@spardutti/claude-skills 2.13.0 → 2.14.0

package/README.md

@@ -51,7 +51,7 @@ The CLI will:
 
 ## Skill Catalog
 
-**13 skills**, grouped the same way the installer presents them.
+**14 skills**, grouped the same way the installer presents them.
 
 > [!NOTE]
 > Skills marked **📦 Bundle** ship a concise always-loaded entry point plus reference files Claude reads only when a task needs them — comprehensive coverage at a low context cost.
@@ -69,6 +69,7 @@ The CLI will:
 | Skill | What it covers |
 |-------|----------------|
 | `fastapi` 📦 | FastAPI — async correctness, `Annotated` dependency injection, `lifespan`, response models, testing with dependency overrides; bundle covers Pydantic, Alembic, Celery, and list endpoints (pagination/filtering/search/sorting) |
+| `express` 📦 | Express 5 — automatic async error forwarding, the four-argument error handler, named wildcards, `req.query` as a getter, validation at the boundary, thin routes, the helmet/CORS/rate-limit baseline; bundle covers tRPC v11 on Express |
 | `drf-best-practices` | Django REST Framework — thin serializers, service layer, queryset optimization, object-level permissions |
 | `drizzle-orm` | Drizzle ORM — schema design, identity columns, relations, migration safety, type inference |
 | `docker-best-practices` | Multi-stage builds, layer caching, security hardening, Compose Watch, health checks |
@@ -346,6 +347,7 @@ scripts/       validate-skills.mjs — checks skill length caps and reference in
                ship-gate-hook.sh — refuses git commit/push without a ship-gate receipt
                gauntlet-selftest.sh — 15 behavioural tests for the hook (runs on pre-push)
                gauntlet-survey.sh — what the hook would do in every repo under a directory
+               preflight.sh — everything that must pass before a release
 cli/           The npm installer (npx @spardutti/claude-skills); version in cli/package.json
 .husky/        pre-push hook running the skill validator
 package.json   Private dev-tooling package (claude-skills-dev) — not the published one
@@ -359,6 +361,9 @@ Skills live in `skills/<name>/SKILL.md`. Authoring conventions are in [CLAUDE.md
 - `SKILL.md` ≤ 350 lines; reference files ≤ 500 and need a `## Contents` TOC past 100 lines.
 - References are one level deep — `SKILL.md` links them, they don't link each other.
 - `npm run validate-skills` enforces this; it also runs on `pre-push`.
+- Before any release, run `bash scripts/preflight.sh` — validator, self-tests, a check that the
+  hook scripts embedded in the CLI still match `scripts/`, detection against every repo under
+  `~/projects`, and that the version is ahead of the registry. Do not publish while it is red.
 - Changing `scripts/gauntlet.sh`? Run `bash scripts/gauntlet-selftest.sh` (also on `pre-push`),
   and run `bash scripts/gauntlet-survey.sh ~/projects` before releasing. Detection is where
   this hook keeps breaking, because real repos are shaped in ways invented test repos aren't —

package/lib/setup-hook.mjs

@@ -941,6 +941,18 @@ export async function writeGauntletConf(targetDir, testCommand) {
   return confPath;
 }
 
+// Register the entry, or CORRECT the one already there. Skipping when a hook of
+// this name exists leaves an existing install pinned to whatever matcher it was
+// first written with — which is how the skill gates kept watching only
+// Write|Edit|MultiEdit after they learned to cover Bash.
+function upsert(list, filename, entry) {
+  const existing = list.find((e) => e.hooks?.some((h) => h.command?.endsWith(filename)));
+  if (!existing) return list.push(entry);
+  if (entry.matcher === undefined) delete existing.matcher;
+  else existing.matcher = entry.matcher;
+  existing.hooks = entry.hooks;
+}
+
 export async function setupHook(targetDir = process.cwd()) {
   const resolved = resolve(targetDir);
   const hooksDir = join(resolved, ".claude", "hooks");
@@ -1006,10 +1018,7 @@ export async function setupHook(targetDir = process.cwd()) {
   };
 
   if (Array.isArray(settings.hooks.PreToolUse)) {
-    const exists = settings.hooks.PreToolUse.some((entry) =>
-      entry.hooks?.some((h) => h.command?.endsWith(GATE_FILENAME))
-    );
-    if (!exists) settings.hooks.PreToolUse.push(gateEntry);
+    upsert(settings.hooks.PreToolUse, GATE_FILENAME, gateEntry);
   } else {
     settings.hooks.PreToolUse = [gateEntry];
   }
@@ -1020,10 +1029,7 @@ export async function setupHook(targetDir = process.cwd()) {
     matcher: "Write|Edit|MultiEdit|Bash",
     hooks: [{ type: "command", command: applicationCommand }],
   };
-  const applicationAlreadyRegistered = settings.hooks.PreToolUse.some((entry) =>
-    entry.hooks?.some((h) => h.command?.endsWith(APPLICATION_GATE_FILENAME))
-  );
-  if (!applicationAlreadyRegistered) settings.hooks.PreToolUse.push(applicationEntry);
+  upsert(settings.hooks.PreToolUse, APPLICATION_GATE_FILENAME, applicationEntry);
 
   // Register PreToolUse ship-gate receipt check on Bash.
   const shipGateCommand = `$CLAUDE_PROJECT_DIR/.claude/hooks/${SHIP_GATE_HOOK_FILENAME}`;
@@ -1031,10 +1037,7 @@ export async function setupHook(targetDir = process.cwd()) {
     matcher: "Bash",
     hooks: [{ type: "command", command: shipGateCommand }],
   };
-  const shipGateRegistered = settings.hooks.PreToolUse.some((entry) =>
-    entry.hooks?.some((h) => h.command?.endsWith(SHIP_GATE_HOOK_FILENAME))
-  );
-  if (!shipGateRegistered) settings.hooks.PreToolUse.push(shipGateEntry);
+  upsert(settings.hooks.PreToolUse, SHIP_GATE_HOOK_FILENAME, shipGateEntry);
 
   // Register PostToolUse auto-mark on Skill.
   const autoMarkCommand = `$CLAUDE_PROJECT_DIR/.claude/hooks/${AUTO_MARK_FILENAME}`;
@@ -1044,10 +1047,7 @@ export async function setupHook(targetDir = process.cwd()) {
   };
 
   if (Array.isArray(settings.hooks.PostToolUse)) {
-    const exists = settings.hooks.PostToolUse.some((entry) =>
-      entry.hooks?.some((h) => h.command?.endsWith(AUTO_MARK_FILENAME))
-    );
-    if (!exists) settings.hooks.PostToolUse.push(autoMarkEntry);
+    upsert(settings.hooks.PostToolUse, AUTO_MARK_FILENAME, autoMarkEntry);
   } else {
     settings.hooks.PostToolUse = [autoMarkEntry];
   }
@@ -1057,10 +1057,7 @@ export async function setupHook(targetDir = process.cwd()) {
   const gauntletEntry = { hooks: [{ type: "command", command: gauntletCommand }] };
 
   if (Array.isArray(settings.hooks.Stop)) {
-    const exists = settings.hooks.Stop.some((entry) =>
-      entry.hooks?.some((h) => h.command?.endsWith(GAUNTLET_FILENAME))
-    );
-    if (!exists) settings.hooks.Stop.push(gauntletEntry);
+    upsert(settings.hooks.Stop, GAUNTLET_FILENAME, gauntletEntry);
   } else {
     settings.hooks.Stop = [gauntletEntry];
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "CLI to install Claude Code skills from the claude-skills collection",
   "type": "module",
   "bin": {