@drunkcoding/agents-and-skills 0.0.37 → 0.0.39

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "tech-graph",
       "source": "./plugins/tech-graph",
       "description": "6-step wizard for technical diagrams (SVG/PNG) via fireworks-tech-graph",
-      "version": "0.0.37",
+      "version": "0.0.39",
       "category": "diagram",
       "keywords": [
         "diagram",
@@ -26,7 +26,7 @@
       "name": "html-effectiveness",
       "source": "./plugins/html-effectiveness",
       "description": "Generate self-contained interactive HTML reports from 20 upstream templates via a conversational agent.",
-      "version": "0.0.37",
+      "version": "0.0.39",
       "category": "reports",
       "keywords": [
         "html",
@@ -41,7 +41,7 @@
       "name": "plugin-validator",
       "source": "./plugins/plugin-validator",
       "description": "Orchestrated validator for Claude Code plugins — validates skills, agents, commands, and hooks across every plugin under plugins/**.",
-      "version": "0.0.37",
+      "version": "0.0.39",
       "category": "tooling",
       "keywords": [
         "validation",
@@ -57,7 +57,7 @@
       "name": "team-share",
       "source": "./plugins/team-share",
       "description": "Onboard your team with an interactive setup menu: install CodeGraph, build the Understand-Anything knowledge graph, and share Claude Code settings — run any combination, all idempotent.",
-      "version": "0.0.37",
+      "version": "0.0.39",
       "category": "tooling",
       "keywords": [
         "onboarding",
@@ -73,7 +73,7 @@
       "name": "multica-tool",
       "source": "./plugins/multica-tool",
       "description": "Export, import, and sync Multica skills, agents, and squads between workspaces.",
-      "version": "0.0.37",
+      "version": "0.0.39",
       "category": "workflow",
       "keywords": [
         "multica",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drunkcoding/agents-and-skills",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Personal collection of Claude Code skills and agents, installable via `npx skills`.",
   "keywords": [
     "claude-code",

package/plugins/html-effectiveness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "html-effectiveness",
   "displayName": "HTML Effectiveness Reports",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Generate self-contained interactive HTML reports from 20 upstream templates via a conversational agent.",
   "author": {
     "name": "Steven Hoang"

package/plugins/multica-tool/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "multica-tool",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Export, import, and sync Multica skills, agents, and squads between workspaces via the multica CLI."
 }

package/plugins/multica-tool/scripts/lib.mjs

@@ -54,9 +54,11 @@ export const listRuntimes = (cli) => cli.json(["runtime", "list"]);
 export const listSkills = (cli) => cli.json(["skill", "list"]);
 export const listAgents = (cli) => cli.json(["agent", "list"]);
 export const listSquads = (cli) => cli.json(["squad", "list"]);
+export const listWorkspaceMembers = (cli) => cli.json(["workspace", "member", "list"]);
 
-// Get-wrappers: the ONLY place that knows the raw CLI field names. They
-// return a stable camelCase shape so downstream code never sees snake_case.
+// Get-wrappers: the ONLY place that knows the raw CLI field names — an
+// explicit allow-list, so unexpected/internal CLI fields never leak into a
+// bundle. Field names mirror the CLI's own snake_case; nothing is renamed.
 export function getSkill(cli, id) {
   const s = cli.json(["skill", "get", id]);
   return {
@@ -70,15 +72,18 @@ export function getAgent(cli, id) {
   const a = cli.json(["agent", "get", id]);
   return {
     id: a.id, name: a.name, description: a.description, instructions: a.instructions,
-    model: a.model, visibility: a.visibility,
-    maxConcurrentTasks: a.max_concurrent_tasks,
-    runtimeConfig: a.runtime_config,
-    customArgs: a.custom_args,
-    thinkingLevel: a.thinking_level,
-    runtimeId: a.runtime_id,
-    hasCustomEnv: a.has_custom_env,
-    mcpConfig: a.mcp_config,
-    mcpConfigRedacted: !!a.mcp_config_redacted,
+    model: a.model, visibility: a.visibility, avatar_url: a.avatar_url ?? null,
+    service_tier: a.service_tier ?? "",
+    permission_mode: a.permission_mode ?? null,
+    invocation_targets: (a.invocation_targets ?? []).map((t) => ({ target_id: t.target_id, target_type: t.target_type })),
+    max_concurrent_tasks: a.max_concurrent_tasks,
+    runtime_config: a.runtime_config,
+    custom_args: a.custom_args,
+    thinking_level: a.thinking_level,
+    runtime_id: a.runtime_id,
+    has_custom_env: a.has_custom_env,
+    mcp_config: a.mcp_config,
+    mcp_config_redacted: !!a.mcp_config_redacted,
     skills: (a.skills ?? []).map((sk) => ({ id: sk.id, name: sk.name })),
   };
 }
@@ -92,10 +97,10 @@ export function getAgentCustomEnv(cli, id) {
 
 export function getSquad(cli, id) {
   const s = cli.json(["squad", "get", id]);
-  return { id: s.id, name: s.name, description: s.description, instructions: s.instructions, leaderId: s.leader_id };
+  return { id: s.id, name: s.name, description: s.description, instructions: s.instructions, leader_id: s.leader_id, avatar_url: s.avatar_url ?? null };
 }
 
 export const getSquadMembers = (cli, id) =>
   (cli.json(["squad", "member", "list", id]) ?? []).map((m) => ({
-    memberId: m.member_id, memberType: m.member_type, role: m.role || "member",
+    member_id: m.member_id, member_type: m.member_type, role: m.role || "member",
   }));

package/plugins/multica-tool/scripts/multica-export.mjs

@@ -1,37 +1,60 @@
 import * as nodeFs from "node:fs";
+import { spawnSync } from "node:child_process";
 import { dirname } from "node:path";
-import { slugify, getSkill, getAgent, getAgentCustomEnv, getSquad, getSquadMembers, listRuntimes, makeCli, realExec, requireAuth, resolveWorkspaceId } from "./lib.mjs";
+import { slugify, getSkill, getAgent, getAgentCustomEnv, getSquad, getSquadMembers, listRuntimes, listSkills, listAgents, listSquads, makeCli, realExec, requireAuth, resolveWorkspaceId } from "./lib.mjs";
 
 const nonEmpty = (v) => v && typeof v === "object" && Object.keys(v).length > 0;
 
+// An avatar_url is either an uploaded-image URL (http[s]://…) or an inline
+// "emoji:🦍" marker. Only image URLs carry bytes worth bundling; emoji markers
+// are just carried as strings in the record.
+const isImageAvatar = (url) => typeof url === "string" && /^https?:\/\//.test(url);
+
+// Extension for the bundled avatar file, from the URL path; defaults to .png.
+function avatarExt(url) {
+  const m = /\.([a-z0-9]{2,5})(?:[?#]|$)/i.exec(url.split("/").pop() || "");
+  return m ? `.${m[1].toLowerCase()}` : ".png";
+}
+
+// Synchronous binary fetch (keeps exportResource sync). Runs the download in a
+// short-lived node subprocess so no top-level async is needed; returns a Buffer,
+// or null on any failure (non-2xx, network error) — a missing avatar is
+// non-fatal, the export continues with just the recorded avatar_url string.
+export function fetchBinary(url) {
+  const script = "fetch(process.argv[1]).then(r=>{if(!r.ok)process.exit(3);return r.arrayBuffer()}).then(b=>process.stdout.write(Buffer.from(b))).catch(()=>process.exit(4))";
+  const res = spawnSync(process.execPath, ["-e", script, "--", url], { maxBuffer: 64 * 1024 * 1024, timeout: 15_000 });
+  if (res.status !== 0 || !res.stdout?.length) return null;
+  return res.stdout;
+}
+
 export function redactAgent(a) {
-  // a is a normalized (camelCase) agent from getAgent, with `customEnv`/
-  // `customEnvFetchFailed` attached by the caller (collectAgent) — getAgent
+  // a is a normalized agent from getAgent, with `custom_env`/
+  // `custom_env_fetch_failed` attached by the caller (collectAgent) — getAgent
   // itself never fetches custom_env, since it requires a separate audited call.
-  const { id, hasCustomEnv, mcpConfigRedacted, customEnvFetchFailed, mcpConfig, customEnv, skills, runtimeId, ...rest } = a;
-  const mcpUsable = !mcpConfigRedacted && nonEmpty(mcpConfig);
-  const envUsable = !customEnvFetchFailed && nonEmpty(customEnv);
-  // mcpConfigRedacted / customEnvFetchFailed alone still flag hadSecrets even
+  const { id, has_custom_env, mcp_config_redacted, custom_env_fetch_failed, mcp_config, custom_env, skills, runtime_id, ...rest } = a;
+  const mcpUsable = !mcp_config_redacted && nonEmpty(mcp_config);
+  const envUsable = !custom_env_fetch_failed && nonEmpty(custom_env);
+  // mcp_config_redacted / custom_env_fetch_failed alone still flag hadSecrets even
   // when unusable — the user should know something was present at the source
   // but couldn't be captured, not just silently see an empty bundle.
-  const hadSecrets = mcpUsable || envUsable || !!mcpConfigRedacted || !!customEnvFetchFailed;
+  const hadSecrets = mcpUsable || envUsable || !!mcp_config_redacted || !!custom_env_fetch_failed;
   return {
-    // sourceId lets import-time mention rewriting map stale `mention://agent/<id>`
+    // source_id lets import-time mention rewriting map stale `mention://agent/<id>`
     // links (in this or another agent's/squad's instructions) to the new id.
     record: {
       ...rest,
-      sourceId: id,
-      sourceRuntimeId: runtimeId,
-      skillNames: [],
-      mcpConfig: mcpUsable ? mcpConfig : null,
-      customEnv: envUsable ? customEnv : null,
-      hadSecrets,
+      source_id: id,
+      source_runtime_id: runtime_id,
+      skill_names: [],
+      mcp_config: mcpUsable ? mcp_config : null,
+      custom_env: envUsable ? custom_env : null,
+      had_secrets: hadSecrets,
     },
     hadSecrets,
   };
 }
 
-export function buildManifest({ scope, sourceWorkspaceId, skills, agents, squad }) {
+export function buildManifest({ scope, sourceWorkspaceId, skills, agents, squads }) {
   const seenSkills = new Map();
   for (const s of skills) if (!seenSkills.has(s.name)) seenSkills.set(s.name, s);
   const seenAgents = new Map();
@@ -39,10 +62,10 @@ export function buildManifest({ scope, sourceWorkspaceId, skills, agents, squad
   return {
     version: "1",
     scope,
-    sourceWorkspaceId,
-    skills: [...seenSkills.values()].map((s) => ({ name: s.name, dir: `skills/${slugify(s.name)}`, sourceId: s.sourceId })),
-    agents: [...seenAgents.values()].map((a) => ({ name: a.name, file: `agents/${slugify(a.name)}.json`, sourceId: a.sourceId, sourceRuntimeId: a.sourceRuntimeId, sourceRuntimeProvider: a.sourceRuntimeProvider ?? null, skillNames: a.skillNames, hadSecrets: !!a.hadSecrets })),
-    squads: squad ? [{ name: squad.name, file: `squads/${slugify(squad.name)}.json`, description: squad.description ?? "", instructions: squad.instructions ?? "", leaderName: squad.leaderName, members: squad.members }] : [],
+    source_workspace_id: sourceWorkspaceId,
+    skills: [...seenSkills.values()].map((s) => ({ name: s.name, dir: `skills/${slugify(s.name)}`, source_id: s.source_id })),
+    agents: [...seenAgents.values()].map((a) => ({ name: a.name, file: `agents/${slugify(a.name)}.json`, source_id: a.source_id, source_runtime_id: a.source_runtime_id, source_runtime_provider: a.source_runtime_provider ?? null, skill_names: a.skill_names, had_secrets: !!a.had_secrets })),
+    squads: (squads ?? []).map((squad) => ({ name: squad.name, file: `squads/${slugify(squad.name)}.json`, description: squad.description ?? "", instructions: squad.instructions ?? "", avatar_url: squad.avatar_url ?? null, leader_name: squad.leader_name, members: squad.members })),
   };
 }
 
@@ -52,59 +75,65 @@ function collectSkill(cli, id, skills) {
   return s.name;
 }
 
-// Keyed by agent id (so squad leaderId/memberId resolve to names). Stores the
+// Keyed by agent id (so squad leader_id/member_id resolve to names). Stores the
 // normalized agent, its redaction result, and its skill names.
 function collectAgent(cli, id, agentsById, skills, providerById) {
   if (agentsById.has(id)) return agentsById.get(id);
   const a = getAgent(cli, id);
-  a.sourceRuntimeProvider = providerById.get(a.runtimeId) ?? null;
-  a.customEnv = {};
-  a.customEnvFetchFailed = false;
-  if (a.hasCustomEnv) {
+  a.source_runtime_provider = providerById.get(a.runtime_id) ?? null;
+  a.custom_env = {};
+  a.custom_env_fetch_failed = false;
+  if (a.has_custom_env) {
     try {
-      a.customEnv = getAgentCustomEnv(cli, id);
+      a.custom_env = getAgentCustomEnv(cli, id);
     } catch {
-      a.customEnvFetchFailed = true; // e.g. insufficient permission — non-fatal, warned via hadSecrets
+      a.custom_env_fetch_failed = true; // e.g. insufficient permission — non-fatal, warned via hadSecrets
     }
   }
-  const skillNames = a.skills.map((sk) => collectSkill(cli, sk.id, skills));
+  const skill_names = a.skills.map((sk) => collectSkill(cli, sk.id, skills));
   const red = redactAgent(a);
-  const entry = { raw: a, red, skillNames };
+  const entry = { raw: a, red, skill_names };
   agentsById.set(id, entry);
   return entry;
 }
 
-export function exportResource({ cli, scope, ids, outDir, sourceWorkspaceId, fs = nodeFs }) {
+export function exportResource({ cli, scope, ids, outDir, sourceWorkspaceId, fs = nodeFs, download = fetchBinary }) {
   const skills = new Map();       // name -> normalized skill
-  const agentsById = new Map();   // id   -> { raw, red, skillNames }
-  let squad = null;
+  const agentsById = new Map();   // id   -> { raw, red, skill_names }
+  const squads = [];
   // Lazy + memoized: only fetched when an agent is actually collected (skips
   // the extra CLI call on skill-only exports).
   let providerById = null;
   const getProviderById = () => providerById ??= new Map(listRuntimes(cli).map((r) => [r.id, r.provider]));
 
-  if (scope === "skill") collectSkill(cli, ids.skillId, skills);
-  if (scope === "agent") collectAgent(cli, ids.agentId, agentsById, skills, getProviderById());
-  if (scope === "squad") {
-    const sq = getSquad(cli, ids.squadId);
-    const members = getSquadMembers(cli, ids.squadId).filter((m) => m.memberType === "agent");
-    for (const m of members) collectAgent(cli, m.memberId, agentsById, skills, getProviderById());
-    if (!agentsById.has(sq.leaderId)) collectAgent(cli, sq.leaderId, agentsById, skills, getProviderById());
+  // Collect a squad's agents (leader + members) and return the squad bundle object.
+  function collectOneSquad(squadId) {
+    const sq = getSquad(cli, squadId);
+    const members = getSquadMembers(cli, squadId).filter((m) => m.member_type === "agent");
+    for (const m of members) collectAgent(cli, m.member_id, agentsById, skills, getProviderById());
+    if (!agentsById.has(sq.leader_id)) collectAgent(cli, sq.leader_id, agentsById, skills, getProviderById());
     const nameOf = (id) => agentsById.get(id)?.raw.name;
-    squad = {
-      name: sq.name,
-      description: sq.description,
-      instructions: sq.instructions,
-      leaderName: nameOf(sq.leaderId),
-      members: members.map((m) => ({ agentName: nameOf(m.memberId), role: m.role })),
+    return {
+      name: sq.name, description: sq.description, instructions: sq.instructions, avatar_url: sq.avatar_url,
+      leader_name: nameOf(sq.leader_id),
+      members: members.map((m) => ({ agent_name: nameOf(m.member_id), role: m.role })),
     };
   }
 
+  if (scope === "skill") collectSkill(cli, ids.skillId, skills);
+  else if (scope === "agent") collectAgent(cli, ids.agentId, agentsById, skills, getProviderById());
+  else if (scope === "squad") squads.push(collectOneSquad(ids.squadId));
+  else if (scope === "all") {
+    for (const s of listSkills(cli)) collectSkill(cli, s.id, skills);
+    for (const a of listAgents(cli)) collectAgent(cli, a.id, agentsById, skills, getProviderById());
+    for (const sq of listSquads(cli)) squads.push(collectOneSquad(sq.id));
+  }
+
   const manifest = buildManifest({
     scope, sourceWorkspaceId,
-    skills: [...skills.values()].map((s) => ({ name: s.name, sourceId: s.id })),
-    agents: [...agentsById.values()].map((a) => ({ name: a.raw.name, sourceId: a.raw.id, sourceRuntimeId: a.raw.runtimeId, sourceRuntimeProvider: a.raw.sourceRuntimeProvider, skillNames: a.skillNames, hadSecrets: a.red.hadSecrets })),
-    squad,
+    skills: [...skills.values()].map((s) => ({ name: s.name, source_id: s.id })),
+    agents: [...agentsById.values()].map((a) => ({ name: a.raw.name, source_id: a.raw.id, source_runtime_id: a.raw.runtime_id, source_runtime_provider: a.raw.source_runtime_provider, skill_names: a.skill_names, had_secrets: a.red.hadSecrets })),
+    squads,
   });
 
   const warnings = [];
@@ -125,10 +154,22 @@ export function exportResource({ cli, scope, ids, outDir, sourceWorkspaceId, fs
   // Index agent entries by name for the manifest writing loop.
   const agentByName = new Map([...agentsById.values()].map((a) => [a.raw.name, a]));
   for (const entry of manifest.agents) {
-    const { raw, red, skillNames } = agentByName.get(entry.name);
-    const record = { ...red.record, skillNames };
+    const { raw, red, skill_names } = agentByName.get(entry.name);
+    const record = { ...red.record, skill_names };
     if (red.hadSecrets) warnings.push(raw.name);
     fs.mkdirSync(`${outDir}/agents`, { recursive: true });
+    // Download an uploaded-image avatar into the bundle so import can re-upload
+    // it (the only way to set an agent avatar). Emoji avatars stay as the
+    // recorded avatar_url string; a failed download leaves avatar_url without a
+    // file, and import simply won't restore it.
+    if (isImageAvatar(record.avatar_url)) {
+      const rel = entry.file.replace(/\.json$/, `.avatar${avatarExt(record.avatar_url)}`);
+      const bytes = download(record.avatar_url);
+      if (bytes && bytes.length) {
+        fs.writeFileSync(`${outDir}/${rel}`, bytes);
+        record.avatar_file = rel;
+      }
+    }
     fs.writeFileSync(`${outDir}/${entry.file}`, JSON.stringify(record, null, 2));
   }
   for (const entry of manifest.squads) {
@@ -148,8 +189,8 @@ function main() {
   const out       = get("--out");
   const workspace = get("--workspace"); // optional: source workspace name
 
-  if (!scope || !id || !out) {
-    console.error("Usage: multica-export.mjs --scope <skill|agent|squad> --id <id> --out <dir> [--workspace <name>]");
+  if (!scope || !out || (scope !== "all" && !id)) {
+    console.error("Usage: multica-export.mjs --scope <skill|agent|squad|all> --id <id> --out <dir> [--workspace <name>]  (--id not needed for --scope all)");
     process.exit(1);
   }
 
@@ -164,7 +205,8 @@ function main() {
   if (scope === "skill")       ids.skillId  = id;
   else if (scope === "agent")  ids.agentId  = id;
   else if (scope === "squad")  ids.squadId  = id;
-  else { console.error(`Unknown scope "${scope}" — use skill|agent|squad`); process.exit(1); }
+  else if (scope === "all")    { /* whole workspace — no id */ }
+  else { console.error(`Unknown scope "${scope}" — use skill|agent|squad|all`); process.exit(1); }
 
   const result = exportResource({ cli, scope, ids, outDir: out, sourceWorkspaceId, fs: nodeFs });
   console.log(JSON.stringify(result, null, 2));

package/plugins/multica-tool/scripts/multica-import.mjs

@@ -1,5 +1,5 @@
 import * as nodeFs from "node:fs";
-import { listSkills, listAgents, listSquads, listRuntimes, getSquadMembers, findByName, makeCli, realExec, requireAuth, resolveWorkspaceId } from "./lib.mjs";
+import { listSkills, listAgents, listSquads, listRuntimes, listWorkspaceMembers, getSquadMembers, findByName, makeCli, realExec, requireAuth, resolveWorkspaceId } from "./lib.mjs";
 
 // Relative paths of every file under root (recursing into subdirs like scripts/).
 function walkSkillFiles(fs, root, rel = "") {
@@ -55,28 +55,39 @@ export function importSkills({ cli, manifest, dir, fs = nodeFs }) {
   return { idMap, created, updated };
 }
 
+// True when a resource already carries an avatar (uploaded image or emoji).
+const hasAvatar = (r) => !!(r && typeof r.avatar_url === "string" && r.avatar_url);
+
 export function importAgents({ cli, manifest, dir, skillIdMap, runtimeMap, fs = nodeFs }) {
   const idMap = new Map();
   const sourceIdMap = new Map(); // source agent id -> new agent id, for mention rewriting
   const secretsApplyFailures = [];
+  const avatarApplyFailures = [];   // image upload rejected
+  const avatarUnsupported = [];     // emoji avatar — no CLI setter for agents
+  const permissionApplyFailures = [];  // CLI rejected --public-to-member
+  const permissionUnsupported = [];    // no member target resolved in the destination
+  // Lazy + memoized: destination member user_ids, only listed when an agent needs them.
+  let destMemberIds = null;
+  const getDestMemberIds = () => destMemberIds ??= new Set(listWorkspaceMembers(cli).map((m) => m.user_id));
   let created = 0, updated = 0;
   const existing = listAgents(cli);
 
   for (const a of manifest.agents) {
     const rec = JSON.parse(fs.readFileSync(`${dir}/${a.file}`, "utf8"));
-    const targetRuntime = runtimeMap.get(rec.sourceRuntimeId);
-    if (!targetRuntime) throw new Error(`Unmapped runtime "${rec.sourceRuntimeId}" for agent "${rec.name}"`);
+    const targetRuntime = runtimeMap.get(rec.source_runtime_id);
+    if (!targetRuntime) throw new Error(`Unmapped runtime "${rec.source_runtime_id}" for agent "${rec.name}"`);
     // Only pass optional flags when present — `--model ""` would CLEAR the model.
     const common = [
       "--visibility", rec.visibility ?? "private",
-      "--max-concurrent-tasks", String(rec.maxConcurrentTasks ?? 6),
+      "--max-concurrent-tasks", String(rec.max_concurrent_tasks ?? 6),
     ];
     if (rec.description) common.push("--description", rec.description);
     if (rec.instructions) common.push("--instructions", rec.instructions);
     if (rec.model) common.push("--model", rec.model);
-    if (rec.thinkingLevel) common.push("--thinking-level", rec.thinkingLevel);
-    if (rec.runtimeConfig && Object.keys(rec.runtimeConfig).length) common.push("--runtime-config", JSON.stringify(rec.runtimeConfig));
-    if (Array.isArray(rec.customArgs) && rec.customArgs.length) common.push("--custom-args", JSON.stringify(rec.customArgs));
+    if (rec.thinking_level) common.push("--thinking-level", rec.thinking_level);
+    if (rec.runtime_config && Object.keys(rec.runtime_config).length) common.push("--runtime-config", JSON.stringify(rec.runtime_config));
+    if (Array.isArray(rec.custom_args) && rec.custom_args.length) common.push("--custom-args", JSON.stringify(rec.custom_args));
+    if (rec.service_tier) common.push("--service-tier", rec.service_tier);
     const match = findByName(existing, rec.name);
     let id;
     if (match) {
@@ -87,36 +98,69 @@ export function importAgents({ cli, manifest, dir, skillIdMap, runtimeMap, fs =
       id = JSON.parse(out).id; created++;
     }
     idMap.set(rec.name, id);
-    if (rec.sourceId) sourceIdMap.set(rec.sourceId, id);
-    const skillIds = (rec.skillNames ?? []).map((n) => skillIdMap.get(n)).filter(Boolean);
+    if (rec.source_id) sourceIdMap.set(rec.source_id, id);
+    const skillIds = (rec.skill_names ?? []).map((n) => skillIdMap.get(n)).filter(Boolean);
     cli.run(["agent", "skills", "set", id, "--skill-ids", skillIds.join(",")]);
 
+    // Avatar: only ever set it when the target agent has none — never clobber an
+    // avatar an existing agent already has. Agents accept only image uploads
+    // (`agent avatar --file`); an emoji-only avatar can't be restored via the CLI.
+    if (!hasAvatar(match)) {
+      if (rec.avatar_file) {
+        try {
+          cli.run(["agent", "avatar", id, "--file", `${dir}/${rec.avatar_file}`]);
+        } catch {
+          avatarApplyFailures.push(rec.name);
+        }
+      } else if (typeof rec.avatar_url === "string" && rec.avatar_url.startsWith("emoji:")) {
+        avatarUnsupported.push(rec.name);
+      }
+    }
+
+    // Restore member-specific public_to sharing that --visibility can't express.
+    // (private and workspace-wide public_to already round-trip via --visibility.)
+    if (rec.permission_mode === "public_to") {
+      const memberTargets = (rec.invocation_targets ?? []).filter((t) => t.target_type === "user");
+      if (memberTargets.length) {
+        const resolvable = memberTargets.map((t) => t.target_id).filter((tid) => getDestMemberIds().has(tid));
+        if (!resolvable.length) {
+          permissionUnsupported.push(rec.name);
+        } else {
+          try {
+            cli.run(["agent", "update", id, "--permission-mode", "public_to", ...resolvable.flatMap((tid) => ["--public-to-member", tid])]);
+          } catch {
+            permissionApplyFailures.push(rec.name);
+          }
+        }
+      }
+    }
+
     // mcp_config/custom_env carry real secrets. Each is applied via its OWN
     // follow-up call, never bundled into the create/update call above — that
     // keeps a rejected secret from failing the whole agent create/update, and
     // sidesteps the fact that only one stdin payload can be read per process
     // anyway. `agent update --mcp-config-stdin` works on a freshly-created id
     // too, so no create/update branching is needed here.
-    const hasMcpConfig = rec.mcpConfig && Object.keys(rec.mcpConfig).length > 0;
+    const hasMcpConfig = rec.mcp_config && Object.keys(rec.mcp_config).length > 0;
     if (hasMcpConfig) {
       try {
-        cli.run(["agent", "update", id, "--mcp-config-stdin"], { input: JSON.stringify(rec.mcpConfig) });
+        cli.run(["agent", "update", id, "--mcp-config-stdin"], { input: JSON.stringify(rec.mcp_config) });
       } catch {
         secretsApplyFailures.push(rec.name);
       }
     }
     // custom_env has no flag on `agent update` at all — `agent env set` is the
     // only way to set it on an existing agent, so it's always a follow-up call.
-    const hasCustomEnv = rec.customEnv && Object.keys(rec.customEnv).length > 0;
+    const hasCustomEnv = rec.custom_env && Object.keys(rec.custom_env).length > 0;
     if (hasCustomEnv) {
       try {
-        cli.run(["agent", "env", "set", id, "--custom-env-stdin"], { input: JSON.stringify(rec.customEnv) });
+        cli.run(["agent", "env", "set", id, "--custom-env-stdin"], { input: JSON.stringify(rec.custom_env) });
       } catch {
         secretsApplyFailures.push(rec.name);
       }
     }
   }
-  return { idMap, sourceIdMap, created, updated, secretsApplyFailures };
+  return { idMap, sourceIdMap, created, updated, secretsApplyFailures, avatarApplyFailures, avatarUnsupported, permissionApplyFailures, permissionUnsupported };
 }
 
 // Rewrites `mention://agent/<id>` links (e.g. `[@dev-backend](mention://agent/<id>)`)
@@ -151,7 +195,7 @@ export function rewriteAgentMentions({ cli, manifest, dir, agentIdMap, sourceIdM
 
 export function importSquad({ cli, squad, agentIdMap, sourceIdMap }) {
   const existing = listSquads(cli);
-  const leaderId = agentIdMap.get(squad.leaderName);
+  const leaderId = agentIdMap.get(squad.leader_name);
   const match = findByName(existing, squad.name);
   let id, created = 0, updated = 0;
   // Squad instructions commonly list @mentions of teammate agents by their
@@ -165,11 +209,18 @@ export function importSquad({ cli, squad, agentIdMap, sourceIdMap }) {
     const out = cli.run(["squad", "create", "--name", squad.name, "--leader", leaderId, "--description", squad.description ?? "", ...instr]);
     id = JSON.parse(out).id; created++;
   }
+  // Avatar: squads accept only an avatar-url string (emoji or URL) via
+  // `squad update`. Set it only when the target squad has none — never clobber
+  // an existing squad's avatar.
+  if (!hasAvatar(match) && squad.avatar_url) {
+    cli.run(["squad", "update", id, "--avatar-url", squad.avatar_url]);
+  }
+
   // Add non-leader members, skipping any already present so re-runs are idempotent.
-  const present = new Set(getSquadMembers(cli, id).map((m) => m.memberId));
+  const present = new Set(getSquadMembers(cli, id).map((m) => m.member_id));
   for (const m of squad.members) {
-    if (m.agentName === squad.leaderName) continue;
-    const memberId = agentIdMap.get(m.agentName);
+    if (m.agent_name === squad.leader_name) continue;
+    const memberId = agentIdMap.get(m.agent_name);
     if (present.has(memberId)) continue;
     cli.run(["squad", "member", "add", id, "--member-id", memberId, "--role", m.role, "--type", "agent"]);
   }
@@ -177,15 +228,15 @@ export function importSquad({ cli, squad, agentIdMap, sourceIdMap }) {
 }
 
 export function collectSourceRuntimes(manifest) {
-  return [...new Set((manifest.agents ?? []).map((a) => a.sourceRuntimeId).filter(Boolean))];
+  return [...new Set((manifest.agents ?? []).map((a) => a.source_runtime_id).filter(Boolean))];
 }
 
-// sourceRuntimeId -> provider (e.g. "claude", "opencode"), from whichever agent recorded it.
+// source_runtime_id -> provider (e.g. "claude", "opencode"), from whichever agent recorded it.
 function collectRuntimeProviders(manifest) {
   const map = new Map();
   for (const a of manifest.agents ?? []) {
-    if (a.sourceRuntimeId && a.sourceRuntimeProvider && !map.has(a.sourceRuntimeId)) {
-      map.set(a.sourceRuntimeId, a.sourceRuntimeProvider);
+    if (a.source_runtime_id && a.source_runtime_provider && !map.has(a.source_runtime_id)) {
+      map.set(a.source_runtime_id, a.source_runtime_provider);
     }
   }
   return map;
@@ -226,18 +277,28 @@ export function importBundle({ cli, dir, runtimeMap, fs = nodeFs }) {
   const agentRes = importAgents({ cli, manifest, dir, skillIdMap: skillRes.idMap, runtimeMap: effective, fs });
   // Runs after every agent exists so forward-referencing mentions resolve.
   const mentionRes = rewriteAgentMentions({ cli, manifest, dir, agentIdMap: agentRes.idMap, sourceIdMap: agentRes.sourceIdMap, fs });
-  let squadRes = { newId: null, created: 0, updated: 0 };
-  if (manifest.squads?.length) squadRes = importSquad({ cli, squad: manifest.squads[0], agentIdMap: agentRes.idMap, sourceIdMap: agentRes.sourceIdMap });
+  const squadIdMap = new Map();
+  let squadsCreated = 0, squadsUpdated = 0;
+  for (const squad of manifest.squads ?? []) {
+    const r = importSquad({ cli, squad, agentIdMap: agentRes.idMap, sourceIdMap: agentRes.sourceIdMap });
+    squadIdMap.set(squad.name, r.newId);
+    squadsCreated += r.created;
+    squadsUpdated += r.updated;
+  }
 
   return {
-    created: { skills: skillRes.created, agents: agentRes.created, squads: squadRes.created },
-    updated: { skills: skillRes.updated, agents: agentRes.updated, squads: squadRes.updated },
+    created: { skills: skillRes.created, agents: agentRes.created, squads: squadsCreated },
+    updated: { skills: skillRes.updated, agents: agentRes.updated, squads: squadsUpdated },
     mentionsRewritten: mentionRes.updated,
     skillIdMap: Object.fromEntries(skillRes.idMap),
     agentIdMap: Object.fromEntries(agentRes.idMap),
-    squadId: squadRes.newId,
-    secretsReminder: (manifest.agents ?? []).filter((a) => a.hadSecrets).map((a) => a.name),
+    squadIdMap: Object.fromEntries(squadIdMap),
+    secretsReminder: (manifest.agents ?? []).filter((a) => a.had_secrets).map((a) => a.name),
     secretsApplyFailures: agentRes.secretsApplyFailures,
+    avatarApplyFailures: agentRes.avatarApplyFailures,
+    avatarUnsupported: agentRes.avatarUnsupported,
+    permissionApplyFailures: agentRes.permissionApplyFailures,
+    permissionUnsupported: agentRes.permissionUnsupported,
   };
 }
 

package/plugins/multica-tool/skills/export/SKILL.md

@@ -44,14 +44,18 @@ where `<slug>` is a lowercased, hyphenated form of the resource name.
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-export.mjs" \
-  --scope <type> \
+  --scope <type|all> \
   --id <id> \
   --out <dir> \
   [--workspace <workspace-name>]
 ```
 
+Pass `--scope all` (with no `--id`) to export the **entire workspace** — every skill, agent, and squad — into one flat, deduped bundle. A skill or agent shared across many agents/squads is written exactly once and referenced by name.
+
 The script writes `manifest.json`, skill SKILL.md files, agent JSON files, and squad JSON files into `<dir>`.
 
+Avatars are captured automatically: an agent's uploaded-image avatar is downloaded into the bundle (`agents/<slug>.avatar.<ext>`) and referenced by `avatar_file`; emoji avatars (agents and squads) and a squad's avatar are recorded as the `avatar_url` string.
+
 ## Step 5 — Report results
 
 Parse the JSON output from the script and report:

package/plugins/multica-tool/skills/import/SKILL.md

@@ -25,11 +25,11 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-import.mjs" \
 If it aborts with `Unmapped runtimes: ...` (0 or 2+ runtimes share that provider in the target workspace, or the bundle predates provider capture), resolve manually:
 
 ```bash
-cat <folder>/manifest.json                 # note each distinct sourceRuntimeId
+cat <folder>/manifest.json                 # note each distinct source_runtime_id
 multica runtime list --output json         # list target workspace runtimes
 ```
 
-Ask the user to pick a matching target runtime by name or ID for each unmapped `sourceRuntimeId`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
+Ask the user to pick a matching target runtime by name or ID for each unmapped `source_runtime_id`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-import.mjs" \
@@ -40,13 +40,19 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-import.mjs" \
 
 The import also rewrites any `mention://agent/<id>` link inside squad and agent instructions (e.g. `[@dev-backend](mention://agent/<id>)`) from the source agent's id to its new id in the target workspace — the CLI does this automatically for every agent captured in the bundle; no extra flag needed. Mentions pointing to an agent outside the bundle are left untouched.
 
+Avatars are restored automatically, but **only when the target resource has none** — an existing agent or squad that already carries an avatar is never overwritten. New agents get their bundled image re-uploaded; new squads get their `avatar_url` (emoji or URL) set. An agent whose source avatar was an emoji can't be restored (the CLI has no emoji setter for agents) and is reported as unsupported.
+
 ## Step 3 — Report results
 
 Parse the JSON output and report:
 
 - Created and updated counts for skills, agents, and squads.
 - Name-to-ID maps for skills and agents (`skillIdMap`, `agentIdMap`).
-- Squad ID if a squad was imported.
+- `squadIdMap`: name-to-ID map for every squad imported.
 - `mentionsRewritten`: how many agents had an agent-mention link rewritten to its new id.
 - If `secretsReminder` is non-empty, surface every agent name verbatim with: "WARNING: the following agents' bundle files contained custom environment variables or MCP config in PLAINTEXT — the source export directory should be treated as sensitive: `<agent-name>`."
 - If `secretsApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: mcp_config or custom_env failed to apply to the following agents during import (the agent itself was still created/updated) — set them manually in the Multica UI: `<agent-name>`."
+- If `avatarApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: the avatar image failed to upload for the following agents — set it manually in the Multica UI: `<agent-name>`."
+- If `avatarUnsupported` is non-empty, surface every agent name verbatim with: "NOTE: the following agents had an emoji avatar at the source, which the CLI cannot set on an agent — set it manually in the Multica UI: `<agent-name>`."
+- If `permissionApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: member-specific sharing failed to apply for the following agents — set their invocation permissions manually in the Multica UI: `<agent-name>`."
+- If `permissionUnsupported` is non-empty, surface every agent name verbatim with: "NOTE: the following agents were shared with specific members at the source, but none of those users exist in the target workspace — re-share manually if needed: `<agent-name>`."

package/plugins/multica-tool/skills/sync/SKILL.md

@@ -33,7 +33,7 @@ If it aborts with `Unmapped runtimes: ...` (0 or 2+ runtimes share that provider
 multica runtime list --workspace-id <dest-ws-id> --output json   # list destination workspace runtimes
 ```
 
-Ask the user to select a matching target runtime by name or ID for each unmapped `sourceRuntimeId`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
+Ask the user to select a matching target runtime by name or ID for each unmapped `source_runtime_id`, then re-run with an explicit map (explicit entries always take precedence over auto-mapping):
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/multica-sync.mjs" \
@@ -49,6 +49,12 @@ Parse the JSON output and report:
 
 - Created and updated counts for skills, agents, and squads.
 - Name-to-ID maps (`skillIdMap`, `agentIdMap`).
-- Squad ID if a squad was synced.
+- `squadIdMap`: name-to-ID map for every squad synced.
 - If `secretsReminder` is non-empty, surface every agent name verbatim with: "WARNING: the following agents' bundle files contained custom environment variables or MCP config in PLAINTEXT — the temporary export directory (already cleaned up) briefly held these secrets in plaintext: `<agent-name>`."
 - If `secretsApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: mcp_config or custom_env failed to apply to the following agents during sync (the agent itself was still created/updated) — set them manually in the Multica UI: `<agent-name>`."
+- If `avatarApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: the avatar image failed to upload for the following agents — set it manually in the destination workspace: `<agent-name>`."
+- If `avatarUnsupported` is non-empty, surface every agent name verbatim with: "NOTE: the following agents had an emoji avatar at the source, which the CLI cannot set on an agent — set it manually in the destination workspace: `<agent-name>`."
+- If `permissionApplyFailures` is non-empty, surface every agent name verbatim with: "WARNING: member-specific sharing failed to apply for the following agents — set their invocation permissions manually in the destination workspace: `<agent-name>`."
+- If `permissionUnsupported` is non-empty, surface every agent name verbatim with: "NOTE: the following agents were shared with specific members at the source, but none of those users exist in the destination workspace — re-share manually if needed: `<agent-name>`."
+
+Avatars sync automatically, but **only when the destination resource has none** — an existing agent or squad that already carries an avatar is never overwritten.

package/plugins/plugin-validator/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "plugin-validator",
   "displayName": "Plugin Validator",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Orchestrated validator for Claude Code plugins — validates skills, agents, commands, and hooks across every plugin under plugins/**.",
   "author": {
     "name": "Steven Hoang"

package/plugins/team-share/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "team-share",
   "displayName": "Team Share",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Onboard your team with an interactive setup menu: install CodeGraph, build the Understand-Anything knowledge graph, and share Claude Code settings — run any combination, all idempotent.",
   "author": {
     "name": "Steven Hoang"

package/plugins/tech-graph/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-graph",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Step-by-step wizard for generating technical diagrams as SVG+PNG.",
   "author": {
     "name": "steven"