happyskills 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-03-04
+
+### Added
+- Add `bump` command to increment a skill's version (`patch`, `minor`, `major`, or explicit semver) and update `skills-lock.json` accordingly
+- Add `convert` command to turn an external Claude Code skill (with `SKILL.md` but no registry presence) into a managed HappySkills package — reads frontmatter, generates `skill.json`, publishes, and moves the skill to a namespaced directory
+- Add universal `--json` flag across all 14 commands for structured output (`{ data }` / `{ error }`) enabling LLM and agent automation
+- Add `login --browser` and `login --password` flags to skip the interactive flow selector
+- Add device authorization (browser) flow for `login` — opens a browser tab and polls until the user approves; supports MFA
+- Add `@version` inline install syntax (e.g., `happyskills install acme/skill@1.2.0`)
+- Add `@latest` special version for `install` to force the newest published version, bypassing the lock skip check
+- Add `keywords` field to skill scaffolding in `init` and `convert`
+- Add S3 pre-signed upload path for large skills (5 MB – 10 MB); small skills (< 5 MB) continue to use the direct JSON upload
+- Add display of external Claude Code skills in `list` output — unregistered skills with a `SKILL.md` are shown with source `external`
+- Add token auto-refresh: sessions are transparently renewed using the Cognito `refresh_token` when the access token expires
+- Add error log files written to `~/.config/happyskills/logs/` on non-usage errors, with the log path printed in the terminal
+
+### Changed
+- Change skill install directory from nested `owner/name` to flat `name` (e.g., `.claude/skills/deploy-aws/` instead of `.claude/skills/acme/deploy-aws/`)
+- Change `install` without arguments to fall back to `skills-lock.json` when no `skill.json` is present in the current directory
+
+### Fixed
+- Fix duplicate skill entries appearing in `list` output
+
 ## [0.1.0] - 2026-02-28
 
 ### Added

package/README.md

@@ -39,6 +39,7 @@ happyskills publish
 | `check [owner/skill]` | Check for available updates |
 | `update [owner/skill]` | Upgrade to latest compatible versions |
 | `publish` | Push the current skill to the registry |
+| `convert <skill-name>` | Convert an external Claude Code skill into a managed HappySkills package |
 | `fork <owner/skill>` | Fork a skill to your workspace |
 | `login` | Authenticate with the registry |
 | `logout` | Clear stored credentials |
@@ -63,7 +64,7 @@ happyskills publish
 | `--version` | Show CLI version |
 | `-g`, `--global` | Use global scope (`~/.claude/skills/`) |
 | `-y`, `--yes` | Skip confirmation prompts |
-| `--json` | Output as JSON (supported by `list`, `search`, `check`, `whoami`) |
+| `--json` | Output as JSON (all commands) |
 
 ## License
 

package/bin/happyskills.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 
-try { require('dotenv').config({ path: require('path').join(__dirname, '..', '.env') }) } catch {}
+try { require('dotenv').config({ path: require('path').join(__dirname, '..', '.env'), quiet: true }) } catch {}
 const { run } = require('../src/index')
 run(process.argv.slice(2))

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.1.0",
+	"version": "0.2.0",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",
@@ -17,11 +17,26 @@
 	"bugs": {
 		"url": "https://github.com/cloudlesslabs/skillsbang/issues"
 	},
-	"keywords": ["cli", "skills", "package-manager", "ai", "claude", "agent", "dependency-resolution"],
-	"files": ["bin/", "src/", "LICENSE", "CHANGELOG.md"],
+	"keywords": [
+		"cli",
+		"skills",
+		"package-manager",
+		"ai",
+		"claude",
+		"agent",
+		"dependency-resolution"
+	],
+	"files": [
+		"bin/",
+		"src/",
+		"LICENSE",
+		"CHANGELOG.md"
+	],
 	"scripts": {
 		"dev": "node bin/happyskills.js",
 		"test": "node --test src/**/*.test.js",
+		"test:unit": "node --test $(find src -name '*.test.js' ! -path '*/integration/*')",
+		"test:integration": "node --test src/integration/cli.test.js",
 		"release": "./scripts/release.sh"
 	},
 	"engines": {

package/src/api/auth.js

@@ -3,38 +3,44 @@ const client = require('./client')
 
 const login = (email, password) => catch_errors('Login failed', async () => {
 	const [errors, data] = await client.post('/auth/login', { email, password }, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const signup = (email, password) => catch_errors('Signup failed', async () => {
 	const [errors, data] = await client.post('/auth/signup', { email, password }, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const confirm = (email, code) => catch_errors('Confirmation failed', async () => {
 	const [errors, data] = await client.post('/auth/confirm', { email, code }, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const resend_code = (email) => catch_errors('Resend code failed', async () => {
 	const [errors, data] = await client.post('/auth/resend-code', { email }, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const device_start = () => catch_errors('Device auth start failed', async () => {
 	const [errors, data] = await client.post('/auth/device/start', {}, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const device_token = (device_code) => catch_errors('Device auth token failed', async () => {
 	const [errors, data] = await client.post('/auth/device/token', { device_code }, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
-module.exports = { login, signup, confirm, resend_code, device_start, device_token }
+const refresh = (refresh_token) => catch_errors('Token refresh failed', async () => {
+	const [errors, data] = await client.post('/auth/refresh', { refresh_token }, { auth: false })
+	if (errors) throw errors[errors.length - 1]
+	return data
+})
+
+module.exports = { login, signup, confirm, resend_code, device_start, device_token, refresh }

package/src/api/push.js

@@ -0,0 +1,63 @@
+const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
+const repos_api = require('./repos')
+const { initiate_upload, complete_upload, upload_files_parallel } = require('./upload')
+
+const DIRECT_PUSH_THRESHOLD = 5 * 1024 * 1024 // 5MB
+
+const estimate_payload_size = (files) => {
+	let size = 0
+	for (const file of files) {
+		size += file.content.length + file.path.length + 100 // base64 content + path + JSON overhead
+	}
+	return size
+}
+
+const smart_push = (owner, repo, { version, message, files }, on_progress) =>
+	catch_errors('Smart push failed', async () => {
+		const payload_size = estimate_payload_size(files)
+
+		if (payload_size < DIRECT_PUSH_THRESHOLD) {
+			// Small payload — use direct push
+			const [err, data] = await repos_api.push(owner, repo, { version, message, files })
+			if (err) throw e('Direct push failed', err)
+			return data
+		}
+
+		// Large payload — use presigned upload flow
+		const file_meta = files.map(f => ({ path: f.path, sha: f.sha, size: f.size }))
+
+		// Step 1: Initiate
+		const [init_err, init_data] = await initiate_upload(owner, repo, {
+			version, message, files: file_meta
+		})
+		if (init_err) throw e('Upload initiation failed', init_err)
+
+		const { upload_id, presigned_urls } = init_data
+
+		// Step 2: Upload files to S3 (deduplicated by SHA)
+		const seen_shas = new Set()
+		const files_to_upload = []
+		for (const file of files) {
+			if (seen_shas.has(file.sha)) continue
+			seen_shas.add(file.sha)
+			const url = presigned_urls[file.sha]
+			if (!url) throw new Error(`No presigned URL for file ${file.path} (sha: ${file.sha})`)
+			files_to_upload.push({
+				buffer: Buffer.from(file.content, 'base64'),
+				url
+			})
+		}
+
+		const [upload_err] = await upload_files_parallel(files_to_upload, on_progress)
+		if (upload_err) throw e('File uploads failed', upload_err)
+
+		// Step 3: Complete
+		const [complete_err, complete_data] = await complete_upload(owner, repo, {
+			upload_id, version, message, files: file_meta
+		})
+		if (complete_err) throw e('Upload completion failed', complete_err)
+
+		return complete_data
+	})
+
+module.exports = { smart_push }

package/src/api/repos.js

@@ -6,38 +6,38 @@ const search = (query, options = {}) => catch_errors('Search failed', async () =
 	if (options.limit) params.set('limit', options.limit)
 	if (options.offset) params.set('offset', options.offset)
 	const [errors, data] = await client.get(`/repos/search?${params}`, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const resolve_dependencies = (skill, version, installed = {}) => catch_errors('Dependency resolution failed', async () => {
 	const [errors, data] = await client.post('/repos:resolve-dependencies', { skill, version, installed })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const clone = (owner, repo, ref) => catch_errors(`Clone ${owner}/${repo} failed`, async () => {
 	const params = ref ? `?ref=${encodeURIComponent(ref)}` : ''
 	const [errors, data] = await client.get(`/repos/${owner}/${repo}/clone${params}`)
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const push = (owner, repo, body) => catch_errors(`Push to ${owner}/${repo} failed`, async () => {
 	const [errors, data] = await client.post(`/repos/${owner}/${repo}/push`, body)
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const get_refs = (owner, repo) => catch_errors(`Get refs for ${owner}/${repo} failed`, async () => {
 	const [errors, data] = await client.get(`/repos/${owner}/${repo}/refs`)
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 
 const get_repo = (owner, repo) => catch_errors(`Get repo ${owner}/${repo} failed`, async () => {
 	const [errors, data] = await client.get(`/repos/${owner}/${repo}`, { auth: false })
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 

package/src/api/upload.js

@@ -0,0 +1,48 @@
+const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
+const client = require('./client')
+
+const CONCURRENT_UPLOADS = 5
+
+const initiate_upload = (owner, repo, body) => catch_errors('Initiate upload failed', async () => {
+	const [errors, data] = await client.post(`/repos/${owner}/${repo}/push/initiate`, body)
+	if (errors) throw errors[errors.length - 1]
+	return data
+})
+
+const complete_upload = (owner, repo, body) => catch_errors('Complete upload failed', async () => {
+	const [errors, data] = await client.post(`/repos/${owner}/${repo}/push/complete`, body)
+	if (errors) throw errors[errors.length - 1]
+	return data
+})
+
+const upload_file_to_s3 = (presigned_url, buffer) => catch_errors('S3 upload failed', async () => {
+	const res = await fetch(presigned_url, {
+		method: 'PUT',
+		body: buffer,
+		headers: { 'Content-Length': buffer.length.toString() }
+	})
+	if (!res.ok) {
+		throw new Error(`S3 PUT failed with status ${res.status}`)
+	}
+})
+
+const upload_files_parallel = (files_with_urls, on_progress) => catch_errors('Parallel upload failed', async () => {
+	let completed = 0
+	const total = files_with_urls.length
+
+	const run_batch = async (batch) => {
+		await Promise.all(batch.map(async ({ buffer, url }) => {
+			const [err] = await upload_file_to_s3(url, buffer)
+			if (err) throw e('File upload failed', err)
+			completed++
+			if (on_progress) on_progress(completed, total)
+		}))
+	}
+
+	for (let i = 0; i < files_with_urls.length; i += CONCURRENT_UPLOADS) {
+		const batch = files_with_urls.slice(i, i + CONCURRENT_UPLOADS)
+		await run_batch(batch)
+	}
+})
+
+module.exports = { initiate_upload, complete_upload, upload_file_to_s3, upload_files_parallel }

package/src/api/workspaces.js

@@ -3,7 +3,7 @@ const client = require('./client')
 
 const list_workspaces = () => catch_errors('List workspaces failed', async () => {
 	const [errors, data] = await client.get('/workspaces')
-	if (errors) throw errors[0]
+	if (errors) throw errors[errors.length - 1]
 	return data
 })
 

package/src/auth/token_store.js

@@ -3,6 +3,20 @@ const path = require('path')
 const { error: { catch_errors } } = require('puffy-core')
 const { credentials_path, config_dir } = require('../config/paths')
 
+const _try_refresh = async (refresh_token) => {
+	try {
+		const { refresh } = require('../api/auth')
+		const [errors, data] = await refresh(refresh_token)
+		if (errors || !data) return null
+		const merged = { ...data, refresh_token }
+		const [save_err] = await save_token(merged)
+		if (save_err) return null
+		return { ...merged, stored_at: new Date().toISOString() }
+	} catch {
+		return null
+	}
+}
+
 const save_token = (token_data) => catch_errors('Failed to save token', async () => {
 	const creds_path = credentials_path()
 	const dir = config_dir()
@@ -40,6 +54,10 @@ const load_token = () => catch_errors('Failed to load token', async () => {
 		const now = Date.now()
 		const elapsed_sec = (now - stored) / 1000
 		if (elapsed_sec >= data.expires_in) {
+			if (data.refresh_token) {
+				const refreshed = await _try_refresh(data.refresh_token)
+				if (refreshed) return refreshed
+			}
 			await clear_token()
 			return null
 		}

package/src/auth/token_store.test.js

@@ -0,0 +1,202 @@
+'use strict'
+const { describe, it, before, after, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+const os = require('os')
+const path = require('path')
+const fs = require('fs')
+
+// ─────────────────────────────────────────────────────────────────────────────
+// token_store reads XDG_CONFIG_HOME lazily (at call time) via config/paths.js,
+// so we can control the credentials location by setting the env var before each
+// test. The module itself can be required once at the top.
+// ─────────────────────────────────────────────────────────────────────────────
+
+const { save_token, load_token, clear_token, require_token } = require('./token_store')
+const { AuthError } = require('../utils/errors')
+
+// ─── helpers ──────────────────────────────────────────────────────────────────
+
+const make_tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'hs-token-test-'))
+const cleanup = (dir) => fs.rmSync(dir, { recursive: true, force: true })
+
+const make_token = (overrides = {}) => ({
+	id_token: 'eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIn0.sig',
+	access_token: 'access-token-value',
+	refresh_token: 'refresh-token-value',
+	expires_in: 3600,
+	...overrides
+})
+
+// Each test uses its own tmp directory to ensure full isolation.
+// We set XDG_CONFIG_HOME to point at it so credentials_path() resolves there.
+const with_tmp = async (fn) => {
+	const dir = make_tmp()
+	const orig = process.env.XDG_CONFIG_HOME
+	process.env.XDG_CONFIG_HOME = dir
+	try {
+		await fn(dir)
+	} finally {
+		if (orig !== undefined) process.env.XDG_CONFIG_HOME = orig
+		else delete process.env.XDG_CONFIG_HOME
+		cleanup(dir)
+	}
+}
+
+const creds_file = (dir) => path.join(dir, 'happyskills', 'credentials.json')
+
+// ─── save_token ───────────────────────────────────────────────────────────────
+
+describe('save_token', () => {
+	it('creates the credentials file with the token data', async () => {
+		await with_tmp(async (dir) => {
+			const token = make_token()
+			const [err] = await save_token(token)
+			assert.strictEqual(err, null)
+			assert.ok(fs.existsSync(creds_file(dir)), 'credentials.json should exist')
+
+			const content = JSON.parse(fs.readFileSync(creds_file(dir), 'utf-8'))
+			assert.strictEqual(content.id_token, token.id_token)
+			assert.strictEqual(content.access_token, token.access_token)
+		})
+	})
+
+	it('injects a stored_at timestamp into the saved file', async () => {
+		await with_tmp(async () => {
+			const before = Date.now()
+			const [err] = await save_token(make_token())
+			assert.strictEqual(err, null)
+			const [, loaded] = await load_token()
+			assert.ok(loaded.stored_at, 'stored_at should be present')
+			const stored_ms = new Date(loaded.stored_at).getTime()
+			assert.ok(stored_ms >= before, 'stored_at should be >= the time before save')
+			assert.ok(stored_ms <= Date.now(), 'stored_at should be <= now')
+		})
+	})
+
+	it('creates the config directory automatically when it does not exist', async () => {
+		await with_tmp(async (dir) => {
+			// The happyskills/ subdirectory does not exist yet
+			assert.ok(!fs.existsSync(path.join(dir, 'happyskills')))
+			const [err] = await save_token(make_token())
+			assert.strictEqual(err, null)
+			assert.ok(fs.existsSync(creds_file(dir)))
+		})
+	})
+
+	it('writes the file with 0o600 permissions (owner read/write only)', async () => {
+		await with_tmp(async (dir) => {
+			await save_token(make_token())
+			const stat = fs.statSync(creds_file(dir))
+			assert.strictEqual(stat.mode & 0o777, 0o600)
+		})
+	})
+})
+
+// ─── load_token ───────────────────────────────────────────────────────────────
+
+describe('load_token', () => {
+	it('returns [null, null] when no credentials file exists', async () => {
+		await with_tmp(async () => {
+			const [err, token] = await load_token()
+			assert.strictEqual(err, null)
+			assert.strictEqual(token, null)
+		})
+	})
+
+	it('returns the saved token when it has not expired', async () => {
+		await with_tmp(async () => {
+			const token = make_token({ expires_in: 3600 })
+			await save_token(token)
+
+			const [err, loaded] = await load_token()
+			assert.strictEqual(err, null)
+			assert.ok(loaded, 'token should be returned')
+			assert.strictEqual(loaded.id_token, token.id_token)
+			assert.strictEqual(loaded.refresh_token, token.refresh_token)
+		})
+	})
+
+	it('returns null for an expired token that has no refresh_token', async () => {
+		await with_tmp(async (dir) => {
+			// Write an already-expired token directly, bypassing save_token's
+			// stored_at injection so we can backdate it ourselves.
+			const expired = {
+				id_token: 'expired-id-token',
+				access_token: 'expired-access-token',
+				expires_in: 1,  // 1 second
+				stored_at: new Date(Date.now() - 5000).toISOString()  // stored 5s ago
+				// no refresh_token
+			}
+			fs.mkdirSync(path.join(dir, 'happyskills'), { recursive: true })
+			fs.writeFileSync(creds_file(dir), JSON.stringify(expired), { mode: 0o600 })
+
+			const [err, token] = await load_token()
+			assert.strictEqual(err, null)
+			assert.strictEqual(token, null, 'expired token without refresh_token should return null')
+		})
+	})
+
+	it('deletes the credentials file when a token has expired and no refresh_token', async () => {
+		await with_tmp(async (dir) => {
+			const expired = {
+				id_token: 'expired-id-token',
+				expires_in: 1,
+				stored_at: new Date(Date.now() - 5000).toISOString()
+			}
+			fs.mkdirSync(path.join(dir, 'happyskills'), { recursive: true })
+			fs.writeFileSync(creds_file(dir), JSON.stringify(expired), { mode: 0o600 })
+
+			await load_token()  // should clear the file
+			assert.ok(!fs.existsSync(creds_file(dir)), 'expired credentials file should be deleted')
+		})
+	})
+})
+
+// ─── clear_token ──────────────────────────────────────────────────────────────
+
+describe('clear_token', () => {
+	it('deletes the credentials file', async () => {
+		await with_tmp(async (dir) => {
+			await save_token(make_token())
+			assert.ok(fs.existsSync(creds_file(dir)))
+
+			const [err] = await clear_token()
+			assert.strictEqual(err, null)
+			assert.ok(!fs.existsSync(creds_file(dir)), 'credentials.json should be deleted')
+		})
+	})
+
+	it('succeeds silently when no credentials file exists', async () => {
+		await with_tmp(async () => {
+			const [err] = await clear_token()
+			assert.strictEqual(err, null)
+		})
+	})
+})
+
+// ─── require_token ────────────────────────────────────────────────────────────
+
+describe('require_token', () => {
+	it('returns the token when one is saved and valid', async () => {
+		await with_tmp(async () => {
+			const token = make_token()
+			await save_token(token)
+
+			const result = await require_token()
+			assert.ok(result, 'should return token data')
+			assert.strictEqual(result.id_token, token.id_token)
+		})
+	})
+
+	it('throws AuthError when no token is stored', async () => {
+		await with_tmp(async () => {
+			await assert.rejects(
+				() => require_token(),
+				(err) => {
+					assert.ok(err instanceof AuthError, `expected AuthError, got ${err?.constructor?.name}`)
+					return true
+				}
+			)
+		})
+	})
+})

package/src/commands/bump.js

@@ -0,0 +1,104 @@
+const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
+const { read_manifest } = require('../manifest/reader')
+const { write_manifest } = require('../manifest/writer')
+const { validate_manifest } = require('../manifest/validator')
+const { inc, valid } = require('../utils/semver')
+const { resolve_skill_dir } = require('../utils/resolve_skill')
+const { find_project_root } = require('../config/paths')
+const { read_lock, get_all_locked_skills } = require('../lock/reader')
+const { write_lock, update_lock_skills } = require('../lock/writer')
+const { hash_directory } = require('../lock/integrity')
+const { print_help, print_success, print_json } = require('../ui/output')
+const { exit_with_error, UsageError } = require('../utils/errors')
+const { EXIT_CODES } = require('../constants')
+
+const BUMP_TYPES = ['patch', 'minor', 'major']
+
+const HELP_TEXT = `Usage: happyskills bump <type|version> <skill-name>
+
+Bump the version in a skill's skill.json.
+
+Arguments:
+  type              Bump type: patch, minor, or major
+  version           Explicit semver version (e.g., 2.0.0)
+  skill-name        Name of the installed skill
+
+Examples:
+  happyskills bump patch my-skill
+  happyskills bump minor deploy-aws
+  happyskills bump major my-skill
+  happyskills bump 2.0.0 my-skill`
+
+const run = (args) => catch_errors('Bump failed', async () => {
+	if (args.flags._show_help) {
+		print_help(HELP_TEXT)
+		return process.exit(EXIT_CODES.SUCCESS)
+	}
+
+	const input = args._[0]
+	const skill_name = args._[1]
+
+	if (!input || !skill_name) {
+		throw new UsageError('Usage: happyskills bump <patch|minor|major|version> <skill-name>')
+	}
+
+	const [dir_err, dir] = await resolve_skill_dir(skill_name)
+	if (dir_err) throw e(`Skill "${skill_name}" not found`, dir_err)
+
+	const [manifest_err, manifest] = await read_manifest(dir)
+	if (manifest_err) throw e('No skill.json found', manifest_err)
+
+	const old_version = manifest.version
+
+	if (BUMP_TYPES.includes(input)) {
+		const new_version = inc(old_version, input)
+		if (!new_version) throw new Error(`Failed to bump version from ${old_version}`)
+		manifest.version = new_version
+	} else {
+		const cleaned = valid(input)
+		if (!cleaned) throw new UsageError(`"${input}" is not a valid semver version.`)
+		manifest.version = cleaned
+	}
+
+	const validation = validate_manifest(manifest)
+	if (!validation.valid) {
+		throw new Error(`Invalid manifest after bump: ${validation.errors.join(', ')}`)
+	}
+
+	const [write_err] = await write_manifest(dir, manifest)
+	if (write_err) throw e('Failed to update skill.json', write_err)
+
+	const project_root = find_project_root()
+	const [lock_err, lock_data] = await read_lock(project_root)
+	if (!lock_err && lock_data) {
+		const all_skills = get_all_locked_skills(lock_data)
+		const suffix = `/${skill_name}`
+		const lock_key = Object.keys(all_skills).find(k => k.endsWith(suffix))
+		if (lock_key && all_skills[lock_key]) {
+			const [hash_err, integrity] = await hash_directory(dir)
+			const updated_entry = {
+				...all_skills[lock_key],
+				version: manifest.version,
+				ref: `refs/tags/v${manifest.version}`
+			}
+			if (!hash_err && integrity) updated_entry.integrity = integrity
+			const updated_skills = update_lock_skills(lock_data, { [lock_key]: updated_entry })
+			await write_lock(project_root, updated_skills)
+		}
+	}
+
+	if (args.flags.json) {
+		const bump_type = BUMP_TYPES.includes(input) ? input : 'explicit'
+		print_json({ data: {
+			skill: skill_name,
+			old_version,
+			new_version: manifest.version,
+			bump_type
+		} })
+		return
+	}
+
+	print_success(`${skill_name}: ${old_version} → ${manifest.version}`)
+}).then(([errors]) => { if (errors) { exit_with_error(errors); return } })
+
+module.exports = { run }