@vatio-ai/skills 1.24.0 → 1.26.0

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "vatio",
       "source": "./",
       "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
-      "version": "1.24.0",
+      "version": "1.25.0",
       "homepage": "https://vatio.ai/docs/integrations/claude-code",
       "category": "development",
       "keywords": [

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vatio",
   "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "author": {
     "name": "Vatio",
     "url": "https://vatio.ai"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/skills",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
   "keywords": [
     "vatio",

package/skills/vatio-add-to-app/SKILL.md

@@ -50,8 +50,10 @@ SDK, Android SDK, Flutter SDK, Authentication, Supabase) have the details.
    app's backend signs the visitor token, and the private key never goes into
    the app.
 6. **Try it in a development build**, signed out and signed in, then say what
-   you added and where each token lives. Release builds answer once the agent
-   is published: `vatio publish` only when they ask.
+   you added and where each token lives. While the workspace is a draft
+   (nobody outside the team has talked to the agent yet) live follows every
+   push, so release builds answer right away; after that they answer with
+   what is published, and `vatio publish` runs only when they ask.
 
 ## Before you finish
 
@@ -61,7 +63,12 @@ Code, offer to send this session to the Vatio team, as the
 `vatio-share-session` skill says; if `vatio share-session --should-ask` prints
 `no`, say nothing.
 
-`vatio` is `npx @vatio-ai/cli` when it is not installed globally.
+There are two ways to run the CLI, and the package name appears once in
+either: `vatio ARGS` when it is installed globally, and
+`npx @vatio-ai/cli@latest ARGS` when it is not. Pick one per command and
+leave it whole — `npx @vatio-ai/cli @vatio-ai/cli push` is the commonest way
+to get this wrong, and the CLI reads the second name as the command and
+fails.
 
 A command you hand the developer to run themselves, because a permission
 check refused it or it needs their own credentials, says

package/skills/vatio-improve/SKILL.md

@@ -63,7 +63,9 @@ In short:
    marked "not tested (Vatio's side)" says nothing about your fix: run
    `vatio test --wait` again. Name reports by id (`F-7K2QX`).
 5. Show the developer what passes now, and `vatio publish` once they agree:
-   it changes what visitors get. If it is refused, follow its message: it
+   it changes what visitors get. In a draft (no conversation from outside
+   the team yet) live already runs every push, and `vatio publish` says
+   there is nothing to publish. If it is refused, follow its message: it
    says what to run. Never pass `--force` unless the developer explicitly
    asks for it.
 6. If the digest, an error or the docs left you guessing, say so:
@@ -73,8 +75,12 @@ In short:
    `vatio share-session --should-ask`: if that prints `no`, say nothing.
 
 `vatio docs` prints the whole contract (manifest, tools, knowledge, CLI) if
-the fix needs more than the digest says. If `vatio` is not installed, use
-`npx @vatio-ai/cli` in its place; if it says to log in, run `vatio login`: it
+the fix needs more than the digest says. There are two ways to run the CLI,
+and the package name appears once in either: `vatio ARGS` when it is
+installed globally, and `npx @vatio-ai/cli@latest ARGS` when it is not. Pick
+one per command and leave it whole — `npx @vatio-ai/cli @vatio-ai/cli flags`
+is the commonest way to get this wrong, and the CLI reads the second name as
+the command and fails. If it says to log in, run `vatio login`: it
 opens the browser on the developer's machine (if it doesn't, give them the
 link it prints), and they sign in and check the code matches. If it times
 out, run it again after they have signed in.

package/skills/vatio-init/SKILL.md

@@ -46,10 +46,22 @@ you recommend, and ask them to confirm.
      team when a person should take over: **Human in the loop** in the docs).
   3. `vatio diff`, `vatio push`, then try it with `vatio chat`, including a
      conversation that should hand off.
-  4. Give them the link `vatio push` prints after `Try it:` (the inbox's
+  4. **Keep the replies that came out right.** For each one,
+     `vatio test add "what the answer has to say"` right after the
+     `vatio chat` that produced it. Three or four is enough to start. This is
+     the only thing that makes a later version's mistake visible: `vatio
+     test` replays them on every push, and once the workspace is published
+     `vatio publish` refuses a version that breaks one. A workspace with no
+     tests publishes with nothing checked, which is how a fix for one
+     question quietly breaks another.
+  5. Give them the link `vatio push` prints after `Try it:` (the inbox's
      Test page, with web chat, WhatsApp and Instagram) with what you
-     tried. Publish with `vatio publish` only when they ask.
-  5. Once they have tried it, offer to put it in the app (the web widget,
+     tried. Until someone outside their team talks to the agent the
+     workspace is a draft: `vatio push` is the deploy, so there is nothing to
+     publish yet and you need not explain preview and live. Every push says
+     which of the two states the workspace is in; once it says visitors still
+     get an older version, publish with `vatio publish` only when they ask.
+  6. Once they have tried it, offer to put it in the app (the web widget,
      or the iOS, Android or Flutter SDK) with the `vatio-add-to-app` skill.
 - **A `vatio.yml`: the agent exists.** Never `vatio init` here: it writes a
   starter agent, and pushing that replaces the real one. Work from the
@@ -95,7 +107,12 @@ that same section.
    the `vatio-share-session` skill says. It starts with
    `vatio share-session --should-ask`: if that prints `no`, say nothing.
 
-`vatio` is `npx @vatio-ai/cli` when it is not installed globally. The first
+There are two ways to run the CLI, and the package name appears once in
+either: `vatio ARGS` when it is installed globally, and
+`npx @vatio-ai/cli@latest ARGS` when it is not. Pick one per command and
+leave it whole — `npx @vatio-ai/cli @vatio-ai/cli push` is the commonest way
+to get this wrong, and the CLI reads the second name as the command and
+fails. The first
 `vatio push` (or `vatio login`) signs the developer in: it opens the browser
 on their machine (if it doesn't, give them the link it prints). Tell them to
 sign in with email, Google or GitHub and check that the code on the page
@@ -111,3 +128,10 @@ another (a token into a secrets store), take it with `--json` and chain with
 empty value. If Claude Code's auto mode refused a `vatio` command and the
 project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
 **Auto mode** on the docs' Claude Code page.
+
+A **secret** is not one of those commands, as long as you do not read it.
+`vatio secrets set KEY --from-env` takes the value from their shell or the
+`.env` beside the `vatio.yml` and sends it without printing it, so run that
+yourself rather than stopping to ask. Ask them only for a value that is not
+there yet, and never echo one back, put one in a file you write, or read a
+`.env` to quote it.