@delorenj/pjangler 1.2.19 → 1.2.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.2.19",
+  "version": "1.2.25",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -20,14 +20,18 @@
   },
   "scripts": {
     "build": "esbuild src/index.ts src/mcp-server.ts --bundle --packages=external --platform=node --format=esm --outdir=dist",
+    "check:audit:prod": "npm audit --omit=dev",
+    "check:lock": "node scripts/check-package-lock-parity.mjs",
+    "check:submodules": "node scripts/check-submodule-contract.mjs",
+    "check:tracked-secrets": "node scripts/check-tracked-secrets.mjs",
     "start": "node dist/index.js",
     "mcp": "node dist/mcp-server.js",
     "typecheck": "tsc --noEmit",
-    "test": "node tests/parity-migrate-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs",
+    "test": "npm run check:lock && npm run check:submodules && npm run check:tracked-secrets && node tests/release-regressions.mjs && node tests/submodule-contract-regressions.mjs && node tests/secret-publication-gate-regressions.mjs && node tests/bmad-version-surface-regressions.mjs && node tests/bmad-transaction-regressions.mjs && node tests/parity-migrate-regressions.mjs && node tests/pjan-43-regressions.mjs && node tests/skillex-init-regressions.mjs && node tests/fleet-shared-bloodbank-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs",
     "migrate:up": "node-pg-migrate --migrations-dir migrations up",
     "migrate:down": "node-pg-migrate --migrations-dir migrations down",
     "migrate:create": "node-pg-migrate --migrations-dir migrations create",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run check:lock && npm run check:submodules -- --remote --recursive --archive --npm && npm run build && npm run check:tracked-secrets"
   },
   "keywords": [
     "cli",
@@ -52,5 +56,12 @@
     "esbuild": "^0.25.0",
     "node-pg-migrate": "^8.0.0",
     "typescript": "^5"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/delorenj/pjangler.git"
+  },
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com"
   }
 }

package/templates/commonproject/copier.yml

@@ -90,8 +90,9 @@ agent_hooks_layer:
   default: true
   when: false
 
-# When agent_hooks_layer is false, omit the project-scoped hook tree + skill-link
-# scripts entirely (the mise.toml wiring is already gated inside the template).
+# When agent_hooks_layer is false, omit only the project-scoped hook tree. The
+# skills manifest stays — sync-skills.py writes project-local CLI dirs and is safe
+# even on machines that already run a global ~/.agents/hooks install.
 # The `.copier-noop-never-matches` sentinel keeps every pattern non-empty when the
 # layer is enabled, which copier requires.
 _exclude:
@@ -105,8 +106,6 @@ _exclude:
   - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/hooks{% endif %}"
   - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/hooks/**{% endif %}"
   - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/local.example.json{% endif %}"
-  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.mise/scripts/link-project-skills-to-clis.sh{% endif %}"
-  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.mise/scripts/unlink-project-skills-from-clis.sh{% endif %}"
 
 # --- Post-generation tasks ---
 #
@@ -120,5 +119,8 @@ _tasks:
   - "printf '\\n# Secrets + per-dev agent-hook/skill overrides (see .agents/local.example.json)\\n.env\\n.env.*\\n!.env.op\\n.agents/local.json\\n.kimi-code/\\n.lastagent\\n**/.claude/settings.local.json\\n' >> .gitignore"
   - "ln -sf AGENTS.md CLAUDE.md"
   - "ln -sf AGENTS.md GEMINI.md"
+  # Materialize the pinned Skillex BMAD manifest + symlink topology without
+  # copying pack content or disturbing project-specific, non-BMAD skills.
+  - "python3 .mise/scripts/provision-bmad-skills.py"
   # Stamp the repo's absolute path into .project.json (the SOT) post-render.
   - "python3 -c \"import json,os,pathlib; p=pathlib.Path('.project.json'); d=json.loads(p.read_text()); d['repo_path']=os.getcwd(); p.write_text(json.dumps(d,indent=2)+chr(10))\""

package/templates/commonproject/template/.agents/hooks/README.md

@@ -15,6 +15,7 @@ master writes zero bytes).
 mise run hooks-sync          # fan out the master -> claude + codex + hermes
 mise run hooks-check         # drift gate (read-only; used in CI)
 mise run hooks-uninstall     # remove codex + hermes injections
+mise run skills-sync         # sync .agents/skills.json -> local CLI skill dirs
 mise run hindsight-setup     # one-time: pull the shared CAF Hindsight key into .env
 ```
 
@@ -70,8 +71,7 @@ Copy [`.agents/local.example.json`](../local.example.json) → `.agents/local.js
   "hooks": {
     "disabled": ["hindsight-recall"],   // hook ids — skipped at runtime, ALL agents
     "disabled_agents": ["codex"]        // claude|codex|hermes — codex/hermes injection skipped/removed
-  },
-  "skills": { "disabled": ["bmad-help"] } // skill dir names — not symlinked for you
+  }
 }
 ```
 
@@ -83,32 +83,18 @@ Copy [`.agents/local.example.json`](../local.example.json) → `.agents/local.js
 - **Disabled agents** are enforced at **install** time (codex/hermes injection is
   skipped, and removed if previously installed). `CAF_HOOKS_SKIP_CODEX=1` is an
   env shortcut for `disabled_agents:["codex"]`.
-- **Disabled skills** are honored by the skill fan-out (below).
+## Skill fan-out — `.agents/skills.json` → each CLI
 
-## Skill fan-out — `.agents/skills` → each CLI
+`.agents/skills.json` is the project's skill manifest. `sync-skills.py --scope
+project` resolves that manifest into project-local CLI dirs (for example
+`./.codex/skills`, `./.hermes/skills`, `./.kimi-code/skills`) and honors
+`inherit_global: true` so a dev's global `~/.agents/skills.json` loadout is
+merged in automatically.
 
-`.agents/skills/` is the project's enabled skill set (committed inherited skills +
-`./skills/*` app skills symlinked in on enter). `link-project-skills-to-clis.sh`
-fans it out as per-skill symlinks to every agent CLI that doesn't read `.agents/`
-natively — a small `SKILL_TARGETS` table:
-
-| CLI | target dir | scope |
-|---|---|---|
-| Codex | `~/.codex/skills` | **global** — link ours in, never clobber foreign entries, removed on `leave` |
-| Kimi | `./.kimi-code/skills` | **local** — a project-scoped mirror we fully manage (stale real copies replaced with symlinks) |
-
-Add a CLI = one `dir|scope` line. Per-dev control via `.agents/local.json`
-`skills`:
-
-- `disabled: [...]` — never link these; pruned from managed mirrors.
-- `defer_to_global: true` — **only if you run a global `~/.agents/skills` system.**
-  Skips any project skill whose name also exists there, so your global copy wins
-  and you get **zero duplicates** (it even yields the slot in `~/.codex/skills`).
-  Teammates with no global layer leave it `false` (default) and **inherit the full
-  set**. Override the global dir with `AGENTS_GLOBAL_SKILLS_DIR`.
-
-Tasks: `mise run skills-relink` (re-fan), `mise run link-project-skills-to-clis`,
-`mise run unlink-project-skills-from-clis`.
+- Project-local skills with the same name shadow the global ones.
+- No `defer_to_global` flag or bash cleanup scripts are needed anymore.
+- The manifest is the only hand-edited skill SSOT; run `mise run skills-sync`
+  after changing it, or just re-enter the repo.
 
 ## Hindsight credentials — `mise run hindsight-setup`
 
@@ -137,6 +123,7 @@ Without a key the hooks **no-op gracefully** — recall/retain just do nothing.
 ```
 .agents/
   local.example.json    # per-dev override template (copy -> local.json, gitignored)
+  skills.json           # project skill manifest (SSOT for sync-skills.py)
   hooks/
     hooks.master.json   # SSOT — the only hand-edited config
     sync.py             # fan-out engine (--install / --uninstall / --check)

package/templates/commonproject/template/.agents/hooks/lib/local-config.sh

@@ -4,10 +4,9 @@
 # Source this, then call:
 #   hook_disabled  <hook-id>     # true if .hooks.disabled[] contains the id
 #   agent_disabled <agent>       # true if .hooks.disabled_agents[] contains the agent
-#   skill_disabled <skill-name>  # true if .skills.disabled[] contains the name
 #
 # All FAIL OPEN (return 1 = "not disabled") when `.agents/local.json` or `jq` is
-# absent, so a missing/garbled local config can never silently kill hooks/skills.
+# absent, so a missing/garbled local config can never silently kill hooks.
 #
 # `.agents/local.json` is gitignored — each dev owns their own. See
 # `.agents/local.example.json` for the schema.
@@ -30,22 +29,13 @@ _caf_listed() {
 
 hook_disabled()  { _caf_listed '.hooks.disabled' "$1"; }
 agent_disabled() { _caf_listed '.hooks.disabled_agents' "$1"; }
-skill_disabled() { _caf_listed '.skills.disabled' "$1"; }
 
-# True if the dev opted to let their GLOBAL agent system (~/.agents/skills) provide
-# any overlapping skill, so the project linker should skip it (no duplicates).
-# Teammates with no global layer omit this and inherit the full project set.
+# True if the dev opted to let their GLOBAL agent system (~/.agents/hooks) provide
+# the hook layer, so project-scoped per-user injections should be suppressed.
 skills_defer_to_global() {
   local f
   f="$(_caf_local_json)" || return 1
   [[ -f "$f" ]] || return 1
   command -v jq >/dev/null 2>&1 || return 1
-  jq -e '.skills.defer_to_global == true' "$f" >/dev/null 2>&1
-}
-
-# True if <skill-name> is provided by the global agent SSOT. `-e` follows the
-# ~/.agents/skills symlink (-> skillex/skill-sets/global) and its entries.
-skill_is_global() {
-  local name="$1" gdir="${AGENTS_GLOBAL_SKILLS_DIR:-$HOME/.agents/skills}"
-  [[ -e "${gdir}/${name}" ]]
+  jq -e '.hooks.defer_to_global == true' "$f" >/dev/null 2>&1
 }

package/templates/commonproject/template/.agents/hooks/sync.py

@@ -72,10 +72,10 @@ def load_local() -> dict:
     (so even Claude's committed hooks honor them); this only needs disabled
     AGENTS, which gate install. CAF_HOOKS_SKIP_CODEX=1 is an env shortcut.
 
-    `defer_to_global` (under either `hooks` or `skills`) means "I already run
-    these hooks from a global agent system" — so the shared per-user injections
-    (codex/kimi/hermes) are suppressed and actively removed. Claude's committed
-    repo settings are harmless and left in place.
+    `hooks.defer_to_global` means "I already run these hooks from a global agent
+    system" — so the shared per-user injections (codex/kimi/hermes) are
+    suppressed and actively removed. Claude's committed repo settings are
+    harmless and left in place.
     """
     disabled_agents: set[str] = set()
     defer_to_global = False
@@ -84,9 +84,8 @@ def load_local() -> dict:
         try:
             data = json.loads(p.read_text() or "{}")
             hooks_cfg = data.get("hooks") or {}
-            skills_cfg = data.get("skills") or {}
             disabled_agents = set(hooks_cfg.get("disabled_agents") or [])
-            defer_to_global = bool(hooks_cfg.get("defer_to_global")) or bool(skills_cfg.get("defer_to_global"))
+            defer_to_global = bool(hooks_cfg.get("defer_to_global"))
         except (json.JSONDecodeError, OSError) as exc:
             warn(f"ignoring malformed .agents/local.json: {exc}")
     if os.environ.get("CAF_HOOKS_SKIP_CODEX") == "1":

package/templates/commonproject/template/.agents/local.example.json

@@ -1,17 +1,11 @@
 {
-  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks, whole agents, or specific auto-linked skills, and tune how project skills fan out to your agent CLIs — without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks-sync` / `mise run skills-relink` (or re-cd into the repo) after editing.",
+  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks or whole injected agents without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks-sync` (or re-cd into the repo) after editing.",
   "hooks": {
     "$disabled_help": "Hook ids from .agents/hooks/hooks.master.json: skill-check-reminder, hindsight-recall, hindsight-retain, hindsight-session-end. Listed ids are skipped at runtime across ALL agents.",
     "disabled": [],
     "$disabled_agents_help": "Agent keys: claude, codex, kimi, hermes. Listed agents are NOT installed (codex/kimi/hermes injections are skipped/removed). Claude's hooks are committed and can't be fully removed per-dev — disable them individually via `disabled` instead.",
     "disabled_agents": [],
-    "$defer_to_global_help": "Set true if you already run these hooks from a GLOBAL agent system (~/.agents/hooks). When true, sync.py suppresses AND removes the shared per-user injections (codex/kimi/hermes) so a project never double-injects into ~/.codex / ~/.kimi-code; Claude's committed repo settings are left in place. Implied by skills.defer_to_global. On a machine with a global install, pjangler skips scaffolding this whole layer, so you rarely need to set this by hand.",
-    "defer_to_global": false
-  },
-  "skills": {
-    "$disabled_help": "Skill directory names under .agents/skills/. Listed skills are NOT symlinked into any agent CLI dir for you, and are pruned from your managed mirrors.",
-    "disabled": [],
-    "$defer_to_global_help": "Set true ONLY if you run a global agent system at ~/.agents/skills. When true, the linker skips any project skill whose name also exists in your global SSOT, so your global copy wins and you get ZERO duplicates/conflicts (and yields the slot in shared dirs like ~/.codex/skills). Teammates with no global layer leave this false (the default) and inherit the FULL project skill set. Override the global dir with the AGENTS_GLOBAL_SKILLS_DIR env var.",
+    "$defer_to_global_help": "Set true if you already run these hooks from a GLOBAL agent system (~/.agents/hooks). When true, sync.py suppresses AND removes the shared per-user injections (codex/kimi/hermes) so a project never double-injects into ~/.codex / ~/.kimi-code; Claude's committed repo settings are left in place. On a machine with a global install, pjangler skips scaffolding this whole layer, so you rarely need to set this by hand.",
     "defer_to_global": false
   }
 }

package/templates/commonproject/template/.agents/skills.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://raw.githubusercontent.com/skillex/schemas/main/skills.schema.json",
+  "inherit_global": true,
+  "registry": "https://github.com/delorenj/skillex.git",
+  "skills": []
+}