feat(cli): add skill packs (design, process, behavior) with pinned, verified installs

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Set version in package.json
         env:
           VERSION: ${{ inputs.version }}
-        run: npm version "$VERSION" --no-git-tag-version
+        run: npm version "$VERSION" --no-git-tag-version --allow-same-version
         working-directory: cli-tool
 
       - name: Install dependencies

AGENTS.md

@@ -8,11 +8,13 @@ This is a Node.js/TypeScript project providing an open-source collection of agen
 - `templates/agents/` -- 108 agent markdown definitions organized by category
 - `templates/skills/` -- 15 skill definitions (each in `<name>/SKILL.md`)
 - `templates/configs/` -- 5 opencode.json preset configurations
+- `templates/packs/` -- skill packs (design, process, behavior): `sources.lock.json` + bundled skills/commands, imported from weisser-dev/agentic-skills via `cli-tool/scripts/import-packs.js`; never edit by hand
 - `cli-tool/` -- The `@weisser-dev/awesome-opencode` npm package
   - `cli-tool/src/index.js` -- Entry point, flow control, re-run detection
   - `cli-tool/src/setup.js` -- Core logic: detection, prompts, model intelligence, file generation (~1800 lines)
   - `cli-tool/templates/` -- Bundled copy of templates for npm distribution
   - `cli-tool/scripts/sync-templates.js` -- Pre-publish script to sync templates from repo root
+  - `cli-tool/src/lib/packs.js` / `packs-cli.js` -- skill pack installer (pinned sources, sha256 verification, no execution)
 
 ## Architecture
 

CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-10-03
+
+### Added
+
+- **Skill packs** (`awesome-opencode packs`, alias `design-pack`, menu entry "Install skill packs", `configure packs`, optional step at the end of the full setup):
+  - `design`: frontend design skills (taste skills, image-to-code, DESIGN.md references, web interface review with vendored Web Interface Guidelines, local Playwright checks, `design-workflow`).
+  - `process`: 23 engineering lifecycle skills and the commands `/spec` `/plan` `/build` `/test` `/constraints` `/review` `/webperf` `/code-simplify` `/ship`.
+  - `behavior` (opt-in, never part of `all`): ponytail minimal-code mode.
+  - Options: `--pack design|process|behavior|all`, `--global`, `--only`, `--all`, `--list`, `--dry-run`, `--force`.
+- `templates/packs/sources.lock.json`: every upstream source pinned to a reviewed commit with license data and per-file sha256; imported from weisser-dev/agentic-skills with `scripts/import-packs.js`.
+- Tests for lock integrity, bundled file provenance, run-time network patterns, selection, URL safety, idempotent install, refusal of locally modified items, backups and sha256 mismatch handling.
+
+### Security
+
+- Pack items are copied from the package or downloaded only from `raw.githubusercontent.com` at the pinned commit; every file is verified against its sha256 pin before anything is written. No upstream scripts, hooks, plugins or MCP servers are installed or executed.
+- Third-party skills that fetched rules or docs at run time, hotlinked assets, installed tools, used external APIs/model CLIs or pushed/deployed without confirmation are shipped as reviewed, adapted copies or excluded (details in each skill's `UPSTREAM.md`).
+
+### Changed
+
+- Release workflow accepts a version that is already set in `package.json` (`npm version --allow-same-version`).
+
 ## [1.4.0] - 2026-03-30
 
 ### Added

README.md

@@ -2,7 +2,7 @@
 
 The most comprehensive collection of agents, skills, and tooling for [OpenCode](https://opencode.ai) -- the open-source AI coding agent.
 
-**108 agents** | **15 skills** | **18 curated MCP servers** | **Live MCP registry search** | **Smart model detection**
+**108 agents** | **15 skills** | **3 skill packs** | **18 curated MCP servers** | **Live MCP registry search** | **Smart model detection**
 
 > Inspired by [VoltAgent/awesome-claude-code-subagents](https://github.com/VoltAgent/awesome-claude-code-subagents), fully adapted for OpenCode with permissions, skills, and markdown agent format.
 
@@ -22,7 +22,7 @@ One command. It analyzes your project, walks you through agent/skill/model/MCP s
 
 ```shell
   Awesome OpenCode
-  108 agents, 15 skills, smart model config
+  108 agents, 15 skills, 3 skill packs, smart model config
   https://github.com/weisser-dev/awesome-opencode
 
 ? How would you like to set up your project?
@@ -126,7 +126,7 @@ On **re-run**, it remembers your setup:
 
 ```shell
   Awesome OpenCode
-  108 agents, 15 skills, smart model config
+  108 agents, 15 skills, 3 skill packs, smart model config
   https://github.com/weisser-dev/awesome-opencode
 
   Already configured!
@@ -351,6 +351,60 @@ On **re-run**, it remembers your setup:
 | `error-triage` | Stack trace parsing and root cause classification |
 | `performance-profile` | Performance hotspot analysis and optimization plan |
 
+### Skill Packs (design / process / behavior)
+
+Reviewed third-party skill collections, adapted for local use and pinned to exact upstream
+commits. Source of truth, review notes and adaptation tooling:
+[weisser-dev/agentic-skills](https://github.com/weisser-dev/agentic-skills/tree/main/packs).
+
+| Pack | Contents | In `--pack all` |
+|------|----------|-----------------|
+| `design` | Frontend design: `design-workflow`, `web-design-guidelines` (vendored Web Interface Guidelines), taste skills (`design-taste-frontend`, `redesign-existing-projects`, `minimalist-ui`, `high-end-visual-design`, `industrial-brutalist-ui`), `image-to-code`, `design-md-reference` (72 DESIGN.md references), `playwright-cli` (local screenshots); opt-in: `gpt-taste`, `full-output-enforcement` | yes |
+| `process` | 23 engineering lifecycle skills + commands `/spec` `/plan` `/build` `/test` `/constraints` `/review` `/webperf` `/code-simplify` `/ship` (from addyosmani/agent-skills, adapted) | yes |
+| `behavior` | `ponytail` minimal-code mode (+ review/audit/debt/help) | no, opt-in |
+
+```bash
+npx @weisser-dev/awesome-opencode packs --list               # packs and items
+npx @weisser-dev/awesome-opencode packs --dry-run            # plan for the design pack
+npx @weisser-dev/awesome-opencode packs                      # design pack -> ./.opencode/skills
+npx @weisser-dev/awesome-opencode packs --pack all           # design + process (skills + commands)
+npx @weisser-dev/awesome-opencode packs --pack behavior      # ponytail, only if you want it
+npx @weisser-dev/awesome-opencode packs --pack all --global  # ~/.config/opencode/{skills,commands}
+npx @weisser-dev/awesome-opencode design-pack                # alias for "packs --pack design"
+```
+
+The interactive menu offers the same under **Install skill packs**, and the full setup asks once
+at the end. Skills go to `.opencode/skills/<name>/SKILL.md` (or `~/.config/opencode/skills/`),
+commands to `.opencode/commands/<name>.md` (or `~/.config/opencode/commands/`), the locations
+OpenCode scans. Re-running is safe: unchanged items are skipped; items you edited are only
+replaced with `--force` (the old version is kept in `.agentic-pack-backups/`).
+
+Notes: the ponytail figures (fewer lines, lower cost) are the upstream author's own benchmarks
+and the mode can reduce thoroughness, so it is never installed by default. `playwright-cli` needs
+`@playwright/cli` as a pinned dev dependency of your project
+(`npm install --save-dev --save-exact @playwright/cli@0.1.22`); the skill never installs it.
+
+#### Security model
+
+- Bundled items (our own skills and the reviewed, adapted copies) are copied from the package; no network.
+- The few items that are installed unmodified from upstream (two taste skills, the opt-in output skill,
+  the DESIGN.md references, four ponytail skills) are downloaded only from
+  `raw.githubusercontent.com` for the repository and commit pinned in
+  `templates/packs/sources.lock.json`, and every file must match its sha256 pin before anything is written.
+- Nothing is executed: no upstream scripts, hooks, plugins or MCP servers are installed.
+- Installed skills and commands do not fetch anything, call external services or install tools at run time;
+  pushes, deploys and migrations need an explicit instruction.
+- No other sources are added without an explicit owner decision and a new review.
+
+| Source | License | Pinned commit |
+|--------|---------|---------------|
+| [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill) | MIT | `ce26fc25` |
+| [vercel-labs/web-interface-guidelines](https://github.com/vercel-labs/web-interface-guidelines) | MIT | `e3d624ba` |
+| [VoltAgent/awesome-design-md](https://github.com/VoltAgent/awesome-design-md) | MIT | `f6961238` |
+| [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli) | Apache-2.0 | `b85c7a73` |
+| [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills) | MIT | `a06bc63b` |
+| [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail) | MIT | `c982cd41` |
+
 ### Smart Model Detection
 
 The CLI recognizes models from **any provider** -- including custom Bedrock, Azure, or self-hosted endpoints:
@@ -426,6 +480,9 @@ awesome-opencode configure agents     # Add/remove agents
 awesome-opencode configure skills     # Add/remove skills
 awesome-opencode configure models     # Change model strategy
 awesome-opencode configure mcp        # Add/remove MCP servers
+awesome-opencode configure packs      # Choose and install skill packs interactively
+awesome-opencode packs [options]      # Install skill packs (see "Skill Packs")
+awesome-opencode design-pack          # Same as "packs --pack design"
 awesome-opencode --help               # Show help
 ```
 
@@ -581,13 +638,15 @@ awesome-opencode/
     agents/                    # 108 agent definitions (.md)
     skills/                    # 15 skill definitions (SKILL.md)
     configs/                   # 5 opencode.json presets
+    packs/                     # skill packs: sources.lock.json + bundled skills/commands
   cli-tool/                    # @weisser-dev/awesome-opencode
     src/
       index.js                 # Entry point and flow control
       setup.js                 # Detection, prompts, generation (~1800 lines)
     templates/                 # Bundled copy for npm package
     scripts/
       sync-templates.js        # Pre-publish template sync
+      import-packs.js          # Import packs from a weisser-dev/agentic-skills checkout
     package.json
 ```
 
@@ -603,6 +662,7 @@ This project builds on the work of several open-source communities:
 - **[pricepertoken.com](https://pricepertoken.com/leaderboards/coding)** -- Model benchmark rankings and pricing data for the model intelligence feature.
 - **[models.dev](https://models.dev)** -- Open-source database of AI models (by anomalyco). Model fingerprints sourced from here.
 - **[registry.modelcontextprotocol.io](https://registry.modelcontextprotocol.io)** -- Official MCP server registry API for live search.
+- **Skill packs** -- [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill), [vercel-labs/web-interface-guidelines](https://github.com/vercel-labs/web-interface-guidelines), [VoltAgent/awesome-design-md](https://github.com/VoltAgent/awesome-design-md), [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli), [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills), [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail); license texts ship with each skill.
 
 ## Also by weisser-dev
 

cli-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weisser-dev/awesome-opencode",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Interactive CLI to set up OpenCode best practices: agents, skills, model optimization, and configs",
   "type": "module",
   "bin": {

cli-tool/scripts/import-packs.js

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+
+/**
+ * Import the skill packs from a weisser-dev/agentic-skills checkout into templates/packs/.
+ *
+ *   node scripts/import-packs.js /path/to/agentic-skills
+ *
+ * agentic-skills is the source of truth (review, adaptation, lock file). This copies the lock
+ * file and every item that lives in that repository (kinds local, vendored, derived) plus the
+ * wrapper folders. Items of kind "fetch" are not copied: the CLI fetches them at install time
+ * from the pinned commits. Run `node scripts/sync-templates.js` afterwards.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..', '..');
+const dest = path.join(repoRoot, 'templates', 'packs');
+
+const src = process.argv[2];
+if (!src || !fs.existsSync(path.join(src, 'packs', 'sources.lock.json'))) {
+  console.error('Usage: node scripts/import-packs.js /path/to/agentic-skills');
+  process.exit(1);
+}
+
+const lock = JSON.parse(fs.readFileSync(path.join(src, 'packs', 'sources.lock.json'), 'utf8'));
+
+fs.rmSync(dest, { recursive: true, force: true });
+fs.mkdirSync(dest, { recursive: true });
+
+function copy(from, to) {
+  const stat = fs.statSync(from);
+  if (stat.isDirectory()) {
+    fs.mkdirSync(to, { recursive: true });
+    for (const entry of fs.readdirSync(from)) copy(path.join(from, entry), path.join(to, entry));
+  } else {
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.copyFileSync(from, to);
+  }
+}
+
+const copied = new Set();
+for (const item of lock.items) {
+  if (item.wrapper) {
+    const rel = item.wrapper.replace(/^packs\//, '');
+    copy(path.join(src, item.wrapper), path.join(dest, rel));
+    item.wrapper = rel;
+  }
+  if (['local', 'vendored', 'derived'].includes(item.kind)) {
+    // commands share one folder (with UPSTREAM.md and the license file)
+    const rel = item.type === 'command' ? path.dirname(item.path) : item.path;
+    if (!copied.has(rel)) {
+      copy(path.join(src, rel), path.join(dest, rel));
+      copied.add(rel);
+    }
+  }
+}
+
+fs.writeFileSync(path.join(dest, 'sources.lock.json'), JSON.stringify(lock, null, 2) + '\n');
+console.log(`Imported ${lock.items.length} pack items (${copied.size} local folders) into ${dest}`);

cli-tool/src/index.js

@@ -3,16 +3,21 @@
 import path from 'path';
 import fs from 'fs';
 import { intro, checkExistingSetup, detectProject, promptAgents, promptSkills, promptModels, promptMcp, promptMcpSearch, promptCostControl, generateFiles, promptAgentsMd, outro, launchOpenCode } from './setup.js';
+import { runPacksCommand, promptAndInstallPacks, PACKS_HELP } from './lib/packs-cli.js';
 
 // ── Parse flags ─────────────────────────────────────────────────────────────
 
 const rawArgs = process.argv.slice(2);
 const flags = {};
 const positional = [];
+const packArgs = [];
+const PACK_COMMANDS = new Set(['packs', 'design-pack']);
 
 for (let i = 0; i < rawArgs.length; i++) {
   const arg = rawArgs[i];
-  if (arg === '--skipSSL' || arg === '--skip-ssl') {
+  if (PACK_COMMANDS.has(positional[0]) && !['--skipSSL', '--skip-ssl', '--crt', '--config'].includes(arg)) {
+    packArgs.push(arg);  // options of the packs command are parsed in lib/packs-cli.js
+  } else if (arg === '--skipSSL' || arg === '--skip-ssl') {
     flags.skipSSL = true;
   } else if (arg === '--config' && rawArgs[i + 1]) {
     flags.configPath = path.resolve(rawArgs[++i]);
@@ -53,6 +58,13 @@ if (flags.configPath) {
 
 async function main() {
   try {
+    if (PACK_COMMANDS.has(command)) {
+      intro();
+      // design-pack = packs with the design pack preselected (kept as a short alias)
+      await runPacksCommand(packArgs, { defaultPacks: ['design'] });
+      return;
+    }
+
     if (flags.help) {
       showHelp();
       return;
@@ -94,6 +106,9 @@ function showHelp() {
     awesome-opencode configure skills   Add/remove skills
     awesome-opencode configure models   Change model strategy
     awesome-opencode configure mcp      Add/remove MCP servers
+    awesome-opencode configure packs    Choose and install skill packs interactively
+    awesome-opencode packs [options]    Install skill packs (design, process, behavior)
+    awesome-opencode design-pack        Same as "packs --pack design"
 
   Flags:
     --help, -h                          Show this help
@@ -113,6 +128,7 @@ function showHelp() {
 
   Docs: https://github.com/weisser-dev/awesome-opencode
 `);
+  console.log(PACKS_HELP);
 }
 
 async function handleExistingSetup(existing) {
@@ -163,6 +179,7 @@ async function handleExistingSetup(existing) {
     { name: 'Configure skills', value: 'configure-skills' },
     { name: 'Configure models', value: 'configure-models' },
     { name: 'Configure MCP servers', value: 'configure-mcp' },
+    { name: 'Install skill packs (design / process / behavior)', value: 'configure-packs' },
     { name: 'Exit', value: 'exit' },
   ];
 
@@ -193,11 +210,19 @@ async function handleExistingSetup(existing) {
     case 'configure-mcp':
       await handleConfigure('mcp');
       break;
+    case 'configure-packs':
+      await promptAndInstallPacks();
+      break;
     // exit: just return
   }
 }
 
 async function handleConfigure(what) {
+  if (what === 'packs') {
+    await promptAndInstallPacks();
+    outro();
+    return;
+  }
   const project = await detectProject({ configPath: flags.configPath });
 
   switch (what) {
@@ -243,6 +268,10 @@ async function runFullSetup() {
   const costControl = await promptCostControl(agents);
 
   await generateFiles({ project, agents, skills, modelConfig, mcpConfig, mcpSearchResults, costControl });
+  const { confirm } = await import('@inquirer/prompts');
+  if (await confirm({ message: 'Install skill packs (design / process / behavior)?', default: false })) {
+    await promptAndInstallPacks();
+  }
   await promptAgentsMd({ project, agents, skills, modelConfig });
   outro();
   await launchOpenCode({ flags });