@skillsmith/cli 0.8.7 → 0.8.8

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.8
+
+- **Fix**: logout/whoami now detect JWT device-code sessions (#2578)
+- **Fix**: `skillsmith logout` and `skillsmith whoami` now detect a JWT device-code session
+  (`skillsmith login`'s default flow, SMI-4402) — previously they only checked the legacy
+  API-key store, so `login` would report "Already authenticated" while `logout` immediately
+  after reported "Not authenticated. Nothing to log out.", a stuck loop with no way to
+  actually end the session. `logout` now clears both credential stores on confirm. (SMI-6235)
+- **Docs**: README's framing sentence updated from the "lifecycle layer" tagline to a plain
+  descriptive sentence ("a registry for sharing, scanning, and tracking agent skills across
+  teams") as part of the site-wide positioning reframe. Wording-only. (SMI-6194)
+- **Fix**: `skillsmith update` no longer force-installs an unrelated same-named registry skill
+  over a locally-authored one it was never asked to replace. `getSkillDiff()` now reads the
+  installed skill's own claimed author from its `SKILL.md` front-matter (`readClaimedAuthor()`)
+  and only trusts a local-registry-cache bare-name match when it agrees with the cache row's
+  author — scanning every same-name cache row for the matching author, not just the first one
+  found — otherwise it falls through to the existing confidence-gated manifest/`SourceRecoveryService`
+  path instead of silently substituting the wrong author's skill. Confirmed real incident: two
+  personal, unclaimed skills were overwritten with unrelated registry content this way (SMI-6103)
+- **Fix**: the CLI's tier-gating messages (`require-tier.ts`) and `ab-test`'s upgrade prompt
+  (console and JSON `price` field) hardcoded the literal unpublished Enterprise price
+  (`$55/user/month`) — now `Custom pricing — Contact Sales`, matching the documented "unpublished"
+  pricing policy (SMI-6069, GH#2368-adjacent follow-up from SMI-5893)
+
+- **Fix**: The Cursor MCP snippet (root README, `@skillsmith/mcp-server`'s README, and the website) no longer defaults to `npx`, which failed inside Cursor on two separate live UAT passes (a real Cursor-bundled-Node ENOENT). The copied `command` is now a resolved-path placeholder (`which`/`where skillsmith-mcp`) that can never point at a wrong path; `npx` stays documented as an explicit, clearly-labeled fallback. Also fixed in the canonical CLI snippet matrix (`templates/mcp-server.template.snippets.ts`, used to scaffold non-Skillsmith MCP servers via `skillsmith author mcp-init`): its Cursor placeholder was hardcoding the literal binary name `skillsmith-mcp` instead of deriving it from the scaffolded server's own package name, and `{{name}}` was never interpolated in a snippet's `notes` text at all — either bug would leak Skillsmith-specific text into a scaffolded (non-Skillsmith) server's generated README (SMI-5893 Wave 11, GH#2368 C-01)
+- **Fix**: Community-tier quota corrected from a stale `1,000` to the actual `100` API calls/month in `displayLicenseStatus` (SMI-5893 Wave 11, GH#2368 C-19)
+- **Fix**: `list`/`manage`'s footer "local: ..." segment, and `inventory status`'s
+  "Local skills: ..." line, both hand-typed the literal `./.claude/skills`
+  independent of `getLocalSkillsDir()`'s own path segments — now sourced from a
+  new `getLocalSkillsDirDisplay()` (`utils/local-skills-dir.ts`), which derives
+  from `getLocalSkillsDir()`'s actual return value via `path.relative()` rather
+  than reconstructing it from a separately-shared constant, so the two genuinely
+  can't drift apart (the `inventory status` instance was found as a sibling gap
+  during review — same bug class, second call site this wave hadn't touched
+  yet). Displayed text is unchanged in both places — SMI-1630's repo-local
+  convention still applies regardless of `--client`. `local-skills-dir.ts` is a
+  small new module split out of `utils/skills-directory.ts`, which was
+  approaching (not over — corrected from an earlier miswritten changelog entry)
+  the 500-line standard (SMI-6060)
+
 ## v0.8.7
 
 - **Fix**: Cursor UAT follow-up — website onboarding, CLI/MCP parity, hooks schema (#2375)

package/README.md

@@ -4,11 +4,11 @@
 
 Command-line interface for Skillsmith — publish, manage, and author agent skills.
 
-Part of Skillsmith: a lifecycle layer for agent skills across teams.
+Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills across teams.
 
 ## Contents
 
-- [What's New](#whats-new-in-v087)
+- [What's New](#whats-new-in-v088)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -16,7 +16,7 @@ Part of Skillsmith: a lifecycle layer for agent skills across teams.
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.8.7
+## What's New in v0.8.8
 
 - **Multi-client targeting fixed across the board**: `install`, `list`, `remove`, `update`, `sync`, and `search -i`'s install action now all honor `SKILLSMITH_CLIENT`/`--client` consistently — previously several of these silently acted on the Claude Code directory regardless of the flag or env var.
 - **`update` no longer fails after a fresh install**: now resolves the installed skill's registry source from the manifest `install` already writes, instead of a dead-code path that could never find it.

package/dist/.skillsmith-dist-hash

@@ -1 +1 @@
-bbbc02d0207042137ce44e87cadc0140a1182fb9
+93f1c12d37b8d391f5574a4964e52d2745aba0a8