skaile-cli 5.6.0 → 5.7.0

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # Changelog
 
+## 5.7.0
+
+### Minor Changes
+
+- [#1027](https://github.com/skaile-ai/workspaces/pull/1027) [`13a54f1`](https://github.com/skaile-ai/workspaces/commit/13a54f15275a9410af554a3eadf05c58e0d1b932) Thanks [@mortegro](https://github.com/mortegro)! - Library authoring fixes from the 5.4.0 review:
+
+  - `skaile library index` and `skaile validate` now accept dependency refs in the documented `kind:@publisher/name#version` form. A malformed `dependencies` entry fails both commands with the same message; before, `index` dropped it and exited 0 while `validate` passed.
+  - `skaile library index` no longer writes a broken asset into the manifest. An asset whose file does not parse (e.g. an empty `SKILL.md`) is reported and skipped with exit 1, an asset with a version that is not semver is skipped with a warning, and `library publish` refuses both. Re-indexing removes the index row of an asset it now skips, so `add` and `search --local` stop finding the old version.
+  - `skaile validate` fails on a `metadata.version` that is not semver, warns when the manifest version differs from the asset file (the file is the source of truth; run `skaile library index`), and flags unedited scaffolds of every kind (prompt, agent, contract and flow, not only skill).
+  - `skaile validate versions [path]` and `skaile validate changelog [path]` take a path like plain `skaile validate` and default to the library you are in. `--changed-only` outside a git repo prints one line, `git diff failed in <root>: …`. `skaile validate versions` now fails on a non-semver version, like plain `validate`.
+  - `skaile library create` now scaffolds only skill, agent, prompt, flow, preset and contract. Other kinds (persona, ruleset, knowledge, mcp-server, connector) are refused with exit 1 instead of silently creating a skill. Hand-written files of those kinds still validate.
+  - `skaile library create --dir` is refused when it points outside the library.
+  - `skaile library create` rejects asset names that are not lowercase kebab-case and invalid `--publisher` values (also checked by `library set publisher=`), with a hint and exit 1, creating nothing.
+  - `skaile library create` and `skaile library index` no longer write `metadata.publisher` into asset files; the manifest (`assets[].publisher`, else the library's `publisher:`) is the only publisher source. `skaile validate` warns about a file whose `metadata.publisher` differs from it. Existing files keep the key until you remove it.
+  - `skaile library index` and adopting an existing directory with `skaile library init` now warn when the publisher falls back to the library name.
+  - `skaile library link` and `skaile library init --git` warn when the remote is not a GitHub URL, since `library publish` only supports GitHub. The exit code is unchanged.
+  - API: `createScaffold` / `AssetManager.create` return `{ ok: false }` for a kind without a scaffold instead of creating a skill, and `syncManifestWithDisk` returns `{ removed, skipped }` (see MIGRATION.md).
+
+- [#1028](https://github.com/skaile-ai/workspaces/pull/1028) [`baa938a`](https://github.com/skaile-ai/workspaces/commit/baa938a4ea1e888afbb5af6441082cb8e765406a) Thanks [@mortegro](https://github.com/mortegro)! - Library git flow, `library set` guards and path fixes from the 5.4.0 review:
+
+  - `skaile library pull` and `skaile library sync` stay fast-forward-only. When local and remote both changed, they now fail with one line that names `skaile library git <lib> pull --rebase origin <branch>`, instead of a long git dump (`pull` used to exit 0 here). `library init --git` and `library link` now set the branch upstream.
+  - `skaile library commit` now refuses (exit 1, no commit) while a rebase, merge, cherry-pick or revert is unfinished or unmerged files exist.
+  - `skaile library set <lib> isDefault=true` now makes that library the only default instead of failing with a SQL error. `isDefault=false` on the current default is refused.
+  - `skaile library set` now rejects an unknown `ownership`, `contributor`/`reader` on a local library, and `backendConfig.url` on a local library, with the same wording `init` uses.
+  - Library names must be letters, digits, `_` or `-`, starting with a letter or digit (`init`, `rename`, `set name=`). Names like `a/b` or `../y` no longer create nested folders or crash. `set name=` now renames like `library rename`. `library remove --purge` also removes the empty parent folders it leaves behind under the libraries root.
+  - `skaile library remove` without a TTY and without `-y` now exits 1 with `library remove needs confirmation: pass -y` and keeps the library.
+  - Git-only commands on a local library (`push`, `pull`, `sync`, …) now tell you to run `skaile library link <name> <url>` first.
+  - A relative `SKAILE_HOME`, `SKAILE_INDEX_PATH`, `SKAILE_LIBRARIES_DIR` or `SKAILE_CACHE_DIR` is now made absolute at startup, so commands run from a subdirectory, and programs `skaile` starts, use the same libraries, index and cache.
+  - `skaile source remove` and its `--purge` help now name the real cache directory instead of a hard-coded `~/.skaile/cache/sources/`.
+  - `skaile update` with `catalog.url: local` now prints `Catalog refresh skipped (catalog.url: local)` instead of reporting a failed refresh.
+  - Piping output into a reader that closes early (`skaile search … | head -1`) now exits 0 without an EPIPE stack trace.
+  - `skaile --help` lists the real session subcommands (`session list|show|switch|delete`), and the README quick start no longer uses the non-existent `skaile run mvp`.
+  - Registering or renaming a library through `@skaile/workspaces/library` now rejects names that are not letters, digits, `_` or `-`, and `source add` turns repo names such as `my.repo` into valid library names.
+
+- [#1026](https://github.com/skaile-ai/workspaces/pull/1026) [`014b422`](https://github.com/skaile-ai/workspaces/commit/014b422606c879517419ad467fbc8426671a729f) Thanks [@mortegro](https://github.com/mortegro)! - Resolver and lock fixes from the 5.4.0 review:
+
+  - `skaile add` and `skaile install` now resolve a ref from your registered library before asking any store, so a library asset adds even when the store is unreachable, and the success line names the library. A `#version` pin the library does not hold still falls through to the store. See MIGRATION.md.
+  - `skaile install` no longer asks the store about refs your library already provides, and an unreachable store is reported once per store URL instead of once per ref.
+  - The dependencies of a library asset (`requires` and `dependencies`) are now deployed and locked together with it. Dependency cycles are handled.
+  - `skaile add skill:@acme/x` now finds an asset created with `library create --publisher acme`, even when the library's own publisher is different.
+  - Short refs like `skill:name` now find library assets in `info`, `why` and `diff`. `diff` on an unknown ref says "not found" instead of crashing.
+  - `skaile doctor` and `skaile check` now report unmet requirements of library assets and locked assets whose library is gone, instead of saying everything is fine. `skaile check` fails for every declared dependency that does not resolve and names `skaile install`.
+  - Re-adding an asset with a new version pin (`skaile add x#0.2.0` after `skaile add x`) now replaces its line in `skaile.yaml` instead of adding a second one.
+  - Upgrading a source or store pinned asset now leaves one entry for it in `skaile.lock.yaml`, not one per version.
+  - The lock now records the library asset version that was actually deployed, so bumping a skill and running `skaile update` writes the new version and `skaile install --locked` passes.
+  - `skaile remove` now removes a declared asset from `skaile.yaml` and the lock even when its files are already gone, including every duplicate line an older `add` left behind. It exits 1 only when there was nothing to remove.
+  - `skaile outdated` now reads library assets from disk, so a version bump shows up once without `skaile library index` first. It lists a library asset whose content changed without a version bump as `content changed since lock`, and a source asset after `skaile source sync` moved the clone past the locked commit, with the number of commits behind. A lock that is ahead of your local clone is not reported as behind.
+  - Adding two sources with the same repo name from different orgs now gives each its own library row, and `source remove` only removes the row of the source you name.
+  - `skaile manage` now ticks an asset only in the library its lock entry names, and `skaile search` shows which library each result comes from.
+  - `asset show` and `asset install` now reject `@publisher/name@version` like `install` does, and `asset show` prints only the canonical `ref`.
+
+- [#1029](https://github.com/skaile-ai/workspaces/pull/1029) [`8b5e19f`](https://github.com/skaile-ai/workspaces/commit/8b5e19fb14f89a475937ceddeb9613dedf871eae) Thanks [@mortegro](https://github.com/mortegro)! - Upgrade hints and docs from the 5.4.0 review:
+
+  - `--domain` on `asset import`, `asset migrate`, `library create` and `validate versions`, and `skaile library set <lib> structure=…`, now print the "domains were removed in 5.0" hint and exit 1 instead of a generic unknown-option error. `--domain` no longer appears in `--help`.
+  - When `skaile add` or `skaile install` cannot find a ref after a publisher change, the error now names the asset under its new publisher (`did you mean skill:@acme/…?`) and the lock entry still pinned to the old one, only when that lock entry came from the library that now holds the asset under the new publisher (an unrelated asset that just shares the name is no longer offered). The hint is printed by the CLI; programmatically, `InstallResult.missing` still holds bare refs and the text is in the new `InstallResult.missingHints` (ref → hint).
+  - The "Upgrading a 4.x library" steps and the 5.3.0 migration entry now say to run `skaile install` once and commit `skaile.lock.yaml` (`install --locked` fails until then), and to run `skaile library link <name> <url>` before `library commit`, `push` or `publish` on a library still registered as local.
+  - The 5.4.0 migration entry carries its real heading, and the release script refuses to publish a new version while `MIGRATION.md` still has an `## Unreleased` heading (`node scripts/release.mjs --check-migration` runs the check alone).
+
+### Patch Changes
+
+- Updated dependencies [[`13a54f1`](https://github.com/skaile-ai/workspaces/commit/13a54f15275a9410af554a3eadf05c58e0d1b932), [`baa938a`](https://github.com/skaile-ai/workspaces/commit/baa938a4ea1e888afbb5af6441082cb8e765406a), [`014b422`](https://github.com/skaile-ai/workspaces/commit/014b422606c879517419ad467fbc8426671a729f), [`8b5e19f`](https://github.com/skaile-ai/workspaces/commit/8b5e19fb14f89a475937ceddeb9613dedf871eae), [`5ebf7dd`](https://github.com/skaile-ai/workspaces/commit/5ebf7dd75c15f253ee573a0f049cb523e90d853f)]:
+  - @skaile/workspaces@5.7.0
+
+## 5.6.1
+
+### Patch Changes
+
+- [#1031](https://github.com/skaile-ai/workspaces/pull/1031) [`377e0d6`](https://github.com/skaile-ai/workspaces/commit/377e0d6736eb01d828aaf74764e09fd82db96b53) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile migrate agents` no longer copies a legacy `requires[].name` such as `Code Reviewer` or `foo.bar` verbatim into `composes[].as`, which failed validation and got the whole `agent.yaml` skipped. The name is slugified (`code-reviewer`, `foo-bar`) with a note naming the original; a name with no valid slug, or one that collides with another alias in the same agent, omits `as` and is listed under the plan's manual section.
+
+  - Tests now pin the run controller's cancel races: a cancel while a run is moving from `queued` to `running`, and a cancel while the nested session is being created or started, each end `cancelled`, settle `agent.result { wait: true }` and dispose the half-started session.
+
+- [#1034](https://github.com/skaile-ai/workspaces/pull/1034) [`85bf2cc`](https://github.com/skaile-ai/workspaces/commit/85bf2cc7dc8517f90568ac4bdb26299db617b8d3) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile install` deploys every file the lock records for an asset from a `sources:` clone again. Since 5.6.0 such assets were copied through the kind's convention filter, so a skill's `.gitignore` or `resources/` dir was dropped while `skaile.lock.yaml` still listed it. Store-staged assets already copied their full file list; both paths now share it.
+  - A re-install compares every deployed file of an asset, not only its manifest, so a deleted or stale companion file (`scripts/`, `resources/`, dotfiles) is restored even when `SKILL.md` is unchanged.
+- Updated dependencies [[`377e0d6`](https://github.com/skaile-ai/workspaces/commit/377e0d6736eb01d828aaf74764e09fd82db96b53), [`85bf2cc`](https://github.com/skaile-ai/workspaces/commit/85bf2cc7dc8517f90568ac4bdb26299db617b8d3)]:
+  - @skaile/workspaces@5.6.1
+
 ## 5.6.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skaile-cli",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "description": "Run the Skaile CLI via `npx skaile-cli` — thin wrapper around @skaile/workspaces",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "asset-manager"
   ],
   "dependencies": {
-    "@skaile/workspaces": "5.6.0"
+    "@skaile/workspaces": "5.7.0"
   },
   "publishConfig": {
     "access": "public"