fix(create-objectstack): scope skill installs to the curated skills/ catalog#3101
Merged
Conversation
…catalog The scaffolder (and docs) ran `npx skills add objectstack-ai/framework --all`, and the skills CLI's --all implies --skill '*', which includes metadata.internal skills — so the repo-internal dogfood-verification skill (.claude/skills/) landed in every scaffolded project's .agents/skills/ (15.1 third-party eval, P2). - scaffolder + docs now install from the /skills subpath, which scopes skills-CLI discovery to the published catalog - mark .claude/skills/dogfood-verification metadata.internal: true so interactive repo-root discovery hides it too - template-consistency ratchets: every SKILL.md outside skills/ must be metadata.internal, curated entries must not be, no customer-facing surface may advertise a repo-root install - scaffold-e2e: install from this checkout's skills/ subpath and assert set-equality with the curated catalog; assert repo-root listing surfaces exactly the curated set Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 7 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
The skills CLI colors the count even when piped (Found \e[32m9\e[39m skills), so the repo-root listing greps in the new skills-boundary step never matched in CI. The subpath-install set-equality assertion had already passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 17, 2026
os-zhuang
added a commit
that referenced
this pull request
Jul 20, 2026
…-boundary ratchet (#3346) The skills-catalog-boundary guard flagged an auto-generated CHANGELOG entry (#3101's changeset prose) that quotes the removed `skills add objectstack-ai/framework --all` command in past tense while documenting its removal, turning Test Core red on main. Exclude **/CHANGELOG.md from the guard's grep surfaces — documenting a fix is not advertising the anti-pattern. Test-only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
akarma-synetal
pushed a commit
to akarma-synetal/framework
that referenced
this pull request
Jul 21, 2026
…DME framing Third-party review of the published skills bundle (installed via `npx skills add objectstack-ai/framework/skills --all` into a scaffolded app) found the references layer leaking monorepo-only surface: - build-skill-references.ts listed transitively-imported src files that are NOT in the published package (only src/**/*.zod.ts ships) — lazy-schema.ts / visibility.ts / public-auth-features.ts pointers 404 in a consumer's node_modules. The generator now traverses through non-shipping files but never lists them. - Add missing load-bearing schemas to the map: ai/knowledge-source + knowledge-document (the real RAG primitives), automation/ time-relative-trigger + data/validation (state-machine rules), ui/dataset, query date-macros. - Give objectstack-formula a references/_index.md like its 8 siblings (it previously pointed at monorepo-relative packages/ paths instead). - Mark the regen note maintainers-only and stop claiming the root barrel re-exports every symbol (it doesn't — e.g. DATE_MACRO_TOKENS lives on @objectstack/spec/data only). - skills/README.md: reposition the bundle as serving any ObjectStack app (not 'the monorepo'), document the install commands and the /skills catalog boundary (objectstack-ai#3101), and describe the real skill anatomy (rules/, contracts/, evals/). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Kj2MJEPXoUXC4LiC3XYJc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题(15.1 第三方评估 P2 #1)
create-objectstack生成的项目.agents/skills/里出现了仓库内部 skilldogfood-verification(frontmatter 自述 "NOT a customer-published skill")。根因
泄漏不在模板或 npm 发布产物,而在脚手架运行时:scaffolder(及文档)执行
npx skills add objectstack-ai/framework --all。skills CLI 的--all隐含--skill '*'(add.ts:1049-1052),而任何非空--skill会把includeInternal置真 —— 即--all连metadata.internal标记的 skill 也一并安装。仓库全量发现会走.claude/skills/,于是内部 skill 进入每个新项目。CI 的 scaffold-e2e 两处均--skip-skills,该路径从未被守。修复(双层)
/skills子路径:scaffolder 与全部文档改为npx skills add objectstack-ai/framework/skills --all,skills CLI 的发现范围被钉死在发布目录(对--all也有效;已实测远端 GitHub 源Found 9 skills)。metadata.internal: true:.claude/skills/dogfood-verification加标记,裸skills add objectstack-ai/framework(无--all)的交互发现也不再露出(实测--list只列 9 个)。防线
template-consistency.test.ts新增 4 个 ratchet:skills/外的 SKILL.md 必须标 internal;curated 条目不得标 internal;scaffolder 必须用子路径源;客户面(docs/skills/create-objectstack)禁止裸根路径安装命令。scaffold-e2e.yml新增步骤:从本 checkout 的skills/子路径真实安装进全新 scaffold,断言安装集合与 curated 目录集合相等;根路径--list断言恰好 curated 数量且无内部 skill。验证
pnpm --filter create-objectstack test10/10 通过;build 通过--list→ Found 9(internal 隐藏)npx skills add objectstack-ai/framework/skills --list→ Found 9check:doc-authoring/check:role-word通过🤖 Generated with Claude Code