v3.0.0

   🚨 Breaking Changes

• Ship native skilld and @skilld/harness  -  by @harlan-zw in #96 (03748)

   🚀 Features

• cli:
  • Add Agent-aware search output  -  by @harlan-zw in #106 (19166)
  • Report outdated and unmanaged Skills  -  by @harlan-zw in #116 (58a81)
  • Clearer remote errors and a live status line  -  by @harlan-zw in #117 (d7674)
  • Themed terminal output with shared UI primitives  -  by @harlan-zw in #120 (13020)
  • Scannable outdated report with command highlighting  -  by @harlan-zw in #121 (b6d1a)
  • Add skilld run for transient Skills  -  by @harlan-zw (79914)
  • Add skilld run for transient Skills  -  by @harlan-zw in #123 (f540c)
  • Add openclaw, hermes, kiro, kilo, droid, trae, zed targets  -  by @harlan-zw and Harlan GitHub Agent in #129 (fd550)
  • Run and add accept repository, curator, and collection refs  -  by @harlan-zw and Harlan GitHub Agent in #131 (b571f)
  • Link every remote Skill to its exact source  -  by @harlan-zw in #130 (73ef0)
  • Map v2 commands and v2 state to v3 guidance  -  by @harlan-zw in #138 (2d90b)

   🐞 Bug Fixes

• cli:
  • Stop pending Artifact resolutions after 60 seconds  -  by @harlan-zw in #103 (43d33)
  • Restore direct sources from lockfile  -  by @harlan-zw in #104 (96fb8)
  • Apply reviewed update snapshots  -  by @harlan-zw in #111 (919a1)
  • Document exact install inputs  -  by @harlan-zw in #105 (ac199)
  • Stop skilld run writing Skills to disk  -  by @harlan-zw (22aa9)
  • Strip control characters from run output and fail loudly on oversized local Skills  -  by @harlan-zw (fa454)
  • Harden transient Skill runs  -  by @harlan-zw (09284)
  • Quote control-character paths for POSIX sh  -  by @harlan-zw (7f80e)
  • Close transient run provenance gaps  -  by @harlan-zw (3d97f)
  • Enforce exact transient sources  -  by @harlan-zw (316a3)
  • Reject spoofed transient sources  -  by @harlan-zw (89530)
  • Make transient runs visible and safe  -  by @harlan-zw (0ef03)
  • Sanitize argument parse errors  -  by @harlan-zw (1277c)
  • Enforce provider commit identity  -  by @harlan-zw (641d6)
  • Sanitize outdated service messages  -  by @harlan-zw (78e59)
  • Parse locked remote sources  -  by @harlan-zw (6aa2b)
  • Show Artifact resolution progress  -  by @harlan-zw in #127 (d6a07)
  • Accept Artifact downloads from a service subdomain  -  by @harlan-zw in #134 (5fa95)
  • Name the GitHub rate limit on a direct run  -  by @harlan-zw in #135 (dc7a3)
• command:
  • Handle artifact HTTP errors  -  by @harlan-zw in #136 (719c5)
• harness:
  • Assert skills via prompt turn options after @ai-sdk/harness 1.0.100  -  in #132 (e6fa1)
• release:
  • Use available npm package names  -  by @harlan-zw in #101 (68932)
  • Allow unrelated working files  -  by @harlan-zw in #126 (2661f)
• sources:
  • Validate GitHub repository hosts  -  by @oritwoen in #94 (cea67)

   🏎 Performance

• cli: Run outdated candidate searches in parallel  -  by @harlan-zw in #119 (90743)

    View changes on GitHub