skillvault-publisher 0.9.2 → 0.11.0

package/dist/commands/analytics.js

@@ -1,12 +1,16 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { requireSession, sessionFetch } from '../session.js';
+import { requireCommandContext, sessionFetch } from '../session.js';
 export const analyticsCommand = new Command('analytics')
     .description('View publisher analytics')
     .option('--days <n>', 'Number of days to look back', '30')
+    .option('--skill <name>', 'Filter top skills/stats to a specific skill')
     .option('--json', 'Output as JSON')
+    .option('--workspace <path>', 'Use workspace at <path> to default --skill')
+    .option('--quiet', 'Suppress the "(using workspace …)" stderr note')
+    .option('--all', 'Disable workspace --skill default; show analytics for all skills')
     .action(async (options) => {
-    const ctx = requireSession();
+    const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     try {
         const days = parseInt(options.days, 10);
         if (isNaN(days) || days < 1) {
@@ -28,8 +32,16 @@ export const analyticsCommand = new Command('analytics')
         console.log(`  ${chalk.bold('Active Licenses:')}    ${data.active_licenses}`);
         console.log(`  ${chalk.bold('Total Decryptions:')}  ${data.total_decryptions}`);
         console.log(`  ${chalk.bold('Period:')}             Last ${days} day${days !== 1 ? 's' : ''} (${start.toLocaleDateString()} \u2013 ${end.toLocaleDateString()})`);
+        // Apply workspace --skill filter (client-side) so analytics from a
+        // workspace dir defaults to that skill's stats. --all disables it.
+        const effectiveSkill = options.skill
+            ?? (options.all ? undefined : ctx.defaultSkillName ?? undefined);
+        const filterSkill = (skillName) => !effectiveSkill || skillName.toLowerCase() === effectiveSkill.toLowerCase();
         // Merge top_skills (decryptions) with skill_stats (licenses) by name
         const statsMap = new Map((data.skill_stats || []).map(s => [s.skill_name, s]));
+        if (effectiveSkill) {
+            data.top_skills = (data.top_skills || []).filter((s) => filterSkill(s.name));
+        }
         if (data.top_skills && data.top_skills.length > 0) {
             console.log();
             console.log(chalk.bold('  Top Skills'));

package/dist/commands/audit.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { requireSession, sessionFetch } from '../session.js';
+import { requireCommandContext, sessionFetch } from '../session.js';
 export const auditCommand = new Command('audit')
     .description('View audit log events')
     .option('--type <event_type>', 'Filter by event type')
@@ -9,16 +9,23 @@ export const auditCommand = new Command('audit')
     .option('--limit <n>', 'Number of events to return', '20')
     .option('--export <format>', 'Export as csv or json')
     .option('--json', 'Output as JSON')
+    .option('--workspace <path>', 'Use workspace at <path> to default --skill')
+    .option('--quiet', 'Suppress the "(using workspace …)" stderr note')
+    .option('--all', 'Disable workspace --skill default; show events for all skills')
     .action(async (options) => {
     try {
-        const ctx = requireSession();
+        const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
+        // If --skill not passed, --all not passed, and a workspace is active,
+        // default the filter to the workspace's skill.
+        const effectiveSkill = options.skill
+            ?? (options.all ? undefined : ctx.defaultSkillName ?? undefined);
         // Build query params shared by both normal and export flows
         const params = new URLSearchParams();
         params.set('limit', options.limit || '20');
         if (options.type)
             params.set('event_type', options.type);
-        if (options.skill)
-            params.set('capability', `skill/${options.skill}`);
+        if (effectiveSkill)
+            params.set('capability', `skill/${effectiveSkill}`);
         if (options.since)
             params.set('since', options.since);
         // ── Export flow ──────────────────────────────────────────────────

package/dist/commands/changelog.js

@@ -1,30 +1,24 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { getConfig } from '../credentials.js';
+import { requireCommandContext } from '../session.js';
 export const changelogCommand = new Command('changelog')
     .description('View version history and changelogs for a skill')
-    .argument('<skill-name>', 'Name of the skill (without skill/ prefix)')
+    .argument('[skill-name]', 'Name of the skill (defaults to workspace skill)')
     .option('--limit <n>', 'Show last N versions', '10')
     .option('--json', 'Output as JSON')
-    .action(async (skillName, options) => {
+    .option('--workspace <path>', 'Use workspace at <path> to default skill-name')
+    .option('--quiet', 'Suppress the "(using workspace …)" stderr note')
+    .action(async (skillNameArg, options) => {
     try {
-        // ── Auth ──
-        const config = getConfig();
-        if (!config) {
-            process.stderr.write(chalk.red('Not logged in. Run `skillvault-publisher login` first.\n'));
+        const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
+        const skillName = skillNameArg ?? ctx.defaultSkillName ?? undefined;
+        if (!skillName) {
+            process.stderr.write(chalk.red('Error: No skill name provided and no workspace context.\n'));
+            process.stderr.write(chalk.dim('  Pass <skill-name> or run from a linked workspace directory.\n'));
             process.exit(1);
         }
-        const serverUrl = config.server_url;
-        // These endpoints require a publisher session token, not a host JWT
-        if (!config.session_token) {
-            process.stderr.write(chalk.red('No session token. Re-login with --email to get a publisher session:\n'));
-            process.stderr.write(chalk.cyan('  skillvault-publisher login --email you@example.com\n'));
-            process.exit(1);
-        }
-        const sessionHeaders = {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${config.session_token}`,
-        };
+        const serverUrl = ctx.serverUrl;
+        const sessionHeaders = ctx.headers;
         // ── Look up the skill by listing publisher's skills ──
         const skillsRes = await fetch(`${serverUrl}/skills`, { headers: sessionHeaders });
         if (!skillsRes.ok) {

package/dist/commands/customers.js

@@ -1,11 +1,13 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { requireSession, sessionFetch } from '../session.js';
+import { requireCommandContext, sessionFetch } from '../session.js';
 export const customersCommand = new Command('customers')
     .description('List your customers')
     .option('--json', 'Output as JSON')
+    .option('--workspace <path>', 'Resolve workspace context (defaults from CWD)')
+    .option('--quiet', 'Suppress the "(using workspace …)" stderr note')
     .action(async (options) => {
-    const ctx = requireSession();
+    const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     try {
         const data = await sessionFetch(ctx, '/customers');
         const customers = data.customers;

package/dist/commands/grants.js

@@ -1,18 +1,31 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { requireSession, sessionFetch } from '../session.js';
+import { requireCommandContext, sessionFetch } from '../session.js';
 export const grantsCommand = new Command('grants')
     .description('List capability grants issued to customers')
     .option('--status <status>', 'Filter by status: active, revoked, expired')
+    .option('--skill <name>', 'Filter to grants for a specific skill (capability)')
     .option('--json', 'Output as JSON')
+    .option('--workspace <path>', 'Use workspace at <path> to default --skill')
+    .option('--quiet', 'Suppress the "(using workspace …)" stderr note')
+    .option('--all', 'Disable workspace --skill default; show grants for all skills')
     .action(async (options) => {
     try {
-        const ctx = requireSession();
+        const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
         const data = await sessionFetch(ctx, '/grants');
+        // Resolve effective skill filter — explicit --skill > workspace default
+        // (unless --all). Default is suppressed when --all is passed so the
+        // publisher can see every grant from a workspace dir without re-cd'ing.
+        const effectiveSkill = options.skill
+            ?? (options.all ? undefined : ctx.defaultSkillName ?? undefined);
         let grants = data.grants;
         if (options.status) {
             grants = grants.filter(g => g.status === options.status);
         }
+        if (effectiveSkill) {
+            const target = `skill/${effectiveSkill.toLowerCase()}`;
+            grants = grants.filter(g => g.capability.toLowerCase() === target);
+        }
         if (options.json) {
             console.log(JSON.stringify(grants, null, 2));
             return;

package/dist/commands/link.js

@@ -0,0 +1,112 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { requireSession } from '../session.js';
+import { loadWorkspace, saveWorkspace, } from '../publisher-workspace.js';
+import { registerWorkspace } from '../publisher-workspaces-registry.js';
+/** Minimal frontmatter parser for SKILL.md (mirrors publish.ts). */
+function parseFrontmatter(content) {
+    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match)
+        return {};
+    const result = {};
+    for (const line of match[1].split('\n')) {
+        const idx = line.indexOf(':');
+        if (idx === -1)
+            continue;
+        const key = line.slice(0, idx).trim();
+        let value = line.slice(idx + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        result[key] = value;
+    }
+    return result;
+}
+export const linkCommand = new Command('link')
+    .description('Link a skill source directory to your publisher account')
+    .argument('[directory]', 'Skill directory to link (defaults to CWD)')
+    .option('--workspace <path>', 'Explicit workspace directory (precedence over positional)')
+    .option('--force', 'Overwrite an existing link to a different publisher_id')
+    .option('--name <name>', 'Override skill name (defaults to SKILL.md frontmatter name)')
+    .option('--capability <cap>', 'Override capability_name (advanced — usually matches skill name)')
+    .action(async (directory, options) => {
+    try {
+        const ctx = requireSession();
+        // Precedence: --workspace > positional > CWD
+        const dirPath = options.workspace
+            ? resolve(options.workspace)
+            : directory
+                ? resolve(directory)
+                : process.cwd();
+        if (!existsSync(dirPath) || !statSync(dirPath).isDirectory()) {
+            process.stderr.write(chalk.red(`Error: "${dirPath}" is not a valid directory\n`));
+            process.exit(1);
+        }
+        const skillMdPath = join(dirPath, 'SKILL.md');
+        const hasSkillMd = existsSync(skillMdPath);
+        const frontmatter = hasSkillMd
+            ? parseFrontmatter(readFileSync(skillMdPath, 'utf8'))
+            : {};
+        const existing = loadWorkspace(dirPath);
+        // ── Resolve skill_name (precedence: --name > existing manifest > frontmatter > error) ──
+        const skillName = options.name ||
+            existing?.skill_name ||
+            frontmatter.name;
+        if (!skillName) {
+            process.stderr.write(chalk.red('Error: Cannot determine skill name.\n'));
+            process.stderr.write(chalk.dim('  Pass --name <name> or set `name:` in SKILL.md frontmatter.\n'));
+            process.exit(1);
+        }
+        // ── Resolve capability_name (precedence: --capability > existing manifest > computed) ──
+        const capabilityName = options.capability ||
+            existing?.capability_name ||
+            `skill/${skillName.toLowerCase()}`;
+        // ── Cross-account guard ──
+        if (existing &&
+            existing.publisher_id !== ctx.publisherId &&
+            !options.force) {
+            process.stderr.write(chalk.red(`Error: This directory is already linked to publisher ${existing.publisher_id}.\n`));
+            process.stderr.write(chalk.dim(`  You are logged in as ${ctx.publisherId}.\n`));
+            process.stderr.write(chalk.cyan('  Use --force to re-link to your account.\n'));
+            process.exit(1);
+        }
+        // ── Build the manifest ──
+        // Spread existing first so source/github and any other forward-compat
+        // fields survive a re-link. linked_at is preserved on re-link.
+        const linkedAt = existing?.linked_at ?? new Date().toISOString();
+        const manifest = {
+            ...(existing ?? {}),
+            version: 1,
+            publisher_id: ctx.publisherId,
+            skill_name: skillName,
+            capability_name: capabilityName,
+            linked_at: linkedAt,
+        };
+        saveWorkspace(dirPath, manifest);
+        registerWorkspace({
+            path: dirPath,
+            publisher_id: manifest.publisher_id,
+            skill_name: manifest.skill_name,
+            capability_name: manifest.capability_name,
+            linked_at: manifest.linked_at,
+            last_published_at: manifest.last_published_at,
+        });
+        const action = existing ? 'Re-linked' : 'Linked';
+        console.log(chalk.green(`${action} "${skillName}" → ${capabilityName}`));
+        console.log(chalk.dim(`  Directory:  ${dirPath}`));
+        console.log(chalk.dim(`  Publisher:  ${ctx.publisherId}`));
+        console.log(chalk.dim(`  Manifest:   .skillvault-publisher/workspace.json`));
+        if (!existing) {
+            console.log();
+            console.log(chalk.cyan('  Tip: commit .skillvault-publisher/workspace.json so teammates and CI can find this skill.'));
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(chalk.red(`Link failed: ${message}\n`));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=link.js.map

package/dist/commands/publish-all.js

@@ -5,6 +5,8 @@ import { resolve, join, basename } from 'node:path';
 import { createHash } from 'node:crypto';
 import { packSkillDirectory, writeVault, generateCEK } from 'skillvault-shared';
 import { requireSession } from '../session.js';
+import { loadWorkspace } from '../publisher-workspace.js';
+import { listWorkspaces } from '../publisher-workspaces-registry.js';
 /** Minimal frontmatter parser for SKILL.md */
 function parseFrontmatter(content) {
     const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -157,20 +159,44 @@ export const publishAllCommand = new Command('publish-all')
     .option('--force', 'Force re-publish all, even if unchanged')
     .option('--changelog <text>', 'Apply same changelog to all skills')
     .option('--server <url>', 'Override server URL')
+    .option('--all-workspaces', 'Iterate registered workspaces instead of walking the filesystem')
+    .option('--current', 'With --all-workspaces, only publish workspaces matching the current account')
     .action(async (directory, options) => {
     try {
         const ctx = requireSession();
         const config = ctx.config;
-        const rootDir = resolve(directory);
-        if (!existsSync(rootDir) || !statSync(rootDir).isDirectory()) {
-            process.stderr.write(chalk.red(`Error: "${rootDir}" is not a valid directory\n`));
-            process.exit(1);
+        // ── Determine the list of skill directories to publish ──
+        let skillDirs;
+        let usingWorkspaces = false;
+        if (options.allWorkspaces) {
+            usingWorkspaces = true;
+            let entries = listWorkspaces();
+            if (options.current) {
+                entries = entries.filter((e) => e.publisher_id === ctx.publisherId);
+            }
+            skillDirs = entries.map((e) => e.path);
+            console.log(chalk.dim(`Iterating ${skillDirs.length} registered workspace${skillDirs.length === 1 ? '' : 's'}` +
+                (options.current ? ' (current account only)' : '') + '...'));
+        }
+        else {
+            const rootDir = resolve(directory);
+            if (!existsSync(rootDir) || !statSync(rootDir).isDirectory()) {
+                process.stderr.write(chalk.red(`Error: "${rootDir}" is not a valid directory\n`));
+                process.exit(1);
+            }
+            console.log(chalk.dim(`Discovering skills in ${rootDir}...`));
+            skillDirs = findSkillDirs(rootDir);
         }
-        console.log(chalk.dim(`Discovering skills in ${rootDir}...`));
-        const skillDirs = findSkillDirs(rootDir);
         if (skillDirs.length === 0) {
-            console.log(chalk.yellow('\n  No skill directories found (directories containing SKILL.md).'));
-            console.log(chalk.dim('  Create a SKILL.md in each skill directory.\n'));
+            if (usingWorkspaces) {
+                console.log(chalk.yellow('\n  No registered workspaces found.'));
+                console.log(chalk.dim('  Run `skillvault-publisher link` from a skill source dir, or'));
+                console.log(chalk.dim('  `skillvault-publisher publish` (auto-links on first publish).\n'));
+            }
+            else {
+                console.log(chalk.yellow('\n  No skill directories found (directories containing SKILL.md).'));
+                console.log(chalk.dim('  Create a SKILL.md in each skill directory.\n'));
+            }
             process.exit(0);
         }
         console.log(chalk.bold(`Found ${skillDirs.length} skill${skillDirs.length === 1 ? '' : 's'}:\n`));
@@ -179,10 +205,20 @@ export const publishAllCommand = new Command('publish-all')
             for (let i = 0; i < skillDirs.length; i++) {
                 const dir = skillDirs[i];
                 const skillMdPath = join(dir, 'SKILL.md');
-                const content = readFileSync(skillMdPath, 'utf8');
-                const fm = parseFrontmatter(content);
-                const name = fm.name || basename(dir);
-                const version = fm.version || '?';
+                let name;
+                let version;
+                if (existsSync(skillMdPath)) {
+                    const content = readFileSync(skillMdPath, 'utf8');
+                    const fm = parseFrontmatter(content);
+                    name = fm.name || basename(dir);
+                    version = fm.version || '?';
+                }
+                else {
+                    // Workspace mode without SKILL.md — surface manifest identity.
+                    const manifest = loadWorkspace(dir);
+                    name = manifest?.skill_name ?? basename(dir);
+                    version = manifest?.last_published_version ?? '?';
+                }
                 console.log(`  [${i + 1}/${skillDirs.length}] ${chalk.cyan(name)} v${version} ${chalk.dim(`(${dir})`)}`);
             }
             console.log(chalk.dim('\n  Dry run — nothing was published.\n'));
@@ -196,6 +232,52 @@ export const publishAllCommand = new Command('publish-all')
         for (let i = 0; i < skillDirs.length; i++) {
             const dir = skillDirs[i];
             const skillMdPath = join(dir, 'SKILL.md');
+            // Check the workspace manifest first so we can pre-skip cross-account
+            // and source=github entries without paying for the SKILL.md read.
+            const manifest = loadWorkspace(dir);
+            // Cross-account skip — never publish someone else's skill.
+            if (manifest && manifest.publisher_id !== ctx.publisherId) {
+                process.stdout.write(`  [${i + 1}/${skillDirs.length}] ${manifest.skill_name} ... `);
+                console.log(chalk.dim('SKIPPED [other account]'));
+                results.push({
+                    name: manifest.skill_name,
+                    version: manifest.last_published_version ?? '?',
+                    dir,
+                    success: true,
+                    skipped: true,
+                    skipReason: 'cross_account',
+                    source: manifest.source ?? 'local',
+                });
+                continue;
+            }
+            // source=github skip (without --force).
+            if (manifest?.source === 'github' && !options.force) {
+                process.stdout.write(`  [${i + 1}/${skillDirs.length}] ${manifest.skill_name} ... `);
+                console.log(chalk.dim(`SKIPPED [source=github, tag ${manifest.github?.tag_pattern ?? '<unset>'}]`));
+                results.push({
+                    name: manifest.skill_name,
+                    version: manifest.last_published_version ?? '?',
+                    dir,
+                    success: true,
+                    skipped: true,
+                    skipReason: 'github_source',
+                    source: 'github',
+                });
+                continue;
+            }
+            if (!existsSync(skillMdPath)) {
+                results.push({
+                    name: manifest?.skill_name ?? basename(dir),
+                    version: '?',
+                    dir,
+                    success: false,
+                    error: 'SKILL.md not found',
+                    source: manifest?.source ?? 'local',
+                });
+                process.stdout.write(`  [${i + 1}/${skillDirs.length}] ${basename(dir)} ... `);
+                console.log(chalk.red('FAILED: SKILL.md not found'));
+                continue;
+            }
             const content = readFileSync(skillMdPath, 'utf8');
             const fm = parseFrontmatter(content);
             const name = fm.name || basename(dir);
@@ -208,6 +290,7 @@ export const publishAllCommand = new Command('publish-all')
                 force: options.force,
                 changelog: options.changelog,
             });
+            result.source = manifest?.source ?? 'local';
             results.push(result);
             if (result.success) {
                 if (result.skipped) {
@@ -223,14 +306,20 @@ export const publishAllCommand = new Command('publish-all')
         }
         // Summary
         const published = results.filter(r => r.success && !r.skipped).length;
-        const skipped = results.filter(r => r.skipped).length;
+        const unchanged = results.filter(r => r.skipped && !r.skipReason).length;
+        const skippedCrossAccount = results.filter(r => r.skipReason === 'cross_account').length;
+        const skippedGithub = results.filter(r => r.skipReason === 'github_source').length;
         const failed = results.filter(r => !r.success).length;
         console.log();
         const parts = [];
         if (published > 0)
             parts.push(chalk.green(`${published} published`));
-        if (skipped > 0)
-            parts.push(chalk.yellow(`${skipped} unchanged`));
+        if (unchanged > 0)
+            parts.push(chalk.yellow(`${unchanged} unchanged`));
+        if (skippedCrossAccount > 0)
+            parts.push(chalk.dim(`${skippedCrossAccount} cross-account`));
+        if (skippedGithub > 0)
+            parts.push(chalk.dim(`${skippedGithub} github-source`));
         if (failed > 0)
             parts.push(chalk.red(`${failed} failed`));
         console.log(`  Summary: ${parts.join(', ')}`);

package/dist/commands/publish.js

@@ -5,6 +5,8 @@ import { resolve, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { packSkillDirectory, writeVault, generateCEK } from 'skillvault-shared';
 import { requireSession } from '../session.js';
+import { loadWorkspace, saveWorkspace, resolveWorkspaceContext, } from '../publisher-workspace.js';
+import { registerWorkspace } from '../publisher-workspaces-registry.js';
 /** Minimal frontmatter parser for SKILL.md */
 function parseFrontmatter(content) {
     const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -27,17 +29,29 @@ function parseFrontmatter(content) {
 }
 export const publishCommand = new Command('publish')
     .description('Encrypt and publish a skill to the registry')
-    .argument('[directory]', 'Skill directory to publish', '.')
+    .argument('[directory]', 'Skill directory to publish')
     .option('--name <name>', 'Skill name (overrides SKILL.md frontmatter)')
     .option('--description <desc>', 'Description (overrides SKILL.md frontmatter)')
-    .option('--force', 'Force re-publish even if content unchanged')
+    .option('--force', 'Force re-publish; bypass rename and source=github guards')
     .option('--changelog <message>', 'Changelog message for this version')
-    .option('--publisher <id>', 'Publisher ID (defaults to host_id from login)')
+    .option('--publisher <id>', 'Publisher ID (defaults to publisher_id from login)')
+    .option('--workspace <path>', 'Explicit workspace directory (overrides CWD walk-up)')
+    .option('--no-link', 'Do not create or update .skillvault-publisher/workspace.json')
     .action(async (directory, options) => {
     try {
         const ctx = requireSession();
         const config = ctx.config;
-        const dirPath = resolve(directory);
+        // ── Resolve target directory ──
+        // Precedence: --workspace > positional > workspace walk-up from CWD > CWD
+        const workspaceCtx = resolveWorkspaceContext({
+            workspaceFlag: options.workspace,
+            cwd: directory ? resolve(directory) : process.cwd(),
+        });
+        const dirPath = options.workspace
+            ? resolve(options.workspace)
+            : directory
+                ? resolve(directory)
+                : workspaceCtx?.dir ?? process.cwd();
         if (!existsSync(dirPath) || !statSync(dirPath).isDirectory()) {
             process.stderr.write(chalk.red(`Error: "${dirPath}" is not a valid directory\n`));
             process.exit(1);
@@ -67,6 +81,49 @@ export const publishCommand = new Command('publish')
             process.stderr.write(chalk.red('Error: Version required in SKILL.md frontmatter (e.g. version: 1.0.0)\n'));
             process.exit(1);
         }
+        // ── Workspace manifest guards ──
+        const existingManifest = loadWorkspace(dirPath);
+        const computedCapability = `skill/${skillName.toLowerCase()}`;
+        const sessionPublisherId = options.publisher || config.publisher_id;
+        // Cross-account guard — refuses even with --force.
+        if (existingManifest && sessionPublisherId && existingManifest.publisher_id !== sessionPublisherId) {
+            process.stderr.write(chalk.red(`Error: This directory is linked to publisher ${existingManifest.publisher_id}, but you are logged in as ${sessionPublisherId}.\n`));
+            process.stderr.write('Either:\n');
+            process.stderr.write(chalk.cyan(`  1. Re-link this directory:  skillvault-publisher link --force\n`));
+            process.stderr.write(chalk.cyan(`  2. Log in as the correct publisher\n`));
+            process.stderr.write(chalk.cyan(`  3. Run with --no-link to publish without updating any manifest\n`));
+            process.exit(1);
+        }
+        // Source-is-github guard — bypassable with --force.
+        if (existingManifest?.source === 'github') {
+            const tagPattern = existingManifest.github?.tag_pattern ?? '<unset>';
+            if (!options.force) {
+                process.stderr.write(chalk.yellow(`Warning: This skill publishes from GitHub via tag push (tag pattern: ${tagPattern}).\n`));
+                process.stderr.write(chalk.yellow('  Running `publish` locally will be overridden the next time the webhook fires.\n'));
+                process.stderr.write(chalk.cyan('  Use --force to publish locally anyway.\n'));
+                process.exit(1);
+            }
+            process.stderr.write(chalk.yellow(`Warning: --force overriding source=github guard (tag pattern: ${tagPattern}).\n`));
+        }
+        // Capability rename guard — bypassable with --force; preserves the
+        // original capability_name when bypassed.
+        let capabilityName = computedCapability;
+        let renameBypassed = false;
+        if (existingManifest && existingManifest.capability_name !== computedCapability) {
+            if (!options.force) {
+                process.stderr.write(chalk.red(`Error: SKILL.md name (${skillName}) does not match the linked capability (${existingManifest.capability_name}).\n`));
+                process.stderr.write('Did you rename the skill? If so, either:\n');
+                process.stderr.write(chalk.cyan(`  1. Change SKILL.md frontmatter name back to "${existingManifest.skill_name}"\n`));
+                process.stderr.write(chalk.cyan('  2. Run `skillvault-publisher unlink && skillvault-publisher link` to create a new skill\n'));
+                process.stderr.write(chalk.cyan(`  3. Use --force to publish under the existing capability_name\n`));
+                process.exit(1);
+            }
+            // --force: keep the original capability_name, but use the new
+            // frontmatter name for display going forward.
+            capabilityName = existingManifest.capability_name;
+            renameBypassed = true;
+            process.stderr.write(chalk.yellow(`Warning: --force keeping original capability ${capabilityName}; new frontmatter name (${skillName}) will display to customers next version.\n`));
+        }
         // Pack directory
         const packed = packSkillDirectory(dirPath);
         const fileCount = Object.keys(packed.files).length;
@@ -108,7 +165,6 @@ export const publishCommand = new Command('publish')
         // Compute SHA-256 of vault for integrity
         const vaultHash = createHash('sha256').update(vaultData).digest('hex');
         // Register capability with server
-        const capabilityName = `skill/${skillName.toLowerCase()}`;
         let capabilityJustRegistered = false;
         const registerBody = {
             name: capabilityName,
@@ -220,6 +276,44 @@ export const publishCommand = new Command('publish')
             process.exit(1);
         }
         const publishResult = await publishRes.json().catch(() => ({}));
+        // ── Workspace manifest update (after successful publish) ──
+        const wasUnlinked = existingManifest === null;
+        if (!options.noLink && sessionPublisherId) {
+            // Spread existing first so source/github and any other forward-compat
+            // fields survive. linked_at is preserved when re-linking, set fresh
+            // on first link.
+            const linkedAt = existingManifest?.linked_at ?? new Date().toISOString();
+            const newManifest = {
+                ...(existingManifest ?? {}),
+                version: 1,
+                publisher_id: sessionPublisherId,
+                // When --force bypassed a rename, keep the original skill_name as
+                // the canonical handle but capability_name is already preserved.
+                skill_name: renameBypassed ? existingManifest.skill_name : skillName,
+                capability_name: capabilityName,
+                linked_at: linkedAt,
+                last_published_version: version,
+                last_published_at: new Date().toISOString(),
+                last_published_hash: vaultHash,
+            };
+            try {
+                saveWorkspace(dirPath, newManifest);
+                registerWorkspace({
+                    path: dirPath,
+                    publisher_id: newManifest.publisher_id,
+                    skill_name: newManifest.skill_name,
+                    capability_name: newManifest.capability_name,
+                    linked_at: newManifest.linked_at,
+                    last_published_at: newManifest.last_published_at,
+                });
+            }
+            catch (manifestErr) {
+                // Manifest write failures are non-fatal — the publish already
+                // succeeded. Surface the error but exit 0.
+                const message = manifestErr instanceof Error ? manifestErr.message : String(manifestErr);
+                process.stderr.write(chalk.yellow(`Warning: failed to update workspace manifest: ${message}\n`));
+            }
+        }
         if (publishResult.status === 'unchanged') {
             console.log(chalk.yellow(`Content unchanged for ${skillName} v${version}. No new version created.`));
             console.log(chalk.dim(`  Use --force to publish anyway.`));
@@ -231,6 +325,12 @@ export const publishCommand = new Command('publish')
             console.log(chalk.dim(`  Files:      ${fileCount}`));
             console.log(chalk.dim(`  Capability: ${capabilityName}`));
         }
+        // First-publish auto-link tip — printed AFTER the publish result so the
+        // user sees the success line first, then the actionable tip.
+        if (wasUnlinked && !options.noLink && sessionPublisherId) {
+            process.stderr.write(chalk.cyan(`\nLinked this directory to skill "${skillName}" (${sessionPublisherId}).\n`));
+            process.stderr.write(chalk.dim('  Tip: commit .skillvault-publisher/workspace.json so teammates and CI can find this skill.\n'));
+        }
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);

package/dist/commands/revoke-grant.js

@@ -1,14 +1,16 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { requireSession, sessionFetch } from '../session.js';
+import { requireCommandContext, sessionFetch } from '../session.js';
 export const revokeGrantCommand = new Command('revoke-grant')
     .description('Revoke a capability grant by ID')
     .argument('<grant-id>', 'Grant ID to revoke (e.g., gnt_xxx)')
     .option('--yes', 'Skip confirmation and revoke immediately')
     .option('--json', 'Output as JSON')
+    .option('--workspace <path>', 'Resolve workspace context (informational only — grant ID is authoritative)')
+    .option('--quiet', 'Suppress the "(using workspace …)" stderr note')
     .action(async (grantId, options) => {
     try {
-        const ctx = requireSession();
+        const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
         if (!options.yes) {
             // Fetch grant details so the user can verify before confirming
             const data = await sessionFetch(ctx, `/grants/${grantId}`);