skaile-cli 5.15.1 → 5.17.0

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # Changelog
 
+## 5.17.0
+
+### Patch Changes
+
+- [#1091](https://github.com/skaile-ai/workspaces/pull/1091) [`b03ddba`](https://github.com/skaile-ai/workspaces/commit/b03ddba92a3aa044d03319b8c2f0eef4b89c99ce) Thanks [@Frozen666](https://github.com/Frozen666)! - claude-sdk driver: a reply with an unclosed `[` is no longer cut off at that `[` ([#1039](https://github.com/skaile-ai/workspaces/issues/1039)).
+
+  The streaming sanitizer treated any `[` with no later `]` as the start of a leaked marker and held back everything after it, and nothing sent the held-back part when the message ended, so the stored and displayed reply stopped just before the `[` (for example a LogsQL range `_time:[2026-10-13T20:30:00Z, now)` or a half-open interval `[0, 1)`). The driver now sends any held-back tail as a final text delta before `message_start`, and the sanitizer holds back only what can still become a marker (a bare `[`, a tag-name prefix, a namespace being written, or a `[User]` label waiting for its colon), so an ordinary `[` streams live.
+
+- Updated dependencies [[`b1dce19`](https://github.com/skaile-ai/workspaces/commit/b1dce1949d47593afa24e72f6c508756d6cb366a), [`b03ddba`](https://github.com/skaile-ai/workspaces/commit/b03ddba92a3aa044d03319b8c2f0eef4b89c99ce), [`b14e6ea`](https://github.com/skaile-ai/workspaces/commit/b14e6ea772f8551f9eabf2dfbaa7024a643b1e75), [`204fd67`](https://github.com/skaile-ai/workspaces/commit/204fd6723a9a36fd1784fc12b6cfa8b63ca6cdcf), [`2dd0486`](https://github.com/skaile-ai/workspaces/commit/2dd0486410798807cc3c9163bcea761a98204f3b), [`53d960b`](https://github.com/skaile-ai/workspaces/commit/53d960b301bab45ffbb8090cab1fc1280fa88864)]:
+  - @skaile/workspaces@5.17.0
+
+## 5.16.0
+
+### Minor Changes
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - `validate`, `library index` and `library publish` give one verdict per authoring case.
+
+  - A manifest entry with `root: .` or an empty root fails all three with `an asset needs its own directory`, instead of an index parse error on `.gitignore` (p870).
+  - `library index` keeps a flow whose `id:` differs from its file name out of the manifest and the index (no `Renamed manifest entry`), and `add` refuses such a flow (p871).
+  - The secret check and the scaffold `.gitignore` cover `.npmrc`, `.netrc`, `.envrc`, `credentials` and `token.json` (p872).
+  - The semver error for a part of more than 15 digits names the 15-digit limit (p873).
+  - `library init` exits 1 and registers nothing for a project folder with deployed copies (p875) and for a `skaile.manifest.yaml` that does not parse (p915).
+  - `library index` fails an untouched scaffold for all six kinds, as `validate` does; the prompt line reads `write the prompt text` (p1020).
+  - `metadata.tags`, `metadata.requires` and `metadata.prerequisites` in their schema shapes (array, array, object) are no conformance finding; the factory skills pass `validate --strict-conformance` (p1027, p853).
+  - `validate` of a directory without a manifest refuses a symlink to an asset directory (p520).
+  - A `composes:` ref that neither the library nor a registered library of its publisher holds is an error in `validate`, `library index` and the publish plan (p415).
+  - `add`, `install` and `update` print `! <ref> body is still the scaffold placeholder` for a deployed library asset with an untouched body (p926).
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - `skaile remove` and `add` respect who owns a folder and keep unrelated state.
+
+  - `remove` deletes a deployed folder only when its own lock entry (publisher, kind and name) owns it. For a ref whose folder another publisher's lock entry holds, it drops the declaration, keeps the folder and names the owner (p57, p720).
+  - A dangling symlink at the asset path counts as an unowned path: `add` refuses to replace it without `--force`, `remove` keeps it (p892).
+  - `install` without a lock adopts an agent file whose bytes equal what skaile renders from the agent, as it does for skill folders (p913).
+  - `add` warns `Same version, different content` when two libraries hold a ref at one version with different bytes; the default library still wins (p927).
+  - `install --locked` in a project with no dependencies prints `Nothing to install` and exits 0 (p944).
+  - `remove` of the last mcp-server drops its `.mcp.json` entry at once and deletes `.mcp.json` and `.skaile/mcp-managed.json` when nothing else is left in them (p963).
+  - `remove agent:<ref>` keeps the other `agents.<id>` bindings and the agents they declare (p982).
+  - `add` of an asset a reader source does not list says to add it to `skaile.manifest.yaml` in the source repo and push; `library index <reader>` exits 1 without editing the clone (p1026).
+  - `add bundle:@acme/x` prints `Error: asset kind "bundle" no longer exists …` instead of the class name (p1032).
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - omp one-shot output and model endpoint (p980, p1003, p1004, p1005, p1006, p1007, p1008). `skaile run --driver omp` prints the whole answer: the text in omp's `message_start` is now the first delta, not dropped. The omp driver merges `config.env` over its base env, so `serve --driver omp --model-endpoint` keeps `PATH`. The model endpoint finds `@earendil-works/pi-ai` in the project first, and `serve` names both places it looked in before the ready line. A model with an unknown provider prefix answers 404 `model_not_found` and lists the providers. A busy `--model-endpoint` port is one line. The public types of `@skaile/workspaces/model-endpoint` compile without pi-ai. `skaile serve` prints a `ws://` line when it listens.
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - Protocol guarantees and agent runs (p1000, p1001, p1002, p410, p421 of the 5.15.0 critique). `access: read-only` now blocks every write path of a mount: a host `resource_request` `write`, `write_range`, `mkdir` or `delete` answers `Connector "<id>" is read-only` (before, only the agent tool path checked it). A mount resolves symlinks and refuses a target whose real path is outside the mount (`Path escapes the mount through a symlink`); a link to a folder inside the mount lists as `directory`. `runner.set_state` is implemented: it writes a key of a shared-state store declared in `session_init.sharedState` and the store answers `state_changed`; an id `session_init.sharedState` did not declare answers `store_not_found`, also for a live flow or user connector. An agent added from a local library that `composes:` a library skill (or another library asset) now runs and dry-runs without a `sources:` clone: the content source reads a locked library asset from the registered library its lock entry records (by name, else by remote URL), and the pinned hash still decides between run and `composition_conflict`. `skaile run --instance <id>` and `skaile repl --instance <id>` start a named `agents:` instance with its overrides (its `model.preferred`, unless `--model` is given, and its `budget.max_turns` / `permissions.max_turns`); an unknown id exits 1 and lists the declared ones. `permissions.permission_mode: interactive` is honoured: claude-sdk runs under `default` and asks before each tool call it does not auto-allow (`repl` and a terminal `run` prompt `y/N`, `serve` clients get a `question` event with an `approval` card, an unanswerable session refuses); codex (standalone) uses `approvalPolicy: on-request` and refuses a command that needs to leave its sandbox, since it cannot show an approval card.
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - Project state commands: no stack traces, no hidden drift. `show`, `rebuild`, `clean` and `info` print one `✗` line for a `skaile.yaml` that does not parse (p910) and for a library asset whose version is not semver (p874). An extra file in the deployed copy of a source- or store-origin asset is drift for `check`, `doctor`, `outdated` and `diff`, and `install --locked` prints `Removed <file>` when it deletes one (p964). `outdated` lists a `0.0.0-sha.<commit>` source lock key whose file now declares a version as `re-key (a → b)` (p914). `diff agent:<ref>` renders and compares the agent instances bound to the ref, and `check` names the instance of an edited instance file (p925). After `library rename`, `outdated` names the locked library on the left of `origin changes` (p890), and the next `install` locks the library under its new name (p893). `search` lists a source asset in the version `add` locks (p855). `remove` leaves the `sources:` rows of the lock as the next `install` builds them, so that `install` does not rewrite a clean lock (p790).
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - Store and source consumption.
+
+  - A failed `update` catalog refresh keeps the cached catalog; the cache is replaced only after the new list arrived (p960).
+  - `store show <ref>#<missing version>` says `<name> has version(s): …`, and no longer asks for a "full ref" when the ref is full (p962).
+  - `verify` reports a deployed copy that differs from the lock, compares a store asset with the store's install manifest, and names the reason when it cannot (p965).
+  - A skipped MCP server is warned about once per reason, not on every `add`, `install` and `update` (p966).
+  - A `--publisher` source asset has one ref, `kind:@<declared publisher>/<name>`; the library-name slug is refused with a hint. A source asset without a version is `0.0.0-sha.<commit>` in `search`, `info`, `add` and the lock; `add …#0.1.0` fails and names it (p967).
+  - An ES-module `server.js` payload of a store MCP server gets a `package.json` with `"type": "module"`, so the `node` command in `.mcp.json` starts it (p971).
+  - A source URL has one spelling (trailing slash dropped, scheme and host lower-cased): `source add …/r.git/` is the source `…/r.git` already is, and the `--publisher` guard cannot be bypassed with it (p722, p891).
+  - A source made under the key a `….git/` URL had before is found by its old clone path, the url its library row records, and its old curated-manifest slug: `source sync` moves the row, the manifest still applies, and `source remove` drops the row (p891).
+  - A version-less asset of a source clone has one version, `0.0.0-sha.<commit>`, also when it comes from the shared reader library in a project without `sources:`: `install --locked` and `check` accept what `add` locked. A pin on that version is accepted even when the commit is all digits with a leading zero (p967).
+  - `source add` and `source sync` print the notes about files outside the asset filter as one line with a count; `--verbose` lists them (p1031).
+
+### Patch Changes
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - Docs and factory skills match the CLI (p1021, p1023, p1024, p1025, p1028, p1029, p1030 and 37 doc defects of the 5.15.0 critique). The factory skills `authoring-skaile-assets`, `authoring-skaile-manifests` and `skailify` now say what the CLI does: a `name:` that differs from `assets[].name` fails `validate` and `library index` renames the entry; an asset on disk but not in the manifest fails `add` with `is in library "<lib>" but not listed in its skaile.manifest.yaml`; `sources[]` is `{url, pin?, publisher?}`; a second `asset import` fails with `Destination already exists`. `docs/CURRICULUM.md` is labelled a blueprint and uses real commands, the three workspace-plugin pages use `skaile add skill:@skaile-ai/use-exa`, `commands/index.md` lists every command, and the resolver page no longer presents `skip_checks` as a flow-file feature.
+
+- [#1079](https://github.com/skaile-ai/workspaces/pull/1079) [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd) Thanks [@mortegro](https://github.com/mortegro)! - Harness rough edges (p940, p941, p942, p943, p945, p981, p1022, p1033, p911, p912, p744, p591, p598, p811, p428). `integration install --driver codex` marks the project trusted in `~/.codex/config.toml`, and `integration status` says `untrusted` when it is not. The claude-sdk driver no longer prints the SDK warning `CLAUDE_SDK_CAN_USE_TOOL_SHADOWED`. An unknown `--driver` of `integration` is one line. `run --dry-run` rejects a model the driver refuses. The repl banner lists the deployed agents. A Claude alias in `model.preferred` is not sent to codex or omp. `config set driver` validates the name; `config get --global` reads the personal file. `check`, `doctor` and `clean` take `--global`. `add --global --harness` is remembered per entry. The omp private home is deleted at exit and old ones are swept. A driver failure is printed once in `repl`. `add agent:` with a delegate under codex prints one line about it. `integration install --full` ignores the per-machine `.claude` files. `run` and `repl` load the project's declared `plugins:` before resolving `--driver`. `remove --global` and `clean --global` never delete an old omp folder an earlier sweep kept.
+
+- Updated dependencies [[`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd), [`4db3b13`](https://github.com/skaile-ai/workspaces/commit/4db3b138138faf5e6754a68d017a1a8265621bfd)]:
+  - @skaile/workspaces@5.16.0
+
 ## 5.15.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skaile-cli",
-  "version": "5.15.1",
+  "version": "5.17.0",
   "description": "Run the Skaile CLI via `npx skaile-cli` — thin wrapper around @skaile/workspaces",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "asset-manager"
   ],
   "dependencies": {
-    "@skaile/workspaces": "5.15.1"
+    "@skaile/workspaces": "5.17.0"
   },
   "publishConfig": {
     "access": "public"