happyskills 1.0.1 → 1.0.2

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.0.2] - 2026-06-01
+
+### Fixed
+
+- Stop `uninstall` from deleting a shared dependency that another installed skill still needs. When a skill depended on by two parents (e.g. `happyskills-design`, required by both `happyskills` and another skill) was resolved across separate install passes, the second pass overwrote its `requested_by` instead of unioning the parents — so uninstalling one parent orphan-pruned the dependency even though the other parent still declared it. Two fixes: `requested_by` is now unioned across install passes, and the orphan pruner additionally cross-checks every surviving skill's `dependencies` map before removing anything.
+
 ## [1.0.1] - 2026-06-01
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "1.0.1",
+	"version": "1.0.2",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/engine/installer.js

@@ -22,6 +22,34 @@ const _format_warnings = (missing_deps) => (missing_deps || []).map(dep => {
 	return `Missing system dependency: ${dep.name} required by ${dep.skill}${hint}`
 })
 
+// Order-preserving, de-duplicated union of requester lists.
+const _union = (...lists) => {
+	const seen = new Set()
+	const out = []
+	for (const list of lists) {
+		for (const requester of (list || [])) {
+			if (!seen.has(requester)) {
+				seen.add(requester)
+				out.push(requester)
+			}
+		}
+	}
+	return out
+}
+
+// Compute the `requested_by` for a package's lock entry. A package is requested
+// either by the user directly (`__root__`) when it IS the skill being installed,
+// or by `root_skill` when it is a (transitive) dependency. We union that with
+// whatever the lock already recorded so a SHARED dependency keeps every parent
+// across separate install passes — install() resolves one root's tree at a time,
+// so a dependency of two roots (e.g. happyskills + create-release-skill both
+// needing happyskills-design) would otherwise have its `requested_by` clobbered
+// by the last pass, and later be wrongly orphan-pruned on uninstall.
+const merge_requested_by = (prev_requested_by, pkg_skill, root_skill) => {
+	const own = pkg_skill === root_skill ? ['__root__'] : [root_skill]
+	return _union(own, prev_requested_by)
+}
+
 const install = (skill, options = {}) => catch_errors('Install failed', async () => {
 	const { version, global: is_global = false, force = false, fresh = false, project_root, agents: agents_flag } = options
 	const base_dir = skills_dir(is_global, project_root)
@@ -246,7 +274,7 @@ const install = (skill, options = {}) => catch_errors('Install failed', async ()
 				integrity: integrity || null,
 				base_commit: pkg.commit || null,
 				base_integrity: integrity || null,
-				requested_by: pkg.skill === skill ? ['__root__'] : [skill],
+				requested_by: merge_requested_by(lock_data?.skills?.[pkg.skill]?.requested_by, pkg.skill, skill),
 				dependencies: pkg.dependencies || {},
 				...(pkg_type ? { type: pkg_type } : {}),
 				...(pkg.forced ? { forced: true } : {})
@@ -378,4 +406,4 @@ const install_from_lock = (lock_data, options = {}) => catch_errors('Install fro
 	return { source: 'skills-lock.json', installed: all_installed, skipped: all_skipped, warnings: all_warnings }
 })
 
-module.exports = { install, install_from_manifest, install_from_lock }
+module.exports = { install, install_from_manifest, install_from_lock, merge_requested_by }

package/src/engine/installer.test.js

@@ -0,0 +1,41 @@
+const { describe, it } = require('node:test')
+const assert = require('node:assert')
+const { merge_requested_by } = require('./installer')
+
+describe('merge_requested_by', () => {
+	it('records the root skill for a fresh dependency', () => {
+		const result = merge_requested_by(undefined, 'happyskillsai/happyskills-design', 'happyskillsai/happyskills')
+		assert.deepStrictEqual(result, ['happyskillsai/happyskills'])
+	})
+
+	it('records __root__ when the package IS the skill being installed', () => {
+		const result = merge_requested_by(['__root__'], 'happyskillsai/happyskills', 'happyskillsai/happyskills')
+		assert.deepStrictEqual(result, ['__root__'])
+	})
+
+	it('unions a shared dependency across separate install passes', () => {
+		// Pass 1 wrote design as a dependency of happyskills.
+		// Pass 2 re-resolves design as a dependency of create-release-skill and
+		// must NOT clobber the existing parent — both must be retained.
+		const result = merge_requested_by(
+			['happyskillsai/happyskills'],
+			'happyskillsai/happyskills-design',
+			'nicolasdao/create-release-skill'
+		)
+		assert.deepStrictEqual(result, ['nicolasdao/create-release-skill', 'happyskillsai/happyskills'])
+	})
+
+	it('de-duplicates when the same requester reappears', () => {
+		const result = merge_requested_by(
+			['happyskillsai/happyskills'],
+			'happyskillsai/happyskills-design',
+			'happyskillsai/happyskills'
+		)
+		assert.deepStrictEqual(result, ['happyskillsai/happyskills'])
+	})
+
+	it('tolerates a null/empty previous list', () => {
+		assert.deepStrictEqual(merge_requested_by(null, 'a/dep', 'a/root'), ['a/root'])
+		assert.deepStrictEqual(merge_requested_by([], 'a/dep', 'a/root'), ['a/root'])
+	})
+})

package/src/engine/uninstaller.js

@@ -7,12 +7,29 @@ const { resolve_agents, unlink_from_agents } = require('../agents')
 const { print_success, print_info } = require('../ui/output')
 
 const find_orphans = (skills, removed_skill) => {
+	// A skill is still needed if a SURVIVING skill (anything other than the one
+	// being removed) declares it in its `dependencies` map. The dependencies map
+	// mirrors each skill's skill.json and is the authoritative statement of what a
+	// skill needs — independent of `requested_by`, which can be stale or clobbered
+	// when a shared dependency is resolved across multiple install passes. Without
+	// this cross-check, a dependency whose `requested_by` was overwritten to point
+	// only at the removed skill gets pruned even though another installed skill
+	// still requires it (the happyskills-design data-loss bug).
+	const declared_by_survivor = (name) => {
+		for (const [other_name, other] of Object.entries(skills)) {
+			if (other_name === removed_skill) continue
+			const deps = (other && other.dependencies) || {}
+			if (Object.prototype.hasOwnProperty.call(deps, name)) return true
+		}
+		return false
+	}
+
 	const orphans = []
 	for (const [name, data] of Object.entries(skills)) {
 		if (name === removed_skill) continue
 		const requested_by = data.requested_by || []
 		const remaining = requested_by.filter(r => r === '__root__' || (r !== removed_skill && skills[r]))
-		if (remaining.length === 0) {
+		if (remaining.length === 0 && !declared_by_survivor(name)) {
 			orphans.push(name)
 		}
 	}

package/src/engine/uninstaller.test.js

@@ -95,4 +95,42 @@ describe('find_orphans', () => {
 		const result = find_orphans(skills, 'acme/other')
 		assert.ok(!result.includes('acme/deploy'))
 	})
+
+	it('keeps a shared dependency a surviving skill still declares, even when requested_by points only at the removed skill', () => {
+		// Reproduces the happyskills-design data-loss bug: design's requested_by was
+		// clobbered to point only at create-release-skill, but happyskills still
+		// declares it in its dependencies map. Uninstalling create-release-skill must
+		// NOT prune design.
+		const skills = {
+			'happyskillsai/happyskills': {
+				requested_by: ['__root__'],
+				dependencies: { 'happyskillsai/happyskills-design': '^0.1.0' }
+			},
+			'nicolasdao/create-release-skill': {
+				requested_by: ['__root__'],
+				dependencies: { 'happyskillsai/happyskills-design': '^0.9.0' }
+			},
+			'happyskillsai/happyskills-design': {
+				requested_by: ['nicolasdao/create-release-skill']
+			}
+		}
+		const result = find_orphans(skills, 'nicolasdao/create-release-skill')
+		assert.ok(!result.includes('happyskillsai/happyskills-design'))
+	})
+
+	it('prunes a dependency once no surviving skill declares it', () => {
+		// Same shape, but happyskills does NOT declare design — removing its sole
+		// remaining requester should orphan it.
+		const skills = {
+			'nicolasdao/create-release-skill': {
+				requested_by: ['__root__'],
+				dependencies: { 'happyskillsai/happyskills-design': '^0.9.0' }
+			},
+			'happyskillsai/happyskills-design': {
+				requested_by: ['nicolasdao/create-release-skill']
+			}
+		}
+		const result = find_orphans(skills, 'nicolasdao/create-release-skill')
+		assert.ok(result.includes('happyskillsai/happyskills-design'))
+	})
 })