@bongos/core 1.20.9 → 1.20.11

package/.claude/skills/scan-before-install/SKILL.md

@@ -2,6 +2,12 @@
 name: scan-before-install
 description: >-
   Vet a third-party GitHub repo or Claude plugin BEFORE installing: quarantined fetch, deterministic floor, subagent panel over a scrubbed mirror, arithmetic verdict, evidence-gated landings. The scanner never installs. Triggers: "/scan-before-install", "is this plugin safe to install", "vet this GitHub repo".
+plain: >-
+  Checks an outside add-on or code project for safety problems before you install it.
+reach-for: >-
+  Before adding anything to the project that someone else wrote.
+cost: >-
+  Uses your session, more than most because several reviewers read the code. It never installs anything itself.
 ---
 
 You are scanning a third-party artifact someone wants to install. The engine lives in `modules/security/artifact-scan/` — this skill is the orchestration wrapper: it runs the pipeline, spawns the panel, and lands one of three offers. Every load-bearing decision below is an owner decision; do not soften any of them.

package/.claude/skills/session-handoff/SKILL.md

@@ -2,6 +2,12 @@
 name: session-handoff
 description: >-
   Emit a paste-ready next-steps prompt so a FRESH session starts with curated context. Read-only. Triggers: "/session-handoff", "hand off to a fresh session", "give me a handoff prompt", "wrap up context for next time", "write the next-steps prompt", "I want to continue this in a new session", "context is getting heavy, prep a fresh start".
+plain: >-
+  Writes a ready-to-paste note so a fresh conversation can pick up exactly where this one left off.
+reach-for: >-
+  When this conversation is getting long and you want to continue in a new one.
+cost: >-
+  Free, and it changes nothing. It only writes the note for you to copy.
 ---
 
 You are producing a **handoff prompt**: a single, self-contained block of text the builder will **copy and paste as the first message of a brand-new session** to continue this work with a clean, light context.

package/.claude/skills/ship-check/SKILL.md

@@ -2,6 +2,12 @@
 name: ship-check
 description: >-
   Run every freshness and fitness check ship.js will run, and get the healing command for each stale file. Triggers: "/ship-check", "am I ready to ship", "what will ship trip on", "check before I ship", "is anything stale".
+plain: >-
+  Runs the same checks a hand-in will run, and tells you how to fix anything that would fail.
+reach-for: >-
+  Before handing in work, to avoid a failed attempt.
+cost: >-
+  Free. It only checks; fixing is up to you.
 ---
 
 # /ship-check — the pre-ship table

package/.claude/skills/status/SKILL.md

@@ -2,6 +2,12 @@
 name: status
 description: >-
   Roll up a version or criterion in one call — its gating tasks, their live statuses, and what is blocking. Read-only. Answers "what's the status of X" and "what's left for criterion Cn". Triggers: "/status", "what's left for C8", "status of GDS-V3", "how far along is the memory criterion", "what tasks remain to complete X".
+plain: >-
+  Shows how far along a version or goal is: what is finished, what is left, and what is holding it up.
+reach-for: >-
+  When you want to know how much is left before something is done.
+cost: >-
+  Free, and it changes nothing. It only reads.
 ---
 
 You are answering a project-status question. Before this skill existed, doing so meant ~10 sequential Bongos calls (grep the seed file for which tasks map to a criterion, eyeball a "Gates R55–R63" sentence, then re-query each task's status). The structured criterion↔task link (`task_criteria`, migration 055) + the `/status` CLI collapse that to one call. See ADR 0025 and task #435.

package/.claude/skills/strand-fix/SKILL.md

@@ -3,6 +3,12 @@ name: strand-fix
 description: >-
   Land ONE stranded ship — a task parked at confirmed that the reconciler gave up on. Also the fix for a claim refused 409 REBASE_REQUIRED. Triggers: "/strand-fix N", "task N is stranded", "land the strand", "my claim says REBASE_REQUIRED".
 requires: [gh]
+plain: >-
+  Rescues one piece of approved work that got stuck on its way into the project, and gets it merged.
+reach-for: >-
+  When work is approved but never reached the live code, or a task refuses to start because older work is stuck.
+cost: >-
+  Uses your session. It gets the stuck work merged into the live code.
 ---
 
 You are landing one stranded task. The reconciler is not coming back for it — a strand produces no signal of its own, so nothing happens until someone walks it.

package/.claude/skills/tweak/SKILL.md

@@ -2,6 +2,12 @@
 name: tweak
 description: >-
   Apply the next submitted page tweak: claim the round, apply every line, render the page before and after, attach the renders and ship it to wait for the artist. Metic+. Triggers: "/tweak", "apply the next page tweak", "work the tweak queue".
+plain: >-
+  Applies the next set of change requests someone made to a page, and shows before and after pictures for the artist to approve.
+reach-for: >-
+  When page change requests are waiting to be done.
+cost: >-
+  Handing it in runs a paid quality review, usually a few dollars charged to the project. The change waits for the artist's approval.
 ---
 
 You are applying ONE page an artist rewrote in the studio (Tweak Mode, ADR 0341). The artist wrote the words; your job is to transcribe them faithfully, show the artist the result, and park it. **You never land it.** The artist approves the applied page first (ADR 0341 D7), and nothing here arms a merge.

package/.claude/skills/worktree-clean/SKILL.md

@@ -2,6 +2,12 @@
 name: worktree-clean
 description: >-
   Remove per-claim worktrees whose work landed, and sweep the husks a locked remove leaves, via junction-safe worktree.js — never raw git worktree remove, which follows the node_modules junction. Triggers: "/worktree-clean", "prune stale worktrees", "worktree husks".
+plain: >-
+  Tidies away old workspace folders on your computer whose work has already been merged.
+reach-for: >-
+  When your computer is collecting old workspaces.
+cost: >-
+  Free. It deletes only workspaces whose work is already safe in the project.
 ---
 
 **Script skill (authoritative).** Two scripts do the work; this skill only sequences them and shows the list before anything is removed.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 460 operations across 70 resource groups
+- 461 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -997,6 +997,8 @@ function createClient(opts = {}) {
       putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer
       postSpecialitiesIdUnoffer: (args) => request("POST", "/specialities/{id}/unoffer", { hasBody: true }, args),
+      // GET /specialities/installed-skills — rank: any-builder — GET /specialities/installed-skills
+      getSpecialitiesInstalledSkills: (args) => request("GET", "/specialities/installed-skills", { hasBody: false }, args),
       // GET /specialities/offered — rank: any-builder — GET /specialities/offered
       getSpecialitiesOffered: (args) => request("GET", "/specialities/offered", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -996,6 +996,8 @@ function createClient(opts = {}) {
       putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer
       postSpecialitiesIdUnoffer: (args) => request("POST", "/specialities/{id}/unoffer", { hasBody: true }, args),
+      // GET /specialities/installed-skills — rank: any-builder — GET /specialities/installed-skills
+      getSpecialitiesInstalledSkills: (args) => request("GET", "/specialities/installed-skills", { hasBody: false }, args),
       // GET /specialities/offered — rank: any-builder — GET /specialities/offered
       getSpecialitiesOffered: (args) => request("GET", "/specialities/offered", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -158,6 +158,7 @@ export interface GetSoftwareUpdateResponse { ok: boolean; update: unknown; door:
 export interface GetSpecialitiesIdDocumentsResponse { documents: unknown }
 export interface GetSpecialitiesIdResponse { speciality: unknown }
 export interface GetSpecialitiesIdSkillsResponse { speciality: unknown; adopted: boolean; enabled: unknown; skills: unknown }
+export interface GetSpecialitiesInstalledSkillsResponse { skills: unknown }
 export interface GetSpecialitiesOfferedResponse { suggestions: unknown }
 export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
@@ -1422,6 +1423,8 @@ export interface BongosClient {
     putSpecialitiesIdSkills(args: RequestArgs & { body: PutSpecialitiesIdSkillsRequest }): Promise<PutSpecialitiesIdSkillsResponse>;
     /** POST /specialities/{id}/unoffer — rank: metic+archon */
     postSpecialitiesIdUnoffer(args?: RequestArgs): Promise<PostSpecialitiesIdUnofferResponse>;
+    /** GET /specialities/installed-skills — rank: any-builder */
+    getSpecialitiesInstalledSkills(args?: RequestArgs): Promise<GetSpecialitiesInstalledSkillsResponse>;
     /** GET /specialities/offered — rank: any-builder */
     getSpecialitiesOffered(args?: RequestArgs): Promise<GetSpecialitiesOfferedResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -993,6 +993,8 @@ export function createClient(opts = {}) {
       putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer
       postSpecialitiesIdUnoffer: (args) => request("POST", "/specialities/{id}/unoffer", { hasBody: true }, args),
+      // GET /specialities/installed-skills — rank: any-builder — GET /specialities/installed-skills
+      getSpecialitiesInstalledSkills: (args) => request("GET", "/specialities/installed-skills", { hasBody: false }, args),
       // GET /specialities/offered — rank: any-builder — GET /specialities/offered
       getSpecialitiesOffered: (args) => request("GET", "/specialities/offered", { hasBody: false }, args),
     },

package/docs/api/openapi.json

@@ -17805,6 +17805,44 @@
         ]
       }
     },
+    "/specialities/installed-skills": {
+      "get": {
+        "operationId": "get_specialities_installed_skills",
+        "tags": [
+          "specialities"
+        ],
+        "summary": "GET /specialities/installed-skills",
+        "description": "GET /specialities/installed-skills — every skill THIS instance has, each explained the way the adoption walkthrough explains it, so a speciality's owner can choose what it offers from the hall (task 1004404). The CHOICES only: the POST/PATCH `skills` check (unknown_skill) is still the rule, so a stale page that sends a name removed since is refused, not trusted. Nothing here is per-builder and the list is public knowledge of the install — every name is already materialised into each checkout's .claude/skills/. Mounted before '/specialities/:id' would capture it as an id. Read-only; rank: any builder.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/specialities/routes/specialities.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetSpecialitiesInstalledSkillsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/specialities/offered": {
       "get": {
         "operationId": "get_specialities_offered",
@@ -23643,6 +23681,15 @@
           "skills"
         ]
       },
+      "GetSpecialitiesInstalledSkillsResponse": {
+        "type": "object",
+        "properties": {
+          "skills": {}
+        },
+        "required": [
+          "skills"
+        ]
+      },
       "GetSpecialitiesOfferedResponse": {
         "type": "object",
         "properties": {
@@ -29474,9 +29521,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 460,
-  "x-schema-count": 492,
+  "x-endpoint-count": 461,
+  "x-schema-count": 493,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 334,
+  "x-response-schemas": 335,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 460 endpoints across 82 route files.
+> **Generated from the live route files** — the route file is authoritative. 461 endpoints across 82 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -698,7 +698,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/software-update` | `any-builder` | — | GET /software-update — Settings → Software update (task 1004296): this project's core, the newest release its channel allows, what the ve… |
 
-## `specialities` (14)
+## `specialities` (15)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -715,6 +715,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/specialities/:id/skills` | `any-builder` | — | GET /specialities/:id/skills — what the adoption WALKTHROUGH shows (task 1004073, ADR 0310 §3): each skill the speciality offers, explain… |
 | PUT | `/api/bongos/specialities/:id/skills` | `any-builder` | `enabled_skills` | PUT /specialities/:id/skills — the caller's ENABLED set for a speciality they hold (task 1004072, ADR 0310 §2). |
 | POST | `/api/bongos/specialities/:id/unoffer` | `metic+archon` | — |  |
+| GET | `/api/bongos/specialities/installed-skills` | `any-builder` | — | GET /specialities/installed-skills — every skill THIS instance has, each explained the way the adoption walkthrough explains it, so a spe… |
 | GET | `/api/bongos/specialities/offered` | `any-builder` | — | GET /specialities/offered — the suggestions for THIS builder. |
 
 ## `sso` (8)