opencode-agent-skills - npm Package Compare versions

Comparing version 0.6.5 to 0.7.0

package.json

 {
   "name": "opencode-agent-skills",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "A dynamic skills plugin for OpenCode that provides tools for loading and using reusable AI agent skills.",
@@ -5,0 +5,0 @@ "author": "Josh Thomas <[e-mail]>",

README.md

@@ -5,2 +5,5 @@ # opencode-agent-skills
 
+> [!NOTE]
+> OpenCode now includes first-party support for agent skills, including native skill discovery and a built-in `skill` tool. For most users, this plugin is no longer necessary. It remains available in maintenance mode for users who depend on its extra behavior, such as automatic semantic skill matching, synthetic context injection, compaction reinjection, Superpowers bootstrapping, and helper tools for reading skill files or running skill scripts.
+
 ## Features
@@ -20,2 +23,4 @@
 
+If you only need standard skill loading, prefer OpenCode's built-in skills support. Install this plugin only if you need one of its additional behaviors.
+
 Add to your OpenCode config (`~/.config/opencode/opencode.json`):
@@ -35,3 +40,3 @@
 {
-  "plugin": ["opencode-agent-skills@0.6.5"]
+  "plugin": ["opencode-agent-skills@0.7.0"]
 }
@@ -91,5 +96,13 @@ ```
 
+## Troubleshooting
+
+If Hugging Face downloads are blocked or slow from your network, point Transformers.js at a compatible mirror:
+
+```bash
+HF_ENDPOINT=https://hf-mirror.com opencode
+```
+
 ## Alternatives
 
-- [opencode-skills](https://github.com/malhashemi/opencode-skills) - Auto-discovers skills and registers each as a dynamic `skills_{{name}}` tool
+- OpenCode's built-in skills support - Native skill discovery and loading through the built-in `skill` tool
 - [superpowers](https://github.com/obra/superpowers) - A complete software development workflow built on composable skills
@@ -100,4 +113,6 @@ - [skillz](https://github.com/intellectronica/skillz) - An MCP server that exposes skills as tools to any MCP client
 
-Contributions are welcome! Here's how to set up for development:
+This project is in maintenance mode. Bug fixes and small, clean improvements are welcome, but new features should generally be weighed against OpenCode's native skills support first.
 
+Here's how to set up for development:
+
 ```bash
@@ -104,0 +119,0 @@ git clone https://github.com/joshuadavidthomas/opencode-agent-skills

src/embeddings.test.ts

@@ -1,3 +0,4 @@
-import { describe, expect, test } from "bun:test";
-import { getEmbedding, cosineSimilarity, matchSkills } from "./embeddings";
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import { getEmbedding, cosineSimilarity, matchSkills, applyHfEndpoint } from "./embeddings";
+import { env } from "@huggingface/transformers";
 import type { SkillSummary } from "./skills";
@@ -247,2 +248,51 @@
   });
+
+  describe("applyHfEndpoint", () => {
+    let originalHfEndpoint: string | undefined;
+    let originalRemoteHost: string;
+
+    beforeEach(() => {
+      originalHfEndpoint = process.env.HF_ENDPOINT;
+      originalRemoteHost = env.remoteHost;
+    });
+
+    afterEach(() => {
+      if (originalHfEndpoint === undefined) {
+        delete process.env.HF_ENDPOINT;
+      } else {
+        process.env.HF_ENDPOINT = originalHfEndpoint;
+      }
+      env.remoteHost = originalRemoteHost;
+    });
+
+    test("sets env.remoteHost when HF_ENDPOINT is defined", () => {
+      process.env.HF_ENDPOINT = "https://hf-mirror.com";
+      applyHfEndpoint();
+      expect(env.remoteHost).toBe("https://hf-mirror.com");
+    });
+
+    test("does not change env.remoteHost when HF_ENDPOINT is undefined", () => {
+      delete process.env.HF_ENDPOINT;
+      applyHfEndpoint();
+      expect(env.remoteHost).toBe(originalRemoteHost);
+    });
+
+    test("trims HF_ENDPOINT before setting env.remoteHost", () => {
+      process.env.HF_ENDPOINT = "  https://hf-mirror.com  ";
+      applyHfEndpoint();
+      expect(env.remoteHost).toBe("https://hf-mirror.com");
+    });
+
+    test("does not change env.remoteHost when HF_ENDPOINT is empty string", () => {
+      process.env.HF_ENDPOINT = "";
+      applyHfEndpoint();
+      expect(env.remoteHost).toBe(originalRemoteHost);
+    });
+
+    test("does not change env.remoteHost when HF_ENDPOINT is only whitespace", () => {
+      process.env.HF_ENDPOINT = "   ";
+      applyHfEndpoint();
+      expect(env.remoteHost).toBe(originalRemoteHost);
+    });
+  });
 });

src/embeddings.ts

@@ -5,3 +5,3 @@ import * as crypto from "node:crypto";
 import { homedir } from "node:os";
-import { pipeline, type FeatureExtractionPipeline } from "@huggingface/transformers";
+import { env, pipeline, type FeatureExtractionPipeline } from "@huggingface/transformers";
 import type { SkillSummary } from "./skills";
@@ -17,2 +17,14 @@
 
+/**
+ * Apply HF_ENDPOINT environment variable to the transformers remote host config.
+ * This allows users in restricted networks to use a mirror instead of huggingface.co.
+ * @see https://github.com/joshuadavidthomas/opencode-agent-skills/issues/36
+ */
+export function applyHfEndpoint(): void {
+  const hfEndpoint = process.env.HF_ENDPOINT?.trim();
+  if (hfEndpoint) {
+    env.remoteHost = hfEndpoint;
+  }
+}
+
 async function ensureModel(): Promise<void> {
@@ -22,2 +34,3 @@ if (model) return;
     modelPromise = (async () => {
+      applyHfEndpoint();
       model = await pipeline("feature-extraction", MODEL_NAME, { dtype: QUANTIZATION });
@@ -24,0 +37,0 @@ })();

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

68766

4.59%

Lines of code

1576

3.55%

Number of lines in readme file

181

9.04%

Worsened metrics

Number of low supply chain risk alerts

18

100%

No dependency changes