Use npm packages for shared skill code (#136)

docs/publishing.md

@@ -21,21 +21,24 @@ bash scripts/sync-clawhub.sh           # sync all skills
 bash scripts/sync-clawhub.sh <skill>   # sync one skill
 ```
 
-Release hooks are configured via `.releaserc.yml`. This repo does not stage a separate release directory: release prep only syncs `packages/` into each skill's committed `scripts/vendor/`, and publish reads the skill directory directly.
+Release hooks are configured via `.releaserc.yml`. This repo does not stage a separate release directory: release prep verifies that skills depend on published npm package versions, and publish reads the skill directory directly.
 
 ## Shared Workspace Packages
 
-`packages/` is the **only** source of truth. Never edit `skills/*/scripts/vendor/` directly.
+`packages/` is the **only** source of truth for shared runtime code. Publish shared packages to npm and reference them from skill script `package.json` files with semver ranges. Do not vendor shared packages into `skills/*/scripts/vendor/`.
 
 Current packages:
-- `baoyu-chrome-cdp` (Chrome CDP utilities), consumed by 6 skills (`baoyu-danger-gemini-web`, `baoyu-danger-x-to-markdown`, `baoyu-post-to-wechat`, `baoyu-post-to-weibo`, `baoyu-post-to-x`, `baoyu-url-to-markdown`)
+- `baoyu-chrome-cdp` (Chrome CDP utilities), consumed by 5 skills (`baoyu-danger-gemini-web`, `baoyu-danger-x-to-markdown`, `baoyu-post-to-wechat`, `baoyu-post-to-weibo`, `baoyu-post-to-x`)
 - `baoyu-md` (shared Markdown rendering and placeholder pipeline), consumed by 3 skills (`baoyu-markdown-to-html`, `baoyu-post-to-wechat`, `baoyu-post-to-weibo`)
+- `baoyu-fetch` (URL-to-Markdown CLI), consumed by 1 skill (`baoyu-url-to-markdown`)
 
-**How it works**: Sync script copies packages into each consuming skill's `vendor/` directory and rewrites dependency specs to `file:./vendor/<name>`. Vendor copies are committed to git, making skills self-contained.
+**How it works**: npm packages are built from `packages/` and published to the public npm registry. Skills depend on those packages with `^<version>` specs. Release prep runs `node scripts/verify-shared-package-deps.mjs` so `file:` dependencies and vendored workspace packages cannot slip back in.
 
 **Update workflow**:
 1. Edit package under `packages/`
-2. Run `node scripts/sync-shared-skill-packages.mjs`
-3. Commit synced `vendor/`, `package.json`, and `bun.lock` together
+2. Run the package build, e.g. `bun run --cwd packages/baoyu-md build`
+3. Publish the changed npm package with `npm publish --access public`
+4. Update consuming skill `package.json` semver ranges if the package version changed
+5. Run `node scripts/verify-shared-package-deps.mjs`
 
-**Git hook**: Run `node scripts/install-git-hooks.mjs` once to enable the `pre-push` hook. It re-syncs and blocks push if vendor copies are stale (`--enforce-clean`).
+**Git hook**: Run `node scripts/install-git-hooks.mjs` once to enable the `pre-push` hook. It blocks pushes when a skill uses a local `file:` dependency or a vendored workspace package.

docs/testing.md

@@ -9,7 +9,7 @@ This repository has many scripts, but they do not share a single runtime or depe
 - Coverage command: `npm run test:coverage`
 - CI trigger: GitHub Actions on `push`, `pull_request`, and manual dispatch
 
-This avoids introducing Jest/Vitest across a repo that already mixes plain Node scripts, Bun-based skill packages, vendored code, and browser automation.
+This avoids introducing Jest/Vitest across a repo that already mixes plain Node scripts, Bun-based skill packages, npm-published shared packages, and browser automation.
 
 ## Rollout Plan
 
@@ -18,19 +18,19 @@ This avoids introducing Jest/Vitest across a repo that already mixes plain Node
 Focus on pure functions under `scripts/lib/` first.
 
 - `scripts/lib/release-files.mjs`
-- `scripts/lib/shared-skill-packages.mjs`
+- `scripts/verify-shared-package-deps.mjs`
 
 Goals:
 
 - Validate file filtering and release packaging rules
-- Catch regressions in package vendoring and dependency rewriting
+- Catch regressions that reintroduce local `file:` dependencies or vendored workspace packages
 - Keep tests deterministic and free of network, Bun, or browser requirements
 
 ### Phase 2: Root CLI integration tests
 
 Add temp-directory integration tests for root CLIs that already support dry-run or local-only flows.
 
-- `scripts/sync-shared-skill-packages.mjs`
+- `scripts/verify-shared-package-deps.mjs`
 - `scripts/publish-skill.mjs --dry-run`
 - `scripts/sync-clawhub.mjs` argument handling and local skill discovery