yeka-skills 0.2.2 → 0.2.4

package/README.md

@@ -31,8 +31,10 @@ yeka-skills logout
 ## Share a local skill with the team
 
 `yeka-skills share <skill>` packages one of your local skill folders and sends it to the private
-submission inbox, where a review bot turns it into a team-repo pull request. Nothing is published
-by a share — a person reviews every submission first.
+submission inbox, where the submission bot turns it into a team-repo pull request. Nothing bypasses
+review — but the reviewers are machines: the repository checks and an AI safety review gate the
+merge, and they run from `main`, not from the pull request. The catalogue page was written from your
+skill's own source and confirmed by you during the share conversation.
 
 - The CLI looks for the folder in the same local roots the installer knows. If a skill exists in
   several of them, it picks the one it would install into first (the current Codex folder, then
@@ -46,7 +48,8 @@ by a share — a person reviews every submission first.
   the review bot can find it, read it, and strip it before the skill content is unpacked. Do not
   create a `_yeka` folder inside your skill yourself.
 - A successful share answers with one sentence: the team is notified the moment the upload
-  lands, and after review it usually goes live the same day, announced in #yeka-skills.
+  lands, and the skill goes live on its own once the automatic checks pass — usually about ten
+  minutes — announced in #yeka-skills. A failed check messages the author, not the operator.
 
 Use `--dry-run` with `add`, `update`, or `remove` to verify and report changes without mutating the
 managed installation. Removal is fully offline and uses local receipts. It refuses locally edited

package/dist/cli.js

@@ -2358,7 +2358,7 @@ var statusCommand = async (context = {}) => {
     return Promise.all(
       receipts.map((receipt) => inspectLocalStatus(receipt, remoteByName.get(receipt.skillName), home))
     );
-  });
+  }, context.session);
   for (const status of statuses) {
     output(
       context,
@@ -2366,17 +2366,21 @@ var statusCommand = async (context = {}) => {
     );
   }
 };
-var assertUpdatableStatuses = (skillName, statuses) => {
+var updateBlocker = (skillName, statuses) => {
   const modified = statuses.find((status) => status.kind === "modified");
   if (modified !== void 0) {
-    throw new CliError(
-      "local_changes",
-      `${skillName} has local changes for ${modified.receipt.runtime}. It was not changed.`
-    );
+    return {
+      code: "local_changes",
+      message: `${skillName} has local changes for ${modified.receipt.runtime}. It was not changed.`
+    };
   }
   if (statuses.some((status) => status.kind === "unavailable")) {
-    throw new CliError("skill_unavailable", `${skillName} is no longer available in the private registry.`);
+    return {
+      code: "skill_unavailable",
+      message: `${skillName} is no longer available in the private registry.`
+    };
   }
+  return void 0;
 };
 var updateCommand = async (skillNameInput, options, context = {}) => {
   const selectedName = skillNameInput === void 0 ? void 0 : validatedSkillName(skillNameInput);
@@ -2396,17 +2400,25 @@ var updateCommand = async (skillNameInput, options, context = {}) => {
     const remoteByName = new Map(manifest.skills.map((skill) => [skill.name, skill]));
     const selectedGroups = [...groups.entries()].filter(([name]) => selectedName === void 0 || name === selectedName);
     const prepared = [];
+    const skipped = [];
     for (const [name, receipts] of selectedGroups) {
       const remote = remoteByName.get(name);
       const statuses = await Promise.all(
         receipts.map((receipt) => inspectLocalStatus(receipt, remote, home))
       );
-      assertUpdatableStatuses(name, statuses);
-      if (remote === void 0) {
-        throw new CliError("skill_unavailable", `${name} is no longer available in the private registry.`);
+      const blocker = updateBlocker(name, statuses) ?? (remote === void 0 ? { code: "skill_unavailable", message: `${name} is no longer available in the private registry.` } : void 0);
+      if (blocker !== void 0) {
+        if (selectedName !== void 0) {
+          throw new CliError(blocker.code, blocker.message);
+        }
+        skipped.push(blocker.message);
+        continue;
       }
       prepared.push({ name, receipts, skill: remote, statuses });
     }
+    for (const message of skipped) {
+      output(context, message);
+    }
     const updated = [];
     for (const item of prepared) {
       if (item.statuses.every((status) => status.kind === "current")) {
@@ -2428,7 +2440,7 @@ var updateCommand = async (skillNameInput, options, context = {}) => {
       });
     }
     return updated;
-  });
+  }, context.session);
   for (const result of results) {
     printActions(context, result.name, result.actions, options.dryRun === true);
   }
@@ -2531,7 +2543,8 @@ var shareCommand = async (skillNameInput, options, context = {}) => {
   const client = context.client ?? new RegistryClient();
   try {
     await withRegistrySession(
-      (token) => client.uploadSubmission(skillName, packaged.sha256, packaged.bytes, token)
+      (token) => client.uploadSubmission(skillName, packaged.sha256, packaged.bytes, token),
+      context.session
     );
   } catch (error) {
     if (error instanceof CliError && error.code.startsWith("login_")) {
@@ -2542,7 +2555,10 @@ var shareCommand = async (skillNameInput, options, context = {}) => {
     }
     throw error;
   }
-  output(context, "Shared. The team was notified the moment it landed; after review it usually goes live the same day, announced in #yeka-skills.");
+  output(
+    context,
+    "Shared. Automatic checks read it first. It goes live on its own once they pass, usually about ten minutes, and only then is it announced to the team in #yeka-skills. If a check fails you get a Slack message saying what to fix, and your colleagues never see a skill that did not pass."
+  );
 };
 var loginCommand = async (context = {}) => {
   await deleteSession();
@@ -2554,9 +2570,57 @@ var logoutCommand = async (context = {}) => {
   output(context, removed ? "The Yeka Skills session was removed." : "There was no saved Yeka Skills session.");
 };
 
+// package.json
+var package_default = {
+  name: "yeka-skills",
+  version: "0.2.4",
+  description: "Install, update, and remove private Gemography agent skills",
+  type: "module",
+  license: "UNLICENSED",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/gemography/yeka-capsules.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://yekaskills.com",
+  engines: {
+    node: ">=22.15.0"
+  },
+  bin: {
+    "yeka-skills": "./dist/cli.js"
+  },
+  files: [
+    "dist",
+    "README.md"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsup src/cli.ts --format esm --platform node --target node22 --clean",
+    typecheck: "tsc --noEmit",
+    test: "vitest run",
+    "pack:check": "npm pack --dry-run"
+  },
+  dependencies: {
+    commander: "15.0.0",
+    tar: "7.5.22",
+    zod: "4.4.3"
+  },
+  devDependencies: {
+    "@types/node": "26.2.0",
+    "@yeka/contracts": "0.0.0",
+    "@yeka/integrity": "0.0.0",
+    tsup: "8.5.1",
+    typescript: "7.0.2",
+    vitest: "4.1.10"
+  }
+};
+
 // src/cli.ts
+var packageVersion = package_default.version;
 var program = new Command();
-program.name("yeka-skills").description("Install, update, and remove private Gemography agent skills").version("0.1.0").showHelpAfterError();
+program.name("yeka-skills").description("Install, update, and remove private Gemography agent skills").version(packageVersion).showHelpAfterError();
 program.command("add").description("Install one private skill").argument("<skill>", "exact skill name").option("--dry-run", "verify and show changes without installation").action(async (skill, options) => addCommand(skill, options));
 program.command("list").description("List managed local skills without network access").action(async () => listCommand());
 program.command("status").description("Check local skills and available updates").action(async () => statusCommand());
@@ -2566,7 +2630,7 @@ program.command("update").description("Update one managed skill or all managed s
 program.command("remove").description("Remove one managed skill without registry access").argument("[skill]", "exact skill name").option("--force", "preserve and remove a locally edited copy").option("--dry-run", "verify and show changes without removal").action(
   async (skill, options) => removeCommand(skill, options)
 );
-program.command("share").description("Share one local skill with the team for review").argument("<skill>", "exact skill name").option("--check", "look the skill over without sharing").option("--notes-file <path>", "text file with your interview answers, shared with the reviewers").action(
+program.command("share").description("Share one local skill with the team").argument("<skill>", "exact skill name").option("--check", "look the skill over without sharing").option("--notes-file <path>", "text file with your interview answers, kept with the submission").action(
   async (skill, options) => shareCommand(skill, options)
 );
 program.command("login").description("Start a new private registry session").action(async () => loginCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yeka-skills",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Install, update, and remove private Gemography agent skills",
   "type": "module",
   "license": "UNLICENSED",