* fix(board-sync): detect the CLI entrypoint through symlinked skill installs
The report helper compared import.meta.url with the raw argv[1]. Node resolves
the main module through symlinks, so invoking the script via a symlinked skill
directory (the default install layout) silently produced no output and exit 0.
Resolve both sides to real paths before comparing, cover it with a symlink test,
and bump board-sync to 2.0.1.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* chore(marketplace): regenerate manifest for board-sync 2.0.1
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(git-cleanup): scope operation and ignored-file guards to the affected candidates
An in-progress rebase in any worktree refused every candidate, and ignored files
made every installed worktree "dirty". With fleet agents rebasing PR branches
continuously, nothing was ever prunable.
- Pin only the worktree running an operation and the branch it operates on
(checked-out branch, rebase head-name, BISECT_START) plus that branch's remote
ref; other candidates stay eligible. Unreadable worktrees are pinned the same way.
- Drop --ignored from the cleanliness check; untracked and modified tracked files
still refuse removal.
Closes#144
* fix(git-cleanup): fetch trunk and prove squash landings by file content
Squash-merge rewrites commit SHAs, so unique commits and per-commit
patch IDs are not evidence that work reached trunk. Fetch origin trunk
before classifying, fast-forward a behind local trunk, and treat path
blobs already on trunk as landed.
* fix(git-cleanup): record reviewed pstack destination hashes
CI pstack:verify rejected the squash-aware cleanup.py change as an
unreviewed destination of the superseded worktree-audit mapping.
* fix(ci): bump markdownlint-cli and pin patched js-yaml/smol-toml
bun audit failed CI on GHSA-2883-xcg3-v3hh (js-yaml) and
GHSA-7w5x-hrqm-74c2 (smol-toml) via markdownlint-cli.
* refactor!: unify GitHub identities and provider-aware board workflows
* fix: resolve renamed helpers from their installed packages
* fix: validate published names and preserve transport types
* fix: enforce skill repair and monitoring contracts
* fix!: clarify repair authority and persistent QA intake
* fix: align QA intake states and metaphor exceptions
* fix: preserve repair authority at the test command entry
* fix: align test input contract with Bun support
* fix: specify durable QA intake recovery ordering
* chore(master): release 2.0.0
* chore: regenerate bundles for release
* chore: downgrade release from 2.0.0 to 1.3.1
Both feat! commits (git-cleanup rename, command consolidation) are internal
skill/command reorganizations, not breaking changes for the library's actual
interface — release-please's default node config treats `!` as an automatic
major bump post-1.0, which overstates the impact here. Overriding the
computed version to 1.3.1 and dropping the BREAKING CHANGES changelog
section.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: VincentShipsIt <vincent@shipshit.dev>
* feat!: consolidate test/scan/env/prompt/performance commands behind skills
- merge /tests into /test run (scope tokens forwarded; /tests retired)
- retire /performance; /refactor perf is the sole performance front door
- rewire /scan as a thin security front door (security-audit + dependency-audit)
- add env-setup skill; /env becomes a thin router to it
- move the Lyra 4-D framework into prompt-engineering references; /prompt goes thin
- document intentional command shortcuts (/qa, /deslop, PR-flow trio) in README
- regenerate bundles + marketplace (185 skills, 30 commands, 198 plugins)
* fix(test-dispatch,env-setup): correct router contract and env discovery scan
Three CodeRabbit findings on #127, all verified against the source before
fixing.
test-dispatch understated what it routes into. Its Creates/Modifies claimed the
router mutates "nothing directly" and its Confirmation Required listed only
e2e/coverage/init as mutating — but `run` delegates to test-runner, whose
auto-fix loop edits the code under test and its tests until green. A reader
picking a route from the contract would have believed `/test run` was safe.
The fix corrects the documentation rather than adding a gate: test-runner's
unprompted edit of the file under test IS `/test run`, and `--no-fix` is the
existing, designed way to ask for a report with no edits. Bolting a blanket
confirmation onto the auto-fix loop would contradict both. The contract now
names which routes mutate, and points at `--no-fix` instead of a gate
test-runner does not have.
env-setup's discovery command had a filter that silently filtered nothing:
`grep -oh` prints only the matched text with the filename suppressed, so the
downstream `grep -v node_modules` had no path to match against and dependency
hits stayed in the inventory. Exclusion is now directory-scoped
(`--exclude-dir`), the pattern also covers bracket access
(`process.env["X"]`), and the surrounding prose states what the scan cannot
see — helper functions, destructures, dynamic keys, and non-JS services in the
same repo — so the output reads as a starting inventory, not an answer.
`/test run unit | integration | e2e` sat inside a bash fence, where copy-paste
runs a pipeline instead of picking a scope. Split into three commands in both
the skill and commands/test.md.
Verified: validate-changed-skills 0 errors/0 warnings, markdownlint 0 issues,
biome clean, catalog regenerated to 186 skills / 199 plugins. The discovery
grep was run against this repo and returns real variable names.
- new gh-board-sync skill (1.0.0): read-only reconciliation of a GitHub
Projects v2 board against real repo state across eight checks —
merged-not-Done, Done-not-merged (false green), stale In Progress,
Human Review starvation, untracked work, epic/parent drift, sprint
readiness, and Priority hygiene — ending with a board-trustworthy verdict
- bundled gh-board-sync-report.mjs: paginated GraphQL board read,
issue<->PR resolution via closedByPullRequestsReferences and closing
keywords, per-repo merge/issue/milestone activity, configurable
--window/--stale/--horizon, --json output; always read-only
- sprint readiness lists each due milestone's open issues as the coming
sprint's focus list; horizon defaults to 7 days, --horizon for longer
sprints
- --apply (skill-driven, not the script) sets Status/Priority only, one
confirmation per check category; never closes, merges, or touches
milestones
- /board becomes a full front door like /cleanup: status, init, audit,
normalize, copy, sync [--apply], schedule [days], review — shape modes
route to gh-project-board, truth modes to gh-board-sync
- add gh-board-sync to github and dev-loop bundles; regenerate bundles,
marketplace.json (198 plugins, 185 skills), and catalog counts
* feat!: rename release-cleanup to git-cleanup behind /cleanup, retire /clean and /inbox
- rename skills/release-cleanup -> skills/git-cleanup (v3.0.0): branch and
worktree pruning is git hygiene, not a release step
- new /cleanup command front door: branches, worktrees, verify, prune,
tasks, sessions, all — absorbs the old /clean command
- delete /inbox command (dead .agents/inbox.md capture flow; the gh-inbox
skill stays for GitHub-scoped triage)
- release-dispatch v2.0.0: cleanup/prune subcommands now point to /cleanup
and stop instead of routing to a release engine
- sharpen /merge copy: default merges ALL approved open PRs, prune step
delegates to git-cleanup
- update all cross-references (merge-open-prs, worktree, release, pstack)
with version bumps and mirrored plugin.json files
- regenerate bundles, marketplace.json, and catalog counts (31 commands)
* fix(git-cleanup): prove merges by patch identity, not commit subject
CodeRabbit flagged the rule-3 fallback on #125. Verified in a sandbox: a
branch whose only commit subject matched a merged PR title was classified
PRUNABLE and would have reached `git branch -D` / `git push origin --delete`,
even though its contents were entirely unmerged.
Subject matching was also near-useless for the case it was written for — a
squash merge rewrites several branch subjects into one PR title, so they
stop matching anyway. Replaced with git patch-id:
- per-commit equivalence via `git cherry`, then
- cumulative-diff patch-id against trunk commits since the merge base
(bounded at 500; unproven => reported, never deleted)
Verified against four cases: unmerged decoy with a colliding subject (not
prunable), genuine squash merge (prunable), rebased copy (prunable), and
merged work plus a new commit (not prunable).
Also from the same review:
- /release prune now redirects to /cleanup instead of falling through to the
unknown-argument path (release-dispatch already accepted both spellings)
- release-dispatch Creates/Modifies no longer advertises branch/worktree
deletion, which no /release mode can reach
- /cleanup closes issues with a PR/commit URL rather than a gitignored
.agents/sessions path that GitHub readers cannot open
- session backups write to a sibling dir, not inside the directory being
consolidated
* feat: port Lauren Tan pstack skills and recut tdd/de-slop
Add pstack as a model-agnostic playbook orchestrator plus the high-value
workflow skills that this catalog did not already cover. Rewrite tdd and
de-slop in place with pstack rigor. Keep existing skill ids. Attribute
MIT to Lauren Tan / cursor/plugins.
Co-authored-by: Vincent <vincent@shipshit.dev>
* fix: regenerate marketplace snapshots after pstack port
CI regenerates bundles and marketplace.json, then fails if they drift.
The port updated catalog sources but left those generated snapshots stale.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(release-cleanup): classify leftover locals without dumping /tmp
Look up PRs per head instead of writing a 1000-PR snapshot file.
Classify local branches and worktrees, not remotes only, and treat
squash-artifact retarget copies as prunable. Remove worktrees before
deleting the branches checked out in them. Keep merge-open-prs
snapshots in the shell.
* fix(release-cleanup): write snapshots under the current repo .tmp
Scratch belongs in the checkout that created it. If a snapshot file is
needed, mkdir <repo>/.tmp and write there. Never /tmp.
* fix(skills): write disposable scratch to the current repo .tmp
Replace machine-wide /tmp dumps in public skills with
<repo>/.tmp. Keep the ignore rule and gitkeep so clones have
the folder. Catalog and bundles regenerated.
The rolling release PR sits open accumulating every merge to master, so a
ready-for-review PR misrepresents its state and invites an accidental merge.
draft-pull-request makes readiness an explicit act: mark it ready when you
actually intend to cut the version.
The workflow_dispatch CI kick attached its `checks` run to the release
branch head SHA, but GitHub never counted it in the PR's status rollup, so
branch protection still saw the required check as missing. What actually
unblocks the release PR is approving the queued `action_required`
pull_request run. Removing the step and its `actions: write` grant so the
workflow no longer implies a guarantee it does not provide.
- validate-skill-sync.sh: hard-error when plugin.json version != SKILL.md
metadata.version, or plugin.json description is a YAML block marker
- new scripts/check-skill-version-bumps.sh (bun run version:check): CI fails
when a skill's content changes without a metadata.version bump vs base
- CI: fetch-depth 0 + version:check step after validate
- sync 12 drifted plugin.json versions to SKILL.md; fix turborepo/html-style
junk descriptions
- bundle plugin.json + marketplace.json versions now come from
package.json / skill plugin.json instead of hardcoded 1.0.0
- fixtures + regression tests for both validator gates
* refactor: split open-source-checker and git-safety by moment-of-use
Both skills scanned for secrets and unsafe commits with heavily duplicated
content: sensitive-file patterns, history sweep commands, git-filter-repo/BFG
cleanup, .gitignore templates, pre-commit hooks, and emergency response all
appeared in each. The overlap made triggers ambiguous and left two copies of
every check to maintain.
Split by the moment each skill is reached for, keeping both:
open-source-checker — the publish gate. Runs once, on a private repository at
the decision to make it public. Four passes: license and attribution
(dependency compatibility matrix, borrowed-code attribution, copyright
ownership), secrets across full history (scanner-driven, plus the refs --all
misses: stashes, merges, deleted files, every branch and tag), private
references (internal hosts, employee emails, customer names, commit author
metadata, infrastructure identifiers), and publication readiness. Returns a
binary publish/block verdict and hands rotation and rewrite work to git-safety.
git-safety — the recurring guard. Runs at every commit and every push in a repo
already in daily use. Two guards: the staged guard (sensitive filenames and
secret-shaped values in the staged diff only) and a new operation guard gating
destructive git commands (force-push, filter-repo, reset --hard, clean -fdx,
branch deletion, rebase on a pushed branch) behind blast radius, backup, and a
reversible alternative. Keeps prevention setup, CI scanning, the history
rewrite procedure, and leak emergency response.
Detection labour divides the same way: hand-written regexes for the small
staged set, scanner tooling (gitleaks, truffleHog) for thousands of commits.
Neither skill now carries the other's checks.
Each carries a Related section pointing at the other for the out-of-scope
moment, and descriptions are rewritten so triggers are disjoint — git-safety
follows the user-invoked convention (human-facing description, triggers moved
to when_to_use), open-source-checker keeps model-facing publish triggers.
open-source-checker gains a Contract block declaring the audit read-only.
Closes#100
* chore: regenerate marketplace bundles for the split skills
* fix: make six colliding skill trigger pairs disjoint
A duplicate-detection audit found six pairs whose description/when_to_use
fired on the same phrasing. Each pair keeps both skills; the frontmatter is
sharpened so the leading words name a distinct moment-of-use and a Related
cross-reference routes the other case.
- cto-advisor / tech-debt: direction and investment level vs codebase
inventory. cto-advisor drops every "tech debt" trigger phrase.
- prd-writer / prd-task-creator: authoring the PRD document vs filing settled
requirements into a tracker as issues and sliced sub-issues.
- release / release-pr-gates: cutting the release (semver + patch notes) vs
holding the pre-merge gate on required CI checks.
- pr-comments / gh-address-comments: read-only digest vs implementing the
fixes. gh-address-comments no longer leads with "fetching threads".
- audit / design-consistency-auditor / accessibility: the broad five-dimension
sweep now routes deep passes to the two specialists; the specialists stop
claiming each other's ground (design-consistency-auditor drops its
accessibility triggers and tag).
- layout / polish: structural composition vs the last detail pass on a
functionally complete feature.
Trigger lists move out of description and into when_to_use for the
user-invoked skills, per the house writing craft. Versions bumped in both
SKILL.md and plugin.json. Local modifications recorded in the three
impeccable-derived READMEs.
Catalog regenerated (no drift); validate-skill-sync.sh reports 0 errors and
no new warnings on the edited skills.
* fix: regenerate marketplace bundles for disjoint trigger frontmatter
The bundles/ tree and .claude-plugin/marketplace.json are committed build
outputs; CI verifies they match the skills/ sources. The trigger-collision
commit only ran catalog:generate, so the bundle mirrors of the 13 edited
skills kept their old descriptions and versions and CI's bundle-freshness
gate failed. Rebased onto master (picks up #96) and ran the full
marketplace:generate.
* fix: split debug and systematic-debugging into front door and escalation lane
A duplicate-detection audit flagged `debug` and `systematic-debugging` as two
hypothesis-driven debugging loops with colliding triggers. Both auto-activated
on "bug / unexpected behavior / performance regression", neither named the
other, so activation was arbitrary.
Resolved by delegation, mirroring the review-dispatch -> code-review /
full-code-review contract pattern. `systematic-debugging` is kept rather than
merged away because it carries obra/superpowers provenance tracked in
scripts/provenance-manifest.json and .agents/memory/system/upstream-tracking.md.
- debug (2.0.0) becomes the front door: the 6-step operational loop that
duplicated the four phases is now a 5-step front-door loop with a checkable
bound per step, plus a Contract block whose Delegates To names
systematic-debugging, execution-debugging, and bug, and an escalation table
naming the five signals that hand a case over. Its unique value — the
feedback-loop menu, instrumentation rules, and 54-rule reference library —
is untouched. Drops a duplicated "When to Apply" section.
- systematic-debugging (1.1.0) keeps the four phases, the Iron Law, and the red
flags verbatim from upstream. Adds an Entry Point section naming debug as the
front door and narrows "When to Use" to escalation. README's Local
modifications line reclassifies it vendored -> adapted and records the
divergence.
- Triggers made disjoint: debug takes first-contact wording (new bug report,
crash, how do I reproduce this, where should I add logging, bug pattern
lookup, triage); systematic-debugging takes escalation wording (that fix did
not work, keeps breaking, tried several fixes, prove the root cause first).
Dropping "test failing" from systematic-debugging also clears a secondary
collision with execution-debugging.
- bug (1.0.1) and commands/bug.md pointed at the ambiguous pair; they now name
debug alone, since it escalates on its own.
catalog:generate is a no-op (no skill added or removed, so README lists,
category counts, and plugin-categories.json bundles are unchanged).
validate-skill-sync.sh: 0 errors, 28 pre-existing warnings, none on the edited
skills. markdownlint clean.
Closes#98
* fix: regenerate marketplace bundles after debug skill split
bundles/ and .claude-plugin/marketplace.json are committed build outputs
verified by CI; only catalog:generate had been run, so the bundle mirrors
kept the pre-split frontmatter.
* refactor: make testing-expert the generalist testing front door
The duplicate-detection audit found testing-expert restating
framework-specific material owned by the two specialists: its
references/full-guide.md carried React Testing Library component and hook
examples already covered by react-testing-library's 43 rules, plus NestJS
testing-module, Supertest, and DB-mocking examples belonging to
nestjs-testing-expert. All three descriptions overlapped, so React- and
NestJS-testing phrasing could pull in the generalist instead of the
specialist.
testing-expert is now framework-agnostic: level selection, coverage
philosophy (branch over line), refactor-surviving test design, test-data
strategy, and a flake diagnosis table. It gains a Contract block whose
Delegates To section routes framework work to the specialists, following
the review-dispatch/test-dispatch pattern, plus a routing table that fires
before it answers. references/full-guide.md is deleted.
nestjs-testing-expert absorbs the concrete Nest patterns so the routing
target actually holds the material: service and controller specs, provider
and guard overrides, integration and e2e boots, and a database strategy
table. Examples are ORM-neutral rather than Mongoose-pinned.
react-testing-library declares its scope and drops a dangling
metadata.json reference link.
Descriptions and when_to_use on all three are sharpened so component/hook
and Nest module phrasing triggers the specialist, and only strategy
phrasing reaches the generalist. Each skill bumped to 1.1.0 in SKILL.md
and plugin.json; catalog, bundles, and marketplace regenerated.
Closes#99
* fix: regenerate nestjs-testing-expert bundle mirror
bundles/ is a committed build output verified by CI; the testing-expert
rework edited skills/nestjs-testing-expert without re-running
marketplace:generate, so the bundle copy drifted.
A duplicate-detection audit flagged skills/analyze-codebase/ and
skills/codebase-advisor/ as near-identical in intent. codebase-advisor
wins on every axis: Hard Rules, a Contract block, the user-invoked
invocation split, scoped allowed-tools, effort levels, and a references/
tree. analyze-codebase was a thin five-step outline with none of it.
Fold in the one capability analyze-codebase had that the advisor lacked:
producing a written architecture and health document for a human, rather
than plan files for an executor. It lands as the `report` variant, with
the discovery pass and section structure in references/analysis-report.md
so SKILL.md only carries what every branch needs.
- Absorb its triggers into description/when_to_use (analyze codebase,
architecture review, project health check, onboarding).
- Widen Hard Rule 1 and the Contract to cover the report artifact, and
add the tools it needs (tree, .agents/memory writes).
- Bump codebase-advisor 1.0.1 -> 1.1.0 in SKILL.md and plugin.json.
- Delete skills/analyze-codebase/, drop it from the README Dev Workflow
list (43 -> 42) and the dev-workflow bundle, and regenerate.
scripts/classify-provenance.workflow.js keeps its mention: that array is
a frozen one-shot snapshot that still names skills retired in bacfbda.
Closes#97
A duplicate-detection audit found performance-expert restating React
render guidance that already lives in react-component-performance:
memoization (useMemo/useCallback/React.memo), virtualization, and an
"Unnecessary Re-renders" section with duplicated code samples. Both
descriptions also claimed React performance triggers, so the two skills
competed for the same activation.
performance-expert now owns backend, database, and infrastructure
performance plus the delivery layer (queries, indexes, N+1, caching,
background jobs, profiling, bundle and asset delivery, CDN/edge). Its
React render content is removed from both SKILL.md and
references/full-guide.md, and a Contract block delegates that work to
react-component-performance (and whole-monorepo audits to
workspace-performance-audit), matching the contract style in
skills/review-dispatch/SKILL.md.
Triggers are now disjoint: React render, re-render, memo, and Profiler
phrasing routes to react-component-performance only; API latency, query,
cache, and infra phrasing routes to performance-expert only. Both skills
gained a when_to_use trigger list and a pointer to the other.
react-component-performance is derived from an individual's repo, so it
is adapted rather than vendored — its README Local modifications line now
records the trigger rewrite; workflow and patterns stay upstream-identical.
Both skills bumped to 1.1.0 in SKILL.md and plugin.json. Catalog and
marketplace bundles regenerated; validate-skill-sync reports 0 errors.
Neither skill is deleted.
Closes#101
Issue Governance failed on every issue opened in the last batch (#97-#101)
with gh's item-edit usage text. The step added the issue to the board, threw
away the item id that item-add returned, and re-ran the paginated items query
to find it again. That query reads a replica that lags behind the write, so
it came back empty, ITEM resolved to the empty string, and
'item-edit --id ""' failed before any field was set — leaving those issues
on the board with no Priority, no Type, and no needs-triage label.
Keep the id from item-add, and hard-fail with a readable message if the id
still cannot be resolved rather than calling item-edit with a blank --id.
* feat: add grok second-opinion review lane, fix catalog drift
- New grok-review skill: /review grok [target] runs one headless Grok CLI
pass on the exact diff (CLI default model/effort, no execution flags),
then verifies every finding in-session before reporting. Report-only.
- review-dispatch 1.4.0: parse the grok engine token, route gathered
diffs to grok-review; retro stays native; engine and depth flags are
mutually exclusive.
- README sync: remove ghost deslop-ui entry, list nestjs-testing-expert
(also added to the backend bundle), category counts corrected.
- skill-auditor 1.2.0: README-sync recipe now reads the categorized
backtick lists (the skills.sh link table no longer exists); orphaned
example table row restored to its table.
- Regenerated catalog facts (169 skills / 182 plugins).
* chore: regenerate marketplace bundles for grok-review lane
* feat: adopt Pocock skill craft and missing primitives
Fold grilling, domain-modeling, wait-what, wizard, prototype, and
codebase-design into the catalog, plus a user-invoked Dev Loop
router, without copying his 25-skill toolkit.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: include docs/ in generated catalog layout
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: retire session-documenter, session-start, and session-end skills
Session history lives in GitHub Issues and repo .agents/memory/ — the
session-doc ritual is no longer part of the workflow. Removes the three
skills from skills/, the session bundle, marketplace.json,
plugin-categories.json, and every cross-reference; regenerates catalog
artifacts via bun run marketplace:generate.
* fix(deps): override brace-expansion, js-yaml, linkify-it to patched versions
bun audit flagged 4 high advisories in markdownlint-cli transitive deps;
compatible-range update cannot reach the fixed versions, so pin via
overrides (same pattern as the existing picomatch override).
- skill-standards.md: model-reference check is a hard error since 400068d, not a warning
- provenance-manifest.json + upstream-tracking.md: tool-design no longer retains a pinned model name; its code example uses the YOUR_MODEL placeholder
github-actions[bot]