@vatio-ai/skills 1.6.0 → 1.9.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vatio",
   "description": "Build a Vatio agent from your coding agent, then fix what supervisors report and prove it with evals.",
-  "version": "1.6.0",
+  "version": "1.9.0",
   "author": { "name": "Vatio", "url": "https://vatio.ai" },
   "homepage": "https://vatio.ai/docs",
   "repository": "https://github.com/vatio-ai/skills",

package/README.md

@@ -38,6 +38,10 @@ Or in Claude Code, as a plugin:
 /plugin install vatio@vatio
 ```
 
+Claude Code does not update plugins from other people's marketplaces on its own:
+turn it on once in `/plugin` → **Marketplaces** → **vatio** → **Enable
+auto-update**, or run `claude plugin update vatio@vatio`.
+
 Your agent then uses them on its own when you ask it to build, improve or fix
 a Vatio agent, or to send the session to Vatio, or you can call them by name:
 `/vatio-init`, `/vatio-improve` and `/vatio-share-session`, or

package/bin/install.mjs

@@ -4,7 +4,7 @@
 //   .agents/skills/   Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode, Cline, Amp
 //   .claude/skills/   Claude Code, which does not read .agents/
 // Running it again overwrites the copies with this version's.
-import { cpSync, existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { cpSync, existsSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -35,6 +35,10 @@ if (!existsSync(root)) {
 }
 
 const source = join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+// Left next to each copy, so `vatio flags` can tell a project whose copies are
+// older than the published skills (cli/lib/skills-hint.mjs).
+const VERSION_FILE = ".vatio-skills-version";
+const { version } = JSON.parse(readFileSync(join(source, "..", "package.json"), "utf8"));
 // Skills this package used to ship under another name. Left in place, the old
 // copy would answer the same requests as the new one.
 const RENAMED = { "vatio-new": "vatio-init" };
@@ -46,6 +50,7 @@ for (const target of [".agents/skills", ".claude/skills"]) {
   for (const skill of skills) {
     const dest = join(root, target, skill);
     cpSync(join(source, skill), dest, { recursive: true, force: true });
+    writeFileSync(join(dest, VERSION_FILE), `${version}\n`);
     console.log(`  ${relative(process.cwd(), join(dest, "SKILL.md")) || dest}`);
   }
   for (const [old, current] of Object.entries(RENAMED)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/skills",
-  "version": "1.6.0",
+  "version": "1.9.0",
   "description": "Agent skills for building and improving a Vatio agent from your coding agent: Claude Code, Codex, Cursor, Gemini CLI, Copilot and any agent that reads SKILL.md",
   "keywords": [
     "vatio",

package/skills/vatio-share-session/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: vatio-share-session
+allowed-tools: AskUserQuestion
 description: Send this coding session to the Vatio team, so they can see where building or improving a Vatio agent got stuck. Use when the user asks to share, send or report this session (or "the conversation", "what we did") to Vatio, when the Vatio team asked them for it, when Vatio itself got in the way and they want the team to see exactly how, or when vatio-init or vatio-improve finish and say to offer it.
 ---
 
@@ -8,8 +9,10 @@ description: Send this coding session to the Vatio team, so they can see where b
 `vatio share-session` sends the Claude Code session you are running in: what
 the user asked, what you read and ran, and what came back. It leaves out
 images, replaces anything that looks like a key, token or password with
-`[REDACTED]`, and the home directory with `~`. Only the Vatio team reads it,
-to see where Vatio got in the way and fix it.
+`[REDACTED]`, email addresses and international phone numbers with `[EMAIL]`
+and `[PHONE]`, and the home directory with `~`. Only the Vatio team reads it,
+to see where Vatio got in the way and fix it; every read is logged, and it is
+deleted 30 days after it arrives (sooner on request to dpo@vatio.ai).
 
 It is sent in one of two ways: the user asked for it, or you offer it because
 `vatio-init` or `vatio-improve` just finished.
@@ -30,25 +33,35 @@ It is sent in one of two ways: the user asked for it, or you offer it because
    ```
 
    Tell them which session it is (the summary it prints), that it is the
-   whole conversation, and that the file is there if they want to read it.
+   whole conversation, what was hidden, how it is treated (only the Vatio
+   team reads it, every read is logged, deleted after 30 days), and that the
+   file is there if they want to read it.
 
 3. Ask whether to send it, once. It is their conversation: never send it on
    your own, even when the task seems to call for it.
 
-   When you are offering it, ask with three answers (in Claude Code, as a
-   multiple-choice question), for example: "Do you want to send this session
+   When you are offering it, ask with the **AskUserQuestion** tool, Claude
+   Code's own question, not in a message. One question, in the user's
+   language, header `Vatio`, for example: "Do you want to send this session
    to the Vatio team, so they can see where Vatio got in the way and improve
-   it?"
+   it?", with these options:
 
-   - **Send it**
-   - **Not now**: do nothing more. It will not be offered again for a week.
-   - **Don't ask again**: run
-     `npx @vatio-ai/cli@latest share-session --never`.
+   - **Send it** — "The whole conversation, as shown above. Only the Vatio
+     team reads it, and it is deleted after 30 days."
+   - **Send it with a comment** — "You say what got in the way, what you
+     expected, or anything else for the team."
+   - **Not now** — "It won't be offered again for a week."
+   - **Don't ask again** — "It won't be offered again."
 
-   In the same question, suggest they add feedback: what got in the way, what
-   they expected Vatio to do, or anything else they want the team to know.
-   It is optional — the session is what matters, and it goes fine on its own.
-   A no is a fine answer: do not insist.
+   **Send it with a comment**: ask for the comment in one plain message, then
+   send. A comment they type in the question's own text field instead (its
+   "Other" answer, or a note on an option) is their feedback too, unless it
+   says no. **Not now**: do nothing more. **Don't ask again**: run
+   `npx @vatio-ai/cli@latest share-session --never`. A no is a fine answer:
+   do not insist.
+
+   When the user asked for it themselves, just confirm in a message and
+   take any feedback they give.
 
 4. If they say to send it, send it. With their feedback, in their words, as
    they gave it:
@@ -70,6 +83,20 @@ It is sent in one of two ways: the user asked for it, or you offer it because
    give them the link it prints). Tell them it was sent and the number it
    printed.
 
+5. If a permission check refuses the command (Claude Code's auto mode can
+   treat it as sending data out), do not retry it or look for another way to
+   send it. Give the user the command to run in their own terminal, with the
+   session id from the summary, and their feedback in quotes at the end if
+   they gave some:
+
+   ```bash
+   npx @vatio-ai/cli@latest share-session --id SESSION_ID --yes
+   ```
+
+   When they say they ran it, check instead of asking:
+   `npx @vatio-ai/cli@latest share-session --list` marks a session that was
+   sent with `(sent #N, when)`. If it is not marked, it did not go.
+
 Only Claude Code sessions can be sent. In any other coding agent, do not offer
 it; when the user asks, write what happened instead:
 `npx @vatio-ai/cli@latest feedback "…"`.