fix: accept the skill names the Agent Skills spec allows (0.24.2) - #118

Follow-on to #117, from the other direction. That PR made kitbash warn about names the spec forbids. This one stops kitbash rejecting names the spec allows — and, worse, silently installing them under a different name.

The bug

KSF's rule was ^[a-z][a-z0-9-]{1,40}$: leading letter required, 41-character cap. The spec allows any lowercase alphanumeric start and up to 64 characters.

So 2fa-setup — a legal Agent Skill — failed the rule, fell through to the directory-name fallback, and hit a slug that strips everything before the first letter:

$ kitbash install file:../2fa-setup --yes
installed fa-setup@0.0.0          # ← not the skill the author published
  pinned in kitbash.lock

It was then pinned in kitbash.lock as fa-setup and compiled into every target under that name. Nothing warned. For a tool whose whole argument is that silent capability loss is the enemy, renaming someone's skill on the way in is the wrong failure mode.

A 64-character name — legal per the spec — was rejected outright by the 41-character cap for the same reason.

The fix

NAME_RE becomes ^[a-z0-9][a-z0-9-]{0,63}$, and the bare-skill slug keeps leading digits instead of eating them.

Loosened in one direction only. tidy--commits and tidy- still load: tightening a value constraint on a frozen manifest field would turn valid existing skills into load failures, which RFC 0002 rules out. Those names are reported by the name-convention lint from #117, which is where a host-compatibility problem belongs.

The directory-name fallback is unchanged. A frontmatter name KSF cannot load still falls back to the directory, because the spec requires name to match the parent directory — propagating a mismatched name would produce a skill hosts silently drop. I started to make that an error and reverted it: the name-invariant test added in 0.24.0 documents the current behaviour as deliberate, and it is right.

Tests

Four new assertions in the existing spec-name block, each failing before the change:

• a leading digit loads under its declared name
• and installs under it, with kitbash.lock pinning 2fa-setup, not fa-setup
• a 64-character name loads
• the existing doubled/trailing-hyphen warnings and the name-invariant fallback still hold

Full suite green (460 assertions), typecheck clean, benchmark deterministic, site/build.mjs --check current.

Context

Found while re-reading the published Agent Skills spec against the implementation. The spec is now the shared authority for eleven targets, so its exact constraints — 1–64 characters, lowercase alphanumerics and single hyphens, name matching the parent directory, description ≤1024 characters, body under ~5,000 tokens — are worth holding the loader to in both directions, not just the strict one.