[tobi12345]

Adds CLI workflows for installing Langfuse-hosted skills and publishing skills maintained in a repository. A local directory can create a skill or publish a new immutable version; unchanged content reuses its existing version. This proof of concept uses the unstable skills API.

Behavior

• skills install <name[@selector]> supports names, labels, versions, and tags; skills install --all enumerates every skill in the connected project with bounded pagination. Name, tag, and all selectors are mutually exclusive. Bare install restores the lockfile; skills update [name] follows saved labels and keeps exact versions pinned. Downloads validate paths, sizes, and checksums and stage directory replacement. Local changes require --force.
• skills push <directory> uploads a validated text-file snapshot. Opt-in --recursive discovers skills and reports invalid skills as skipped while pushing valid ones. --update-only skips names absent from Langfuse; --dry-run reports planned changes without writes.
• Push records successful versions in langfuse-skills.lock and pins selectors to those versions. --label production applies that label and records a label selector instead, preserving other labels on the target version. Unchanged content can be labeled without creating another version. --no-lockfile bypasses lockfile reads and writes.
• Lockfile lookup uses explicit --lockfile <path>, then an existing file in the install/push directory, then cwd. If none exists, it creates the lockfile in the install/push directory. Single-skill push uses the skill’s parent; recursive push uses the collection root (or its parent when the root is itself a skill). Entry paths are relative to the selected lockfile. --no-lockfile disables lookup and persistence.
• The lockfile retains lockVersion: 1 and stores skills as an array of { path, name, selector, version } entries, sorted by path. Repeated writes replace the matching path; duplicate paths are rejected.
• Lock entries support source directories whose names differ from the skill name. Locked directories must remain inside the working project and cannot overlap; explicit unlocked operations can use external directories. Each successful skill is recorded before moving to the next. Failed labeling leaves the published version available and the previous lock entry unchanged.
• Local reads reject symlinks, unsupported files, invalid UTF-8, and oversized snapshots. Leading UTF-8 BOMs are normalized consistently for publishing and local manifest comparisons; download checksum verification remains byte-exact. Requests reject redirects.
• Includes the pinned API 4.48.0 spec and seven skills API operations. No release version bump.

Examples

langfuse skills install support-triage@production
langfuse skills install --all
langfuse skills update
langfuse skills push .agents/skills/support-triage
langfuse skills push .agents/skills --recursive --label production
langfuse skills push .agents/skills --recursive --update-only --dry-run --json

Validation

Impacted package: @langfuse/cli.

• bun test: 117 pass, 0 fail.
• bun run typecheck: exit 0.
• bun run build: Built native Bun CLI with 7 contracts and 720 operations.
• bun run conformance:all: Total: 720/720 in the prior feature review; API contracts are unchanged by the lockfile and install-all changes.
• Built-CLI install-all smoke check passed pagination, deduplication, selectors, lockfile restore/override, opt-out, empty projects, conflicting flags, and preflight failure behavior.
• Built-CLI lockfile smoke check passed directory precedence, cwd fallback, explicit override, new-file defaults, relative paths, install/update/push round trips, recursive root handling, labels, dry-run, opt-out, and safety checks.
• Temporary smoke checks against the built Node CLI verified pinned and labeled selectors, creation and unchanged promotion, preserved labels, recursive skips, dry runs, lockfile opt-out, validation, and partial-failure recovery.
• Two review reproductions failed before the fixes and passed afterward: BOM-bearing files matching their pushed manifest and extensionless files being rejected locally. Real content edits and invalid UTF-8 still fail manifest matching.
• Changed-file whitespace check passed. Live Langfuse integration testing was not performed; API compatibility was reviewed against backend routes and schemas.