skaile-cli 5.12.0 → 5.13.0

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # Changelog
 
+## 5.13.0
+
+### Minor Changes
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Agents: the open findings of the 5.12.0 critique.
+
+  - A rendered agent file is part of the drift model. `install`, `add` and `update` record the sha256 of every file an agent renders (`.claude/agents/<name>.md`, the codex and omp files) in the lock entry's new `rendered:` list. `check`, `doctor` and `outdated` exit 1 for a hand-edited agent file (`<file> was edited`), and `install`, `install --locked` and `update` restore it and print `Restored <file>`, as for a skill file (p549, p576).
+  - `install` keeps a source at the commit the lock records: it no longer pulls a pinned clone to the branch tip. Only `update` moves a lock entry (p632).
+  - `check` names every instance bound to an agent whose pinned `SOUL.md` / `knowledge/` was edited after `rebuild`, and `doctor` prints the same lines and exits 1 (p635). `RULES.md`, `DUTIES.md` and local rulesets are `inline-live`: they are read at every run start, so the docs no longer say an edit is a conflict (p414).
+  - `validate` fails a `composes` item of a kind with no default binding (`preset`) that sets no `binding:` (p415), resolves `composes` refs against the enclosing library when it gets one asset directory (p633), and warns on an unknown key under the primary `agent:` block, as it does under `agents.<id>` (p634).
+  - `skaile run` prints the typed `result` a finished `agent.run` role returned, and no `output=` for a failed run (p636).
+  - omp: the system prompt goes to a per-spawn file under `.skaile/cache/omp-system/` that the process deletes, so a nested `agent.run` child never reads its parent's prompt (p630); the agent's soul reaches the live prompt once whether or not a memory block seeds from `SOUL.md` (p631); omp's home is a private directory that links the agent's files, so omp's databases never land in the pinned agent directory, and a missing credential names `/login` instead of a path in the cache (p637).
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Library authoring: the open findings of the 5.12.0 critique.
+
+  - A library holds plain files: `validate`, `library index`, `library publish` and `asset import` (and `asset migrate --mode copy`) refuse a symlink with one line, `<path> is a symlink to <target>`, and exit 1. This covers an alias of an asset directory (`s1alias -> s1`), a link to `.` and a link to a file inside an asset. `validate` no longer passes a library that `index` and the publish plan refuse (p520, p224).
+  - Editor leftovers (`*.swp`, `*.swo`, `*~`) join the names no asset ships: `asset import`, the deploy and the content hash leave them out (p224).
+  - The asset-scan cycle warning is printed once per directory and run, names the library and says `remove the symlink` (p524).
+  - Versions follow strict semver (no leading zero, no empty identifier, numbers up to 15 digits): `01.0.0`, `1.0.0-alpha..1` and `99999999999999999999.0.0` are refused by `validate`, `index` and the publish plan (p521).
+  - A SKILL.md with a UTF-8 BOM or CRLF line endings parses like any other; a file that still fails says `BOM` or `CRLF` in the message (p522).
+  - `library pull` and `library sync` print `! <n> asset(s) on disk are not in the manifest; run skaile library index <name>` after bringing assets the manifest does not list (p523).
+  - `library create --help` offers the scaffoldable kinds only (p567).
+  - An untouched scaffold body (`Skill prompt goes here.`) is an error in `validate` (exit 1), so a passing `validate` means the asset can be published; the publish plan keeps refusing it, and `library index` keeps indexing but warns `publish refuses it until you write the <kind> prompt` (p675).
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Consume commands: the open findings of the 5.12.0 critique.
+
+  - `source add` of a source with no publisher (a `file://` URL, a local path, GitLab, a manifest without `publisher:`) exits 1 with `publisher must be declared in skaile.manifest.yaml … or recorded with skaile source add --publisher` and records nothing, instead of printing `Indexed` and `registered` for a source every later command skips. New option `source add --publisher <name>` records the publisher on the `sources:` entry (`SourceEntry.publisher`, also in preset `sources:`); `publisher:` in the source manifest still wins (p540, p613).
+  - A local path given to `source add` is resolved to an absolute, real path before it is stored: `../remotes/srcA.git` and its absolute path are one source, cloned under `cache/sources/`. The local-catalog errors name `skaile library init <name> --path <dir>` (p618).
+  - `add` refuses to deploy over a folder (or agent file) no lock entry owns, such as a hand-made skill of the same name: exit 1, the folder is named, `--force` replaces it. A folder the deploy would rewrite with the same content (the one `asset import` copied the skill from: same bytes, or same body with frontmatter the asset only extends) is adopted without a word (p542).
+  - `update` re-locks and reports only the source assets whose files changed. A source asset without a declared version keeps its `0.0.0-sha.<commit>` lock key while its files hash the same, so `update` and `outdated` list the same assets (p543).
+  - `update` skips the catalog refresh when every locked asset comes from a library, and prints a failed refresh as `! Catalog refresh failed` (not `✗`) when it goes on with exit 0 (p544).
+  - A source clone that cannot be refreshed is reported once as `! source clone <name> not refreshed: <cause>; using the cached commit`, without the `[repo-manager]` tag, the double period or the second path (p545).
+  - `library link` to a remote that already has branches but not the library's branch exits 1 with `pass --branch <name>` instead of pushing a second, unrelated history (p546).
+  - `add` names a ref held by two libraries once (the `! … exists in 2 libraries` warning), not a second time as `is held at different versions` (p547).
+  - `source sync <name>` with a name two sources share exits 1 and lists both, as `show` and `remove` do (p548).
+  - `update <ref>` of a locked asset that another asset requires answers `<ref> is required by <ref2>; run skaile update <declared ref>` (exit 1), not `No declared asset matches` (p550).
+  - Docs: `diff` with a publisher-less ref that names one locked asset still diffs it (p541).
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Flows by id, local sources, flow dependencies and the docs site: the open findings of the 5.12.0 critique (docs-flows).
+
+  - A flow asset is named by its `id:`, not by the slug of `name:` (`name:` stays a display label): a flow with `id: flow-a` and `name: Something Else Entirely` is `flow:@acme/flow-a`, `add` finds it and deploys `.skaile/flows/flow-a/flow-a.flow.yaml`, which the flow engine loads. `validate`, `library index` and `publish --dry-run` fail a flow whose file stem differs from its `id:` (`flow id "x" does not match the file name "y.flow.yaml"`) (p670).
+  - `source add <local path>` exits 1 with one line, before anything is cloned, when the path is a registered library (`library list` already shows it) or not a git repository (p671).
+  - The skills a flow's nodes name in `run.assets` (and the sub-flows they call) are the flow's dependencies: `info` lists them, `add flow:…` deploys them, `check` and `install --locked` report one that is missing (p676).
+  - A flow run whose driver cannot start (SDK missing, no model, `omp` exits at once) ends the session as `failed` with the cause in `error`; `status` prints `Error:`. It used to stay `paused` although no node ran (p677).
+  - The docs site resolves every relative link (`../commands/library`, `./03-run-a-flow`, links to repo files become GitHub links), and CI builds the site and fails on a dead internal link: `docs/site/scripts/check-links.mjs` (`bun run check:links`) (p672).
+  - Docs: driver targets are `claude-code`, `omp` and `codex` only (p673); `skaile migrate assets` is the CLI for the publication half of the v2→v3 migration (p674); `WORKSPACE_IDEAS` is marked ideas-only (p678); tutorial 03 shows the real `Driver:` line, the failed-run output and the flow dependencies; the stale wording of the v6 docs list is fixed.
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Harnesses and drivers: the open findings of the 5.12.0 critique.
+
+  - `--driver omp` with an unusable provider entry (credential variable unset) starts omp on the user's own agent directory when no entry is usable or the selected model's entry was left out, so omp's own login and default model apply and the notice `omp falls back to its own login` is true (p362).
+  - `check`, `doctor` and `install --locked` treat an omp agent as deployed only when the flat `.omp/agents/<name>.md` exists; a deleted file is `locked but its deployed copy is missing` (p590).
+  - `integration install` adds `.codex/config.toml`, `.omp/extensions/skaile.ts` and `.skaile/plugin-state.json` to the project `.gitignore`, as `init` does; the docs say they are per machine (p591).
+  - `add --global` for omp deploys to `~/.omp/agent/skills`, `~/.omp/agent/agents/<name>.md`, `~/.omp/agent/prompts` and `~/.omp/agent/contracts`, where omp reads user assets (p592).
+  - `run --driver codex --model <provider>/<model>` for a provider codex cannot address exits 1 naming the provider, before any request (p593).
+  - A Claude login that expired ends the turn with the SDK's own text and `run claude /login` instead of `The model reported an error but sent no details` (p594).
+  - `skaile run "<prompt>"` with stdout piped writes the bare answer and one newline, with no `agent ▶` prefix and no blank lines; a failed turn writes nothing to stdout (p595).
+  - Docs: `repl` lists every registered driver and the banner counts the deployed skills (p596).
+  - `integration uninstall` names the file the entry came from (`.mcp.json`) and deletes an empty `.claude/settings.json` and `.skaile/plugin-state.json` (p597).
+  - A failed turn is printed once: one `✗` line with the provider's message, `check your API key or login` for a credential error, and a pointer to `skaile logs`; the `[error]` records stay in the log database (p598).
+  - The `serve` preflight says the optional SDK must be installed next to the `skaile` install, not in the project (p656).
+  - `validate` reports a `connectors:` entry whose `driver` no catalog entry provides, with the text `serve` logs (p657).
+  - The codex driver accepts the codex CLI's ChatGPT login (`$CODEX_HOME/auth.json`, default `~/.codex/auth.json`) as well as an API key: the file is linked into the session's private `CODEX_HOME`, an exported `OPENAI_API_KEY` / `CODEX_API_KEY` still wins, and with neither the start fails with `codex driver needs OPENAI_API_KEY, or the codex CLI's ChatGPT login …` (p348b).
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Protocol, serve and plugins: the open findings of the 5.12.0 critique.
+
+  - `skaile serve` on a busy port exits 1 right after the one-line message instead of staying alive (p468).
+  - A `local` connector honours `mountPath:` (on the connector or under `params:`, `${project}` allowed): reads and writes go to that directory, not to a copy under `.mounts/<id>` (p650).
+  - A second `plugin install` works: the store install is frozen to its lock file only when the plugin list did not change. A failed install also puts the store's `package.json` back (p651).
+  - `plugin install` falls back to `npm` when `bun` is not on `PATH`, and names the missing tools when neither is found (p652).
+  - The replayed `session_init_ack` carries the same `capabilitySignature` as the handshake ack of the same runner: the `runner.*` capabilities are registered before the handshake ack is built, not after (p653).
+  - The no-token warning of a loopback bind (`--host 127.0.0.1`) says local processes can drive the agent and no longer advises `--host` (p654).
+  - A project without `agent.definition` (a fresh `skaile init`) no longer logs `no agent definition found` as a warning; a set but unresolvable `agent.definition` still warns (p655).
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - State and upgrade: the open findings of the 5.12.0 critique.
+
+  - `skaile validate <path>` creates nothing: a missing path, or the gone directory of a registered library, stays missing and exits 1. `assertManifestEditable` no longer creates the library directory (p560).
+  - The 5.12.0 MIGRATION entry says a project that added an agent with 5.11.0 sees one rewrite of `.claude/agents/<name>.md` (p561).
+  - An equal-version tie between libraries goes to the default library on `update` and `add`, then to the library the lock names; the docs and the MIGRATION entry now say so (p562).
+  - `install`, `install --locked` and `update` keep `.env`, `.venv/`, `__pycache__/` and `*.pyc` in a deployed asset folder and print nothing about them; they remove only the files they print (p563).
+  - A declared asset with a requirement nothing holds reads `requires <dep> but no library or source holds it — register the library …` in `check`, `doctor`, `outdated`, `why`, `diff` and `install --locked`, not `run skaile install` (p564).
+  - `add` and `install` say `Store unreachable` for a requirement the store could not be asked about, not `not found` (p565).
+  - `diff <ref>` prints the diff of `<ref>` first and lists a problem of an asset it requires after it (p575).
+  - `outdated` says `locked and not deployed` and advises `skaile install --locked` for a required asset whose folder is gone; `check` and `doctor` advise it too (p577).
+  - From a subdirectory of a project, `No skaile.yaml found` is followed by the nearest parent that holds one and `--project-dir` (p578).
+
+- [#1064](https://github.com/skaile-ai/workspaces/pull/1064) [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9) Thanks [@mortegro](https://github.com/mortegro)! - Store: the open findings of the 5.12.0 critique.
+
+  - `install --locked` restores a store asset whose upstream repo is `github.com/skaile-ai/ai-assets` (the URL the bundled factory source shares): it is fetched and SHA-verified file by file instead of being checked against the bundled factory tree, which does not hold its path. A second machine (lock + yaml only) restores it, and `check`, `doctor`, `outdated` and `install --locked` agree (p380).
+  - Every store kind is installable: `store search`, `store show` and the `manage` feed list `mcp-server`, `agent` and `contract` rows with an `Install:` line, and `add` takes them and `install --locked` restores them; the `Not installable` branch is gone (p610).
+  - A store row's requirements are canonical `kind:@publisher/name[#pin]` refs; a kind-less `@publisher/name` gets the kind `skill`, and a path-style entry the indexer left behind (`../../../ai-asset-management/agents/skaile/agent.yaml`) is dropped. `add` of such an agent no longer fails with `Asset not found` (p611, p615).
+  - `store show <ref>` with a ref that is not a ref prints `Invalid asset ref "<ref>": ...` instead of blaming the network; `store show`/`store search --kind <unknown>` exit 1 and list the valid kinds (p612).
+  - A store row flagged `demo` or `internal` is hidden from `search`/`store search` by default; `--all` lists it (p616).
+  - A 404 or 405 from a REST-framed catalog host says `framing is rest; set catalog.framing trpc`; `catalog test` probes the route the store verbs use for the configured framing and names the mismatch instead of printing `reachable` (p617).
+  - With `cache_ttl: 0`, `search --store` answers from the cached catalog like `store search`; plain `search` keeps the store leg off with a one-line notice (p619).
+  - `source manifest init <bare name>` that is neither a registered source nor a store slug exits 1 with `not a git URL or an owner/repo shorthand`, as `source add` does, and clones nothing (p614).
+
+### Patch Changes
+
+- Updated dependencies [[`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9), [`c0c483e`](https://github.com/skaile-ai/workspaces/commit/c0c483e068aeb5f5f1979565a251b5a29e0d72c9)]:
+  - @skaile/workspaces@5.13.0
+
 ## 5.12.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skaile-cli",
-  "version": "5.12.0",
+  "version": "5.13.0",
   "description": "Run the Skaile CLI via `npx skaile-cli` — thin wrapper around @skaile/workspaces",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "asset-manager"
   ],
   "dependencies": {
-    "@skaile/workspaces": "5.12.0"
+    "@skaile/workspaces": "5.13.0"
   },
   "publishConfig": {
     "access": "public"