@skillsmith/cli 0.8.6 → 0.8.8

package/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.8
+
+- **Fix**: logout/whoami now detect JWT device-code sessions (#2578)
+- **Fix**: `skillsmith logout` and `skillsmith whoami` now detect a JWT device-code session
+  (`skillsmith login`'s default flow, SMI-4402) — previously they only checked the legacy
+  API-key store, so `login` would report "Already authenticated" while `logout` immediately
+  after reported "Not authenticated. Nothing to log out.", a stuck loop with no way to
+  actually end the session. `logout` now clears both credential stores on confirm. (SMI-6235)
+- **Docs**: README's framing sentence updated from the "lifecycle layer" tagline to a plain
+  descriptive sentence ("a registry for sharing, scanning, and tracking agent skills across
+  teams") as part of the site-wide positioning reframe. Wording-only. (SMI-6194)
+- **Fix**: `skillsmith update` no longer force-installs an unrelated same-named registry skill
+  over a locally-authored one it was never asked to replace. `getSkillDiff()` now reads the
+  installed skill's own claimed author from its `SKILL.md` front-matter (`readClaimedAuthor()`)
+  and only trusts a local-registry-cache bare-name match when it agrees with the cache row's
+  author — scanning every same-name cache row for the matching author, not just the first one
+  found — otherwise it falls through to the existing confidence-gated manifest/`SourceRecoveryService`
+  path instead of silently substituting the wrong author's skill. Confirmed real incident: two
+  personal, unclaimed skills were overwritten with unrelated registry content this way (SMI-6103)
+- **Fix**: the CLI's tier-gating messages (`require-tier.ts`) and `ab-test`'s upgrade prompt
+  (console and JSON `price` field) hardcoded the literal unpublished Enterprise price
+  (`$55/user/month`) — now `Custom pricing — Contact Sales`, matching the documented "unpublished"
+  pricing policy (SMI-6069, GH#2368-adjacent follow-up from SMI-5893)
+
+- **Fix**: The Cursor MCP snippet (root README, `@skillsmith/mcp-server`'s README, and the website) no longer defaults to `npx`, which failed inside Cursor on two separate live UAT passes (a real Cursor-bundled-Node ENOENT). The copied `command` is now a resolved-path placeholder (`which`/`where skillsmith-mcp`) that can never point at a wrong path; `npx` stays documented as an explicit, clearly-labeled fallback. Also fixed in the canonical CLI snippet matrix (`templates/mcp-server.template.snippets.ts`, used to scaffold non-Skillsmith MCP servers via `skillsmith author mcp-init`): its Cursor placeholder was hardcoding the literal binary name `skillsmith-mcp` instead of deriving it from the scaffolded server's own package name, and `{{name}}` was never interpolated in a snippet's `notes` text at all — either bug would leak Skillsmith-specific text into a scaffolded (non-Skillsmith) server's generated README (SMI-5893 Wave 11, GH#2368 C-01)
+- **Fix**: Community-tier quota corrected from a stale `1,000` to the actual `100` API calls/month in `displayLicenseStatus` (SMI-5893 Wave 11, GH#2368 C-19)
+- **Fix**: `list`/`manage`'s footer "local: ..." segment, and `inventory status`'s
+  "Local skills: ..." line, both hand-typed the literal `./.claude/skills`
+  independent of `getLocalSkillsDir()`'s own path segments — now sourced from a
+  new `getLocalSkillsDirDisplay()` (`utils/local-skills-dir.ts`), which derives
+  from `getLocalSkillsDir()`'s actual return value via `path.relative()` rather
+  than reconstructing it from a separately-shared constant, so the two genuinely
+  can't drift apart (the `inventory status` instance was found as a sibling gap
+  during review — same bug class, second call site this wave hadn't touched
+  yet). Displayed text is unchanged in both places — SMI-1630's repo-local
+  convention still applies regardless of `--client`. `local-skills-dir.ts` is a
+  small new module split out of `utils/skills-directory.ts`, which was
+  approaching (not over — corrected from an earlier miswritten changelog entry)
+  the 500-line standard (SMI-6060)
+
+## v0.8.7
+
+- **Fix**: Cursor UAT follow-up — website onboarding, CLI/MCP parity, hooks schema (#2375)
+- **Chore**: removed 3 confirmed-dead exports flagged by the new `code-health-auditor` skill's first real dogfooding run (SMI-6023) — `displayQuotaProgressBar`/`displayQuotaWarning` (`utils/license.ts`, superseded by inline rendering in `displayLicenseStatus`) and `getTrustTierColor` (`commands/search-formatters.ts`, a one-line wrapper — real call sites already index `TRUST_TIER_COLORS` directly), plus the now-dead re-export of `getTrustTierColor` from `commands/search.ts`. No public API surface change — `packages/cli` ships as a bin-only bundle with no `exports`/`main`/`types` field. 3 other candidates the scan flagged were verified as false positives (same-file callers the tool's coverage check missed) and kept.
+- **Fix**: `list --client cursor`'s footer no longer hardcodes `~/.claude/skills` — it now names the resolved client's actual install path, via `manage.action.ts` reusing the existing `getInstallPath(client)` pattern (SMI-5893 Wave 7, GH#2368)
+- **Fix**: `recommend`'s footer no longer hardcodes `~/.claude/skills` either — since `recommend`'s auto-detection scans across every installed client rather than one, the footer now describes multi-harness detection accurately instead of naming one client path. `recommend --context` also dedupes duplicate rows by `skill.id` (client-side mitigation; the schema-level root cause stays with the separately-tracked SMI-5898) (SMI-5893 Wave 7, GH#2368)
+- **Feature**: `skillsmith setup` (`install-skill.ts`) gains `--client <id>` support, installing to the resolved client's path instead of always `~/.claude/skills/skillsmith/` (SMI-5893 Wave 7, GH#2368)
+- **Fix**: `--quiet`/`SKILLSMITH_QUIET` is now wired once via a commander `preAction` hook at the CLI root instead of being duplicated per-command, and reuses the shared `isQuietModeEnabled()` check instead of a narrower literal-`'true'` comparison. Fixes a real bug where the new root `--quiet` flag was silently shadowing `install`/`registry-install`/`merge`'s own pre-existing local `--quiet` flags (SMI-5893 Wave 7, GH#2368)
+
 ## v0.8.6
 
 - **Fix**: Harden manifest concurrency (uninstall lock, temp-file races) (#2331)

package/README.md

@@ -4,11 +4,11 @@
 
 Command-line interface for Skillsmith — publish, manage, and author agent skills.
 
-Part of Skillsmith: a lifecycle layer for agent skills across teams.
+Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills across teams.
 
 ## Contents
 
-- [What's New](#whats-new-in-v086)
+- [What's New](#whats-new-in-v088)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -16,7 +16,7 @@ Part of Skillsmith: a lifecycle layer for agent skills across teams.
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.8.6
+## What's New in v0.8.8
 
 - **Multi-client targeting fixed across the board**: `install`, `list`, `remove`, `update`, `sync`, and `search -i`'s install action now all honor `SKILLSMITH_CLIENT`/`--client` consistently — previously several of these silently acted on the Claude Code directory regardless of the flag or env var.
 - **`update` no longer fails after a fresh install**: now resolves the installed skill's registry source from the manifest `install` already writes, instead of a dead-code path that could never find it.

package/dist/.skillsmith-dist-hash

@@ -1 +1 @@
-7b1b6c30831fc27d4cfa421514f8939c6f8515b7
+93f1c12d37b8d391f5574a4964e52d2745aba0a8