v0.12.0

Changelog

Features

• 7e14fd5: feat(release): publish an arch linux pacman repository (@richardcase)

Other

• ef3c088: Merge pull request #140 from richardcase/registry-refresh (@richardcase)
• f241e25: Merge pull request #143 from richardcase/richardcase/update-demo (@richardcase)
• 2c5198c: Merge pull request #147 from richardcase/arch (@richardcase)
• 72361d0: chore(registry): fill in TODO skill entries from registry-refresh (@richardcase)
• 212a279: chore(registry): refresh skills.json (@richardcase)

v0.11.0

Changelog

Features

• 5262f0b: feat!: rename project from skillsctl to satchel (@richardcase)

Other

• 56600e7: Merge pull request #135 from richardcase/richardcase/update-asciicinema (@richardcase)
• 6998adc: Merge pull request #136 from richardcase/richardcase/test-ensure-we-test-packaging-skills-with-refere (@richardcase)
• 033fe19: Merge pull request #137 from richardcase/richardcase/wiki-npx-skills-diff (@richardcase)
• 4bcc421: Merge pull request #142 from richardcase/richardcase/rename-project-from-skillsctl-to-satchel (@richardcase)
• b4d7e95: Update README.md (@richardcase)
• e36c3ca: docs(assets): show the agent-selection prompt in the install demo (@richardcase)

v0.10.0

Changelog

Features

• dc7aebc: feat(cli): prompt for agents on install, link and adopt (@richardcase)
• a393951: feat(target): add more agents to the built-in target table (@richardcase)

Fixes

• a659faf: fix(security): pull OCI installs by the verified digest (@richardcase)
• 53a1b4a: fix(security): reject skill names containing ".." as a substring (@richardcase)
• 2a3cfd1: fix(security): resolve archive symlinks against dest before extracting (@richardcase)
• 483ae9e: fix(security): validate skill name before Occupied's path join (@richardcase)
• 7d07a13: fix: make scaffold creation atomic and plan-driven (@richardcase)
• 153a3bf: fix: skip the state lock file when asserting doctor and lint change nothing (@richardcase)

Other

• 6fa820d: Merge pull request #109 from richardcase/richardcase/community-standards (@richardcase)
• 5b8f22c: Merge pull request #125 from richardcase/richardcase/security1 (@richardcase)
• ae5dc8c: Merge pull request #126 from richardcase/richardcase/fix-security-pull-oci-installs-by-the-verified-d (@richardcase)
• 9116e9f: Merge pull request #128 from richardcase/richardcase/new-make-scaffold-creation-atomic-transactional (@richardcase)
• f6bc69d: Merge pull request #129 from richardcase/richardcase/security2 (@richardcase)
• cfa7241: Merge pull request #131 from richardcase/fix/zipslip-codeql-alert (@richardcase)
• 845f6ac: Merge pull request #132 from richardcase/richardcase/acknowledgement (@richardcase)
• 96d6c7a: Merge pull request #134 from richardcase/richardcase/support-more-agents-in-the-built-in-target-table (@richardcase)
• 6592df7: Update SECURITY.md (@richardcase)

v0.9.0

Changelog

Features

• e6c4571: feat: show command help on usage errors (@richardcase)

Fixes

• 9fc8e17: fix: handle hardlinks and error on unrepresentable tar entries in untar (@richardcase)
• b398ed1: fix: reconcile receipts with the agent after a batch update fails part-way (@richardcase)
• 96ca19d: fix: time out and report who holds a contended state lock (@richardcase)

Other

• d5a2d18: Merge pull request #104 from richardcase/richardcase/search-example (@richardcase)
• eaa49c4: Merge pull request #105 from richardcase/richardcase/Show-help-on-error (@richardcase)
• c4a397e: Merge pull request #106 from richardcase/richardcase/untar-silently-drops-hardlinks-and-other-non-reg (@richardcase)
• 5eeebe0: Merge pull request #107 from richardcase/richardcase/the-state-lock-blocks-forever-with-no-message-an (@richardcase)
• 6179a17: Merge pull request #108 from richardcase/richardcase/plugin-a-batch-update-that-fails-part-way-leaves (@richardcase)

v0.8.0

Changelog

Features

• 25b29c6: feat(channel): add Rollback to the Channel interface (@richardcase)
• 9a1f9a1: feat(channel): implement rollback for the git channel (@richardcase)
• 1374b28: feat(channel): implement rollback for the oci channel (@richardcase)
• 34350cb: feat(channel): record the previous revision on a git relink (@richardcase)
• a285dfe: feat(channel): record the previous revision on an oci relink (@richardcase)
• 33cef82: feat(channel): warn on undeclared agents when installing a local skill (@richardcase)
• b352bd3: feat(channel): warn when a skill installs into an undeclared agent (@richardcase)
• 3d54652: feat(cli): add --force to rollback and enforce the dirty check (@richardcase)
• 2a711e8: feat(cli): add lint command to validate SKILL.md before publishing (@richardcase)
• 32b5fef: feat(cli): add skillsctl diff (@richardcase)
• 4eeec72: feat(cli): add skillsctl rollback (@richardcase)
• 4dfbbfe: feat(cli): add skillsctl search (@richardcase)
• dd2e0f6: feat(cli): filter bundle's output by tag (@richardcase)
• ae48977: feat(cli): filter list by tag, and show tags in its output (@richardcase)
• 18ebca9: feat(cli): scaffold skills with new and manage them interactively with browse (@richardcase)
• c5395a7: feat(cli): sync against a git-hosted profile repo, not just a local file (@richardcase)
• 875992c: feat(diff): add the diff package (@richardcase)
• 39c6afa: feat(discover): parse an agents frontmatter field (@richardcase)
• 18b42bc: feat(gitx): add Diff and DiffDirs (@richardcase)
• 8978462: feat(manifest): carry tags from skills.toml into installed receipts (@richardcase)
• d4a9547: feat(manifest): fetch skills.toml from a git-hosted profile repository (@richardcase)
• 9e4f4cc: feat(registry): add --fix to registry-check (@richardcase)
• 7140286: feat(registry): add the skill registry fetch-and-cache client (@richardcase)
• a7fcb18: feat(state): record a receipt's previous revision (@richardcase)
• f7bf3cf: feat(target): add a [registry] config table for skillsctl search (@richardcase)
• 9b3bb5d: feat: add the registry-check maintenance tool (@richardcase)

Fixes

• 80c8696: fix(cli): correct diff --against latest's help text (@richardcase)
• 70220d0: fix(cli): report a missing local manifest instead of guessing it's remote (@richardcase)
• 3d1a8f5: fix(diff): fetch the mirror before diffing against latest (@richardcase)
• 7d816c2: fix(diff): scope git and oci diffs to the receipt's subpath (@richardcase)
• fcc308c: fix(outdated): satisfy the widened gitx.Git interface in the test fake (@richardcase)
• d18ad33: fix: address final review findings for skillsctl search (@richardcase)
• 84605d3: fix: deduplicate new candidates on full owner/name, not truncated skill-name (@richardcase)
• eae7a78: fix: gofumpt-format cmd/registry-check/main_test.go (@richardcase)

Other

• c15e4c4: Merge pull request #100 from richardcase/richardcase/update-the-registry-file (@richardcase)
• 7773088: Merge pull request #102 from richardcase/registry-refresh (@richardcase)
• 1bbfa10: Merge pull request #84 from richardcase/richardcase/brainstorm-additional-features (@richardcase)
• ed87d0c: Merge pull request #86 from richardcase/richardcase/Update-asciicinema-demo (@richardcase)
• 21ab8bc: Merge pull request #89 from richardcase/richardcase/discovery-trust-search-quality-signals-skill-lin (@richardcase)
• 8100d0b: Merge pull request #90 from richardcase/richardcase/team-sharing-workflows-sync-against-a-remote-pro (@richardcase)
• b44c894: Merge pull request #91 from richardcase/richardcase/lifecycle-safety-diff-rollback-agent-compatibili (@richardcase)
• fa249e3: Merge pull request #96 from richardcase/richardcase/search-find-skills-without-already-knowing-owner (@richardcase)
• 243edfc: Merge pull request #98 from richardcase/dependabot/go_modules/go-dependencies-ef5cf1a099 (@richardcase)
• 6f2e128: chore(deps): bump github.com/google/go-containerregistry (@dependabot[bot])
• 24a0439: chore(registry): fill in descriptions and fix source paths (@richardcase)
• b7c7fa1: chore(registry): refresh skills.json (@richardcase)
• d50867e: chore(state): gofmt the receipt fields and note which previous field is load-bearing (@richardcase)
• 3969aac: ci(registry): open a PR from registry-refresh instead of an issue (@richardcase)
• 16aa109: test(cli): make TestListFilterByTag actually verify row presence/absence (@richardcase)

v0.7.0

Changelog

Features

• 19d1f5e: feat(discover): resolve marketplace.json plugins[] provenance for skills (@richardcase)
• 3d0fd1c: feat(install): group and label listings by marketplace plugin (@richardcase)
• 796550f: feat(install): group the picker by category for multi-folder repos (@richardcase)
• fa89e55: feat(install): thread marketplace plugin provenance into Candidate (@richardcase)

Fixes

• 29b32b4: fix(install): strip a shared wrapper folder before grouping by category (@richardcase)
• 6217b93: fix: skip already-installed skills in the install picker (@richardcase)

Other

• 2986744: Merge pull request #75 from richardcase/richardcase/signing-updates (@richardcase)
• 37ae6da: Merge pull request #78 from richardcase/richardcase/install-should-not-show-already-installed-skills (@richardcase)
• c004371: Merge pull request #79 from richardcase/richardcase/listing-skills-should-show-categories (@richardcase)
• eef72a2: Merge pull request #80 from richardcase/richardcase/not-showing-tree (@richardcase)
• a56e81a: Merge pull request #81 from richardcase/richardcase/dependabot-config (@richardcase)
• 42bdd3d: Merge pull request #82 from richardcase/dependabot/github_actions/github-actions-9f033b59c4 (@richardcase)
• 38ab66e: Merge pull request #83 from richardcase/richardcase/install-discover-skills-in-a-plugin-marketplace (@richardcase)
• fe543d5: chore(deps): bump jdx/mise-action in the github-actions group (@dependabot[bot])

v0.6.0

Changelog

Features

• 5ee7b72: feat(channel): verify OCI image signatures, warn when unverified (@richardcase)
• 2a32cb6: feat(channel): verify keyless signatures on oci:// installs (@richardcase)
• e9ca86b: feat(channel): widen Prepare to return warnings alongside candidates (@richardcase)
• 9ee74ec: feat(cli): add a newCosign seam and test harness fake (@richardcase)
• d847cf3: feat(cosignx): add keyless sign and verify (@richardcase)
• f1fe79d: feat(cosignx): wrap the cosign binary for sign/verify/signed checks (@richardcase)
• e292340: feat(doctor): warn when cosign is missing from PATH (@richardcase)
• 744c20f: feat(install): verify OCI signatures with --verify-key (@richardcase)
• b315a48: feat(install): verify keyless signatures with --verify-identity/--verify-issuer (@richardcase)
• a157dbd: feat(package): sign the pushed image when --sign-key is given (@richardcase)
• 73d4566: feat(package): support keyless signing with --sign-keyless (@richardcase)

Fixes

• 7b36b9a: fix(channel): mention keyless verify flags in the unverified-signature warning (@richardcase)
• b5a5c4e: fix: gofmt recordingCosign field alignment (@richardcase)

Other

• e86c77b: Merge pull request #67 from richardcase/richardcase/sign-oci-image (@richardcase)
• 93cbdac: Merge pull request #68 from richardcase/richardcase-patch-1 (@richardcase)
• 8903cd2: Merge pull request #69 from richardcase/richardcase/licence-change (@richardcase)
• 853a728: Merge pull request #70 from richardcase/richardcase/sigstore-keyless-fulcio-rekor-signing-as-an-alte (@richardcase)
• 1e888e8: Merge pull request #72 from richardcase/richardcase/split-cli-reference-into-own-doc (@richardcase)
• 785de86: Merge pull request #73 from richardcase/docs/signing-verification-guide (@richardcase)
• 426be82: Merge pull request #74 from richardcase/richardcase/cosign-doctor (@richardcase)
• 1aac621: Update README.md (@richardcase)
• b44649e: test(channel,cli): assert keyless verify identity/issuer reach cosign (@richardcase)

v0.5.0

Changelog

Features

• 2370080: feat(channel): add the OCI channel (@richardcase)
• 5839499: feat(cli): add the package command and wire up the OCI channel (@richardcase)
• 44b6bcf: feat(list): add --include-channel/--exclude-channel filters (@richardcase)
• 66c396c: feat(ocix): add an OCI registry seam for packaging and install (@richardcase)
• 94a5b5c: feat(outdated): detect a moved OCI tag (@richardcase)
• 87eccb4: feat(pack): add a gitignore-aware tar builder for OCI packaging (@richardcase)
• 0f1e3d5: feat(source): recognise oci:// references (@richardcase)
• 42aeae5: feat(store): add EnsureOCI to extract an OCI-pulled revision (@richardcase)

Fixes

• 842bac0: fix(adopt): recover git provenance for npx-skills installs (@richardcase)
• c4fbcbd: fix(channel): store the oci:// form in an OCI receipt's Source (@richardcase)
• 53d7c4a: fix(store): recognise OCI digest-named revisions in gc (@richardcase)
• 6204fe6: fix: sort skill list alphabetically in install picker (@richardcase)

Other

• 2b4685f: Merge pull request #54 from richardcase/richardcase/option-to-filter-by-channel-when-doing-list (@richardcase)
• d6a0499: Merge pull request #55 from richardcase/richardcase/list-of-skills-isnt-sorted-when-using-install (@richardcase)
• 3243714: Merge pull request #56 from richardcase/richardcase/adopt-marks-as-local-channel-instead-of-git (@richardcase)
• 0959ed3: Merge pull request #59 from richardcase/richardcase/package-and-install-skills-from-oci (@richardcase)
• cdfe08a: Merge pull request #60 from richardcase/richardcase/add-asciicinema-demo-to-readme (@richardcase)
• 438482e: Merge pull request #61 from richardcase/richardcase/add-gitlab-example (@richardcase)
• 9df4028: refactor(gitx): export Untar for reuse by the OCI channel (@richardcase)

v0.4.0

Changelog

Features

• e84210b: feat(install): fan a plugin's skills out to every agent it named (@richardcase)
• a1923e9: feat(install): let a multi-skill repository be picked from (@richardcase)
• 8e24d79: feat(link): link a plugin's skills into another agent (@richardcase)
• 753c525: feat(manifest): diff a manifest against the installed skills (@richardcase)
• 0104983: feat(manifest): project receipts into a manifest (@richardcase)
• 343a5bc: feat(manifest): the skills.toml format (@richardcase)
• 1e9eb46: feat(outdated): report a plugin whose install path has moved (@richardcase)
• a2caa56: feat(plan): add Note, a plan line that changes nothing (@richardcase)
• b3b67bc: feat(plugin): link a plugin's skills into agents that cannot install it (@richardcase)
• 0a43b83: feat(plugin): plan the fan-out inline for a plugin claude already has (@richardcase)
• c384ac2: feat(plugin): reconcile a plugin's skills against an agent's links (@richardcase)
• ce8cc8a: feat(plugin): remove a plugin from one linked agent without uninstalling it (@richardcase)
• d30bb42: feat(prompt): add a terminal list picker (@richardcase)
• 3ee9c9c: feat(target): add WithoutPlugins, the agents a plugin fans out to (@richardcase)
• 6153641: feat(update): re-point a plugin's links at the version claude installed (@richardcase)
• f6e3643: feat: bundle the installed skills as skills.toml (@richardcase)
• 568c700: feat: sync the skills a manifest names (@richardcase)

Fixes

• e29ef87: fix(adopt): find a receipt by link path before by name (@richardcase)
• 0c9946d: fix(cli): let bundle emit a manifest with no agent directories present (@richardcase)
• d4f9bff: fix(install): match --dry-run's exit code to the real run for a plugin's skips (@richardcase)
• 764dbe2: fix(link): print only the agents the plan actually touched (@richardcase)
• 23e237e: fix(link): repair a partially fanned-out agent instead of declaring it already linked (@richardcase)
• 683a1b5: fix(link): tighten plugin link test and match dry-run's exit code to the real run (@richardcase)
• 40fcb5a: fix(manifest): carry a plugin's fan-out in the manifest (@richardcase)
• 46e446e: fix(sync): follow Link and Install into reconciliation (@richardcase)
• 6b18bbf: fix(sync): report only the agents an install actually reached (@richardcase)
• 4cb00e9: fix(sync): report the settled version and match the exit-code contract (@richardcase)
• 30f3d7e: fix(sync): share the plan's registry with settleSynced (@richardcase)
• 39c5ffc: fix(update): note the links a plugin update will reconcile, and why the record moved (@richardcase)
• 29ac6b0: fix: add trailing newline to bundle warning message (@richardcase)
• ca838d0: fix: correct plugin messages, comments and docs (@richardcase)
• 77ac585: fix: keep the rebase onto doctor and info coherent (@richardcase)

Other

• bf3ab63: Merge pull request #46 from richardcase/richardcase/fan-a-plugins-skills-out-to-non-claude-agents (@richardcase)
• ac6173e: Merge pull request #47 from richardcase/richardcase/bundle-and-sync-skills.toml-as-a-portable-manife (@richardcase)
• e8f793f: Merge pull request #49 from richardcase/richardcase/allow-selecting-which-skills-to-install (@richardcase)
• 65efd4f: docs(adopt): correct a stale keyed-by-target comment in adopt_test.go (@richardcase)
• 3ea1332: docs(channel): fix grammar in link test comment (@richardcase)
• 24202f0: docs(channel): fix stale keyed-by-target comment on link test (@richardcase)
• 0175b64: docs(channel): say what Ownership answers now that a plugin has links (@richardcase)
• 7be3481: docs(manifest): drop a false comparison to adopt.Report (@richardcase)
• e77f9af: docs(readme): note the hand-written-subpath trap in skills.toml (@richardcase)
• 54c047f: refactor(channel): widen Link to reconciliation and carry skip reasons (@richardcase)
• b190d87: refactor(target): extract the agent-resolution rule sync and install share (@richardcase)
• 2bf4155: test(manifest): add path-safety test for subpath field (@richardcase)
• 5e14a52: test(manifest): cover every branch of differs (@richardcase)
• 4faad43: test(manifest): cover source.Parse's error-wrapping branch in validate (@richardcase)
• e370c34: test(manifest): register a real Plugin channel in the bundle test registry (@richardcase)
• ced0a1d: test(plugin): cover fan's path-escape rejection, EINVAL skip, and idempotency (@richardcase)
• 3a490aa: test(plugin): really fan superpowers out to a second agent (@richardcase)
• 04e7c9a: test(sync): pin the all-or-nothing apply when a link path is occupied (@richardcase)

v0.3.0

Changelog

Features

• 509cc26: feat(adopt): record a hand-made link into a second agent (@richardcase)
• f754446: feat: adopt hand-installed skills from an agent's skills directory (@richardcase)
• 5163c2a: feat: describe a git working copy through gitx (@richardcase)
• 270b233: feat: link an installed skill into another agent (@richardcase)
• 32d0f81: feat: pin and unpin an already-installed skill (@richardcase)
• 3e026a2: feat: report inconsistencies between receipts and disk with doctor (@richardcase)
• 5ce46b0: feat: show a receipt in full with info (@richardcase)

Fixes

• 3483967: fix(cli): name the right exit code in outdated's help text (@richardcase)
• 346cb16: fix(doctor): name repairs that actually repair (@richardcase)

Other

• a8a0435: Merge pull request #41 from richardcase/richardcase/adopt-take-over-hand-installed-skills-already-in (@richardcase)
• 642fd5e: Merge pull request #42 from richardcase/richardcase/pin-and-unpin-an-already-installed-skill (@richardcase)
• 16e470b: Merge pull request #43 from richardcase/richardcase/link-name-a-agent-link-an-installed-skill-into-a (@richardcase)
• 60d16ea: Merge pull request #44 from richardcase/richardcase/doctor-report-dangling-links-missing-links-orpha (@richardcase)
• 8ffbe3b: Merge pull request #45 from richardcase/richardcase/info-name-show-a-receipt-in-full (@richardcase)