[Skills] serialize CLI commands across processes

[DaleSeo]

Fixes #30486

Description

Update All Skills and Manage Skills can launch separate npx skills@latest processes against the same npm cache. When their package installation phases overlap, npm can fail one process with ENOTEMPTY before the Skills CLI starts.

This change serializes Skills CLI invocations across Raycast command processes with a stale-safe filesystem lock. Manage Skills also waits for pending CLI work before reading installed-skill metadata, preventing stale or partially written state from being displayed after an update.

Screencast

This change has no UI.

Checklist

• I read the extension guidelines
• I read the documentation about publishing
• I ran npm run build and tested this distribution build in Raycast
• I checked that files in the assets folder are used by the extension itself
• I checked that assets used in the README are located outside the metadata folder if they were not generated with our metadata tool

[raycastbot]

Thank you for your contribution! 🎉

🔔 @keito4 @raulgg @pernielsentikaer @kayotimoteo @alexibuild @alastairsounds you might want to have a look.

You can use this guide to learn how to check out the Pull Request locally in order to test it.

📋 Quick checkout commands

BRANCH="fix/skills-cli-concurrency"
FORK_URL="https://github.com/DaleSeo/extensions.git"
EXTENSION_NAME="skills"
REPO_NAME="extensions"

git clone -n --depth=1 --filter=tree:0 -b $BRANCH $FORK_URL
cd $REPO_NAME
git sparse-checkout set --no-cone "extensions/$EXTENSION_NAME"
git checkout
cd "extensions/$EXTENSION_NAME"
npm install && npm run dev

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 15 business days.

[greptile-apps]

Greptile Summary

This PR serializes Skills CLI work across Raycast command processes and reads installed-skill data from one locked snapshot.

• Adds a stale-safe filesystem lock around Skills CLI execution.
• Captures the installed-skill list and lock metadata while holding the shared lock.
• Computes update status from the captured metadata and adds the required runtime dependency.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
extensions/skills/src/utils/skills-cli-runner.ts	Adds in-process and cross-process serialization around every Skills CLI invocation.
extensions/skills/src/utils/installed-skills.ts	Captures installed skills and lock metadata atomically, resolving the previously reported inconsistent-read window.
extensions/skills/src/utils/skills-cli.ts	Allows the locked snapshot operation to inject a runner without reacquiring the lock.
extensions/skills/src/hooks/useInstalledSkills.ts	Switches Manage Skills to the consolidated snapshot-and-update-status operation.
extensions/skills/package.json	Adds proper-lockfile as a runtime dependency and its declarations as a development dependency.
extensions/skills/CHANGELOG.md	Documents the cross-process serialization and consistent metadata snapshot behavior.

_{Reviews (3): Last reviewed commit: "Update CHANGELOG.md" | Re-trigger Greptile}

[raulgg]

Looks good! thank you for the fix

[0xdhrv]

Looks good to me, approved ✅

[github-actions]

Published to the Raycast Store:
https://raycast.com/keito4/skills

[raycastbot]

🎉 🎉 🎉

We've rewarded your Raycast account with some credits. You will soon be able to exchange them for some swag.