@skillsmith/cli 0.8.4 → 0.8.6

package/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.6
+
+- **Fix**: Harden manifest concurrency (uninstall lock, temp-file races) (#2331)
+- **Feature**: `antigravity` (Google Antigravity) is now a supported `--client` value across install/list/remove/update/sync and the generated MCP-server config snippet (`skillsmith install --client antigravity` / `SKILLSMITH_CLIENT=antigravity`) — companion-subagent output uses Antigravity's own directory-package convention (`.agents/agents/<name>/agent.md`), not the flat file every other client gets. `VALID_CLIENT_HINT` also picks up `grok`, which was a pre-existing gap (SMI-5697 added the client but never updated this help text) (SMI-5982)
+- **Fix**: `saveManifest()` (`utils/manifest.ts`) computed its temp filename from just the process
+  id, so two concurrent saves in the same process could collide on the same temp path and corrupt
+  one of them. The temp filename now includes a random UUID suffix, with best-effort cleanup of
+  only that invocation's own temp file on failure (mirrors the same fix in
+  `@skillsmith/core`'s `ManifestManager.save()`) (SMI-6007).
+- **Changed**: bumps `@skillsmith/core` for the SMI-5929 compatibility-ranking change —
+  `SearchResponse.compatibilityHidden` is renamed to `compatibilityDeprioritized` and
+  `SearchOptions` gains an optional `compatibility` field. `skillsmith search` does not currently
+  expose a compatibility filter of its own (no `--compatible-with` flag, and `searchRemoteOrLocal`
+  never read the old field), so this has no CLI-visible behavior change today — the entry is here
+  because both renamed/added members are part of `@skillsmith/core`'s public type surface this
+  package depends on (SMI-5929)
+- **Fix**: `skillsmith author subagent`/`transform` now write companion-subagent files to the
+  target client's own agent directory (via `@skillsmith/core`'s new `COMPANION_AGENT_TARGETS`)
+  instead of always hardcoding `~/.claude/agents/` — fixes generated subagents landing in the
+  wrong client's directory for `--client cursor`/`copilot`/etc (GH #2161)
+- **Fix**: `recommend --context`'s keyword extraction (`commands/recommend.ts`) no longer silently
+  drops real short technical terms ("git", "ci", "aws", "sql", "k8s") via a bare
+  `.filter((w) => w.length > 3)` threshold — a context consisting only of such terms previously
+  derived an empty stack and tripped the SMI-5896 empty-stack guard even though usable context had
+  been supplied. Now uses the shared `extractContextWords()` (`@skillsmith/core`) also adopted by
+  the MCP server's `skill_recommend`, so the two can't independently drift on this again (SMI-5986)
+- **Fix**: `license-types.ts`'s `TIER_FEATURES` was silently missing `version_tracking`
+  (individual/team/enterprise) and `skill_security_audit` (team/enterprise) versus the canonical
+  `@smith-horn/enterprise` package's own feature membership — this file has no compiler backstop
+  (`Record<LicenseTier, string[]>`, not `Record<FeatureFlag, ...>`), so the drift went undetected
+  until a new regression test comparing the two caught it. Also adds the new `registry_approval`
+  flag to the `enterprise` tier (SMI-5949 Wave 2)
+
+## v0.8.5
+
+- **Cadence**: Mechanical cadence alignment (no changes since v0.8.4).
+- **Changed**: `skillsmith --help`'s top-level description now reads "Publish versioned agent skills to a team-scoped registry, catch drift across installs, and deprecate what's gone stale. (alias: sklx)" — part of the repo-wide messaging reframe from "skill discovery" to "agent skill lifecycle management" (SMI-5948)
+- **Fix**: `search-formatters.ts`'s security-status coloring (`formatSecurityStatus`, `displaySkillDetails`) no longer renders bright green purely from `securityPassed === true` — a skill scoring just under the quarantine threshold (`DEFAULT_RISK_THRESHOLD`, 40 — lower is safer) rendered identically to one scoring near 0, misleadingly implying "very safe" for a borderline pass. Green is now reserved for a comfortably-safe pass (risk score under half the threshold, or no numeric score); a borderline pass renders yellow instead. Text ("PASS"/"PASSED") is unchanged — this is a color-only fix (SMI-5897)
+- **Feature**: new `skillsmith registry install <skillId>` command (optional `--version`) — pulls a skill previously published to your team's Enterprise private registry and installs it locally, closing the publish→install gap (previously the registry could only be published to and browsed). Talks to the new `private-registry-get` Edge Function under your signed-in user JWT (`skillsmith login`) — the CLI never carries Supabase credentials directly. `403` maps to "Enterprise subscription required for your team's private registry"; a cross-team or nonexistent `skillId` both map to a non-leaking "not found", matching the Edge Function's own contract (SMI-5905)
+- **Fix**: `registry-install`'s `skillId` validation rejects `.`/`..` path segments (e.g. `"team/.."`) before any network call or disk write — the same guard added at every layer of this feature's stack (SMI-5905)
+- **Fix**: `skillsmith recommend --installed <ids...>` now actually feeds those IDs into the recommendation query — previously an explicit `--installed` list was reported back in the output but never fed into the empty-derived-stack guard, so a codebase where analysis detects nothing (non-Node stack, all-devDeps) still hit the guard's degraded response even though the user had already supplied exactly the escape-hatch information the guard's own guidance text asks for (SMI-5896)
+- **Fix**: `skillsmith update <name>` now resolves an installed skill's registry source from `~/.skillsmith/manifest.json` — the entry `install` already writes on every successful install, looked up by the `(name, client)` key so a same-named skill installed under two clients resolves the copy the caller asked about — instead of a `SKILL.md` front-matter `id:` read that `SkillParser` never populated. `update` therefore no longer reports `"<name>" has no recorded registry source` for a normally-installed skill. When the manifest genuinely has no entry, it falls back to `SourceRecoveryService` and auto-applies only `exact`/`high`/`user-specified` matches; a speculative medium/low name match fails safe with a pointer to `sklx audit sources` rather than silently updating from a guessed source (SMI-5895)
+- **Fix**: `skillsmith search -i`'s "Install this skill" action now honors `SKILLSMITH_CLIENT` — previously it always installed to the canonical Claude Code directory regardless of the environment variable, the same class of bug SMI-5894 fixed for `install`/`list`/`remove`/`update`/`sync` (SMI-5894 post-merge retro)
+- **Fix**: `--accept`/`--revoke` are now rejected outright (a new `accept_disabled` validation code, before any audit/lock/file touch) while `SKILLSMITH_AUDIT_ACCEPT_DISABLE=1` is set, instead of writing a real but dormant record and printing a false "OK Accepted"/"OK Revoked" success message (SMI-5883 post-merge retro)
+- **Feature**: `sklx audit security` gains `--accept <key> --reason "<why>"` / `--revoke <key>` / `--candidates` / `--list-accepted` for the new local security-acceptance allowlist — a reviewed false-positive finding can be marked accepted so it stops re-surfacing, without ever affecting rug-pull/hostile-update detection. `--accept` re-runs the real audit before matching a key (a stale key from changed content is rejected as `key_not_found`, never blindly trusted); `--revoke` resolves against the stored ledger, not the current run's candidates, since the records most worth revoking are often ones that no longer match live content. `--json` candidate output is paginated (`--page`/`--page-size`, or `--all-candidates` for the complete uncapped array) with a deterministic total ordering so no candidate is skipped or duplicated across pages (SMI-5883)
+
 ## v0.8.4
 
 - **Cadence**: Mechanical cadence alignment (no changes since v0.8.3).

package/README.md

@@ -2,11 +2,13 @@
 
 > **Important:** The bare `skillsmith` package on npm is **not** this project. Install `@skillsmith/cli` for the CLI or configure [`@skillsmith/mcp-server`](https://www.npmjs.com/package/@skillsmith/mcp-server) for MCP integration.
 
-Command-line interface for Skillsmith - discover, manage, and author agent skills.
+Command-line interface for Skillsmith — publish, manage, and author agent skills.
+
+Part of Skillsmith: a lifecycle layer for agent skills across teams.
 
 ## Contents
 
-- [What's New](#whats-new-in-v082)
+- [What's New](#whats-new-in-v086)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -14,11 +16,14 @@ Command-line interface for Skillsmith - discover, manage, and author agent skill
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.8.2
-
-- **Corrected tier quota display**: Community/Individual/Team quota labels shown by the CLI are reduced 10x (100/mo, 1,000/mo, 10,000/mo respectively) to match actual enforcement — display-only; enforcement lives in `@skillsmith/mcp-server`.
+## What's New in v0.8.6
 
-> v0.8.2 is a scheduled cadence release with no functional changes beyond v0.8.1.
+- **Multi-client targeting fixed across the board**: `install`, `list`, `remove`, `update`, `sync`, and `search -i`'s install action now all honor `SKILLSMITH_CLIENT`/`--client` consistently — previously several of these silently acted on the Claude Code directory regardless of the flag or env var.
+- **`update` no longer fails after a fresh install**: now resolves the installed skill's registry source from the manifest `install` already writes, instead of a dead-code path that could never find it.
+- **New `skillsmith registry install <skillId>`**: pulls a skill previously published to your team's Enterprise private registry and installs it locally.
+- **New security-acceptance workflow**: `sklx audit security --accept/--revoke/--candidates/--list-accepted` lets you mark a reviewed false-positive as accepted so it stops re-surfacing, without affecting rug-pull/hostile-update detection.
+- **`recommend --installed` actually used now**: an explicit `--installed` list is fed into the recommendation query instead of being silently ignored on an empty-derived-stack workspace.
+- **Security-status coloring corrected**: a borderline-safe scan result no longer renders identically bright-green to a comfortably-safe one.
 
 See [CHANGELOG.md](./CHANGELOG.md) for previous releases.
 

package/dist/.skillsmith-dist-hash

@@ -1 +1 @@
-5f56c82dba321630993c75abcccb8819828fe89d
+7b1b6c30831fc27d4cfa421514f8939c6f8515b7