drafted 1.11.12 → 1.11.13

package/agent-instructions/global.md

@@ -29,6 +29,8 @@ Skill rules:
 - Search skills before starting repeatable work: skill(action="search") or skill(action="list").
 - Load and follow relevant skills with skill(action="load"). Read supporting skill files when needed.
 - When the user asks to record, distill, create, save, install, or update a skill/procedure/SOP/checklist/method/protocol/playbook, create or update a Drafted skill for the org with skill tools.
+- Every skill has a portable part — its method, SKILL.md, and any script source — and that part always belongs in Drafted, not only in a local repo. When you build a runnable skill, push the source to Drafted (skill action="push", or skill action="add" for prose) and declare how to rebuild it in the skill's `setup:` frontmatter (e.g. ["npm ci"]) so any machine or agent can regenerate it. Do not leave a reusable skill authored only as local files when Drafted is connected.
+- Machine-specific build output (node_modules, downloaded browsers, compiled binaries) is never portable: build it into a `.skillinstall/` directory inside the skill. Drafted always strips `.skillinstall/` from a pushed bundle and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe stay in Drafted.
 - Improve skills when you find a better checklist, standard, or operating method.
 
 Project/producible rules:

package/cli/drafted.mjs

@@ -1828,7 +1828,7 @@ skillCmd
 function collectSkillTree(dir) {
   const root = resolve(dir);
   if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const SKIP_DIRS = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform']);
+  const SKIP_DIRS = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform', '.skillinstall']);
   let ignore = () => false;
   const ignPath = join(root, '.skillignore');
   if (existsSync(ignPath)) {
@@ -1854,9 +1854,25 @@ function collectSkillTree(dir) {
   return out;
 }
 
+// Ensure the pushed source tree's .gitignore excludes the rebuildable bundle dir,
+// so a skill's machine-specific build output (built into .skillinstall/ by its
+// `setup:` recipe) can never be committed. The server already strips .skillinstall/
+// from the bundle (skill-ingest DENY_DIRS) — this keeps the author's git clean too.
+// Idempotent; returns true only when it adds the entry.
+function ensureSkillInstallIgnored(dir) {
+  try {
+    const gi = join(dir, '.gitignore');
+    const existing = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (existing.split(/\r?\n/).some((l) => l.trim().replace(/\/$/, '') === '.skillinstall')) return false;
+    const body = existing && !existing.endsWith('\n') ? existing + '\n' : existing;
+    writeFileSync(gi, body + '.skillinstall/\n');
+    return true;
+  } catch { return false; }
+}
+
 skillCmd
   .command('push')
-  .description('Push a local source tree into a skill (bulk ingest; server strips artifacts + enforces caps)')
+  .description('Push a local source tree into a Drafted skill (bulk ingest). Stores the portable bits — SKILL.md, scripts, and the setup: recipe; build output is stripped server-side. Build machine-specific output into .skillinstall/ (auto-gitignored, always stripped) and declare its rebuild in setup:.')
   .option('--id <id>', 'skill id')
   .option('--slug <slug>', 'skill slug (resolved to id)')
   .requiredOption('--dir <dir>', 'local source tree to push')
@@ -1878,8 +1894,9 @@ skillCmd
     });
     const data = await res.json().catch(() => ({}));
     if (!res.ok) { emitSkillResult(opts.format, { status: 'error', id, error: data.error || `HTTP ${res.status}` }); process.exit(1); }
-    if (opts.format === 'json') console.log(JSON.stringify({ status: 'ok', id, hash: data.hash, count: data.count, stripped: data.stripped, files: data.files }));
-    else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}`);
+    const gitignored = ensureSkillInstallIgnored(opts.dir);
+    if (opts.format === 'json') console.log(JSON.stringify({ status: 'ok', id, hash: data.hash, count: data.count, stripped: data.stripped, gitignored, files: data.files }));
+    else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}${gitignored ? ', gitignored .skillinstall/' : ''}`);
   });
 
 program.parse();

package/install-mcp.sh

@@ -443,6 +443,8 @@ Skill rules:
 - Search skills before starting repeatable work: skill(action="search") or skill(action="list").
 - Load and follow relevant skills with skill(action="load"). Read supporting skill files when needed.
 - When the user asks to record, distill, create, save, install, or update a skill/procedure/SOP/checklist/method/protocol/playbook, create or update a Drafted skill for the org with skill tools.
+- Every skill has a portable part — its method, SKILL.md, and any script source — and that part always belongs in Drafted, not only in a local repo. When you build a runnable skill, push the source to Drafted (skill action="push", or skill action="add" for prose) and declare how to rebuild it in the skill's `setup:` frontmatter (e.g. ["npm ci"]) so any machine or agent can regenerate it. Do not leave a reusable skill authored only as local files when Drafted is connected.
+- Machine-specific build output (node_modules, downloaded browsers, compiled binaries) is never portable: build it into a `.skillinstall/` directory inside the skill. Drafted always strips `.skillinstall/` from a pushed bundle and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe stay in Drafted.
 - Improve skills when you find a better checklist, standard, or operating method.
 
 Project/producible rules:

package/mcp/server.mjs

@@ -2751,7 +2751,7 @@ tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions conn
 function collectSkillTreeForPush(dir) {
   const root = resolve(dir);
   if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const SKIP = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform']);
+  const SKIP = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform', '.skillinstall']);
   const NUL = String.fromCharCode(0);
   let ignore = () => false;
   const ign = join(root, '.skillignore');
@@ -2778,7 +2778,22 @@ function collectSkillTreeForPush(dir) {
   return out;
 }
 
-tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/guidelines agents can load and follow. Dispatch by `action`: search/load/list for discovery; history for a skill\'s version git-log; add/update/remove for org skills; fork/push for source-only skills; attach/detach for project binding; favorite/unfavorite for personal pins; read_file/update_file for supporting files inside a skill directory.', {
+// Ensure a pushed source tree's .gitignore excludes the rebuildable bundle dir, so
+// a skill's machine-specific build output (built into .skillinstall/ by its `setup:`
+// recipe) can never be committed. The server also strips .skillinstall/ from the
+// bundle (skill-ingest DENY_DIRS); this keeps the author's git clean. Idempotent.
+function ensureSkillInstallIgnored(dir) {
+  try {
+    const gi = join(dir, '.gitignore');
+    const existing = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (existing.split(/\r?\n/).some((l) => l.trim().replace(/\/$/, '') === '.skillinstall')) return false;
+    const body = existing && !existing.endsWith('\n') ? existing + '\n' : existing;
+    writeFileSync(gi, body + '.skillinstall/\n');
+    return true;
+  } catch { return false; }
+}
+
+tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/guidelines agents can load and follow. When you build a reusable skill, author it HERE — add for prose, push to ingest a local source tree — so its method and setup: recipe live in Drafted and any machine or agent can reuse it; keep only machine-specific build output local in .skillinstall/ (always stripped on push). Dispatch by `action`: search/load/list for discovery; history for a skill\'s version git-log; add/update/remove for org skills; fork/push for source-only skills; attach/detach for project binding; favorite/unfavorite for personal pins; read_file/update_file for supporting files inside a skill directory.', {
   action: z.enum([
     'search', 'load', 'list', 'history',
     'add', 'update', 'remove',
@@ -2805,7 +2820,7 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   org: z.string().optional().describe('[fork|push|update] resolve/fork into this Drafted org (id or name); scopes the request without switching the session'),
   setup: z.array(z.string()).optional().describe('[add|update] setup command(s) (in order) run on materialize to build a source-only skill, e.g. ["npm ci","npm run build"]'),
   files: z.array(z.object({ path: z.string(), content: z.string() })).optional().describe('[push] source files to push (path + UTF-8 content); server strips artifacts + enforces caps'),
-  dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs + .skillignore pre-filtered), server re-enforces'),
+  dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs, .skillinstall/, and .skillignore pre-filtered), server re-enforces. On push the dir\'s .gitignore is auto-updated to exclude .skillinstall/ (the rebuildable bundle).'),
   deleteMissing: z.boolean().optional().describe('[push] remove stored files not present in the pushed set'),
 }, async (args) => {
   try {
@@ -2952,7 +2967,9 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         let fileList = files;
         if (!fileList && dir) fileList = collectSkillTreeForPush(dir);
         if (!Array.isArray(fileList) || fileList.length === 0) throw new Error('files[] (non-empty) or dir required for action=push');
-        return ok(await api('POST', `/api/skills/${id}/files/bulk`, { files: fileList, deleteMissing: !!deleteMissing }, extra));
+        const pushed = await api('POST', `/api/skills/${id}/files/bulk`, { files: fileList, deleteMissing: !!deleteMissing }, extra);
+        if (dir) { try { if (ensureSkillInstallIgnored(dir)) pushed.gitignored = '.skillinstall/'; } catch { /* best-effort */ } }
+        return ok(pushed);
       }
       case 'attach': {
         const { skillId } = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.12",
+  "version": "1.11.13",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [