fix: include bundled skills directory in published package

[LaZzyMan]

TLDR

Bundled skills (e.g. /review) were missing after npm publish because the bundled directory was not included in the files whitelist of the generated dist/package.json.

Dive Deeper

The build pipeline has two relevant steps:

1. npm run bundle → copy_bundle_assets.js correctly copies packages/core/src/skills/bundled/ to dist/bundled/.
2. prepare-package.js → Generates a dist/package.json for npm publishing with a files field that controls which files are included in the published tarball.

The files array was:

['cli.js', 'vendor', '*.sb', 'README.md', 'LICENSE', 'locales']

Missing 'bundled' meant npm excluded the entire dist/bundled/ directory during publish. At runtime, SkillManager resolves bundledSkillsDir to <install-path>/bundled/ (via import.meta.url), finds the directory missing, and logs a warning — silently returning zero bundled skills.

The fix adds 'bundled' to the files array so bundled skills are shipped with the published package.

Reviewer Test Plan

1. Run npm run bundle && node scripts/prepare-package.js
2. Verify dist/bundled/review/SKILL.md exists
3. Run npm pack ./dist and inspect the tarball — confirm bundled/review/SKILL.md is included
4. Install from the tarball and run qwen /skills — the review skill should appear in the list

Testing Matrix

	🍏	🪟	🐧
npm run	✅	❓	❓
npx	❓	❓	❓
Docker	❓	❓	❓
Podman	❓	-	-
Seatbelt	❓	-	-

Linked issues / bugs

"

[github-actions]

📋 Review Summary

This PR fixes a critical packaging issue where bundled skills (e.g., /review) were excluded from the npm published package because the bundled directory was missing from the files whitelist in the generated dist/package.json. The fix is minimal, targeted, and correctly addresses the root cause identified in the PR description.

🔍 General Feedback

• The fix is surgical and follows the existing pattern established for other assets (vendor, locales, etc.)
• The PR description provides excellent context with a clear TLDR, technical deep dive, and testing matrix
• The change aligns with how the build pipeline already works - copy_bundle_assets.js correctly copies files to dist/bundled/, but npm was excluding them during publish
• Good testing plan outlined in the PR description with clear verification steps

🎯 Specific Feedback

🔴 Critical

No critical issues identified. The fix correctly addresses the packaging problem.

🟡 High

No high priority issues identified.

🟢 Medium

No medium priority issues identified.

🔵 Low

• File: scripts/prepare-package.js:157 - Consider adding a verification step after the files array definition to ensure the bundled directory exists in dist/ before publishing, similar to the existing checks for cli.js and vendor/ at the top of the script. This would provide early failure if the bundle step didn't copy the skills correctly.

  Suggested addition (after line 157, before the config property):

  // Verify bundled directory exists if listed in files
  if (distPackageJson.files.includes('bundled') && !fs.existsSync(path.join(distDir, 'bundled'))) {
    console.warn('Warning: bundled directory listed in files but not found in dist/');
  }

✅ Highlights

• Excellent PR description with clear problem statement, root cause analysis, and testing plan
• Minimal, focused change that solves the exact problem without unnecessary modifications
• The fix follows the established pattern for including other assets in the published package
• Good verification steps provided in the PR description for reviewers to validate the fix

[yiliang114]

LGTM

[tanzhenxin]

LGTM!