skillmds 1.3.2 → 1.3.4

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.3.4
+
+- **A companion file that its source repo no longer serves no longer fails the install.** When a registry pack links to a file the upstream repo has since deleted or moved, `add` (and the MCP install tool) now installs everything else and warns which files are missing, e.g. `1 companion file is gone from the source repo and was not installed (scripts/gone.ts)`. Before, one such link failed the whole bundle and `add owner/name` fell back to fetching the slug as a GitHub repo, ending in a misleading 404 with nothing installed. `update` stays strict: it never replaces a full install with a partial one.
+
 ## 1.2.0
 
 `skillmd add` was rewritten. It no longer copies a skill into every agent folder it can find: it writes **one canonical copy** and links that copy into the agents you chose, in the scope you chose, and records what it did in a lock file.

package/README.md

@@ -186,7 +186,7 @@ No auth required. It exposes `skillmd_search`, `skillmd_get`, `skillmd_download`
 
 ## Find skills on skillmd.com
 
-The registry behind these tools is [skillmd.com](https://skillmd.com): 25,000+ Agent Skills, each linted, security-scanned and content-pinned.
+The registry behind these tools is [skillmd.com](https://skillmd.com): 1,000,000+ Agent Skills, each linted, security-scanned and content-pinned.
 
 - [Search all skills](https://skillmd.com/search) · [browse by category](https://skillmd.com/categories) · [by publisher](https://skillmd.com/publishers)
 - Install guides per agent: [Claude Code](https://skillmd.com/agents/claude-code) · [Cursor](https://skillmd.com/agents/cursor) · [Codex](https://skillmd.com/agents/codex) · [all 60+ agents](https://skillmd.com/agents)

package/dist/{chunk-FVWCI37S.js → chunk-6JVWN3IG.js}

@@ -197,7 +197,13 @@ async function fetchBundle(base, slug, token, opts = {}) {
       contents = Buffer.from(f.content_base64, "base64");
     } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
       const r = await doFetch(f.source_url).catch(() => null);
-      if (!r || !r.ok) throw new Error(`could not fetch companion file "${f.path}" from ${hostOf(f.source_url)}`);
+      if (!r || !r.ok) {
+        if (opts.missing) {
+          opts.missing.push(f.path);
+          continue;
+        }
+        throw new Error(`could not fetch companion file "${f.path}" from ${hostOf(f.source_url)}`);
+      }
       contents = Buffer.from(await r.arrayBuffer());
       fromUrl = true;
     } else {
@@ -215,6 +221,12 @@ async function fetchBundle(base, slug, token, opts = {}) {
   }
   return out;
 }
+function missingFilesNote(paths) {
+  const n = paths.length;
+  const shown = paths.slice(0, 5).join(", ") + (n > 5 ? `, and ${n - 5} more` : "");
+  const [f, was, it] = n === 1 ? ["file is", "was", "it"] : ["files are", "were", "them"];
+  return `${n} companion ${f} gone from the source repo and ${was} not installed (${shown}); the skill may still refer to ${it}`;
+}
 
 // src/source.ts
 import { existsSync as existsSync2, statSync, lstatSync, readFileSync as readFileSync2, readdirSync, mkdtempSync, rmSync } from "fs";
@@ -841,6 +853,7 @@ export {
   RegistryError,
   createClient,
   fetchBundle,
+  missingFilesNote,
   skillMdFor,
   resolveSource,
   collectFiles,

package/dist/cli.js

@@ -16,6 +16,7 @@ import {
   isSkillDirOrLink,
   listInstalled,
   looksLikeProject,
+  missingFilesNote,
   parseSource,
   readConfig,
   readLock,
@@ -30,7 +31,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-FVWCI37S.js";
+} from "./chunk-6JVWN3IG.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -655,6 +656,7 @@ function resolveClaudeBin(env = process.env) {
 var needsShell = (bin) => /\.(cmd|bat)$/i.test(bin);
 var MARKETPLACE_URL = "https://skillmd.com/.claude-plugin/marketplace.json";
 var MARKETPLACE_NAME = "skillmd";
+var MARKETPLACE_SCHEMA = "https://anthropic.com/claude-code/marketplace.schema.json";
 var TIMEOUT_MS = 12e4;
 function exec(deps) {
   return deps.exec ?? ((file, args) => {
@@ -776,17 +778,36 @@ async function installPluginNatively(owner, slug, deps = {}) {
       writeFileSync3(dest, data);
     }
     writeFileSync3(join2(installPath, ".in_use"), "");
-    mkdirSync2(join2(pluginsDir, "marketplaces", MARKETPLACE_NAME), { recursive: true });
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const source = { source: "url", url: MARKETPLACE_URL };
+    const marketplaceDir = join2(pluginsDir, "marketplaces", MARKETPLACE_NAME);
+    const cachedPath = join2(marketplaceDir, ".claude-plugin", "marketplace.json");
+    const cached = readJson(cachedPath);
+    if (cached === "unparsable") return { ok: false, reason: "the cached marketplace manifest is not readable JSON \u2014 left untouched" };
+    const cachedDoc = cached === "absent" ? {
+      $schema: MARKETPLACE_SCHEMA,
+      name: MARKETPLACE_NAME,
+      owner: { name: "SkillMD", email: "hi@skillmd.com" },
+      description: "Agent Skill plugins from the SkillMD registry.",
+      plugins: []
+    } : cached;
+    const list = Array.isArray(cachedDoc.plugins) ? cachedDoc.plugins : [];
+    cachedDoc.plugins = [
+      ...list.filter((e) => e?.name !== name),
+      {
+        name,
+        version: version2,
+        homepage: `${SITE_URL}/plugins/${owner}/${slug}`,
+        author: { name: owner === "skillmd" ? "SkillMD" : `@${owner}` },
+        source: { source: "archive", url: `${SITE_URL}/plugins/${owner}/${slug}/plugin.zip` }
+      }
+    ];
+    writeJson(cachedPath, cachedDoc);
     const knownDoc = known === "absent" ? {} : known;
-    knownDoc[MARKETPLACE_NAME] = {
-      ...obj(knownDoc[MARKETPLACE_NAME]),
-      source,
-      installLocation: join2(pluginsDir, "marketplaces", MARKETPLACE_NAME),
-      lastUpdated: now
-    };
-    writeJson(knownPath, knownDoc);
+    if (!knownDoc[MARKETPLACE_NAME]) {
+      knownDoc[MARKETPLACE_NAME] = { source, installLocation: marketplaceDir, lastUpdated: now };
+      writeJson(knownPath, knownDoc);
+    }
     const installedDoc = installed === "absent" ? { version: 2, plugins: {} } : installed;
     const plugins = obj(installedDoc.plugins);
     const prior = Array.isArray(plugins[qualified]) ? plugins[qualified] : [];
@@ -798,7 +819,9 @@ async function installPluginNatively(owner, slug, deps = {}) {
     if (typeof installedDoc.version !== "number") installedDoc.version = 2;
     writeJson(installedPath, installedDoc);
     const settingsDoc = settings === "absent" ? {} : settings;
-    settingsDoc.extraKnownMarketplaces = { ...obj(settingsDoc.extraKnownMarketplaces), [MARKETPLACE_NAME]: { source } };
+    const declared = obj(settingsDoc.extraKnownMarketplaces);
+    if (!declared[MARKETPLACE_NAME]) declared[MARKETPLACE_NAME] = { source };
+    settingsDoc.extraKnownMarketplaces = declared;
     settingsDoc.enabledPlugins = { ...obj(settingsDoc.enabledPlugins), [qualified]: true };
     writeJson(settingsPath, settingsDoc);
   } catch (e) {
@@ -848,6 +871,11 @@ function unverifiedFilesNote(n) {
   const [f, it] = n === 1 ? ["file", "it"] : ["files", "them"];
   return `${n} companion ${f} came straight from the source repo \u2014 the registry holds no checksum for ${it}, so only the connection was verified`;
 }
+function bundleNote(bundle, missing) {
+  const unverified = bundle.filter((file) => file.unverified).length;
+  const notes = [unverified ? unverifiedFilesNote(unverified) : "", missing.length ? missingFilesNote(missing) : ""].filter(Boolean);
+  return notes.length ? notes.join("; ") : void 0;
+}
 function registryFallbackNote(host) {
   return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
 }
@@ -890,15 +918,16 @@ async function registryCandidate(owner, name, source, client) {
     securityFlags: skill.security_flags
   };
   if (skill.type === "pack") {
-    const bundle = await fetchBundle(client.base, registrySlug, client.token);
+    const missing = [];
+    const bundle = await fetchBundle(client.base, registrySlug, client.token, { missing });
     if (bundle && bundle.length) {
       const sk = bundle.find((file) => file.path === "SKILL.md");
-      const unverified = bundle.filter((file) => file.unverified).length;
+      const note2 = bundleNote(bundle, missing);
       return {
         ...meta,
         raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill),
         files: bundle,
-        ...unverified ? { note: unverifiedFilesNote(unverified) } : {}
+        ...note2 ? { note: note2 } : {}
       };
     }
     const pack = await resolvePackFiles(skill);
@@ -988,13 +1017,14 @@ function makeDefaultDeps(flags) {
             for (let i = n++; i < multi.length; i = n++) {
               const c = multi[i];
               try {
-                const bundle = await fetchBundle(apiBase2, c.registrySlug, token2);
+                const missing2 = [];
+                const bundle = await fetchBundle(apiBase2, c.registrySlug, token2, { missing: missing2 });
                 if (!bundle?.length) continue;
                 const sk = bundle.find((file) => file.path === "SKILL.md");
-                const unverified = bundle.filter((file) => file.unverified).length;
+                const note2 = bundleNote(bundle, missing2);
                 c.files = bundle;
                 if (sk) c.raw = sk.contents.toString("utf8");
-                if (unverified) c.note = unverifiedFilesNote(unverified);
+                if (note2) c.note = note2;
               } catch {
               }
             }

package/dist/mcp.js

@@ -8,11 +8,12 @@ import {
   fetchBundle,
   installSkill,
   looksLikeProject,
+  missingFilesNote,
   resolvePackFiles,
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-FVWCI37S.js";
+} from "./chunk-6JVWN3IG.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -206,9 +207,11 @@ async function installFromRegistry(args, ctx, deps = {}) {
   let note = "";
   if (skill.type === "pack") {
     try {
-      const bundle = await getBundle(ctx.base, `${owner}/${name}`, ctx.token);
+      const missing = [];
+      const bundle = await getBundle(ctx.base, `${owner}/${name}`, ctx.token, { missing });
       if (bundle?.length) {
         files = bundle.some((f) => f.path === "SKILL.md") ? bundle : [...bundle, { path: "SKILL.md", contents: raw }];
+        if (missing.length) note = missingFilesNote(missing);
       } else {
         const pack = await getPackFiles(skill);
         if (pack) {
@@ -549,7 +552,7 @@ async function startMcpServer() {
       name: "skillmd",
       version: VERSION,
       title: "SkillMD",
-      description: "The open registry of Agent Skills: search, inspect, lint and install 25,000+ linted, security-reviewed SKILL.md files for Claude Code, Cursor, Codex and 60+ other agents.",
+      description: "The open registry of Agent Skills: search, inspect, lint and install 1,000,000+ linted, security-reviewed SKILL.md files for Claude Code, Cursor, Codex and 60+ other agents.",
       websiteUrl: "https://skillmd.com",
       icons: [
         { src: "https://skillmd.com/favicon.png", mimeType: "image/png", sizes: ["512x512"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",