@vruum/skills 0.6.16 → 0.6.17

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vruum",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "Vruum AI skills + remote MCP server for B2B GTM teams. Slash commands for outreach triage, engagement triage, pipeline filling, prospect enrichment, and reply diagnosis, paired with the full Vruum MCP tool surface over OAuth 2.1.",
   "author": {
     "name": "Vruum AI",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vruum",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "Vruum AI skills + remote MCP server for B2B GTM teams. Skills for outreach triage, engagement triage, pipeline filling, prospect enrichment, and reply diagnosis, paired with the full Vruum MCP tool surface over OAuth 2.1.",
   "author": {
     "name": "Vruum AI",

package/bin/vruum-skills-update-check

@@ -21,7 +21,9 @@ CONFIG_FILE="$STATE_DIR/config.yaml"
 REMOTE_URL="${VRUUM_REMOTE_URL:-https://registry.npmjs.org/@vruum/skills/latest}"
 
 # Force flag busts cache + snooze (used by /vruum-skills-upgrade directly)
+FORCE=0
 if [ "${1:-}" = "--force" ]; then
+  FORCE=1
   rm -f "$CACHE_FILE" "$SNOOZE_FILE"
 fi
 
@@ -75,6 +77,7 @@ if [ -f "$CACHE_FILE" ]; then
   case "$CACHED" in
     UP_TO_DATE*)        TTL=60 ;;
     UPGRADE_AVAILABLE*) TTL=720 ;;
+    CHECK_FAILED*)      TTL=30 ;;
     *)                  TTL=0 ;;
   esac
   STALE=$(find "$CACHE_FILE" -mmin +"$TTL" 2>/dev/null || true)
@@ -93,6 +96,12 @@ if [ -f "$CACHE_FILE" ]; then
           exit 0
         fi
         ;;
+      CHECK_FAILED*)
+        # Recent fetch failure cached — stay quiet and do NOT imply "up to
+        # date". Retry once the short TTL expires. A --force run never reaches
+        # here (it cleared the cache above), so it always re-fetches.
+        exit 0
+        ;;
     esac
   fi
 fi
@@ -100,13 +109,24 @@ fi
 # Step 5: slow path — fetch latest from npm registry.
 mkdir -p "$STATE_DIR"
 RESP="$(curl -fsSL --max-time 5 "$REMOTE_URL" 2>/dev/null || true)"
-# Extract "version":"X.Y.Z" without jq.
-REMOTE="$(echo "$RESP" | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"
+# Extract "version":"X.Y.Z" without jq. The trailing `|| true` is load-bearing
+# under `set -euo pipefail`: on a failed/empty fetch the grep matches nothing
+# and (with pipefail) the pipeline exits non-zero, which would errexit the whole
+# script mid-way — the original silent-failure path. Swallow it so REMOTE ends
+# up empty and the unreachable-registry branch below handles it deliberately.
+REMOTE="$(echo "$RESP" | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/' || true)"
 REMOTE="$(echo "$REMOTE" | tr -d '[:space:]')"
 
-# Reject anything that doesn't look like a semver number.
+# Registry unreachable or unparseable response. A failed fetch is NOT evidence
+# the local version is current — caching UP_TO_DATE here is the false-positive
+# that pinned a sandboxed client to a stale bundle: its forced check returned
+# nothing, which /vruum-skills-upgrade reads as "already on latest". Cache a
+# short-lived CHECK_FAILED marker so passive checks don't hammer the registry,
+# but never claim current. A forced check surfaces the failure so the user
+# knows it couldn't run (vs. a real up-to-date).
 if ! echo "$REMOTE" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
-  echo "UP_TO_DATE $LOCAL" > "$CACHE_FILE"
+  echo "CHECK_FAILED $LOCAL $(date +%s)" > "$CACHE_FILE"
+  if [ "$FORCE" = 1 ]; then echo "CHECK_FAILED $LOCAL"; fi
   exit 0
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vruum/skills",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "Vruum AI skills for Claude Code, Claude Desktop, Codex CLI, and any AI assistant with a skill directory. Slash commands for outreach triage, engagement triage, pipeline filling, prospect enrichment, and reply diagnosis. Pairs with the Vruum MCP server at https://api.vruum.ai/mcp.",
   "license": "MIT",
   "repository": {
@@ -42,5 +42,5 @@
     "outreach",
     "gtm"
   ],
-  "contentHash": "b8c87fc8fa92db1b14f993e7797fe6d7bd69ec24fec5fafa3256d346f7d0a0f9"
+  "contentHash": "ea6ebae97d7fd0f6f8ffe802a6634b495697627372def939359629ba6a0a0bee"
 }

package/skills/vruum-skills-upgrade/SKILL.md

@@ -67,10 +67,13 @@ Force a fresh check first, then run the flow above starting from Step 2:
 ~/.vruum/bin/vruum-skills-update-check --force
 ```
 
-If the forced check returns nothing, report `already on latest (v$(cat ~/.vruum/VERSION))` and exit.
+Interpret the forced check's output:
+- Returns nothing → genuinely up to date. Report `already on latest (v$(cat ~/.vruum/VERSION))` and exit.
+- `CHECK_FAILED <local>` → the registry could NOT be reached (network/sandbox), so we do **not** know if you're current. Report `upgrade check failed — couldn't reach the npm registry (network/sandbox); not necessarily on latest. Try again later or from an unsandboxed shell.` Do NOT claim "already on latest." (A forced check emits this whenever the fetch fails; a sandbox that blocks the registry is the common cause.)
+- `UPGRADE_AVAILABLE <old> <new>` → run the upgrade flow from Step 2.
 
 ## When something goes wrong
 
 - `npm install` fails with permissions → tell the user to re-run with `sudo` or fix their npm prefix. Don't auto-sudo.
 - `vruum-skills install` reports skipped skills → surface the conflict message verbatim; user needs to remove conflicting files.
-- Network failure on registry lookup → report `upgrade check failed, try again later` and continue with the original skill (don't block work on a transient fetch error).
+- Network failure on registry lookup → the forced check now emits `CHECK_FAILED <local>` (it no longer silently looks up to date). Report `upgrade check failed, try again later` and continue with the original skill (don't block work on a transient fetch error).