@aryaminus/controlkeel-opencode 0.3.64 → 0.3.66

package/.opencode/skills/agent-integration/SKILL.md

@@ -50,6 +50,11 @@ Use this skill when the task is attaching or distributing ControlKeel across age
 3. Export plugin bundles when the user wants a shareable package.
 4. For MCP-only tools, generate the instruction bundle and installation guidance.
 5. For Conductor, prefer the Claude Code install path because Conductor documents support for `.mcp.json`, `CLAUDE.md`, and `.claude/commands`.
+6. Treat the target matrix as the discovery contract: every listed native skill directory is scanned by the registry, while host-specific non-skill companions remain documented separately.
+7. For `ck_attach`, validate the canonical project inside `CK_PROJECT_ROOT` for every scope. User scope changes native destinations but does not authorize another project; consult the target matrix for hosts whose MCP registration also updates a user-managed config path.
+8. Run the complete verification path after install: `controlkeel setup`, `controlkeel attach <host>`, `controlkeel attach doctor`, `controlkeel provider doctor`, `controlkeel status`, and `controlkeel findings`.
+9. Keep boundaries explicit: project attach mutates the governed repo; user scope is valid only for targets that advertise it and writes user-level host files. Local stdio MCP has the full local tool set, while hosted MCP is a narrower OAuth-scoped set.
+10. Describe exported plugin and marketplace manifests as installable bundles, not as proof that a public marketplace has published or approved them.
 
 ## Cursor (Rules, Skills, Agents, Hooks, Plugins)
 
@@ -65,7 +70,7 @@ Cursor’s **Settings → Rules, Skills, Subagents** (and related **Commands**,
 | **MCP** | `.cursor/mcp.json` | Stdio MCP; use `${workspaceFolder}` for command paths and `CK_PROJECT_ROOT`. |
 | **Plugins** | `.cursor-plugin/` | Distributable bundle (`plugin.json`, mirrored assets, `hooks/hooks.json`, `mcpServers`) for **Plugins → Install** / marketplace-style flows. |
 
-**Install path:** `controlkeel attach cursor` in the governed repo root, then enable the ControlKeel MCP server in Cursor and (if desired) install the generated `.cursor-plugin` from the repo or a release export.
+**Install path:** run `controlkeel setup` and `controlkeel attach cursor` in the governed repo root, then enable the local ControlKeel MCP server in Cursor and (if desired) install the generated `.cursor-plugin` from the repo or a release export. The generated marketplace-style bundle is not itself a public marketplace listing. Finish with `controlkeel attach doctor`, `controlkeel provider doctor`, `controlkeel status`, and `controlkeel findings`.
 
 ## Additional resources
 

package/.opencode/skills/agent-integration/references/target-matrix.md

@@ -6,16 +6,29 @@
 - Claude Code: `.claude/skills`, `.claude/agents`, plugins
 - Copilot / VS Code: `.github/skills`, `.github/agents`, plugins
 - Cursor: `.cursor/skills`, `.cursor/agents`, `.cursor/rules`, `.cursor/hooks.json`, `.cursor/mcp.json`, `.cursor-plugin/`
+- OpenCode: `.opencode/skills` and `.agents/skills`
+- Augment: `.augment/skills`
+- Kilo: `.kilo/skills`
+- Devin for Terminal: `.devin/skills` (project), `~/.config/devin/skills` (user)
+- Warp: `.warp/skills` and `.agents/skills`
 - Conductor compatibility: use Claude Code repo-local surfaces (`.mcp.json`, `CLAUDE.md`, `.claude/commands`)
 
 ## MCP-only fallback
 
-- Windsurf
+- Windsurf (native rules/workflows/hooks; AgentSkills compatibility via `.agents/skills`)
 - Kiro
 - Amp
-- OpenCode
 - Gemini CLI
 - Continue
 - Aider
 
 All MCP-only tools should still receive CK instruction snippets so the model knows how and when to call CK tools.
+
+## Scope and distribution boundaries
+
+- Project scope writes into the governed repository. User scope writes host-level files only when the target advertises user support; project binding and evidence remain project-specific.
+- `ck_attach` always authorizes an existing canonical project inside `CK_PROJECT_ROOT`, regardless of scope. Scope changes artifact destinations, not which project may be attached.
+- Some hosts keep MCP registration in a user-managed config even when companion artifacts are project-scoped. Current examples include Cursor, Windsurf, Kiro, Kilo, Amp, Augment, OpenCode, Gemini CLI, Cline, Continue, and Goose. Their attach output identifies the exact host config path before restart; this host registration is separate from project-root authorization.
+- Local stdio MCP exposes the full local catalog. Hosted MCP is a separate service-account OAuth surface with a narrower scope-authorized catalog; consult `docs/support-matrix.md` for exact tool availability.
+- Exported plugin directories and marketplace manifests are release/install bundles. They are not evidence that a host's public marketplace has published or approved ControlKeel.
+- `github.com/.../releases/latest/download/...` selects a versioned release asset. `raw.githubusercontent.com/.../main/...` reads mutable default-branch content.

package/package.json

@@ -35,5 +35,5 @@
     "url": "git+https://github.com/aryaminus/controlkeel.git"
   },
   "type": "module",
-  "version": "0.3.64"
+  "version": "0.3.66"
 }