fix(create-objectstack): scope skill installs to the curated skills/ catalog#3101
Merged
Conversation
…catalog The scaffolder (and docs) ran `npx skills add objectstack-ai/framework --all`, and the skills CLI's --all implies --skill '*', which includes metadata.internal skills — so the repo-internal dogfood-verification skill (.claude/skills/) landed in every scaffolded project's .agents/skills/ (15.1 third-party eval, P2). - scaffolder + docs now install from the /skills subpath, which scopes skills-CLI discovery to the published catalog - mark .claude/skills/dogfood-verification metadata.internal: true so interactive repo-root discovery hides it too - template-consistency ratchets: every SKILL.md outside skills/ must be metadata.internal, curated entries must not be, no customer-facing surface may advertise a repo-root install - scaffold-e2e: install from this checkout's skills/ subpath and assert set-equality with the curated catalog; assert repo-root listing surfaces exactly the curated set Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 7 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
The skills CLI colors the count even when piped (Found \e[32m9\e[39m skills), so the repo-root listing greps in the new skills-boundary step never matched in CI. The subpath-install set-equality assertion had already passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题(15.1 第三方评估 P2 #1)
create-objectstack生成的项目.agents/skills/里出现了仓库内部 skilldogfood-verification(frontmatter 自述 "NOT a customer-published skill")。根因
泄漏不在模板或 npm 发布产物,而在脚手架运行时:scaffolder(及文档)执行
npx skills add objectstack-ai/framework --all。skills CLI 的--all隐含--skill '*'(add.ts:1049-1052),而任何非空--skill会把includeInternal置真 —— 即--all连metadata.internal标记的 skill 也一并安装。仓库全量发现会走.claude/skills/,于是内部 skill 进入每个新项目。CI 的 scaffold-e2e 两处均--skip-skills,该路径从未被守。修复(双层)
/skills子路径:scaffolder 与全部文档改为npx skills add objectstack-ai/framework/skills --all,skills CLI 的发现范围被钉死在发布目录(对--all也有效;已实测远端 GitHub 源Found 9 skills)。metadata.internal: true:.claude/skills/dogfood-verification加标记,裸skills add objectstack-ai/framework(无--all)的交互发现也不再露出(实测--list只列 9 个)。防线
template-consistency.test.ts新增 4 个 ratchet:skills/外的 SKILL.md 必须标 internal;curated 条目不得标 internal;scaffolder 必须用子路径源;客户面(docs/skills/create-objectstack)禁止裸根路径安装命令。scaffold-e2e.yml新增步骤:从本 checkout 的skills/子路径真实安装进全新 scaffold,断言安装集合与 curated 目录集合相等;根路径--list断言恰好 curated 数量且无内部 skill。验证
pnpm --filter create-objectstack test10/10 通过;build 通过--list→ Found 9(internal 隐藏)npx skills add objectstack-ai/framework/skills --list→ Found 9check:doc-authoring/check:role-word通过🤖 Generated with Claude Code