@drunkcoding/agents-and-skills 0.0.36 → 0.0.38

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "tech-graph",
       "source": "./plugins/tech-graph",
       "description": "6-step wizard for technical diagrams (SVG/PNG) via fireworks-tech-graph",
-      "version": "0.0.36",
+      "version": "0.0.38",
       "category": "diagram",
       "keywords": [
         "diagram",
@@ -26,7 +26,7 @@
       "name": "html-effectiveness",
       "source": "./plugins/html-effectiveness",
       "description": "Generate self-contained interactive HTML reports from 20 upstream templates via a conversational agent.",
-      "version": "0.0.36",
+      "version": "0.0.38",
       "category": "reports",
       "keywords": [
         "html",
@@ -41,7 +41,7 @@
       "name": "plugin-validator",
       "source": "./plugins/plugin-validator",
       "description": "Orchestrated validator for Claude Code plugins — validates skills, agents, commands, and hooks across every plugin under plugins/**.",
-      "version": "0.0.36",
+      "version": "0.0.38",
       "category": "tooling",
       "keywords": [
         "validation",
@@ -57,7 +57,7 @@
       "name": "team-share",
       "source": "./plugins/team-share",
       "description": "Onboard your team with an interactive setup menu: install CodeGraph, build the Understand-Anything knowledge graph, and share Claude Code settings — run any combination, all idempotent.",
-      "version": "0.0.36",
+      "version": "0.0.38",
       "category": "tooling",
       "keywords": [
         "onboarding",
@@ -73,7 +73,7 @@
       "name": "multica-tool",
       "source": "./plugins/multica-tool",
       "description": "Export, import, and sync Multica skills, agents, and squads between workspaces.",
-      "version": "0.0.36",
+      "version": "0.0.38",
       "category": "workflow",
       "keywords": [
         "multica",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drunkcoding/agents-and-skills",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Personal collection of Claude Code skills and agents, installable via `npx skills`.",
   "keywords": [
     "claude-code",

package/plugins/html-effectiveness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "html-effectiveness",
   "displayName": "HTML Effectiveness Reports",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Generate self-contained interactive HTML reports from 20 upstream templates via a conversational agent.",
   "author": {
     "name": "Steven Hoang"

package/plugins/multica-tool/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "multica-tool",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Export, import, and sync Multica skills, agents, and squads between workspaces via the multica CLI."
 }

package/plugins/multica-tool/scripts/lib.mjs

@@ -8,17 +8,17 @@ export function slugify(name) {
   return s || "unnamed";
 }
 
-export function realExec(args) {
-  return spawnSync("multica", args, { encoding: "utf8" });
+export function realExec(args, opts = {}) {
+  return spawnSync("multica", args, { encoding: "utf8", ...opts });
 }
 
 export function makeCli(exec, { workspaceId } = {}) {
-  function run(args) {
+  function run(args, opts) {
     let full = args;
     if (workspaceId) {
       full = [...args, "--workspace-id", workspaceId];
     }
-    const res = exec(full);
+    const res = exec(full, opts);
     if (res.status !== 0) throw new Error(res.stderr?.trim() || `multica exited ${res.status}`);
     return res.stdout;
   }
@@ -55,8 +55,9 @@ export const listSkills = (cli) => cli.json(["skill", "list"]);
 export const listAgents = (cli) => cli.json(["agent", "list"]);
 export const listSquads = (cli) => cli.json(["squad", "list"]);
 
-// Get-wrappers: the ONLY place that knows the raw CLI field names. They
-// return a stable camelCase shape so downstream code never sees snake_case.
+// Get-wrappers: the ONLY place that knows the raw CLI field names — an
+// explicit allow-list, so unexpected/internal CLI fields never leak into a
+// bundle. Field names mirror the CLI's own snake_case; nothing is renamed.
 export function getSkill(cli, id) {
   const s = cli.json(["skill", "get", id]);
   return {
@@ -71,23 +72,31 @@ export function getAgent(cli, id) {
   return {
     id: a.id, name: a.name, description: a.description, instructions: a.instructions,
     model: a.model, visibility: a.visibility,
-    maxConcurrentTasks: a.max_concurrent_tasks,
-    runtimeConfig: a.runtime_config,
-    customArgs: a.custom_args,
-    thinkingLevel: a.thinking_level,
-    runtimeId: a.runtime_id,
-    hasCustomEnv: a.has_custom_env,
-    mcpConfig: a.mcp_config,
+    max_concurrent_tasks: a.max_concurrent_tasks,
+    runtime_config: a.runtime_config,
+    custom_args: a.custom_args,
+    thinking_level: a.thinking_level,
+    runtime_id: a.runtime_id,
+    has_custom_env: a.has_custom_env,
+    mcp_config: a.mcp_config,
+    mcp_config_redacted: !!a.mcp_config_redacted,
     skills: (a.skills ?? []).map((sk) => ({ id: sk.id, name: sk.name })),
   };
 }
 
+// Custom env is never included in `agent get` — only `has_custom_env`/`custom_env_key_count`.
+// Reading actual values requires this dedicated, audited, owner/admin-only command.
+export function getAgentCustomEnv(cli, id) {
+  const r = cli.json(["agent", "env", "get", id]);
+  return r.custom_env ?? {};
+}
+
 export function getSquad(cli, id) {
   const s = cli.json(["squad", "get", id]);
-  return { id: s.id, name: s.name, description: s.description, instructions: s.instructions, leaderId: s.leader_id };
+  return { id: s.id, name: s.name, description: s.description, instructions: s.instructions, leader_id: s.leader_id };
 }
 
 export const getSquadMembers = (cli, id) =>
   (cli.json(["squad", "member", "list", id]) ?? []).map((m) => ({
-    memberId: m.member_id, memberType: m.member_type, role: m.role || "member",
+    member_id: m.member_id, member_type: m.member_type, role: m.role || "member",
   }));

package/plugins/multica-tool/scripts/multica-export.mjs

@@ -1,15 +1,32 @@
 import * as nodeFs from "node:fs";
 import { dirname } from "node:path";
-import { slugify, getSkill, getAgent, getSquad, getSquadMembers, listRuntimes, makeCli, realExec, requireAuth, resolveWorkspaceId } from "./lib.mjs";
+import { slugify, getSkill, getAgent, getAgentCustomEnv, getSquad, getSquadMembers, listRuntimes, makeCli, realExec, requireAuth, resolveWorkspaceId } from "./lib.mjs";
 
 const nonEmpty = (v) => v && typeof v === "object" && Object.keys(v).length > 0;
 
 export function redactAgent(a) {
-  // a is a normalized (camelCase) agent from getAgent.
-  const { id, hasCustomEnv, mcpConfig, skills, runtimeId, ...rest } = a;
-  const hadSecrets = !!hasCustomEnv || nonEmpty(mcpConfig);
+  // a is a normalized agent from getAgent, with `custom_env`/
+  // `custom_env_fetch_failed` attached by the caller (collectAgent) — getAgent
+  // itself never fetches custom_env, since it requires a separate audited call.
+  const { id, has_custom_env, mcp_config_redacted, custom_env_fetch_failed, mcp_config, custom_env, skills, runtime_id, ...rest } = a;
+  const mcpUsable = !mcp_config_redacted && nonEmpty(mcp_config);
+  const envUsable = !custom_env_fetch_failed && nonEmpty(custom_env);
+  // mcp_config_redacted / custom_env_fetch_failed alone still flag hadSecrets even
+  // when unusable — the user should know something was present at the source
+  // but couldn't be captured, not just silently see an empty bundle.
+  const hadSecrets = mcpUsable || envUsable || !!mcp_config_redacted || !!custom_env_fetch_failed;
   return {
-    record: { ...rest, sourceRuntimeId: runtimeId, skillNames: [], hadSecrets },
+    // source_id lets import-time mention rewriting map stale `mention://agent/<id>`
+    // links (in this or another agent's/squad's instructions) to the new id.
+    record: {
+      ...rest,
+      source_id: id,
+      source_runtime_id: runtime_id,
+      skill_names: [],
+      mcp_config: mcpUsable ? mcp_config : null,
+      custom_env: envUsable ? custom_env : null,
+      had_secrets: hadSecrets,
+    },
     hadSecrets,
   };
 }
@@ -22,10 +39,10 @@ export function buildManifest({ scope, sourceWorkspaceId, skills, agents, squad
   return {
     version: "1",
     scope,
-    sourceWorkspaceId,
-    skills: [...seenSkills.values()].map((s) => ({ name: s.name, dir: `skills/${slugify(s.name)}`, sourceId: s.sourceId })),
-    agents: [...seenAgents.values()].map((a) => ({ name: a.name, file: `agents/${slugify(a.name)}.json`, sourceRuntimeId: a.sourceRuntimeId, sourceRuntimeProvider: a.sourceRuntimeProvider ?? null, skillNames: a.skillNames, hadSecrets: !!a.hadSecrets })),
-    squads: squad ? [{ name: squad.name, file: `squads/${slugify(squad.name)}.json`, description: squad.description ?? "", instructions: squad.instructions ?? "", leaderName: squad.leaderName, members: squad.members }] : [],
+    source_workspace_id: sourceWorkspaceId,
+    skills: [...seenSkills.values()].map((s) => ({ name: s.name, dir: `skills/${slugify(s.name)}`, source_id: s.source_id })),
+    agents: [...seenAgents.values()].map((a) => ({ name: a.name, file: `agents/${slugify(a.name)}.json`, source_id: a.source_id, source_runtime_id: a.source_runtime_id, source_runtime_provider: a.source_runtime_provider ?? null, skill_names: a.skill_names, had_secrets: !!a.had_secrets })),
+    squads: squad ? [{ name: squad.name, file: `squads/${slugify(squad.name)}.json`, description: squad.description ?? "", instructions: squad.instructions ?? "", leader_name: squad.leader_name, members: squad.members }] : [],
   };
 }
 
@@ -35,22 +52,31 @@ function collectSkill(cli, id, skills) {
   return s.name;
 }
 
-// Keyed by agent id (so squad leaderId/memberId resolve to names). Stores the
+// Keyed by agent id (so squad leader_id/member_id resolve to names). Stores the
 // normalized agent, its redaction result, and its skill names.
 function collectAgent(cli, id, agentsById, skills, providerById) {
   if (agentsById.has(id)) return agentsById.get(id);
   const a = getAgent(cli, id);
-  a.sourceRuntimeProvider = providerById.get(a.runtimeId) ?? null;
-  const skillNames = a.skills.map((sk) => collectSkill(cli, sk.id, skills));
+  a.source_runtime_provider = providerById.get(a.runtime_id) ?? null;
+  a.custom_env = {};
+  a.custom_env_fetch_failed = false;
+  if (a.has_custom_env) {
+    try {
+      a.custom_env = getAgentCustomEnv(cli, id);
+    } catch {
+      a.custom_env_fetch_failed = true; // e.g. insufficient permission — non-fatal, warned via hadSecrets
+    }
+  }
+  const skill_names = a.skills.map((sk) => collectSkill(cli, sk.id, skills));
   const red = redactAgent(a);
-  const entry = { raw: a, red, skillNames };
+  const entry = { raw: a, red, skill_names };
   agentsById.set(id, entry);
   return entry;
 }
 
 export function exportResource({ cli, scope, ids, outDir, sourceWorkspaceId, fs = nodeFs }) {
   const skills = new Map();       // name -> normalized skill
-  const agentsById = new Map();   // id   -> { raw, red, skillNames }
+  const agentsById = new Map();   // id   -> { raw, red, skill_names }
   let squad = null;
   // Lazy + memoized: only fetched when an agent is actually collected (skips
   // the extra CLI call on skill-only exports).
@@ -61,23 +87,23 @@ export function exportResource({ cli, scope, ids, outDir, sourceWorkspaceId, fs
   if (scope === "agent") collectAgent(cli, ids.agentId, agentsById, skills, getProviderById());
   if (scope === "squad") {
     const sq = getSquad(cli, ids.squadId);
-    const members = getSquadMembers(cli, ids.squadId).filter((m) => m.memberType === "agent");
-    for (const m of members) collectAgent(cli, m.memberId, agentsById, skills, getProviderById());
-    if (!agentsById.has(sq.leaderId)) collectAgent(cli, sq.leaderId, agentsById, skills, getProviderById());
+    const members = getSquadMembers(cli, ids.squadId).filter((m) => m.member_type === "agent");
+    for (const m of members) collectAgent(cli, m.member_id, agentsById, skills, getProviderById());
+    if (!agentsById.has(sq.leader_id)) collectAgent(cli, sq.leader_id, agentsById, skills, getProviderById());
     const nameOf = (id) => agentsById.get(id)?.raw.name;
     squad = {
       name: sq.name,
       description: sq.description,
       instructions: sq.instructions,
-      leaderName: nameOf(sq.leaderId),
-      members: members.map((m) => ({ agentName: nameOf(m.memberId), role: m.role })),
+      leader_name: nameOf(sq.leader_id),
+      members: members.map((m) => ({ agent_name: nameOf(m.member_id), role: m.role })),
     };
   }
 
   const manifest = buildManifest({
     scope, sourceWorkspaceId,
-    skills: [...skills.values()].map((s) => ({ name: s.name, sourceId: s.id })),
-    agents: [...agentsById.values()].map((a) => ({ name: a.raw.name, sourceRuntimeId: a.raw.runtimeId, sourceRuntimeProvider: a.raw.sourceRuntimeProvider, skillNames: a.skillNames, hadSecrets: a.red.hadSecrets })),
+    skills: [...skills.values()].map((s) => ({ name: s.name, source_id: s.id })),
+    agents: [...agentsById.values()].map((a) => ({ name: a.raw.name, source_id: a.raw.id, source_runtime_id: a.raw.runtime_id, source_runtime_provider: a.raw.source_runtime_provider, skill_names: a.skill_names, had_secrets: a.red.hadSecrets })),
     squad,
   });
 
@@ -99,8 +125,8 @@ export function exportResource({ cli, scope, ids, outDir, sourceWorkspaceId, fs
   // Index agent entries by name for the manifest writing loop.
   const agentByName = new Map([...agentsById.values()].map((a) => [a.raw.name, a]));
   for (const entry of manifest.agents) {
-    const { raw, red, skillNames } = agentByName.get(entry.name);
-    const record = { ...red.record, skillNames };
+    const { raw, red, skill_names } = agentByName.get(entry.name);
+    const record = { ...red.record, skill_names };
     if (red.hadSecrets) warnings.push(raw.name);
     fs.mkdirSync(`${outDir}/agents`, { recursive: true });
     fs.writeFileSync(`${outDir}/${entry.file}`, JSON.stringify(record, null, 2));

package/plugins/multica-tool/scripts/multica-import.mjs

@@ -57,24 +57,26 @@ export function importSkills({ cli, manifest, dir, fs = nodeFs }) {
 
 export function importAgents({ cli, manifest, dir, skillIdMap, runtimeMap, fs = nodeFs }) {
   const idMap = new Map();
+  const sourceIdMap = new Map(); // source agent id -> new agent id, for mention rewriting
+  const secretsApplyFailures = [];
   let created = 0, updated = 0;
   const existing = listAgents(cli);
 
   for (const a of manifest.agents) {
     const rec = JSON.parse(fs.readFileSync(`${dir}/${a.file}`, "utf8"));
-    const targetRuntime = runtimeMap.get(rec.sourceRuntimeId);
-    if (!targetRuntime) throw new Error(`Unmapped runtime "${rec.sourceRuntimeId}" for agent "${rec.name}"`);
+    const targetRuntime = runtimeMap.get(rec.source_runtime_id);
+    if (!targetRuntime) throw new Error(`Unmapped runtime "${rec.source_runtime_id}" for agent "${rec.name}"`);
     // Only pass optional flags when present — `--model ""` would CLEAR the model.
     const common = [
       "--visibility", rec.visibility ?? "private",
-      "--max-concurrent-tasks", String(rec.maxConcurrentTasks ?? 6),
+      "--max-concurrent-tasks", String(rec.max_concurrent_tasks ?? 6),
     ];
     if (rec.description) common.push("--description", rec.description);
     if (rec.instructions) common.push("--instructions", rec.instructions);
     if (rec.model) common.push("--model", rec.model);
-    if (rec.thinkingLevel) common.push("--thinking-level", rec.thinkingLevel);
-    if (rec.runtimeConfig && Object.keys(rec.runtimeConfig).length) common.push("--runtime-config", JSON.stringify(rec.runtimeConfig));
-    if (Array.isArray(rec.customArgs) && rec.customArgs.length) common.push("--custom-args", JSON.stringify(rec.customArgs));
+    if (rec.thinking_level) common.push("--thinking-level", rec.thinking_level);
+    if (rec.runtime_config && Object.keys(rec.runtime_config).length) common.push("--runtime-config", JSON.stringify(rec.runtime_config));
+    if (Array.isArray(rec.custom_args) && rec.custom_args.length) common.push("--custom-args", JSON.stringify(rec.custom_args));
     const match = findByName(existing, rec.name);
     let id;
     if (match) {
@@ -85,18 +87,77 @@ export function importAgents({ cli, manifest, dir, skillIdMap, runtimeMap, fs =
       id = JSON.parse(out).id; created++;
     }
     idMap.set(rec.name, id);
-    const skillIds = (rec.skillNames ?? []).map((n) => skillIdMap.get(n)).filter(Boolean);
+    if (rec.source_id) sourceIdMap.set(rec.source_id, id);
+    const skillIds = (rec.skill_names ?? []).map((n) => skillIdMap.get(n)).filter(Boolean);
     cli.run(["agent", "skills", "set", id, "--skill-ids", skillIds.join(",")]);
+
+    // mcp_config/custom_env carry real secrets. Each is applied via its OWN
+    // follow-up call, never bundled into the create/update call above — that
+    // keeps a rejected secret from failing the whole agent create/update, and
+    // sidesteps the fact that only one stdin payload can be read per process
+    // anyway. `agent update --mcp-config-stdin` works on a freshly-created id
+    // too, so no create/update branching is needed here.
+    const hasMcpConfig = rec.mcp_config && Object.keys(rec.mcp_config).length > 0;
+    if (hasMcpConfig) {
+      try {
+        cli.run(["agent", "update", id, "--mcp-config-stdin"], { input: JSON.stringify(rec.mcp_config) });
+      } catch {
+        secretsApplyFailures.push(rec.name);
+      }
+    }
+    // custom_env has no flag on `agent update` at all — `agent env set` is the
+    // only way to set it on an existing agent, so it's always a follow-up call.
+    const hasCustomEnv = rec.custom_env && Object.keys(rec.custom_env).length > 0;
+    if (hasCustomEnv) {
+      try {
+        cli.run(["agent", "env", "set", id, "--custom-env-stdin"], { input: JSON.stringify(rec.custom_env) });
+      } catch {
+        secretsApplyFailures.push(rec.name);
+      }
+    }
   }
-  return { idMap, created, updated };
+  return { idMap, sourceIdMap, created, updated, secretsApplyFailures };
+}
+
+// Rewrites `mention://agent/<id>` links (e.g. `[@dev-backend](mention://agent/<id>)`)
+// from a source-workspace agent id to its id in the destination workspace.
+// Mentions with no entry in idMap (agent outside this bundle) are left as-is.
+const MENTION_RE = /mention:\/\/agent\/([^)\s]+)/g;
+
+export function rewriteMentions(text, idMap) {
+  if (!text) return text;
+  return text.replace(MENTION_RE, (full, oldId) => {
+    const newId = idMap.get(oldId);
+    return newId ? `mention://agent/${newId}` : full;
+  });
+}
+
+// Second pass over agent instructions: an agent's instructions may @mention a
+// sibling agent from the same bundle by its SOURCE id, which is only knowable
+// once every agent in the bundle has been created/updated (idMap complete) —
+// so this must run after the importAgents loop above, not inside it.
+export function rewriteAgentMentions({ cli, manifest, dir, agentIdMap, sourceIdMap, fs = nodeFs }) {
+  let updated = 0;
+  for (const a of manifest.agents) {
+    const rec = JSON.parse(fs.readFileSync(`${dir}/${a.file}`, "utf8"));
+    if (!rec.instructions) continue;
+    const rewritten = rewriteMentions(rec.instructions, sourceIdMap);
+    if (rewritten === rec.instructions) continue;
+    cli.run(["agent", "update", agentIdMap.get(rec.name), "--instructions", rewritten]);
+    updated++;
+  }
+  return { updated };
 }
 
-export function importSquad({ cli, squad, agentIdMap }) {
+export function importSquad({ cli, squad, agentIdMap, sourceIdMap }) {
   const existing = listSquads(cli);
-  const leaderId = agentIdMap.get(squad.leaderName);
+  const leaderId = agentIdMap.get(squad.leader_name);
   const match = findByName(existing, squad.name);
   let id, created = 0, updated = 0;
-  const instr = squad.instructions ? ["--instructions", squad.instructions] : [];
+  // Squad instructions commonly list @mentions of teammate agents by their
+  // SOURCE id — rewrite to the destination ids before the squad is created.
+  const instructions = sourceIdMap ? rewriteMentions(squad.instructions, sourceIdMap) : squad.instructions;
+  const instr = instructions ? ["--instructions", instructions] : [];
   if (match) {
     cli.run(["squad", "update", match.id, "--leader", leaderId, "--description", squad.description ?? "", ...instr]);
     id = match.id; updated++;
@@ -105,10 +166,10 @@ export function importSquad({ cli, squad, agentIdMap }) {
     id = JSON.parse(out).id; created++;
   }
   // Add non-leader members, skipping any already present so re-runs are idempotent.
-  const present = new Set(getSquadMembers(cli, id).map((m) => m.memberId));
+  const present = new Set(getSquadMembers(cli, id).map((m) => m.member_id));
   for (const m of squad.members) {
-    if (m.agentName === squad.leaderName) continue;
-    const memberId = agentIdMap.get(m.agentName);
+    if (m.agent_name === squad.leader_name) continue;
+    const memberId = agentIdMap.get(m.agent_name);
     if (present.has(memberId)) continue;
     cli.run(["squad", "member", "add", id, "--member-id", memberId, "--role", m.role, "--type", "agent"]);
   }
@@ -116,15 +177,15 @@ export function importSquad({ cli, squad, agentIdMap }) {
 }
 
 export function collectSourceRuntimes(manifest) {
-  return [...new Set((manifest.agents ?? []).map((a) => a.sourceRuntimeId).filter(Boolean))];
+  return [...new Set((manifest.agents ?? []).map((a) => a.source_runtime_id).filter(Boolean))];
 }
 
-// sourceRuntimeId -> provider (e.g. "claude", "opencode"), from whichever agent recorded it.
+// source_runtime_id -> provider (e.g. "claude", "opencode"), from whichever agent recorded it.
 function collectRuntimeProviders(manifest) {
   const map = new Map();
   for (const a of manifest.agents ?? []) {
-    if (a.sourceRuntimeId && a.sourceRuntimeProvider && !map.has(a.sourceRuntimeId)) {
-      map.set(a.sourceRuntimeId, a.sourceRuntimeProvider);
+    if (a.source_runtime_id && a.source_runtime_provider && !map.has(a.source_runtime_id)) {
+      map.set(a.source_runtime_id, a.source_runtime_provider);
     }
   }
   return map;
@@ -163,16 +224,20 @@ export function importBundle({ cli, dir, runtimeMap, fs = nodeFs }) {
 
   const skillRes = importSkills({ cli, manifest, dir, fs });
   const agentRes = importAgents({ cli, manifest, dir, skillIdMap: skillRes.idMap, runtimeMap: effective, fs });
+  // Runs after every agent exists so forward-referencing mentions resolve.
+  const mentionRes = rewriteAgentMentions({ cli, manifest, dir, agentIdMap: agentRes.idMap, sourceIdMap: agentRes.sourceIdMap, fs });
   let squadRes = { newId: null, created: 0, updated: 0 };
-  if (manifest.squads?.length) squadRes = importSquad({ cli, squad: manifest.squads[0], agentIdMap: agentRes.idMap });
+  if (manifest.squads?.length) squadRes = importSquad({ cli, squad: manifest.squads[0], agentIdMap: agentRes.idMap, sourceIdMap: agentRes.sourceIdMap });
 
   return {
     created: { skills: skillRes.created, agents: agentRes.created, squads: squadRes.created },
     updated: { skills: skillRes.updated, agents: agentRes.updated, squads: squadRes.updated },
+    mentionsRewritten: mentionRes.updated,
     skillIdMap: Object.fromEntries(skillRes.idMap),
     agentIdMap: Object.fromEntries(agentRes.idMap),
     squadId: squadRes.newId,
-    secretsReminder: (manifest.agents ?? []).filter((a) => a.hadSecrets).map((a) => a.name),
+    secretsReminder: (manifest.agents ?? []).filter((a) => a.had_secrets).map((a) => a.name),
+    secretsApplyFailures: agentRes.secretsApplyFailures,
   };
 }
 

package/plugins/multica-tool/skills/export/SKILL.md

@@ -58,4 +58,4 @@ Parse the JSON output from the script and report:
 
 - Directory written to.
 - Count of skills, agents, and squads exported.
-- If `warnings` is non-empty, surface every agent name verbatim with this message: "WARNING: the following agents had custom environment variables or MCP config that were NOT exported — re-add secrets manually after import: `<agent-name>`."
+- If `warnings` is non-empty, surface every agent name verbatim with this message: "WARNING: the following agents' exported files contain custom environment variables or MCP config in PLAINTEXT — treat the export directory as sensitive (avoid committing it to a public repo, restrict file permissions, delete it once the import is done): `<agent-name>`."

package/plugins/multica-tool/skills/import/SKILL.md

@@ -25,11 +25,11 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-import.mjs" \
 If it aborts with `Unmapped runtimes: ...` (0 or 2+ runtimes share that provider in the target workspace, or the bundle predates provider capture), resolve manually:
 
 ```bash
-cat <folder>/manifest.json                 # note each distinct sourceRuntimeId
+cat <folder>/manifest.json                 # note each distinct source_runtime_id
 multica runtime list --output json         # list target workspace runtimes
 ```
 
-Ask the user to pick a matching target runtime by name or ID for each unmapped `sourceRuntimeId`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
+Ask the user to pick a matching target runtime by name or ID for each unmapped `source_runtime_id`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-import.mjs" \
@@ -38,6 +38,8 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-import.mjs" \
   --runtime-map <srcId1=dstId1,srcId2=dstId2,...>
 ```
 
+The import also rewrites any `mention://agent/<id>` link inside squad and agent instructions (e.g. `[@dev-backend](mention://agent/<id>)`) from the source agent's id to its new id in the target workspace — the CLI does this automatically for every agent captured in the bundle; no extra flag needed. Mentions pointing to an agent outside the bundle are left untouched.
+
 ## Step 3 — Report results
 
 Parse the JSON output and report:
@@ -45,4 +47,6 @@ Parse the JSON output and report:
 - Created and updated counts for skills, agents, and squads.
 - Name-to-ID maps for skills and agents (`skillIdMap`, `agentIdMap`).
 - Squad ID if a squad was imported.
-- If `secretsReminder` is non-empty, surface every agent name verbatim with: "WARNING: the following agents had custom environment variables or MCP config that were NOT exported — re-add secrets manually in the Multica UI: `<agent-name>`."
+- `mentionsRewritten`: how many agents had an agent-mention link rewritten to its new id.
+- If `secretsReminder` is non-empty, surface every agent name verbatim with: "WARNING: the following agents' bundle files contained custom environment variables or MCP config in PLAINTEXT — the source export directory should be treated as sensitive: `<agent-name>`."
+- If `secretsApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: mcp_config or custom_env failed to apply to the following agents during import (the agent itself was still created/updated) — set them manually in the Multica UI: `<agent-name>`."

package/plugins/multica-tool/skills/sync/SKILL.md

@@ -33,7 +33,7 @@ If it aborts with `Unmapped runtimes: ...` (0 or 2+ runtimes share that provider
 multica runtime list --workspace-id <dest-ws-id> --output json   # list destination workspace runtimes
 ```
 
-Ask the user to select a matching target runtime by name or ID for each unmapped `sourceRuntimeId`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
+Ask the user to select a matching target runtime by name or ID for each unmapped `source_runtime_id`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-sync.mjs" \
@@ -50,4 +50,5 @@ Parse the JSON output and report:
 - Created and updated counts for skills, agents, and squads.
 - Name-to-ID maps (`skillIdMap`, `agentIdMap`).
 - Squad ID if a squad was synced.
-- If `secretsReminder` is non-empty, surface every agent name verbatim with: "WARNING: the following agents had custom environment variables or MCP config that were NOT exported — re-add secrets manually in the Multica UI: `<agent-name>`."
+- If `secretsReminder` is non-empty, surface every agent name verbatim with: "WARNING: the following agents' bundle files contained custom environment variables or MCP config in PLAINTEXT — the temporary export directory (already cleaned up) briefly held these secrets in plaintext: `<agent-name>`."
+- If `secretsApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: mcp_config or custom_env failed to apply to the following agents during sync (the agent itself was still created/updated) — set them manually in the Multica UI: `<agent-name>`."

package/plugins/plugin-validator/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "plugin-validator",
   "displayName": "Plugin Validator",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Orchestrated validator for Claude Code plugins — validates skills, agents, commands, and hooks across every plugin under plugins/**.",
   "author": {
     "name": "Steven Hoang"

package/plugins/team-share/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "team-share",
   "displayName": "Team Share",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Onboard your team with an interactive setup menu: install CodeGraph, build the Understand-Anything knowledge graph, and share Claude Code settings — run any combination, all idempotent.",
   "author": {
     "name": "Steven Hoang"

package/plugins/tech-graph/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-graph",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "Step-by-step wizard for generating technical diagrams as SVG+PNG.",
   "author": {
     "name": "steven"