feat(skills): notify when installed skills have updates

Kai Armstrongrequested to merge
add-skill-update-notifications into main

Depends on !3335 (merged) (add-whatsnew-command). Bundled-skill check hooks into the post-upgrade banner introduced there.

Summary

Adds glab skills update [name|--all] and two passive notification surfaces that flag when an installed agent skill (bundled or remote) has diverged from its source.

How it works

Detection is manifest-free: internal/commands/skills/installed/ walks the two well-known install locations and matches each subdirectory against the bundled + remote registries. Each installed skill gets a skill.ContentHash (sha256 over the file tree) so we can compare on-disk content to source-of-truth.

Trade-off: we can't distinguish user-edited from stale — both look 'diverged.'

Notifications: bundled checks fire from MaybeShowPostUpgradeBanner (post-glab-upgrade only). Remote checks fire from CheckUpdate (24h cadence).

Action: glab skills update [name] re-fetches via the registry and overwrites every installed copy. --all does all installed skills.

Config

  • notify_skill_updates (default true) — opt out
  • GLAB_NOTIFY_SKILL_UPDATES=false — env override

Test plan

  • glab skills update --help renders
  • Install glab, edit SKILL.md, run update glab → overwrites
  • Up-to-date skill → reports 'already up to date'
  • update notreal → 'not installed' error
  • update with no args/--all → flag-required error
  • Post-upgrade banner shows bundled-skill line when divergent
  • check-update shows remote-skill line when divergent
  • notify_skill_updates=false and GLAB_NOTIFY_SKILL_UPDATES=false suppress both

Merge request reports