@skillsmith/cli 0.8.9 → 0.8.11

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@skillsmith/cli` are documented here.
 
 ## [Unreleased]
 
+## v0.8.11
+
+- **Fix**: SMI-6530 -- stop recommending bulk `skillsmith update` until the safety gate ships (#2801)
+- **Fix (data loss)**: `skillsmith update` writes only into the directory it compared and refuses
+  otherwise, so a skill can no longer be written into a differently named directory. Skills marked
+  local, and skills Skillsmith didn't install, are skipped before any source recovery or registry
+  lookup instead of being resolved and overwritten. `--dry-run` no longer writes the manifest. The
+  "no recorded registry source" hint no longer suggests `install --force` and names the skill by
+  its directory (SMI-6529).
+
+- **Security**: `skillsmith update --all` in CLI 0.8.8-0.8.10 can overwrite local edits in skill
+  directories that are git clones and can write into the wrong directory (SMI-6528). On those
+  versions, preview with `--dry-run` and update skills one at a time. This release includes the
+  install-layer fix (SMI-6529).
+
+## v0.8.10
+
+- **Fixed**: SMI-6472 -- `src/utils/skill-name.ts`'s re-export of `VALID_SKILL_NAME_RE`/`validateSkillName` now imports from the narrow `@skillsmith/core/utils/skill-name` subpath instead of the `@skillsmith/core` package barrel. The barrel import transitively pulled in `skill-installation.io.ts` -> `safe-fs.ts`'s `fs/promises` needs (`open`/`lstat`/`constants`), breaking `tests/create.test.ts`'s narrow `fs/promises` mock (`mkdir`/`writeFile`/`stat` only) with `[vitest] No "constants" export is defined on the "fs/promises" mock`. No behavior change — only the import path.
+
 ## v0.8.9
 
 - **Feature**: SMI-6343 Wave 3 -- tamper-check classification (#2710)

package/README.md

@@ -8,7 +8,7 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 
 ## Contents
 
-- [What's New](#whats-new-in-v089)
+- [What's New](#whats-new-in-v0811)
 - [Installation](#installation)
 - [Commands](#commands)
   - [inventory](#inventory)
@@ -16,7 +16,7 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 - [Examples](#examples)
 - [Privacy & Data Handling](#privacy--data-handling)
 
-## What's New in v0.8.9
+## What's New in v0.8.11
 
 - **Multi-client targeting fixed across the board**: `install`, `list`, `remove`, `update`, `sync`, and `search -i`'s install action now all honor `SKILLSMITH_CLIENT`/`--client` consistently — previously several of these silently acted on the Claude Code directory regardless of the flag or env var.
 - **`update` no longer fails after a fresh install**: now resolves the installed skill's registry source from the manifest `install` already writes, instead of a dead-code path that could never find it.
@@ -142,8 +142,8 @@ names, or `--all` — bare `skillsmith update` with none of those prints usage
 guidance instead of updating anything.
 
 ```bash
-# Update all skills
-skillsmith update --all
+# Preview what --all would change before applying it
+skillsmith update --all --dry-run
 
 # Update one skill
 skillsmith update skill-name
@@ -833,8 +833,8 @@ npm run dev
 ### Manage Skills
 
 ```bash
-# Update all installed skills
-skillsmith update --all
+# Preview updates to all installed skills, then update one at a time
+skillsmith update --all --dry-run
 
 # Remove a skill
 skillsmith remove community/old-skill

package/dist/.skillsmith-dist-hash

@@ -1 +1 @@
-f62a85156479633b6e42bda2582af08b36eacf4c
+9246e507770b63b57f5efbce668c7d37473dd1c6