v4.0.0

Changelog

• e4eacbb feat!: v4.0 simplification — remove memory, scheduler, leaderboard, hooks (#25)

v3.2.1

Changelog

• ed7f00b refactor: extract shared utilities, eliminate redundant I/O (#24)

v3.2.0

Changelog

• 42ee53e release: v3.2.0 — official skills, injection path fixes, CI E2E validation

v3.1.0

Changelog

• f457a46 release: v3.1.0 — unattended preflight, rules injection fix, e2e deflake

v3.0.0

skillpm v3.0.0

Major feature release — 5 new capabilities, comprehensive documentation, and hardened security.

New Features

• Skill Dependency Management — DAG-based topological sort with circular dependency detection. Declare deps in SKILL.md frontmatter (inline deps: [a, b] or block list format); transitive deps are resolved and installed automatically.
• skillpm create — Scaffold new skills from templates (default, prompt, script). Generates a ready-to-use SKILL.md with frontmatter.
• skillpm publish — Publish skills to ClawHub registries with CLAWHUB_TOKEN auth. Supports ancillary file bundling.
• Lifecycle Hooks — pre_install, post_install, pre_inject, post_inject, pre_remove, post_remove shell commands with configurable timeout. Commands inherit the full OS environment (PATH, HOME, etc.).
• Skill Bundles — Named groups of skills in project manifest. skillpm bundle create/list/install for batch operations.

Documentation

• Getting Started Guide — Installation, first skill, scopes, and agent tips
• Cookbook — 10 self-contained recipes for common workflows
• CI Policy — CI pass rate, nightly E2E, benchmark thresholds
• Rollback Guide — Recovery procedures for failed installs/syncs

Security & Correctness

• Upgraded Go from 1.24.13 to 1.26.1, fixing 4 stdlib vulnerabilities (GO-2026-4599 through GO-2026-4602)
• Hook commands now inherit os.Environ() — previously lost PATH/HOME
• expandDeps calls TopologicalSort() for circular dependency detection
• PublishSkill propagates file read errors instead of silently ignoring
• Slug properly escaped in publish API URL
• Defensive copies returned from Deps() and BundleList()

Full Changelog: v2.3.1...v3.0.0

v2.3.1

Changelog

• 417c767 Merge pull request #17 from eddieran/fix/hardening-tests-security

v2.3.0

Changelog

• a9c35f7 Merge pull request #16 from eddieran/feat/cli-agent-friendly

v2.2.1

What's New

Generic Git URL Install

• skillpm install <URL> now works with any git host — GitLab, Gitea, Bitbucket, self-hosted servers
• GitLab /-/tree/ and /-/blob/ URL patterns fully supported
• Nested group URLs (e.g., gitlab.com/org/sub/repo) handled correctly
• .git suffix auto-stripped

Auto-Detect Default Branch

• No longer hardcodes main — repos using master or other default branches work automatically
• Clone uses remote's default branch; fetch detects current branch from existing clone

Broader Skill Discovery

• Bare repo URLs automatically scan entire repository for skills
• URL auto-register scans both root and skills/ directories

Full Changelog: v2.2.0...v2.2.1

v2.2.0

What's New

Leaderboard Live Fetch

• skillpm leaderboard --live now attempts to fetch real-time trending data from ClawHub API
• Graceful fallback to seed data when API is unavailable
• New --api-base flag for custom API endpoints
• GitHub Action updated to weekly schedule with --live flag

Expanded Adapter Support

• Default adapters now include: antigravity, claude, codex, copilot, cursor, gemini, kiro, openclaw, opencode, trae, vscode

Test Coverage

• 13 new project-scope operation tests covering upgrade, inject, removeInjected, and sync workflows
• 8 new leaderboard live fetch tests with httptest mocks
• Total: 23 leaderboard tests, 16 project-scope tests

Full Changelog: v2.1.1...v2.2.0

v2.1.1

What's Changed

Refactoring & Fixes

• Shared fsutil package: consolidated 9 duplicate atomic write implementations into fsutil.AtomicWrite with consistent error handling
• Shared managed marker constants: unified <!-- skillpm:managed --> marker across bridge, rules, and doctor into shared constants
• Bridge WriteRankings wired: memory consolidate now writes skillpm-rankings.md to Claude Code auto memory
• N+1 LoadState fix: syncRulesForSkills loads state once instead of per-skill
• Gemini parser fix: dual-parse now uses mutual exclusion, preventing duplicate hits

Removed

• Dead LastScanPath() from store/paths.go
• Dead ObserveOnSync config field
• 9 private atomic write implementations replaced by shared utility

Tests

• Added 11 new tests for OpenCode and Gemini parsers (coverage 56.6% → 85.9%)

Full Changelog: v2.1.0...v2.1.1