Every failure this fleet actually hit was silent. 243 dangling symlinks were
invisible to git because **/.claude/skills/ is in the global gitignore. A
checkout 20 skills behind still resolved, so nothing complained. A loose
secret-hygiene.md loaded in no harness and errored in none. Two machines had
the library missing entirely. Exit status is the signal that was absent.
bin/doctor reports, with a non-zero exit:
- dangling links, anywhere under the harness dirs
- links that RESOLVE but land outside the active checkout — the dangerous
case, because it works while serving stale content
- skill-count mismatch between a harness and the checkout
- stray entries where <name>/SKILL.md was expected
- leftover per-skill Claude symlinks (plugin skills do not override
same-named user skills, so leftovers mean everything loads twice)
- divergence between the plugin copy and the copy the other harnesses link to
Wired as a SessionStart hook with --quiet, so a healthy host prints nothing and
a drifting one says so at the top of the next session. That beats a timer:
no launchd/systemd wiring, and it reaches every host that installs the plugin.
27ms on koala, no network, no git fetch.
Two design points found by the tests, both worth keeping:
- The canonical checkout is whatever ~/.agents/skills resolves to, NOT the
copy doctor runs from. As a plugin hook $0 lives in the plugin cache, which
is legitimately a second copy; judging harness links against it flagged
every one of them as "outside".
- "cd X/.." resolves ".." lexically against the link path and lands back in
~/.agents. Resolve the link first, then take the parent.
tests/doctor_test.sh drives seven fixtures through $HOME and $DOCTOR_CHECKOUT,
so no test touches the real host. Each asserts both the non-zero exit and that
the report names the fault — an exit-code-only assertion would pass while the
message said nothing useful.
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
The plugin now carries the two hooks Mathias owns and the brain/gitea/infra
MCP server definitions, not just skills.
Why this matters more than tidiness: both hooks existed ONLY in koala's
~/.claude/, which is host-local and unsynced. flamingo and iguana have been
running with no secret-guard at all — that is the control which blocks the
decrypt-and-print shape behind the 2026-08-05 ntfy-token leak, the op-item-get
shape behind 2026-07-30, and the base64-bypass shape behind 2026-06-11. Its
absence on two of three machines is a security gap, not a config gap. Shipping
it in the plugin means installing the plugin installs the guard.
.mcp.json references tokens as ${BRAIN_MCP_TOKEN} / ${GITEA_MCP_TOKEN} only —
env indirection, never literal values, so the manifest is safe to commit.
tests/secret_guard_test.sh pins 14 cases. It asserts on
hookSpecificOutput.permissionDecision, NOT exit status: the guard always exits
0 by contract, so an exit-status assertion would pass vacuously while the guard
silently allowed everything. Each deny case names the incident that produced it.
gsd-* hooks are deliberately NOT migrated — GSD owns and updates those in place.
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
Skills move to skills/<name>/SKILL.md and the repo gains both manifests, so
it is now a marketplace hosting exactly one plugin whose root is the repo
root (source: "."). Claude Code installs it from git; no symlinks involved.
Why: install.sh wired the library into every consuming repo as an ABSOLUTE
symlink to $CHECKOUT_DIR. The checkout moved three times, most recently when
local-dev@1966d5a dropped the embedded .skills/ copy, and nothing migrated
the links — 243 dangling links across 12 repos, hidden from git by the
**/.claude/skills/ ignore rule. Worse, ~/dev spans two path roots
(/Users/mathias on the iCloud-shared Macs, /home/mathias on koala), so an
absolute link stored there is broken on one side by construction. Re-running
the installer cannot fix that; only removing the mechanism can.
install.sh keeps the harnesses with no plugin system and drops from 42 links
per harness to one directory link, via the convergent ~/.agents/skills
convention that Pi and OpenCode both read:
~/.agents/skills -> $CHECKOUT_DIR/skills
~/.config/crush/skills -> ~/.agents/skills
~/.config/opencode/skills -> ~/.agents/skills
wire_claude_repo is deleted outright rather than gated behind a flag — on a
mixed-root fleet it cannot be made correct. Antigravity and Vibe targets go
too; both unused. CHECKOUT_DIR keeps its host-local default deliberately:
pointing it into ~/dev would put a git working tree inside iCloud with two
concurrent writers.
Taskfile drops five near-identical wiring loops (they had already drifted)
and delegates to install.sh. `task check` gains frontmatter validation, a
stray-root-entry gate, and manifest/tag version parity — the loose
secret-hygiene.md sat unloadable for months because nothing checked layout.
Verified: claude plugin validate . passes clean; a probe skill loaded as
skills:zzprobe through --plugin-dir; task check green at 42 skills.
Refs: #23
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
Was a loose secret-hygiene.md at the root of ~/.claude/skills — not
dir/SKILL.md, so no harness ever loaded it. Promoted to a real skill so
it installs to Claude Code, Crush, Antigravity and Vibe alike.
Frontmatter description carries load-before triggers (kubectl exec/env,
whole-file SOPS decrypt, token rotation) so it fires ahead of the command
that would leak, not after.
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
set -euo pipefail + `... | grep -iE '^Bump-Type:' | head -1 | awk ...`
inside `bump=$(...)`: when the last commit has no Bump-Type footer (the
normal default-to-patch case), grep exits 1 on no-match. Under
pipefail, that propagates as the whole pipeline's exit status even
though head/awk both succeed -- set -e then kills the script before it
ever reaches the case statement. Broke on every push since 2026-06-22
once a footer-less commit landed after the last one that happened to
carry a Bump-Type line. Appended `|| true` to swallow the expected
no-match case.
Verified this session: `task install` (and its sub-targets) wipe/skip the
per-skill symlinks (0/40 across all harnesses), while install.sh wires 40/40
reliably. Point the wiring docs at install.sh until the Taskfile bug is fixed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The index still described local-dev's old wire-skills.sh / ~/dev/.skills
mechanism. This repo is now the canonical home; wiring is `task install`
(claude global+repo, crush, antigravity, vibe) or the curl|bash install.sh.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ports the Vibe wiring from local-dev's wire-skills.sh so this repo's installer
covers all four harnesses. Vibe uses a flat layout — ~/.vibe/skills/<name>.md
symlinked to the skill's SKILL.md file (not the directory, unlike Claude/Crush/
Antigravity). Added to both `task install` and install.sh, idempotent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Consolidating the divergence between this repo and local-dev's embedded
~/dev/.skills/ (the two had drifted; the 19 overlapping skills were byte-identical).
- Import the 17 skills that existed only in local-dev: discovery-framing,
stage-gate-review, web-shot, and the 14 superpowers-* skills. This repo is now
the superset / single source of truth.
- SKILLS_INDEX.md: add rows for the 17.
- install.sh + Taskfile.yml: git.d-ma.be host (was stale gitea.d-ma.be, which
broke the one-line curl|bash installer post-rename).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The two new skills shipped without the name/description frontmatter every
other skill carries, so harnesses surfaced them as a bare directory name
with no description to match against intent. Add frontmatter (body unchanged).
Bump-Type: patch
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The koala act_runner has labels [self-hosted, linux, amd64]. The
default ubuntu-latest label doesn't match, so the release workflow
silently produced zero runs on every push. Matches the convention
used by hyperguild + infra workflows.
Runner is offline at time of this commit — bring it up on koala via
the act_runner systemd unit before expecting tags to appear.
[skip-release]
Phase 2 of mathias/skills extraction. Adds two new per-tool wirers
alongside Claude Code:
- Crush — ~/.config/crush/skills/<name>/SKILL.md (charmbracelet/crush,
successor to opencode-ai/opencode which is archived)
- Antigravity — ~/.gemini/antigravity/skills/<name>/SKILL.md (Google
VS Code extension). Our SKILL.md frontmatter (name + description)
is already in the format Antigravity expects — no manifest
translation step needed.
Both wirers added to Taskfile.yml (install:crush + install:antigravity)
and install.sh (wire_crush + wire_antigravity). The aggregate `install`
target now calls all four targets (claude:global, claude:repo, crush,
antigravity). Idempotent symlinks, same shape as the Claude Code wirer.
Per-host env overrides documented in README: SKILLS_REF for tag pinning,
CRUSH_SKILLS_DIR + ANTIGRAVITY_SKILLS_DIR for non-default paths.
Skipped:
- opencode (opencode-ai/opencode): archived, succeeded by Crush; its
Custom Commands surface is user prompt templates, not system skills
- gitea-resident agents: consume via per-repo .claude/skills or brain
MCP, no special target needed
Bump-Type: minor
Phase 1 of mathias/skills extraction (infra#62 Track D — homelab
next-step plan addendum). Imports ~/dev/.skills/ verbatim (19 skill
dirs + SKILLS_INDEX.md) and adds the installation surface:
- Taskfile.yml — install / update / list / release / check targets
- install.sh — bootstrap installer for hosts without Task. Idempotent
symlink wirer; default checkout at ~/.local/share/skills/ on every
host; SKILLS_REF env var pins a tag (default: main).
- .gitea/workflows/release.yml — auto-tag every push to main by
Bump-Type footer (major/minor/patch, default patch). Skipped when
commit contains [skip-release].
- README — usage, versioning, contribution flow, secret-hygiene rule.
Phase 1 wires Claude Code only (~/.claude/skills/<name> global +
<repo>/.claude/skills/<name> per-repo). Phase 2 adds Crush, opencode,
antigravity, and gitea-resident agents (cobalt-dingo, agentsquad)
once their skill conventions are researched.
Public repo, markdown-only — no secrets, no client names. Verified
via pre-push grep before initial push.
[skip-release]
mathiasandClaude Opus 5