docs: Finalize TypeScript skill 0.2.1 for published runtime 0.3.5

README.ja.md

@@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes
 
 状態が `queued`（キュー登録済み）または `submitted`（送信済み）でも、受信側がメッセージを消費したことは確認できません。送信結果が不明な場合は自動で再送しないでください。Codex の返信待ちは利用ガイドを参照してください。
 
-npm 版 TypeScript ランタイムには、別の `session-peer-ts` スキル 0.2.0 を使います。ランタイム 0.3.3 は、このスキルのメタデータを認識します。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。
+別の `session-peer-ts` スキル 0.2.1 のメタデータプロファイルは、公開済み npm ランタイム 0.3.5 がサポートしています。公開された内容が固定されたスキルリリースを選び、記録されたソースコミットとコンテンツハッシュを確認してください。ランタイムの公開はスキルの公開や更新を意味せず、インストールの許可も与えません。エージェント、プロジェクト/グローバルの適用範囲、レビュー済みコミットを指定したインストール手順は [TypeScript 設定ガイド](docs/typescript.md)を参照してください。
 
 ## ドキュメント
 

README.ko.md

@@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes
 
 `queued` 또는 `submitted` 상태는 수신자가 메시지를 처리했다는 확인이 아닙니다. 제출 결과가 불확실한 경우 자동으로 재전송하지 마세요. Codex 회신 대기 절차는 사용 안내를 참고하세요.
 
-npm TypeScript 런타임에는 별도의 `session-peer-ts` 스킬 0.2.0을 사용합니다. 런타임 0.3.3은 이 스킬의 메타데이터를 인식합니다. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다.
+별도의 `session-peer-ts` 스킬 0.2.1 메타데이터 프로필은 공개 npm 런타임 0.3.5가 지원합니다. 공개된 불변 스킬 릴리스를 선택하고 기록된 소스 커밋과 콘텐츠 해시를 확인하세요. 런타임 발행은 스킬을 발행하거나 업데이트하지 않으며 스킬 설치 권한도 부여하지 않습니다. 에이전트, 프로젝트 또는 전역 설치 범위, 검토된 커밋을 명시하는 설치 방법은 [TypeScript 설정 안내](docs/typescript.md)를 참고합니다.
 
 ## 문서
 

README.md

@@ -46,7 +46,7 @@ The runtime command above is for pipx installations; keep using your existing ru
 
 A `queued` or `submitted` status does not confirm that the recipient consumed the message. Do not automatically resend after an uncertain submission; see the usage guide for Codex reply waiting.
 
-The separate `session-peer-ts` skill 0.2.0 supports the npm TypeScript runtime; runtime 0.3.3 accepts its metadata profile. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation.
+The separate `session-peer-ts` skill 0.2.1 has a metadata profile supported by published npm runtime 0.3.5. Select a published immutable skill release and verify its recorded source commit and content hash. Runtime publication does not publish or update the skill or authorize its installation. See the [TypeScript setup guide](docs/typescript.md) for an explicit agent, project/global scope, and reviewed commit installation.
 
 ## Docs
 

README.zh-CN.md

@@ -46,7 +46,7 @@ npx -y skills@latest update session-peer --global --yes
 
 `queued` 或 `submitted` 状态不代表接收方已消费该消息。提交结果不确定时不要自动重发。Codex 回复等待流程请参阅使用指南。
 
-npm TypeScript 运行时使用独立的 `session-peer-ts` 技能 0.2.0。运行时 0.3.3 可识别此技能的元数据。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。
+独立的 `session-peer-ts` 技能 0.2.1 元数据配置由已发布的 npm 运行时 0.3.5 支持。请选择已发布且不可变的技能版本，并核对其记录的源码提交和内容哈希。发布运行时不会发布或更新技能，也不代表获准安装技能。指定智能体、项目/全局适用范围和经审查提交版本的安装步骤，请参阅 [TypeScript 设置指南](docs/typescript.md)。
 
 ## 文档
 

docs/typescript.md

@@ -2,30 +2,32 @@
 
 [Back to README](../README.md)
 
-The separate `session-peer-ts` skill 0.2.0 describes the published npm TypeScript runtimes 0.3.3 and 0.3.4. The 0.3.4 publication source is [`afed4a5a8945012faf1b23d52cffecb70470a5b3`](https://github.com/abruption/session-peer-ts/blob/afed4a5a8945012faf1b23d52cffecb70470a5b3/RELEASING.md). The runtime runs without Python. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use.
+The separate `session-peer-ts` skill 0.2.1 documents the npm TypeScript runtime and its independently versioned metadata profile. Published runtime 0.3.5 supports this exact profile; its guard source is [`a2057940ba19056fcaaa5551a7820f7414bd3bfa`](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts), with a separate [runtime publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5). Runtime publication does not publish, install, update or authorize adoption of the skill. Select a separately approved, published immutable skill release and its recorded source/hash as described below. Both runtimes use the command name `session-peer`, so resolve the intended executable and inspect its version and help before use. The TS runtime runs without Python.
 
 ## Published support and independent versions
 
-Published 0.2.0 added combined listing, bounded known Codex homes, guarded live-writer selection, explicit inactive queueing, read-only doctor, and explicit text output. Published 0.3.0 added multi-host SSH, constrained SSH options and a POSIX jump option, Tailscale routing hints, generated reply routes, opt-in return-route diagnostics, npm update checks and cached notices, and the optional shell `sp` alias. Runtime 0.3.3 adds the bounded metadata reader and supports this skill's successor profile. Always check the selected executable's actual version and supported command help. Wake, Antigravity, Relay, MCP, general wait, and Draft 0.4 handoff/observer designs remain unsupported.
+Published 0.2.0 added combined listing, bounded known Codex homes, guarded live-writer selection, explicit inactive queueing, read-only doctor, and explicit text output. Published 0.3.0 added multi-host SSH, constrained SSH options and a POSIX jump option, Tailscale routing hints, generated reply routes, opt-in return-route diagnostics, npm update checks and cached notices, and the optional shell `sp` alias. Runtime 0.3.3 adds the bounded metadata reader and supports the published skill 0.2.0 profile; public 0.3.4 retains that support. Always check the selected executable's actual version and supported command help. Wake, Antigravity, Relay, MCP, general wait, and Draft 0.4 handoff/observer designs remain unsupported.
 
 | Version | Meaning |
 |---|---|
-| Python repository tag `v0.3.2` | Independent Python skill release |
-| Python skill `0.3.2` | Version of `session-peer/SKILL.md` |
-| TS skill `0.2.0` | Version of `session-peer-ts/SKILL.md` |
-| TS skill tag `session-peer-ts-v0.2.0` | Separate TS skill release; resolve its annotated tag to the exact commit recorded in the release |
-| TS runtimes `0.3.3` and `0.3.4` | Published npm package `session-peer`; independent of both skill versions |
+| Python repository tag `v0.3.3` | Independent published Python skill release |
+| Python skill `0.3.3` | Independent version of `session-peer/SKILL.md` |
+| TS skill `0.2.1` | Version declared by `session-peer-ts/SKILL.md`; metadata alone is not publication evidence |
+| Historical TS skill `0.2.0` | Separately published revision from 2026-10-09 |
+| Historical tag `session-peer-ts-v0.2.0` | Its 2026-10-09 release records source `8482cf644507c682915e35c85aa3384c53864906`; this is not a pin for revision 0.2.1 |
+| Revision tag `session-peer-ts-v0.2.1` | Verify a published, approved release and its recorded source/hash before selecting it; a tag name or PR head alone is insufficient |
+| TS runtimes `0.3.3`, `0.3.4` and `0.3.5` | Published npm package `session-peer`; independent of both skill versions |
 | `runtime-min-version` = `0.1.0` | CLI compatibility floor for the explicit baseline commands |
 | `runtime-full-version` = `0.3.2` | Coverage reference for this revision's published CLI features |
-| Successor doctor acceptance | Runtimes `0.3.3` and `0.3.4` accept this exact metadata profile; public `0.3.2` rejects it |
+| Skill doctor acceptance | Published runtime `0.3.5` explicitly accepts skill `0.2.1`; public `0.3.2`, `0.3.3` and `0.3.4` reject it |
 
 The minimum and full values are distinct from security recommendations, latest-version markers, doctor support, and delivery/ACK. Help establishes option presence only; platform/native prerequisites, permissions, allowlists, and writer guards still apply. See the [normative min/full definitions and separate doctor acceptance table](typescript-compatibility.md#minimum-full-features-and-guard-acceptance).
 
-Use reviewed runtime 0.3.3 or 0.3.4 for doctor metadata compatibility with TS skill 0.2.0. Public 0.3.2 rejects the successor even though it meets the baseline CLI minimum and feature coverage values. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization.
+For the published skill 0.2.0, reviewed runtimes 0.3.3 and 0.3.4 support doctor metadata inspection. Skill 0.2.1 is different: public runtimes 0.3.2/0.3.3/0.3.4 reject it even when they meet its CLI minimum/full coverage values. Published runtime 0.3.5 explicitly supports this profile; skill publication and adoption still require separate approval. The exact 0.3.5 row does not enable other future versions. Keep the existing package manager and obtain authorization before upgrading; do not edit metadata to hide a mismatch. Unknown future runtime/profile combinations are not automatically accepted. A compatible metadata check is not a content review, source authentication, freshness check, or delivery authorization.
 
 ## Install, update, and remove the skill
 
-Choose the reviewed **40-character commit SHA** from the [TS skill release](https://github.com/abruption/session-peer-skill/releases/tag/session-peer-ts-v0.2.0), agent (`codex` or `claude-code`), and scope explicitly. The release records the peeled tag commit and SHA-256 of the canonical TS `SKILL.md`. Run in the intended project; omitting `--global` selects project scope. Inspect existing files before accepting an overwrite. For global scope add `--global` consistently to add/list/remove. Codex uses the shared `.agents/skills` directory, so agent selection is not an isolation boundary from other clients that discover that directory.
+Choose the skill version, agent (`codex` or `claude-code`), and scope explicitly. Find the selected TS tag in the [skill release catalog](https://github.com/abruption/session-peer-skill/releases) and verify its approved publication, recorded peeled tag commit, and canonical TS `SKILL.md` SHA-256. For this revision, the tag name is `session-peer-ts-v0.2.1`; if its publication or source/hash record cannot be verified, stop rather than using a Draft/PR head or a guessed future pin. Replace `REVIEWED_COMMIT` below with that verified **40-character commit SHA**, and compare the copied skill bytes to the release hash. Run in the intended project; omitting `--global` selects project scope. Inspect existing files before accepting an overwrite. For global scope add `--global` consistently to add/list/remove. Codex uses the shared `.agents/skills` directory, so agent selection is not an isolation boundary from other clients that discover that directory.
 
 ```sh
 npx -y skills@1.7.0 add https://github.com/abruption/session-peer-skill/tree/REVIEWED_COMMIT/session-peer-ts \
@@ -42,7 +44,7 @@ The TS metadata uses `runtime-implementation: "typescript"` and `runtime-capabil
 
 Resolve the executable before discovery. Explicit JSON remains a safe baseline; operations have no default output format. See the [agent instructions](../session-peer-ts/SKILL.md) for discovery, dry-run, SSH, and reply boundaries, and the [published CLI help](https://github.com/abruption/session-peer-ts/blob/afed4a5a8945012faf1b23d52cffecb70470a5b3/src/help.ts) for supported flags.
 
-`doctor --json` performs read-only diagnostics; `ok:true` can coexist with `ready:false`. Skill inspection in runtimes 0.3.3 and 0.3.4 bounds whole-file UTF-8 reads to 65,536 bytes, with at most 65,537 bytes for overflow detection, and checks regular-file, descriptor/path, and observable stability evidence. It reads body bytes but interprets only frontmatter; `metadata_only` does not execute instructions, install, update, or make network requests. It does not authenticate content, freeze an atomic snapshot, or impose a deadline on arbitrary filesystem I/O. Public 0.3.2 had only a 64 KiB pre-read size check. See the [published compatibility contract and status table](typescript-compatibility.md); permission errors remain distinct from unknown input.
+`doctor --json` performs read-only diagnostics; `ok:true` can coexist with `ready:false`. Skill inspection in runtimes 0.3.3, 0.3.4 and 0.3.5 bounds whole-file UTF-8 reads to 65,536 bytes, with at most 65,537 bytes for overflow detection, and checks regular-file, descriptor/path, and observable stability evidence. It reads body bytes but interprets only frontmatter; `metadata_only` does not execute instructions, install, update, or make network requests. It does not authenticate content, freeze an atomic snapshot, or impose a deadline on arbitrary filesystem I/O. Public 0.3.2 had only a 64 KiB pre-read size check. See the [published compatibility contract and status table](typescript-compatibility.md); permission errors remain distinct from unknown input.
 
 `doctor --check-return-route` is a separate, explicitly requested SSH probe. Metadata compatibility and forward SSH reachability do not prove that a send is authorized or that a return route works.
 

scripts/test-ts-skill.mjs

@@ -10,7 +10,7 @@ const source = resolve('session-peer-ts');
 const expected = readFileSync(join(source, 'SKILL.md'), 'utf8');
 const metadata = expected.match(/^---\n([\s\S]*?)\n---/)?.[1];
 assert.ok(metadata?.includes('name: session-peer-ts'));
-for (const [key, value] of Object.entries({ version: '0.2.0', 'runtime-implementation': 'typescript', 'runtime-min-version': '0.1.0', 'runtime-full-version': '0.3.2', 'runtime-capability-policy': 'probe-help' })) {
+for (const [key, value] of Object.entries({ version: '0.2.1', 'runtime-implementation': 'typescript', 'runtime-min-version': '0.1.0', 'runtime-full-version': '0.3.2', 'runtime-capability-policy': 'probe-help' })) {
   assert.ok(metadata.includes(`  ${key}: "${value}"`), key);
 }
 try {

session-peer-ts/SKILL.md

@@ -3,7 +3,7 @@ name: session-peer-ts
 description: Discover and message Claude Code or Codex sessions using the npm TypeScript session-peer CLI, locally or over SSH. Use for user-requested cross-session messaging with the TypeScript runtime; Python runtime guidance belongs to the separate session-peer skill.
 allowed-tools: Bash, Read
 metadata:
-  version: "0.2.0"
+  version: "0.2.1"
   runtime-implementation: "typescript"
   runtime-min-version: "0.1.0"
   runtime-full-version: "0.3.2"
@@ -24,12 +24,19 @@ Python uses that command name too: if the marker is absent, select the Python sk
 which installation the user intends. Keep the resolved executable for every
 following command; do not replace another manager's launcher.
 
-This skill revision is 0.2.0 and covers the published npm 0.3.3 and 0.3.4 runtimes. Its CLI
-minimum is 0.1.0; its full-feature coverage reference is 0.3.2. The original 0.1.0
-supports only the historical baseline below. Runtimes 0.3.3 and 0.3.4 doctor accept this
-exact successor metadata profile; public 0.3.2 doctor rejects it even though the
-baseline CLI commands work. For supported doctor metadata inspection, use reviewed 0.3.3 or 0.3.4;
-an upgrade still requires the user's request and the existing package manager.
+This skill revision is 0.2.1, retaining the documented public CLI features
+through npm runtime 0.3.4. Its CLI minimum is 0.1.0; its full-feature coverage
+reference is 0.3.2. The original 0.1.0 supports only the historical baseline
+below. Public runtimes 0.3.2, 0.3.3 and 0.3.4 doctor reject this exact metadata
+profile even when baseline commands work. Published runtime 0.3.5 explicitly
+accepts it; use that reviewed runtime for doctor inspection, without inferring
+support from a larger version number. Its [exact guard source](https://github.com/abruption/session-peer-ts/blob/a2057940ba19056fcaaa5551a7820f7414bd3bfa/src/skill-metadata.ts)
+and [publication record](https://github.com/abruption/session-peer-ts/releases/tag/v0.3.5)
+are separate from this skill's release and do not authorize installation or
+sending. Adopt only a separately approved immutable skill release and its
+recorded source pin. Runtime publication does not publish or install this
+skill. Any upgrade still requires the user's request and the existing package
+manager.
 Do not change metadata to silence an incompatibility. The skill version, npm version, and Python skill/repository
 tag are independent. Unknown versions or contradictory help require review
 before using an unverified operation; do not infer features from Python's
@@ -104,7 +111,7 @@ Skill checks report structural metadata compatibility, not freshness, authentic
 source, functional verification, or message readiness. `verification: metadata_only`
 means skill instructions/references are not executed and the skill check does
 not install, update, or make network requests. It is not a privacy guarantee
-that body bytes are unread. Runtimes 0.3.3 and 0.3.4 bound whole-file UTF-8 reads to 65,536
+that body bytes are unread. Runtimes 0.3.3, 0.3.4 and 0.3.5 bound whole-file UTF-8 reads to 65,536
 bytes, with a 65,537-byte overflow-detection buffer, and check regular-file,
 descriptor/path, and observable stability evidence before interpreting metadata.
 It does not authenticate content, freeze an atomic snapshot, protect against a