[mstomar125]

Summary

• Publishes the NodeSpace Agent Skill to the public, generated-only NodeSpaceAI/nodespace-skill repo, wired into release.yml's release: [published] pipeline the same way the Homebrew tap sync is (sync-skill-repo job, sibling of sync-homebrew-cask).
• Decision recorded: @nodespaceai/skill will not be published to npm; NodeSpaceAI/nodespace-skill is the sole distribution channel for external harness import. The desktop app has never shelled out to npx/npm for its own install path (it runs the built installer directly with bun, since commit b6ec420 / Build packages/skill and invoke the installer directly via bun #2143), so npm publishing was never actually required — Publish @nodespaceai/skill to npm: distributable skill package for PTY agent marketplaces #1184 closing without the package landing on the registry never blocked anything real. Updated packages/skill/README.md and install.ts, which still described an npx install flow that was never live.
• Frontmatter for all four installer targets (Claude Code, Codex, Gemini CLI, OpenCode) was already fixed to be spec-valid and shared across all four in Make the graph the source of truth for the NodeSpace skill (channel-independent half) #2284 (merged just before this branch started) — verified still correct, not re-done here. Added one thing Make the graph the source of truth for the NodeSpace skill (channel-independent half) #2284 didn't need: buildSkillFrontmatter() in agents.ts, which stamps an optional compatibility field (the Agent Skills spec's optional field, max 500 chars) with the released NodeSpace app version — used only by the new publish script, not the app's own install path.
• scripts/publish-skill-repo.ts renders skills/nodespace/SKILL.md (shared frontmatter + packages/skill/SKILL.md's current body, whatever shape it currently is) and skills/nodespace/references/cli.md, copied verbatim from packages/skill. The published file set is derived from the intersection of all four agents' shims lists in agents.ts (sharedShimPaths()), not hardcoded — so it won't silently drift if a shared file is ever added, and it keeps working unmodified if Make the graph the source of truth for the NodeSpace skill, and decide how guidance reaches external agents #1958 later changes SKILL.md to a smaller stub.
• Generalized scripts/homebrew-tap-push.ts → scripts/push-to-external-repo.ts: pushFilesToTap took a hardcoded tap repo; pushFilesToRepo takes the target repo as a parameter, reused by update-homebrew-cask.ts, update-homebrew-formula.ts, and the new publish script.

What's live right now (not just code — verified per the issue's closing criteria)

NodeSpaceAI/nodespace-skill is populated for real, not empty:

• README.md — explains it's a generated publish target, points back to nodespace-core.
• skills/nodespace/SKILL.md — pushed by actually running scripts/publish-skill-repo.ts v0.2.2 --push by hand (using my own gh/git credentials, not a CI secret) as the one-time manual bootstrap the issue anticipated, since exercising the release pipeline itself would mean cutting a real release. This is the same code path CI will run — it wasn't simulated.
• skills/nodespace/references/cli.md — pushed the same way.

Verified against the actual fetched artifact (fresh git clone, not my local build) with a validator built directly from the six-field table on https://agentskills.io/specification: 16/16 checks pass — name matches the directory, description/compatibility/name are within their length limits, frontmatter uses only the six spec-defined fields, references/cli.md resolves, body is under the 500-line recommendation.

I also copied skills/nodespace/ into a scratch Claude Code project (.claude/skills/nodespace/, not the real ~/.claude) to confirm placement matches exactly what Claude Code's own docs describe for project-level skills. I could not get a live Claude Code session to load and activate it — this sandbox has no OAuth session and a non-writable keychain (claude doctor confirms both), so a nested claude -p invocation fails to authenticate regardless of the skill itself. That's an environment limitation, not something this PR can fix; the structural verification above is the strongest available substitute. Recommend a live Claude Code (and ideally Codex) activation check on a machine with real auth before fully closing this out.

Resolved: the allowed-tools question from the issue

The issue asked whether allowed-tools is a Claude-Code-specific extension (in which case it should be dropped from the codex/gemini/opencode frontmatter). I fetched both https://agentskills.io/specification and Claude Code's own skills docs directly: allowed-tools is one of the spec's six universal frontmatter fields (name, description, license, compatibility, metadata, allowed-tools), marked "Experimental" (support varies by implementation) but not Claude-Code-only. Claude Code's own docs confirm the same six-field list for what claude.ai skill uploads / the Skills API / package_skill.py accept — anything outside those six hard-errors. So sharing allowed-tools across all four installer targets (as #2284 already does) is spec-compliant, not a leak of a Claude-Code-only field. No change needed there.

Open / flagged for the coordinator

• New secret needed: SKILL_REPO_TOKEN (a PAT with contents: write on NodeSpaceAI/nodespace-skill only) is not yet provisioned as a repo secret on nodespace-core. Until it is, sync-skill-repo will fail loudly on the next real release and notify-failure will open an issue — same failure shape HOMEBREW_TAP_TOKEN/WEBSITE_DEPLOY_TOKEN had before they were provisioned. I don't have a path to create repo secrets myself.
• Discovered (pre-existing, unrelated to this change) while running the startup sequence: bun run gh:status is broken — scripts/github-client.ts hardcodes owner: "malibio" / projectNumber: 5, which no longer resolves to a real project (the live board is the org-level NodeSpaceAI project Create design system foundation #2). I worked around it by updating Publish the NodeSpace skill so users can actually install it: public import repo + automated release #2283's board status directly via the GraphQL API rather than fixing the script in this PR (out of scope here). Flagging in case it's not already tracked.
• No scheduled drift-check backstop (like homebrew-drift-check.yml) was added for the skill repo. The issue didn't ask for one; happy to add if wanted.

Test plan

• bun run test:all — full suite (unit + browser + Rust) passes, no new failures.
• bun run quality:fix — clean.
• bun run scripts/publish-skill-repo.ts v0.2.2 --push — run for real against NodeSpaceAI/nodespace-skill (bootstrap; superseded by the next real release through CI).
• Structural spec validation of the live, freshly-cloned artifact (16/16 checks, script-based, quoting the spec table).
• Placed the published skills/nodespace/ folder in a scratch project's .claude/skills/nodespace/ and confirmed correct structure/placement; live activation blocked by sandbox auth (see above).