The skill directory is a CLI-managed artifact, so install now replaces it
wholesale and remove deletes it. Drops the manifest file, the content
hashing, and --force.
Preserving edits was worse than losing them. An edited file was skipped
by every future install, so it stayed frozen forever against a CLI that
keeps changing, which defeats the reason for embedding the skill in the
binary at all. Replacing wholesale also drops files an older version
shipped, with no reconciliation logic needed.
This removes the three ownership-loss paths raised in review rather than
patching them, since all of them came from keeping that bookkeeping file
in sync with what was on disk.
SKILL.md now says it is managed and points anywhere else for custom
guidance.
Three ownership-loss paths found in review, all variations on discarding
the manifest while the file it describes is still on disk.
`remove` deleted the manifest unconditionally. When it deliberately kept
a file the user had edited, the next install saw an untracked file and
overwrote those edits without --force, undoing the preservation that
removal had just performed. It now writes back a manifest covering
everything still present, and only deletes it when the directory is
actually empty.
The same applied to files it could not delete: the record vanished, the
file stayed, and removal still reported success. Those are now retained,
reported, and retried by a later run.
Upgrade cleanup had the mirror problem, dropping stale entries from the
new manifest even when deletion failed, orphaning a file we know we
wrote. It keeps tracking those so a later install can retry.
A failed manifest write during removal is now a warning rather than an
abort, since the previous manifest still lists every retained file and
other targets should still be processed.
`response delete` had to run its own list first just to report how many
it removed, which duplicated the query the helper already does. Both
helpers now return the count instead.
`cmd_delete_all_http_responses` was returning the helper's value
directly, so it keeps its `()` result explicitly and the frontend
contract is unchanged.
Stored responses were unreachable from the CLI even though the model
layer has had list/get/delete all along. After a send, an agent could
only see the body it just streamed: no status, no timing, no history.
`yaak response list|show|body|delete` closes that. `show` and `body`
accept a request ID as shorthand for its most recent response, which is
the common case, and `show` returns status, reason, timing, headers, the
final URL, and any transport error as JSON.
`request create` also accepted payloads for request types it cannot
create. A gRPC-shaped payload deserialized into an HttpRequest with the
unknown fields dropped, so the gRPC method name landed in `method`,
`service` vanished, and the result looked like a successful create. It
now rejects a non-`http_request` `model`, and any field that is not part
of the HTTP request schema, pointing at the app instead. `request update`
had the same silent-drop behavior and gets the same check.
The skill now points at `response show` rather than teaching agents to
grep verbose send output for the status line.
The skill had grown into a reference manual: body type tables, auth
strategy lists, a template function table, field-by-field OAuth 2.0
config. All of it goes stale, because the user's CLI version and their
installed plugins decide what actually exists. On this machine a faker
plugin contributes 274 template functions; the skill listed eleven, and
got some names wrong.
The CLI should carry that knowledge, so:
- `yaak template-function list [filter]` and `template-function show
<name>` report what the loaded plugins actually provide, the same way
`request schema http` already merges in plugin auth strategies.
- `yaak folder schema` now exists, so folder payloads are discoverable
like every other model. Required deriving JsonSchema on Folder.
- The request schema documents `bodyType` and `body` shapes, and states
that setting a body type does not add a Content-Type header.
The skill drops to a single 135-line SKILL.md that teaches the model,
the workflows, and how to interrogate the CLI, and says outright that
the CLI wins when the two disagree.
Authentication was only covered in references/requests.md, so an agent
that never opened it had no reason to know the schema enumerates every
installed strategy, including plugin-contributed ones. OAuth 2.0 was not
mentioned in the always-loaded file at all.
SKILL.md now shows how to list the strategies and dump one's shape, and
calls out that the variant title is a display label rather than the
authenticationType value ("NTLM Auth" is `windows`, "AWS Signature" is
`awsv4`). Auth is in the frontmatter description too, so the skill
triggers on requests to add auth to a request.
requests.md gains a worked OAuth 2.0 payload, verified against the schema
and round-tripped through the model.
Two problems found in review, both from deleting without checking what we
actually wrote:
`agent remove` called remove_dir_all on the whole tree, discarding files
the user had edited or added. Install goes out of its way to preserve
those, so uninstall throwing them away was inconsistent and lossy. It now
deletes only tracked files whose contents still match the manifest,
prunes empty directories, and reports anything it kept.
`agent install` never reconciled against the previous manifest, so a file
an older CLI shipped but a newer one drops would linger and could feed an
agent stale guidance. Unshipped files are now removed when unmodified,
and left alone (and untracked) when the user has edited them.
Teaches agents to drive the CLI: workspaces, environments, requests,
sending, response chaining, and importing. SKILL.md stays lean with
four references loaded on demand.
The skill is embedded in the binary and written to ~/.agents/skills plus
any detected tool directory, so it ships with the CLI and refreshes on
update. Reinstalls keep files edited locally unless --force.
Also fixes the `request schema http` hint for URL path parameters, which
said to omit the leading colon. Names without the colon are sent as query
string parameters instead, leaving the placeholder literal in the path.
Test runs from the repo root were picking up every git worktree under .claude,
running 648 tests across 102 files instead of 322 across 34. That made results
misleading rather than just noisy: a failure in an unrelated worktree showed up
as a failure here.
Ignores the directory too. Only settings.local.json was listed, while rules.md
stays tracked.
Tag text was black in light themes and correctly tinted in dark. Both came from
liftMax(), which pushes lightness to an extreme, and the two extremes are not
symmetric: lightening past the sRGB gamut clips to a still-tinted color, so dark
kept its hue by accident, while darkening to zero lightness collapses every hue
to black.
Stopping short of the extreme keeps the hue in both appearances with no branch
on appearance, and still clears 6:1 against the tag's own surface across every
accent. Dark shifts from washed out toward the accent, so a purple tag now reads
purple rather than near-white pink.
The "when reasonable" checkboxes read as optional, but the contribution
policy workflow requires all boxes checked. Reword them as either/or
statements and accept the legacy wording in the policy script so
existing PRs keep validating.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The yaak.app MCP server carries the release workflow in its tool
descriptions and instructions; notes are generated from changelog
items on ship.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The release command no longer teaches hand-writing GitHub notes: they
are generated from the yaak.app changelog items by release_ship_beta
and release_publish. AGENTS.md tag rule updated for the CLI being
version-locked to app tags.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The CLI is now version-locked to app releases, so the devDependency
follows the latest stable instead of a range that would strand on the
old 0.x line.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The CLI now publishes to npm on every v* tag at the app's version,
instead of its own yaak-cli-* tag namespace. Stables go to the latest
dist-tag, prereleases to beta/alpha. workflow_dispatch remains for
manual publishes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gregory Schier