@spardutti/claude-skills 2.44.3 → 2.45.0

package/README.md

@@ -162,6 +162,7 @@ Every install writes a manifest at `.claude/.claude-skills.json` recording what
 - **Pre-check what you already have** in the picker — re-running doubles as an update screen; toggle to add or remove.
 - **Detect stale items** — skills/commands renamed or removed from the catalog upstream are flagged, and the CLI offers to delete them.
 - **Never touch what it didn't install** — the manifest is the CLI's own record; hand-written skills are invisible to it and always safe.
+- **Gate your own skills** — list a hand-written skill under `"custom"` (`"custom": ["brand"]`) and the skill gate enforces its `gate-paths` like an installed one. The CLI keeps `"custom"` as written and never deletes those skills. Never add your own skill to `"skills"`: a sync deletes anything there that is not in the catalog.
 
 ```bash
 npx @spardutti/claude-skills --sync

package/hooks/skill-gate-automark.sh

@@ -24,9 +24,9 @@ SKILL_NAME=$(printf '%s' "$INPUT" | grep -o '"skill":"[^"]*"' | head -1 | sed 's
 if [ -n "$SKILL_NAME" ]; then
   # Sanitize: only allow [A-Za-z0-9_-] in the marker filename.
   SAFE_NAME=$(printf '%s' "$SKILL_NAME" | tr -cd 'A-Za-z0-9_-')
-  # Only skills the CLI installed get acked; built-ins and hand-made skills have no rules for us.
+  # Only skills the CLI installed, or the user listed under "custom", get acked.
   MANIFEST="$(dirname "$(cd "$(dirname "$0")" && pwd)")/.claude-skills.json"
-  if [ -n "$SAFE_NAME" ] && tr -d ' \n' 2>/dev/null < "$MANIFEST" | grep -o '"skills":\[[^]]*\]' | grep -q "\"$SAFE_NAME\""; then
+  if [ -n "$SAFE_NAME" ] && tr -d ' \n' 2>/dev/null < "$MANIFEST" | grep -oE '"(skills|custom)":\[[^]]*\]' | grep -q "\"$SAFE_NAME\""; then
     touch "/tmp/claude-skill-loaded-$KEY-$SAFE_NAME"
     # The ack path holds a key the model cannot know, so without this line its
     # first write is always denied just to learn it.

package/hooks/skill-gate.sh

@@ -116,7 +116,7 @@ MISSING=""
 ACKS=""
 MANIFESTS=""
 if [ -n "$TARGETS" ]; then
-  INSTALLED=$(tr -d ' \n' 2>/dev/null < "$PROJECT_DIR/.claude/.claude-skills.json" | grep -o '"skills":\[[^]]*\]')
+  INSTALLED=$(tr -d ' \n' 2>/dev/null < "$PROJECT_DIR/.claude/.claude-skills.json" | grep -oE '"(skills|custom)":\[[^]]*\]')
   MANIFESTS=$(find "$PROJECT_DIR" -maxdepth 4 \( -name node_modules -o -name .git -o -name .venv -o -name dist \) -prune -o \( -name package.json -o -name pyproject.toml -o -name requirements.txt \) -print 2>/dev/null)
 fi
 if [ -n "$TARGETS" ]; then
@@ -136,7 +136,7 @@ if [ -n "$TARGETS" ]; then
     SNAME=$(sed -n 's/^name:[[:space:]]*//p' "$SKILL_FILE" | head -1 | sed "$UNQUOTE")
     [ -z "$SPATHS" ] && continue
     [ -z "$SNAME" ] && continue
-    case "$INSTALLED" in *"\"$SNAME\""*) ;; *) continue ;; esac  # automark never marks a hand-made skill
+    case "$INSTALLED" in *"\"$SNAME\""*) ;; *) continue ;; esac  # automark marks only installed and custom skills
 
     HIT=""
     for G in $(printf '%s' "$SPATHS" | tr ',' ' '); do

package/lib/manifest.mjs

@@ -16,6 +16,7 @@ export async function readManifest(targetDir = process.cwd()) {
       skills: data.skills ?? [],
       commands: data.commands ?? [],
       agents: data.agents ?? [],
+      custom: data.custom ?? [],
     };
   } catch {
     return null; // no manifest — a pre-manifest project or a fresh install
@@ -23,15 +24,17 @@ export async function readManifest(targetDir = process.cwd()) {
 }
 
 // Record exactly what the CLI has installed. This is the CLI's source of truth —
-// it never deletes anything not listed here.
+// it never deletes anything not listed here. `custom` is the user's own gated skills, carried over untouched.
 export async function writeManifest(targetDir, { catalogVersion, skills, commands, agents }) {
   await mkdir(join(targetDir, ".claude"), { recursive: true });
+  const custom = (await readManifest(targetDir))?.custom ?? [];
   const data = {
     catalogVersion,
     installedAt: new Date().toISOString(),
     skills: [...new Set(skills)].sort(),
     commands: [...new Set(commands)].sort(),
     agents: [...new Set(agents)].sort(),
+    custom,
   };
   await writeFile(manifestPath(targetDir), JSON.stringify(data, null, 2) + "\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.44.3",
+  "version": "2.45.0",
   "description": "Guardrails for Claude Code — best-practice skills, planning commands, and delivery gates.",
   "type": "module",
   "repository": {