[wip] Postinstall script to (re)mount the skill on npm package installation

CLAUDE.md

@@ -125,3 +125,8 @@ JSON output mode (`--format json`) is **not** affected — `JSON.stringify` enco
 | `LINK_API_BASE_URL` | Override API base URL |
 | `LINK_AUTH_BASE_URL` | Override auth base URL |
 | `LINK_HTTP_PROXY` | Route all SDK requests through an HTTP proxy (requires `undici` installed) |
+| `LINK_CLI_SKIP_SKILL_INSTALL` | Skip the `postinstall` skill refresh (see below). Also skipped when `CI` is set. |
+
+## Skill Reinstall on Upgrade
+
+`packages/cli/postinstall.mjs` runs on every npm install/upgrade of `@stripe/link-cli` (via the `postinstall` script). It delegates to `npx --yes skills add stripe/link-cli` to refresh the `create-payment-credential` skill so it stays in sync with the installed CLI version, printing a one-line notice. It never fails the install (always exits 0), and is skipped when run from the source tree (not under `node_modules`), in CI, or when `LINK_CLI_SKIP_SKILL_INSTALL` is set.

README.md

@@ -29,6 +29,8 @@ Install the skill:
 npx skills add stripe/link-cli
 ```
 
+Installing or upgrading `@stripe/link-cli` via npm re-runs this automatically (through a `postinstall` hook) so the skill file stays in sync with the CLI. Set `LINK_CLI_SKIP_SKILL_INSTALL=1` to opt out; it is also skipped in CI.
+
 By default when called from an agent (non-TTY), all commands use `toon` output — a compact, LLM-friendly text format. All commands accept `--format [format]` for structured output. Other formats: `json`, `yaml`, `md`, `jsonl`.
 
 List available commands:

packages/cli/package.json

@@ -8,6 +8,7 @@
   "files": [
     "dist",
     "!dist/sea",
+    "postinstall.mjs",
     "README.md",
     "LICENSE"
   ],
@@ -24,6 +25,7 @@
   "scripts": {
     "build": "tsup",
     "build:sea": "tsup --config tsup.sea.config.ts",
+    "postinstall": "node postinstall.mjs",
     "prepack": "cp ../../README.md ../../LICENSE .",
     "typecheck": "tsc",
     "test": "vitest run",

packages/cli/postinstall.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+// Refresh the create-payment-credential skill whenever the CLI is (re)installed
+// or upgraded via npm. Delegates to the openclaw `skills` CLI so the skill file
+// stays in sync with the installed CLI version. Must never fail the install.
+
+import { spawnSync } from 'node:child_process';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const REPO = 'stripe/link-cli';
+
+function run() {
+  // Skip when running from the source monorepo (dev `pnpm install`). Installed
+  // copies live under node_modules; the dev tree does not.
+  if (!fileURLToPath(import.meta.url).includes('node_modules')) {
+    return;
+  }
+
+  if (process.env.CI || process.env.LINK_CLI_SKIP_SKILL_INSTALL) {
+    return;
+  }
+
+  process.stdout.write(
+    'link-cli: refreshing the create-payment-credential skill…\n',
+  );
+
+  const result = spawnSync('npx', ['--yes', 'skills', 'add', REPO], {
+    stdio: 'inherit',
+    timeout: 60_000,
+  });
+
+  if (result.error || result.status !== 0) {
+    process.stdout.write(
+      `link-cli: skipped skill refresh; run 'npx skills add ${REPO}' manually.\n`,
+    );
+  }
+}
+
+try {
+  run();
+} catch {
+  // Never fail the install.
+}
+
+process.exit(0);