@ssheleg/make-skill 0.25.0 → 0.25.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## v0.25.1 — the rule keeps its default, and the family's exception is written down
+
+- **The same-name command rule now carries its recorded exception** (operator
+  decision, 2026-08-30: no renames anywhere in the family). The default in
+  `references/host-capabilities.md` is unchanged — never name a command after a
+  skill in the same plugin — and the one recorded exception is enumerated beside
+  it: the ssheleg family ships same-named commands deliberately (`task-pipeline`,
+  `project-audit`, `seo-aeo-audit`, `sheleg-design`, `agent-sync`, and
+  `super-ux`'s `vision` / `ux-foundation` / `ux-flows` / `ux-audit`), with the
+  cost stated rather than waived: the skill wins the trigger, and each command
+  stays an always-on token cost that may be unreachable in the picker.
+  `retrofit.md` item 14 and the Cursor rule teach the auditor the same path, so
+  family audits report ASY-02 / SEO-02 / TPA-02 / SHD-06 / SUX-03 as
+  *deliberate, recorded — no change needed* instead of open gaps. A collision
+  NOT on a dated, recorded exception list is still the gap the rule names.
+- **A hand-typed eval count drifted, exactly as this skill's own gotcha predicts**
+  (MSK-02). `test/evals/RESULTS.md` said "20 queries" and `SKILL-CARD.md` said
+  "20 trigger queries" over a `triggers.json` holding 22. Both corrected — and
+  both statements are now compared, not typed: `test/evals_validate.py` parses
+  RESULTS.md's stated counts against the artifacts and refuses a claim-free
+  RESULTS.md rather than passing vacuously, with negative self-tests planting an
+  off-by-one count and a claim-free file; `test/validate.py`'s counted-claims
+  sweep gains the `N trigger queries` / `N behavioural scenarios` patterns for
+  every other document. Both guards were watched failing against the real
+  20-vs-22 defect before the numbers were corrected.
+- The `SKILL.md` body is untouched on purpose: at ~4742/5000 tokens it has 8
+  tokens of headroom, so the whole amendment lives in the references.
+
 ## v0.25.0 — the installer refuses the shadow it documents, loudly
 
 - **The family audit of 2026-08-29 reproduced the shadow live:** a bare

package/cursor/rules/make-skill.mdc

@@ -140,7 +140,10 @@ through a quoted `"${CLAUDE_PLUGIN_ROOT}/…"` with a `timeout`; hook scripts ex
 0 silently when the event is not theirs and when the interpreter is missing;
 `PreToolUse` blocks (exit 2 sends stderr to the model), `PostToolUse` advises via
 `systemMessage`; plugin agents may not carry `hooks`, `mcpServers` or
-`permissionMode`; a command is never named after a skill in the same plugin.
+`permissionMode`; a command is never named after a skill in the same plugin —
+unless the collision is on the recorded, dated exception list in the skill's
+`references/host-capabilities.md` (the ssheleg family, operator decision
+2026-08-30), which an audit reports as deliberate and recorded, not as a gap.
 
 ## Hard rules
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/make-skill",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way — conformance to the Agent Skills open standard AND Anthropic's platform rules (front-matter limits, disclosure budgets, per-surface runtime limits, the Skills API, evals) plus the Claude Code plugin reference (manifest schemas, component layout, claude plugin validate --strict), marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, the review checklist for third-party skills, and MCP / A2A rules for protocol-connected skills. This package is the installer CLI.",
   "keywords": [
     "skill",

package/plugins/make-skill/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "make-skill",
   "displayName": "Make Skill",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way: conformance to the Agent Skills open standard, Anthropic's platform rules (surfaces, Skills API, evals) and the Claude Code plugin reference, marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, the review checklist for third-party skills, plus MCP / A2A references for protocol-connected skills.",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/make-skill/skills/make-skill/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: Authoring works on any agent. The bundled scripts/ need python3. Publishing steps need git, gh, node and npm; the plugin gates need the claude CLI. Not usable on the Claude API surface, which has no network and no runtime package install.
 metadata:
   author: ssheleg
-  version: "0.25.0"
+  version: "0.25.1"
   homepage: https://github.com/ssheleg/make-skill
 ---
 

package/plugins/make-skill/skills/make-skill/references/host-capabilities.md

@@ -143,7 +143,17 @@ body receives `$ARGUMENTS`. Two rules cost a debugging round each:
 
 - **Never name a command after a skill in the same plugin.** Commands are skills
   now: both claim `/<name>`, the skill wins, the command is unreachable always-on
-  cost visible only in `claude plugin details`.
+  cost visible only in `claude plugin details`. That is the default for every new
+  plugin. **One recorded exception (operator decision, 2026-08-30): the ssheleg
+  family ships same-named commands deliberately** — `task-pipeline`,
+  `project-audit`, `seo-aeo-audit`, `sheleg-design`, `agent-sync`, and
+  `super-ux`'s `vision`, `ux-foundation`, `ux-flows`, `ux-audit`. The cost is
+  accepted, not waived: the skill wins the trigger, and each command stays an
+  always-on token cost that may be unreachable in the picker. An audit that finds
+  a collision on this list reports it as *deliberate, recorded — no change
+  needed*; a collision NOT on a dated, recorded exception list is still the gap
+  this rule names. A rule's exception is enumerated, dated, and carries its cost
+  — never implied.
 - **Quote `argument-hint`.** Bare `[a | b]` is a YAML flow sequence; a comma
   inside it drops the entire frontmatter block, leaving a command with no
   description and no warning.
@@ -236,7 +246,8 @@ what the agent reads at the exact moment something is missing.
 - [ ] `PostToolUse` advises (`systemMessage`), `PreToolUse` blocks — not the reverse
 - [ ] Hook commands quote `"${CLAUDE_PLUGIN_ROOT}"` and set a `timeout`
 - [ ] Hook scripts are executable, have a shebang, and need no `jq`
-- [ ] No command named after a skill; every `argument-hint` quoted
+- [ ] No command named after a skill — or the collision is on a recorded, dated
+      exception list (see *Commands*); every `argument-hint` quoted
 - [ ] Plugin agents carry no `hooks` / `mcpServers` / `permissionMode`
 - [ ] Scripts are stdlib-only, inside the skill dir, invoked by a resolvable path
 - [ ] No command the agent is told to RUN contains `${CLAUDE_PLUGIN_ROOT}` — it is

package/plugins/make-skill/skills/make-skill/references/retrofit.md

@@ -125,8 +125,11 @@ Report the table before changing anything, then fix.
     MCP server: the degradation contract written in the body for all three axes
     (not Claude Code / recommended plugin absent / tool absent); hooks that
     exit 0 silently when the event is not theirs; `PostToolUse` advising rather
-    than blocking; commands quoted and never named after a skill; plugin agents
-    free of `hooks`, `mcpServers` and `permissionMode`.
+    than blocking; commands quoted and never named after a skill (a collision on
+    the recorded, dated exception list in `references/host-capabilities.md` —
+    the ssheleg family's same-named commands, operator decision 2026-08-30 — is
+    reported as *deliberate, recorded — no change needed*, not as a gap); plugin
+    agents free of `hooks`, `mcpServers` and `permissionMode`.
 
 ## Personal skills — the short form