xmlsquishsource. compose. build.
中文
Release log

v1.1.0 · Historical

Agent Skills become locked project dependencies

Declare local or Git skills in the workspace-root manifest, pin complete bundles in the lockfile, and reconcile safe, agent-visible copies in .agents/skills. The bundled prompt-squish guide can also be installed independently.

· Machine protocol 3.2· 6 native archives
Get this versionGitHub ReleaseRelease metadata

01

Changes

Skills are first-class dependencies

  • A workspace-root [skills] table accepts an exact local directory or Git repository with an optional rev, tag, branch, and subdir; skills remain separate from XML package dependencies.
  • xmlsquish.lock records each selected source, exact Git revision where applicable, and a BLAKE3 digest of the complete skill tree, not just SKILL.md.
  • Legacy manifests and lockfiles without skills remain readable; XML package operations preserve skill pins.

A complete skill lifecycle

  • add-skill and remove-skill manage one declared skill; sync-skills restores missing managed copies and reconciles the declared set after checkout or interruption.
  • install-skill installs xmlsquish's bundled prompt-squish guide to the user directory by default or to the workspace with --project, without modifying the project manifest or lockfile.
  • The familiar --dry-run, --locked, --offline, and --frozen modes apply to project skill operations.

Ownership and recovery

  • The projection at .agents/skills/<name> is a copied, managed tree; unowned or user-edited directories are not overwritten or removed.
  • Acquisition validates SKILL.md identity and complete-tree paths and rejects unsafe links and collisions; no skill script is executed during installation.
  • Recoverable publication and reconciliation keep the manifest, lockfile, and installed projection aligned after interrupted operations.

02

Get this version

Native archives

Choose the archive matching your operating system and processor. Verify its exact filename against SHA256SUMS before extraction.

Windows

Windows 10/11 · ZIP

Linux

glibc 2.35+ · tar.gz

macOS

macOS 11+ · tar.gz
SHA-256 manifest

Native archives are unsigned and not Apple-notarized. Checksums establish byte integrity, not publisher identity.

Pinned source install

cargo install --git https://github.com/kleedaisuki/prompt-squish --tag v1.1.0 --locked

03

Compatibility

  • Machine protocol 3.2 adds typed skill operations and results; existing XML DSL, artifact locators, and exit-code meanings remain unchanged.
  • Existing projects need no migration unless they declare [skills]; a skill is not an XML package and does not participate in imports or builds.
  • Review a third-party skill before adding it: a digest establishes byte integrity, not the trustworthiness of its instructions or scripts.