skillfish 1.0.35 → 1.0.37

package/README.md

@@ -401,9 +401,29 @@ See [CHANGELOG.md](CHANGELOG.md) for release history.
 <details>
 <summary>Telemetry</summary>
 
-Anonymous, aggregate install counts only. No PII collected.
+Anonymous, aggregate usage data — no PII, no identifiers, no IP fingerprinting on our side.
 
-To opt out: `DO_NOT_TRACK=1` or `CI=true`.
+**What we send**
+
+- `command` events (one per CLI invocation): the subcommand name (`add`, `install`, `list`, etc.)
+- `install` events (one per successful skill install): the skill repo (`owner/repo`), the skill name, and the platform names it was installed to (e.g. `Claude Code`, `Cursor`)
+
+That's it. No usernames, no machine IDs, no file paths, no skill contents.
+
+**How to opt out**
+
+Set either env var to any non-falsy value:
+
+```bash
+export DO_NOT_TRACK=1   # https://consoledonottrack.com/
+export CI=true          # already set in most CI environments
+```
+
+Telemetry is also automatically disabled when running from source (e.g. `tsx`, `npm test`).
+
+**How it's sent**
+
+Each event is dispatched to a detached background process and the CLI returns immediately, so telemetry can never block your terminal. If our server is down or slow, your CLI still exits instantly.
 
 </details>
 

package/dist/commands/add.js

@@ -72,7 +72,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('add');
+    trackCommand('add');
     const force = options.force ?? false;
     const trustSource = options.yes ?? false;
     const installAll = options.all ?? false;
@@ -263,9 +263,12 @@ Examples:
         }
         totalInstalled += result.installed.length;
         totalSkipped += result.skipped.length;
-        // Track successful installs (fire and forget)
+        // Track successful installs (fire and forget — dispatched to detached worker)
         if (result.installed.length > 0) {
-            void trackInstall('add', owner, repo, skillName);
+            // skillPath is 'SKILL.md' for root skills, or a directory like
+            // 'skills/foo' for sub-skills in a monorepo.
+            const skillRepoPath = skillPath === SKILL_FILENAME ? undefined : skillPath;
+            trackInstall('add', owner, repo, skillName, result.installed.map((i) => i.agent), skillRepoPath);
         }
     }
     // Summary

package/dist/commands/bundle.js

@@ -78,7 +78,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('bundle');
+    trackCommand('bundle');
     // Determine scope (interactive if no flags specified)
     const { baseDir, location } = await selectBundleLocation(projectFlag, globalFlag, jsonMode);
     const manifestPath = getProjectManifestPath(location === 'global');

package/dist/commands/init.js

@@ -161,7 +161,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)} ${pc.dim('· Create a skill')}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('init');
+    trackCommand('init');
     const skipPrompts = options.yes ?? false;
     const projectFlag = options.project ?? false;
     const globalFlag = options.global ?? false;

package/dist/commands/install.js

@@ -87,7 +87,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('install');
+    trackCommand('install');
     // Determine scope (interactive if no flags specified)
     const { location, baseDir, manifestPath } = await selectInstallLocation(projectFlag, globalFlag, jsonMode);
     jsonOutput.manifest_path = manifestPath;
@@ -473,6 +473,7 @@ Examples:
                     skillName,
                     success: false,
                     installCount: 0,
+                    platform: [],
                     errorMsg: result.failureReason,
                 };
             }
@@ -493,6 +494,7 @@ Examples:
                 skillName,
                 success: true,
                 installCount: result.installed.length,
+                platform: result.installed.map((i) => i.agent),
             };
         }
         catch (err) {
@@ -518,6 +520,7 @@ Examples:
                 skillName,
                 success: false,
                 installCount: 0,
+                platform: [],
                 errorMsg,
             };
         }
@@ -534,8 +537,8 @@ Examples:
         const action = toInstall[i];
         if (result.success) {
             successCount++;
-            // Track successful installs (fire and forget)
-            void trackInstall('install', action.entry.owner, action.entry.repo, result.skillName);
+            // Track successful installs (fire and forget — dispatched to detached worker)
+            trackInstall('install', action.entry.owner, action.entry.repo, result.skillName, result.platform, action.entry.path);
             if (!jsonMode) {
                 // Show which agents it was installed to if it's a partial install
                 const agentCount = action.targetAgents.length;

package/dist/commands/list.js

@@ -65,7 +65,7 @@ Examples:
         });
     }
     // Track command usage (fire and forget)
-    void trackCommand('list');
+    trackCommand('list');
     // Determine which locations to check
     // By default, check both global and project. Flags narrow it down.
     const checkGlobal = !projectFlag; // Check global unless --project is set

package/dist/commands/remove.js

@@ -70,7 +70,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('remove');
+    trackCommand('remove');
     const skipConfirm = options.yes ?? false;
     const removeAll = options.all ?? false;
     const projectFlag = options.project ?? false;

package/dist/commands/search.js

@@ -71,7 +71,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim('Search')}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('search');
+    trackCommand('search');
     // Show spinner while searching
     let response;
     if (!jsonMode) {

package/dist/commands/submit.js

@@ -61,7 +61,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish submit '))} ${pc.dim(`v${version}`)}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('submit');
+    trackCommand('submit');
     const skipConfirm = options.yes ?? false;
     // Parse repo format - supports owner/repo or full GitHub URL
     let owner;

package/dist/commands/update.js

@@ -60,7 +60,7 @@ Examples:
         p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)}`);
     }
     // Track command usage (fire and forget)
-    void trackCommand('update');
+    trackCommand('update');
     // Detect agents (check both global and project for updates)
     const detected = getDetectedAgentsForLocation('both', process.cwd());
     if (detected.length === 0) {

package/dist/telemetry-worker.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Detached telemetry worker. Reads a JSON payload from stdin, POSTs it to the
+ * telemetry endpoint, then exits. Intended to be spawned by `telemetry.ts` so
+ * the parent CLI can exit immediately without waiting on the network request.
+ *
+ * Failures are swallowed silently — telemetry must never surface to the user.
+ */
+export {};

package/dist/telemetry-worker.js

@@ -0,0 +1,41 @@
+/**
+ * Detached telemetry worker. Reads a JSON payload from stdin, POSTs it to the
+ * telemetry endpoint, then exits. Intended to be spawned by `telemetry.ts` so
+ * the parent CLI can exit immediately without waiting on the network request.
+ *
+ * Failures are swallowed silently — telemetry must never surface to the user.
+ */
+const TELEMETRY_URL = 'https://mcpmarket.com/api/telemetry';
+const TELEMETRY_TIMEOUT = 5000;
+async function main() {
+    try {
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(chunk);
+        }
+        const body = Buffer.concat(chunks).toString('utf-8');
+        if (!body)
+            return;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), TELEMETRY_TIMEOUT);
+        try {
+            await fetch(TELEMETRY_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+                signal: controller.signal,
+            });
+        }
+        catch {
+            // network/timeout — ignore
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    }
+    catch {
+        // stdin/parse error — ignore
+    }
+}
+void main().finally(() => process.exit(0));
+export {};

package/dist/telemetry.d.ts

@@ -1,17 +1,32 @@
 /**
- * Track a command execution. Fire and forget.
+ * Anonymous CLI usage telemetry.
+ *
+ * Telemetry is dispatched to a detached child process (`telemetry-worker.js`)
+ * that owns the HTTP request and survives the parent's exit. This means:
+ *   - The CLI returns to the user immediately, never blocked by network I/O.
+ *   - `process.exit()` in command code does not abort the in-flight POST.
+ *
+ * Disabled when `DO_NOT_TRACK=1` or `CI=true`. Also disabled when the module
+ * is loaded from TypeScript source (dev/test via tsx) since the compiled
+ * worker only exists in `dist/`.
+ */
+/**
+ * Track a command execution. Fire-and-forget; returns immediately.
  *
  * @param command The command name (e.g., 'add', 'bundle', 'install')
- * @returns Promise that resolves when telemetry is sent (or times out)
  */
-export declare function trackCommand(command: string): Promise<void>;
+export declare function trackCommand(command: string): void;
 /**
- * Track a skill install. Inserts into telemetry_events and increments skill download count.
+ * Track a skill install. Fire-and-forget; returns immediately.
+ * Inserts into telemetry_events and increments skill download count.
  *
  * @param command The command that triggered the install ('add' or 'install')
  * @param owner GitHub repository owner
  * @param repo GitHub repository name
  * @param skillName Name of the skill being installed
- * @returns Promise that resolves when telemetry is sent (or times out)
+ * @param platform Names of the agents the skill was installed to (e.g. ['Claude Code', 'Cursor'])
+ * @param path Path to the skill within the repo. Undefined for root-level
+ *   skills (whole repo is one skill). For monorepos, this disambiguates
+ *   sibling skills (e.g. 'skills/council' vs 'skills/marketing').
  */
-export declare function trackInstall(command: string, owner: string, repo: string, skillName: string): Promise<void>;
+export declare function trackInstall(command: string, owner: string, repo: string, skillName: string, platform?: readonly string[], path?: string): void;

package/dist/telemetry.js

@@ -1,61 +1,101 @@
-const TELEMETRY_URL = 'https://mcpmarket.com/api/telemetry';
-/** Timeout for telemetry requests (ms) */
-const TELEMETRY_TIMEOUT = 5000;
 /**
- * Send a telemetry payload. Returns a promise that resolves when the request
- * completes (or times out). Never rejects.
+ * Anonymous CLI usage telemetry.
+ *
+ * Telemetry is dispatched to a detached child process (`telemetry-worker.js`)
+ * that owns the HTTP request and survives the parent's exit. This means:
+ *   - The CLI returns to the user immediately, never blocked by network I/O.
+ *   - `process.exit()` in command code does not abort the in-flight POST.
+ *
+ * Disabled when `DO_NOT_TRACK=1` or `CI=true`. Also disabled when the module
+ * is loaded from TypeScript source (dev/test via tsx) since the compiled
+ * worker only exists in `dist/`.
+ */
+import { spawn } from 'child_process';
+import { fileURLToPath } from 'url';
+/**
+ * Treat any non-empty value other than "0"/"false" as "disabled". This matches
+ * the de-facto behavior of the consoledonottrack.com convention used by other
+ * CLI tools — `DO_NOT_TRACK=true`, `DO_NOT_TRACK=yes`, etc. all disable.
  */
-function sendTelemetry(payload) {
+function isTruthyEnv(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized !== '' && normalized !== '0' && normalized !== 'false';
+}
+function isTelemetryDisabled() {
+    return isTruthyEnv(process.env.DO_NOT_TRACK) || isTruthyEnv(process.env.CI);
+}
+function dispatch(payload) {
+    if (isTelemetryDisabled())
+        return;
+    // The worker only ships as a compiled .js artifact. When loaded from .ts
+    // source (tsx in dev/test), there is no worker to spawn — skip silently.
+    if (import.meta.url.endsWith('.ts'))
+        return;
     try {
-        if (process.env.DO_NOT_TRACK === '1' || process.env.CI === 'true') {
-            return Promise.resolve();
-        }
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), TELEMETRY_TIMEOUT);
-        return fetch(TELEMETRY_URL, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(payload),
-            signal: controller.signal,
-        })
-            .then(() => { })
-            .catch(() => { })
-            .finally(() => clearTimeout(timeoutId));
+        const workerPath = fileURLToPath(new URL('./telemetry-worker.js', import.meta.url));
+        const child = spawn(process.execPath, [workerPath], {
+            detached: true,
+            stdio: ['pipe', 'ignore', 'ignore'],
+            windowsHide: true,
+        });
+        // Swallow spawn errors (ENOENT, EPERM, etc.) — telemetry must not surface.
+        child.on('error', () => { });
+        // Detach from the parent's reference count so process.exit() doesn't wait.
+        child.unref();
+        // Small JSON payloads fit comfortably in the kernel pipe buffer, so this
+        // write completes synchronously and the child can read it after the parent
+        // exits.
+        child.stdin?.end(JSON.stringify(payload));
     }
     catch {
-        return Promise.resolve();
+        // ignore
     }
 }
 /**
- * Track a command execution. Fire and forget.
+ * Track a command execution. Fire-and-forget; returns immediately.
  *
  * @param command The command name (e.g., 'add', 'bundle', 'install')
- * @returns Promise that resolves when telemetry is sent (or times out)
  */
 export function trackCommand(command) {
     if (!command)
-        return Promise.resolve();
-    return sendTelemetry({ event_type: 'command', command });
+        return;
+    dispatch({ event_type: 'command', command });
 }
 /**
- * Track a skill install. Inserts into telemetry_events and increments skill download count.
+ * Track a skill install. Fire-and-forget; returns immediately.
+ * Inserts into telemetry_events and increments skill download count.
  *
  * @param command The command that triggered the install ('add' or 'install')
  * @param owner GitHub repository owner
  * @param repo GitHub repository name
  * @param skillName Name of the skill being installed
- * @returns Promise that resolves when telemetry is sent (or times out)
+ * @param platform Names of the agents the skill was installed to (e.g. ['Claude Code', 'Cursor'])
+ * @param path Path to the skill within the repo. Undefined for root-level
+ *   skills (whole repo is one skill). For monorepos, this disambiguates
+ *   sibling skills (e.g. 'skills/council' vs 'skills/marketing').
  */
-export function trackInstall(command, owner, repo, skillName) {
+export function trackInstall(command, owner, repo, skillName, platform = [], path) {
     if (!command || !owner || !repo || !skillName)
-        return Promise.resolve();
-    return sendTelemetry({
+        return;
+    // Canonical skill key: 'owner/repo' for root skills, 'owner/repo/path'
+    // for skills nested in a monorepo. Without the path component, every
+    // skill in a monorepo collapses to the same key.
+    const normalizedPath = path?.trim().replace(/^\/+|\/+$/g, '') || undefined;
+    const skillKey = normalizedPath ? `${owner}/${repo}/${normalizedPath}` : `${owner}/${repo}`;
+    // platform is a single text column on telemetry_events. We send a
+    // comma-separated, de-duplicated list so one install stays one row
+    // (preserving download-count semantics). Agent names contain no commas.
+    const platformText = Array.from(new Set(platform)).join(', ');
+    dispatch({
         event_type: 'install',
         command,
-        skill_key: `${owner}/${repo}`,
+        skill_key: skillKey,
         // Fields for skill count increment
         owner,
         repo,
-        skillName,
+        skill_name: skillName,
+        platform: platformText,
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillfish",
-  "version": "1.0.35",
+  "version": "1.0.37",
   "description": "All in one Skill manager for AI coding agents. Install, update, and sync Skills across Claude Code, Cursor, Copilot + more.",
   "type": "module",
   "bin": {