@skillsmith/cli 0.8.5 → 0.8.7

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.7
+
+- **Fix**: Cursor UAT follow-up — website onboarding, CLI/MCP parity, hooks schema (#2375)
+- **Chore**: removed 3 confirmed-dead exports flagged by the new `code-health-auditor` skill's first real dogfooding run (SMI-6023) — `displayQuotaProgressBar`/`displayQuotaWarning` (`utils/license.ts`, superseded by inline rendering in `displayLicenseStatus`) and `getTrustTierColor` (`commands/search-formatters.ts`, a one-line wrapper — real call sites already index `TRUST_TIER_COLORS` directly), plus the now-dead re-export of `getTrustTierColor` from `commands/search.ts`. No public API surface change — `packages/cli` ships as a bin-only bundle with no `exports`/`main`/`types` field. 3 other candidates the scan flagged were verified as false positives (same-file callers the tool's coverage check missed) and kept.
+- **Fix**: `list --client cursor`'s footer no longer hardcodes `~/.claude/skills` — it now names the resolved client's actual install path, via `manage.action.ts` reusing the existing `getInstallPath(client)` pattern (SMI-5893 Wave 7, GH#2368)
+- **Fix**: `recommend`'s footer no longer hardcodes `~/.claude/skills` either — since `recommend`'s auto-detection scans across every installed client rather than one, the footer now describes multi-harness detection accurately instead of naming one client path. `recommend --context` also dedupes duplicate rows by `skill.id` (client-side mitigation; the schema-level root cause stays with the separately-tracked SMI-5898) (SMI-5893 Wave 7, GH#2368)
+- **Feature**: `skillsmith setup` (`install-skill.ts`) gains `--client <id>` support, installing to the resolved client's path instead of always `~/.claude/skills/skillsmith/` (SMI-5893 Wave 7, GH#2368)
+- **Fix**: `--quiet`/`SKILLSMITH_QUIET` is now wired once via a commander `preAction` hook at the CLI root instead of being duplicated per-command, and reuses the shared `isQuietModeEnabled()` check instead of a narrower literal-`'true'` comparison. Fixes a real bug where the new root `--quiet` flag was silently shadowing `install`/`registry-install`/`merge`'s own pre-existing local `--quiet` flags (SMI-5893 Wave 7, GH#2368)
+
+## v0.8.6
+
+- **Fix**: Harden manifest concurrency (uninstall lock, temp-file races) (#2331)
+- **Feature**: `antigravity` (Google Antigravity) is now a supported `--client` value across install/list/remove/update/sync and the generated MCP-server config snippet (`skillsmith install --client antigravity` / `SKILLSMITH_CLIENT=antigravity`) — companion-subagent output uses Antigravity's own directory-package convention (`.agents/agents/<name>/agent.md`), not the flat file every other client gets. `VALID_CLIENT_HINT` also picks up `grok`, which was a pre-existing gap (SMI-5697 added the client but never updated this help text) (SMI-5982)
+- **Fix**: `saveManifest()` (`utils/manifest.ts`) computed its temp filename from just the process
+  id, so two concurrent saves in the same process could collide on the same temp path and corrupt
+  one of them. The temp filename now includes a random UUID suffix, with best-effort cleanup of
+  only that invocation's own temp file on failure (mirrors the same fix in
+  `@skillsmith/core`'s `ManifestManager.save()`) (SMI-6007).
+- **Changed**: bumps `@skillsmith/core` for the SMI-5929 compatibility-ranking change —
+  `SearchResponse.compatibilityHidden` is renamed to `compatibilityDeprioritized` and
+  `SearchOptions` gains an optional `compatibility` field. `skillsmith search` does not currently
+  expose a compatibility filter of its own (no `--compatible-with` flag, and `searchRemoteOrLocal`
+  never read the old field), so this has no CLI-visible behavior change today — the entry is here
+  because both renamed/added members are part of `@skillsmith/core`'s public type surface this
+  package depends on (SMI-5929)
+- **Fix**: `skillsmith author subagent`/`transform` now write companion-subagent files to the
+  target client's own agent directory (via `@skillsmith/core`'s new `COMPANION_AGENT_TARGETS`)
+  instead of always hardcoding `~/.claude/agents/` — fixes generated subagents landing in the
+  wrong client's directory for `--client cursor`/`copilot`/etc (GH #2161)
+- **Fix**: `recommend --context`'s keyword extraction (`commands/recommend.ts`) no longer silently
+  drops real short technical terms ("git", "ci", "aws", "sql", "k8s") via a bare
+  `.filter((w) => w.length > 3)` threshold — a context consisting only of such terms previously
+  derived an empty stack and tripped the SMI-5896 empty-stack guard even though usable context had
+  been supplied. Now uses the shared `extractContextWords()` (`@skillsmith/core`) also adopted by
+  the MCP server's `skill_recommend`, so the two can't independently drift on this again (SMI-5986)
+- **Fix**: `license-types.ts`'s `TIER_FEATURES` was silently missing `version_tracking`
+  (individual/team/enterprise) and `skill_security_audit` (team/enterprise) versus the canonical
+  `@smith-horn/enterprise` package's own feature membership — this file has no compiler backstop
+  (`Record<LicenseTier, string[]>`, not `Record<FeatureFlag, ...>`), so the drift went undetected
+  until a new regression test comparing the two caught it. Also adds the new `registry_approval`
+  flag to the `enterprise` tier (SMI-5949 Wave 2)
+
 ## v0.8.5
 
 - **Cadence**: Mechanical cadence alignment (no changes since v0.8.4).

package/README.md

@@ -8,7 +8,7 @@ Part of Skillsmith: a lifecycle layer for agent skills across teams.
 
 ## Contents
 
-- [What's New](#whats-new-in-v085)
+- [What's New](#whats-new-in-v087)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -16,7 +16,7 @@ Part of Skillsmith: a lifecycle layer for agent skills across teams.
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.8.5
+## What's New in v0.8.7
 
 - **Multi-client targeting fixed across the board**: `install`, `list`, `remove`, `update`, `sync`, and `search -i`'s install action now all honor `SKILLSMITH_CLIENT`/`--client` consistently — previously several of these silently acted on the Claude Code directory regardless of the flag or env var.
 - **`update` no longer fails after a fresh install**: now resolves the installed skill's registry source from the manifest `install` already writes, instead of a dead-code path that could never find it.

package/dist/.skillsmith-dist-hash

@@ -1 +1 @@
-0bf4163ad3408fd44f049b7776596b2ffd97cd3d
+bbbc02d0207042137ce44e87cadc0140a1182fb9