image-skill 0.1.38 → 0.1.40

package/CHANGELOG.md

@@ -4,6 +4,26 @@ This changelog tracks the public `image-skill` CLI package and public skill
 mirror. The npm package metadata remains the authority for tarball integrity and
 provenance; this file is the human- and agent-readable release map.
 
+## 0.1.40 - 2026-06-11
+
+- Fix (growth): the `IMAGE_SKILL_DISCOVERY_SOURCE` attribution slug now
+  survives the guide handoff — guide-emitted fresh-process replay commands
+  (including the signup `next_command`) carry the env assignment in their
+  shell prefix, the same fresh-process-env treatment as
+  `IMAGE_SKILL_CONFIG_PATH`. Without this, a slug provided at
+  `create --guide` was lost before signup, so channel attribution read zero
+  by construction.
+
+## 0.1.39 - 2026-06-10
+
+- Feature (growth): **`signup --discovery-source SLUG`** (or the
+  `IMAGE_SKILL_DISCOVERY_SOURCE` environment variable; the flag wins)
+  optionally records the channel where the agent discovered Image Skill — a
+  short slug such as `clawhub`, `skills-sh`, or `npm` (lowercase
+  letters/digits plus `.`/`_`/`-`, max 64 chars). Self-reported and
+  first-touch: the first signup that names a channel wins, and a later
+  re-signup never relabels it. Never required — omit it rather than guessing.
+
 ## 0.1.38 - 2026-06-09
 
 - Feature (auth): **signup is anonymous by default** — `signup --agent

package/bin/image-skill.mjs

@@ -7,7 +7,7 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import os from "node:os";
 
-const VERSION = "0.1.38";
+const VERSION = "0.1.40";
 const PACKAGE_NAME = "image-skill";
 const DEFAULT_API_BASE_URL = "https://api.image-skill.com";
 const DEFAULT_DOCS_BASE_URL = "https://image-skill.com";
@@ -760,7 +760,7 @@ async function signup(argv) {
       false,
       {
         required_flags: ["--agent-name", "--runtime"],
-        optional_flags: ["--agent-contact"],
+        optional_flags: ["--agent-contact", "--discovery-source"],
         suggested_command: SIGNUP_SUGGESTED_COMMAND,
         docs_url: "https://image-skill.com/cli.md#image-skill-signup-agent",
       },
@@ -778,7 +778,7 @@ async function signup(argv) {
       false,
       {
         required_flags: ["--agent-name", "--runtime"],
-        optional_flags: ["--agent-contact"],
+        optional_flags: ["--agent-contact", "--discovery-source"],
         accepted_aliases: {
           "--human-email": "--agent-contact",
         },
@@ -803,6 +803,13 @@ async function signup(argv) {
       return configReady.result;
     }
   }
+  // Discovery-source attribution (#1814): self-reported channel slug from
+  // --discovery-source or IMAGE_SKILL_DISCOVERY_SOURCE (flag wins). Omitted
+  // entirely when absent — never guessed, never required.
+  const discoverySource =
+    flagString(args, "discovery-source")?.trim() ||
+    process.env.IMAGE_SKILL_DISCOVERY_SOURCE?.trim() ||
+    null;
   const result = await apiRequest({
     command: "image-skill signup",
     method: "POST",
@@ -813,6 +820,9 @@ async function signup(argv) {
       agent_name: agentName,
       runtime,
       return_token: shouldSave || showToken,
+      ...(discoverySource === null || discoverySource === ""
+        ? {}
+        : { discovery_source: discoverySource }),
     },
   });
   result.envelope.command = "image-skill signup";
@@ -3088,15 +3098,28 @@ function createGuideCommandPrefix(input = {}) {
     input.configPath === undefined
       ? configuredImageSkillConfigPath()
       : input.configPath;
+  // Discovery-source attribution (#1814) must survive the guide handoff into
+  // the fresh-process replay commands, or the slug dies before signup.
+  const discoverySource = configuredDiscoverySource();
   return renderShellEnvPrefixedCommand(
     {
       npm_config_update_notifier: "false",
       ...(configPath === null ? {} : { IMAGE_SKILL_CONFIG_PATH: configPath }),
+      ...(discoverySource === null
+        ? {}
+        : { IMAGE_SKILL_DISCOVERY_SOURCE: discoverySource }),
     },
     "npx -y image-skill@latest",
   );
 }
 
+function configuredDiscoverySource() {
+  const value = process.env.IMAGE_SKILL_DISCOVERY_SOURCE;
+  return typeof value === "string" && value.trim().length > 0
+    ? value.trim()
+    : null;
+}
+
 function configuredImageSkillConfigPath() {
   const configPath = process.env.IMAGE_SKILL_CONFIG_PATH;
   return typeof configPath === "string" && configPath.length > 0

package/cli.md

@@ -119,6 +119,13 @@ Anonymous signups mint a fresh agent identity on every call, so re-running
 signup without a contact creates a new agent instead of returning the existing
 one; rely on the saved config to reuse the identity you already have.
 
+`--discovery-source SLUG` (or the `IMAGE_SKILL_DISCOVERY_SOURCE` environment
+variable; the flag wins) optionally records where you discovered Image Skill —
+a short channel slug such as `clawhub`, `skills-sh`, or `npm` (lowercase
+letters/digits plus `.`/`_`/`-`, max 64 chars). It is self-reported,
+first-touch (a later re-signup never relabels it), and never required: omit it
+when you do not know the channel rather than guessing.
+
 ### `image-skill claim request`
 
 Attaches an email-shaped durable contact inbox to the authenticated agent —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "image-skill",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "Zero-setup durable creative-media CLI for agents (image + video + audio + 3D): guide-first creation, model and cost inspection, owned URLs, JSON recovery, payments, reusable assets, and feedback.",
   "type": "module",
   "private": false,

package/skills/image-skill/references/cli.md

@@ -119,6 +119,13 @@ Anonymous signups mint a fresh agent identity on every call, so re-running
 signup without a contact creates a new agent instead of returning the existing
 one; rely on the saved config to reuse the identity you already have.
 
+`--discovery-source SLUG` (or the `IMAGE_SKILL_DISCOVERY_SOURCE` environment
+variable; the flag wins) optionally records where you discovered Image Skill —
+a short channel slug such as `clawhub`, `skills-sh`, or `npm` (lowercase
+letters/digits plus `.`/`_`/`-`, max 64 chars). It is self-reported,
+first-touch (a later re-signup never relabels it), and never required: omit it
+when you do not know the channel rather than guessing.
+
 ### `image-skill claim request`
 
 Attaches an email-shaped durable contact inbox to the authenticated agent —