yeka-skills 0.2.1 → 0.2.3

package/README.md

@@ -31,8 +31,10 @@ yeka-skills logout
 ## Share a local skill with the team
 
 `yeka-skills share <skill>` packages one of your local skill folders and sends it to the private
-submission inbox, where a review bot turns it into a team-repo pull request. Nothing is published
-by a share — a person reviews every submission first.
+submission inbox, where the submission bot turns it into a team-repo pull request. Nothing bypasses
+review — but the reviewers are machines: the repository checks and an AI safety review gate the
+merge, and they run from `main`, not from the pull request. The catalogue page was written from your
+skill's own source and confirmed by you during the share conversation.
 
 - The CLI looks for the folder in the same local roots the installer knows. If a skill exists in
   several of them, it picks the one it would install into first (the current Codex folder, then
@@ -46,7 +48,8 @@ by a share — a person reviews every submission first.
   the review bot can find it, read it, and strip it before the skill content is unpacked. Do not
   create a `_yeka` folder inside your skill yourself.
 - A successful share answers with one sentence: the team is notified the moment the upload
-  lands, and after review it usually goes live the same day, announced in #yeka-skills.
+  lands, and the skill goes live on its own once the automatic checks pass — usually about ten
+  minutes — announced in #yeka-skills. A failed check messages the author, not the operator.
 
 Use `--dry-run` with `add`, `update`, or `remove` to verify and report changes without mutating the
 managed installation. Removal is fully offline and uses local receipts. It refuses locally edited

package/dist/cli.js

@@ -2358,7 +2358,7 @@ var statusCommand = async (context = {}) => {
     return Promise.all(
       receipts.map((receipt) => inspectLocalStatus(receipt, remoteByName.get(receipt.skillName), home))
     );
-  });
+  }, context.session);
   for (const status of statuses) {
     output(
       context,
@@ -2366,17 +2366,21 @@ var statusCommand = async (context = {}) => {
     );
   }
 };
-var assertUpdatableStatuses = (skillName, statuses) => {
+var updateBlocker = (skillName, statuses) => {
   const modified = statuses.find((status) => status.kind === "modified");
   if (modified !== void 0) {
-    throw new CliError(
-      "local_changes",
-      `${skillName} has local changes for ${modified.receipt.runtime}. It was not changed.`
-    );
+    return {
+      code: "local_changes",
+      message: `${skillName} has local changes for ${modified.receipt.runtime}. It was not changed.`
+    };
   }
   if (statuses.some((status) => status.kind === "unavailable")) {
-    throw new CliError("skill_unavailable", `${skillName} is no longer available in the private registry.`);
+    return {
+      code: "skill_unavailable",
+      message: `${skillName} is no longer available in the private registry.`
+    };
   }
+  return void 0;
 };
 var updateCommand = async (skillNameInput, options, context = {}) => {
   const selectedName = skillNameInput === void 0 ? void 0 : validatedSkillName(skillNameInput);
@@ -2396,17 +2400,25 @@ var updateCommand = async (skillNameInput, options, context = {}) => {
     const remoteByName = new Map(manifest.skills.map((skill) => [skill.name, skill]));
     const selectedGroups = [...groups.entries()].filter(([name]) => selectedName === void 0 || name === selectedName);
     const prepared = [];
+    const skipped = [];
     for (const [name, receipts] of selectedGroups) {
       const remote = remoteByName.get(name);
       const statuses = await Promise.all(
         receipts.map((receipt) => inspectLocalStatus(receipt, remote, home))
       );
-      assertUpdatableStatuses(name, statuses);
-      if (remote === void 0) {
-        throw new CliError("skill_unavailable", `${name} is no longer available in the private registry.`);
+      const blocker = updateBlocker(name, statuses) ?? (remote === void 0 ? { code: "skill_unavailable", message: `${name} is no longer available in the private registry.` } : void 0);
+      if (blocker !== void 0) {
+        if (selectedName !== void 0) {
+          throw new CliError(blocker.code, blocker.message);
+        }
+        skipped.push(blocker.message);
+        continue;
       }
       prepared.push({ name, receipts, skill: remote, statuses });
     }
+    for (const message of skipped) {
+      output(context, message);
+    }
     const updated = [];
     for (const item of prepared) {
       if (item.statuses.every((status) => status.kind === "current")) {
@@ -2428,7 +2440,7 @@ var updateCommand = async (skillNameInput, options, context = {}) => {
       });
     }
     return updated;
-  });
+  }, context.session);
   for (const result of results) {
     printActions(context, result.name, result.actions, options.dryRun === true);
   }
@@ -2496,6 +2508,23 @@ var shareCommand = async (skillNameInput, options, context = {}) => {
   const notes = options.notesFile === void 0 ? void 0 : await readNotesFile(options.notesFile);
   const check = await checkSkillFolder(folder.folderPath, skillName, void 0, notes);
   if (options.check === true) {
+    try {
+      const taken = await withRegistrySession(async (token) => {
+        const manifest = await (context.client ?? new RegistryClient()).getManifest(token);
+        return manifest.skills.some((skill) => skill.name === skillName);
+      }, context.session);
+      if (taken) {
+        output(
+          context,
+          `The catalogue already has a skill called ${skillName}. If it is yours, sharing it now updates it. If it is not, rename your folder and its SKILL.md \`name:\` first, or the team's checks will turn it away.`
+        );
+      }
+    } catch {
+      output(
+        context,
+        "Could not reach the catalogue to see whether that name is free, so this only checked the folder."
+      );
+    }
     if (check.warnings.length === 0) {
       output(context, "Nothing looked risky.");
     } else {
@@ -2514,7 +2543,8 @@ var shareCommand = async (skillNameInput, options, context = {}) => {
   const client = context.client ?? new RegistryClient();
   try {
     await withRegistrySession(
-      (token) => client.uploadSubmission(skillName, packaged.sha256, packaged.bytes, token)
+      (token) => client.uploadSubmission(skillName, packaged.sha256, packaged.bytes, token),
+      context.session
     );
   } catch (error) {
     if (error instanceof CliError && error.code.startsWith("login_")) {
@@ -2525,7 +2555,10 @@ var shareCommand = async (skillNameInput, options, context = {}) => {
     }
     throw error;
   }
-  output(context, "Shared. The team was notified the moment it landed; after review it usually goes live the same day, announced in #yeka-skills.");
+  output(
+    context,
+    "Shared. The team was notified the moment it landed. It goes live on its own once the automatic checks pass, usually about ten minutes, announced in #yeka-skills. If a check fails you get a Slack message saying what to fix."
+  );
 };
 var loginCommand = async (context = {}) => {
   await deleteSession();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yeka-skills",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Install, update, and remove private Gemography agent skills",
   "type": "module",
   "license": "UNLICENSED",