Skip to content

fix(skills): use current SDK from upstream dotfiles - #186

Merged
shunkakinoki merged 2 commits into
mainfrom
codex/use-latest-skills-sdk
Aug 6, 2026
Merged

fix(skills): use current SDK from upstream dotfiles#186
shunkakinoki merged 2 commits into
mainfrom
codex/use-latest-skills-sdk

Conversation

@shunkakinoki

@shunkakinoki shunkakinoki commented Aug 6, 2026

Copy link
Copy Markdown
Owner

What changed

  • Use the current stable skills SDK (^1.5.22, resolved in bun.lock) instead of the stale CLI workaround.
  • Invoke the project-local Vercel Skills CLI so a conflicting global skills executable cannot be selected.
  • Resolve the SDK and Bun install from the dotagents Makefile directory, so make skills-install works from both ~/dotfiles and ~/dotfiles/dotagents.

Verification

  • ./node_modules/.bin/skills --version -> 1.5.22
  • bun install --frozen-lockfile --minimum-release-age 0 --no-progress
  • make skills-install from ~/dotfiles
  • make -C dotagents skills-install from ~/dotfiles
  • make dotagents-sync from ~/dotfiles

Summary by cubic

Switch to the project-local skills SDK (^1.5.22, resolved in bun.lock) and CLI to avoid global conflicts and make installs/updates consistent from both ~/dotfiles and dotagents/.

  • Bug Fixes

    • Makefile runs bun install from the project directory and uses node_modules/.bin/skills instead of a global binary.
    • skills-install and skills-update now work the same from upstream ~/dotfiles and nested dotagents/.
  • Dependencies

    • Bump skills from ^1.5.20 to ^1.5.22.
    • Update bun.lock with new transitive packages (e.g., tar).

Written for commit fa405a0. Summary will update on new commits.

Review in cubic

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@shunkakinoki, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 28d279dd-842e-4c42-9eb9-b4c2cb5eb1c0

📥 Commits

Reviewing files that changed from the base of the PR and between dd3a9cd and fa405a0.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • Makefile
  • UPGRADE_LOG.md
  • package.json

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Makefile">

<violation number="1" location="Makefile:92">
P2: `skills-install` now runs `bun install --frozen-lockfile` unconditionally on every invocation, before the all-installed idempotency check that used to let the recipe exit 0 without touching bun. This makes `make sync` and offline/idempotent re-syncs depend on a live bun registry and rewrites node_modules every run; when the registry is unreachable the whole sync now hard-fails even though all skills are already present. Gate the install on the CLI already existing so the no-op path stays bun-free: `[ ! -x "$(SKILLS_CLI)" ] && ! (cd "$(SKILLS_PROJECT_DIR)" && bun install ... )` else error.</violation>

<violation number="2" location="Makefile:140">
P3: The `bun install --frozen-lockfile --minimum-release-age 0 --no-progress` command is duplicated verbatim in both `skills-install` and `skills-update`. A shared `SKILLS_*` variable (alongside the other SKILLS_ vars) would keep them in sync and make future flag changes a one-line edit.</violation>
</file>

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread Makefile
Comment on lines +92 to +95
if ! (cd "$(SKILLS_PROJECT_DIR)" && bun install --frozen-lockfile --minimum-release-age 0 --no-progress >/dev/null); then \
echo "Error: failed to install the skills SDK from bun.lock"; \
exit 1; \
fi; \

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: skills-install now runs bun install --frozen-lockfile unconditionally on every invocation, before the all-installed idempotency check that used to let the recipe exit 0 without touching bun. This makes make sync and offline/idempotent re-syncs depend on a live bun registry and rewrites node_modules every run; when the registry is unreachable the whole sync now hard-fails even though all skills are already present. Gate the install on the CLI already existing so the no-op path stays bun-free: [ ! -x "$(SKILLS_CLI)" ] && ! (cd "$(SKILLS_PROJECT_DIR)" && bun install ... ) else error.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Makefile, line 92:

<comment>`skills-install` now runs `bun install --frozen-lockfile` unconditionally on every invocation, before the all-installed idempotency check that used to let the recipe exit 0 without touching bun. This makes `make sync` and offline/idempotent re-syncs depend on a live bun registry and rewrites node_modules every run; when the registry is unreachable the whole sync now hard-fails even though all skills are already present. Gate the install on the CLI already existing so the no-op path stays bun-free: `[ ! -x "$(SKILLS_CLI)" ] && ! (cd "$(SKILLS_PROJECT_DIR)" && bun install ... )` else error.</comment>

<file context>
@@ -87,6 +89,10 @@ skills-install: ## Install external skills from skills-lock.json (skips already
 	@lock="$(SKILLS_LOCK_FILE)"; \
 	skills_dir="$(SKILLS_EXTERNAL_SOURCE_DIR)"; \
 	force="$${DOTAGENTS_FORCE_SKILLS_INSTALL:-0}"; \
+	if ! (cd "$(SKILLS_PROJECT_DIR)" && bun install --frozen-lockfile --minimum-release-age 0 --no-progress >/dev/null); then \
+		echo "Error: failed to install the skills SDK from bun.lock"; \
+		exit 1; \
</file context>
Suggested change
if ! (cd "$(SKILLS_PROJECT_DIR)" && bun install --frozen-lockfile --minimum-release-age 0 --no-progress >/dev/null); then \
echo "Error: failed to install the skills SDK from bun.lock"; \
exit 1; \
fi; \
if [ ! -x "$(SKILLS_CLI)" ]; then \
if ! (cd "$(SKILLS_PROJECT_DIR)" && bun install --frozen-lockfile --minimum-release-age 0 --no-progress >/dev/null); then \
echo "Error: failed to install the skills SDK from bun.lock"; \
exit 1; \
fi; \
fi; \

Comment thread Makefile
.PHONY: skills-update
skills-update: ## Update installed external skills to latest and refresh the lock.
@bun x skills update --global --yes </dev/null
@cd "$(SKILLS_PROJECT_DIR)" && bun install --frozen-lockfile --minimum-release-age 0 --no-progress >/dev/null

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The bun install --frozen-lockfile --minimum-release-age 0 --no-progress command is duplicated verbatim in both skills-install and skills-update. A shared SKILLS_* variable (alongside the other SKILLS_ vars) would keep them in sync and make future flag changes a one-line edit.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Makefile, line 140:

<comment>The `bun install --frozen-lockfile --minimum-release-age 0 --no-progress` command is duplicated verbatim in both `skills-install` and `skills-update`. A shared `SKILLS_*` variable (alongside the other SKILLS_ vars) would keep them in sync and make future flag changes a one-line edit.</comment>

<file context>
@@ -131,15 +137,16 @@ skills-refresh: ## Force a reinstall of all external skills from skills-lock.jso
 .PHONY: skills-update
 skills-update: ## Update installed external skills to latest and refresh the lock.
-	@bun x skills update --global --yes </dev/null
+	@cd "$(SKILLS_PROJECT_DIR)" && bun install --frozen-lockfile --minimum-release-age 0 --no-progress >/dev/null
+	@$(SKILLS_CLI) update --global --yes </dev/null
 	@$(MAKE) skills-lock
</file context>

@shunkakinoki
shunkakinoki merged commit d5087fa into main Aug 6, 2026
4 checks passed
@shunkakinoki
shunkakinoki deleted the codex/use-latest-skills-sdk branch August 6, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant