sshlg-skills 0.5.4

package/CHANGELOG.md

@@ -0,0 +1,167 @@
+# Changelog
+
+## v0.5.4 — 2026-07-28
+
+- **seo-aeo-audit bumped to v0.4.0** in the registry and the submodule pin (was
+  0.3.1). That release ran ten per-track extraction passes over the full source
+  corpus and one reconciliation pass over all 19 contracts: +1,725 lines, sixteen
+  contradictions resolved by naming both studies and demoting contested
+  directions, duplication removed with a single owner per fact, and the coverage
+  gaps filled (hreflang and international duplication, fabricated information
+  gain, licensing posture, rank-tracker vendor continuity, EU DMA exposure).
+- Registry `desc` updated to match.
+
+## v0.5.3 — 2026-07-28
+
+- **seo-aeo-audit bumped to v0.3.1** in the registry and the submodule pin
+  (was 0.2.0). Two releases landed: v0.3.0 added the ranking model, the on-page
+  completeness sweep, the tooling/evidence ladder and the post-click track
+  (conversion elements, call and offline attribution, paid × organic alignment);
+  v0.3.1 ran a consistency pass over the whole flow — one evidence ladder, one
+  stance on structured data, reconciled page-experience and keyword framing,
+  tier discipline in every new contract — and rewrote the README around install,
+  update, the audit flow, what knowledge ships inside and how fresh it is.
+- Registry `desc` updated to match.
+
+## v0.5.2 — 2026-07-28
+
+- **seo-aeo-audit bumped to v0.2.0** in the registry and the submodule pin. That
+  release adds a dated Google update timeline (every core, spam and Discover
+  update from March 2025 to June 2026, plus the platform changes that retired old
+  tactics), an update-response protocol wired into the audit flow, a refresh
+  routine with named sources, and SEJ's *SEO Trends 2026* distilled into the
+  existing contracts.
+- Registry `desc` updated to match.
+
+## v0.5.1 — 2026-07-28
+
+- **seo-aeo-audit bumped to v0.1.0 → v0.1.1** in the registry and the submodule
+  pin. That release fixes the make-skill gotcha the first cut tripped over — the
+  deliverable skeletons lived only at the repo root, which the skills CLI does not
+  ship, so non-Claude agents received a SKILL.md pointing at files they could not
+  read — plus a broken cross-reference anchor, mixed British/American spelling
+  across the contracts, and two auditor defects (navigation labels inflating the
+  word count, robots directives matched as substrings).
+
+## v0.5.0 — 2026-07-28
+
+- **New family member: `seo-aeo-audit` v0.1.0** ([ssheleg/seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit)) —
+  evidence-first website audit for search **and** answer engines that ends in a
+  prioritized change plan. Ten tracks (access & indexation economics,
+  canonicalization, architecture & link equity, intent & SERP fit, content value,
+  extractability/AEO-GEO, entity & brand consensus, experience signals, risk &
+  threats, measurement), an evidence-tier triage model
+  (`priority = (impact × confidence) / effort`), an explicit myth guard, and a
+  stdlib-only page auditor that measures the answer-engine read budget.
+- Registered in `skills.json`, added as a submodule at `skills/seo-aeo-audit`,
+  README family table and RU section updated.
+
+## v0.4.1 — 2026-07-27
+
+- **task-pipeline bumped to v0.12.0** in the registry and the submodule pin
+  (was 0.10.0). That release makes the intake grill mandatory and **built in** —
+  the `grill-me` / `grilling` dependency is gone, the doctrine is ported in-house
+  with domain awareness (CONTEXT.md glossary challenges, ADR discipline) and an
+  autonomy sweep that pre-resolves every stage-1→9 blocker — and replaces
+  per-stage model tiering with one provider-agnostic model confirmed up front.
+- Registry `desc` and the README family table updated to match.
+
+## v0.4.0 — 2026-07-25
+
+- **Enforce "one channel per agent" automatically.** The skills CLI auto-detects
+  Claude Code and writes `~/.claude/skills/<id>` even when it is never named as a
+  target, so every `install`/`update` silently recreated plain copies that shadow
+  the Claude plugin. The launcher now prunes those copies after any skills-CLI
+  step while the plugin channel is active (skipped under `--no-claude`, where the
+  plain copies are the intended channel). Verified live: 7 shadows → 0.
+
+## v0.3.1 — 2026-07-25
+
+- Pin bump: sheleg-design **0.7.0** (style-agnostic build recipe, release
+  workflow, RU README). Family now pinned at super-ux 0.19.0, task-pipeline
+  0.10.0, make-skill 0.3.0, sheleg-design 0.7.0.
+
+## v0.3.0 — 2026-07-25
+
+Launcher hardening — four defects an adversarial audit proved by execution.
+
+- **FIX: `update` silently moved the pins, even with `--claude-only`.** The
+  submodule step ran before any flag branch and used `--remote --merge`, so a
+  "Claude-only" run fast-forwarded a submodule to its upstream tip and left the
+  superproject dirty — destroying the pinned-snapshot contract. It now runs only
+  when not `--claude-only`, uses `--init --recursive` (materialise, don't move),
+  and moves pins **only** behind the new explicit `--bump-pins`.
+- **FIX: every `claude plugin` failure was swallowed.** Those `run()` results were
+  discarded, so a completely failing `claude` still exited 0 (worst with
+  `--claude-only`, where nothing else could set the flag). All four calls now feed
+  the exit status — verified with a failing stub on PATH: exit 1.
+- **FIX: the CI could not catch a bad `skillNames`.** Both workflows checked out
+  `submodules: false`, and the cross-check was guarded by `if isdir(...)` — so it
+  skipped silently and a bogus id passed green. Workflows now check out
+  `submodules: recursive`, and the validator **fails loudly** when a submodule
+  isn't materialised instead of skipping.
+- **`skills update` now runs one call per skill id** so a single bad id can't fail
+  the batch; contradictory `--claude-only --no-claude` and a valueless `--agent`
+  now exit 2; `spawnSync` uses `shell` on Windows (npx/claude are `.cmd` shims);
+  `list` falls back to versions recorded in `skills.json` when run from an npx
+  tarball (it printed `v?` for everything, including the release smoke test).
+- README's `update` section now matches the launcher (no `--agent`, adds
+  `--bump-pins`).
+
+## v0.2.1 — 2026-07-25
+
+- Pins bumped to the review-pass releases: super-ux **0.19.0** (contracts now ship
+  with every skill), task-pipeline **0.10.0** (brief template reachable on every
+  channel, current super-ux chain), make-skill **0.3.0** (stopped shipping a
+  placeholder skill; validator enforces the canon), sheleg-design 0.6.0.
+
+## v0.2.0 — 2026-07-24
+
+- **Fix: `update` never updated super-ux.** A repo can ship several skills under
+  different ids — super-ux ships `ux-foundation`/`ux-flows`/`ux-scenarios`/
+  `ux-audit` and there is no skill called `super-ux` — but the launcher passed the
+  repo names to `skills update`, which matches INSTALLED SKILL ids. super-ux was
+  silently skipped on every update. `skills.json` entries now carry `skillNames[]`
+  (the ids actually shipped) and the launcher updates those; the validator
+  enforces the field and cross-checks it against the skills each submodule ships,
+  so the regression cannot come back.
+
+## v0.1.3 — 2026-07-24
+
+- **Tolerate stray non-flag arguments.** zsh does not treat `#` as a comment by
+  default, so `... install # note` passed `#` into the launcher and it hard-failed
+  with "unknown option: #". Now only `-`/`--`-prefixed unknowns error; bare stray
+  tokens are ignored with a notice, so the intended command still runs.
+
+## v0.1.2 — 2026-07-24
+
+- Bumped submodule pins to the current release of each skill: super-ux 0.18.0,
+  task-pipeline 0.9.0, **make-skill 0.2.0** (correct multi-agent + cross-platform
+  distribution guidance), sheleg-design 0.6.0.
+
+## v0.1.1 — 2026-07-24
+
+- **Fix multi-agent install.** The vercel `skills` CLI does not split a
+  comma/space-joined `--agent` value (it read `cursor,opencode,…` as one invalid
+  agent). The launcher now passes one repeated `--agent <name>` flag per agent, so
+  `install` reaches the whole default agent set (and `--all`/`--agent a,b`) in one
+  `skills add` call per skill.
+
+## v0.1.0 — 2026-07-24
+
+Initial release — the ssheleg skill-family umbrella.
+
+- **Submodules** (`skills/`): super-ux, task-pipeline, make-skill, sheleg-design
+  (→ `ssheleg/sheleg-design-skill`), wired via `.gitmodules` (https urls, clonable
+  without SSH).
+- **Launcher/updater** `bin/sshlg-skills.js` (zero-dep): `install` / `update` /
+  `list` / `agents`. A thin orchestrator over the vercel `skills` CLI (70+ agents),
+  `claude plugin` (Claude Code), and `git submodule` (pinned snapshots). Non-Claude
+  agents via the skills CLI; Claude Code via its plugin to avoid a shadow duplicate.
+  Flags: `--agent`, `--all`, `--no-claude`, `--claude-only`.
+- **`skills.json`** — source of truth (repos, plugin ids, default agent set).
+- **Validator** (`test/validate.py`, stdlib): package/version, bin resolves, files
+  whitelist, CHANGELOG version match, and `.gitmodules` ↔ `skills.json` ↔ on-disk
+  submodule agreement. CI runs it plus a negative self-test and `node --check`.
+- **Distribution:** `npx github:ssheleg/sshlg-skills` (no publish needed),
+  `git clone --recursive` + `install.sh`, and (optional) npm `sshlg-skills`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ssheleg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,99 @@
+# sshlg-skills
+
+[![validate](https://github.com/ssheleg/sshlg-skills/actions/workflows/validate.yml/badge.svg)](https://github.com/ssheleg/sshlg-skills/actions/workflows/validate.yml)
+[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+One umbrella for the **ssheleg skill family** — the five skills live in their own
+repos, aggregated here as git **submodules**, with a single **launcher/updater**
+that installs and updates them across **every agent**: Claude Code, Cursor,
+OpenCode, Kilo, Kimi, Hermes, OpenClaw, Codex, Gemini CLI, Windsurf, Zed, and more.
+
+## The family
+
+| Skill | Repo | What |
+|---|---|---|
+| **super-ux** | [ssheleg/super-ux](https://github.com/ssheleg/super-ux) | Scenario-driven UX: foundation → flows → screens → scenarios → audits, one `/ux` entry, a doc-drift linter |
+| **task-pipeline** | [ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline) | Mandatory built-in intake grill (domain-aware, ADR discipline) + 9 gated delivery stages on the superpowers skills |
+| **make-skill** | [ssheleg/make-skill](https://github.com/ssheleg/make-skill) | Create, retrofit, and ship skills & plugins the proven way |
+| **sheleg-design** | [ssheleg/sheleg-design-skill](https://github.com/ssheleg/sheleg-design-skill) | Cinematic scroll-driven landing/hero design + product-UI style packs |
+| **seo-aeo-audit** | [ssheleg/seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit) | Evidence-first SEO + AEO/GEO site audit: ten tracks, evidence tiers, a prioritized change plan |
+
+Each is independently installable; this repo is the one-command hub.
+
+## Install everything
+
+**No clone needed** (runs straight from GitHub):
+```
+npx github:ssheleg/sshlg-skills install
+```
+After npm publish, the short form also works:
+```
+npx sshlg-skills install
+```
+
+**Or clone with submodules** (pinned snapshots + offline reference):
+```
+git clone --recursive https://github.com/ssheleg/sshlg-skills
+cd sshlg-skills && ./install.sh
+```
+
+### What `install` does
+
+- **Non-Claude agents** (`cursor, opencode, kilo, kimi-code-cli, hermes-agent,
+  openclaw, codex, gemini-cli, windsurf, zed`) via the vercel `skills` CLI, global.
+- **Claude Code** via its **plugin** (not a plain copy) — so it never shadows a
+  plugin you already run.
+
+Flags: `--agent a,b` (pick agents), `--all` (every agent the skills CLI supports),
+`--no-claude` (skip the Claude plugin step), `--claude-only`.
+
+## Update everything
+
+```
+npx github:ssheleg/sshlg-skills update
+```
+Updates every skills-CLI install (one call per skill id) and the Claude Code
+plugins, and materialises the pinned submodules inside a checkout **without moving
+the pins**. Restart Claude Code to apply.
+
+Flags: `--no-claude`, `--claude-only`, and `--bump-pins` (fast-forward the pins to
+their upstream tips — off by default so a checkout stays reproducible). `update`
+targets whatever is already installed, so it takes no `--agent`.
+
+## Other commands
+
+```
+npx github:ssheleg/sshlg-skills list      # the family + versions
+npx github:ssheleg/sshlg-skills agents    # supported agents
+```
+
+## How it works
+
+A thin, zero-dependency launcher over the tools that already reach each agent: the
+vercel [`skills`](https://github.com/vercel-labs/skills) CLI (70+ agents),
+`claude plugin` (Claude Code), and `git submodule` (pinned snapshots). It adds no
+new install mechanism — it curates the family and drives those. `skills.json` is
+the source of truth (repos, plugin ids, default agents); the validator keeps it in
+sync with `.gitmodules`.
+
+## По-русски
+
+**sshlg-skills** — единый зонтичный репозиторий для семейства скилов ssheleg
+(super-ux, task-pipeline, make-skill, sheleg-design, seo-aeo-audit). Сами скилы живут в своих
+репах и подключены сюда git-**сабмодулями**, а один **лончер/апдейтер** ставит и
+обновляет их сразу для **всех агентов**: Claude Code, Cursor, OpenCode, Kilo, Kimi,
+Hermes, OpenClaw, Codex, Gemini CLI, Windsurf, Zed и др.
+
+Установить всё: `npx github:ssheleg/sshlg-skills install`. Обновить всё:
+`npx github:ssheleg/sshlg-skills update`. Не-Claude агенты идут через `skills` CLI,
+Claude Code — через **плагин** (чтобы не дублировать plain-копией). Флаги:
+`--agent a,b`, `--all`, `--no-claude`, `--claude-only`. Список семейства и версий —
+`… list`, поддерживаемые агенты — `… agents`.
+
+Лончер ничего не изобретает — он тонкая обёртка над тем, что уже умеет достучаться
+до каждого агента (`skills` CLI, `claude plugin`, `git submodule`). Источник правды
+— `skills.json`, валидатор держит его в синхроне с `.gitmodules`.
+
+## License
+
+MIT © 2026 ssheleg.

package/bin/sshlg-skills.js

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+/*
+ * sshlg-skills — one launcher/updater for the ssheleg skill family
+ * (super-ux, task-pipeline, make-skill, sheleg-design) across every agent.
+ *
+ * It is a thin orchestrator over the tools that already know how to reach each
+ * agent: the vercel `skills` CLI (70+ agents), `claude plugin` (Claude Code),
+ * and `git submodule` (pinned snapshots). Zero npm dependencies.
+ *
+ *   npx sshlg-skills install [--agent a,b | --all] [--no-claude] [--claude-only]
+ *   npx sshlg-skills update  [--agent a,b | --all] [--no-claude] [--claude-only] [--bump-pins]
+ *   npx sshlg-skills list
+ *   npx sshlg-skills agents
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'skills.json'), 'utf8'));
+const SKILLS = manifest.skills;
+
+function log(m) { process.stdout.write(m + '\n'); }
+function run(cmd, args, opts) {
+  log('  » ' + cmd + ' ' + args.join(' '));
+  const r = spawnSync(cmd, args, Object.assign(
+    { stdio: 'inherit', shell: process.platform === 'win32' }, opts || {}));
+  return r.status === 0;
+}
+
+function parseFlags(argv) {
+  const f = { agents: null, all: false, claude: true, claudeOnly: false, bumpPins: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--all') f.all = true;
+    else if (a === '--no-claude') f.claude = false;
+    else if (a === '--claude-only') f.claudeOnly = true;
+    else if (a === '--bump-pins') f.bumpPins = true;
+    else if (a === '--agent' || a === '-a') {
+      const v = argv[++i];
+      if (!v || v.startsWith('-')) { log('--agent needs a value, e.g. --agent cursor,zed'); process.exit(2); }
+      f.agents = v.split(',').map(s => s.trim()).filter(Boolean);
+      if (!f.agents.length) { log('--agent got an empty list'); process.exit(2); }
+    }
+    else if (a.startsWith('-')) { log(`unknown option: ${a}`); process.exit(2); }
+    // ignore stray non-flag tokens (e.g. a trailing shell comment zsh doesn't strip)
+    else log(`  (ignoring stray argument: ${a})`);
+  }
+  if (f.claudeOnly && !f.claude) { log('--claude-only and --no-claude contradict each other'); process.exit(2); }
+  return f;
+}
+
+function agentList(f) {
+  if (f.all) return ['*'];
+  if (f.agents && f.agents.length) return f.agents;
+  return manifest.defaultAgents.slice();
+}
+
+// The skills CLI auto-detects Claude Code and writes ~/.claude/skills/<id> even when
+// we never ask for that agent. While the Claude PLUGIN channel is active those plain
+// copies shadow the plugin, so prune them — "one channel per agent", enforced.
+function pruneClaudeShadows(skillIds) {
+  const base = path.join(os.homedir(), '.claude', 'skills');
+  const pruned = [];
+  for (const id of skillIds) {
+    const d = path.join(base, id);
+    try {
+      if (fs.existsSync(d)) { fs.rmSync(d, { recursive: true, force: true }); pruned.push(id); }
+    } catch (_) { /* leave it; not fatal */ }
+  }
+  if (pruned.length) {
+    log(`  pruned Claude plain copies that would shadow the plugin: ${pruned.join(', ')}`);
+  }
+}
+
+function usage() {
+  log(`sshlg-skills — install/update the ssheleg skill family everywhere
+
+Skills: ${SKILLS.map(s => s.name).join(', ')}
+
+Usage:
+  npx sshlg-skills install [--agent a,b | --all] [--no-claude] [--claude-only]
+  npx sshlg-skills update  [--agent a,b | --all] [--no-claude] [--claude-only] [--bump-pins]
+  npx sshlg-skills list
+  npx sshlg-skills agents
+
+Defaults:
+  - Non-Claude agents (${manifest.defaultAgents.join(', ')}) via the skills CLI.
+  - Claude Code via its PLUGIN (not a plain copy) to avoid a shadow duplicate.
+  - --all       every agent the skills CLI supports ('*'); with Claude plugins on,
+                this also drops a plain Claude copy — prefer the default.
+  - --no-claude skip the Claude plugin step.
+  - --claude-only install/update only the Claude plugins.
+  - --bump-pins  (update only) also fast-forward the pinned submodules to their
+                 upstream tips — off by default so pins stay reproducible.`);
+}
+
+function skillsCliAgents(f) {
+  // Never let the skills CLI drop a plain Claude copy while we manage Claude via plugin.
+  let agents = agentList(f);
+  if (f.claude && !f.all) agents = agents.filter(a => a !== 'claude-code');
+  if (f.all && f.claude) log('  ! --all includes claude-code: a plain Claude copy will be added alongside the plugin (duplicate). Use the default agent set to avoid this.');
+  return agents;
+}
+
+function cmdInstall(f) {
+  let ok = true;
+  if (!f.claudeOnly) {
+    const agents = skillsCliAgents(f);
+    // the skills CLI wants ONE `--agent` flag per agent (it does not split a
+    // comma/space-joined value) — flatten to repeated flags.
+    const agentFlags = agents.reduce((acc, a) => acc.concat('--agent', a), []);
+    log(`\n== Installing to agents via skills CLI: ${agents.join(', ')} ==`);
+    for (const s of SKILLS) {
+      log(`\n- ${s.name} (${s.repo})`);
+      ok = run('npx', ['--yes', 'skills', 'add', s.repo, ...agentFlags, '--global', '--yes']) && ok;
+    }
+    if (f.claude) pruneClaudeShadows(SKILLS.flatMap(s => s.skillNames || [s.name]));
+  }
+  if (f.claude || f.claudeOnly) {
+    log(`\n== Installing Claude Code plugins ==`);
+    for (const s of SKILLS) {
+      log(`\n- ${s.name}`);
+      ok = run('claude', ['plugin', 'marketplace', 'add', s.pluginMarketplace]) && ok;
+      ok = run('claude', ['plugin', 'install', s.pluginInstall]) && ok;
+    }
+    log('\n(restart Claude Code to apply the plugins)');
+  }
+  return ok;
+}
+
+function cmdUpdate(f) {
+  let ok = true;
+  // 1. Submodules are PINNED snapshots. Only materialise them (--init), never
+  //    move the pins — unless the operator explicitly asks with --bump-pins.
+  //    Skipped entirely for --claude-only: that flag must not touch the checkout.
+  if (!f.claudeOnly && fs.existsSync(path.join(ROOT, '.gitmodules'))) {
+    if (f.bumpPins) {
+      log('\n== Bumping submodule pins to upstream tips (--bump-pins) ==');
+      ok = run('git', ['-C', ROOT, 'submodule', 'update', '--init', '--remote', '--merge']) && ok;
+      log('  ! pins moved — commit the gitlinks to make this reproducible');
+    } else {
+      log('\n== Materialising pinned submodules (pins unchanged) ==');
+      ok = run('git', ['-C', ROOT, 'submodule', 'update', '--init', '--recursive']) && ok;
+    }
+  }
+  if (!f.claudeOnly) {
+    // A repo can ship several skills under different ids (super-ux ships
+    // ux-foundation/ux-flows/ux-scenarios/ux-audit — there is no "super-ux"
+    // skill), and `skills update` matches INSTALLED SKILL names, not repo names.
+    const names = SKILLS.flatMap(s => (s.skillNames && s.skillNames.length ? s.skillNames : [s.name]));
+    log(`\n== Updating skills-CLI installs (global): ${names.join(', ')} ==`);
+    // One invocation per skill: a single bad id must not fail the whole batch.
+    for (const n of names) {
+      ok = run('npx', ['--yes', 'skills', 'update', n, '--global', '--yes']) && ok;
+    }
+    if (f.claude) pruneClaudeShadows(names);
+  }
+  if (f.claude || f.claudeOnly) {
+    log(`\n== Updating Claude Code plugins ==`);
+    for (const s of SKILLS) {
+      ok = run('claude', ['plugin', 'marketplace', 'update', s.pluginInstall.split('@')[1]]) && ok;
+      ok = run('claude', ['plugin', 'update', s.pluginInstall]) && ok;
+    }
+    log('\n(restart Claude Code to apply)');
+  }
+  return ok;
+}
+
+function cmdList() {
+  log('ssheleg skill family:\n');
+  for (const s of SKILLS) {
+    let ver = s.version || '?';
+    const pj = path.join(ROOT, s.dir, 'plugins', s.name, '.claude-plugin', 'plugin.json');
+    try { ver = JSON.parse(fs.readFileSync(pj, 'utf8')).version; } catch (_) {}
+    log(`  ${s.name.padEnd(16)} v${ver.padEnd(8)} ${s.repo}`);
+    log(`  ${' '.repeat(16)}          ${s.desc}`);
+  }
+  log(`\nInstall:  npx sshlg-skills install       Update:  npx sshlg-skills update`);
+}
+
+function cmdAgents() {
+  log('Agents are handled by the vercel `skills` CLI (70+). The named ones:\n');
+  log('  claude-code (via plugin), cursor, opencode, kilo, kimi-code-cli,');
+  log('  hermes-agent, openclaw, codex, gemini-cli, windsurf, zed, and more.\n');
+  log("Full list / exact ids:  npx skills add <any-repo> --agent __x__  (prints valid agents)");
+  log(`Default set: ${manifest.defaultAgents.join(', ')}  (Claude via plugin)`);
+}
+
+function main(argv) {
+  const [cmd, ...rest] = argv.slice(2);
+  if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') { usage(); return 0; }
+  if (cmd === 'list' || cmd === 'ls') { cmdList(); return 0; }
+  if (cmd === 'agents') { cmdAgents(); return 0; }
+  const f = parseFlags(rest);
+  if (cmd === 'install' || cmd === 'i') return cmdInstall(f) ? 0 : 1;
+  if (cmd === 'update' || cmd === 'up') return cmdUpdate(f) ? 0 : 1;
+  log(`unknown command: ${cmd}`); usage(); return 2;
+}
+
+process.exit(main(process.argv));

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "sshlg-skills",
+  "version": "0.5.4",
+  "description": "One launcher/updater for the ssheleg skill family (super-ux, task-pipeline, make-skill, sheleg-design, seo-aeo-audit) across every agent — Claude Code, Cursor, OpenCode, Kilo, Kimi, Hermes, OpenClaw, Codex, and more.",
+  "bin": {
+    "sshlg-skills": "bin/sshlg-skills.js"
+  },
+  "files": [
+    "bin",
+    "skills.json",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "repository": "github:ssheleg/sshlg-skills",
+  "homepage": "https://github.com/ssheleg/sshlg-skills",
+  "license": "MIT",
+  "author": "ssheleg",
+  "engines": {
+    "node": ">=16"
+  },
+  "keywords": [
+    "skills",
+    "launcher",
+    "installer",
+    "updater",
+    "monorepo",
+    "submodules",
+    "claude-code",
+    "cursor",
+    "agents"
+  ]
+}

package/skills.json

@@ -0,0 +1,80 @@
+{
+  "owner": "ssheleg",
+  "defaultAgents": [
+    "cursor",
+    "opencode",
+    "kilo",
+    "kimi-code-cli",
+    "hermes-agent",
+    "openclaw",
+    "codex",
+    "gemini-cli",
+    "windsurf",
+    "zed"
+  ],
+  "skills": [
+    {
+      "name": "super-ux",
+      "repo": "ssheleg/super-ux",
+      "dir": "skills/super-ux",
+      "skillNames": [
+        "ux-foundation",
+        "ux-flows",
+        "ux-scenarios",
+        "ux-audit"
+      ],
+      "pluginMarketplace": "ssheleg/super-ux",
+      "pluginInstall": "super-ux@super-ux",
+      "desc": "Scenario-driven UX: foundation -> flows -> screens -> scenarios -> audits, one /ux entry, a doc-drift linter.",
+      "version": "0.19.0"
+    },
+    {
+      "name": "task-pipeline",
+      "repo": "ssheleg/task-pipeline",
+      "dir": "skills/task-pipeline",
+      "pluginMarketplace": "ssheleg/task-pipeline",
+      "pluginInstall": "task-pipeline@task-pipeline",
+      "desc": "Mandatory built-in intake grill (domain-aware, ADR discipline) + 9 gated delivery stages on the superpowers skills; typed gates, super-ux UX track, toggleable release.",
+      "skillNames": [
+        "task-pipeline"
+      ],
+      "version": "0.12.0"
+    },
+    {
+      "name": "make-skill",
+      "repo": "ssheleg/make-skill",
+      "dir": "skills/make-skill",
+      "pluginMarketplace": "ssheleg/make-skill",
+      "pluginInstall": "make-skill@make-skill",
+      "desc": "Create, retrofit, and ship agent skills & plugins the proven ssheleg way.",
+      "skillNames": [
+        "make-skill"
+      ],
+      "version": "0.3.0"
+    },
+    {
+      "name": "sheleg-design",
+      "repo": "ssheleg/sheleg-design-skill",
+      "dir": "skills/sheleg-design",
+      "pluginMarketplace": "ssheleg/sheleg-design-skill",
+      "pluginInstall": "sheleg-design@sheleg-design-skill",
+      "desc": "Cinematic scroll-driven landing/hero design methodology + product-UI style packs.",
+      "skillNames": [
+        "sheleg-design"
+      ],
+      "version": "0.7.0"
+    },
+    {
+      "name": "seo-aeo-audit",
+      "repo": "ssheleg/seo-aeo-audit",
+      "dir": "skills/seo-aeo-audit",
+      "pluginMarketplace": "ssheleg/seo-aeo-audit",
+      "pluginInstall": "seo-aeo-audit@seo-aeo-audit",
+      "desc": "Evidence-first SEO + AEO/GEO website audit: ten tracks with mechanical sweeps, evidence tiers, a dated Google update timeline, 59 tiered growth plays, and a prioritized change plan with verification steps.",
+      "skillNames": [
+        "seo-aeo-audit"
+      ],
+      "version": "0.4.0"
+    }
+  ]
+}