skilldrop-cli 1.12.0 → 1.13.0

package/bin/skilldrop.js

@@ -133,6 +133,8 @@ Options:
   --json             machine-readable output for list | info | packs | agents | outdated | doctor —
                      one JSON object on stdout, nothing else (for agents, scripts, CI)
   --with-related     also install each skill's related companions (one level)
+  --replace          replace a skill installed from a different catalogue that has the same
+                     name (install refuses otherwise); the old folder is removed first
   --with-hooks       also wire any hooks a skill declares (RFC-0006) — git pre-commit
                      reminders and Claude Code session-start context; degrades where the
                      target has no hook mechanism. Off by default so installs never touch
@@ -189,6 +191,15 @@ function splitSource(source) {
   const i = source.lastIndexOf("#");
   return i > 0 ? [source.slice(0, i), source.slice(i + 1)] : [source, ""];
 }
+/* Two catalogue sources are the same catalogue when they name the same place, whatever ref or
+   spelling: git+https://host/o/r.git#abc, https://host/o/r and https://host/o/r/ are one source. */
+function sourceId(source) {
+  if (!source || source === BUNDLED) return BUNDLED;
+  let s = splitSource(String(source))[0].trim().replace(/^git\+/, "").replace(/\/+$/, "").replace(/\.git$/, "");
+  if (/^[a-z]+:\/\//i.test(s)) s = s.replace(/^([a-z]+:\/\/[^/]+)/i, (h) => h.toLowerCase());
+  else s = path.resolve(s);
+  return s;
+}
 function isPinned(source) { return !!source && SHA_RE.test(splitSource(source)[1]); }
 
 function fetchCatalog(source) {
@@ -1471,11 +1482,15 @@ function installUnits(args) {
   const policy = enforcePolicy(args.flags, cat, names, "skill");
   const { dest, ide } = target(args.flags);
   const contain = containmentFor(args.flags, cat, names, dest, ide, policy);
-  if (args.flags["dry-run"]) { planInstall(cat, names, dest, ide, args.flags); if (contain) applyContainment(contain, true); return; }
+  const clashes = sourceClashes(cat, names, dest);
+  if (args.flags["dry-run"]) { planInstall(cat, names, dest, ide, args.flags, clashes); if (contain) applyContainment(contain, true); return; }
+  if (clashes.length && !args.flags.replace) die(clashMessage(clashes, cat, dest));
   fs.mkdirSync(dest, { recursive: true });
   const l = ledger(dest);
   const pipDeps = [], suggestions = new Set(), notes = [];
   for (const s of names) {
+    // A replaced skill's folder goes first, so no file of the other catalogue's skill is left mixed in.
+    if (clashes.some((c) => c.name === s)) fs.rmSync(path.join(dest, s), { recursive: true, force: true });
     const m = copyOne(cat, s, dest, ide, l, notes);
     if (fs.existsSync(path.join(skillDir(cat, s), "requirements.txt"))) pipDeps.push(s);
     for (const r of m.related || []) if (!names.includes(r) && !l.data[r]) suggestions.add(r);
@@ -1537,14 +1552,39 @@ function installUnits(args) {
   if (pk && pk["first-value"]) console.log("\n" + firstValueLines(pk).join("\n"));
 }
 
+/* Two catalogues can each ship a skill with the same name, and they are different skills. Copying
+   one over the other would replace it silently and leave the first one's extra files mixed in, so
+   install refuses unless asked (--replace), and says where each came from. */
+function sourceClashes(cat, names, dest) {
+  const l = ledger(dest), out = [];
+  for (const s of names) {
+    const have = l.data[s];
+    if (!have || isLoopEntry(have)) continue;
+    if (sourceId(lsrc(have)) !== sourceId(cat.source)) out.push({ name: s, from: lsrc(have) });
+  }
+  return out;
+}
+function clashMessage(clashes, cat, dest) {
+  const what = (src) => src === BUNDLED ? "skilldrop" : `'${src}'`;
+  return clashes.map((c) => `'${c.name}' in ${dest} came from ${what(c.from)}; this install is from ${what(cat.source)}, a different skill with the same name.`).join("\n       ") +
+    "\n       Nothing was installed. Keep the one you have, or replace it: rerun with --replace (the old folder is removed first)," +
+    "\n       or install into a separate folder with --dest <dir>.";
+}
+
 /* install --dry-run: everything install would write, and nothing written. */
-function planInstall(cat, names, dest, ide, flags) {
+function planInstall(cat, names, dest, ide, flags, clashes = []) {
   const l = ledger(dest);
   console.log(`dry run — nothing will be written. Target: ${dest} (${ide})\n`);
   for (const s of names) {
     const m = manifestOf(cat, s);
     const have = l.data[s];
-    const verb = !have ? "install" : lver(have) === m.version ? "reinstall" : `replace ${lver(have)} with`;
+    const clash = clashes.find((c) => c.name === s);
+    if (clash && !flags.replace) {
+      console.log(`would refuse ${s}: installed from ${clash.from === BUNDLED ? "skilldrop" : clash.from}, a different catalogue (add --replace to replace it)`);
+      continue;
+    }
+    const verb = clash ? `replace ${clash.from === BUNDLED ? "skilldrop" : clash.from}'s ${s} with` :
+      !have ? "install" : lver(have) === m.version ? "reinstall" : `replace ${lver(have)} with`;
     const edits = editedFiles(dest, s, have);
     console.log(`would ${verb} ${s}@${m.version} -> ${path.join(dest, s)}`);
     if (edits.length) console.log(`  overwrites your edits in: ${edits.join(", ")} (update keeps them; install does not)`);
@@ -1818,6 +1858,9 @@ function doctor(args) {
   for (const n of names) {
     const note = lsrc(data[n]) === BUNDLED && retiredNote(resolveCatalog(), n, isLoopEntry(data[n]));
     if (note) add("warn", note, `skilldrop uninstall ${n}${targetHint(args.flags)}, or keep it as it is; it will not update`);
+    if (lsrc(data[n]) !== BUNDLED && !isLoopEntry(data[n]) && skillExists(resolveCatalog(), n))
+      add("info", `${n} here came from '${lsrc(data[n])}'; skilldrop has its own ${n}, a different skill with the same name`,
+          `keep it, or switch with: skilldrop install ${n} --replace${targetHint(args.flags)} (or install skilldrop's into another --dest)`);
     if (!fs.existsSync(path.join(dest, n))) add("error", `${n} is in the ledger but its folder is gone`, `skilldrop install ${n} (or uninstall ${n} to drop the record)`);
     else if (!data[n].file) {
       const loop = isLoopEntry(data[n]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/ai-engineering/skills/agent-config-review/evals/files/1/dot.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+coverage/
+.env
+.env.*

package/packs/ai-engineering/skills/agent-config-review/examples/inputs/tidewater-ingest/dot.gitignore

@@ -0,0 +1,3 @@
+.env
+.claude/settings.local.json
+__pycache__/

package/packs/ai-engineering/skills/agent-config-review/examples/python-repo-tighten.md

@@ -5,9 +5,9 @@
 > We're about to roll this Claude Code setup out to the whole data team for tidewater-ingest.
 > Anything we should change first?
 
-Files: [`inputs/tidewater-ingest/.claude/settings.json`](inputs/tidewater-ingest/.claude/settings.json),
-[`inputs/tidewater-ingest/.mcp.json`](inputs/tidewater-ingest/.mcp.json),
-[`inputs/tidewater-ingest/.gitignore`](inputs/tidewater-ingest/.gitignore).
+Files: [`inputs/tidewater-ingest/dot.claude/settings.json`](inputs/tidewater-ingest/dot.claude/settings.json),
+[`inputs/tidewater-ingest/.mcp.json`](inputs/tidewater-ingest/dot.mcp.json),
+[`inputs/tidewater-ingest/.gitignore`](inputs/tidewater-ingest/dot.gitignore).
 
 ## What the scan listed (abridged, real output)
 

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/dot.npmrc

@@ -0,0 +1,3 @@
+registry=https://registry.npmjs.org/
+save-exact=true
+engine-strict=true

package/packs/experience-design/skills/locale-check/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: locale-check
-description: Check a product's translations against the source strings before they ship — every key present, every placeholder ({name}, %s, %1$d, ICU plural and select) carried over intact, the plural forms each language needs, markup tags balanced, and strings over their character budget — with a script that reads JSON, ARB, gettext .po, Android strings.xml and iOS .strings, and lists each problem with its key and locale. Use when someone asks to "check the translations", "QA these locale files", "will the German fit", "why does the French build crash on this string", or hands over locale files before a release.
+description: Check a product's translations against the source strings before they ship — every key present, every placeholder (named, %s, %1$d, ICU plural and select) carried over intact, the plural forms each language needs, markup tags balanced, and strings over their character budget — with a script that reads JSON, ARB, gettext .po, Android strings.xml and iOS .strings, and lists each problem with its key and locale. Use when someone asks to "check the translations", "QA these locale files", "will the German fit", "why does the French build crash on this string", or hands over locale files before a release.
 ---
 
 # locale-check

package/packs/experience-design/skills/locale-check/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "locale-check",
-  "version": "0.1.0",
-  "description": "Check a product's translations against the source strings before they ship — every key present, every placeholder ({name}, %s, %1$d, ICU plural and select) carried over intact, the plural forms each language needs, markup tags balanced, and strings over their character budget — with a script that reads JSON, ARB, gettext .po, Android strings.xml and iOS .strings, and lists each problem with its key and locale. Use when someone asks to \"check the translations\", \"QA these locale files\", \"will the German fit\", \"why does the French build crash on this string\", or hands over locale files before a release.",
+  "version": "0.1.1",
+  "description": "Check a product's translations against the source strings before they ship — every key present, every placeholder (named, %s, %1$d, ICU plural and select) carried over intact, the plural forms each language needs, markup tags balanced, and strings over their character budget — with a script that reads JSON, ARB, gettext .po, Android strings.xml and iOS .strings, and lists each problem with its key and locale. Use when someone asks to \"check the translations\", \"QA these locale files\", \"will the German fit\", \"why does the French build crash on this string\", or hands over locale files before a release.",
   "entrypoint": "SKILL.md",
   "deps": {
     "npm": [],

package/packs/frontend/skills/bundle-size-review/evals/files/9/dot.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+meta.json
+# generated from the design team's emoji export, not committed
+src/emoji/emoji-data.json