Review caught this on the note added last commit, and it was right again. `sync`
prints the card's path relative to the repository root; a Markdown image
resolves relative to the file it sits in. Telling the agent to reuse the
printed path is correct only for a README at the root.
Verified: with output `docs/usage.svg`, sync prints `./docs/usage.svg`. Pasted
into `docs/zh-CN/README.md` that resolves to `docs/zh-CN/docs/usage.svg` — the
card exists, the image is broken. The nested README needs `../usage.svg`.
The note now says to rewrite the path for the target file and gives both forms.
Review caught this on the previous commit, and it was right. `sync` resolves
its target as `--out` if given, otherwise `.tokenchit.json`'s `output` —
`tokenchit.svg` is that field's default, not a fixed location. Saying the bare
command "writes tokenchit.svg in the repository root" is wrong for anyone who
has configured another path.
Checked rather than assumed: a config with `output: docs/custom-card.svg` makes
the bare command report `would write docs/custom-card.svg`.
Three places said it. Step 3 now says the configured output, the flag table no
longer implies the default is fixed, and the README snippet carries a note to
use the path sync actually reported. The command's usage comment says the same.
The workflow's step 3 was an executable block containing placeholders:
npx -y @tokenchit/cli@0.10.0 sync [--out PATH] [--theme auto|light|dark] [--dry-run]
Copied as written, that does not fail. `sync` ignores an unrecognised
positional argument rather than refusing it, and `[--dry-run]` is positional —
so the brackets are discarded and a real sync runs. Verified against the
published 0.10.0: the literal command exits 0 and writes tokenchit.svg, 10,144
bytes, while `--dry-run` spelled properly writes nothing. An agent following
this skill for a preview would have changed the working tree.
Step 3 now shows one bare runnable command and moves the options into a table,
so nothing inside a bash block is a placeholder. Three reviewers flagged this
shape — it was the standing merge-risk note on the PR — and it was still live.
Also states the Node floor. The skill said only "Requires Node.js"; the package
declares engines node >=22, so anyone on 20 met a confusing failure instead of
a clear precondition.
The conflicts were all counter bumps. Upstream moved 286 -> 292 skills while
staying at 94 command shims; this branch adds one of each, so the merged values
are 293 skills and 95 shims, carried across the English, Turkish and Chinese
docs. Upstream's 2.2.2 version is kept.
One line needed care and nearly went wrong: the v2.0.0 changelog entry records
"281 skills, 67 agents, 94 command shims". That 94 is a fact about a past
release, not a live counter, and a blanket substitution had rewritten it. It is
back to 94. The Discord snowflake and the Perl badge colour both contain "94"
too and are untouched.
While here, the pin was stale. It named 0.7.0, three minor versions behind, so
anyone installing through this skill got a tool without Gemini support, the
read-only doctor report, PNG export or the portable ledger. Raised to 0.10.0 —
knowingly, which is what the skill's own note asks for — and the documented
`npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball` was run to confirm
it resolves.
The agent list was stale for the same reason: Gemini CLI became a real adapter
in 0.9.0 and the skill still advertised three agents. Verified against the
published 0.10.0 tarball rather than from memory — `init --help` and `doctor`
both name Claude Code, Codex, Gemini CLI and OpenCode.
Addresses the review on #3039. Four findings, all of them real.
Skills-first (Greptile P2). AGENTS.md says commands/ exists for compatibility and
the direction is skills-first, so the workflow now lives in skills/token-card
and commands/token-card.md is a thin shim pointing at it — 70 lines down to 28.
Unpinned remote code (CodeRabbit major, Greptile P1, CWE-494). The workflow ran
`npx -y @tokenchit/cli@latest` and handed whatever the registry currently serves
read access to local session logs. It is pinned to 0.7.0, the skill says to raise
the pin knowingly, gives the `npm view … dist.integrity` check, and step 1 is now
an explicit confirmation before the first download on a machine.
The "no network request" claim was false as written (both bots). `sync` sends
nothing, but the npx invocation around it is a registry download, and the
sentence read as though the whole step were offline. It now separates the two.
`--dry-run` wrote a file (Greptile P2). Step 1 created `.tokenchit.json` via
`init` before `sync --dry-run` ran, so a documented no-op mutated the tree.
Initialisation is skipped on a dry run and reported as prospective instead.
The README offer was unreachable (Greptile P2). "Stop after step 3" sat directly
below step 4, so the step that puts the card in the README — the whole point —
could never run. The boundary moved to after step 4; publishing still requires
being asked for by name.
Wiring: agent.yaml skills list, manifests/install-modules.json under
operator-workflows (beside cost-tracking and ecc-tools-cost-audit), and
package.json `files`, which the npm-publish-surface test requires to track the
module graph. `yarn install --mode=update-lockfile` leaves yarn.lock byte
identical, so nothing to commit there. docs/tr/AGENTS.md carries two skill counts
the catalog sync does not reach, both 286 -> 287.
npm test: 4396 passed, 0 failed. markdownlint clean on both files.
haelyra