Leogriel v1.0.0-beta.4

Fixed

• Ignore Leogriel-managed adapter targets during coexistence detection while continuing to report genuinely unmanaged skills.
• Honor init --with-skill --no-prompt in non-interactive and JSON workflows.
• Keep audit policy findings on domain exit code 1; exit code 2 remains reserved for invalid input and fatal failures.
• Report npm versions without mislabeling them as Git commit provenance in remote info output.
• Limit GitHub subpath extraction to the requested skill tree so unrelated repository symlinks do not break Windows installs.
• Treat native Windows Codex sandbox launch failures as incomplete behavioral runs instead of successful completions.
• Discover a complete standalone Codex installation on Windows so the elevated sandbox can locate both setup and command-runner helpers.
• Exclude directory-only scaffolding from max-changed-files while continuing to count created, removed, and modified files and symlinks.
• Update current Vercel skill examples to the repository's skills/web-design-guidelines path.
• Include the root architecture document in coordinated version preparation so release candidates cannot retain a stale version label.
• Keep idempotent release verification strict for runtime files while tolerating only cross-platform line endings in package documentation and generated completion scripts, plus non-runtime TypeScript incremental metadata.

Validation

• Completed the opt-in Windows Codex live smoke through an explicit ChatGPT authentication profile, exact model gpt-5.4, elevated native sandbox, denied network, and a sandboxed Node.js file proof.
• Exercised a real two-run paired test with the immutable public documentation-writer skill; Leogriel correctly returned inconclusive when one skill-side run timed out instead of claiming an unsupported improvement or regression.

Compare v1.0.0-beta.3...v1.0.0-beta.4

Leogriel v1.0.0-beta.3

Leogriel 1.0.0-beta.3

This prerelease consolidates the 1.0 candidate with stricter target diagnostics, complete structured import output, local opt-in runner validation, updated architecture and security documentation, and coordinated package hardening.

Full comparison: v1.0.0-beta.2...v1.0.0-beta.3

npm packages

All coordinated packages are published with the next dist-tag and verified against the attached tarballs:

• @leogriel/core@1.0.0-beta.3
• @leogriel/manifest@1.0.0-beta.3
• @leogriel/lockfile@1.0.0-beta.3
• @leogriel/link-manager@1.0.0-beta.3
• @leogriel/plugin-system@1.0.0-beta.3
• @leogriel/project-state@1.0.0-beta.3
• @leogriel/adapters@1.0.0-beta.3
• @leogriel/security@1.0.0-beta.3
• @leogriel/registry@1.0.0-beta.3
• @leogriel/import@1.0.0-beta.3
• @leogriel/testing@1.0.0-beta.3
• @leogriel/cli@1.0.0-beta.3

Install the prerelease CLI with npm install --global @leogriel/cli@next.

Added

• Added leogriel test <skill> --compare <git-ref> to run paired regressions between the skill at an immutable Git commit and the current working-tree candidate, recording both integrity hashes.
• Added an official composite GitHub Action with frozen restore, Job Summary, redacted JSON/Markdown/HTML reports, downloadable artifacts, Shields badge data, optional pull-request comments, and fail-after-report regression enforcement.
• Added an experimental Claude Code AgentRunner alongside Codex, with version/capability detection, isolated configuration, fail-closed native sandboxing, subprocess credential filtering, default-deny networking, explicit staged-skill injection, and an opt-in live smoke.
• Added bilingual public-contract and 1.0 migration candidates plus an evidence-based external validation matrix for local, redacted runner validation.

Changed

• Made live runner validation local and opt-in, removing the hosted credential workflow while retaining the composite Action as an optional consumer feature.
• Replaced the mixed current/historical design document with a concise Leogriel architecture and archived the original skillctl proposal under docs/history/.
• Removed the unused registries and experimental.plugins config type fields; legacy values are ignored without changing config schema version 1.
• Added repository security guidance, structured issue and pull-request templates, and automated documentation/version/meta-skill contract checks.
• Restricted every published package to an explicit public root export in preparation for stable API contracts.
• Extended plugin audit findings with categories, remediation, confidence, and evidence fields matching the first-party audit model.
• Updated tar to 7.5.20 and removed the deprecated external @types/tar package.

Fixed

• Made doctor report missing and managed-stale targets as warnings with exit code 1, expose state counts, and re-inspect targets after --fix.
• Added structured schema-1 JSON output to plain leogriel import, including deterministic dry-run and empty-project results.
• Completed help descriptions for backup and plugin lifecycle subcommands and rejected interactive import flags in JSON mode.
• Ignored the built-in Pi adapter target directory in the repository dogfood state.
• Aligned the README, package documentation, bilingual site, migration guide, validation matrix, roadmap, contributor guide, and first-party skill with the beta.3 candidate.
• Made non-interactive Codex runs set an explicit no-prompt approval policy and require the elevated native Windows sandbox, preserving fail-closed workspace writes and network denial.
• Made the release gate execute the root test command so release-script contract tests cannot be skipped.
• Updated the architecture document to reflect the completed Leogriel rebrand and current beta baseline.
• Removed active 0.5.0 fallbacks from HTTP and import runtime metadata; both now derive their version from the owning package and use unknown only when package metadata is unavailable.
• Included ANTHROPIC_API_KEY in centralized CLI output redaction and kept authentication variables out of runner installation steps.

Leogriel v1.0.0-beta.2

Leogriel beta

• Published the first reproducible Leogriel-branded prerelease across all twelve coordinated @leogriel/* packages with the npm next dist-tag.
• Carries forward the complete rebrand from skillctl: the leogriel command, @leogriel/* package scope, .leogriel/ state paths, repository and documentation URLs, first-party skill, and woven-thread visual identity.
• Preserves agent-skills.json, agent-skills.lock, lock schema 1.0, config schema 1, the canonical integrity algorithm, and read compatibility for documented legacy skillctl state.

Capabilities included

• Includes discovery and provider-aware search, immutable GitHub/npm/skills.sh resolution, info, deterministic outdated and atomic update planning.
• Includes reconciliable doctor/sync, explicit unmanaged-target replacement with verified backups, full backup lifecycle commands, plugin inspection and lifecycle management, offline audit with SARIF, and shell completions.
• Includes the shared strict SKILL.md parser, field-aware streaming secret redaction, opt-in versioned artifacts, and advanced audit categories with remediation and confidence.
• Includes experimental paired behavioral testing through @leogriel/testing, with an isolated Codex runner, deterministic assertions and verdicts, default-deny networking, API-key or explicit ChatGPT-profile authentication, and opt-in live smoke diagnostics.

Fixed

• Clean every package dist directory and remove TypeScript incremental build metadata before release builds, preventing stale Windows output from leaking into npm tarballs.
• Rebuild packages topologically from a clean state before npm pack, then install and smoke-test all twelve generated archives.
• Mark semantic prerelease versions as GitHub prereleases instead of stable releases.
• Keep release publication idempotent: verify existing npm SRI or canonical archive content, run registry smoke tests on Windows, macOS, and Linux, and create the tag and GitHub prerelease only after every gate succeeds.

Publishing and migration

• Uses npm Trusted Publishing for all twelve packages from .github/workflows/release.yml in the npm-production environment, without a long-lived NPM_TOKEN; npm generates provenance automatically.
• New installations use npm install -g @leogriel/cli@1.0.0-beta.2. Existing users should uninstall @skillctl/cli and install @leogriel/cli.
• The historical @skillctl/* packages remain separate and receive no new code. They can be deprecated with a migration notice after this prerelease passes registry verification.

Compare v0.7.3...v1.0.0-beta.2

v0.7.3

skillctl 0.7.3

skillctl 0.7 introduce discovery, manutenzione pianificata, riconciliazione sicura dei target, plugin sperimentali, audit SARIF e completamenti shell. Tutti gli 11 pacchetti @skillctl/* sono allineati alla versione 0.7.3.

Novità principali

Discovery e informazioni

• Nuovi comandi skillctl search [query] e skillctl info <name-or-specifier>.
• Catalogo skills.sh con validazione stretta, timeout, retry, cache locale di 15 minuti e fallback stale quando la rete non è disponibile.
• Nuovo specifier selettivo skills.sh/<owner>/<repo>/<skill>, risolto a commit SHA immutabile e riproducibile con install --frozen.
• Ricerca interattiva nei terminali TTY e output deterministico/JSON per CI e agenti.

Outdated e aggiornamenti

• Nuovo comando skillctl outdated [names...] con classificazione current, outdated, modified, legacy, unavailable e unsupported.
• skillctl update supporta --dry-run, --latest, --save, --yes, --no-sync e --json.
• Piani distinti per aggiornamenti patch, minor, major, commit e contenuto.
• Aggiornamenti multipli atomici: staging completo prima del commit e rollback coordinato di store, manifest e lock in caso di errore.

Doctor e sync sicuri

• Ispezione dei target con stati missing, current, managed-stale, unmanaged e failed.
• doctor --fix ripara soltanto target mancanti o riconosciuti come gestiti.
• sync --replace-unmanaged richiede selettori espliciti, conferma e scope non ambiguo.
• I contenuti unmanaged sostituiti vengono salvati sotto .skillctl/backups/sync/ con metadati e ripristino automatico in caso di fallimento.

Plugin system sperimentale

• Lifecycle completo: add, install, update, enable, disable, info, doctor, remove e list.
• Manifest e lock separati in ~/.skillctl/plugins.json e ~/.skillctl/plugins.lock.
• Supporto consigliato per plugin npm e supporto locale esplicito tramite --allow-local.
• Verifica SRI, API version e capabilities; protezioni contro path traversal, symlink in uscita ed entrypoint fuori package.
• Gli errori di caricamento sono isolati. I plugin eseguono codice Node.js con i permessi dell'utente e non sono presentati come sandboxed.

Audit, policy e SARIF

• Output SARIF 2.1.0 tramite skillctl audit --format sarif, anche su file con --output.
• Finding con location e fingerprint stabili, compatibili con il caricamento SARIF di GitHub.
• Policy security.trustedSourcesMode: off, warn oppure error.
• Nuovi controlli offline per provenance incompleta, risoluzioni legacy mutable, script sospetti, escape di file/symlink, dimensioni, plugin e drift dei target canonici.

Completion e UX

• Nuovi completamenti per Bash, Zsh e PowerShell tramite skillctl completion <shell>.
• Completamento dinamico di comandi, opzioni, adapter, skill installate e plugin.
• Rendering centralizzato con supporto NO_COLOR, fallback ASCII, spinner solo in TTY e assenza di ANSI in CI/JSON.
• Warning ed errori umani sono inviati coerentemente su stderr; l'envelope JSON resta allo schema 1.

Release e automazione

• GitHub Actions aggiornate ai runtime Node 24 correnti.
• Workflow predisposto per npm Trusted Publishing tramite OIDC, senza NPM_TOKEN.
• Pubblicazione degli 11 pacchetti verificabile e ripetibile, con controllo dell'integrità prima della creazione di tag e release.
• Release con tag annotato, note curate e tarball npm allegati.

Compatibilità e sicurezza

• Node.js 22.13 o successivo; pnpm 11.x per lo sviluppo del workspace.
• Lock schema 1.0 e configurazione version: 1 restano invariati.
• Manifest, lock e configurazioni 0.6.x continuano a essere leggibili.
• Nessuna telemetria e nessuna installazione automatica silenziosa.
• I target unmanaged non vengono mai sovrascritti implicitamente.
• Tutti i pacchetti sono stati verificati su Ubuntu, macOS 15 e Windows con Node 22.13 e Node 24.

Installazione

npm install --global @skillctl/cli@0.7.3
skillctl --version

Pacchetti pubblicati

@skillctl/core, @skillctl/manifest, @skillctl/lockfile, @skillctl/link-manager, @skillctl/plugin-system, @skillctl/project-state, @skillctl/adapters, @skillctl/security, @skillctl/registry, @skillctl/import e @skillctl/cli.

Confronto completo: v0.6.1...v0.7.3

skillctl v0.6.1

Highlights

skillctl 0.6.1 is a maintenance release focused on cross-platform integrity, reproducible project state, documentation accuracy, and a more reliable release pipeline.

• Directory integrity hashes are now portable between Windows, macOS, and Linux. Existing legacy Windows/POSIX hashes remain accepted during migration.
• The repository's first-party skillctl meta-skill now uses the project-local store and portable lock state introduced in 0.6.
• CI and release automation are aligned with Node 24 action runtimes, macOS 15, and deterministic workspace test execution.

Fixes and changes

• Realigned the bundled skillctl skill and its references with the 0.6 project-local store, plain import flow, explicit global operations, and Pi adapter.
• Migrated the repository dogfood manifest, lockfile, and vendored skill away from the legacy global canonical path, so doctor and audit work on a fresh clone.
• Made directory integrity calculation independent of native path separators and added compatibility for legacy hashes generated on either Windows or POSIX systems.
• Updated integrity verification in core operations, registry materialization, security auditing, and managed-copy checks.
• Added regression coverage for portable integrity hashes and legacy Windows hash compatibility.
• Serialized workspace tests to prevent intermittent Node test-runner IPC deserialization failures under CI load.
• Upgraded GitHub Actions to Node 24-compatible releases and pinned the macOS test matrix to macOS 15.
• Fixed the publish workflow initialization order so pnpm is available before Node configures its package-manager cache.

Documentation

• Corrected stale Italian and English examples that still produced local:imported entries or referenced removed import flags.
• Added migration guidance for pre-0.6 local locks and clarified which manifest, lock, and vendored store files should be committed.
• Updated the design baseline and documentation site to distinguish project stores from personal/global stores consistently.
• Updated the first-party skill guidance for the plain import workflow and Pi support.

Validation

• Full build, type-check, test, coverage, security audit, doctor, dogfood, and package-install preflight passed.
• CI passed on Ubuntu, macOS, and Windows with Node.js 22.13 and 24.
• All 11 @skillctl/* packages were verified at version 0.6.1 and are attached below as installable archives.

Upgrade

npm install --global @skillctl/cli@0.6.1
skillctl --version

For reproducible project installs after upgrading:

skillctl install --frozen
skillctl doctor

Full changelog: v0.6.0...v0.6.1

v0.6.0

Project-local skills, explicit global installs, and Pi support

skillctl now treats a project as the default home for its skills. Version 0.6.0 makes local skill sets reproducible and shareable with the repository, while keeping personal skills available through an explicit global mode.

Added

• Project-local skill store: skillctl init creates .skillctl/skills/. Local commands find the nearest parent project containing agent-skills.json, so they work from subdirectories too.
• Vendored local skills: skillctl add ./path/to/skill copies the skill into .skillctl/skills/<name> and records a portable file:./.skillctl/skills/<name> entry. Commit this directory to share private or unpublished skills with the team.
• Explicit global operations: use -g for personal skills outside a project:
  • skillctl add -g <source>
  • skillctl list -g
  • skillctl doctor -g
  • skillctl remove -g <name>
• Simplified import: skillctl import discovers skills in supported agent directories, copies them into the project store, deduplicates identical content, and stops safely on conflicting same-name skills. --dry-run, --select, --interactive, and --sources are supported.
• Pi adapter: supports .pi/skills for project skills and ~/.pi/agent/skills for global skills.

Changed

• Project-local storage is now the default; the global ~/.skillctl/skills store is reserved for explicit -g operations.
• Local operations outside an initialized project fail with a clear next step: initialize a project or install globally.
• Imported skills are reproducible project files instead of depending on an agent directory or another developer's home directory.
• README, changelog, and contributor guidance now document the local/global workflow.

Compatibility and safety

• Existing immutable GitHub, npm, and skills.sh resolution metadata and integrity checks remain in place.
• Legacy global lock paths remain readable.
• Frozen installs resolve project-local stores correctly.
• Sync and removal retain managed-target safety protections.

Verification

The release passed build, lint, tests, coverage, production audit, skill validation, packaging checks, and CI on Ubuntu, macOS, and Windows with Node.js 22.13 and 24.

Install

npm install --global @skillctl/cli@0.6.0
skillctl --version

v0.5.0

Full Changelog: v0.4.0...v0.5.0

v0.4.0 — meta-skill, Grok adapter, skill validate

Added

• First-party meta-skill — \skills/skillctl/\ (\SKILL.md\ +
  eferences/) teaches agents how to use skillctl; repo dogfoods via root \�gent-skills.json\ + \�gent-skills.lock.
• Grok adapter — sync to .grok/skills\ (project) and ~/.grok/skills\ (global).
• *\skillctl skill validate [path]* — lint a \SKILL.md\ directory (frontmatter, scripts, size); CI validates \skills/skillctl.
• *\skillctl init --with-skill* — bootstrap manifest and add meta-skill from GitHub (or \ile:./skills/skillctl\ when developing skillctl itself).

Changed

• Default \ rustedSources\ includes \github:xFurti/skillctl/*.

Install:
npm install -g @skillctl/cli

Docs: https://xfurti.github.io/skillctl/

v0.3.1

Portable manifest and lock paths (fixes #2). Local specifiers normalize to file:./ or local:imported/. Lock canonicalPath uses ~/.skillctl/skills/. Doctor warns on legacy absolute paths.

v0.1.0

feat: initial commit - skillctl v0.1 full monorepo (from design plan)