@ssheleg/make-skill 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v0.9.1 — 2026-08-05
+
+### Fixed
+- **The release checklist told agents to publish npm by hand.** Step 5 of the
+  recurring-release checklist in `distribution.md` said "npm publish if
+  applicable (human 2FA the first time)" — contradicting the launch checklist's
+  own step 9, which arms CI publishing precisely so that is the *last* manual
+  publish. A `v*` tag now publishes; manual publish is named as the fallback
+  for a repo that has not armed CI yet.
+- `CONTRIBUTING.md` carried the same stale instruction for the family
+  catalogue, and now points at `test/check_pins.py`, the registry comparison
+  `sshlg-skills` gained in v0.20.0.
+
 ## v0.9.0 — 2026-08-03
 
 The canon knew the Claude Code capability set and used none of it. This release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/make-skill",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way \u2014 conformance to the Agent Skills open standard AND Anthropic's platform rules (front-matter limits, disclosure budgets, per-surface runtime limits, the Skills API, evals) plus the Claude Code plugin reference (manifest schemas, component layout, claude plugin validate --strict), marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, the review checklist for third-party skills, and MCP / A2A rules for protocol-connected skills. This package is the installer CLI.",
   "keywords": [
     "skill",

package/plugins/make-skill/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "make-skill",
   "displayName": "Make Skill",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way: conformance to the Agent Skills open standard, Anthropic's platform rules (surfaces, Skills API, evals) and the Claude Code plugin reference, marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, the review checklist for third-party skills, plus MCP / A2A references for protocol-connected skills.",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/make-skill/skills/make-skill/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: Authoring works on any agent. The bundled scripts/ need python3. Publishing steps need git, gh, node and npm; the plugin gates need the claude CLI. Not usable on the Claude API surface, which has no network and no runtime package install.
 metadata:
   author: ssheleg
-  version: "0.9.0"
+  version: "0.9.1"
   homepage: https://github.com/ssheleg/make-skill
 ---
 

package/plugins/make-skill/skills/make-skill/references/distribution.md

@@ -306,8 +306,12 @@ claude plugin update <name>@<name>             # full id required
 4. Conventional commit; push; confirm CI `success`; tag `v<ver>` and push the tag;
    `gh release create` from the CHANGELOG section (or let the release workflow
    below do it).
-5. npm publish if applicable (human 2FA the first time); e2e `npx <name>@<ver>`
-   from a non-repo cwd.
+5. **npm publishes itself** once CI publishing is armed (launch checklist step
+   9): the `v*` tag triggers it, with provenance, skipping a version the
+   registry already has. A manual `npm publish` here is the fallback for a repo
+   that has not armed it yet — not the normal path, and leaving it as the
+   normal path is how a family ends up with a release step nobody performs and
+   everybody documents. Then e2e `npx <name>@<ver>` from a non-repo cwd.
 6. **Refresh THIS machine's global installs — always, as Definition of Done:**
    `claude plugin marketplace update <name>` → `claude plugin update
    <name>@<name>` → `npx skills update <name> --global --yes && rm -f