feat(pnpm): recognize and bundle package Skills

[harlan-zw]

🔗 Linked issue

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

pnpm 12.11 links approved package Skills into Agent directories. Doctor now reports their package and version, refuses migration or removal, and excludes them from outdated replacement suggestions.

The npm package now includes the public skilld Skill and its references. Authoring guidance documents pnpm’s package layout and approval scope.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-10 06:14 UTC.

GitHub merged this pull request.

• Logged (50/100): The new pnpm safeguard does not recognize junction links on Windows, so doctor offers removal and outdated suggests replacing pnpm-owned Skills there. View code Optional follow-up: Treat Windows reparse points (junctions) as links when detecting pnpm ownership, and cover the case with a Windows test.
  • Ask an agent to verify and fix this finding
• Logged (40/100): pnpm links whose canonical target escapes node_modules (workspace-linked packages) are not protected by the new ownership check. View code Optional follow-up: Establish ownership from the link name, the 'skills' parent, and the package.json beside the target without requiring node_modules in the fully resolved path, for example by resolving the link once instead of through node_modules.
  • Ask an agent to verify and fix this finding
• Logged (15/100): Required pull request screenshot evidence is unavailable, so the documented visual behaviour cannot be confirmed. View code Optional follow-up: Re-attach the screenshot (fresh upload) so the shown pnpm Skill support output can be reviewed.
  • Ask an agent to verify and fix this finding

736c3611-35e6-49d7-b1cc-f4e4c8d1f856

Selected findings run after merge and open separate pull requests.

[harlan-zw]

Agent verification: pnpm 12.11.0 installed a scoped tarball fixture. Without approval, no Skill link appeared. With package approval, pnpm created the expected scoped link. The built skilld doctor reported pnpm ownership with the package name and version. Migration and removal regression tests preserve the link.

An npm pack dry run includes only skills/skilld/SKILL.md and its declared-skills reference.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-zw]

Agent finding assessment for head 6b6fa7c.

The Windows junction finding, Logged at 50/100, is a false positive. Both the minimum Rust 1.88 and the tested Rust 1.95 set is_symlink for name-surrogate reparse points. The junction tag is 0xA0000003, which contains the required 0x20000000 bit.

Sources: Rust 1.88 FileType, Rust 1.95 FileType, junction tag.

This source check does not replace a Windows runtime fixture. Workspace targets outside node_modules remain outside the implemented ownership condition. The public npm package fixture is verified.