showdar-skills 0.2.3 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,80 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+## [0.4.0]
+
+### Added
+
+- First-class workflow skill model: 15 primitives (`kind: primitive`) plus 4
+  workflows (`kind: workflow`) for 19 total installable skills.
+- `showdar-feature`: adaptive end-to-end feature implementation over
+  understand, requirements, plan, design, build, test, and review stages.
+- `showdar-bugfix`: adaptive defect resolution over understand, debug, build,
+  test, and review stages, including investigation-only mode.
+- `showdar-release`: release readiness versus execution separation over
+  quality, security, ship, and authority-gated ops stages.
+- `showdar-incident`: operational incident investigation and recovery over
+  understand, debug, recover, verification, and authority-gated ops stages.
+- `showdar add feature|bugfix|release|incident` installs workflows through the
+  existing installer; short names normalize like primitives.
+- Workflow composition and safety validation: stage references resolve to
+  known primitives, workflows never stage another workflow or themselves,
+  and workflow SKILL.md files stay lean by referencing primitives.
+
+### Changed
+
+- Catalog distinguishes primitive and workflow skills; `getSkill` and
+  `normalizeSkillName` resolve all 19 installable skills.
+- `showdar validate` reports primitive/workflow/total counts
+  (`15 primitives, 4 workflows, 19 total`).
+- `showdar add` normalization supports workflow IDs and short names.
+- OpenCode `skill.md` command lists all 19 skills with a whole-task versus
+  single-primitive selection guard.
+- AGENTS.md managed routing block includes workflow routes when installed.
+
+## [0.3.0]
+
+### Added
+
+- Explicit harness targets for `showdar init` and `showdar add`: `codex`,
+  `opencode`, `cursor`, `claude`, `universal`, and `all`.
+- `showdar add <skill>` for installing a single primitive skill without
+  re-running a whole profile (for example `showdar add debug`,
+  `showdar add security --ai cursor`,
+  `showdar add review --scope global --ai claude`).
+- Native Cursor skill roots (`.cursor/skills` for projects,
+  `~/.cursor/skills` for global installs).
+- Deny-by-default routing authority coverage for conditional, modal,
+  contextual, hypothetical, and negated actions.
+
+### Changed
+
+- Each harness target now installs into its native skill directory instead of
+  sharing one compatibility root.
+- Routing uses a single authoritative engine: current request → structural
+  interpretation → authority classification → primary capability → skill.
+- Context, log, and example text no longer becomes requested work on its own;
+  conditional and hypothetical actions stay non-authoritative until current
+  request semantics permit them.
+- Risk metadata no longer overrides an explicit governing action.
+
+### Fixed
+
+- Conditional, modal, context, and negation authority safety cases.
+- Security-risk ownership cases where risk signals previously stole primary
+  ownership from the governing action.
+- Debug, upgrade, build, and test imperative recognition for explicit
+  governing requests.
+
+### Removed
+
+- The executable legacy 6F authority engine and the old route-scoring path.
+
+## [0.2.3]
+
+See git history for changes before the 0.3.0 changelog was started.

package/MIGRATION.md

@@ -0,0 +1,75 @@
+# Migrating to 0.4.0
+
+0.4.0 adds four optional workflow skills over the unchanged 15 primitives:
+
+```bash
+showdar add feature
+showdar add bugfix
+showdar add release
+showdar add incident
+```
+
+- 0.3.0 `.showdar.json` v2 configs remain valid; no config-version migration
+  is required.
+- All 15 primitive IDs remain unchanged.
+- Profile behavior and composition are unchanged: `minimal` (8), `developer`
+  (12), `backend` (14), `qa` (9), `product` (6), `full` (15 primitives).
+- Workflows are additive and optional; they complement rather than replace
+  primitives. Nothing is removed.
+- No Phase 6G routing migration is required; the authority engine and the
+  15-capability primitive taxonomy are unchanged.
+- Single primitive requests keep resolving to primitives; whole-task or
+  lifecycle requests may select a workflow.
+
+# Migrating to 0.3.0
+
+## Skill install roots
+
+`--ai universal` still installs to `.agents/skills` (project) and
+`~/.agents/skills` (global). Explicit harness targets now use their native
+roots:
+
+- OpenCode: `.opencode/skills` / `~/.config/opencode/skills`
+- Cursor: `.cursor/skills` / `~/.cursor/skills`
+- Claude Code: `.claude/skills` / `~/.claude/skills`
+- Codex: `.agents/skills` / `~/.agents/skills`
+
+One invocation installs to one resolved root only; no compatibility copies
+are made automatically.
+
+## Existing projects
+
+Existing `.showdar.json` v2 configs remain valid. No config-version migration
+is required. Re-running `showdar init` with an explicit `--ai` target moves
+managed skills to the newly requested native root; the previous root is not
+silently deleted unless existing Showdar stale-cleanup semantics apply.
+
+## Profiles
+
+Profile names and composition are unchanged:
+
+- `minimal` (8), `developer` (12), `backend` (14), `qa` (9), `product` (6),
+  `full` (15).
+- `mobile` and `web` remain accepted as deprecated aliases for `developer`;
+  manifests store the canonical name.
+
+## Single-skill additions
+
+Use `showdar add <skill>` instead of re-running a larger profile to add one
+skill:
+
+```bash
+showdar add debug
+showdar add security --ai cursor
+showdar add review --scope global --ai claude
+```
+
+Additions preserve the configured profile and are idempotent.
+
+## Routing behavior
+
+0.3.0 uses stricter deny-by-default authority semantics. Conditional,
+hypothetical, contextual, and negated actions stay non-authoritative until
+current request semantics permit them, and risk metadata no longer overrides
+an explicit governing action. Do not assume byte-identical routing with older
+releases where behavior intentionally tightened.

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/showdar-skills?logo=npm)](https://www.npmjs.com/package/showdar-skills)
 [![Node >=20](https://img.shields.io/badge/node-%3E%3D20-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue?logo=opensourceinitiative&logoColor=white)](./LICENSE)
-[![15 skills](https://img.shields.io/badge/skills-15-6f42c1)](#skill-catalog)
+[![19 skills](https://img.shields.io/badge/skills-19-6f42c1)](#skill-catalog)
 
 Production-grade software engineering skills for coding agents. Showdar covers
 the full lifecycle—from requirements and planning through implementation, QA,
@@ -17,10 +17,16 @@ Install the CLI, then install a role-oriented skill profile into your project:
 ```bash
 npm install -g showdar-skills
 cd my-project
-showdar init --ai codex --profile developer
+showdar init
 showdar doctor
 ```
 
+```bash
+showdar init --ai cursor
+showdar init --ai claude --scope global
+showdar init --profile developer --ai opencode
+```
+
 To install from source instead:
 
 ```bash
@@ -29,13 +35,14 @@ cd showdar-skills
 npm install -g .
 ```
 
-Showdar works with Codex, OpenCode, Claude Code, and universal agent skill
-directories. Choose `backend`, `qa`, or `product` when that gives discovery a
-more precise context; use `full` when you want all capabilities available.
+Showdar works with Universal Agent Skills, Codex, OpenCode, Cursor, and
+Claude Code as supported installation targets. Choose `backend`, `qa`, or
+`product` when that gives discovery a more precise context; use `full` when
+you want all capabilities available.
 
 ## Why Showdar?
 
-- **15 focused skills** instead of one oversized agent prompt.
+- **15 focused primitive skills** plus 4 adaptive workflow skills (19 installable) instead of one oversized agent prompt.
 - **Lifecycle coverage** from product rules to implementation, verification,
   security, operations, release readiness, and Git completion.
 - **Intent-based discovery** that selects the workflow matching the request.
@@ -65,21 +72,32 @@ SKILL.md
           only when needed
 ```
 
-The 15 skills are not eagerly loaded as full prompts. Lightweight descriptions
-help the agent choose one skill; that skill then loads its workflow and deeper
-knowledge progressively.
+The 15 primitive skills are not eagerly loaded as full prompts. Lightweight
+descriptions help the agent choose one skill; that skill then loads its
+workflow and deeper knowledge progressively. Workflow skills add a portable
+orchestration layer: a workflow selects the lifecycle stages a task actually
+needs and composes primitives one at a time, without duplicating their
+instructions.
 
 ## Supported agents
 
-| Target | Project destination | Global destination |
-| --- | --- | --- |
-| Codex / Universal | `.agents/skills/` | `~/.agents/skills/` |
-| OpenCode skills | `.opencode/skills/` | `~/.config/opencode/skills/` |
-| OpenCode commands | `.opencode/commands/showdar/` | `~/.config/opencode/commands/showdar/` |
-| Claude Code | `.claude/skills/` | `~/.claude/skills/` |
+| Harness | Project path | Global path | Status |
+| --- | --- | --- | --- |
+| Universal Agent Skills | `.agents/skills/` | `~/.agents/skills/` | Supported installation target |
+| Codex | `.agents/skills/` | `~/.agents/skills/` | Supported installation target |
+| OpenCode | `.opencode/skills/` | `~/.config/opencode/skills/` | Supported installation target |
+| Cursor | `.cursor/skills/` | `~/.cursor/skills/` | Supported installation target |
+| Claude Code | `.claude/skills/` | `~/.claude/skills/` | Supported installation target |
+
+Universal uses `.agents/skills/`. Explicit harness targets use their native
+skill directories. Codex and Universal intentionally share `.agents/skills/`.
+OpenCode additionally receives native `/showdar/...` command files in
+`.opencode/commands/showdar/` (project) and
+`~/.config/opencode/commands/showdar/` (global).
 
-Codex and Universal intentionally share `.agents/skills/`. OpenCode receives
-both skills and native `/showdar/...` command files.
+"Supported installation target" means skills install to the harness-native
+directory. It does not promise identical implicit invocation, cloud,
+agent/subagent, or MCP behavior across harnesses.
 
 ## Project and global installation
 
@@ -115,8 +133,10 @@ paths are refreshed or removed.
 
 ## Profiles
 
-Role-specific profiles improve routing precision. `full` exposes every skill,
-but still does not eagerly load every skill body.
+Role-specific profiles improve routing precision. Profiles install primitive
+skill sets; workflow skills are opt-in through `showdar add <workflow>` and
+are not silently included in any profile. `full` exposes every primitive
+skill, but still does not eagerly load every skill body.
 
 | Profile | Skills | Best for |
 | --- | ---: | --- |
@@ -125,7 +145,7 @@ but still does not eagerly load every skill body.
 | `backend` | 14 | APIs, services, and runtime operations |
 | `qa` | 9 | Testing and quality workflows |
 | `product` | 6 | Product, requirements, and design work |
-| `full` | 15 | All capabilities |
+| `full` | 15 | All primitive capabilities |
 
 Legacy aliases remain compatible:
 
@@ -138,7 +158,8 @@ New manifests store the canonical `developer` profile.
 
 ## Skill catalog
 
-All 15 entries are first-class Showdar skills.
+All 15 primitive entries are first-class Showdar skills. Four workflow skills
+compose them; see [Workflow skills](#workflow-skills).
 
 ### Analysis and planning
 
@@ -180,6 +201,109 @@ All 15 entries are first-class Showdar skills.
 | `showdar-recover` | Interrupted or partial engineering work must be reconstructed from repository evidence before continuing. |
 | `showdar-git` | Performing local Git inspection, staging, commits, branch integration, conflicts, cleanup, or explicitly requested remote Git actions. |
 
+## Workflow skills
+
+Four workflow skills orchestrate primitives adaptively; they are not fixed
+pipelines and they grant no extra authority:
+
+| Skill | Use when |
+| --- | --- |
+| `showdar-feature` | Implementing a complete feature end-to-end. |
+| `showdar-bugfix` | Resolving an observed defect end-to-end. |
+| `showdar-release` | Preparing, validating, or executing a release lifecycle. |
+| `showdar-incident` | Investigating or recovering from an active operational incident. |
+
+How a workflow runs:
+
+```text
+Workflow
+  -> selects needed lifecycle stages
+  -> invokes/composes primitive skills one at a time
+  -> primitives retain their own semantics
+  -> Phase 6G remains the authority source
+```
+
+Properties:
+
+- Adaptive, not fixed pipelines: stages marked `?` below are skipped when
+  evidence permits.
+- Intended for whole-task and lifecycle requests.
+- Focused primitive requests remain primitive.
+- Workflow identity never grants mutation or deployment authority.
+- Risk and severity never grant production authority.
+- Workflows do not create a second router or authority engine.
+
+### showdar-feature
+
+```bash
+showdar add feature
+```
+
+Typical candidate flow:
+
+```text
+understand -> requirements? -> plan? -> design? -> build -> test -> review
+```
+
+Skip requirements when behavior is already defined, plan for genuinely
+focused work, and design when no architecture or UX decision exists.
+Verification is never skipped to move faster. Ops is not implied.
+
+### showdar-bugfix
+
+```bash
+showdar add bugfix
+```
+
+Typical:
+
+```text
+understand -> debug? -> build -> test -> review
+```
+
+If the root cause is already proven, debug may be skipped. If the request is
+diagnosis only, build is not implied and the workflow stops after
+`showdar-debug`.
+
+### showdar-release
+
+```bash
+showdar add release --scope global --ai claude
+```
+
+Typical:
+
+```text
+quality -> security? -> ship -> ops only with explicit target + authorization
+```
+
+Readiness must not imply deployment. `showdar-ship` stays delivery
+verification; `showdar-ops` loads only with an explicit target plus execution
+authorization.
+
+### showdar-incident
+
+```bash
+showdar add incident
+```
+
+Typical:
+
+```text
+understand -> debug -> recover -> verification -> ops only when explicitly authorized
+```
+
+Diagnose before mutating when the cause is unknown. Severity must not imply
+production mutation. The workflow never auto-deploys or restarts production
+from risk alone.
+
+Workflows compose primitives: they select only the stages the evidence
+requires, skip defined or decision-free stages, load one primitive at a time,
+and stop when evidence or authority is missing. Single primitive requests stay
+primitive (`showdar-review`, `showdar-debug`, `showdar-test`). Phase 6G remains
+the authority source; workflows consume it and never mint it. Workflows are
+opt-in through `showdar add <workflow>`; profiles install primitive sets only.
+
 ## A typical software workflow
 
 ```text
@@ -238,10 +362,63 @@ OpenCode exposes native commands after initialization with `--ai opencode` or
 | `showdar-security` | Performs defensive, evidence-based analysis and never exposes secret values. |
 | `showdar-requirements` | Records assumptions and open decisions instead of inventing business decisions. |
 
+## Adding a single skill
+
+Install one skill without re-running a whole profile:
+
+```bash
+showdar add debug
+showdar add showdar-security
+showdar add test --ai cursor
+showdar add review --scope global --ai claude
+showdar add feature
+showdar add bugfix --ai cursor
+showdar add release --scope global --ai claude
+showdar add incident
+```
+
+Accepted names are the short form (`debug`, `feature`) or the canonical form
+(`showdar-debug`, `showdar-feature`). The release ships exactly 15 primitive
+skills plus 4 workflow skills (19 installable total); profiles install
+primitive sets only. There is no `showdar workflow ...` command. `showdar add`
+is idempotent, preserves the configured profile, supports `--ai`/`--scope`
+overrides, and refuses to overwrite a foreign same-name skill directory that
+Showdar does not own.
+
+## Routing
+
+Showdar routes each request through progressive disclosure: the host discovers
+lightweight skill metadata, loads the relevant skill, and pulls deeper
+guides and data only when needed.
+
+```text
+current request
+      |
+      v
+structural interpretation
+      |
+      v
+authority classification
+      |
+      v
+primary capability
+      |
+      v
+skill
+```
+
+Product behavior notes:
+
+- Context, log, and example text does not automatically become requested work.
+- Conditional and hypothetical actions remain non-authoritative until current
+  request semantics permit them.
+- Risk metadata does not override an explicit governing action.
+
 ## CLI reference
 
 ```bash
 showdar init [--scope <project|global>] --ai <target> --profile <profile>
+showdar add <skill> [--ai <target>] [--scope <project|global>]
 showdar list
 showdar status [--scope <project|global>]
 showdar doctor [--scope <project|global>]
@@ -249,10 +426,12 @@ showdar validate
 showdar remove [--scope <project|global>]
 ```
 
-Main flags are `--ai`, `--profile`, and `--scope`. `--ai` accepts `codex`,
-`opencode`, `claude`, `universal`, or `all`. `--scope` defaults to `project`;
-`--profile` accepts the six canonical profiles and the `mobile`/`web` aliases.
-Run `showdar --help` or a command's `--help` for current options.
+Main flags are `--ai`, `--profile`, and `--scope`. `--ai` accepts `universal`,
+`codex`, `opencode`, `cursor`, `claude`, or `all` for `init` (single targets
+for `add`). `--scope` accepts `project` or `global` and defaults to `project`;
+`--profile` accepts the six canonical profiles and the deprecated
+`mobile`/`web` aliases. Run `showdar --help` or a command's `--help` for
+current options.
 
 `showdar validate` validates the installed Showdar package. `showdar doctor`
 checks managed files against ownership hashes, while `showdar remove` removes

package/bin/showdar.js

@@ -3,8 +3,8 @@ import path from 'node:path';
 import { homedir } from 'node:os';
 import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
-import { AI_TARGETS, PROFILE_ALIASES, PROFILES, SKILLS, canonicalProfile, isDeprecatedProfile, resolveProfile } from '../src/catalog.js';
-import { globalManifestPath, initGlobal, initProject, inspectGlobal, inspectProject, removeGlobal, removeProject } from '../src/project.js';
+import { AI_TARGETS, PRIMITIVE_COUNT, PROFILE_ALIASES, PROFILES, SKILLS, TOTAL_COUNT, WORKFLOW_COUNT, canonicalProfile, isDeprecatedProfile, resolveProfile } from '../src/catalog.js';
+import { addSkill, globalManifestPath, initGlobal, initProject, inspectGlobal, inspectProject, removeGlobal, removeProject } from '../src/project.js';
 import { validateRepository } from '../src/validate.js';
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -32,14 +32,18 @@ function scopeAfter(args) {
 function printHelp(version, command = null) {
   const scopeUsage = '[--scope <project|global>]';
   if (command === 'init') {
-    console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <codex|opencode|claude|universal|all>]\n\nDefaults: scope project, profile full, AI target universal.\nProject scope writes native skills and project .showdar.json. Global scope writes verified user skill directories and ~/.showdar/global.json without project files. Codex and universal use .agents/skills in project scope and ~/.agents/skills in global scope; --ai all writes each shared destination once.\n\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
+    console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <universal|codex|opencode|cursor|claude|all>]\n\nDefaults: scope project, profile full, AI target universal.\nProject scope writes native skills and project .showdar.json. Global scope writes verified user skill directories and ~/.showdar/global.json without project files. Codex and universal use .agents/skills in project scope and ~/.agents/skills in global scope; cursor uses .cursor/skills in project scope and ~/.cursor/skills in global scope; --ai all writes each shared destination once.\n\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
     return;
   }
   if (['status', 'doctor', 'remove'].includes(command)) {
     console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar ${command} ${scopeUsage}\n\nDefault scope: project. Use --scope global for the user installation.`);
     return;
   }
-  console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <codex|opencode|claude|universal|all>]\n  showdar status ${scopeUsage}\n  showdar doctor ${scopeUsage}\n  showdar validate\n  showdar list\n  showdar remove ${scopeUsage}\n\nDefaults: scope project, profile full, AI target universal.\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
+  if (command === 'add') {
+    console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar add <skill> [--ai <universal|codex|opencode|cursor|claude>] [--scope <project|global>]\n\nExamples:\n  showdar add debug\n  showdar add showdar-security\n  showdar add test --ai cursor\n  showdar add review --scope global --ai claude\n\nDefault scope: project. Default AI target: universal, or the configured .showdar.json value when present.`);
+    return;
+  }
+  console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <universal|codex|opencode|cursor|claude|all>]\n  showdar add <skill> [--ai <universal|codex|opencode|cursor|claude>] [--scope <project|global>]\n  showdar status ${scopeUsage}\n  showdar doctor ${scopeUsage}\n  showdar validate\n  showdar list\n  showdar remove ${scopeUsage}\n\nDefaults: scope project, profile full, AI target universal.\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
 }
 
 async function main() {
@@ -55,7 +59,7 @@ async function main() {
   }
   if (args.includes('--help') || args.includes('-h')) return printHelp(version, command);
 
-  const scope = ['init', 'status', 'doctor', 'remove'].includes(command) ? scopeAfter(args) : null;
+  const scope = ['init', 'status', 'doctor', 'remove', 'add'].includes(command) ? scopeAfter(args) : null;
 
   if (command === 'list') {
     console.log(`Profiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\n\nSkills:`);
@@ -65,7 +69,7 @@ async function main() {
 
   if (command === 'validate') {
     const result = await validateRepository(packageRoot);
-    if (result.ok) console.log(`Showdar validation OK (${SKILLS.length} skills).`);
+    if (result.ok) console.log(`Showdar validation OK (${PRIMITIVE_COUNT} primitives, ${WORKFLOW_COUNT} workflows, ${TOTAL_COUNT} total).`);
     else {
       console.log(`Showdar validation FAILED (${result.errors.length} errors).`);
       for (const error of result.errors) console.log(`- ${error}`);
@@ -76,7 +80,7 @@ async function main() {
   }
 
   if (command === 'init') {
-    if (args.includes('--agent')) throw new Error('--agent is no longer supported in V0.2. Use --ai <codex|opencode|claude|universal|all>.');
+    if (args.includes('--agent')) throw new Error('--agent is no longer supported in V0.2. Use --ai <universal|codex|opencode|cursor|claude|all>.');
     const requestedProfile = valueAfter(args, '--profile', 'full');
     const profile = canonicalProfile(requestedProfile);
     const ai = valueAfter(args, '--ai', 'universal');
@@ -112,6 +116,25 @@ async function main() {
     return;
   }
 
+  if (command === 'add') {
+    const positional = args.filter((a, i) => i > 0 && !a.startsWith('--') && args[i - 1] !== '--ai' && args[i - 1] !== '--scope');
+    const skillArg = positional[0];
+    if (!skillArg) throw new Error('Skill name is required. Usage: showdar add <skill> [--ai <target>] [--scope <project|global>]');
+    const hasAiFlag = args.includes('--ai');
+    const hasScopeFlag = args.includes('--scope');
+    const result = await addSkill({
+      cwd: projectRoot,
+      skill: skillArg,
+      ai: hasAiFlag ? valueAfter(args, '--ai', 'universal') : null,
+      scope: hasScopeFlag ? scope : null,
+      home: homedir(),
+      packageRoot,
+      packageVersion: version,
+    });
+    console.log(`Showdar skill ${result.added ? 'added' : 'already installed'}.\nSkill: ${result.skill}\nScope: ${result.scope}\nAI: ${result.ai}\nPath: ${result.destination}`);
+    return;
+  }
+
   if (command === 'remove') {
     if (scope === 'global') await removeGlobal();
     else await removeProject(projectRoot);

package/commands/opencode/showdar/skill.md

@@ -1,6 +1,6 @@
 ---
 description: Invoke a specific Showdar flagship skill explicitly
 ---
-Select exactly one requested Showdar skill and follow it: `showdar-understand`, `showdar-plan`, `showdar-design`, `showdar-build`, `showdar-debug`, `showdar-test`, `showdar-review`, `showdar-upgrade`, `showdar-ship`, `showdar-recover`, `showdar-git`, `showdar-requirements`, `showdar-quality`, `showdar-security`, or `showdar-ops`. If the requested name is ambiguous, choose the smallest matching skill from this list and say which one was selected.
+Select exactly one requested Showdar skill and follow it: `showdar-understand`, `showdar-plan`, `showdar-design`, `showdar-build`, `showdar-debug`, `showdar-test`, `showdar-review`, `showdar-upgrade`, `showdar-ship`, `showdar-recover`, `showdar-git`, `showdar-requirements`, `showdar-quality`, `showdar-security`, `showdar-ops`, `showdar-feature`, `showdar-bugfix`, `showdar-release`, or `showdar-incident`. Whole-task intent (complete feature, end-to-end fix, release lifecycle, active incident) selects a workflow; single primitive intent stays primitive. If the requested name is ambiguous, choose the smallest matching skill from this list and say which one was selected.
 
 Request: $ARGUMENTS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "showdar-skills",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "Production-grade software engineering lifecycle skills for coding agents.",
   "type": "module",
   "bin": { "showdar": "./bin/showdar.js" },
@@ -14,7 +14,7 @@
     "release:check": "node scripts/check-release-version.mjs"
   },
   "engines": { "node": ">=20" },
-  "files": ["bin", "src", "skills", "commands", "router", "bundles", "profiles", "engine", "README.md", "LICENSE"],
+  "files": ["bin", "src", "skills", "commands", "router", "bundles", "profiles", "engine", "README.md", "LICENSE", "CHANGELOG.md", "MIGRATION.md"],
   "keywords": ["agent-skills", "coding-agents", "codex", "opencode", "claude-code", "software-engineering", "developer-tools", "requirements", "qa", "security", "devops", "workflow"],
   "license": "MIT",
   "repository": {
@@ -24,5 +24,8 @@
   "homepage": "https://github.com/caongocquy/showdar-skills#readme",
   "bugs": {
     "url": "https://github.com/caongocquy/showdar-skills/issues"
+  },
+  "devDependencies": {
+    "ajv": "^8.20.0"
   }
 }