skillmds 1.3.5 → 1.3.6

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.3.6
+
+- **Installed skills name where they came from.** A skill installed from the registry (with `add`, `update` or the MCP install tool) gets one line in its frontmatter, `metadata.source: https://skillmd.com/skills/<owner>/<name>`, so an agent reading it knows its SkillMD page. Every other byte is the author's: an existing `metadata` block gains that one line, and an author's own `metadata.source` is never replaced. The line is added after the integrity checks, and the lock file's digest still covers the bytes the registry served, so `update` is unaffected. GitHub, gist and local installs are written exactly as fetched.
+- **find-skills, offered once.** After your first successful install in a terminal, `add` asks once whether to also add `skillmd/find-skills`, a skill that tells your agent to look on SkillMD when a task needs know-how it doesn't have, and to vet what it finds before suggesting it. Yes or no, it never asks again; an agent running the CLI, `-y` and `--json` are never asked.
+
 ## 1.3.5
 
 - **The agent picker now says why Claude Code isn't in it.** `add plugin:owner/slug` installs the plugin into Claude Code as a real plugin first, then asks which other agents should get its skills, leaving Claude Code out so it doesn't get the same skills twice. The question read "Which agents do you want to install to?", and the confirmation only printed after the run, so the list looked as if Claude Code hadn't been detected. It now asks: `Claude Code already has <plugin> as a plugin. Which other agents should get its skills too?`

package/dist/{chunk-6JVWN3IG.js → chunk-HGVEADWS.js}

@@ -622,6 +622,48 @@ import { createHash as createHash2 } from "crypto";
 import { cpSync, existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { platform } from "os";
 import { dirname as dirname3, join as join7, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+
+// src/provenance.ts
+import { parseSkillMd } from "@skillmds/core";
+var SKILLMD_ORIGIN = "https://skillmd.com";
+var FRONTMATTER = /^(?---\r?\n)([\s\S]*?)(\r?\n---[ \t]*(?:\r?\n|$))/;
+function withRegistrySource(md, slug) {
+  const m = FRONTMATTER.exec(md);
+  if (!m) return md;
+  const [whole, open, block, close] = m;
+  const nl = open.endsWith("\r\n") ? "\r\n" : "\n";
+  const source = `${SKILLMD_ORIGIN}/skills/${slug}`;
+  const lines = block.split(/\r?\n/);
+  const at = lines.findIndex((l) => /^metadata[ \t]*:/.test(l));
+  if (at === -1) {
+    lines.push("metadata:", `  source: ${source}`);
+  } else {
+    if (!/^metadata[ \t]*:[ \t]*(#.*)?$/.test(lines[at])) return md;
+    let end = at + 1;
+    while (end < lines.length && (/^[ \t]/.test(lines[end]) || lines[end].trim() === "")) end++;
+    const children = lines.slice(at + 1, end);
+    if (children.some((l) => /^[ \t]+source[ \t]*:/.test(l))) return md;
+    const indent = /^([ \t]+)\S/.exec(children.find((l) => l.trim() !== "") ?? "")?.[1] ?? "  ";
+    lines.splice(at + 1, 0, `${indent}source: ${source}`);
+  }
+  const out = open + lines.join(nl) + close + md.slice(whole.length);
+  const before = parseSkillMd(md);
+  const after = parseSkillMd(out);
+  return "error" in after && !("error" in before) ? md : out;
+}
+function filesForInstall(files, source) {
+  const slug = /^registry:([^/\s]+\/[^/\s]+)$/.exec(source)?.[1];
+  if (!slug) return files;
+  return files.map((f) => {
+    if (f.path.replace(/\\/g, "/") !== "SKILL.md") return f;
+    const text = typeof f.contents === "string" ? f.contents : f.contents.toString("utf8");
+    const next = withRegistrySource(text, slug);
+    if (next === text) return f;
+    return { ...f, contents: typeof f.contents === "string" ? next : Buffer.from(next, "utf8") };
+  });
+}
+
+// src/installer.ts
 var NAME_OK = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 function assertSafeName(name) {
   if (!NAME_OK.test(name) || name.includes("..")) throw new Error(`refused unsafe skill name: "${name}"`);
@@ -712,7 +754,7 @@ async function installSkill(req) {
   const staging = `${canonical}.tmp-${process.pid}`;
   rmSync3(staging, { recursive: true, force: true });
   try {
-    writeTree(staging, req.files);
+    writeTree(staging, filesForInstall(req.files, req.source));
   } catch (e) {
     rmSync3(staging, { recursive: true, force: true });
     throw e;

package/dist/cli.js

@@ -31,7 +31,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-6JVWN3IG.js";
+} from "./chunk-HGVEADWS.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -1137,7 +1137,9 @@ function finish2(flags, outcome) {
         written,
         blocked,
         exitCode,
-        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths)
+        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths),
+        scope: outcome.scope,
+        agents: [...new Set(installed.flatMap((d) => d.targets.map((t) => t.agent)))]
       };
     }
     case "list": {
@@ -1387,8 +1389,40 @@ var clackUI = {
   spinner: () => p3.spinner(),
   message: (m) => p3.log.message(m),
   outro: (m) => p3.outro(m),
-  cancel: (m) => p3.cancel(m)
+  cancel: (m) => p3.cancel(m),
+  confirm: async (m) => {
+    const answer = await p3.confirm({ message: m, initialValue: true });
+    return p3.isCancel(answer) ? null : answer;
+  }
 };
+var FIND_SKILLS = "skillmd/find-skills";
+async function offerFindSkills(source, flags, run2, ui, deps) {
+  if (!ui.confirm || run2.exitCode !== 0 || !run2.written.length || !run2.scope || !run2.agents?.length) return;
+  if (source.replace(/^registry:/, "").toLowerCase() === FIND_SKILLS) return;
+  const cfg = readConfig(flags.home);
+  if (cfg.findSkillsOffered) return;
+  const global = run2.scope === "global";
+  const lock = readLock({ global, cwd: flags.cwd, home: flags.home });
+  if (Object.values(lock.skills).some((e) => e.source === `registry:${FIND_SKILLS}`)) return;
+  try {
+    writeConfig({ ...cfg, findSkillsOffered: true }, flags.home);
+  } catch {
+  }
+  const yes = await ui.confirm("Also add find-skills, so your agent can look for more skills on SkillMD when a task needs one?");
+  if (!yes) return;
+  const r = await runAdd(FIND_SKILLS, {
+    ...flags,
+    yes: true,
+    json: false,
+    skill: void 0,
+    list: void 0,
+    ref: void 0,
+    global,
+    project: !global,
+    agent: run2.agents
+  }, deps);
+  ui.message(r.exitCode === 0 ? `${pc8.green(GLYPH.ok)} find-skills added` : pc8.yellow(`${GLYPH.warn} find-skills could not be added. Try later: npx skillmds add ${FIND_SKILLS}`));
+}
 async function runAddWithUI(source, flags, opts = {}) {
   const term = opts.term ?? { ...realTerminal(), env: flags.env ?? process.env };
   const base = opts.deps ?? makeDefaultDeps(flags);
@@ -1421,6 +1455,7 @@ async function runAddWithUI(source, flags, opts = {}) {
       return { run: run2, printed: true };
     }
     ui.message(run2.output);
+    await offerFindSkills(source, flags, run2, ui, base);
     ui.outro(run2.exitCode === 0 ? `Done. Run ${pc8.cyan("skillmd list")} to see everything installed.` : pc8.red("Some skills were not installed."));
     return { run: run2, printed: true };
   } catch (e) {

package/dist/mcp.js

@@ -13,7 +13,7 @@ import {
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-6JVWN3IG.js";
+} from "./chunk-HGVEADWS.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",