. Display-only; actual enforcement is in `@skillsmith/mcp-server`.
+
 ## v0.8.0
 
 - **Feature**: per-user inventory purge, hard-delete (SMI-5510, R0 Wave 1a) (#1684)

package/README.md

@@ -6,7 +6,7 @@ Command-line interface for Skillsmith - discover, manage, and author agent skill
 
 ## Contents
 
-- [What's New](#whats-new-in-v050)
+- [What's New](#whats-new-in-v080)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -14,12 +14,12 @@ Command-line interface for Skillsmith - discover, manage, and author agent skill
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.5.0
+## What's New in v0.8.0
 
-- **`skillsmith create` command**: Scaffold a new agent skill directly into `~/.claude/skills/<name>/` — interactive prompts or non-interactive flags (`--description`, `--author`, `--type`, `--dry-run`, `--yes`)
-- **Stricter name validation**: `author init` and `create` share registry-safe validation (lowercase + hyphens only)
-
-> v0.5.1 is a version-bump-only release fixing an npm registry regression. No source changes.
+- **`sklx agent install` / `uninstall`**: New command group installs a portable agent pack (SKILL.md + shims + hooks) to detected harnesses with per-harness MCP registration.
+- **Per-user inventory purge**: New hard-delete path for clearing a user's full skill inventory.
+- **`sklx audit collisions` / `audit advisories`**: Namespace-collision and legacy security-advisory audit subcommands, plus `sklx config set audit_mode <preventative|power_user|governance|off>`.
+- **Remote-default search + provenance**: `search` now defaults to the remote registry with safety filters, and install provenance is reported as Local / source-identified / Pending.
 
 See [CHANGELOG.md](./CHANGELOG.md) for previous releases.
 
@@ -133,21 +133,34 @@ skillsmith remove author/skill-name --force
 
 ### update
 
-Update installed skills.
+Update installed skills. Requires an explicit selector — a skill name, several
+names, or `--all` — bare `skillsmith update` with none of those prints usage
+guidance instead of updating anything.
 
 ```bash
 # Update all skills
-skillsmith update
+skillsmith update --all
+
+# Update one skill
+skillsmith update skill-name
 
-# Update specific skill
-skillsmith update author/skill-name
+# Update a specific set of skills
+skillsmith update skill-name another-skill
+
+# Preview changes without applying them
+skillsmith update skill-name --dry-run
 ```
 
+**Options:**
+- `-a, --all` - Update all installed skills
+- `-n, --dry-run` - Show what would update without installing
+- `-d, --db <path>` - Database file path
+
 ### inventory
 
 Cross-machine skill inventory for viewing which agent skills are installed across your machines and harnesses. Requires `skillsmith login` and opt-in via the [Cross-machine skill inventory toggle](https://www.skillsmith.app/account/telemetry) at skillsmith.app/account/telemetry (off by default). Once enabled, view your inventory at [skillsmith.app/account/skills](https://www.skillsmith.app/account/skills).
 
-**Privacy:** Only skill IDs, versions, content hashes, declared SKILL.md front-matter fields (author, license, repository), and device platform metadata are uploaded. File contents, paths, and your raw hostname are never transmitted. Set `SKILLSMITH_INVENTORY_DISABLE=1` to hard-disable.
+**Privacy:** Only skill IDs, versions, content hashes, declared SKILL.md front-matter fields (author, license, repository), and device platform metadata are uploaded. File contents, paths, and your raw hostname are never transmitted. Set `SKILLSMITH_INVENTORY_DISABLE=1` to hard-disable, or run `skillsmith inventory purge` to delete everything already stored.
 
 #### inventory push
 
@@ -183,6 +196,18 @@ Clear the local device registration; the next push creates a fresh device ID and
 skillsmith inventory forget-device
 ```
 
+#### inventory purge
+
+Permanently delete this account's entire stored cross-machine inventory from Skillsmith's servers (all devices and their skill rows). Irreversible. Prompts for confirmation unless `--yes` is passed.
+
+```bash
+skillsmith inventory purge
+skillsmith inventory purge --yes
+```
+
+**Options:**
+- `-y, --yes` - Skip the confirmation prompt (for scripts)
+
 See [Cross-machine skill inventory](https://www.skillsmith.app/docs/inventory) for details.
 
 ### init
@@ -645,6 +670,49 @@ By default, the CLI uses `~/.skillsmith/skills.db`. Override with:
 SKILLSMITH_DB_PATH=/custom/path/skills.db skillsmith search "testing"
 ```
 
+### Error Logging
+
+Structured error logs are automatically persisted to disk for debugging and diagnostics.
+
+**Log Location:** `~/.skillsmith/logs/skillsmith-cli-<YYYY-MM-DD>.jsonl`
+
+**Log Format:** One JSON-line record per error, with fields:
+- `ts` — ISO 8601 timestamp
+- `level` — log level (`debug`, `info`, `warn`, `error`)
+- `surface` — invocation surface (`cli`, `mcp`, or `vscode`)
+- `event` — short machine-readable category tag
+- `msg` — human-readable message (redacted)
+- `err` — normalized error object with `name`, `message`, and first 20 stack frames (all redacted)
+- `correlationId` — trace ID linking related log entries and telemetry events
+- `toolOrCommand` — CLI command name or MCP tool name
+- `skillId` — skill ID when applicable
+- `version` — package version
+- `pid` — process ID
+- `details` — additional structured context beyond the fields above, when provided (redacted)
+
+**Redaction:** Secrets, tokens, API keys, passwords, connection strings, and PEM keys are automatically redacted before any record is written to disk — this applies to the message, error stack, and any structured context. Redaction happens synchronously at the call site, so disk logs are already safe to inspect or share.
+
+**Rotation & Retention:** Log files rotate daily (new file per UTC calendar date) and are capped at ~10MB with `.1`, `.2` continuation files. Files older than 14 days are automatically deleted on startup (CLI or MCP server, whichever runs first).
+
+**Control Logging:**
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `SKILLSMITH_ERROR_LOG_DISABLE` | unset (logging ON) | Set to `'1'` or `'true'` to disable error logging entirely |
+| `SKILLSMITH_LOG_LEVEL` | `warn` | Filter log verbosity: `debug`, `info`, `warn`, or `error` |
+
+Examples:
+
+```bash
+# Turn off error logging
+SKILLSMITH_ERROR_LOG_DISABLE=1 skillsmith search "testing"
+
+# Enable debug-level verbosity (noisier, more detailed logs)
+SKILLSMITH_LOG_LEVEL=debug skillsmith search "testing"
+```
+
+**Inspect Logs:** Run `skillsmith diagnose` to view a redacted summary of recent error records, or `skillsmith logs --tail` to follow logs in real-time. Both commands redact secrets inline, so output is always safe to paste in chat or share.
+
 ## Privacy & Data Handling
 
 Skillsmith is designed with privacy as a core principle.
@@ -758,7 +826,7 @@ npm run dev
 
 ```bash
 # Update all installed skills
-skillsmith update
+skillsmith update --all
 
 # Remove a skill
 skillsmith remove community/old-skill

package/dist/.skillsmith-dist-hash

@@ -0,0 +1 @@
+1c79f9dd311c8960dffa1c8af98f6089de9acee9