@zibby/skill-ids 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zibby/skill-ids",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Single authoritative Zibby skill-id map (zero-dep leaf). The one source of truth for well-known skill ids — every consumer (agent-workflow, core, skills, backend, templates) imports it, so the ids can never drift.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -120,12 +120,13 @@ export const SKILL_IDS = Object.freeze({
   SOCIAL_CARD: 'social-card',
   // `code-scan` — AGENT-DRIVEN, stack-smart deterministic linter over a
   // checked-out repo (JS/TS→oxlint, …). Tier ① (fully local) → UNGATED. Opt-in.
-  // No-connection TOGGLEABLE (default ON). Backed by codeScanSkill.
+  // No-connection TOGGLEABLE, DEFAULT-ON (meta.defaultEnabled: seeded ON at
+  // deploy, still user-toggleable OFF). Backed by codeScanSkill.
   CODE_SCAN: 'code-scan',
   // `codebase-memory` — code-graph + semantic index over the checked-out repo,
   // backed by the codebase-memory-mcp binary BAKED INTO the agent image. Fully
-  // local → UNGATED. No-connection TOGGLEABLE (default ON). Opt-in. Backed by
-  // codebaseMemorySkill.
+  // local → UNGATED. No-connection TOGGLEABLE, DEFAULT-OFF (no meta.defaultEnabled
+  // — the user opts IN). Opt-in. Backed by codebaseMemorySkill.
   CODEBASE_MEMORY: 'codebase-memory',
   WORKFLOW_BUILDER: 'workflow-builder',
   // `trigger-agent` — the agent-callable `trigger_agent` MCP tool
@@ -167,7 +168,17 @@ export const SKILL_IDS = Object.freeze({
  *
  * Shape per id:
  *   { toggleable, requiresIntegration, tier, display:{ name, description },
- *     binary?:{ name, version, sha256 } }
+ *     defaultEnabled?, binary?:{ name, version, sha256 } }
+ *
+ * `defaultEnabled` (optional, boolean) — a GENERAL per-skill flag: when true, the
+ * skill is SEEDED ON at deploy (the platform ships it enabled; the user opts OUT,
+ * not in) while remaining user-toggleable OFF in the agent's Skills settings.
+ * ABSENT / false = default-OFF (the user opts IN). Only meaningful for
+ * `toggleable: true` skills (a non-toggleable skill's on/off isn't user-facing).
+ * The deploy-seed (backend marketplace deployWorkflow) unions every graph-declared
+ * defaultEnabled toggleable skill into a fresh deploy's allowlist; the deploy
+ * modal pre-checks them. e.g. `code-scan` is defaultEnabled (reviews should scan
+ * out of the box); `codebase-memory` is NOT (code-graph is opt-in for review).
  *
  * A skill absent from this map is "not toggleable" (the default for everything
  * except the two no-connection toggleable skills). Ids are append-only (see the
@@ -203,6 +214,9 @@ export const SKILL_META = deepFreeze({
   'code-scan': {
     toggleable: true,
     requiresIntegration: false,
+    // DEFAULT-ON: seeded into a fresh deploy's allowlist (reviews scan out of the
+    // box) but still user-toggleable OFF in the agent's Skills settings.
+    defaultEnabled: true,
     tier: 2,
     display: {
       name: 'Code scan',