Skip to content

feat(skill): install skills from the catalog; the skills repository pulls the brevo-cli skill - #150

Merged
piyushsarin-sib merged 13 commits into
mainfrom
feat/skill-install-pull-sync
Oct 23, 2026
Merged

piyushsarin-sib merged 13 commits into
mainfrom
feat/skill-install-pull-sync

Conversation

@piyushsarin-sib

@piyushsarin-sib piyushsarin-sib commented Oct 22, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Adds brevo skill install | update | uninstall | list | check, which installs Brevo agent skills from the brevo-skills catalog, and stops this repo from pushing the brevo-cli skill to the skills repository (that repository now pulls it).

What it adds

  • brevo skill command group. Installs skills from the catalog with a hash check of every file, --pin, --dry-run, markers and a lock file, optional MCP registration (--mcp) and a min_cli_version gate.
  • More agents. The brevo-cli skill installs for Codex and Gemini CLI too, not only Claude Code.
  • Update notice. After a command, one line says a skill is outdated instead of reinstalling silently. BREVO_SKILL_AUTOREFRESH=1 reinstalls instead.
  • Offline fallback. brevo skill install brevo-cli installs the copy bundled with the CLI when the catalog is unreachable.
  • Homebrew bump. Moved out of release.yaml into its own bump-homebrew.yml workflow.

Pull instead of push

The repository that writes and publishes the Brevo skills now pulls agent-context/SKILL.md from this repo's latest release, weekly or by hand. So this repo no longer pushes anything:

  • Removes .github/actions/sync-brevo-skills, .github/workflows/sync-brevo-skills.yml and the "Trigger brevo-skills sync" step of the release workflow. A release no longer dispatches a sync and no BREVO_SKILLS_SYNC_TOKEN is needed.
  • Fixes CLAUDE.md, which still said installed skills are auto-refreshed: the check prints one update line and BREVO_SKILL_AUTOREFRESH=1 reinstalls.
  • Removes a node_modules symlink that was committed by mistake and broke yarn install in CI.

Both changesets are minor, so the next release is 2.6.0.

Order

  1. The skills repository's pull workflow is merged and has run once successfully (otherwise the brevo-cli skill stops syncing after this merges).
  2. This PR.
  3. The first published release of the skills after that, so brevo skill install has a catalog to read. Until then it stops with the unreachable-catalog message and points to brevo skill install brevo-cli (the bundled copy).

Checks

  • CI is green (lint, test, build, CodeQL, SonarCloud).
  • Locally: yarn lint, yarn build and the full jest suite (1,972 tests) pass.
  • Run by hand with the built CLI against a local copy of the catalog and an empty HOME: skill list, install --dry-run, install --agent claude,codex, check (exit 0, and exit 1 after editing an installed file), the skill:cli alias, uninstall, and the offline fallback to the bundled copy.
  • Not run by hand: --mcp registration against real agent CLIs, and the release and Homebrew workflows (they run on a real release).

🤖 Generated with Claude Code

piyushsarin-sib and others added 13 commits October 14, 2026 00:02
`brevo skill:cli install --agent <claude|codex|gemini|all>` installs the
skill into each agent's skills directory: ~/.claude/skills for Claude Code
(the default, unchanged), ~/.agents/skills for Codex and Gemini CLI, which
both read it, so one copy serves the two.

- uninstall removes every copy the CLI installed, or one agent's with --agent
- auto-refresh keeps every installed copy current
- BREVO_AGENTS_HOME overrides ~/.agents, like BREVO_CLAUDE_HOME
- --json results gain an `agents` field
- SKILL.md, AGENTS.md, README and CLAUDE.md no longer call the skill
  Claude-only: it follows the open Agent Skills format these agents load

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…atalog (#140)

* feat(skill): install, update and check skills from the brevo-skills catalog

Replace the one-skill `skill:cli` group with `brevo skill install|update|
uninstall|list|check`. Skills come from the brevo-skills catalog (latest
release asset, or `--pin <release>`), are fetched from the release tag and
hashed by the catalog's contract before they are written; a mismatch skips
that skill and exits 1. Skills marked `default` are always included, platform
fit and `min_cli_version` are honoured, `--mcp` registers the Brevo MCP server
through each agent's own CLI, `--dry-run` writes nothing.

Each installed directory carries `.brevo-skill.json`; `~/.brevo/skills.lock.json`
records versions, releases and pins. The catalog is cached at
`~/.brevo/skills-catalog.json`; after any command, when the cache is older than
12 hours and something is installed, outdated unpinned skills are reinstalled,
silently on network failure. Offline, `skill install brevo-cli` installs the
bundled copy. `skill:cli install|uninstall` stay as hidden aliases.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* docs(skill): describe the skill command group in the README and agent docs

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(skill): refuse unsafe catalog paths and spawn agent CLIs by absolute path

Catalog file and skill paths are validated as `/`-joined plain segments
(letters, digits, dot, underscore, dash; never `.`, `..`, an empty segment,
a backslash, a drive letter, a control character or the marker name), and
the write site checks again: the resolved destination must stay under the
skill directory and no component between the two may be a symbolic link.
A refused file skips that skill, like a hash mismatch, and the run exits 1.

`--mcp` resolves the agent CLI to an absolute path from absolute PATH
entries only and spawns that path with no shell, so the OS performs no
lookup of its own. On Windows only an `.exe` is run; a `.cmd`/`.bat`
launcher needs a shell, so its command is printed instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* feat(skill): print an update notice after commands instead of reinstalling skills

After a brevo command, an installed skill that is behind the catalog is now
named in one stderr line pointing to `brevo skill update`; nothing on disk
changes. BREVO_SKILL_AUTOREFRESH=1 restores the reinstall, and
BREVO_NO_SKILL_AUTOREFRESH=1 still turns the check off. The offline bundled
copy follows the same rule.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(skill): call validateSkill through an arrow in map (Sonar S7727)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
CI sets CI=true, which makes the auto-refresh skip itself, so the tests now
start from an environment without that gate. The PATHEXT test names its file
with the upper-case extension so it also matches on a case-sensitive filesystem.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Remove the ASSUMPTION caveats that named internal tickets from
agent-context/SKILL.md and agent-context/AGENTS.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
After a release publishes, dispatch getbrevo/brevo-skills' sync-skill
workflow for brevo-cli at the release commit. That repo packages
agent-context/SKILL.md for every agent platform and opens a PR there for
review. Best-effort: skipped with a warning without
BREVO_SKILLS_SYNC_TOKEN, and continue-on-error so it never fails a release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve conflicts with the public-apps GA docs (#143): keep the
`brevo skill update` wording in CLAUDE.md, keep the ticket-free M2M
lines in SKILL.md, and take main's new status/submit/withdraw entries.
Drop the internal ticket keys that main reintroduced into agent-context/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ill:cli

When the catalog cannot be fetched, `brevo skill install` now says the
brevo-skills repository is not reachable and points to the hidden
`brevo skill:cli install` group, which installs only the CLI skill from
the copy bundled with the CLI.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… hand

Move both post-publish steps into composite actions so the Release job and
two new workflow_dispatch workflows (Sync brevo-skills, Bump Homebrew
formula) run the same code. The release path keeps its behaviour and order
(sync best-effort, Homebrew last, no extra approval); the manual workflows
run in the npm-publish environment, so they need the same reviewer approval
and only run from main. The Homebrew version is now validated before it is
used in a URL, branch name and sed expression.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Resolve the README env var table: keep this PR's new rows in main's
prettier-aligned layout.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
bump-homebrew.yml is now the single implementation: workflow_dispatch for a
manual run, workflow_call for the Release workflow, which runs it as a
separate job after a publish instead of a final step in the publish job. A
failed bump no longer fails the release job and can be re-run alone. Drops
the composite action and the netrc workaround that only the in-job step
needed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…only with BREVO_SKILL_AUTOREFRESH=1

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The repository that publishes the skills now pulls agent-context/SKILL.md from this repo's
latest release, so a release no longer dispatches a sync and no token is needed for it.
Removes the sync-brevo-skills action and workflow and the release step, and fixes CLAUDE.md,
which still said installed skills are auto-refreshed (they are notified about by default).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

@piyushsarin-sib
piyushsarin-sib marked this pull request as ready for review October 23, 2026 09:42
@piyushsarin-sib piyushsarin-sib changed the title feat(skill): install skills from the catalog; the skills repository pulls the brevo-cli skill (draft) feat(skill): install skills from the catalog; the skills repository pulls the brevo-cli skill Oct 23, 2026

@Tribhuvan14 Tribhuvan14 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@piyushsarin-sib
piyushsarin-sib merged commit 665eaaa into main Oct 23, 2026
6 checks passed
@piyushsarin-sib
piyushsarin-sib deleted the feat/skill-install-pull-sync branch October 23, 2026 10:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants