happyskills 1.16.0 → 1.16.1

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.16.1] - 2026-07-02
+
+### Fixed
+
+- Make the passive daily skill-update check watch **every** installed skill, not just top-level (`__root__`) ones. Bundled family satellites installed as transitive dependencies (e.g. `happyskills-design`, `happyskills-help`) are recorded in the lock as `requested_by: [<parent>]`, so the previous `__root__`-only filter silently never nudged when they fell behind the registry — even though the check already spans both the project-local and global locks. Candidate selection now mirrors `happyskills check` (every installed skill), so an outdated bundled satellite is surfaced both in the stderr nudge and in the `SKILLS_UPDATE_AVAILABLE` envelope warning.
+
+### Changed
+
+- The "installed skills behind the registry" nudge now names the outdated skills in its suggested command (`npx happyskills update <owner/name> …`, grouped by scope so global skills get `-g`) instead of suggesting `update --all` — which only re-checks top-level skills and therefore could never refresh an outdated bundled satellite.
+
 ## [1.16.0] - 2026-07-01
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "1.16.0",
+	"version": "1.16.1",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/ui/envelope.test.js

@@ -34,7 +34,7 @@ test('drift set → appends a SKILLS_UPDATE_AVAILABLE warning without touching d
 		assert.strictEqual(env.warnings[0].code, 'SKILLS_UPDATE_AVAILABLE')
 		assert.match(env.warnings[0].message, /2 installed skill\(s\) behind the registry/)
 		assert.match(env.warnings[0].message, /acme\/x, acme\/y/)
-		assert.match(env.warnings[0].message, /npx happyskills update --all/)
+		assert.match(env.warnings[0].message, /npx happyskills update acme\/x acme\/y/)
 	})
 })
 

package/src/utils/skill_update_check.js

@@ -44,6 +44,16 @@ const write_scope = (key, outdated) => {
 	}
 }
 
+// Selects which locked skills to check for registry drift: EVERY installed skill,
+// not just __root__ entries. A bundled family satellite (e.g. happyskills-help) is
+// pulled in as a transitive dependency of core — its lock entry reads
+// requested_by:['happyskillsai/happyskills'], NOT ['__root__'] — so a __root__-only
+// filter silently never nudged about it even when it fell behind. Mirrors the
+// "check every installed skill" enumeration in commands/check.js. A null value is a
+// removed-skill tombstone — skip it. Extracted as a pure function for unit testing.
+const select_drift_candidates = (skills) =>
+	Object.entries(skills || {}).filter(([, d]) => d && typeof d === 'object')
+
 // Background refresh — NOT awaited, all errors swallowed. Reads the lock directly
 // (NOT via lock/reader.read_lock, which prints a stderr warning on version mismatch
 // — unwanted noise from a silent background task), batch-checks root skills against
@@ -60,8 +70,7 @@ const refresh_cache = (key, opts) => {
 		const lock_path = lock_file_path(lock_root(opts.is_global, opts.project_root))
 		const [, lock_data] = await read_json(lock_path)
 		const skills = (lock_data && lock_data.skills) || {}
-		const candidates = Object.entries(skills)
-			.filter(([, d]) => d && Array.isArray(d.requested_by) && d.requested_by.includes('__root__'))
+		const candidates = select_drift_candidates(skills)
 
 		if (candidates.length === 0) { write_scope(key, []); return }
 
@@ -140,11 +149,17 @@ const format_skill_drift = (verdict) => {
 	const items = verdict.outdated
 	const names = items.slice(0, 3).map(s => s.skill).join(', ')
 	const more = items.length > 3 ? `, +${items.length - 3} more` : ''
-	let cmd
-	if (verdict.has_global && verdict.has_local) cmd = 'npx happyskills update --all (and add -g for the global ones)'
-	else if (verdict.has_global) cmd = 'npx happyskills update --all -g'
-	else cmd = 'npx happyskills update --all'
-	return `${items.length} installed skill(s) behind the registry (${names}${more}). Run: ${cmd}`
+	// Name the outdated skills explicitly rather than suggesting `update --all`.
+	// `update --all` only re-checks __root__ skills, so it can never refresh a bundled
+	// satellite installed as a transitive dependency — but `update <owner/name>` fixes
+	// ANY locked skill. Group by scope: a global skill needs -g, and one update run
+	// writes a single scope. Items with no scope default to local.
+	const local = items.filter(i => i.scope !== 'global').map(i => i.skill)
+	const global = items.filter(i => i.scope === 'global').map(i => i.skill)
+	const cmds = []
+	if (local.length) cmds.push(`npx happyskills update ${local.join(' ')}`)
+	if (global.length) cmds.push(`npx happyskills update ${global.join(' ')} -g`)
+	return `${items.length} installed skill(s) behind the registry (${names}${more}). Run: ${cmds.join('  &&  ')}`
 }
 
-module.exports = { check_skills_for_update, format_skill_drift, get_cache_path, scope_key }
+module.exports = { check_skills_for_update, format_skill_drift, select_drift_candidates, get_cache_path, scope_key }

package/src/utils/skill_update_check.test.js

@@ -4,7 +4,7 @@ const fs = require('fs')
 const os = require('os')
 const path = require('path')
 
-const { check_skills_for_update, format_skill_drift, get_cache_path, scope_key } = require('./skill_update_check')
+const { check_skills_for_update, format_skill_drift, select_drift_candidates, get_cache_path, scope_key } = require('./skill_update_check')
 
 const PROJECT_ROOT = '/proj'
 const PKEY = scope_key({ is_global: false, project_root: PROJECT_ROOT })
@@ -53,7 +53,7 @@ test('project-only drift → verdict flagged local, no -g in the message', () =>
 		assert.strictEqual(v.outdated.length, 1)
 		assert.strictEqual(v.has_local, true)
 		assert.strictEqual(v.has_global, false)
-		assert.match(format_skill_drift(v), /update --all$/)
+		assert.match(format_skill_drift(v), /Run: npx happyskills update acme\/x$/)
 	})
 })
 
@@ -64,7 +64,7 @@ test('global-only drift → verdict flagged global, message uses -g', () => {
 		assert.ok(v)
 		assert.strictEqual(v.has_local, false)
 		assert.strictEqual(v.has_global, true)
-		assert.match(format_skill_drift(v), /update --all -g$/)
+		assert.match(format_skill_drift(v), /Run: npx happyskills update happyskillsai\/happyskills -g$/)
 	})
 })
 
@@ -75,7 +75,9 @@ test('drift in BOTH scopes → merged, both flags set, message mentions -g for g
 		assert.strictEqual(v.outdated.length, 2)
 		assert.strictEqual(v.has_local, true)
 		assert.strictEqual(v.has_global, true)
-		assert.match(format_skill_drift(v), /add -g for the global ones/)
+		const msg = format_skill_drift(v)
+		assert.match(msg, /npx happyskills update acme\/x/)
+		assert.match(msg, /npx happyskills update happyskillsai\/happyskills -g/)
 	})
 })
 
@@ -116,3 +118,38 @@ test('localhost:0 test API sentinel short-circuits to null', () => {
 		assert.strictEqual(check_skills_for_update({ project_root: PROJECT_ROOT }), null)
 	})
 })
+
+// ─── Regression: the passive check must watch the WHOLE installed family ─────────
+// A bundled family satellite (design/publish/sync/search/help) is installed as a
+// transitive dependency of core, so its lock entry is requested_by:[core], NOT
+// [__root__]. A __root__-only enumeration silently never nudged about it even when it
+// fell behind the registry — the gap this suite pins shut. See docs/cli-overview.md § 3.
+
+test('select_drift_candidates watches transitive dependencies, not just __root__ skills', () => {
+	const skills = {
+		'happyskillsai/happyskills':      { version: '2.5.4', base_commit: 'aaa', requested_by: ['__root__'] },
+		'happyskillsai/happyskills-help': { version: '0.8.2', base_commit: 'bbb', requested_by: ['happyskillsai/happyskills'] },
+	}
+	const names = select_drift_candidates(skills).map(([n]) => n)
+	assert.ok(names.includes('happyskillsai/happyskills-help'),
+		'a bundled satellite pulled in as a transitive dependency must still be checked for updates')
+})
+
+test('select_drift_candidates keeps __root__ skills and skips null (removed-skill) tombstones', () => {
+	const skills = {
+		'acme/root':    { version: '1.0.0', requested_by: ['__root__'] },
+		'acme/removed': null,
+	}
+	const names = select_drift_candidates(skills).map(([n]) => n)
+	assert.ok(names.includes('acme/root'))
+	assert.ok(!names.includes('acme/removed'))
+})
+
+test('format_skill_drift names the skills (works for transitive deps), never suggests update --all', () => {
+	// `update --all` only re-checks __root__ skills, so it can never refresh a bundled
+	// satellite. The remedy must name the skill: `update <owner/name>` fixes ANY locked skill.
+	const verdict = { outdated: [{ skill: 'happyskillsai/happyskills-help', installed: '0.8.2', latest: '0.9.0', scope: 'local' }], has_local: true, has_global: false }
+	const msg = format_skill_drift(verdict)
+	assert.match(msg, /npx happyskills update happyskillsai\/happyskills-help/)
+	assert.doesNotMatch(msg, /update --all/)
+})