* refactor!: unify GitHub identities and provider-aware board workflows
* fix: resolve renamed helpers from their installed packages
* fix: validate published names and preserve transport types
* fix: enforce skill repair and monitoring contracts
* fix!: clarify repair authority and persistent QA intake
* fix: align QA intake states and metaphor exceptions
* fix: preserve repair authority at the test command entry
* fix: align test input contract with Bun support
* fix: specify durable QA intake recovery ordering
* feat!: consolidate test/scan/env/prompt/performance commands behind skills
- merge /tests into /test run (scope tokens forwarded; /tests retired)
- retire /performance; /refactor perf is the sole performance front door
- rewire /scan as a thin security front door (security-audit + dependency-audit)
- add env-setup skill; /env becomes a thin router to it
- move the Lyra 4-D framework into prompt-engineering references; /prompt goes thin
- document intentional command shortcuts (/qa, /deslop, PR-flow trio) in README
- regenerate bundles + marketplace (185 skills, 30 commands, 198 plugins)
* fix(test-dispatch,env-setup): correct router contract and env discovery scan
Three CodeRabbit findings on #127, all verified against the source before
fixing.
test-dispatch understated what it routes into. Its Creates/Modifies claimed the
router mutates "nothing directly" and its Confirmation Required listed only
e2e/coverage/init as mutating — but `run` delegates to test-runner, whose
auto-fix loop edits the code under test and its tests until green. A reader
picking a route from the contract would have believed `/test run` was safe.
The fix corrects the documentation rather than adding a gate: test-runner's
unprompted edit of the file under test IS `/test run`, and `--no-fix` is the
existing, designed way to ask for a report with no edits. Bolting a blanket
confirmation onto the auto-fix loop would contradict both. The contract now
names which routes mutate, and points at `--no-fix` instead of a gate
test-runner does not have.
env-setup's discovery command had a filter that silently filtered nothing:
`grep -oh` prints only the matched text with the filename suppressed, so the
downstream `grep -v node_modules` had no path to match against and dependency
hits stayed in the inventory. Exclusion is now directory-scoped
(`--exclude-dir`), the pattern also covers bracket access
(`process.env["X"]`), and the surrounding prose states what the scan cannot
see — helper functions, destructures, dynamic keys, and non-JS services in the
same repo — so the output reads as a starting inventory, not an answer.
`/test run unit | integration | e2e` sat inside a bash fence, where copy-paste
runs a pipeline instead of picking a scope. Split into three commands in both
the skill and commands/test.md.
Verified: validate-changed-skills 0 errors/0 warnings, markdownlint 0 issues,
biome clean, catalog regenerated to 186 skills / 199 plugins. The discovery
grep was run against this repo and returns real variable names.
- new gh-board-sync skill (1.0.0): read-only reconciliation of a GitHub
Projects v2 board against real repo state across eight checks —
merged-not-Done, Done-not-merged (false green), stale In Progress,
Human Review starvation, untracked work, epic/parent drift, sprint
readiness, and Priority hygiene — ending with a board-trustworthy verdict
- bundled gh-board-sync-report.mjs: paginated GraphQL board read,
issue<->PR resolution via closedByPullRequestsReferences and closing
keywords, per-repo merge/issue/milestone activity, configurable
--window/--stale/--horizon, --json output; always read-only
- sprint readiness lists each due milestone's open issues as the coming
sprint's focus list; horizon defaults to 7 days, --horizon for longer
sprints
- --apply (skill-driven, not the script) sets Status/Priority only, one
confirmation per check category; never closes, merges, or touches
milestones
- /board becomes a full front door like /cleanup: status, init, audit,
normalize, copy, sync [--apply], schedule [days], review — shape modes
route to gh-project-board, truth modes to gh-board-sync
- add gh-board-sync to github and dev-loop bundles; regenerate bundles,
marketplace.json (198 plugins, 185 skills), and catalog counts
* feat!: rename release-cleanup to git-cleanup behind /cleanup, retire /clean and /inbox
- rename skills/release-cleanup -> skills/git-cleanup (v3.0.0): branch and
worktree pruning is git hygiene, not a release step
- new /cleanup command front door: branches, worktrees, verify, prune,
tasks, sessions, all — absorbs the old /clean command
- delete /inbox command (dead .agents/inbox.md capture flow; the gh-inbox
skill stays for GitHub-scoped triage)
- release-dispatch v2.0.0: cleanup/prune subcommands now point to /cleanup
and stop instead of routing to a release engine
- sharpen /merge copy: default merges ALL approved open PRs, prune step
delegates to git-cleanup
- update all cross-references (merge-open-prs, worktree, release, pstack)
with version bumps and mirrored plugin.json files
- regenerate bundles, marketplace.json, and catalog counts (31 commands)
* fix(git-cleanup): prove merges by patch identity, not commit subject
CodeRabbit flagged the rule-3 fallback on #125. Verified in a sandbox: a
branch whose only commit subject matched a merged PR title was classified
PRUNABLE and would have reached `git branch -D` / `git push origin --delete`,
even though its contents were entirely unmerged.
Subject matching was also near-useless for the case it was written for — a
squash merge rewrites several branch subjects into one PR title, so they
stop matching anyway. Replaced with git patch-id:
- per-commit equivalence via `git cherry`, then
- cumulative-diff patch-id against trunk commits since the merge base
(bounded at 500; unproven => reported, never deleted)
Verified against four cases: unmerged decoy with a colliding subject (not
prunable), genuine squash merge (prunable), rebased copy (prunable), and
merged work plus a new commit (not prunable).
Also from the same review:
- /release prune now redirects to /cleanup instead of falling through to the
unknown-argument path (release-dispatch already accepted both spellings)
- release-dispatch Creates/Modifies no longer advertises branch/worktree
deletion, which no /release mode can reach
- /cleanup closes issues with a PR/commit URL rather than a gitignored
.agents/sessions path that GitHub readers cannot open
- session backups write to a sibling dir, not inside the directory being
consolidated
* feat: port Lauren Tan pstack skills and recut tdd/de-slop
Add pstack as a model-agnostic playbook orchestrator plus the high-value
workflow skills that this catalog did not already cover. Rewrite tdd and
de-slop in place with pstack rigor. Keep existing skill ids. Attribute
MIT to Lauren Tan / cursor/plugins.
Co-authored-by: Vincent <vincent@shipshit.dev>
* fix: regenerate marketplace snapshots after pstack port
CI regenerates bundles and marketplace.json, then fails if they drift.
The port updated catalog sources but left those generated snapshots stale.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
- validate-skill-sync.sh: hard-error when plugin.json version != SKILL.md
metadata.version, or plugin.json description is a YAML block marker
- new scripts/check-skill-version-bumps.sh (bun run version:check): CI fails
when a skill's content changes without a metadata.version bump vs base
- CI: fetch-depth 0 + version:check step after validate
- sync 12 drifted plugin.json versions to SKILL.md; fix turborepo/html-style
junk descriptions
- bundle plugin.json + marketplace.json versions now come from
package.json / skill plugin.json instead of hardcoded 1.0.0
- fixtures + regression tests for both validator gates
A duplicate-detection audit flagged skills/analyze-codebase/ and
skills/codebase-advisor/ as near-identical in intent. codebase-advisor
wins on every axis: Hard Rules, a Contract block, the user-invoked
invocation split, scoped allowed-tools, effort levels, and a references/
tree. analyze-codebase was a thin five-step outline with none of it.
Fold in the one capability analyze-codebase had that the advisor lacked:
producing a written architecture and health document for a human, rather
than plan files for an executor. It lands as the `report` variant, with
the discovery pass and section structure in references/analysis-report.md
so SKILL.md only carries what every branch needs.
- Absorb its triggers into description/when_to_use (analyze codebase,
architecture review, project health check, onboarding).
- Widen Hard Rule 1 and the Contract to cover the report artifact, and
add the tools it needs (tree, .agents/memory writes).
- Bump codebase-advisor 1.0.1 -> 1.1.0 in SKILL.md and plugin.json.
- Delete skills/analyze-codebase/, drop it from the README Dev Workflow
list (43 -> 42) and the dev-workflow bundle, and regenerate.
scripts/classify-provenance.workflow.js keeps its mention: that array is
a frozen one-shot snapshot that still names skills retired in bacfbda.
Closes#97
* feat: add grok second-opinion review lane, fix catalog drift
- New grok-review skill: /review grok [target] runs one headless Grok CLI
pass on the exact diff (CLI default model/effort, no execution flags),
then verifies every finding in-session before reporting. Report-only.
- review-dispatch 1.4.0: parse the grok engine token, route gathered
diffs to grok-review; retro stays native; engine and depth flags are
mutually exclusive.
- README sync: remove ghost deslop-ui entry, list nestjs-testing-expert
(also added to the backend bundle), category counts corrected.
- skill-auditor 1.2.0: README-sync recipe now reads the categorized
backtick lists (the skills.sh link table no longer exists); orphaned
example table row restored to its table.
- Regenerated catalog facts (169 skills / 182 plugins).
* chore: regenerate marketplace bundles for grok-review lane
* feat: adopt Pocock skill craft and missing primitives
Fold grilling, domain-modeling, wait-what, wizard, prototype, and
codebase-design into the catalog, plus a user-invoked Dev Loop
router, without copying his 25-skill toolkit.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: include docs/ in generated catalog layout
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: retire session-documenter, session-start, and session-end skills
Session history lives in GitHub Issues and repo .agents/memory/ — the
session-doc ritual is no longer part of the workflow. Removes the three
skills from skills/, the session bundle, marketplace.json,
plugin-categories.json, and every cross-reference; regenerates catalog
artifacts via bun run marketplace:generate.
* fix(deps): override brace-expansion, js-yaml, linkify-it to patched versions
bun audit flagged 4 high advisories in markdownlint-cli transitive deps;
compatible-range update cannot reach the fixed versions, so pin via
overrides (same pattern as the existing picomatch override).
- skill-standards.md: model-reference check is a hard error since 400068d, not a warning
- provenance-manifest.json + upstream-tracking.md: tool-design no longer retains a pinned model name; its code example uses the YOUR_MODEL placeholder
The generator sliced every skill description to 100 chars, which cut the
'Use when …' trigger clauses (added in this PR) off mid-word in the catalog
— e.g. 'Use when ad', 'build configuration. Us', 'profiling or improvi'.
115+ of 155 descriptions were affected.
Emit the full SKILL.md description instead (the source frontmatter is already
length-capped at 1024/1536). Collapse whitespace so literal (`|`) block
scalars like turborepo render as a single-line blurb rather than leaking
embedded newlines. Regenerated marketplace.json: 155 descriptions expanded,
0 structural changes, valid JSON.
Implements three independent enhancements (#39, #26, #27):
#39 codex-image-gen skill (ai-agents bundle)
- New skill that drives the Codex CLI image tool and extracts the finished
PNG from the session rollout JSONL (the headless `codex exec` path never
writes the image to disk). Ships SKILL.md, plugin.json, and a Python
extractor helper, plus an AppIcon.appiconset worked example and the
alias/sandbox, size/alpha, and fragility caveats.
#26 dispatch:plan planning gate
- New plan-dispatch.yml: a human applies `dispatch:plan` to a Backlog issue;
the Claude lane runs the writing-plans contract, posts/updates a trusted
`## Implementation Plan` comment, moves the board to Human Review, assigns
the gate-applier, and applies NO execution gate. Planning and execution stay
separated by human validation.
- setup-dev-loop.sh seeds the dispatch:plan label and installs the workflow.
- Documented in triage-labels.md, setup-agent-routing, loop.md, ai-dev-loop.md
(incl. HITL issues never receiving any gate, dispatch:plan included).
#27 local /codex-loop command
- Codex twin of /loop: claims one dispatch:codex Backlog issue, runs the
executing-plans contract through `codex exec`, opens a PR, hands off to
Human Review. Same 30-min claim lock, reads the `## Implementation Plan`
comment, one issue per invocation. loop.md no longer calls the Codex lane
push-only and cross-references /codex-loop.
Bundles + marketplace.json regenerated; README counts updated (147 skills,
21 commands). All gates green: bun run validate, bun run lint (markdownlint +
biome + shellcheck), actionlint.
Mirrors the /review and /release dispatcher pattern — one front door per domain
instead of scattered single-skill commands. No behavior removed; routers delegate
to the existing skills behind their own gates.
New dispatchers (skill + front-door command):
/skill create|capture|comply|scout → skill-* skills
/design audit|clarify|critique|layout|polish|quieter|shape|consistency
/test run|qa|tdd|e2e|coverage|init|regression
/agent audit|config|init|route
/prd new|spec|gate|write|intake|interview
/deploy app|compose|ec2|monitor|devcontainer
Extended /pr with PR-scoped actions: address (gh-address-comments),
fix-ci (gh-fix-ci), suggest (gh-review-suggestions). gh-inbox and
gh-project-board left standalone (cross-PR scope, not single-PR).
Registered in plugin-categories.json; marketplace.json + bundles regenerated.
Skill count 146 → 152 (README, AGENTS.md, package.json).
One front door for the release lifecycle, mirroring the /review → review-dispatch
pattern. Subcommands route to the existing engines (no behavior removed):
/release status: trunk, latest tag, commits since, CI state + usage
/release gates → release-pr-gates (verify CI green, cut tag/release or release PR)
/release cut|notes|patch|minor|major|vX.Y.Z → release (semver + patch notes)
/release cleanup → release-cleanup (prune merged branches + stale worktrees)
- New skills/release-dispatch (explicit-invoke only; read-only until the
delegated skill's own confirmation gate).
- commands/release.md rewritten as the front door.
- Registered in plugin-categories.json; marketplace.json + bundles regenerated.
- Skill count 146 → 147 (README, AGENTS.md, package.json).
Close gaps found by comparing the Cursor cursor-team-kit skills against our
library. Adds four skills + four commands and extends four existing skills.
New skills:
- standup: author-scoped git recap (collapses Cursor weekly-review +
what-did-i-get-done)
- test-runner: scoped/changed/full/e2e/types test execution with a
read-trace, fix, rerun-until-green loop (subsumes run-smoke-tests +
check-compiler-errors)
- pr-comments: read-only, severity-tagged, priority-ordered PR comment digest
(get-pr-comments)
- fix-merge-conflicts: correctness-first conflict resolution, lockfile regen,
rebuild-before-continue; model-invokable so it auto-triggers on conflicts
New commands: /standup, /tests, /pr (dispatcher), /deslop
Extended skills:
- de-slop: --changed diff-only scoping, two new slop patterns (defensive
try-catch, over-nesting -> early returns), explicit Modes section
- gh-pr-publish: Reviewability Pass (/pr tidy) - rewrites the PR description
for reviewers; description only, no commit reorg (squash-merge repo)
- gh-fix-ci: autonomous loop-until-green mode, gh pr checks --json as truth
source, external-check link inspection (loop-on-ci parity)
- merge-open-prs: delegates conflicted PRs to fix-merge-conflicts
Registered the new skills in plugin-categories.json and regenerated bundles
and marketplace.json. Avoids files owned by the open /review PR to stay
conflict-free. Validate + lint clean; bundles regenerate deterministically.
Add a single front door for code review instead of remembering which of
six review skills fits which scope.
- commands/review.md: /review command with target modes — working tree,
single PR, all open PRs (summary table), last N commits, and time
windows (24h/7d/2w) — plus a --deep flag for the orchestrated pass.
- skills/review-dispatch: the router behind /review. Parses the arg into
(mode, depth), resolves the target to diffs with read-only git/gh, and
delegates to code-review (quick gate) or full-code-review (deep). Holds
no rubrics of its own. Read-only throughout.
- structural-review: add Design Purity (same behavior, less structure —
code-judo) and Directness vs Magic (speculative generality, hidden
assumptions) axes to close the gaps vs Cursor's thermo-nuclear rubric;
mirror both into full-code-review's inline structural reviewer prompt.
- merge.md: point the per-PR review step at the same engine as
/review prs so the two share one mental model.
- full-code-review.js: document why reviewer rubrics are inlined (Workflow
sandbox has no filesystem access) and name the canonical source skills.
Regenerated marketplace.json + dev-workflow bundle (review-dispatch added
to plugin-categories.json). All 142 skills pass validate-skill-sync;
markdownlint clean.
* feat(dev-loop): add ready-for-agent dispatch + setup-agent-routing skill
Human-gated autonomous execution for the AI dev loop, in two phases that share
one dispatch contract: an issue runs only when a human applies `ready-for-agent`
(opt-in) and it sits in `status:todo`.
- setup-agent-routing: new skill that writes an `## Agent skills` routing block
+ docs/agents/ so the dev-loop skills (executing-plans, feature-intake,
writing-prds, qa-reviewer) know a consumer repo's tracker, label vocabulary,
and domain layout. Adapted port of setup-matt-pocock-skills.
- commands/loop.md: Phase 1 local pull loop (/loop, --status, --list) wrapping
executing-plans. One invocation = one task, never a daemon.
- .github/workflows/agent-dispatch.yml: Phase 2 push dispatch on the
`ready-for-agent` label. OAuth-token-only auth (never ANTHROPIC_API_KEY),
per-issue concurrency, least-privilege permissions, untrusted issue body.
- executing-plans: candidate query now requires ready-for-agent + status:todo;
completion strips the gate; QA reject re-arms it (status:todo + ready-for-agent).
- .github/actionlint.yaml: register the Blacksmith runner label (also clears the
pre-existing false positive on generate-bundles.yml).
- Regenerate bundles + marketplace.json (session bundle 6 -> 7 skills).
* feat(dev-loop): add Codex/GPT lane + model-as-variable + setup script
Extend the ready-for-agent loop into a two-engine design:
- New codex-dispatch.yml: ready-for-codex gate routes to openai/codex-action@v1
(sandbox: workspace-write, safety-strategy: drop-sudo). The executing-plans
contract is inlined into the prompt since codex-action has no plugin-loading
equivalent; Codex auto-reads AGENTS.md/.codex. At most one gate per issue.
- Model selection is now a repo VARIABLE, not hardcoded or secret. Claude lane:
claude_args --model vars.AGENT_MODEL (fallback sonnet-4-6). Codex lane:
vars.CODEX_MODEL / vars.CODEX_EFFORT. Only auth tokens stay secret.
- scripts/setup-dev-loop.sh: one-shot per-repo provisioning — seeds labels
(incl. ready-for-codex), installs both workflows, arms CLAUDE_CODE_OAUTH_TOKEN
+ OPENAI_API_KEY, prints the gh variable set commands. --dry-run/--skip flags.
- Docs: AI-DEV-LOOP.md two-lane rewrite + planner/executor/QA role table;
setup-agent-routing SKILL + triage-labels seed gain the ready-for-codex gate;
commands/loop.md notes /loop is the Claude lane (Codex is push-only).
Verified: validate, shellcheck, markdownlint, actionlint all green.
* feat(skills): store implementation plans as issue comments, not local docs/plans files
writing-plans (ported from obra/superpowers) was saving the plan to a local
docs/plans/YYYY-MM-DD-<feature>.md file. That file desyncs from the project the
moment work starts and never crosses to CI, so the cross-engine "Claude plans ->
Codex executes" handoff silently failed on the plan path.
Now the plan is posted as a `## Implementation Plan` comment on the work/PRD
issue, mirroring how writing-prds stores the PRD in the issue body. A comment
co-locates plan + PRD on one issue while keeping the PRD body clean (feature-intake
forbids plans in the body). The executor and both dispatch lanes already read the
issue body, linked PRD, and ALL comments, so the plan reaches CI for either engine
with no executor/workflow/label change — the handoff gap closes for free.
- writing-plans: "Saving the Plan" -> "Storing the Plan" (gh issue comment
--body-file -); killed the docs/plans default; confirm-before-post; no-tracker
fallback; >65k-char split note; label-driven Execution Handoff; version 1.0.0 -> 1.1.0
- writing-plans/README: recorded the storage divergence so future upstream syncs preserve it
- executing-plans: the `## Implementation Plan` comment is the authoritative plan
- AI-DEV-LOOP: both planning artifacts live on the issue (PRD=body, plan=comment)
- writing-prds: "plan the X PRD" flow points at the plan comment
- regenerated planning + session bundles
Vincent