happy-next: Skill for Claude Code

.claude/skills/happy-ota/SKILL.md

happy-ota is a skill for Claude Code from hitosea/happy-next. It costs 65 tokens per session (2,305 once invoked), scanned D, original, MIT.

A command-based tool for publishing or rolling back JavaScript updates to an Expo mobile app through an update server. These updates can reach installed builds with the matching native runtime version without a new app-store release.

In plain words
What is it for?
Use it to inspect eligible builds, publish an update to production, preview, or development channels, roll an update back, and tell testers how to verify it on a phone.
Why use it?
It provides a controlled way to deliver JavaScript changes and checks whether installed app builds can receive the update before publishing.

Skill for Claude Code

Written for Claude Code: disable-model-invocation in frontmatter. Also seen: reads .claude/ paths.

This is hitosea/happy-next's own configuration. It tells Claude Code how to work on happy-next itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything happy-next configures →

Reuse

Borrowing it

Nothing to install: this file belongs to hitosea/happy-next. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/hitosea/happy-next/main/.claude/skills/happy-ota/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/hitosea/happy-next

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for happy-ota

README.md
[![agentmods](https://agentmods.dev/badge/skills/hitosea/happy-next/happy-ota/github.svg)](https://agentmods.dev/skills/hitosea/happy-next/happy-ota)
Your own site
<a href="https://agentmods.dev/skills/hitosea/happy-next/happy-ota"><img src="https://agentmods.dev/badge/skills/hitosea/happy-next/happy-ota/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for happy-ota

Your own site · 80×15
<a href="https://agentmods.dev/skills/hitosea/happy-next/happy-ota"><img src="https://agentmods.dev/badge/skills/hitosea/happy-next/happy-ota.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,305 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00065 $0.02305
Opus 5.5 $0.00026 $0.00922
Sonnet 5.5 $0.00013 $0.00461
Haiku 4.5 $0.00006 $0.00231

Measured 2d ago against content hash ebc809bc3038, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade D, and why

happy-ota scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/embedded-fingerprint.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

sudo -n grep '^OTA_ADMIN_TOKEN=' /www/ajax/happy-next.com/.env | cut -d= -f2- | tr -d '\r\n' \

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

npx expo-updates runtimeversion:resolve --platform $p 2>/dev/null | tail -1 ); done; rm -rf $T

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s -o /dev/null -w '%{http_code}\n' -H 'expo-platform: ios' -H 'expo-runtime-version: <runtime>' \
.claude/skills/happy-ota/SKILL.md · 128 lines

How it starts

The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.

happy-app OTA 发布与回滚

App 的 JS 和资源可以不经过商店直接更新:yarn ota(packages/happy-app/sources/scripts/ota.ts)把更新上传到 happy-server(/v1/ota/*),App 里的 expo-updates 从 https://api.happy-next.com/v1/ota/manifest 拉取。

  • runtime version 就是原生 fingerprint(fingerprint.config.js)。一个更新只会发给 fingerprint 相同的安装包。改了原生依赖、插件或 app.config.js 中影响原生的部分以后,fingerprint 会变,旧包就收不到这次更新,要先打新的原生包。
  • App 什么时候收到更新:
    • 冷启动时,原生层会在后台下载更新,到下一次冷启动才换上。
    • App 从后台回到前台时,也会检查并下载(hooks/useUpdates.ts,在根布局里启动)。下载好后,收件箱顶部会出现「有可用更新」横幅,点一下立即重载。不点的话,下一次冷启动时生效。
  • 渠道: production、preview、development 各对应同名 channel,默认用 production。

调用本技能,就是授权执行下面「流程」第一、三、四段的操作。第二段的计划要用户确认后才能执行。由 happy-next-release 照本文件执行时,以它的发布计划为准,不再单独确认。

一、检查(不询问用户)

在 packages/happy-app 下:

  1. 工作区: 运行 git status --porcelain --untracked-files=no。有未提交的已跟踪改动时停下,让用户选「先提交」还是「不发布」。不要把未提交的改动发出去,ota.ts 遇到这种情况只会警告,不会拦。

  2. 算出这次的 runtime: 和发布时一样,要在 EAS 环境里算:

    T=$(mktemp -d); npx eas-cli env:pull production --path $T/p.env --non-interactive >/dev/null
    for p in ios android; do ( set -a; . $T/p.env; set +a; export APP_ENV=production NODE_ENV=production CI=1
      npx expo-updates runtimeversion:resolve --platform $p 2>/dev/null | tail -1 ); done; rm -rf $T
    
  3. 哪些安装包收得到: 把上一步的 runtime 和已经装在用户手机上的包的 fingerprint 对一下(工具:.claude/skills/happy-ota/scripts/embedded-fingerprint.sh <ipa|apk>):

    • 最近一次 GitHub Release(App Store 和 Android 用户用的就是它):
      D=$(mktemp -d); gh release download <tag> -p '*-ios.ipa' -p '*-android.apk' -D $D
      
      解出 fingerprint 后删除目录。输出「no embedded fingerprint」,说明这个包打在自建 OTA 之前,收不到任何 OTA。
    • Mac mini 测试包: ~/wwwroot/appdown/builds/ 里最新的 HappyNext-*.ipa,用 orchestrator_exec 在 Mac mini 上执行 unzip -p <ipa> 'Payload/*.app/EXUpdates.bundle/fingerprint'。
    • 历史更新: yarn ota list --platform ios 和 --platform android,列出之前的更新发到了哪些 runtime。

    哪个平台都对不上,就说明没有设备能收到这次更新。这时停下,告诉用户要先打原生包(测试包用 happy-ios-build,正式版走 happy-next-release)。

  4. 这次包含哪些改动: 从 yarn ota list 里取同平台最近一次更新的 gitCommit,执行 git log --oneline <gitCommit>..HEAD -- packages/happy-app packages/happy-wire。如果其中有原生相关的改动(package.json 里的依赖、plugins/、modules/、targets/、patches/、app.config.js),第 2 步算出的 runtime 应该已经变了,要和第 3 步的结论一起核对。

Read the full file on GitHub · 128 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 128 lines · 65 tokens per session scan D ebc809bc3038

Subscribe to this mod's changes

happy-ota is a skill published in the GitHub repository hitosea/happy-next (61 stars, last pushed yesterday), licensed MIT. It adds 65 tokens to every session and 2,305 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.

Related

Other skills, from other repositories

lov-app-release

A release workflow for publishing one app version to declared channels such as iOS, Android, GitHub, a website, and documentation. It checks signing, build artifacts, and remote status rather than treating a successful build as a completed release.

lovstudio/skills · 64 tokens

git-workflow-and-versioning

Use when managing branches, commits, versioning, and release workflows for Android projects, or when cutting a release, choosing a version bump, tagging, or writing a changelog. Covers trunk-based development, atomic commits, versionCode/versionName derived from tags, semver for library modules, changelogs and Play…

GuillemRoca/agent-skills-android · 77 tokens

shipping-and-launch

Use when preparing to release an Android app to production. Pre-launch checklist covering code quality, security, performance, accessibility, Play Store requirements, staged rollout, and rollback planning.

GuillemRoca/agent-skills-android · 39 tokens

axiom-shipping

Use when preparing an app for App Store submission, handling rejections or appeals, managing App Store Connect and Xcode Cloud, or triaging TestFlight/Sentry crash corpora. Covers checklists, metadata, privacy manifests, age ratings, export compliance.

CharlesWiltgen/Axiom · 56 tokens

release-new-version

Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).

niki914/zafiro · 54 tokens

asc-ad-hoc-distribution

Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.

rorkai/app-store-connect-cli-skills · 62 tokens