@skillsmith/cli 0.8.8 → 0.8.10

package/CHANGELOG.md

@@ -4,6 +4,106 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.10
+
+- **Fixed**: SMI-6472 -- `src/utils/skill-name.ts`'s re-export of `VALID_SKILL_NAME_RE`/`validateSkillName` now imports from the narrow `@skillsmith/core/utils/skill-name` subpath instead of the `@skillsmith/core` package barrel. The barrel import transitively pulled in `skill-installation.io.ts` -> `safe-fs.ts`'s `fs/promises` needs (`open`/`lstat`/`constants`), breaking `tests/create.test.ts`'s narrow `fs/promises` mock (`mkdir`/`writeFile`/`stat` only) with `[vitest] No "constants" export is defined on the "fs/promises" mock`. No behavior change — only the import path.
+
+## v0.8.9
+
+- **Feature**: SMI-6343 Wave 3 -- tamper-check classification (#2710)
+- **Added**: `skillsmith update` now refuses to force-install over an already-corrupt manifest
+  entry — before overwriting the currently-installed skill, it runs the same shared tamper-
+  check classification `skill_outdated` uses and skips (rather than updates) any entry
+  classified `local-drift`, `identity-mismatch`, or `unknown`, naming the reason in a new
+  `Skipped` bucket in the update summary (SMI-6343 Wave 3). `sklx list --outdated` similarly
+  no longer reports `hasUpdates: true` for a `local-drift`/owner-mismatch/path-unresolved
+  entry — only the two signals that don't require a network call (this scan is offline by
+  design); a signal-2-only (front-matter) corruption still surfaces through `skill_outdated`.
+- **Fix**: `skills-directory.ts`'s `hasUpdates` computation (read by `sklx list --outdated`)
+  previously read a nonexistent `contentHash`/`originalContentHash` field off the *parsed
+  SKILL.md* object instead of the manifest entry, so it always fell back to comparing a fresh
+  on-disk hash against `skill_versions`' pre-fix metadata-proxy hash and could not correctly
+  report `hasUpdates: true` (SMI-6343 Wave 2). Now reads the manifest's real recorded install
+  hash and compares it via the shared `compareSkillContentHashes()` comparator, matching the
+  MCP server's `skill_outdated`/`skill_updates` tools.
+- **Fix**: `utils/manifest.ts`'s `saveManifest()` — a homedir-derived manifest write with no
+  path-override parameter — now refuses to touch a manifest inside the real user home while
+  running under vitest, via `@skillsmith/core`'s newly-exported `assertNotRealUserHome()`
+  (SMI-6343 Wave 1 follow-up, adversarial review). Previously the test-run `$HOME` sandbox
+  was this write path's only protection.
+- **Fix**: `skillsmith registry --help` now states that publishing and listing are MCP-only
+  today (`private_registry_publish`/`private_registry_manage`), pointing at those tools and
+  the private-registry docs page — matching already-shipped website copy. Two external
+  testers had each independently read the silent absence of `registry publish`/`list` as an
+  accidental gap; no new CLI subcommands (full CLI parity is tracked separately) (SMI-6266
+  Wave 8, SMI-6278)
+- **Fix**: The MCP config snippet for Google Antigravity now sets `SKILLSMITH_CLIENT: "antigravity"`,
+  so copying it verbatim installs skills to AntiGravity's own directory instead of silently
+  falling back to Claude Code's default — the same fix Cursor got earlier. `command`/`args`
+  stay plain `npx` (AntiGravity has no known `npx`-resolution problem, unlike Cursor) (SMI-6266
+  Wave 7, SMI-6277)
+- **Feature**: `skillsmith whoami` now shows your live effective license tier (and, when the
+  live check returns one, your per-minute API rate limit) alongside the existing masked-key/
+  session display, resolved via the same credential-aware `resolveEffectiveTier()` live check
+  `audit advisories`/`diff`/`pin`/`audit-collisions` already use (SMI-6271) — previously
+  `whoami` showed no tier information at all. Reuses the existing `formatTierBadge()` tier-badge
+  formatting rather than reimplementing it. Unlike those gating commands, a transient live-check
+  failure here does not block the command (this is a display command, not a gate) — it shows a
+  "could not verify" message instead of ever displaying a fabricated tier, since a single-shot
+  CLI invocation has no cached last-known tier to fall back to (SMI-6266 Wave 2, SMI-6272)
+- **Feature**: `install`/`update`/`remove` gain a new `--scope <global|workspace>` flag
+  (ADR-139, SMI-6274 Wave 4) — `workspace` resolves against the nearest ancestor workspace
+  marker or `.git` root instead of the client's home-anchored global directory, creating the
+  workspace skills directory if none exists yet (the only path allowed to create one implicitly).
+  Precedence: `--scope` > `SKILLSMITH_SCOPE` env var > per-client `~/.skillsmith/config.json`
+  default > auto-detecting an EXISTING workspace directory > global (unchanged default — no
+  existing install moves, nothing changes for anyone who doesn't opt in). `remove`/`update` now
+  resolve against the exact `(scope, client, name)` triple rather than "whichever scope happened
+  to match by name." `list` now scans every client's workspace directory (not just Claude Code's
+  repo-local one) alongside every global directory, labels each row's scope, and marks a skill
+  present on disk with no manifest entry `[untracked]` instead of silently omitting it —
+  `remove`/`update` now adopt such a skill (reconstructing a manifest entry from disk) instead of
+  requiring `--force`. `agent install --scope workspace` can bootstrap AntiGravity as a target in
+  a fresh repo by creating `.agents/skills`. `getLocalSkillsDir()` is now a deprecated thin
+  wrapper delegating to the new resolver (also fixing a real bug: it previously never walked up
+  from `cwd`, so `list` run from a repo subdirectory silently missed the repo-root
+  `.claude/skills`)
+
+- **Fix**: `skillsmith diagnose` now checks whether your Cursor MCP registration (both the
+  global `~/.cursor/mcp.json` and any project-scoped copy) is on the current, working config
+  shape and tells you how to fix it if not — previously nothing detected this at all once the
+  MCP server failed to even start, since the CLI's own update-nudge only fires from inside a
+  running MCP process (GH#2368, SMI-6279)
+
+- **Fix**: `audit advisories`, `diff`, `pin`, `config get/set audit_mode`, and `audit-collisions`
+  now correctly recognize a personal `SKILLSMITH_API_KEY` or a logged-in `skillsmith login`
+  session — previously they only ever checked `SKILLSMITH_LICENSE_KEY` (an offline license key
+  almost nobody uses), so an Enterprise customer using either of the two common auth methods was
+  always reported as Community tier (GH#2508, GH#2509, SMI-6271). Live tier verification now
+  fails closed on a network/timeout error rather than silently passing or downgrading a real
+  paying customer
+
+- **Fix**: `skillsmith login` (device-code flow) now refuses cleanly for SSO-provisioned users
+  instead of silently logging into the wrong account. Prints the server's refusal message and
+  points to the personal-API-key alternative (`/account/cli-token/` + `SKILLSMITH_API_KEY`).
+  Server-supplied error text is sanitized (control characters, bidi-override characters) before
+  being written to the terminal. Part of SMI-6206.
+
+- **Breaking**: `sync` (and `sync config --enable`) now require Team+ tier — Community and
+  Individual tiers can no longer bulk-download the skill registry. The registry has grown far
+  larger than this feature was designed for (hundreds of thousands of records, still growing),
+  with no size warning or cost boundary until now. Enforced both client-side (fast, friendly
+  failure) and server-side (a new `registry-sync` Edge Function, so a direct API call or an
+  older CLI can't bypass the gate). Before syncing, the CLI now shows a live record count
+  fetched from the registry and asks for confirmation — pass `-y`/`--yes` to skip the prompt for
+  scripted/automated use (`--json` implies `--yes`). No deprecation window; see ADR-136 for the
+  full rationale (SMI-6236). Adversarial security review before merge found and fixed a real
+  regression in the client-side gate: it originally resolved tier from `SKILLSMITH_LICENSE_KEY`
+  only, which a user authenticated via the documented `skillsmith login` flow never has set —
+  such a user would have been incorrectly blocked as "community" even on a real Team plan. The
+  gate now resolves tier from whichever credential the sync request actually authenticates
+  with, deferring to the server's own response when it can't be resolved offline
+
 ## v0.8.8
 
 - **Fix**: logout/whoami now detect JWT device-code sessions (#2578)

package/README.md

@@ -8,7 +8,7 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 
 ## Contents
 
-- [What's New](#whats-new-in-v088)
+- [What's New](#whats-new-in-v0810)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -16,7 +16,7 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.8.8
+## What's New in v0.8.10
 
 - **Multi-client targeting fixed across the board**: `install`, `list`, `remove`, `update`, `sync`, and `search -i`'s install action now all honor `SKILLSMITH_CLIENT`/`--client` consistently — previously several of these silently acted on the Claude Code directory regardless of the flag or env var.
 - **`update` no longer fails after a fresh install**: now resolves the installed skill's registry source from the manifest `install` already writes, instead of a dead-code path that could never find it.
@@ -59,7 +59,7 @@ npm update -g @skillsmith/cli
 npm install -g @skillsmith/cli@latest
 
 # Using npx always gets the latest
-npx @skillsmith/cli@latest sync
+npx @skillsmith/cli@latest --version
 ```
 
 ## Command Alias
@@ -432,12 +432,15 @@ skillsmith import --topic claude-skill --max 500
 
 ### sync
 
-Synchronize your local skill database with the live Skillsmith registry.
+Synchronize your local skill database with the live Skillsmith registry (Team+ tier). The registry holds hundreds of thousands of skills, so `sync` shows a live record count and asks for confirmation before downloading — pass `-y`/`--yes` to skip the prompt for scripted or automated use (e.g. running the CLI on a Team's own cloud instance to maintain a shared local mirror).
 
 ```bash
 # Sync skills from registry (differential - only changes)
 skillsmith sync
 
+# Skip the confirmation prompt (automation)
+skillsmith sync --yes
+
 # Force full sync (ignore last sync time)
 skillsmith sync --force
 
@@ -448,6 +451,7 @@ skillsmith sync --dry-run
 **Options:**
 - `-f, --force` - Force full sync, ignore last sync timestamp
 - `--dry-run` - Preview changes without writing to database
+- `-y, --yes` - Skip the confirmation prompt (for automation; also implied by `--json`)
 - `-d, --db <path>` - Database path
 - `--json` - Output results as JSON
 
@@ -489,7 +493,7 @@ Configure automatic sync settings.
 # Show current configuration
 skillsmith sync config --show
 
-# Enable automatic background sync
+# Enable automatic background sync (Team+ tier)
 skillsmith sync config --enable
 
 # Disable automatic sync
@@ -841,6 +845,8 @@ skillsmith search --interactive
 
 ### Keep Skills Up-to-Date
 
+`sync` and background auto-sync require Team+ tier — see [sync](#sync) above.
+
 ```bash
 # Sync with the live registry
 skillsmith sync

package/dist/.skillsmith-dist-hash

@@ -1 +1 @@
-93f1c12d37b8d391f5574a4964e52d2745aba0a8
+5992a78b8d7fefcc5366d7b1a8c3f83c07ad056e