happyskills 0.39.1 → 0.40.0

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.40.0] - 2026-05-03
+
+### Added
+- Propagate the fork relationship to the server on the first `publish` after `happyskills fork`. The CLI now reads `manifest.forked_from.repo` (an `owner/name` string written by the fork command), splits it into `{ workspace, name }`, and includes it in the push payload across all three transport modes: direct push, archive upload, and per-file presigned upload. The API resolves the parent and persists `repos.forked_from`, which feeds the duplicate-detection heuristic (forks-of-active-parents are ineligible to be elected source-of-truth, and the publish-time `duplicates` warning is suppressed when the only match is the fork's parent). Subsequent publishes of an existing repo are unaffected — the field is honored only on the create-repo path. Requires API ≥ 2.4.0.
+
+### Fixed
+- Fix `publish` crashing with a `ReferenceError`/TDZ on `visibility` when validation runs before the spinner update — the `const visibility = args.flags.public ? 'public' : 'private'` declaration was below its first use. Move the declaration ahead of all reads.
+- Fix `validate_manifest` rejecting kit names like `_kit-foo` ("Invalid name … Must start with a letter or number"). Kits are required by `init --kit` and `validate_skill_json` to start with `_kit-`, so the leading-character rule is now carved out for `manifest.type === 'kit'` via a separate `KIT_NAME_PATTERN`. Bumping a kit no longer fails its own pre-publish manifest validation.
+
 ## [0.39.1] - 2026-05-01
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.39.1",
+	"version": "0.40.0",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/api/push.js

@@ -13,7 +13,7 @@ const estimate_payload_size = (files) => {
 	return size
 }
 
-const archive_push = (owner, repo, { version, message, files, visibility, base_commit, force, parent_shas, source_dir }, on_progress) =>
+const archive_push = (owner, repo, { version, message, files, visibility, base_commit, force, parent_shas, forked_from, source_dir }, on_progress) =>
 	catch_errors('Archive push failed', async () => {
 		const file_meta = files.map(f => ({ path: f.path, sha: f.sha, size: f.size }))
 
@@ -28,6 +28,7 @@ const archive_push = (owner, repo, { version, message, files, visibility, base_c
 				archive: true, archive_sha: archive.sha, archive_size: archive.size
 			}
 			if (parent_shas) init_body.parent_shas = parent_shas
+			if (forked_from) init_body.forked_from = forked_from
 			const [init_err, init_data] = await initiate_upload(owner, repo, init_body)
 			if (init_err) throw e('Upload initiation failed', init_err)
 
@@ -44,6 +45,7 @@ const archive_push = (owner, repo, { version, message, files, visibility, base_c
 				version, message, files: file_meta, base_commit, force
 			}
 			if (parent_shas) complete_body.parent_shas = parent_shas
+			if (forked_from) complete_body.forked_from = forked_from
 			const [complete_err, complete_data] = await complete_upload(owner, repo, complete_body)
 			if (complete_err) throw e('Upload completion failed', complete_err)
 
@@ -62,7 +64,7 @@ const archive_push = (owner, repo, { version, message, files, visibility, base_c
 		}
 	})
 
-const smart_push = (owner, repo, { version, message, files, visibility, base_commit, force, parent_shas, source_dir }, on_progress) =>
+const smart_push = (owner, repo, { version, message, files, visibility, base_commit, force, parent_shas, forked_from, source_dir }, on_progress) =>
 	catch_errors('Smart push failed', async () => {
 		const payload_size = estimate_payload_size(files)
 
@@ -70,6 +72,7 @@ const smart_push = (owner, repo, { version, message, files, visibility, base_com
 			// Small payload — use direct push
 			const body = { version, message, files, visibility, base_commit, force }
 			if (parent_shas) body.parent_shas = parent_shas
+			if (forked_from) body.forked_from = forked_from
 			const [err, data] = await repos_api.push(owner, repo, body)
 			if (err) throw e('Direct push failed', err)
 			return data
@@ -77,7 +80,7 @@ const smart_push = (owner, repo, { version, message, files, visibility, base_com
 
 		// Large payload — prefer archive upload if source_dir is available
 		if (source_dir) {
-			return await archive_push(owner, repo, { version, message, files, visibility, base_commit, force, parent_shas, source_dir }, on_progress)
+			return await archive_push(owner, repo, { version, message, files, visibility, base_commit, force, parent_shas, forked_from, source_dir }, on_progress)
 		}
 
 		// Fallback: per-file presigned upload
@@ -86,6 +89,7 @@ const smart_push = (owner, repo, { version, message, files, visibility, base_com
 		// Step 1: Initiate
 		const init_body = { version, message, files: file_meta, visibility, base_commit, force }
 		if (parent_shas) init_body.parent_shas = parent_shas
+		if (forked_from) init_body.forked_from = forked_from
 		const [init_err, init_data] = await initiate_upload(owner, repo, init_body)
 		if (init_err) throw e('Upload initiation failed', init_err)
 
@@ -111,6 +115,7 @@ const smart_push = (owner, repo, { version, message, files, visibility, base_com
 		// Step 3: Complete
 		const complete_body = { upload_id, version, message, files: file_meta, base_commit, force }
 		if (parent_shas) complete_body.parent_shas = parent_shas
+		if (forked_from) complete_body.forked_from = forked_from
 		const [complete_err, complete_data] = await complete_upload(owner, repo, complete_body)
 		if (complete_err) throw e('Upload completion failed', complete_err)
 

package/src/commands/publish.js

@@ -135,6 +135,8 @@ const run = (args) => catch_errors('Publish failed', async () => {
 
 	const spinner = create_spinner('Preparing to publish...')
 
+	const visibility = args.flags.public ? 'public' : 'private'
+
 	let owner = args.flags.workspace
 	if (!owner) {
 		const [, resolved_owner] = await resolve_skill_owner(skill_name)
@@ -221,7 +223,6 @@ const run = (args) => catch_errors('Publish failed', async () => {
 			spinner.update(`Uploading files (${completed}/${total})...`)
 		}
 	}
-	const visibility = args.flags.public ? 'public' : 'private'
 	const push_options = {
 		version: manifest.version,
 		message: `Release ${manifest.version}`,
@@ -234,6 +235,15 @@ const run = (args) => catch_errors('Publish failed', async () => {
 	if (merge_parents && !force) {
 		push_options.parent_shas = merge_parents
 	}
+
+	// Propagate fork relationship to the server on the first publish.
+	// Only the create-repo path uses this; existing repos already have forked_from set.
+	if (manifest.forked_from && typeof manifest.forked_from.repo === 'string' && manifest.forked_from.repo.includes('/')) {
+		const [parent_workspace, parent_name] = manifest.forked_from.repo.split('/')
+		if (parent_workspace && parent_name) {
+			push_options.forked_from = { workspace: parent_workspace, name: parent_name }
+		}
+	}
 	const [push_err, push_data] = await smart_push(workspace.slug, manifest.name, push_options, on_progress)
 	if (push_err) {
 		const last = push_err[push_err.length - 1]

package/src/commands/publish.test.js

@@ -0,0 +1,21 @@
+const { describe, it } = require('node:test')
+const assert = require('node:assert')
+const fs = require('node:fs')
+const path = require('node:path')
+
+describe('publish.js — Bug 1 regression: visibility temporal-dead-zone', () => {
+	const src = fs.readFileSync(path.join(__dirname, 'publish.js'), 'utf8')
+
+	it('declares `visibility` before passing it to validate_dependencies', () => {
+		const decl_idx = src.search(/const\s+visibility\s*=\s*args\.flags\.public/)
+		const use_idx = src.search(/validate_dependencies\([\s\S]*?visibility/)
+		assert.notStrictEqual(decl_idx, -1, '`const visibility = args.flags.public ? ...` declaration not found')
+		assert.notStrictEqual(use_idx, -1, '`validate_dependencies(... visibility ...)` call not found')
+		assert.ok(
+			decl_idx < use_idx,
+			`visibility must be declared (idx ${decl_idx}) before it is read inside validate_dependencies (idx ${use_idx}). ` +
+			'The current ordering causes `ReferenceError: Cannot access \'visibility\' before initialization` ' +
+			'whenever skill.json declares one or more dependencies.'
+		)
+	})
+})

package/src/manifest/validator.js

@@ -2,6 +2,9 @@ const { valid } = require('../utils/semver')
 
 const REQUIRED_FIELDS = ['name', 'version']
 const NAME_PATTERN = /^[a-z0-9][a-z0-9_-]*$/
+// Kits are required to start with `_kit-` (enforced by `init --kit` and
+// validate_skill_json). Carve out the leading-character rule for them.
+const KIT_NAME_PATTERN = /^_kit-[a-z0-9][a-z0-9-]*$/
 
 const validate_manifest = (manifest) => {
 	const errors = []
@@ -12,7 +15,8 @@ const validate_manifest = (manifest) => {
 		}
 	}
 
-	if (manifest.name && !NAME_PATTERN.test(manifest.name)) {
+	const name_pattern = manifest.type === 'kit' ? KIT_NAME_PATTERN : NAME_PATTERN
+	if (manifest.name && !name_pattern.test(manifest.name)) {
 		errors.push(`Invalid name "${manifest.name}". Use lowercase letters, numbers, hyphens, and underscores. Must start with a letter or number.`)
 	}
 

package/src/manifest/validator.test.js

@@ -98,4 +98,26 @@ describe('validate_manifest', () => {
 		const result = validate_manifest({ name: 'my-skill', version: '1.0.0' })
 		assert.strictEqual(result.valid, true)
 	})
+
+	// Bug 2 regression — kit names start with `_kit-` (enforced by `init --kit` and
+	// `validate_skill_json` for type==='kit'). The shared `validate_manifest` used
+	// by `bump` must accept this convention or the standard release workflow breaks.
+	describe('kit name convention', () => {
+		it('accepts a kit name beginning with _kit- when type is "kit"', () => {
+			const result = validate_manifest({ name: '_kit-mykit', version: '1.0.0', type: 'kit' })
+			assert.strictEqual(result.valid, true, `expected valid, got errors: ${result.errors.join(', ')}`)
+		})
+
+		it('still rejects a non-kit manifest whose name starts with _', () => {
+			const result = validate_manifest({ name: '_oops', version: '1.0.0' })
+			assert.strictEqual(result.valid, false)
+			assert.ok(result.errors.some(e => e.includes('Invalid name')))
+		})
+
+		it('still rejects a non-kit manifest whose name starts with _ even if type=skill', () => {
+			const result = validate_manifest({ name: '_oops', version: '1.0.0', type: 'skill' })
+			assert.strictEqual(result.valid, false)
+			assert.ok(result.errors.some(e => e.includes('Invalid name')))
+		})
+	})
 })