happyskills 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-03-08
+
+### Fixed
+- Fix `update` command wiping all other skills from `skills-lock.json` — the `fresh` flag was skipping the lock file read entirely, causing the merge-on-write to start from an empty map instead of preserving existing entries
+- Fix `publish` dependency check producing false "not found" warnings by replacing the bulk `resolve_dependencies` call with individual repo lookups
+
 ## [0.7.2] - 2026-03-06
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.7.2",
+	"version": "0.7.3",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/commands/publish.js

@@ -9,6 +9,10 @@ const { smart_push } = require('../api/push')
 const { inc } = require('../utils/semver')
 const { collect_files } = require('../utils/file_collector')
 const { resolve_skill_dir, resolve_skill_owner } = require('../utils/resolve_skill')
+const { find_project_root } = require('../config/paths')
+const { read_lock, get_all_locked_skills } = require('../lock/reader')
+const { write_lock, update_lock_skills } = require('../lock/writer')
+const { hash_directory } = require('../lock/integrity')
 const { create_spinner } = require('../ui/spinner')
 const { print_help, print_success, print_error, print_warn, print_hint, print_json, code } = require('../ui/output')
 const { exit_with_error, UsageError, CliError } = require('../utils/errors')
@@ -102,14 +106,20 @@ const run = (args) => catch_errors('Publish failed', async () => {
 
 	if (manifest.dependencies && Object.keys(manifest.dependencies).length > 0) {
 		spinner.update('Checking dependencies...')
-		const [dep_err] = await repos_api.resolve_dependencies(
-			`${workspace.slug}/${manifest.name}`,
-			manifest.version,
-			{}
-		)
-		if (dep_err) {
+		const dep_entries = Object.keys(manifest.dependencies)
+		const dep_results = await Promise.all(dep_entries.map(async (dep) => {
+			const parts = dep.split('/')
+			if (parts.length !== 2) return { dep, missing: true }
+			const [dep_owner, dep_name] = parts
+			const [err] = await repos_api.get_repo(dep_owner, dep_name)
+			return { dep, missing: !!err }
+		}))
+		const missing = dep_results.filter(r => r.missing)
+		if (missing.length > 0) {
 			spinner.fail('Dependency check failed')
-			print_warn('Some dependencies may not be published yet.')
+			for (const { dep } of missing) {
+				print_warn(`Dependency "${dep}" not found in the registry.`)
+			}
 		}
 	}
 
@@ -122,7 +132,7 @@ const run = (args) => catch_errors('Publish failed', async () => {
 		spinner.update(`Uploading files (${completed}/${total})...`)
 	}
 	const visibility = args.flags.public ? 'public' : 'private'
-	const [push_err] = await smart_push(workspace.slug, manifest.name, {
+	const [push_err, push_data] = await smart_push(workspace.slug, manifest.name, {
 		version: manifest.version,
 		message: `Release ${manifest.version}`,
 		files: skill_files,
@@ -132,11 +142,33 @@ const run = (args) => catch_errors('Publish failed', async () => {
 
 	spinner.succeed(`Published ${workspace.slug}/${manifest.name}@${manifest.version}`)
 
+	const full_name = `${workspace.slug}/${manifest.name}`
+	const project_root = find_project_root()
+	const [lock_err, lock_data] = await read_lock(project_root)
+	if (!lock_err && lock_data) {
+		const all_skills = get_all_locked_skills(lock_data)
+		const suffix = `/${skill_name}`
+		const lock_key = Object.keys(all_skills).find(k => k.endsWith(suffix))
+		if (lock_key && all_skills[lock_key]) {
+			const [hash_err, integrity] = await hash_directory(dir)
+			const updated_entry = {
+				...all_skills[lock_key],
+				version: manifest.version,
+				ref: push_data?.ref || `refs/tags/v${manifest.version}`,
+				commit: push_data?.commit || null
+			}
+			if (!hash_err && integrity) updated_entry.integrity = integrity
+			const updated_skills = update_lock_skills(lock_data, { [lock_key]: updated_entry })
+			await write_lock(project_root, updated_skills)
+		}
+	}
+
 	if (args.flags.json) {
 		print_json({ data: {
-			skill: `${workspace.slug}/${manifest.name}`,
+			skill: full_name,
 			version: manifest.version,
-			ref: `refs/tags/v${manifest.version}`,
+			ref: push_data?.ref || `refs/tags/v${manifest.version}`,
+			commit: push_data?.commit || null,
 			bumped_from
 		} })
 		return

package/src/engine/installer.js

@@ -24,7 +24,7 @@ const install = (skill, options = {}) => catch_errors('Install failed', async ()
 	const temp_dir = tmp_dir(base_dir)
 	const lock_dir = lock_root(is_global, project_root)
 
-	const [, lock_data] = fresh ? [null, null] : await read_lock(lock_dir)
+	const [, lock_data] = await read_lock(lock_dir)
 
 	if (!fresh && lock_data) {
 		const locked = get_locked_skill(lock_data, skill)