skaile-cli 5.17.0 → 5.18.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 5.18.0
+
+### Minor Changes
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - Authoring: one verdict for secrets, symlinks, flows and kinds (5.16.0 critique, p1040, p1041, p411, p1042, p135, p871, p873, p1193, p1194, p926, p915, p486, p743, p875).
+
+  - `add` and `install` withhold every file the publish plan calls a secret (`.npmrc`, `.netrc`, `.envrc`, `credentials`, `token.json`, private keys, certificates, `.pypirc`, `.htpasswd`, `secrets.yaml`, `service-account.json`, `terraform.tfstate`, not only `.env*`) and warn once per file. The list is `isSecretFileName`, shared with the publish plan and the `.gitignore` scaffold. `onEnvFile` / `listEnvFiles` are now `onSecretFile` / `listSecretFiles`.
+  - A symlink in an asset folder refuses the deploy (`add`, `install`, `update`: exit 1, `Nothing was added`), as `library index`, `validate` and the publish plan refuse the library. The `! skipped symlink` line and `DeployOptions.onSkippedSymlink` are gone.
+  - A hand-written `RULESET.md` or `PERSONA.md` is a supported library asset: `library index` writes it to the manifest, `validate` checks it, `show`, `asset show`, `add` and an agent's `composes:` resolve it.
+  - `metadata.requires` of a SKILL.md and the `items[].ref` of a preset are checked with the one ref rule `dependencies:` uses, in `validate`, `library index` and the publish plan; `add` says `invalid publisher "Bad!"` instead of `publisher required`.
+  - `asset show` prints the same not-semver cause as `show` and `info` for an asset `library index` skipped; the 15-digit hint covers a numeric pre-release identifier too.
+  - `library index` drops the old entry of a flow whose `id:` was renamed but whose file was not; the message names the real rule (a deployed flow is loaded as `<id>/<id>.flow.yaml`).
+  - `validate` and the publish plan fail an asset directory the manifest does not list; `validate versions` in a directory with no asset exits 1; `validate` warns on `reads_from:` / `writes_to:` (no release reads them; they left the skill schema).
+  - `add`, `install` and `update` name a placeholder `description:` next to a placeholder body (`description and body are still the scaffold placeholder`).
+  - `library init --path` refuses a folder with deployed copies (`.claude/`, `.skaile/`, `.codex/`, `.omp/`) also without a `skaile.yaml` unless `--force`, and refuses a tree with an asset file that does not parse before anything is registered.
+  - A symlink in an asset folder is refused before the first copy is written and before `install` removes a stale asset, for every kind including `agent` (an agent with a symlink used to deploy with its source cache dropped). A credential file that an older release deployed is listed as extra by `check`, `doctor` and `diff` and deleted by the next `install` or `update` (`.env*` stays). `validate` and the publish plan skip deployed copies under `.claude/`, `.codex/`, `.omp/`, `.skaile/` and `dist/`; `library init --path` refuses only the deploy folders, not `settings.local.json` or `.omp/plans`; `validate versions` says `no versioned asset` for a library without versioned kinds.
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - Harnesses: the omp extension file that `integration install --driver omp` writes holds no host path and is committed, not gitignored (omp skips an ignored extension; install removes the old ignore line and says when another rule still ignores it); `integration uninstall --driver codex|all` removes the trust entry install added to the user's codex config; a `--model <provider>/<model>` whose provider is not in the registry is refused by `run` and `repl` (also with `--dry-run`); a driver failure points at a real session id or at nothing, never at a literal `<session-id>`; a plugin that fails to install prints one `!` line with the installer's last error; the codex delegate warning is printed when files are written, not on every install; `config unset <driver|model> [--global]` exists and the `config set driver` warning in a project that names another harness names it; the omp home sweep removes the `standalone-*` homes of older releases; `integration install --driver claude-code --full` copies the installed skills into the plugin; a REPL failed turn is printed once, not again as the driver's own record (p345, p598, p1110, p1111, p1112, p1113, p1114, p1115, p1151, p1190).
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - `add`, `remove` and `source` no longer touch what the project does not own, and the status commands say more. `add --force` replaces a symlink at an agent file (claude-code, codex, omp) instead of writing through it into the file it points at (p1060). A dangling symlink where a locked asset should be is drift for `check`, `doctor`, `outdated` and `diff` (p1061). `source remove` refuses while a locked asset comes from the source (`--force` overrides), and `check`, `doctor` and `outdated` report an asset whose source is gone or now publishes it under another publisher (p1062). `source add --publisher` on a source registered without one is guarded like a declared publisher (p722). `remove` with the library gone prunes the dependencies the lock recorded, `#range` forms included (p95). `add` refuses a flow the flow engine cannot parse (p1192). `install` keeps an agent that an `agents.<id>.ref` or `agent.definition` binds (p982). The `check` line for an agent binding whose library is gone reads as one sentence (p1152).
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - `mcp-server` assets of the store are project state. The payload under `.skaile/assets/mcp-server/<name>/` and the entry skaile wrote to `.mcp.json` count as files of the locked asset: a deleted, edited or extra file, or a missing or changed entry, is drift for `check`, `doctor`, `outdated`, `diff` and `verify`, and `install --locked` writes them back and prints `Restored …` (p1130). `skaile diff mcp-server:<ref>` shows the payload and entry differences instead of `not deployed` (p1132). `verify` of a source asset compares the store's hash with the lock's hash and ignores the commit: the same bytes at another commit are `verified` (p1131). A server skaile does not write to `.mcp.json` shows as `skipped: <reason>` in `list` and `info` and as a `!` line in `check` and `doctor` (p1133). `add` names every required `MCP.md` field nothing sets (`SQL_MCP_DSN`) and says to set it with an `mcp_servers` entry in `skaile.yaml`; `doctor` and `check` keep listing it (p1134). A hand-written `mcp_servers` entry of `skaile.yaml` is configuration, not a locked asset, and is never drift.
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - Serve and mounts: the model endpoint port uses the same bind check as the websocket port (a port held on every interface is refused), a mount watcher does not follow a symlink out of its mount, `@xstate/store` is looked up in the project first and its miss names the add command, a registry no longer replaces the user's own omp default model that only their `models.yml` serves, `serve` refuses an empty `--host` and a padded `--port`, and a `mountPath` that is a symlink leaving the project fails `validate` and is not mounted (p833, p1006, p1170, p1171, p1172, p1173).
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - `install` and `install --locked` keep a locked library asset at its locked version when the library holds a newer one and the deployed copy is intact; only `update` moves a lock. A library re-registered under another name is found by publisher and content hash, and `update`/`install` re-lock the new name for git libraries too. `check`, `doctor`, `outdated` and `diff` print one line for an invalid library asset version. `validate .` checks publisher slugs in `skaile.yaml`. A never-held `#pin` names the pin in `skaile.yaml`. `add` prints one collision summary (`--verbose` lists each). `install --locked` fails on an unresolvable agent instance ref without a lock. `remove` of the last asset of a repo drops its `sources:` row.
+
+### Patch Changes
+
+- [#1092](https://github.com/skaile-ai/workspaces/pull/1092) [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba) Thanks [@mortegro](https://github.com/mortegro)! - Docs match 5.16 behaviour: `sources[]` is `{url, pin?, publisher?}` (also in the `repositories:` migration error text), `run` refuses a one-word prompt that matches no flow (quote more words), `skaile session logs` is named for the log database, the `skaile-ai` publisher in `asset` examples, and the other doc defects of the 5.16.0 critique. `WORKSPACE_IDEAS.md` moved to `docs/superpowers/` so the docs site no longer builds it.
+
+- Updated dependencies [[`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba), [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba), [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba), [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba), [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba), [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba), [`611bf2b`](https://github.com/skaile-ai/workspaces/commit/611bf2bb36f146f9959053bdbccc73fce61b5dba)]:
+  - @skaile/workspaces@5.18.0
+
 ## 5.17.0
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skaile-cli",
-  "version": "5.17.0",
+  "version": "5.18.0",
   "description": "Run the Skaile CLI via `npx skaile-cli` — thin wrapper around @skaile/workspaces",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "asset-manager"
   ],
   "dependencies": {
-    "@skaile/workspaces": "5.17.0"
+    "@skaile/workspaces": "5.18.0"
   },
   "publishConfig": {
     "access": "public"