website-build-skill 0.1.1 → 0.1.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "A skill pack that teaches your AI current website-building expertise: research, design, code, accessibility, performance, search and security.",
   "author": {
     "name": "website-build-skill contributors"

package/CHANGELOG.md

@@ -6,6 +6,19 @@ Version policy: [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-09-23
+
+### Fixed
+
+- #13: Synchronized the repository settings description with `package.json`, added a description drift check and documented the release update step.
+- #14: Documented the installed skill folder as the Hermes alias path root in the adapter, installer contract and CLI help, with regression coverage for help text and alias placement.
+
+## [0.1.2] - 2026-09-23
+
+### Changed
+
+- README "Two ways to work" is a two-row table in place of the raw installer prompt; the save-location choices are one sentence. SKILL.md keeps the card verbatim because the agent shows it to the user, and the drift check now requires it there only.
+
 ## [0.1.1] - 2026-09-23
 
 ### Added

package/README.md

@@ -87,36 +87,14 @@ Every site follows the same twelve stages, so your AI researches before it desig
 
 ## Two ways to work
 
-```text
-How do you want to work?
-
-  1  Teach my AI          One AI learns the whole thing and does every job itself.
-                          Works with any AI: Claude, ChatGPT, Grok, Cursor, Copilot.
-                          Nothing else to install.
-
-  2  Give me the team     Seven specialist agents, one per job, starting with a researcher that gets them all current.
-                          Needs Claude Code, Codex, Hermes, Antigravity, or Grok Bot.
-                          One command installs their files; you open each session yourself.
+| Choice | What happens | Works with |
+|---|---|---|
+| **1 · Teach my AI** (SOLO) | One AI learns the whole method and does every job itself. Nothing else to install. | Any AI: Claude, ChatGPT, Grok, Cursor, Copilot |
+| **2 · Give me the team** (TEAM) | Seven specialist agents, one per job, starting with a researcher that gets them all current. One command installs their files; you open each session yourself. | Claude Code, Codex, Hermes, Antigravity, Grok Bot |
 
 Not sure? Pick 1. Moving to 2 later keeps everything you have already done.
 
-Where should the work be saved?
-
-  1  Obsidian vault       Give an existing folder inside your vault. The library is
-                          plain Markdown, so it opens and links natively.
-
-  2  A folder on this computer
-                          Give an existing directory. The default is the
-                          website project folder.
-
-  3  Notion               Working copy still lives in a folder on this computer,
-                          because every gate reads its own files back by path.
-                          Notion receives an export of the finished library.
-
-  4  Somewhere else       Type an existing local destination yourself.
-
-Whatever you pick becomes the workspace root. Everything below is written inside it.
-```
+The installer also asks where to save the work: an Obsidian vault folder, a folder on this computer (default: your project folder), Notion (a local working copy plus an export of the finished library), or another local folder. That folder becomes the workspace root.
 
 SOLO follows the same jobs with saved self-handoffs. TEAM gives each job a separate route:
 

package/RELEASING.md

@@ -19,6 +19,8 @@ push publishes. Creating the GitHub release page stays manual.
 
 ## Invocation chain
 
+When `package.json` description changes, update REPO_SETTINGS.md § Description in the same commit and run `gh repo edit https://github.com/aunysillyme/website-build-skill --description "<same string>"`.
+
 1. Read the candidate and resolve any source, privacy, claim-review or license defect.
 2. Run `node scripts/build.mjs` to regenerate bundles and the index.
 3. Run `node scripts/check.mjs` without rewriting outputs.

package/REPO_SETTINGS.md

@@ -7,9 +7,9 @@ trusting any row; a checklist is only as current as its last read.
 
 ## Description
 
-- [x] Repository description set to this one line. Read back 2026-09-21; it matches.
+- [x] Repository description set to this one line, identical to package.json and npm. Read back 2026-09-23; it matches.
 
-Research-first website-building skill: learn the craft, match the brand, compare three mockups, then build and verify. Use one AI or a seven-role team with reusable research, design, accessibility, SEO and release checklists.
+Skills that make your AI an expert website builder: current research, design, accessibility, performance, SEO, security and code, for any LLM or agent.
 
 ## Topics
 

package/adapters/hermes.md

@@ -6,7 +6,8 @@ For explicit loading, ask the session to read its SKILL.md directly.
 After confirming the installed CLI supports it, try preload: `hermes -s website-build-skill` after discovery is confirmed.
 After checking the installed CLI help, use its trust operation: `hermes skills trust`; this changes trust state and requires the user's authorization.
 Do not create version-control state or alter global settings during a copy.
-Install the files: `npx website-build-skill --team --target hermes --dir . --scope project --yes --bundle-dir ./team-aliases`.
+Install the files: `npx website-build-skill --team --target hermes --dir . --scope project --yes --bundle-dir team-aliases`.
+The path is relative to the installed skill folder, so the alias files land in `.agents/skills/website-build-skill/team-aliases/` and the path must stay inside that folder.
 
 ## Two planned branches
 

package/docs/INSTALLER.md

@@ -38,7 +38,7 @@ Append `#<reviewed-commit-sha>` to the repository reference for a reproducible i
 - Choice: mutually exclusive `--solo` / `--team`; no arguments asks the canonical human question first.
 - Target: `claude-code`, `codex`, `hermes`, `antigravity`, `grok`, `agents`, `chatgpt`, `portable`.
 - Scope: project by default; user scope requires explicit selection, never implicit fallback.
-- Destination: `--dir` is explicit; `--bundle-dir` is accepted only for the Hermes team alias.
+- Destination: `--dir` is explicit; `--bundle-dir` is accepted only for the Hermes team alias and resolves relative to the installed skill folder. Paths outside that folder are refused with exit 3 and "Path escapes destination root".
 - Output root: `--output-dir` selects an existing directory separately from the skill destination. Interactive setup collects the save-location choice and path; Enter on the local-folder path uses the website project directory. The receipt records `outputRoot` and optional `outputStorage` (kind and Notion export target). Researcher consumes those values before writing `<outputRoot>/site-work/research/library/scope.md`. The installer only probes the root; it does not create a library or export to Notion. Headless setup without `--output-dir` leaves the root unset for Researcher to ask before writing.
 - Notion: export destination only. Interactive setup requires both the existing local working directory (authoritative) and a page URL or name for later export. No credentials are requested and no network upload occurs.
 - Writability: confirm the output root by writing and reading back before any sweep; an unwritable root fails without partial writes.

package/docs/evidence/content-review.json

@@ -10,9 +10,9 @@
       "disposition": "instructions-and-qualified-status-only"
     },
     "CHANGELOG.md": {
-      "sha256": "ab824090287fb7dfd4810e5715ea474699d0845dc3b6ef8bef1ffcff3cd8c9ee",
+      "sha256": "a459e172980dc7c72d410017d6ed5474902e39c72d19f48d26eb3f5f0359da79",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending."
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the added 0.1.1 framing note against the presentation copy changes; publication is a separate release action. Implementation-agent editorial review; independent review remains pending. Reviewed the copied-install checker ladder fix against the canonical instructions and regression test. Live host retrial remains pending release. Reviewed for the ROUND 1 audit: added Fixed/Added/Changed lines for the restored positive-and-accurate adapter, SKILL.md, designer.md, grok.md and validate.mjs fixes. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed the #13 description check and #14 Hermes path documentation entries against the implementation and regression tests; publication remains a separate maintainer action. Implementation-agent editorial review; independent review remains pending."
     },
     "CLAUDE.md": {
       "sha256": "502ce6fb03a6032d4a03198288e10906d38c73124937950e34176d44a7f52440",
@@ -31,18 +31,19 @@
       "disposition": "instructions-and-qualified-status-only"
     },
     "README.md": {
-      "sha256": "32eb1581711d83bfaa94286a2012f992a174df9b9dfcbc6668b92354eaff3bb9",
+      "sha256": "472e92ac17d396170904caca2cc3b200cd84c2e7a329eaaf812d496598edaa7e",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Reviewed the requested skill-pack framing and each learning-table sentence against its linked canonical instructions; preserved the twelve stages, starter, setup card and sibling links. Demo URL awaits the separately recorded artifact. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending."
+      "review": "0.1.2: the installer prompt block became a two-row choice table and one save-location sentence; reviewed by Claude against install-choice.txt and SKILL.md, same facts. Reviewed the requested skill-pack framing and each learning-table sentence against its linked canonical instructions; preserved the twelve stages, starter, setup card and sibling links. Demo URL awaits the separately recorded artifact. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending."
     },
     "RELEASING.md": {
-      "sha256": "c09c6fe815997615f0242d580430d8c83175b3ef2c0b0b929f9bd4d6284def2a",
-      "disposition": "instructions-and-qualified-status-only"
+      "sha256": "7e89b30d20fef7570fc0485f80844c651a861a18956efd43e1555967f3e8dde4",
+      "disposition": "instructions-and-qualified-status-only",
+      "review": "0.1.3: reviewed the same-commit description update and explicit GitHub command against the task specification; no live repository setting was changed in this offline implementation pass. Implementation-agent editorial review; independent review remains pending. The command uses the exact repository URL to preserve the existing privacy allowance for public repository references."
     },
     "REPO_SETTINGS.md": {
-      "sha256": "d3ca77b4497f879efd18b316f721b28074e0778246f93e99d4c5889013d0e33b",
+      "sha256": "f0a405e61c2361c9b746a867279dc2ca28a983a14899d14b249286c486e989de",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Topic list changed to match the skill-pack framing and package.json keywords (20 topics). Reviewed by Claude against the check TOPICS rule."
+      "review": "Topic list changed to match the skill-pack framing and package.json keywords (20 topics). Reviewed by Claude against the check TOPICS rule. 0.1.3: matched the Description text to package.json and added the requested 2026-09-23 read-back row from the maintainer task bundle; GitHub and npm were not independently queried in this offline implementation pass. Implementation-agent editorial review; independent review remains pending."
     },
     "SECURITY.md": {
       "sha256": "9e0a9064cd020c23ae82f4c734ceab24bb9e4297073227a49ecc41414e33f8b7",
@@ -89,9 +90,9 @@
       "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending."
     },
     "adapters/hermes.md": {
-      "sha256": "14675d43a1561d2ad43f6b2cdda47e7312d1ba9aba3354ecec4c1545bcccb90d",
+      "sha256": "eeba94a78d84587d8a5fefea75692ff9ae4c2efaeb119a8672b22e18b5ad8724",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending."
+      "review": "Reviewed setup instructions, tool fallback gates and compatibility links against the previous adapter; research status and safety requirements preserved. Implementation-agent editorial review; independent review remains pending. Reviewed for the ROUND 1 audit: restored the positive, once-stated native-loading status fact for adapters, README and compatibility docs, without implying native loading is proven. Claude (builder, non-author fixer) editorial review; independent review remains pending. 0.1.3: reviewed team-aliases placement and the destination boundary against src/install.mjs plan/safePath and the extended installer regression; native loading status is unchanged. Implementation-agent editorial review; independent review remains pending."
     },
     "adapters/zero-install.md": {
       "sha256": "7ac8fb37969ecbc321be6e74f6193d04d61ed4760ca7951975ab6d636d227699",
@@ -121,9 +122,9 @@
       "review": "Reviewed the exact two-sibling allowlist against production privacy rules and rejection regressions. Implementation-agent editorial review; independent review remains pending."
     },
     "docs/INSTALLER.md": {
-      "sha256": "87b5c2e78fe62d626d7b25987552124a71d94797670314dbeba7b22b63acb6d5",
+      "sha256": "85944c760b696080cb2ba8b6d381af13da3aeafa517965c7c7e28dd4625b10c6",
       "disposition": "instructions-and-qualified-status-only",
-      "review": "Reviewed npm commands and loading instructions against the CLI contract and existing installer tests; flags and exit policy preserved. Implementation-agent editorial review; independent review remains pending."
+      "review": "Reviewed npm commands and loading instructions against the CLI contract and existing installer tests; flags and exit policy preserved. Implementation-agent editorial review; independent review remains pending. 0.1.3: reviewed the installed skill folder resolution root, exit 3 and Path escapes destination root message against src/install.mjs and the installer regression. Implementation-agent editorial review; independent review remains pending."
     },
     "docs/METHOD.md": {
       "sha256": "c316397d190cb1b86e6167914106e6fd71db97b7d18e1af09e5f18b36e04b266",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Skills that make your AI an expert website builder: current research, design, accessibility, performance, SEO, security and code, for any LLM or agent.",
   "type": "module",
   "license": "MIT",

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.1",
+  "packageVersion": "0.1.3",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [

package/src/cli.mjs

@@ -8,7 +8,7 @@ check-library <site-work-dir> (read-only receipt validation)
 --solo | --team  --target ${Object.keys(targets).join('|')}
 --dir <path>  --scope project|user  --output-dir <path>
 --yes  --dry-run  --receipt <path>  --uninstall  --help  --version
---bundle-dir <path> (Hermes TEAM only)
+--bundle-dir <path> (Hermes TEAM only; relative to the installed skill folder)
 Headless installs require explicit mode, target and --dir.
 Activation remains UNVERIFIED.`;
 

package/src/validate.mjs

@@ -270,7 +270,9 @@ export function check(root, options = {}) {
       }
     }
     const question = read(root, `${CORE}/templates/install-choice.txt`).trimEnd();
-    if (!read(root, 'README.md').includes(question) || !read(root, `${CORE}/SKILL.md`).includes(question)) issues.push('CHOICE_DRIFT:verbatim question');
+    // The agent shows this card to the user, so SKILL.md carries it verbatim. The README
+    // summarizes the same two choices as a table for human readers.
+    if (!read(root, `${CORE}/SKILL.md`).includes(question)) issues.push('CHOICE_DRIFT:verbatim question');
     const prompts = read(root, 'docs/bundles/prompts.md');
     if (prompts.includes(`BEGIN SOURCE: ${ARCHIVE}`) || prompts.includes(read(root, `${CORE}/${ARCHIVE}`).split('\n').slice(8).join('\n').trim())) issues.push('ARCHIVE_EXCLUSION:active prompt bundle');
   });
@@ -349,6 +351,9 @@ export function check(root, options = {}) {
     if (/they are ready/i.test(choice)) issues.push('CHOICE_HONESTY:no installer creates a running worker');
     if (!p.bin && !/one-command install is planned/i.test(choice)) issues.push('CHOICE_HONESTY:manual-setup statement missing');
     const settings = read(root, 'REPO_SETTINGS.md');
+    const description = settings.split(/^## Description\r?$/m)[1]?.split(/^## /m)[0]
+      .split(/\r?\n/).filter(line => line.trim() && !/^- \[[ x]\] /.test(line)).join('\n');
+    if (description !== p.description) issues.push('DESCRIPTION_DRIFT:REPO_SETTINGS.md');
     const topics = settings.split('## Topics')[1].split('## Creation')[0].split('\n').filter(s => /^- [a-z0-9-]+$/.test(s)).map(s => s.slice(2));
     if (JSON.stringify(topics) !== JSON.stringify(p.keywords) || topics.length > 20 || topics.some(t => !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(t) || t.length >= 50)) issues.push('TOPICS:invalid or mismatched keywords');
     if (p.description.length >= 350) issues.push('DESCRIPTION:too long');