feat(npm): add package Skill install options

[harlan-zw]

🔗 Linked issue

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Skill pages detect published npm packages that include the Skill. When detected, NPM opens first, with Run second and Install third. The NPM panel offers pnpm approval or skills-npm setup, coloured logos, and versioned commands highlighted with rangi.

Other Skills keep Run as the default. The npm authoring guide explains package layout, and the CLI feature list describes pnpm ownership compatibility.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

Agent verification: live npm metadata and tarballs identify ripide@0.8.0 as bundling the ripast Skill. The detector returns Absent for @nuxtjs/seo@5.3.16 because its published tarball excludes the Skill, despite the source directory existing.

The pnpm 12.11.0 fixture confirms scoped package approval and link creation. Desktop and mobile browser checks confirm the optional panel opens and commands remain readable. Screenshots use temporary public Skill and package response fixtures because the local registry lacks that Skill. The fixtures were removed after capture.

The unmodified endpoint returns Found for ripide@0.8.0 using a seeded local D1 row and live GitHub/npm reads. After deleting that test row, the next request still returns Found, confirming the complete lookup is served from cache. Test rows were removed.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-10 07:43 UTC.

GitHub merged this pull request.

• Logged (35/100): The PR's visual claims (NPM-first ordering, coloured logos, mobile readability, light/dark logos) are documented only in screenshots that could not be inspected, so the visible-UI half of this change is unverified. View code Optional follow-up: Re-run Review in a turn with image input, or attach the same screenshots to the PR with an explicit checklist so a human verifies pixels before merge.
  • Ask an agent to verify and fix this finding
• Logged (15/100): The late-arriving package result overwrites the user's explicit tab choice mid-read. View code Optional follow-up: Apply the NPM default only until first user interaction, e.g. flip npmSelected only when the user has not clicked a tab (an interacted flag) instead of on every published change.
  • Ask an agent to verify and fix this finding
• Logged (25/100): Deterministic Unavailable outcomes are treated like transient transport failures and recompute on every request. View code Optional follow-up: Split Unavailable into transient (network/5xx: never cache) versus deterministic (size/parse: cache a short negative TTL such as 300s), so bounded-rejected packages stop re-downloading per view.
  • Ask an agent to verify and fix this finding
• Logged (10/100): Verification limit: whether registry.npmjs.org accepts the fully-encoded scoped URL is unproven, and a mismatch would silently disable the feature for all scoped packages. View code Optional follow-up: Build the registry URL with the npm-canonical escape (replace('/', '%2F')) or confirm the %40 form with one live request before deploy.
  • Ask an agent to verify and fix this finding

5e82909c-740c-4967-9c4d-535f1f9b8e0a

Selected findings run after merge and open separate pull requests.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-zw]

Agent verification for commit aafaebb:

• Checked official npm and pnpm artwork on desktop and 390px mobile, in light and dark mode.
• pnpm changes to its official light artwork in dark mode. skills-npm has no duplicate npm symbol.
• NPM keeps its accessible name. Run and package setup choices still switch correctly.
• Mobile had no horizontal overflow.
• Browser checks used temporary public-data API fixtures. Both routes were removed before the commit.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results