@vibe-agent-toolkit/cli 0.1.41-rc.5 → 0.1.41-rc.6

package/dist/utils/help-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"help-loader.js","sourceRoot":"","sources":["../../src/utils/help-loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,mCAAmC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEtD,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,qHAAqH;QACrH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO;;0BAEe,QAAQ;;EAEhC,YAAY;;;CAGb,CAAC;IACA,CAAC;AACH,CAAC"}
+{"version":3,"file":"help-loader.js","sourceRoot":"","sources":["../../src/utils/help-loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,mCAAmC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEtD,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,qHAAqH;QACrH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO;;0BAEe,QAAQ;;EAEhC,YAAY;;;CAGb,CAAC;IACA,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;IACtF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,IAAI,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,4EAA4E;YAC5E,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/utils/skill-packaging-config.d.ts

@@ -1,19 +1,28 @@
 /**
  * Shared helper for merging skill packaging config from VAT config YAML.
  *
- * Both `vat skills validate` and `vat skill review` need to merge
- * `skills.defaults` with per-skill overrides (`skills.config.<name>`) and
- * strip undefined values so the result satisfies `exactOptionalPropertyTypes`.
- * Centralized here so both call sites agree on semantics and we don't
- * duplicate the merge logic.
+ * Every lane that reasons about a skill — `vat skills build`, `vat skills validate`,
+ * `vat skill review`, `vat audit`, and the Claude plugin build — merges
+ * `skills.defaults` with per-skill overrides (`skills.config.<name>`) through THIS
+ * function, so no two lanes can disagree about a skill's effective config.
+ *
+ * Most fields are a shallow override: a per-skill value replaces the default
+ * outright. `files:` is the exception — see below.
  */
-import type { SkillPackagingConfig } from '@vibe-agent-toolkit/agent-skills';
+import { type SkillPackagingConfig } from '@vibe-agent-toolkit/agent-skills';
 /**
  * Merge defaults with per-skill overrides, dropping undefined values.
  *
  * Zod-inferred optional types surface explicit `undefined` which is not
  * assignable to optional-but-not-undefined properties — this helper strips
  * those so the returned config is type-clean.
+ *
+ * `files:` merges ADDITIVELY (defaults ∪ per-skill, per-skill winning on a
+ * duplicate dest) rather than being replaced, because a default `files:` entry is
+ * a project-wide artifact every skill needs, not a value a skill overrides by
+ * declaring one of its own. This was previously implemented only inside
+ * `vat skills build`, so the read-only lanes saw a DIFFERENT effective config than
+ * the build did — the exact class of divergence this module exists to prevent.
  */
 export declare function mergeSkillPackagingConfig(defaults: Record<string, unknown> | undefined, perSkillOverrides: Record<string, unknown> | undefined): SkillPackagingConfig;
 //# sourceMappingURL=skill-packaging-config.d.ts.map

package/dist/utils/skill-packaging-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packaging-config.d.ts","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACrD,oBAAoB,CAStB"}
+{"version":3,"file":"skill-packaging-config.d.ts","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACrD,oBAAoB,CAmBtB"}

package/dist/utils/skill-packaging-config.js

@@ -1,18 +1,28 @@
 /**
  * Shared helper for merging skill packaging config from VAT config YAML.
  *
- * Both `vat skills validate` and `vat skill review` need to merge
- * `skills.defaults` with per-skill overrides (`skills.config.<name>`) and
- * strip undefined values so the result satisfies `exactOptionalPropertyTypes`.
- * Centralized here so both call sites agree on semantics and we don't
- * duplicate the merge logic.
+ * Every lane that reasons about a skill — `vat skills build`, `vat skills validate`,
+ * `vat skill review`, `vat audit`, and the Claude plugin build — merges
+ * `skills.defaults` with per-skill overrides (`skills.config.<name>`) through THIS
+ * function, so no two lanes can disagree about a skill's effective config.
+ *
+ * Most fields are a shallow override: a per-skill value replaces the default
+ * outright. `files:` is the exception — see below.
  */
+import { mergeFilesConfig } from '@vibe-agent-toolkit/agent-skills';
 /**
  * Merge defaults with per-skill overrides, dropping undefined values.
  *
  * Zod-inferred optional types surface explicit `undefined` which is not
  * assignable to optional-but-not-undefined properties — this helper strips
  * those so the returned config is type-clean.
+ *
+ * `files:` merges ADDITIVELY (defaults ∪ per-skill, per-skill winning on a
+ * duplicate dest) rather than being replaced, because a default `files:` entry is
+ * a project-wide artifact every skill needs, not a value a skill overrides by
+ * declaring one of its own. This was previously implemented only inside
+ * `vat skills build`, so the read-only lanes saw a DIFFERENT effective config than
+ * the build did — the exact class of divergence this module exists to prevent.
  */
 export function mergeSkillPackagingConfig(defaults, perSkillOverrides) {
     const merged = { ...defaults, ...perSkillOverrides };
@@ -22,6 +32,14 @@ export function mergeSkillPackagingConfig(defaults, perSkillOverrides) {
             packagingConfig[key] = value;
         }
     }
+    const defaultFiles = defaults?.['files'];
+    const perSkillFiles = perSkillOverrides?.['files'];
+    if (defaultFiles !== undefined || perSkillFiles !== undefined) {
+        const mergedFiles = mergeFilesConfig(defaultFiles, perSkillFiles);
+        if (mergedFiles.length > 0) {
+            packagingConfig.files = mergedFiles;
+        }
+    }
     return packagingConfig;
 }
 //# sourceMappingURL=skill-packaging-config.js.map

package/dist/utils/skill-packaging-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packaging-config.js","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACrD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,eAA2C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"skill-packaging-config.js","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAA6B,MAAM,kCAAkC,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACrD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,eAA2C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAkC,CAAC;IAC1E,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAkC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,eAAe,CAAC,KAAK,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/docs/skill-test.md

@@ -64,14 +64,14 @@ Every field is optional; an omitted knob falls back to its default.
 | `maxBudgetUsd` | number > 0 | none | `--max-budget-usd <n>` | Hard USD budget cap passed to the CLI. |
 | `timeout` | integer, **seconds** | scales with eval count: ~`2min + 2min/eval`, floored at 5min, capped at 1h | `--timeout <s>` | Wall-clock timeout. An explicit value always overrides the scaled default. |
 | `stall` | integer, **seconds** | none | `--stall <s>` | Stall watchdog — kill the spawn after this long with no stream output. |
-| `evals` | string (path) | bootstrapped suite | `--evals <path>` | Path to `evals.json`, **relative to the skill source**. |
+| `evals` | string (path or npm specifier) | auto-detected `evals/evals.json` (see below) | `--evals <path>` | Which `evals.json` to grade against. `test.evals` resolves **relative to the skill source**; `--evals` resolves **relative to the current directory**. Either may be absolute, and either may be an npm bare specifier. An explicit value always wins over the default convention. |
 | `auth` | `inherit` \| `subscription` \| `api-key` \| `auto` | `inherit` | `--auth <mode>` | Auth mechanism for the spawned session. |
 | `requireAuth` | `subscription` \| `api-key` | none | `--require-auth <mech>` | Fail-fast guard: preflight exits `2` if the effective mechanism isn't this. |
 | `baseline` | boolean | `false` | `--baseline` | Run the opt-in with/without A/B skill-lift comparison. |
 | `skillCreator` | source descriptor | `{ vendored: true }` | — | Source for the vendored skill-creator rubric. |
 | `with` | array of source descriptors | none | `--with name=<src>` | **Required** companion skills staged alongside the subject, invocable by it. |
 | `optional` | array of source descriptors | none | `--with-optional name=<src>` | **Optional** companions — skipped with a warning if unresolvable. |
-| `env` | map string→string | none | `--env KEY=VALUE` | Env vars injected into the **executor** spawn. Values interpolate `${fixturesDir}`, `${stagedSkillDir}`, `${harnessRoot}`, `${resultsDir}`. Protected names (PATH, auth, model, admin) cannot be overridden. |
+| `env` | map string→string | none | `--env KEY=VALUE` | Env vars injected into the **executor** spawn. Values interpolate `${fixturesDir}`, `${stagedSkillDir}`, `${harnessRoot}`, `${resultsDir}`. `${fixturesDir}` is **per-eval** — it names that eval's own staged workspace (`fixtures/` under the executor's working directory), so the eval must declare input `files`; using it on an eval without them fails the run (exit 2). Protected names (PATH, auth, model, admin) cannot be overridden. |
 | `passEnv` | array of strings | none | `--pass-env KEY` | Names of host env vars to forward to the executor spawn if present. Protected names are ignored with a warning. |
 | `build` | string (shell command) | none | — | Command run **once, before staging**, to generate build artifacts. Runs with `cwd` = config root. A non-zero exit aborts the run (exit `2`). |
 
@@ -94,6 +94,50 @@ unbuilt source only when the failure is non-destructive. Each declared skill bui
 Staging the same name twice across the subject, `--with`, and `--with-optional` is a
 duplicate-name error (exit `2`).
 
+### The default eval-suite convention
+
+**You do not need a `test:` block to have an eval suite.** If a skill has a file at:
+
+```
+<skill-source-dir>/evals/evals.json
+```
+
+VAT treats that as the skill's suite — the same path `vat skill test run` has always defaulted to. Two things follow from it, and they are deliberately the same two things an explicit `test:` block would give you:
+
+1. `vat skill test run <skill>` finds and runs the suite.
+2. **The suite directory is excluded from packaged output.** It holds the `expected_output` / `expectations` answer key, so shipping it would both publish the answers and let a skill under test read its own key.
+
+This is **auto-detection, not a requirement**. It is keyed on the suite *file* existing:
+
+| On disk | Treated as a suite? |
+|---|---|
+| `<skill>/evals/evals.json` | **Yes** — run by the harness, excluded from the bundle |
+| `<skill>/evals/` with no `evals.json` | No — ordinary content, ships normally |
+| `<skill>/docs/evals/…` (any other location named `evals`) | No — ordinary content, ships normally |
+| No `evals/` directory at all | No — nothing happens, no error, no warning |
+
+A skill with no suite is completely unaffected: it packages exactly as it would have, with no error and nothing excluded. The convention never makes evals mandatory.
+
+**Set `test.evals` explicitly** when your suite lives anywhere else — a shared directory, a per-skill subdirectory (VAT's own repo uses `evals/<skill-name>/evals.json`), or outside the skill tree. An explicit path always overrides the convention.
+
+> Both lanes honor this. Before it was shared, the harness auto-detected the suite while the packager did not, so a skill relying on the default had its answer key published even though the harness was protecting it.
+
+### Testing a skill you did not author
+
+A correctly packaged skill ships **no** eval suite — the suite is the answer key, and excluding it from the bundle is the whole point of the convention above. So for any skill you install rather than write, there is nothing in its tree to grade against, and you have to supply the suite yourself:
+
+```bash
+vat skill test run npm:@vendor/their-skill \
+  --evals ./our-audit-corpus/their-skill.json \
+  --i-understand-this-runs-skill-code
+```
+
+`--evals` resolves against the directory you run it from, so the path means what you typed. It may point anywhere — including outside the skill's tree entirely, which is the normal case here. It also accepts an npm bare specifier (`--evals @acme/skill-evals/their-skill.json`), honoring that package's `exports` map, so a shared corpus can be distributed as a package.
+
+The suite is never copied into anything the executor can reach. Each eval's declared input `files` are resolved relative to the **suite's** directory and staged into that eval's own workspace, so fixtures travel with the suite rather than with the skill.
+
+> **On sensitive fixtures.** `workspaces/` and `results/` are created `0700`, so a fixture that was never in your repo is not left readable by other local users. That is necessary but **not** sufficient: `grading.json` quotes the executor transcript verbatim as evidence, so anything the skill *reads out of* a fixture is written into `results/` as text — and `results/` survives `--keep` by design. Treat the harness output as being as sensitive as the fixtures you feed it.
+
 ## Global knobs (top-level `test:`)
 
 | Config key | Type | Default | CLI flag | Purpose |
@@ -109,7 +153,7 @@ duplicate-name error (exit `2`).
 | `--no-build` | Stage existing `dist` instead of building. Errors if absent for the subject or a **required** companion; an optional companion falls back to raw source with a warning. |
 | `--refresh` | Force a full re-stage, ignoring existing staged content. |
 | `--keep` | Keep the harness directory after the run (needed to inspect `results/`). |
-| `--dry-run` | Assemble the command without spawning Claude. Note this **skips the build**, so it does not preview `files:` injection. |
+| `--dry-run` | Build and stage exactly as a real run would, then stop without spawning Claude — no session, no tokens. It **does build** (when `--i-understand-this-runs-skill-code` is passed), because the question a dry run answers is "what happens if I drop this flag", and a preview built from a stale `dist/` answers it wrongly. **Without** the acknowledgement it does not build — building runs the repo's `test.build` hook, an arbitrary shell command — so it falls back to an existing `dist/` and warns it may be stale. `--no-build` skips the build either way. |
 | `--out <dir>` / `--workdir <dir>` | Override the harness output / working directory. |
 | `--allow-eval-failure` | Opt out of fail-closed: exit `0` even when an eval fails. For interactive iteration. |
 | `--allow-unverified-skill-source` | Skip the vendored manifest integrity check. |

package/docs/skills.md

@@ -315,14 +315,22 @@ for terminology.
 
 **What it does:**
 1. Resolves the source (local directory, ZIP, .tgz, or npm package)
-2. Discovers one or more skills inside the source
+2. Discovers one or more skill directories inside the source
 3. Pre-validates every skill with `validateSkill()` — zero files written if validation fails
-4. Builds an install plan, detecting conflicts before touching the filesystem
-5. Copies skill(s) to the resolved platform directory (all-or-nothing semantics)
-6. Emits a YAML summary on stdout
+4. Reads each skill's declared name, which is the name it installs under
+5. Builds an install plan, detecting conflicts before touching the filesystem
+6. Copies skill(s) to the resolved platform directory (all-or-nothing semantics)
+7. Emits a YAML summary on stdout
 
 Both `--target` and `--scope` are **required** — there are no defaults.
 
+**Installed name:** a skill installs under the `name` its `SKILL.md` frontmatter
+declares — the same identity `vat skills build` and the plugin build key on — not
+the name of the directory it came from. A ZIP or npm source has no meaningful
+directory name to use. If two skills in one source declare the same name, the
+whole install fails rather than one silently overwriting the other. Use `--name`
+to override (single-skill sources only).
+
 **Supported Sources:**
 - **Local directory:** `./path/to/skill-dir` — must contain `SKILL.md` at root or in subdirectories
 - **Local ZIP file:** `./path/to/skill.zip` — extracted to a temp directory, then installed
@@ -354,6 +362,16 @@ Both `--target` and `--scope` are **required** — there are no defaults.
 | `windsurf` | `~/.codeium/windsurf/skills/` | `.windsurf/skills/` |
 | `agents` | `~/.agents/skills/` | `.agents/skills/` |
 
+These paths were last reviewed against vendor conventions on 2026-04-08 and are
+not verified at build or test time — the tests assert the table's shape, never
+that a path is where a platform actually looks. If a vendor moves its convention,
+installs land somewhere unread and every VAT check still passes. Re-check the
+vendor's documentation before relying on a non-`claude` target.
+
+**Visibility:** VAT's own inspection commands are Claude-scoped — `vat skills
+list --user` and `vat audit --user` read `~/.claude` only. A skill installed to
+any other target lands correctly but is invisible to them.
+
 **Exit Codes:**
 - `0` - Install successful (or dry-run complete)
 - `1` - Install error (validation failed, conflict without `--force`, source not found, bad target/scope)
@@ -438,6 +456,10 @@ for terminology.
 2. Reports validation status for each skill
 3. Shows skill metadata (name, description, path)
 
+The reported `name` is the one the skill's frontmatter declares — matching what
+`vat skills install` would install it as — falling back to the directory name
+only when the `SKILL.md` declares none.
+
 **Modes:**
 
 **Project mode (default):**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/cli",
-  "version": "0.1.41-rc.5",
+  "version": "0.1.41-rc.6",
   "description": "Command-line interface for vibe-agent-toolkit",
   "type": "module",
   "bin": {
@@ -41,16 +41,16 @@
   "//dependencies-note": "DO NOT add example agent packages or adopter packages here. Adopter packages (like vat-development-agents) depend on the CLI binary at build time — declaring them as deps creates a circular build dependency. They are built in a second turbo pass via package#task overrides in turbo.json.",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.71.2",
-    "@vibe-agent-toolkit/agent-config": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/agent-schema": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/agent-skills": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/claude-marketplace": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/discovery": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/gateway-mcp": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/rag": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/rag-lancedb": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/resources": "0.1.41-rc.5",
-    "@vibe-agent-toolkit/utils": "0.1.41-rc.5",
+    "@vibe-agent-toolkit/agent-config": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/agent-schema": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/agent-skills": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/claude-marketplace": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/discovery": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/gateway-mcp": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/rag": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/rag-lancedb": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/resources": "0.1.41-rc.6",
+    "@vibe-agent-toolkit/utils": "0.1.41-rc.6",
     "adm-zip": "^0.6.0",
     "commander": "^12.1.0",
     "picomatch": "^4.0.3",
@@ -65,7 +65,7 @@
     "@types/picomatch": "^4.0.2",
     "@types/semver": "^7.7.1",
     "@types/tar": "^6.1.13",
-    "@vibe-agent-toolkit/dev-tools": "0.1.41-rc.5",
+    "@vibe-agent-toolkit/dev-tools": "0.1.41-rc.6",
     "rimraf": "^6.0.1",
     "typescript": "^5.7.3",
     "vitest": "^3.2.4"