Borrowing it
Nothing to install: this file belongs to hitosea/happy-next. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hitosea/happy-next/main/.claude/skills/happy-ota/SKILL.mdgit clone --depth 1 https://github.com/hitosea/happy-nextWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hitosea/happy-next/happy-ota)<a href="https://agentmods.dev/skills/hitosea/happy-next/happy-ota"><img src="https://agentmods.dev/badge/skills/hitosea/happy-next/happy-ota/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hitosea/happy-next/happy-ota"><img src="https://agentmods.dev/badge/skills/hitosea/happy-next/happy-ota.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02305 |
| Opus 5.5 | $0.00026 | $0.00922 |
| Sonnet 5.5 | $0.00013 | $0.00461 |
| Haiku 4.5 | $0.00006 | $0.00231 |
Grade D, and why
happy-ota scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo -n grep '^OTA_ADMIN_TOKEN=' /www/ajax/happy-next.com/.env | cut -d= -f2- | tr -d '\r\n' \ Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
npx expo-updates runtimeversion:resolve --platform $p 2>/dev/null | tail -1 ); done; rm -rf $T Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w '%{http_code}\n' -H 'expo-platform: ios' -H 'expo-runtime-version: <runtime>' \ How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
happy-app OTA 发布与回滚
App 的 JS 和资源可以不经过商店直接更新:yarn ota(packages/happy-app/sources/scripts/ota.ts)把更新上传到 happy-server(/v1/ota/*),App 里的 expo-updates 从 https://api.happy-next.com/v1/ota/manifest 拉取。
- runtime version 就是原生 fingerprint(
fingerprint.config.js)。一个更新只会发给 fingerprint 相同的安装包。改了原生依赖、插件或app.config.js中影响原生的部分以后,fingerprint 会变,旧包就收不到这次更新,要先打新的原生包。 - App 什么时候收到更新:
- 冷启动时,原生层会在后台下载更新,到下一次冷启动才换上。
- App 从后台回到前台时,也会检查并下载(
hooks/useUpdates.ts,在根布局里启动)。下载好后,收件箱顶部会出现「有可用更新」横幅,点一下立即重载。不点的话,下一次冷启动时生效。
- 渠道: production、preview、development 各对应同名 channel,默认用 production。
调用本技能,就是授权执行下面「流程」第一、三、四段的操作。第二段的计划要用户确认后才能执行。由 happy-next-release 照本文件执行时,以它的发布计划为准,不再单独确认。
一、检查(不询问用户)
在 packages/happy-app 下:
-
工作区: 运行
git status --porcelain --untracked-files=no。有未提交的已跟踪改动时停下,让用户选「先提交」还是「不发布」。不要把未提交的改动发出去,ota.ts遇到这种情况只会警告,不会拦。 -
算出这次的 runtime: 和发布时一样,要在 EAS 环境里算:
T=$(mktemp -d); npx eas-cli env:pull production --path $T/p.env --non-interactive >/dev/null for p in ios android; do ( set -a; . $T/p.env; set +a; export APP_ENV=production NODE_ENV=production CI=1 npx expo-updates runtimeversion:resolve --platform $p 2>/dev/null | tail -1 ); done; rm -rf $T -
哪些安装包收得到: 把上一步的 runtime 和已经装在用户手机上的包的 fingerprint 对一下(工具:
.claude/skills/happy-ota/scripts/embedded-fingerprint.sh <ipa|apk>):- 最近一次 GitHub Release(App Store 和 Android 用户用的就是它):
解出 fingerprint 后删除目录。输出「no embedded fingerprint」,说明这个包打在自建 OTA 之前,收不到任何 OTA。D=$(mktemp -d); gh release download <tag> -p '*-ios.ipa' -p '*-android.apk' -D $D - Mac mini 测试包:
~/wwwroot/appdown/builds/里最新的HappyNext-*.ipa,用 orchestrator_exec 在 Mac mini 上执行unzip -p <ipa> 'Payload/*.app/EXUpdates.bundle/fingerprint'。 - 历史更新:
yarn ota list --platform ios和--platform android,列出之前的更新发到了哪些 runtime。
哪个平台都对不上,就说明没有设备能收到这次更新。这时停下,告诉用户要先打原生包(测试包用 happy-ios-build,正式版走 happy-next-release)。
- 最近一次 GitHub Release(App Store 和 Android 用户用的就是它):
-
这次包含哪些改动: 从
yarn ota list里取同平台最近一次更新的 gitCommit,执行git log --oneline <gitCommit>..HEAD -- packages/happy-app packages/happy-wire。如果其中有原生相关的改动(package.json里的依赖、plugins/、modules/、targets/、patches/、app.config.js),第 2 步算出的 runtime 应该已经变了,要和第 3 步的结论一起核对。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 128 lines · 65 tokens per session scan D ebc809bc3038
happy-ota is a skill published in the GitHub repository hitosea/happy-next (61 stars, last pushed yesterday), licensed MIT. It adds 65 tokens to every session and 2,305 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
Other skills, from other repositories
lov-app-release
A release workflow for publishing one app version to declared channels such as iOS, Android, GitHub, a website, and documentation. It checks signing, build artifacts, and remote status rather than treating a successful build as a completed release.
git-workflow-and-versioning
Use when managing branches, commits, versioning, and release workflows for Android projects, or when cutting a release, choosing a version bump, tagging, or writing a changelog. Covers trunk-based development, atomic commits, versionCode/versionName derived from tags, semver for library modules, changelogs and Play…
shipping-and-launch
Use when preparing to release an Android app to production. Pre-launch checklist covering code quality, security, performance, accessibility, Play Store requirements, staged rollout, and rollback planning.
axiom-shipping
Use when preparing an app for App Store submission, handling rejections or appeals, managing App Store Connect and Xcode Cloud, or triaging TestFlight/Sentry crash corpora. Covers checklists, metadata, privacy manifests, age ratings, export compliance.
release-new-version
Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.