skillmds 1.3.4 → 1.3.6

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.3.6
+
+- **Installed skills name where they came from.** A skill installed from the registry (with `add`, `update` or the MCP install tool) gets one line in its frontmatter, `metadata.source: https://skillmd.com/skills/<owner>/<name>`, so an agent reading it knows its SkillMD page. Every other byte is the author's: an existing `metadata` block gains that one line, and an author's own `metadata.source` is never replaced. The line is added after the integrity checks, and the lock file's digest still covers the bytes the registry served, so `update` is unaffected. GitHub, gist and local installs are written exactly as fetched.
+- **find-skills, offered once.** After your first successful install in a terminal, `add` asks once whether to also add `skillmd/find-skills`, a skill that tells your agent to look on SkillMD when a task needs know-how it doesn't have, and to vet what it finds before suggesting it. Yes or no, it never asks again; an agent running the CLI, `-y` and `--json` are never asked.
+
+## 1.3.5
+
+- **The agent picker now says why Claude Code isn't in it.** `add plugin:owner/slug` installs the plugin into Claude Code as a real plugin first, then asks which other agents should get its skills, leaving Claude Code out so it doesn't get the same skills twice. The question read "Which agents do you want to install to?", and the confirmation only printed after the run, so the list looked as if Claude Code hadn't been detected. It now asks: `Claude Code already has <plugin> as a plugin. Which other agents should get its skills too?`
+
 ## 1.3.4
 
 - **A companion file that its source repo no longer serves no longer fails the install.** When a registry pack links to a file the upstream repo has since deleted or moved, `add` (and the MCP install tool) now installs everything else and warns which files are missing, e.g. `1 companion file is gone from the source repo and was not installed (scripts/gone.ts)`. Before, one such link failed the whole bundle and `add owner/name` fell back to fetching the slug as a GitHub repo, ending in a misleading 404 with nothing installed. `update` stays strict: it never replaces a full install with a partial one.

package/dist/{chunk-6JVWN3IG.js → chunk-HGVEADWS.js}

@@ -622,6 +622,48 @@ import { createHash as createHash2 } from "crypto";
 import { cpSync, existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { platform } from "os";
 import { dirname as dirname3, join as join7, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+
+// src/provenance.ts
+import { parseSkillMd } from "@skillmds/core";
+var SKILLMD_ORIGIN = "https://skillmd.com";
+var FRONTMATTER = /^(?---\r?\n)([\s\S]*?)(\r?\n---[ \t]*(?:\r?\n|$))/;
+function withRegistrySource(md, slug) {
+  const m = FRONTMATTER.exec(md);
+  if (!m) return md;
+  const [whole, open, block, close] = m;
+  const nl = open.endsWith("\r\n") ? "\r\n" : "\n";
+  const source = `${SKILLMD_ORIGIN}/skills/${slug}`;
+  const lines = block.split(/\r?\n/);
+  const at = lines.findIndex((l) => /^metadata[ \t]*:/.test(l));
+  if (at === -1) {
+    lines.push("metadata:", `  source: ${source}`);
+  } else {
+    if (!/^metadata[ \t]*:[ \t]*(#.*)?$/.test(lines[at])) return md;
+    let end = at + 1;
+    while (end < lines.length && (/^[ \t]/.test(lines[end]) || lines[end].trim() === "")) end++;
+    const children = lines.slice(at + 1, end);
+    if (children.some((l) => /^[ \t]+source[ \t]*:/.test(l))) return md;
+    const indent = /^([ \t]+)\S/.exec(children.find((l) => l.trim() !== "") ?? "")?.[1] ?? "  ";
+    lines.splice(at + 1, 0, `${indent}source: ${source}`);
+  }
+  const out = open + lines.join(nl) + close + md.slice(whole.length);
+  const before = parseSkillMd(md);
+  const after = parseSkillMd(out);
+  return "error" in after && !("error" in before) ? md : out;
+}
+function filesForInstall(files, source) {
+  const slug = /^registry:([^/\s]+\/[^/\s]+)$/.exec(source)?.[1];
+  if (!slug) return files;
+  return files.map((f) => {
+    if (f.path.replace(/\\/g, "/") !== "SKILL.md") return f;
+    const text = typeof f.contents === "string" ? f.contents : f.contents.toString("utf8");
+    const next = withRegistrySource(text, slug);
+    if (next === text) return f;
+    return { ...f, contents: typeof f.contents === "string" ? next : Buffer.from(next, "utf8") };
+  });
+}
+
+// src/installer.ts
 var NAME_OK = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 function assertSafeName(name) {
   if (!NAME_OK.test(name) || name.includes("..")) throw new Error(`refused unsafe skill name: "${name}"`);
@@ -712,7 +754,7 @@ async function installSkill(req) {
   const staging = `${canonical}.tmp-${process.pid}`;
   rmSync3(staging, { recursive: true, force: true });
   try {
-    writeTree(staging, req.files);
+    writeTree(staging, filesForInstall(req.files, req.source));
   } catch (e) {
     rmSync3(staging, { recursive: true, force: true });
     throw e;

package/dist/cli.js

@@ -31,7 +31,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-6JVWN3IG.js";
+} from "./chunk-HGVEADWS.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -856,11 +856,14 @@ async function promptScopeInteractive(ctx) {
   });
   return p3.isCancel(choice) ? null : choice;
 }
+function agentsPromptMessage(managed) {
+  return managed ? `Claude Code already has ${managed} as a plugin. Which other agents should get its skills too?` : "Which agents do you want to install to?";
+}
 async function promptAgentsInteractive(ctx) {
   if (ctx.detected.length < 2) return ctx.detected;
   const remembered = (readConfig().lastAgents ?? []).filter((id) => ctx.detected.includes(id));
   const picked = await p3.multiselect({
-    message: "Which agents do you want to install to?",
+    message: agentsPromptMessage(ctx.managed),
     options: ctx.detected.map((id) => ({ value: id, label: id, hint: ctx.dirFor(id) })),
     initialValues: remembered.length ? remembered : ctx.detected,
     required: true
@@ -1134,7 +1137,9 @@ function finish2(flags, outcome) {
         written,
         blocked,
         exitCode,
-        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths)
+        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths),
+        scope: outcome.scope,
+        agents: [...new Set(installed.flatMap((d) => d.targets.map((t) => t.agent)))]
       };
     }
     case "list": {
@@ -1210,7 +1215,7 @@ function gate(flags, deps, candidates) {
   }
   return null;
 }
-async function chooseTargets(flags, deps, scope, detected) {
+async function chooseTargets(flags, deps, scope, detected, managed) {
   const notices = [];
   let targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
   if (scope.global) {
@@ -1222,7 +1227,7 @@ async function chooseTargets(flags, deps, scope, detected) {
     targets = kept;
   }
   if (!flags.agent?.length && deps.promptAgents && !flags.yes && !flags.json && !detectHostAgent(flags.env ?? process.env)) {
-    const picked = await deps.promptAgents({ detected: targets, dirFor: (id) => agentDir(id, scope) });
+    const picked = await deps.promptAgents({ detected: targets, dirFor: (id) => agentDir(id, scope), ...managed ? { managed } : {} });
     if (picked === null) return null;
     targets = picked;
     if (flags.home === void 0 && picked.length) {
@@ -1354,7 +1359,7 @@ async function runAdd(arg, flags, deps) {
   const notices = resolved.note ? [infoNotice(resolved.note)] : [];
   notices.push(...managedNotices);
   const detected = detectAgents(scope).filter((id) => id !== managed?.agent);
-  const chosen = await chooseTargets(flags, d, scope, detected);
+  const chosen = await chooseTargets(flags, d, scope, detected, managed?.name);
   if (!chosen) return finish2(flags, { kind: "cancel" });
   notices.push(...chosen.notices);
   const ctx = { arg, flags, deny: new Set(flags.deny ?? []), scope, targets: chosen.targets, env, deps: d };
@@ -1384,8 +1389,40 @@ var clackUI = {
   spinner: () => p3.spinner(),
   message: (m) => p3.log.message(m),
   outro: (m) => p3.outro(m),
-  cancel: (m) => p3.cancel(m)
+  cancel: (m) => p3.cancel(m),
+  confirm: async (m) => {
+    const answer = await p3.confirm({ message: m, initialValue: true });
+    return p3.isCancel(answer) ? null : answer;
+  }
 };
+var FIND_SKILLS = "skillmd/find-skills";
+async function offerFindSkills(source, flags, run2, ui, deps) {
+  if (!ui.confirm || run2.exitCode !== 0 || !run2.written.length || !run2.scope || !run2.agents?.length) return;
+  if (source.replace(/^registry:/, "").toLowerCase() === FIND_SKILLS) return;
+  const cfg = readConfig(flags.home);
+  if (cfg.findSkillsOffered) return;
+  const global = run2.scope === "global";
+  const lock = readLock({ global, cwd: flags.cwd, home: flags.home });
+  if (Object.values(lock.skills).some((e) => e.source === `registry:${FIND_SKILLS}`)) return;
+  try {
+    writeConfig({ ...cfg, findSkillsOffered: true }, flags.home);
+  } catch {
+  }
+  const yes = await ui.confirm("Also add find-skills, so your agent can look for more skills on SkillMD when a task needs one?");
+  if (!yes) return;
+  const r = await runAdd(FIND_SKILLS, {
+    ...flags,
+    yes: true,
+    json: false,
+    skill: void 0,
+    list: void 0,
+    ref: void 0,
+    global,
+    project: !global,
+    agent: run2.agents
+  }, deps);
+  ui.message(r.exitCode === 0 ? `${pc8.green(GLYPH.ok)} find-skills added` : pc8.yellow(`${GLYPH.warn} find-skills could not be added. Try later: npx skillmds add ${FIND_SKILLS}`));
+}
 async function runAddWithUI(source, flags, opts = {}) {
   const term = opts.term ?? { ...realTerminal(), env: flags.env ?? process.env };
   const base = opts.deps ?? makeDefaultDeps(flags);
@@ -1418,6 +1455,7 @@ async function runAddWithUI(source, flags, opts = {}) {
       return { run: run2, printed: true };
     }
     ui.message(run2.output);
+    await offerFindSkills(source, flags, run2, ui, base);
     ui.outro(run2.exitCode === 0 ? `Done. Run ${pc8.cyan("skillmd list")} to see everything installed.` : pc8.red("Some skills were not installed."));
     return { run: run2, printed: true };
   } catch (e) {

package/dist/mcp.js

@@ -13,7 +13,7 @@ import {
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-6JVWN3IG.js";
+} from "./chunk-HGVEADWS.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",