Add a `dryRun` option to the scan-projects endpoint. When true, the
scan identifies which skills would be pruned and which agents would be
affected, but does not delete anything or modify agent configs.
The response now includes:
- `pruned[]`: list of skills that would be (or were) removed, with
affected agent names
- `dryRun`: boolean echoed back so callers can distinguish preview
results from live mutations
This lets callers preview destructive prune operations before committing
to them, addressing the review concern about silent deletion of
production data.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Previously, skills pruned during re-scan only emitted a warning when
they were attached to agents. Skills with no agent references were
deleted silently. Now every pruned skill emits a warning in the scan
result so the deletion is always visible to the caller.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
During a repo sync (scan button), if a skill was removed from the source
and is still assigned to agents, the skill is now automatically detached
from those agents before deletion, rather than leaving it attached.
Manual delete-by-source is unchanged (still blocks if in use).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub/sks_sh pruned skills don't have project/workspace context needed for
the CompanySkillProjectScanConflict/Skipped types. Orphaned skills are
silently deleted; skills still used by agents emit a warning instead of
a conflict entry.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When re-scanning existing sources, diff skills in the DB against the
current source manifest. Skills no longer in the source are either:
- Added to conflicts (if still used by agents)
- Deleted via deleteSkill (if orphaned), added to skipped
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use Set<string> instead of Map for tracking unique source locators
- Remove dead skillsAtSource destructuring from loop
- Remove redundant deriveCanonicalSkillKey call (already set by readUrlSkillImports)
- Invert slug check to continue guard for cleaner flow
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace redundant listFull() call with acceptedSkills to avoid extra DB round-trip
- Check slug conflicts against full acceptedSkills list instead of just same-source skills
- Call upsertAcceptedSkill after persisting to keep in-memory list current
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When "Scan project workspaces for skills" runs, now also iterates all
existing GitHub/sks_sh skills and re-fetches their source repos to
detect newly added skills. New skills are upserted automatically.
Skips sources that fail, logged as warnings.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When updateSkillAuth(null) is called, the underlying secret row was
left orphaned. Now deletes the secret via secretsSvc.remove() before
clearing sourceAuthSecretId from metadata.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Scope metadata update WHERE clause to companyId for defence-in-depth
- Add CompanySkillUpdateAuth inferred type export to match other schemas
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Pre-check all skills for agent usage before deleting any in deleteBySource
to prevent partial/failed deletions
- Delete (rotate to empty) the skill-pat:<skillId> secret when a skill is
deleted to prevent orphaned PAT secrets
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add optional authToken to skill import for GitHub private repos
- Store PAT as encrypted company secret (skill-pat:{skillId})
- Thread auth token through ghFetch, fetchText, fetchJson, and all GitHub resolution functions
- Add PATCH /companies/:companyId/skills/:skillId/auth for managing PAT per skill
- Add DELETE /companies/:companyId/skills/by-source for bulk deleting skills from a repo
- Preserve sourceAuthSecretId across skill re-imports/updates
- UI: Add PAT input field in import form for GitHub URLs
- UI: Add SkillAuthSection with ShieldCheck icon for viewing/updating/removing PAT
- UI: Add trash icon next to source label for delete-by-source
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Added functionality to prevent deletion of skills that are still in use by agents. Updated the company skill service to throw an unprocessable error if a skill is attempted to be deleted while still referenced by agents. Enhanced the UI to include a delete button and confirmation dialog, displaying relevant messages based on agent usage. Updated tests to cover the new deletion logic and error handling.
When skills are imported via skills.sh URLs or key-style imports
(org/repo/skill), the stored sourceType is now "skills_sh" with the
original skills.sh URL as sourceLocator, instead of "github" with the
resolved GitHub URL.
- Add "skills_sh" to CompanySkillSourceType and CompanySkillSourceBadge
- Track originalSkillsShUrl in parseSkillImportSourceInput
- Override sourceType/sourceLocator in importFromSource for skills.sh
- Handle skills_sh in key derivation, source info, update checks,
file reads, portability export, and UI badge rendering
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add DELETE /api/companies/:companyId/skills/:skillId endpoint with same
permission model as other skill mutations. Deleting a skill removes it
from the DB, cleans up materialized runtime files, and automatically
strips it from any agent desiredSkills that reference it.
- Fix parseSkillImportSourceInput to detect skills.sh URLs
(e.g. https://skills.sh/org/repo/skill) and resolve them to the
underlying GitHub repo + skill slug, instead of fetching the HTML page.
- Add tests for skills.sh URL resolution with and without skill slug.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When a skill's source is "Paperclip workspace", clicking the label now
copies the absolute path to the managed skills workspace to the clipboard
and shows a toast confirmation.
- Add sourcePath field to CompanySkillDetail and CompanySkillListItem types
- Return managedRoot path as sourcePath from deriveSkillSourceInfo for
Paperclip workspace skills
- Make source label a clickable button in SkillPane detail view
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pawla Abdul
Chris Farhood
Dotta