Repository navigation
Add selective npm skill installer and distinguish code review workflows - #25
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR adds a selective npm installer for the 55 bundled skills, introduces curated installation profiles, preserves skill dependencies and provenance, and clarifies the difference between the two existing code review workflows.
The complete plugin remains available. Selective installation is an additional option for users who want a smaller skill set shared across Codex, OpenCode, and Pi.
Why this change
Installing all 55 skills is useful for the full plugin experience, but it is not always ideal:
code-reviewandcode-reviewerlooked duplicative because their names were too similar, despite serving different scopes.This PR addresses those problems without renaming existing skill IDs or breaking current integrations.
Selective npm installer
The package now exposes this executable through
package.json:{ "bin": { "opencode-power-pack": "bin/opencode-power-pack.mjs" } }It can be executed directly through npm:
The implementation is in:
It uses only Node.js built-in modules and does not add runtime dependencies.
CLI reference
Listing profiles and skills
The command prints all available profiles followed by every packaged skill and its description:
Installing the recommended profile
This installs a balanced development toolkit into:
The recommended profile includes:
Required companion skills are added automatically. For example, selecting
feature-devalso installs:Installing individual skills
One skill:
Multiple skills:
Profiles and individual skills can be combined:
Selections are deduplicated and sorted before installation.
Unknown skills or profiles fail with an explicit error:
Installing every skill
This copies the complete catalog into the shared user-level skill directory.
The full plugin installation remains the preferred option when users want the complete plugin and its host integrations. The npm installer is intended for selective standalone skill discovery.
Repository-local installation
The installer walks upward from the current working directory until it finds the nearest
.gitfile or directory.This means it works when executed from a nested directory:
For example:
cd my-project/packages/api npx opencode-power-pack install --profile review --projectThe result is installed at the Git root:
It is not incorrectly installed under:
Running
--projectoutside a Git repository returns:Previewing an installation
Example output:
A project-local preview:
Example output:
--dry-rundoes not create the destination or modify existing skills.Updating installed skills
Existing skill directories are skipped by default:
Example result:
To update them from the latest npm package:
Example result:
Curated profiles
Profiles are defined in:
The catalog currently provides:
recommendedreviewfeature-devfrontendsecurityhuggingfaceauthoringproject-memoryAGENTS.mdandCLAUDE.mdguidanceThe catalog uses an explicit schema version:
{ "schemaVersion": 1, "profiles": {}, "dependencies": {} }Automatic dependency expansion
The installer computes the transitive closure of selected skill dependencies.
For example:
{ "feature-dev": [ "code-architect", "code-explorer", "code-reviewer" ] }Installing only
feature-dev:automatically installs:
Other dependency relationships covered by the catalog include:
Project memory
agents-md-reviserequires the rule-resolution resources shipped byagents-md-improver:{ "agents-md-revise": [ "agents-md-improver" ] }SageMaker deployment
The SageMaker deployment planner coordinates five specialist workflows:
{ "hf-cloud-sagemaker-deployment-planner": [ "hf-cloud-aws-context-discovery", "hf-cloud-python-env-setup", "hf-cloud-sagemaker-iam-preflight", "hf-cloud-serving-image-selection", "hf-cloud-sagemaker-production-defaults" ] }Semgrep rule variants
{ "semgrep-rule-variant-creator": [ "semgrep-rule-creator" ] }This prevents selectively installed coordinator skills from being unusable because required companion workflows are missing.
Safe replacement and concurrency handling
Each installation is staged before the destination is changed:
A per-destination lock prevents two installer processes from replacing the same skill concurrently.
If another installation is already updating the skill, the command reports the exact lock path:
If promotion and rollback both fail, the error includes:
Successful installation is not incorrectly reported as failed merely because cleanup of a backup, staging directory, or lock encounters an error. Instead, installation succeeds with an actionable warning.
Provenance and licenses
A selectively copied skill must remain independently auditable after the npm cache is removed.
Every installed skill therefore includes:
This preserves:
This fixes the otherwise broken
see UPSTREAMS.jsonreferences in selectively copiedSKILL.mdfiles.Distinguishing the review workflows
The technical IDs remain unchanged to preserve compatibility:
Codex-facing metadata now gives them distinct names.
Comprehensive review
Use
$code-reviewfor:Focused review
Use
$code-reviewerfor:feature-devquality-review phase.The workflows remain complementary:
$code-review$code-review$code-review$code-reviewer$code-reviewerfeature-devquality phase$code-reviewerDocumentation changes
The README now includes:
Issues found and fixed during review
The implementation went through a complete review before this PR was prepared.
The review found and corrected:
agents-md-revise.After those corrections, the final review completed all seven review lenses with no unresolved or reportable findings.
Test coverage
New tests cover:
Verification results
Complete test suite
OpenCode smoke test
Node.js 20 compatibility
npm package validation
The test suite creates a real tarball, installs it into a clean temporary project, and executes:
The executable successfully loads its packaged
skillsets.jsonand skill catalog.npm publication dry-run
Diff validation
Final review
npm release readiness
The release metadata is prepared for the first public npm publication:
{ "version": "0.4.0", "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" }, "scripts": { "prepublishOnly": "npm test" } }This ensures that:
0.4.0version.npx opencode-power-pack.The authenticated npm account was verified through
npm whoami, and the package name currently returnsE404, so the first successful publication will claim it.Compatibility
$code-reviewreferences continue to work.$code-reviewerandfeature-devreferences continue to work.