Agent skill · software engineering · dohooo
helmor-bump-vendors
Bump or upgrade the pinned versions of Helmor's bundled agent CLIs, SDKs, and supporting binaries — Claude Code + claude-agent-sdk (lockstep), Codex, Cursor SDK, OpenCode, Kimi, Pi, and gh / glab / cloudflared / llama.cpp / Node. Encodes exactly which files to edit (`sidecar/package.json`, `sidecar/scripts/vendor-platform.ts`), how to source each version and compute its SHA256, the Claude SDK↔CLI lockstep rule, npm dist-tags caveats (latest vs next vs stable), the cross-arch (arm64+x64) SHA requirement, and the mandatory verification gates. Use whenever the user wants to upgrade / bump / update / refresh a bundled agent CLI or SDK version, check whether a vendor is behind latest, or run a dependency version sweep in the Helmor repo.
Why this skill is useful
Adds a detailed, executable workflow for upgrading multiple SDKs and binaries with specific versioning and verification steps that are not commonly documented.
What it needs
Requires bun installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 1,281 stars on the source repository.
What this skill does
Helmor Bump Vendors Standardized procedure for upgrading the third-party agent CLIs, SDKs, and helper binaries that Helmor pins and bundles. Goal: a correct, verified bump with no guesswork about where versions live, how to source each SHA256, or what to run before declaring it done. The pin sites Every bundled version is pinned in one (or both) of these files: sidecar/package.json — npm dependencies. Covers SDKs (imported in TS) and the npm-distributed CLIs whose native binary is staged from nodemodules (@anthropic-ai/claude-code, @openai/codex, opencode-ai). sidecar/scripts/vendor-platform.ts — version constants + per-version SHA256 tables for every staged binary. Source of truth for what gets bundled into the release. sidecar/scripts/stage-vendor.ts — staging logic. Only edit it when a vendor's archive layout changes (rare; see codex/cursor notes in references/vendors.md). Vendor classes (determine the change-set) Class Vendors What to edit SHA256? --- --- --- --- A. npm SDK only @anthropic-ai/claude-agent-sdk, @cursor/sdk, @opencode-ai/sdk, @earendil-works/pi- package.json line No — plain npm dep B. npm-distributed staged binary claude-code, codex, opencode package.json line + SHA256 table key in vendor-platform.ts Yes — from npm tarball C. GitHub-release staged binary kimi, gh, glab, cloudflared, llama.cpp, node <NAME>VERSION const + SHA256 table in vendor-platform.ts (NOT in package.json) Yes — source varies Per-vendor exact pin location, SHA256 source, and gotchas live in references/vendors.md — read the relevant section before editing. Workflow 1. Scope. Confirm which vendors to bump. For each, open references/vendors.md for its class, pin location, SHA source, and gotchas. 2. Find the target version. Check LIVE — never trust memory; dist-tags flip within hours. npm: bun -e 'console.log((await (await fetch("https://registry.npmjs.org/<pkg>")).json())["dist-tags"])' Target latest (the stable channel). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills dohooo/helmor-bump-vendors