Route Node package-delivery ambiguity into one install packet: temporary Git bridge, SHA-pinned shared bridge, private-auth Git path, tarball / `npm pack` artifact, workspace / `file:` inner-loop, or publish-first registry handoff. Use when the user wants to install an npm / pnpm / Yarn / Bun package from a branch, tag, commit, fork, private repo, monorepo package, or unreleased fix, and the real question is which delivery path is safest rather than how Git or package registries work in general. Triggers on: npm install from GitHub, git dependency, github:owner/repo, git+ssh, git+https, private package from repo, install branch vs commit, monorepo package install, npm pack vs git, and should we publish this instead.
Route Node package-delivery ambiguity into one install packet: temporary Git bridge, SHA-pinned shared bridge, private-auth Git path, tarball / `npm pack` artifact, workspace / `file:` inner-loop, or publish-first registry handoff. Use when the user wants to install an npm / pnpm / Yarn / Bun package from a branch, tag, commit, fork, private repo, monorepo package, or unreleased fix, and the real question is which delivery path is safest rather than how Git or package registries work in general. Triggers on: npm install from GitHub, git dependency, github:owner/repo, git+ssh, git+https, private package from repo, install branch vs commit, monorepo package install, npm pack vs git, and should we publish this instead.
allowed-tools
Bash Read Write Edit Glob Grep
compatibility
Best for Node/TypeScript repositories where the main question is package delivery strategy and install mechanics, not local Git recovery, package-host administration, or full environment setup. Covers npm, pnpm, Yarn, and Bun at the decision level.
replacement path once the dependency stops being temporary
Defaults:
floating branches are convenience shortcuts, not shared infrastructure
private Git is only as good as the worst environment's auth setup
tarballs trade Git surprises for artifact ownership
publish-first is usually the honest answer once the package becomes routine shared infrastructure
Step 7: Route the next owner immediately
This skill owns package-delivery choice, not every downstream task.
Typical route-outs:
git-workflow — fix or shape the underlying branch/history state
github-repo-management — operate repos, packages, releases, or package-host settings
workflow-automation — wire repeatable repo scripts or monorepo automation around the chosen package flow
system-environment-setup — handle machine/runtime/container/service setup once the dependency question is no longer the main blocker
If the user asks “how should we consume this package?” stay here.
If they ask “how do we administer hosting or fix auth at the platform level?” route out.
Step 8: Produce one concise install brief
Return a short operator-style brief with:
packet
primary mode
durability tier
1-3 recommended steps
only the needed commands
auth / build / reproducibility notes
exit strategy
next owner if the work leaves this skill
If the honest answer is “publish this or package it properly,” say that directly.
Output format
Always return a Git package install brief, artifact recommendation brief, or publish-first handoff brief.
Required qualities:
identify the packet already in hand
choose one primary delivery mode
classify durability explicitly
make auth/build/reproducibility consequences visible
tailor commands to the package manager actually in use
leave a clear exit strategy
route package hosting, repo admin, workflow glue, or environment setup to the right neighboring skill
Examples
Example 1: unpublished fix shared in CI
Input
We need an unpublished fix from a GitHub repo for our npm app. Should we install from the branch or do something safer for CI?
Good output direction
shared-bridge-packet
sha-pinned-shared-bridge
rejects floating branch use for shared CI
gives one npm-specific command plus an exit path
Example 2: private package auth trouble
Input
Our package is in a private GitHub repo and pnpm install keeps failing in CI. What path should we take?
Good output direction
private-auth-packet
chooses private-git-auth-path or publish-first-registry-path
clarifies CI credential parity and avoids committed secrets
Example 3: monorepo or durable shared package
Input
The package lives in a monorepo. I use Yarn locally but the rest of the team just needs the package in normal projects. Should we install straight from GitHub?
Good output direction
workspace-inner-loop-packet or durable-distribution-packet
prefers workspace / file: for local co-development or publish-first for durable use
does not oversell raw Git install
Best practices
Start from the delivery packet already in hand, not from a favorite syntax form.
Treat Git refs as a bridge, not a default release channel.
Prefer SHA pins over floating branches whenever a Git dependency will be shared.
Surface lifecycle/build behavior early; raw Git installs can behave like source packaging, not registry downloads.
Keep local, team/CI, and durable shared usage clearly separated.
Treat private-auth pain as a signal to re-evaluate the delivery path, not just patch credentials forever.
Recommend a durable exit path once the dependency stops being temporary.
Update compact and discovery surfaces when the front-door wording changes materially.
