helmor-bump-vendors
Helmor Bump Vendors automates the process of upgrading pinned versions of agent CLIs, SDKs, and supporting binaries—including Claude Code, Codex, Cursor SDK, and platform tools. It handles version sourcing, SHA256 computation for both arm64 and x64 architectures, enforces the Claude SDK↔CLI lockstep rule, and runs mandatory verification gates to ensure correctness before release.
Helmor Bump Vendors upgrades bundled agent CLIs and SDKs with cross-architecture SHA256 verification.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-28
Helmor Bump Vendors upgrades bundled agent CLIs and SDKs with cross-architecture SHA256 verification. Helmor Bump Vendors automates the process of upgrading pinned versions of agent CLIs, SDKs, and supporting binaries—including Claude Code, Codex, Cursor SDK, and platform tools. It handles version sourcing, SHA256 computation for both arm64 and x64 architectures, enforces the Claude SDK↔CLI lockstep rule, and runs mandatory verification gates to ensure correctness before release.
Use it when
- Helmor Bump Vendors' procedure encompasses version sourcing from npm dist-tags (latest, next, stable).
- Helmor Bump Vendors computes SHA256 checksums for vendor binaries across both arm64 and x64 architectures as part of its verification.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
dohooo/helmor/helmor-bump-vendors · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to upgrade helmor bundled agent versions?
Helmor Bump Vendors automates upgrading pinned versions of agent CLIs, SDKs, and binaries including Claude Code, Codex, and Cursor SDK. The tool sources the latest versions, computes SHA256 checksums for both arm64 and x64 architectures, enforces the Claude SDK↔CLI lockstep versioning constraint, and runs verification gates before release to ensure correctness.
What does helmor vendor version bump procedure include?
Helmor Bump Vendors' procedure encompasses version sourcing from npm dist-tags (latest, next, stable), SHA256 verification across architectures, updates to package.json and vendor-platform.ts, lockstep validation between Claude SDK and Code, breaking change detection in SDK exports and stdout event shapes, and dependency sweep validation gates for vendor bump releases.
How does helmor compute sha256 vendor binaries?
Helmor Bump Vendors computes SHA256 checksums for vendor binaries across both arm64 and x64 architectures as part of its verification workflow. These checksums are validated against bundled agents like kimi, gh, glab, cloudflared, node, and llama.cpp to ensure binary integrity before the vendor bump release is finalized.
What vendor tools does helmor upgrade?
Helmor Bump Vendors upgrades pinned versions of agent CLIs and SDKs including Claude Code, Codex, Cursor SDK, kimi, gh, glab, cloudflared, node, and llama.cpp. It maintains cross-architecture support for arm64 and x64, enforces the Claude SDK↔CLI lockstep rule, and detects breaking changes in SDK exports before release.
What is the helmor cli sdk lockstep rule?
Helmor Bump Vendors enforces a lockstep versioning constraint between Claude SDK and Code CLI, ensuring they remain synchronized during vendor bumps. This constraint is validated as part of the mandatory verification gates to prevent version mismatches that could cause breaking changes in SDK exports or stdout event shapes.
What verification gates does helmor run before release?
Helmor Bump Vendors runs mandatory verification gates including SHA256 checksum validation across arm64 and x64 architectures, breaking change detection in SDK exports and stdout event shapes, Claude SDK↔CLI lockstep rule enforcement, typecheck pipeline tests, and a full dependency sweep to ensure vendor bump correctness before release.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Helmor Bump Vendors
Standardized procedure for upgrading the third-party agent CLIs, SDKs, and helper binaries that Helmor pins and bundles. Goal: a correct, verified bump with no guesswork about where versions live, how to source each SHA256, or what to run before declaring it done.
The pin sites
Every bundled version is pinned in one (or both) of these files:
sidecar/package.json
(truncated - see the full file via the links below)
File tree — 3 files
.agents/skills/helmor-bump-vendors/SKILL.md
.agents/skills/helmor-bump-vendors/references/vendors.md
.agents/skills/helmor-bump-vendors/scripts/npm_vendor_sha.sh
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Upgrade bundled agent CLIs and SDKs to latest versions with SHA verification”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides you through upgrading @anthropic-ai/sdk and @anthropic-ai/claude-agent-sdk packages in the vscode-copilot-chat project. It walks you through reviewing release notes, consolidating changes by category, identifying breaking changes, updating dependencies, detecting API surface shifts via type definition diffs, fixing compilation errors, and running tests to validate the upgrade.
This skill queries npm to compare your declared SDK versions against the latest published releases for Claude Code, Claude Agent SDK, and Codex SDK. It generates a status table showing which packages are current or outdated, then analyzes the version gap and release notes for each outdated package to help you assess update risk before installing.
Automate version bumping and release workflows for ralph-orchestrator by updating the workspace Cargo.toml file and pushing tags to trigger CI. The skill handles all seven version locations, runs tests, and coordinates with GitHub Actions to build binaries and publish to crates.io and npm.
This skill manages updates to the core SDK dependencies that power harness adapters, ensuring each package stays current with its respective framework. It handles both bridge harnesses like Claude Code and non-bridge variants, applying version constraints consistently across dependencies and examples. A built-in verification script confirms all relevant versions remain aligned.
This skill helps you systematically review and remediate security vulnerabilities within your project's dependency tree. It integrates with Claude Code to scan for known issues, assess their impact, and recommend or apply fixes automatically.
web-artifacts-builder enables you to generate sophisticated, multi-layered React applications and UI components directly within Claude Code. Designed for developers who need production-ready artifact generation with contemporary frameworks and build patterns, this skill streamlines the creation of interactive web experiences through structured, reusable component architecture.
More skills artifacts-builder (Apache-2.0) · vc-audit-vc (MIT)