feat(skills): add skills-update, drive install from SKILLS.txt

Makefile

@@ -83,7 +83,10 @@ ruler-rules-copy: ## Copy rules to .ruler directory.
 # External skills are declared in SKILLS.txt and locked in skills-lock.json.
 
 .PHONY: skills-install
-skills-install: ## Install external skills from skills-lock.json (skips already installed).
+skills-install: ## Install external skills declared in SKILLS.txt (skips already installed).
+	@if [ -f "$(SKILLS_GLOBAL_LOCK)" ]; then \
+		$(MAKE) skills-lock; \
+	fi
 	@lock="$(SKILLS_LOCK_FILE)"; \
 	skills_dir="$(SKILLS_EXTERNAL_SOURCE_DIR)"; \
 	force="$${DOTAGENTS_FORCE_SKILLS_INSTALL:-0}"; \
@@ -120,12 +123,20 @@ skills-install: ## Install external skills from skills-lock.json (skips already
 		fi; \
 	done; \
 	rm -f "$$tmp_missing"; \
+	if [ -f "$(SKILLS_GLOBAL_LOCK)" ]; then \
+		$(MAKE) skills-lock; \
+	fi; \
 	exit $$failed
 
 .PHONY: skills-refresh
 skills-refresh: ## Force a reinstall of all external skills from skills-lock.json.
 	@DOTAGENTS_FORCE_SKILLS_INSTALL=1 $(MAKE) skills-install
 
+.PHONY: skills-update
+skills-update: ## Update installed external skills to latest and refresh the lock.
+	@bun x skills update --global --yes </dev/null
+	@$(MAKE) skills-lock
+
 .PHONY: skills-lock
 skills-lock: ## Regenerate skills-lock.json from SKILLS.txt.
 	@global_lock="$(SKILLS_GLOBAL_LOCK)"; \

README.md

@@ -14,16 +14,20 @@ This runs the full pipeline: prepares `.ruler/`, generates agent instruction fil
 External skills are declared in `SKILLS.txt` (canonical: repo plus comma-separated selection, no selection installs all) and locked in `skills-lock.json`, both committed. Installs go through the [skills CLI](https://github.com/vercel-labs/skills); global scope is scripted here because the CLI's own lock restore is project-only (see [vercel-labs/skills#549](https://github.com/vercel-labs/skills/issues/549)).
 
 ```bash
-# Regenerate skills-lock.json from SKILLS.txt
-make skills-lock
-
-# Install everything in the lock that is missing (idempotent)
+# Install everything declared in SKILLS.txt that is missing (idempotent;
+# regenerates skills-lock.json automatically)
 make skills-install
 
+# Update installed skills to latest and refresh the lock
+make skills-update
+
+# Regenerate skills-lock.json from SKILLS.txt without installing
+make skills-lock
+
 # Force a reinstall of everything in the lock
 make skills-refresh
 ```
 
-To add skills: edit `SKILLS.txt`, run `make skills-lock && make skills-install && make skills-lock` (the second lock captures resolved metadata), and commit both files. To remove: delete from `SKILLS.txt`, run `bunx skills remove <name> --global --yes`, then `make skills-lock`.
+To add skills: edit `SKILLS.txt`, run `make skills-install`, and commit both files. To remove: delete from `SKILLS.txt`, run `bunx skills remove <name> --global --yes`, then `make skills-lock`.
 
 Installs track each source's default branch: the skills CLI does not record commit SHAs in its lock yet, so entries are not pinned to a commit.

rules/skills-management.md

@@ -23,8 +23,8 @@ bunx skills add owner/repo --global --list
 # Repos with <10 skills: install all (no selection)
 # Repos with 10+ skills: always specify selections
 
-# 3. Regenerate the lock, install, then re-lock to capture resolved metadata
-cd dotagents && make skills-lock && make skills-install && make skills-lock
+# 3. Install (regenerates skills-lock.json from SKILLS.txt automatically)
+cd dotagents && make skills-install
 
 # 4. Commit SKILLS.txt and skills-lock.json together
 ```
@@ -37,6 +37,15 @@ bunx skills remove <name> --global --yes
 cd dotagents && make skills-lock
 ```
 
+## Updating Installed Skills
+
+```bash
+cd dotagents && make skills-update
+```
+
+Runs `bun x skills update --global` and refreshes `skills-lock.json`; commit
+the resulting diff.
+
 ## Restoring (fresh machine or CI)
 
 ```bash