skilllib 1.12.1 → 1.13.0

package/dist/{tui-3QD6RQGL.js → tui-3MBVYSVM.js}

@@ -1,4 +1,5 @@
 import {
+  FEATURED_HARNESSES,
   HARNESSES,
   PROJECT_SKILLS_DIR,
   addRefusal,
@@ -43,6 +44,8 @@ import {
   moveGlobalSkills,
   movedTogether,
   notWritable,
+  personalPinsFile,
+  pinsIn,
   pluginBackups,
   projectHere,
   projectOfFactory,
@@ -81,10 +84,11 @@ import {
   updatePlugin,
   updateProject,
   usageIssues,
+  versionForHash,
   versionHistory,
   visibleProjects,
   withoutForceHint
-} from "./chunk-LORSEDNW.js";
+} from "./chunk-C6TSR7NT.js";
 
 // src/tui/index.tsx
 import { render } from "ink";
@@ -445,7 +449,7 @@ function globalFixes(m) {
   ];
 }
 function pinFix(w, repo, s) {
-  if (s.source !== "lib" || !w.library.some((l) => l.name === s.name)) return null;
+  if (s.source !== "lib" || !s.pinMoves || !w.library.some((l) => l.name === s.name)) return null;
   if (s.personal)
     return { label: "Pin it for the team", preview: `Move ${s.name}'s pin into ${repo}'s skilllib.json. Git will see skilllib.json and ${s.dir}/${s.name}: commit them to share it.`, run: (w2) => w2.ops.pin(repo, s.name, false) };
   if (s.inGit || isShared(s.git)) return null;
@@ -1506,8 +1510,11 @@ function App({ initial, reload, loadUsage: loadUsage2 }) {
   }
   useEffect(() => {
     const folder = () => !initial.roots.length && askForFolder("Where are your projects? skilllib finds the git repos in there");
-    if (!initial.agentsChosen) setModal({ kind: "agents", selected: initial.agents, cursor: 0, then: folder });
-    else folder();
+    if (!initial.agentsChosen) {
+      const installed = HARNESSES.filter((h) => h.installed()).map((h) => h.id);
+      const ids = [...FEATURED_HARNESSES, ...installed.filter((id) => !FEATURED_HARNESSES.includes(id))];
+      setModal({ kind: "agents", selected: initial.agents, ids, cursor: 0, then: folder });
+    } else folder();
   }, []);
   function openInGlobal(name) {
     goPlace("global");
@@ -1527,14 +1534,24 @@ function App({ initial, reload, loadUsage: loadUsage2 }) {
       cells: [{ text, width: 34, color: c }, { text: sub, grow: true, color: color.faint }],
       onEnter
     });
+    const shown = [
+      ...FEATURED_HARNESSES.map((id) => harness(id)),
+      ...world.agents.filter((id) => !FEATURED_HARNESSES.includes(id)).map((id) => harness(id))
+    ];
     return [
       header("#agents", "Agents"),
-      ...HARNESSES.map(
+      ...shown.map(
         (h) => row(`agent:${h.id}`, `${world.agents.includes(h.id) ? "[x]" : "[ ]"} ${h.icon} ${h.name}`, h.projectDirs.join(", "), () => {
           const wasOn = world.agents.includes(h.id);
           apply((w) => (w.ops.setAgents(wasOn ? w.agents.filter((a) => a !== h.id) : HARNESSES.map((x) => x.id).filter((id) => id === h.id || w.agents.includes(id))), `${h.name} ${wasOn ? "off" : "on"}`));
         })
       ),
+      row(
+        "agents:more",
+        "More agents\u2026",
+        "Copilot, Gemini, OpenCode, Windsurf, and the rest",
+        () => setModal({ kind: "agents", selected: world.agents, ids: HARNESSES.map((h) => h.id), cursor: 0 })
+      ),
       // The skill that lets your agents use skilllib: installing adds a global skill, so it asks first.
       row(
         "agent-skill",
@@ -1664,11 +1681,13 @@ function App({ initial, reload, loadUsage: loadUsage2 }) {
     if (m.kind === "add") return addKeys(m, input, key);
   }
   function agentsKeys(m, input, key) {
+    const list2 = m.ids.map((id) => harness(id));
     if (key.escape && !m.then) return setModal(null);
     if (key.upArrow) return setModal({ ...m, cursor: Math.max(0, m.cursor - 1) });
-    if (key.downArrow) return setModal({ ...m, cursor: Math.min(HARNESSES.length - 1, m.cursor + 1) });
+    if (key.downArrow) return setModal({ ...m, cursor: Math.min(list2.length - 1, m.cursor + 1) });
     if (input === " ") {
-      const id = HARNESSES[m.cursor].id;
+      const id = list2[m.cursor]?.id;
+      if (!id) return;
       return setModal({ ...m, selected: m.selected.includes(id) ? m.selected.filter((x) => x !== id) : [...m.selected, id] });
     }
     if (key.return) {
@@ -1902,11 +1921,11 @@ function App({ initial, reload, loadUsage: loadUsage2 }) {
         empty: "",
         header: /* @__PURE__ */ jsx2(Text2, { color: color.muted, children: "skilllib makes your skills visible to each one. Detected ones are ticked." }),
         headerHeight: 1,
-        rows: HARNESSES.map((h) => ({
+        rows: modal.ids.map((id) => harness(id)).map((h) => ({
           key: h.id,
           cells: [
             { text: modal.selected.includes(h.id) ? "[x] " : "[ ] ", width: 4, color: modal.selected.includes(h.id) ? color.green : color.faint },
-            { text: `${h.icon} ${h.name}`, width: 18, color: h.color },
+            { text: `${h.icon} ${h.name}`, width: 22, color: h.color },
             { text: `reads ${h.projectDirs.join(", ")}`, grow: true, color: color.faint }
           ]
         }))
@@ -2095,7 +2114,7 @@ function uniqueNames(roots) {
     })
   );
 }
-function localSkill(root, s, git) {
+function localSkill(root, s, git, pins, canBePersonal) {
   const managed = {
     "edited locally": { edited: true },
     "edited locally, update available": { edited: true },
@@ -2114,7 +2133,9 @@ function localSkill(root, s, git) {
   const state = git ? git.of(relativeTo(root, s.path)) : null;
   const others = otherCopies(root, s.name, s.location);
   const own = other[s.state]?.source === "untracked" && isShared(state) ? { source: "repo" } : {};
-  const inGit = s.managed && (isShared(state) || (readManifest(root).skills[s.name]?.links ?? []).some((d) => isShared(git?.of(`${d}/${s.name}`))));
+  const dep = pins[s.name];
+  const inGit = s.managed && (isShared(state) || (dep?.links ?? []).some((d) => isShared(git?.of(`${d}/${s.name}`))));
+  const pinMoves = s.managed && !!dep && versionForHash(s.name, dep.hash) !== null && !s.state.startsWith("edited") && (s.personal || canBePersonal);
   return {
     name: s.name,
     source: "lib",
@@ -2122,7 +2143,7 @@ function localSkill(root, s, git) {
     path: s.path,
     // Agents that actually load it here: visibility lists every agent you use, with `paths: 0` for the blind ones.
     agents: s.visibility.filter((v) => v.paths > 0).map((v) => v.id),
-    ...s.managed ? { version: s.version ?? void 0, ...s.personal ? { personal: true } : {}, ...inGit ? { inGit: true } : {}, ...managed[s.state] } : { ...other[s.state], ...own },
+    ...s.managed ? { version: s.version ?? void 0, ...s.personal ? { personal: true } : {}, ...inGit ? { inGit: true } : {}, ...pinMoves ? { pinMoves: true } : {}, ...managed[s.state] } : { ...other[s.state], ...own },
     ...s.source ? { origin: `npx skills: ${s.source}` } : {},
     ...others.length ? { others } : {},
     git: state
@@ -2219,11 +2240,11 @@ function loadWorld() {
       name: names.get(root),
       path: root,
       manifest: hasManifest ? git ? git.of("skilllib.json") : "no git" : "none",
-      skills: status.map((s) => {
-        const local = localSkill(root, s, git);
+      skills: ((pins, canBePersonal) => status.map((s) => {
+        const local = localSkill(root, s, git, pins, canBePersonal);
         const own = s.state.includes("missing") ? "" : readSkillInfo(s.path).description;
         return own && own !== descriptions[s.name] ? { ...local, description: own } : local;
-      }),
+      }))(pinsIn(root), personalPinsFile(root) !== null),
       ...loadedHere(root)
     };
   });
@@ -2376,8 +2397,14 @@ function realOps(roots, backups, machine, libraryNames) {
     },
     pin: (repo, name, personal) => {
       const c = addSkill(rootOf(repo), name, { personal });
-      if (c.action === "skipped") return failed(said3(c, repo));
-      return personal ? `${name} is now personal in ${repo}: only on your machines, kept out of git` : `${name} is now pinned in ${repo}'s skilllib.json for the team`;
+      if (c.action === "skipped") return failed(`${name}: ${withoutForceHint(c.reason ?? "skipped")}`);
+      const moved = personal ? `${name} is now personal in ${repo}: only on your machines, kept out of git` : `${name} is now pinned in ${repo}'s skilllib.json for the team`;
+      if (c.uncommitted?.length) {
+        const copy = `${copyDir(repo, name)}/${name}`;
+        return failed(`${moved}, but not linked in ${c.uncommitted.join(", ")}: git tracks ${c.uncommitted.length === 1 ? "it" : "them"} and ${copy} isn't committed, so agents reading ${c.uncommitted.length === 1 ? "it" : "them"} can't use ${name}. Commit ${copy}, then run skilllib link --allow-tracked`);
+      }
+      if (c.blocked?.length || c.inTheWay?.length) return withLinks(c, repo, name);
+      return moved;
     },
     copyToLibrary: (repo, name) => ((s) => s ? toLibrary(s.path) : failed(`${name} isn't in ${repo} any more`))(find(repo, name)),
     deleteGlobal: (m) => {

package/package.json

@@ -1,15 +1,19 @@
 {
   "name": "skilllib",
-  "version": "1.12.1",
-  "description": "Manage your agent skills like dependencies. One library for all your skills; each repo gets only the ones it needs, and every agent can see them. Works with Claude Code, Cursor, Codex, Zed and Grok.",
+  "version": "1.13.0",
+  "description": "Manage your agent skills like dependencies. One library, install from skills.sh, and every agent you use can see them.",
   "keywords": [
     "agent-skills",
     "skills",
+    "skills.sh",
     "skill-md",
     "claude-code",
     "claude",
     "cursor",
     "codex",
+    "gemini",
+    "github-copilot",
+    "opencode",
     "zed",
     "grok",
     "ai-agents",

package/skills/skilllib/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: skilllib
-description: Agent skills (SKILL.md) loaded in this repo and the user's skill library, via the skilllib CLI. Use for which skills you can use here and where each comes from, which library skills to add, what's out of date, broken or duplicated, and adding, removing or updating skills.
+description: Agent skills (SKILL.md) loaded in this repo and the user's skill library, via the skilllib CLI. Use for which skills you can use here and where each comes from, which library skills to add, what's out of date, broken or duplicated, adding, removing or updating skills, and installing skills from skills.sh or GitHub.
 allowed-tools: Bash(skilllib:*)
 ---
 
@@ -8,7 +8,7 @@ allowed-tools: Bash(skilllib:*)
 
 The user manages agent skills with the `skilllib` CLI. Their **library** (`~/.skilllib/library`, "my skills", "the registry") holds versioned skills that load nowhere until added to a repo. A repo pins its skills in `skilllib.json` (shared, committed), or in the user's personal pins (`~/.skilllib/pins`, kept out of git: `personal: true` in the output).
 
-Always pass `--json` (one line of JSON on stdout; messages go to stderr). A failure exits 1 with `{"error": "..."}` as that line. `link`, `tidy`, `global` (its listing, `keep` and `unkeep`), `restore`, `new`, `folders`, `harnesses`, `scan` and `unhide` print messages only (read the exit code). Unknown flags are errors. Never run bare `skilllib` or `skilllib ui`: that's an interactive app.
+Always pass `--json` (one line of JSON on stdout; messages go to stderr). A failure exits 1 with `{"error": "..."}` as that line. `link`, `tidy`, `global` (its listing, `keep` and `unkeep`), `restore`, `new`, `folders`, `harnesses`, `scan`, `search` (without `--json`) and `unhide` print messages only (read the exit code). Unknown flags are errors. Never run bare `skilllib` or `skilllib ui`: that's an interactive app.
 
 ## Reading
 
@@ -25,7 +25,7 @@ Also: `usage --json` (Claude Code usage only, so "unused" is a hint; each skill
 
 ## Changing (ask first unless the user asked for this exact change)
 
-`add <name>...` (pins in `skilllib.json` when the repo has one, else in personal pins; `--personal` / `--shared` choose, and move an existing pin without changing its version) · `remove <name>...` (skills skilllib manages, `source: library`) · `update [name...]` · `sync` (installs what `skilllib.json` pins; takes no names). Pass several names in one call. Their result is `[{name, action, from, to, dirs, reason, blocked, uncommitted, inTheWay, backedUp}]`, which is the whole result: there's no need to check files afterwards. `import <dir>...` (into the library) prints `[{path, name, status}]` and exits 1 if a folder was skipped (`exists`, `no SKILL.md`). `doctor --fix` prints doctor's issues, each fix with `fixed: {ok, message}`.
+`add <name>...` (pins in `skilllib.json` when the repo has one, else in personal pins; `--personal` / `--shared` choose, and move an existing pin without changing its version) · `remove <name>...` (skills skilllib manages, `source: library`) · `update [name...]` · `sync` (installs what's pinned, in `skilllib.json` and your personal pins; takes no names). Pass several names in one call. Their result is `[{name, action, from, to, dirs, personal, moved, reason, blocked, uncommitted, inTheWay, backedUp}]` (`personal: true` when the pin is in your personal pins; `moved` when `--personal`/`--shared` moved it), which is the whole result: there's no need to check files afterwards. `import <dir>...` (into the library) prints `[{path, name, status}]` and exits 1 if a folder was skipped (`exists`, `no SKILL.md`). `doctor --fix` prints doctor's issues, each fix with `fixed: {ok, message}`.
 
 - `skipped` + `reason`: nothing changed for that skill, and the command exits 1; tell the user. `--force` overwrites local edits (`backedUp` says where they went; `skilllib restore <name>` brings them back), but only use it with their OK.
 - `removed` + `reason`: removed from skilllib.json, but something was left as it is (its copy behind a folder that links out of the repo, a file of the user's, or a link in such a folder). Tell the user what the reason says is still there.
@@ -42,7 +42,7 @@ Also: `usage --json` (Claude Code usage only, so "unused" is a hint; each skill
 
 **Fixes and decisions.** `apply <id> [choice]` runs one problem's `fix`, or the choice you name: its label (safest), or its number from 1. With several choices it needs one. Prints `{id, applied, ok, message}`. Ids come from `issues` in `status --json` (Now, below) or from `doctor --json` (every repo; pass `apply` the same `--days` you gave `doctor`). A few issues span repos and offer different choices in each; then `apply` takes only the label.
 
-**Importing.** `import <dir>...` copies skill folders (each with a `SKILL.md`) into the library; skilllib doesn't download anything. For a skill on GitHub, clone the repo into a temporary folder, `import` the skill's folder, then `add` it here.
+**Importing and installing.** `import <dir>...` copies skill folders (each with a `SKILL.md`) into the library; it doesn't download anything. `install <source>...` does: `owner/repo`, `owner/repo@skill`, a `https://skills.sh/...` or GitHub URL, or a local folder. It puts each skill in the library. In a repo it also adds them here; `--global` loads them in every repo instead (and marks them kept). A repo with several skills is listed, not installed, until you pass `@name` or `--all`. `search <query>` lists matches from skills.sh. `install` and `search` accept `--json`.
 
 ## Now