v16.17.0

What's Changed

New Features

• skills: carry hidden companion files and recover malformed skill frontmatter by @dyoshikawa in #2745
  • Hidden (dot-prefixed) companion files inside a skill directory — .env.example, .config/, and the like — are now discovered and carried through both import and generate. The Agent Skills specification allows a skill directory to contain any files beyond the required SKILL.md, but glob discovery previously left them invisible. .git (as a directory prefix and as a bare submodule/worktree pointer file) and .DS_Store are still never carried, and skipping a nested repository is warned about.
  • Malformed YAML frontmatter is retried once instead of being dropped. A value such as description: Use this skill when: the user asks about PDFs — the case the Agent Skills client-implementation guide names — is now quoted and re-parsed, so the skill imports rather than being silently skipped. The repair is deliberately narrow: one pass, top-level entries only, values already starting as another YAML construct left alone, and homepage: https://example.com untouched. If the repair does not help, the original parse error is what surfaces.
  • A skill with an empty description is now imported with a warning rather than dropped, matching what the generate side already did with the same violation.
  • Fixed a gray-matter cache-poisoning bug: a throwing parse left a poisoned cache entry that made the next identical parse silently return empty frontmatter.

CI

• Add a scheduled Dependabot auto-merge workflow driven by OpenCode by @dyoshikawa in #2702
  • Runs the babysit-dependabot-pr procedure daily against every open Dependabot pull request. Triggered by schedule plus a maintainer-gated workflow_dispatch, so the prompt stays fully static and no untrusted event data is interpolated into it.

Contributors

• @dyoshikawa

Full Changelog: v16.16.0...v16.17.0