feat(cli): show author and source after run and install

[harlan-zw]

What

From any CLI surface that shows a Skill, the user reaches the exact SKILL.md in the author's Repository in one click (VISION principle 1, rebrand plan Workstream 2).

• skilld run: after the transient notice, a headline name · owner/repository @ commit, and Read it first: <SKILL.md URL at that commit> after the source status caution. Also on --file reads.
• skilld install: the same block, plus Source status and its plain meaning for verified, local, and unverified. Replaces the bare "Review the unverified Skill before use." hint.
• skilld search: owner/repository before the star count (human, --plain, --json).
• skilld view: the Source link now points at the exact SKILL.md, not the Repository root.
• --json for run: origin gains owner, repository, skillPath, commit, sourceUrl. sourceStatus was already present.

Host::install and Host::install_request return InstalledSkill (name, locked source, source status) instead of bare names.

Real output

Built from this branch and run against skilld-dev/skills. The hosted path (skilld:skilld-dev/skills/find-skill) returned RESOLUTION_TIMEOUT from skilld.dev during capture, so the capture below uses --direct. The verified variant is covered by tests (cli_install_shows_the_author_the_source_status_and_the_exact_skill_file).

skilld run github:skilld-dev/skills/skills/find-skill --direct --plain

skilld loaded the transient Skill find-skill for this session.
skilld retained no Skill files.
It created no lockfile entry, Agent target, or project file.
find-skill · skilld-dev/skills @ 806d812
Source: github:skilld-dev/skills/skills/find-skill
Revision: 806d812729d24cbd3b504aeb7fdcb3e1f71ca031
Source status: unverified
skilld did not check this source. Read this Skill before you follow it.
Read it first: https://github.com/skilld-dev/skills/blob/806d812729d24cbd3b504aeb7fdcb3e1f71ca031/skills/find-skill/SKILL.md

--- SKILL.md ---
...

skilld install github:skilld-dev/skills/skills/find-skill --direct --agent codex --plain

Installed Skill find-skill.
find-skill · skilld-dev/skills @ 806d812
Source: github:skilld-dev/skills/skills/find-skill
Source status: unverified
skilld did not check this source. Read this Skill before you follow it.
Read it first: https://github.com/skilld-dev/skills/blob/806d812729d24cbd3b504aeb7fdcb3e1f71ca031/skills/find-skill/SKILL.md

skilld search vue --plain (first rows)

vue	skilld:antfu/skills/vue	antfu/skills	5822	Vue 3 Composition API, ...
vue-testing-best-practices	skilld:antfu/skills/vue-testing-best-practices	antfu/skills	5822	Use for Vue.js testing. ...
vueuse-functions	skilld:vueuse/skills/vueuse-functions	vueuse/skills	385	Apply VueUse composables ...

skilld run ... --direct --json (origin only)

{
  "_tag": "remote",
  "source": "github:skilld-dev/skills/skills/find-skill",
  "direct": true,
  "owner": "skilld-dev",
  "repository": "skills",
  "skillPath": "skills/find-skill",
  "commit": "806d812729d24cbd3b504aeb7fdcb3e1f71ca031",
  "sourceUrl": "https://github.com/skilld-dev/skills/blob/806d812729d24cbd3b504aeb7fdcb3e1f71ca031/skills/find-skill/SKILL.md"
}

The URL returns HTTP 200.

Gaps

• The Artifact wire contract carries no author, licence, or source updated time (ResolvedSource has owner, repository, commitSha, skillPath only). The GitHub owner stands in for the author. The Updated ... · MIT line from the plan is omitted rather than faked. Adding those fields to the contract is a follow-up.
• skilld install has no --json mode today; that is unchanged. --plain prints the lines without styling.
• JSON uses repository, not repo, to match SourceRequest and the glossary.

Tests

New: a_remote_run_names_the_author_and_links_the_exact_skill_file, a_remote_file_read_links_the_exact_skill_file, cli_install_shows_the_author_the_source_status_and_the_exact_skill_file. Updated the install, search, view link, and native probe expectations for the new lines. cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings, and cargo fmt --check pass.

Written with Claude Code.

https://claude.ai/code/session_018T67Ndp8FAjnHWthXABbJW

[harlan-github-agent]

🤖 READY · 88/100

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. A person still decides the merge.

• Merge gate: Passed.
• Review gate: Passed. No material issues.
• CI gate: Passed.