@djordje-stojanovic/sigmaskills 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,100 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-09-29
+
+### Changed
+
+- CI and release jobs use current actions and Node.js. `actions/checkout` is v7.0.1 and `actions/setup-node` is v7.0.0, both pinned by full SHA. The release, registry-sync, and rehearsal jobs run on Node.js 24.21.0, whose bundled npm 11.19 supports trusted publishing, so the extra `npm install -g npm@11.5.1` step is gone. The `package-manager-cache: false` setting is now a valid input, and the runner no longer warns about Node 20 actions. (#69)
+- `.github/dependabot.yml` opens one weekly pull request to keep the `github-actions` pins current. (#69)
+- The bug template has a "Sigma Installer (CLI)" area and optional fields for CLI version, Node.js version, and OS. The pull request template adds `npm test` and CHANGELOG checkboxes and covers the CLI. Every job in `release.yml` and `registry-sync.yml` has `timeout-minutes: 30`. (#69)
+- The six skills now agree with each other. SigmaShip and SigmaBrief both merge the base branch into a pushed branch (no rebase), use `<base>` (default `main`), delete a squash-merged branch with `git branch -D` only after the PR shows merged, define P1 as SigmaReview does, and use the shell native to the executing machine. In a SigmaShip review round, the `CLEAN | FIXED | BLOCKED` report wins over SigmaBrief's format. The grilling skill is called `/grilling` everywhere. SigmaShip says to write the acceptance criteria by hand when `/to-spec`, `/to-tickets`, or `/grilling` are missing. The README lists these optional companion skills from `mattpocock/skills`. (#65)
+- SigmaBrief examples now use its own dispatch format and generic content. (#65)
+- SigmaRefactor and the README no longer name a private repository, and they say `laloc` is optional. (#65)
+- Tests check that `openai.yaml` lists only Codex products (`chatgpt`, `codex`, `atlas`), that every skill name and description follows the Agent Skills limits, and that every relative link and `#anchor` in the skill folders resolves. (#65)
+- Package metadata: `package.json` now has `license` (`MIT`), `bugs`, and `keywords`, so npm shows the license. (#64)
+- Docs and changelog match 0.4.0. The CHANGELOG compare links and the 0.4.0 package-size note are fixed, 0.2.1 is marked as a GitHub Release only, and the 0.2.0 sections follow Keep a Changelog order. The installer guide now covers the Link/Copy page, the `a` key, plain mode with `TERM=dumb` and `--json`, Escape in the destination search, and the hidden aliases (`-g`, `--cwd`, `--list`, `check`). The maintainer guide covers `registry:sync`, `registry:validate`, and the role of `.agents/skills` and `skills-lock.json`. ADRs 0005 and 0006 and the wayfinder label note are corrected. (#64)
+- The Agent Host registry follows `vercel-labs/skills` at `2a286c7`: Pi is now a universal host that reads `.agents/skills` (project) and `~/.agents/skills` (global) instead of `.pi/skills` and `~/.pi/agent/skills`. Existing installs keep their recorded paths. (#78)
+- The generated registry pull request no longer says it "may auto-merge". It says auto-merge only runs when `main` is protected with required checks, and the owner merges by hand otherwise. `main` is not protected, so registry sync pull requests are reviewed and merged by hand. The maintainer guide says so, and ADR 0004 has a status note. (#70)
+
+### Removed
+
+- **BREAKING CHANGE:** Node.js 20 is no longer supported. `package.json` `engines.node` is now `>=22`, and CI no longer runs a Node.js 20 job. Use Node.js 22 or newer. (#70)
+- A private homelab plan that did not belong to this project (`.cursor/plans/`). `.cursor/` is now ignored. (#64)
+- Signal handlers in the install transaction that could never run, the unused `MIGRATABLE_KINDS` list, a `keypress` `removeListener` call that removed nothing, and the lossy `injectCustomContent` helper. (#67)
+
+### Fixed
+
+- `npm run release` works on Windows when Git Bash's `tar` comes first on `PATH`. It lists the tarball by file name inside its folder, because GNU tar reads `C:` in a path as a remote host. It also starts npm through Node instead of a shell, so Node no longer prints the DEP0190 warning.
+- The README no longer claims that every GitHub Release is on npm, and its run section names only real hosts.
+- The release tool keeps release notes exactly as written. Notes with `$&`, `$'`, or `` $` `` are no longer changed when the version is applied, and a changelog with only `## [Unreleased]` now gets its version heading. (#68)
+- Applying a release now adds the new compare link (`[X.Y.Z]: …/compare/vPREV...vX.Y.Z`) and moves `[Unreleased]` to compare from the new tag. The registry patch release does the same. (#68)
+- A registry patch Release now puts its version heading after the whole `[Unreleased]` section. Before, it went right under `## [Unreleased]`, so the owner's unreleased notes ended up under the patch version. (#70)
+- A `.sigma.lock.guard` folder left by a hard kill is now detected. When it is older than one minute, the command stops with a `lock-guard-stale` error that names the folder and says to stop all SigmaSkills processes and remove it. Before, every run failed with a bare `lock-busy` message. The installer does not delete the folder itself, because two processes could both decide it is stale. (#70)
+- The auto-merge check now says no when any required input is missing (head SHA, generated SHA, expected SHA, default-branch SHA, check result, or classification) or when a SHA is not 40-hex. Before, a missing input skipped its check. (#68)
+- Registry automation stops when a `gh`, `npm`, or `git` lookup fails for any reason other than "not found". Before, a network error counted as "no npm versions", "no concurrent run", or "no release", so a version could be reused. (#68)
+- `npm run registry:sync -- --dry-run` now writes nothing, including with `--fetch` (it used to overwrite the fixture). The dead `fetchPinnedSourceSync` branch is gone. Registry validation rejects destinations under `.git`, `.github/workflows`, and `.ssh`, so a new host with such a path needs owner review. (#68)
+- `agents/openai.yaml` no longer lists the invalid product `api` in any skill. Codex could ignore a metadata file with an unknown product. (#65)
+- SigmaBrief now sets `allow_implicit_invocation: false`, so the host no longer starts it on its own. (#65)
+- Two broken `measure.md` links in `sigmareview/references/method.md` now resolve. (#65)
+- The migration error message, its comments, and the installer guide now name 0.3.0 as the last version with the old state layout. 0.4.0 already uses the new layout, so the old advice to run `@0.4.0` failed in the same place. (#64)
+- The README host list names only hosts that exist in the registry. (#64)
+- A project `skills-lock.json` from another tool is never rewritten. When the file is a generic (non-Sigma) lock, `install`, `uninstall`, and `restore` leave it byte-identical, print a notice, and still finish the install, uninstall, or restore. The Sigma lock is only written when the file is missing or already a Sigma lock. (#66)
+- State and purge-journal paths that escape the project, home, or state folder are rejected when they load, with an error that says the path "escapes" its folder. A crafted `../victim` destination in `state.json` can no longer make `uninstall` or `purge` delete a folder outside the project. (#66)
+- `restore` now stops with `occupied-unowned` when a recorded host destination (for example `.claude/skills/<skill>`) holds files Sigma does not own. Before, it deleted those files and put the skill there. (#66)
+- A foreign `.agents/state.json` or `.agents/backups/` from another tool is no longer moved into the private folder or removed. Those two names count as Sigma's old layout only beside a `state.json` that has Sigma's shape. `install` no longer fails on such a project. (#66)
+- Reinstalling over a Sigma-owned link that points to the wrong target now stops with a `wrong-target` error. Before, it printed "Installed" with exit code 0 and left the wrong link in place. (#66)
+- `status`, `update`, and `uninstall` now classify a link that a user added inside a skill the same way, as a local addition. They share one tree walker. Before, `status` and `uninstall` called such a skill clean while `update` called it changed. (#66)
+- `--adopt-* replace` and `--adopt-* export` over a junction or symlink now work. The backup or export holds the folder the link points to, and the backup passes the integrity check. Before, both failed with `EEXIST`. (#66)
+- A project `skills-lock.json` with a newer `schemaVersion` than Sigma supports now stops the command with an error. Before, Sigma read it as version 1 and wrote it back without the newer fields. (#67)
+- Replacing a changed skill (`--adopt-* replace`, `update --outside-edit replace`) keeps the customization block byte for byte. A block that began with a Windows line ending lost one byte before. (#67)
+- A destination folder whose name starts with two dots, such as `..cache/skills`, is accepted. `..`, `../x`, and absolute paths that leave the project or home are still rejected. One shared check now does this everywhere. (#67)
+- `restore` rejects a backup whose metadata names a `canonicalTarget` or a copy destination outside the project or home folder. (#67)
+- The install lock is released when setup code fails right after the lock is taken. Before, a failure there left the lock behind until its owner stopped. (#67)
+- `CI=false` and `CI=0` now mean "not CI" in the interactive installer, the same as in the `purge` check. (#67)
+- When `update` fails on a later skill, it still lists the skills it already updated after the error message. (#67)
+
+## [0.4.0] — 2026-09-27
+
+### Added
+
+- SigmaImprove (`sigmaimprove`) finds what would make a product, game, codebase, or system clearly better. It scans a full list of improvement categories (value, speed, control, look and feel, reach, intelligence, trust, engineering, and games) and compares the product with the world's top one to three products and with published bars such as Core Web Vitals and WCAG 2.2. It keeps at least ten entries: ideas with 3–5 weighed options and text sketches, and signals that flag a gap for a person to think about. It files one living issue per category (1–20 per run) and updates those issues on later runs instead of duplicating them. It never edits the system. It grew out of the SigmaCheck draft, which was never released.
+- The first SigmaCheck audit of this repository is kept in `docs/audits/SIGMACHECK-2026-09-26.md` as a baseline.
+- SigmaShip (`sigmaship`) ships one planned GitHub issue end to end: a feature worktree and branch, a draft PR linked to the ticket, spec, and map, test-first commits pushed as it goes, review rounds by fresh agents until one finds nothing at P0–P2, then merge, ticket closed, branches and worktree deleted, and local `main` verified equal to `origin/main`. It refuses tickets without checkable acceptance criteria and names the skill to run first. It builds on Matt Pocock's `implement` skill.
+- `install` takes several skill ids (`install sigmawrite sigmareview`) or `--all`. Every skill is planned first, then all of them install in one transaction: if one fails, none stay installed, and `skills-lock.json` is written once. `--json` prints `{ schemaVersion, plans }` when there is more than one skill; one skill prints the same plan as before. (#38)
+- Skill evals. `npm test` now checks the output contract of every skill against good and bad sample outputs, and checks that near-miss prompts route to the right skill. `node scripts/eval-skills.js [skill...]` runs the real skills on a small fixture game with Claude Code, on demand only. See `docs/evals.md`. (#43)
+
+### Changed
+
+- SigmaReview (`sigmareview`) now covers correctness, security (source review plus safe tests on a local instance), and measured performance in one run. It reports every finding with no cap, each written as a self-contained fix brief that an LLM can act on, grouped into waves that can be fixed in parallel. It still never changes code: it publishes one feature-branch pull request with the review file. The report file is now `SIGMAREVIEW-YYYY-MM-DD.md`.
+- SigmaBrief (`sigmabrief`) accepts SigmaReview reports and SigmaImprove issues as input and groups briefs into waves, so only independent items run in parallel. Every brief now asks for green baseline checks before changes and ends with a fixed report (`DONE`, `DONE_WITH_CONCERNS`, or `BLOCKED`, plus PR, checks, and open questions). `approval: auto` lets agents record their decisions as rulings instead of waiting. A host's native worktree tool is preferred over manual `git worktree`. A new `session` brief hands the current conversation to a fresh agent.
+- The skill picker and `list` now show each skill's short description for people (`short_description` in `agents/openai.yaml`) instead of the agent-facing description cut off mid-word. The picker wraps it onto at most two lines, so narrow terminals show it whole. A skill without that line shows the first sentence of its description. `list --json` still gives the full description. (#39)
+- The installer's private files (state, lock, backups, journals, staging) now live in `.agents/.sigmaskills/` (global: `~/.agents/.sigmaskills/`). The folder ignores itself in Git, so `git add -A` no longer stages `.agents/state.json` or backups. Older projects move there on the next write command; `status` and `--dry-run` still read the old layout and write nothing. `--state-dir` and `SIGMA_STATE_DIR` are unchanged. (#34)
+- The npm package now ships only the user CLI: about 88 KB smaller unpacked (500,482 B instead of 588,522 B) and 3 fewer files (53 instead of 56). Release and registry automation moved to `scripts/` in the repository, and `sigmaskills release` is gone from the published CLI. Maintainers run `npm run release -- <flags>` from a checkout; the checks it makes are unchanged. (#40)
+- Every pull request now rehearses the Release path. A CI job commits the Release identities in a throwaway worktree, then runs the preview, the dispatch checks, and the trusted `validate` and publish steps with a real `npm pack` (`node scripts/release-rehearsal.js`). npm and GitHub lookups, dispatch, and publish are stubbed, so the job needs no secrets. A pull request that breaks packing, such as the `npm pack` JSON bug fixed in 0.2.1, now fails before merge. (#41)
+- CI now runs with a read-only token (`permissions: contents: read`) and pins every action to a full commit SHA, like the Release workflows. (#41)
+- CI now tests Node.js 22 and 24 on Windows, macOS, and Linux. Node.js 20 reached end of life on 2026-04-30, but `engines` stays at `>=20` for this Release so current users on Node.js 20 can still install; one Linux job on Node.js 20 keeps that promise tested. A later Release may raise it. (#41)
+- The README is short again. It keeps the quick start, the skills, one install table, and run examples. Command details moved to [`docs/installer.md`](docs/installer.md); releases, registry automation, tests, and CI moved to [`docs/maintainers.md`](docs/maintainers.md). A test keeps it under 1,500 words, with no paragraph over 80 words. (#42)
+- The Agent Host registry follows `vercel-labs/skills` at `7407f38`: Droid and Kilo read project skills from `.agents/skills` (Kilo global: `~/.kilo/skills`), fx and sarvam-code are new hosts, and Antigravity, antigravity-cli, and deepagents leave the universal-prompt list. Existing installs keep their recorded paths.
+
+### Removed
+
+- SigmaPerformance (`sigmaperformance`). Its measurement method and evidence classes are now part of SigmaReview.
+
+### Fixed
+
+- The release tool now treats a breaking change before 1.0.0 as a minor version step, as SemVer allows for 0.y.z versions, instead of jumping to 1.0.0.
+- The README no longer points to the v0.2.1 zip as the latest Release.
+- The finished 0.3.0 `plan.md` is removed from the repository root; its content lives in issue #3 and PR #29.
+- `update` no longer stops when a skill that left the Skill Pack is still installed. The manifest lists retired skills (`sigmaperformance`); `update` leaves them unchanged, lists them under *Retired skills*, and names the `uninstall` command that removes them.
+- An unknown skill id now fails with `unknown skill '<id>'` before any planning, for `install`, `update`, `restore`, and `uninstall`. `uninstall --skill nope` said `stale-state` before. (#38)
+- A value flag with a missing, empty, or dash-prefixed value now fails with the flag name. Before, `--skill --yes` read `--yes` as a skill id, and a value flag at the end of the command was ignored. One flag table now parses and checks every flag; all current flags and aliases still work. (#38)
+- The registry sync test writes into a temporary folder instead of `registry/agent-hosts.json`, so parallel test files no longer read a half-written file and fail at random.
+- Update previews show the relevant release notes and correct running-version relation, omit empty sections, and ask for outside-edit choices only when needed. JSON field names and the installed-side relation remain compatible. (#36)
+- Lock recovery serializes competing takeovers, preserves fresh incomplete records, and checks unique ownership when releasing. Locks expire after 24 hours; a crash-leftover takeover guard stops safely with recovery instructions. Legacy migration uses the same lock. (#37)
+- Untouched copies of earlier Releases are recognized again. `registry/skill-baselines.json` now holds the file hashes of 0.1.0, 0.2.0, 0.2.1, and 0.3.0, rebuilt from their git tags (`node scripts/backfill-baselines.js <tag>...`), and `npm run release -- --write-identities` adds the outgoing Release each time. Such a copy shows as `legacy` with high provenance and upgrades with no `--adopt-*` flag; a changed copy still needs a choice. (#35)
+- Install plans now label files from the installer's point of view: *Additions* are files the new Release brings, *Deletions* are files the install removes. They were swapped before. (#35)
+
 ## [0.3.0] — 2026-09-08
 
 ### Added
@@ -16,8 +110,7 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - The installer opens directly to skill selection, keeps destination pages within eight rows, and offers line-based commands in plain terminals. Help preserves cancellation, and short terminals keep focus and controls visible.
 - Package tests compare complete trees and bytes for all five skills, including customized reinstall protection and updates.
 
-
-## [0.2.1] — 2026-08-27
+## [0.2.1] — 2026-08-27 (GitHub Release only)
 
 ### Changed
 
@@ -29,13 +122,8 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - Registry Sync no longer fails when a leftover `registry/sync-*` branch still exists: it replaces that generated branch, or reuses a matching open pull request, and still refuses human branches.
 - Release packing reads `npm pack --json` after prepack logs, so publication can rebuild the tarball digest.
 
-
 ## [0.2.0] — 2026-08-20
 
-### Fixed
-
-- `npm test` lists `test/*.test.js` files in a runner script so Node.js 20 CI runs the suite without glob expansion. Registry pin hashing ignores CRLF from Windows checkout so the fixture still matches `contentSha256`.
-
 ### Added
 
 - Safe Agent Host registry additions and description-only changes may auto-merge after required checks and publish a patch Release through the trusted idempotent publication primitive. Destination, ID, alias, detection, platform, membership, removal, and unknown changes still need owner review. Version calculation serializes concurrent runs against live npm and GitHub state. The generated branch is deleted only after verified merge and matching publication. Automation cannot change skills, CLI behavior, unrelated work, human branches, or major/minor Releases, and it never overwrites an existing npm version.
@@ -61,6 +149,9 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - Structural regression tests (`npm test`) and GitHub Actions CI so skill registry, README wiring, templates, and SigmaWrite soft-steer invariants cannot silently drift.
 - Root [`AGENTS.md`](AGENTS.md): mandatory work rules and clear-writing rules, project map, and the `KNOWN_SKILLS` + README + CHANGELOG update rule.
 
+### Fixed
+
+- `npm test` lists `test/*.test.js` files in a runner script so Node.js 20 CI runs the suite without glob expansion. Registry pin hashing ignores CRLF from Windows checkout so the fixture still matches `contentSha256`.
 
 ## [0.1.0] — 2026-08-11
 
@@ -98,7 +189,10 @@ Ship high-rigor, installable agent skills (not apps): full-repo audits, performa
 | 2026-08-11 | `5dab832` | Add CHANGELOG and mark v0.1.0 as the first Sigmaskills release |
 | 2026-08-11 | `124a666` | Polish v0.1.0 docs for multi-host install and use |
 
-[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.1
 [0.2.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.0
 [0.1.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.1.0