@event4u/agent-config 8.7.0 → 8.9.0

package/dist/discovery/discovery-manifest.summary.md

@@ -1,8 +1,8 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-07-08T15:01:19Z`
+- Generated: `2026-07-10T10:26:10Z`
 - Scanner: `f36b5a348348`
-- Artefacts: **533**
+- Artefacts: **543**
 - Unassigned: **0**
 
 ## `engineering` — Engineering
@@ -11,7 +11,7 @@
 
 | Pack | Artefacts |
 |---|---|
-| `engineering-base` — Engineering Base | 95 |
+| `engineering-base` — Engineering Base | 102 |
 | `git` — Git | 4 |
 | `php` — PHP | 6 |
 | `laravel` — Laravel | 25 |
@@ -103,7 +103,7 @@
 
 | Pack | Artefacts |
 |---|---|
-| `meta` — Meta | 257 |
+| `meta` — Meta | 260 |
 | `memory` — Memory | 9 |
 | `analytics` — Analytics | 4 |
 | `product-reasoning` — Product Reasoning | 11 |

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-07-08T15:01:19Z`
+- Generated: `2026-07-10T10:26:10Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,12 +1,14 @@
 {
-  "checksum": "sha256:9902bbcc7fac058b3506979d8233180ef0a52be98f42cec030433ee6781a5cf3",
-  "generated_at": "2026-07-08T15:01:19Z",
+  "checksum": "sha256:5053fd5ada6f48068438bf48a67d44f530573ebd4fb618d3fa9b1c03a7354411",
+  "generated_at": "2026-07-10T10:26:10Z",
   "packs": [
     {
       "always_on": false,
-      "artefact_count": 95,
+      "artefact_count": 102,
       "artefacts": [
         "src/domains/engineering-base/mission/upgrade/command.md",
+        "src/rules/active-remediation.md",
+        "src/rules/broken-access-control.md",
         "src/rules/commit-conventions.md",
         "src/rules/commit-policy.md",
         "src/rules/delegation-policy.md",
@@ -20,8 +22,10 @@
         "src/rules/minimal-safe-diff.md",
         "src/rules/non-destructive-by-default.md",
         "src/rules/output-discipline.md",
+        "src/rules/prefer-enums-over-literals.md",
         "src/rules/scope-control.md",
         "src/rules/security-sensitive-stop.md",
+        "src/rules/senior-engineering-discipline.md",
         "src/rules/source-discovery-gate.md",
         "src/rules/think-before-action.md",
         "src/rules/untrusted-input-defense.md",
@@ -29,6 +33,7 @@
         "src/skills/accessibility-auditor/SKILL.md",
         "src/skills/adversarial-review/SKILL.md",
         "src/skills/agent-security-review/SKILL.md",
+        "src/skills/ai-code-blindspots/SKILL.md",
         "src/skills/api-design/SKILL.md",
         "src/skills/api-endpoint/SKILL.md",
         "src/skills/api-testing/SKILL.md",
@@ -57,6 +62,7 @@
         "src/skills/fe-design/SKILL.md",
         "src/skills/finishing-a-development-branch/SKILL.md",
         "src/skills/form-handler/SKILL.md",
+        "src/skills/frontend-render-security/SKILL.md",
         "src/skills/git-workflow/SKILL.md",
         "src/skills/github-ci/SKILL.md",
         "src/skills/grafana/SKILL.md",
@@ -86,6 +92,7 @@
         "src/skills/source-discovery/SKILL.md",
         "src/skills/sql-writing/SKILL.md",
         "src/skills/standards-from-config/SKILL.md",
+        "src/skills/supply-chain-intake/SKILL.md",
         "src/skills/systematic-debugging/SKILL.md",
         "src/skills/tailwind-engineer/SKILL.md",
         "src/skills/tech-debt-tracker/SKILL.md",
@@ -103,14 +110,14 @@
         "src/skills/verify-completion-evidence/SKILL.md"
       ],
       "by_lifecycle": {
-        "active": 94,
+        "active": 101,
         "archived": 0,
         "deprecated": 0,
         "experimental": 1
       },
       "by_trust_level": {
         "advisory": 0,
-        "core": 93,
+        "core": 100,
         "experimental": 1,
         "professional": 1,
         "restricted": 0
@@ -1206,7 +1213,7 @@
     },
     {
       "always_on": true,
-      "artefact_count": 257,
+      "artefact_count": 260,
       "artefacts": [
         "src/agent-src/templates/agents/proposal.example.md",
         "src/domains/ai-video/image/analyse/command.md",
@@ -1349,6 +1356,7 @@
         "src/rules/autonomous-execution.md",
         "src/rules/cli-output-handling.md",
         "src/rules/command-suggestion-policy.md",
+        "src/rules/communication-through-line.md",
         "src/rules/content-quoting-floor.md",
         "src/rules/context-hygiene.md",
         "src/rules/copilot-routing.md",
@@ -1359,6 +1367,7 @@
         "src/rules/domain-safety-disclaimer.md",
         "src/rules/domain-safety-pii.md",
         "src/rules/domain-safety-retention.md",
+        "src/rules/external-code-graph-interop.md",
         "src/rules/external-reference-deep-dive.md",
         "src/rules/fast-path-marker-visibility.md",
         "src/rules/framework-neutrality-in-generic-skills.md",
@@ -1379,6 +1388,7 @@
         "src/rules/package-ci-checks.md",
         "src/rules/persona-governance.md",
         "src/rules/preservation-guard.md",
+        "src/rules/question-not-instruction.md",
         "src/rules/reviewer-awareness.md",
         "src/rules/roadmap-ci-steps-policy.md",
         "src/rules/roadmap-progress-sync.md",
@@ -1467,14 +1477,14 @@
         "src/skills/verify-repair-loop/SKILL.md"
       ],
       "by_lifecycle": {
-        "active": 256,
+        "active": 259,
         "archived": 0,
         "deprecated": 0,
         "experimental": 1
       },
       "by_trust_level": {
         "advisory": 0,
-        "core": 256,
+        "core": 259,
         "experimental": 1,
         "professional": 0,
         "restricted": 0

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-07-08T15:01:19Z`
+- Generated: `2026-07-10T10:26:10Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 
@@ -8,16 +8,16 @@
 
 | Workspace | core | professional | experimental | advisory | restricted |
 |---|---|---|---|---|---|
-| `agent-config-maintainer` | 290 | 0 | 2 | 0 | 0 |
-| `construction` | 22 | 0 | 0 | 0 | 0 |
-| `engineering` | 153 | 58 | 1 | 0 | 0 |
-| `finance` | 24 | 3 | 0 | 1 | 0 |
-| `founder` | 29 | 0 | 0 | 1 | 0 |
-| `gtm` | 26 | 12 | 0 | 0 | 0 |
-| `legal-review-prep` | 22 | 0 | 0 | 6 | 0 |
-| `ops` | 22 | 8 | 0 | 0 | 0 |
-| `product` | 22 | 15 | 0 | 0 | 0 |
-| `small-business` | 28 | 0 | 18 | 0 | 0 |
+| `agent-config-maintainer` | 291 | 0 | 2 | 0 | 0 |
+| `construction` | 23 | 0 | 0 | 0 | 0 |
+| `engineering` | 163 | 58 | 1 | 0 | 0 |
+| `finance` | 25 | 3 | 0 | 1 | 0 |
+| `founder` | 30 | 0 | 0 | 1 | 0 |
+| `gtm` | 27 | 12 | 0 | 0 | 0 |
+| `legal-review-prep` | 23 | 0 | 0 | 6 | 0 |
+| `ops` | 23 | 8 | 0 | 0 | 0 |
+| `product` | 23 | 15 | 0 | 0 | 0 |
+| `small-business` | 29 | 0 | 18 | 0 | 0 |
 
 ## Human-review-required artefacts
 

package/dist/discovery/workspaces.json

@@ -1,10 +1,10 @@
 {
-  "checksum": "sha256:9902bbcc7fac058b3506979d8233180ef0a52be98f42cec030433ee6781a5cf3",
-  "generated_at": "2026-07-08T15:01:19Z",
+  "checksum": "sha256:5053fd5ada6f48068438bf48a67d44f530573ebd4fb618d3fa9b1c03a7354411",
+  "generated_at": "2026-07-10T10:26:10Z",
   "scanner_version": "f36b5a348348",
   "workspaces": [
     {
-      "artefact_count": 174,
+      "artefact_count": 181,
       "default_packs": [
         "engineering-base",
         "git"
@@ -27,9 +27,11 @@
       ],
       "packs": [
         {
-          "artefact_count": 95,
+          "artefact_count": 102,
           "artefacts": [
             "src/domains/engineering-base/mission/upgrade/command.md",
+            "src/rules/active-remediation.md",
+            "src/rules/broken-access-control.md",
             "src/rules/commit-conventions.md",
             "src/rules/commit-policy.md",
             "src/rules/delegation-policy.md",
@@ -43,8 +45,10 @@
             "src/rules/minimal-safe-diff.md",
             "src/rules/non-destructive-by-default.md",
             "src/rules/output-discipline.md",
+            "src/rules/prefer-enums-over-literals.md",
             "src/rules/scope-control.md",
             "src/rules/security-sensitive-stop.md",
+            "src/rules/senior-engineering-discipline.md",
             "src/rules/source-discovery-gate.md",
             "src/rules/think-before-action.md",
             "src/rules/untrusted-input-defense.md",
@@ -52,6 +56,7 @@
             "src/skills/accessibility-auditor/SKILL.md",
             "src/skills/adversarial-review/SKILL.md",
             "src/skills/agent-security-review/SKILL.md",
+            "src/skills/ai-code-blindspots/SKILL.md",
             "src/skills/api-design/SKILL.md",
             "src/skills/api-endpoint/SKILL.md",
             "src/skills/api-testing/SKILL.md",
@@ -80,6 +85,7 @@
             "src/skills/fe-design/SKILL.md",
             "src/skills/finishing-a-development-branch/SKILL.md",
             "src/skills/form-handler/SKILL.md",
+            "src/skills/frontend-render-security/SKILL.md",
             "src/skills/git-workflow/SKILL.md",
             "src/skills/github-ci/SKILL.md",
             "src/skills/grafana/SKILL.md",
@@ -109,6 +115,7 @@
             "src/skills/source-discovery/SKILL.md",
             "src/skills/sql-writing/SKILL.md",
             "src/skills/standards-from-config/SKILL.md",
+            "src/skills/supply-chain-intake/SKILL.md",
             "src/skills/systematic-debugging/SKILL.md",
             "src/skills/tailwind-engineer/SKILL.md",
             "src/skills/tech-debt-tracker/SKILL.md",
@@ -574,7 +581,7 @@
       ]
     },
     {
-      "artefact_count": 281,
+      "artefact_count": 284,
       "default_packs": [
         "meta",
         "memory",
@@ -587,7 +594,7 @@
       "optional_packs": [],
       "packs": [
         {
-          "artefact_count": 257,
+          "artefact_count": 260,
           "artefacts": [
             "src/agent-src/templates/agents/proposal.example.md",
             "src/domains/ai-video/image/analyse/command.md",
@@ -730,6 +737,7 @@
             "src/rules/autonomous-execution.md",
             "src/rules/cli-output-handling.md",
             "src/rules/command-suggestion-policy.md",
+            "src/rules/communication-through-line.md",
             "src/rules/content-quoting-floor.md",
             "src/rules/context-hygiene.md",
             "src/rules/copilot-routing.md",
@@ -740,6 +748,7 @@
             "src/rules/domain-safety-disclaimer.md",
             "src/rules/domain-safety-pii.md",
             "src/rules/domain-safety-retention.md",
+            "src/rules/external-code-graph-interop.md",
             "src/rules/external-reference-deep-dive.md",
             "src/rules/fast-path-marker-visibility.md",
             "src/rules/framework-neutrality-in-generic-skills.md",
@@ -760,6 +769,7 @@
             "src/rules/package-ci-checks.md",
             "src/rules/persona-governance.md",
             "src/rules/preservation-guard.md",
+            "src/rules/question-not-instruction.md",
             "src/rules/reviewer-awareness.md",
             "src/rules/roadmap-ci-steps-policy.md",
             "src/rules/roadmap-progress-sync.md",

package/dist/install/install.mjs

@@ -7508,6 +7508,122 @@ function build_merge_entries(file_label, overlay) {
   }));
 }
 
+// src/scripts/_lib/claude_builtin_names.ts
+var _CURRENT = [
+  "add-dir",
+  "advisor",
+  "agents",
+  "autofix-pr",
+  "background",
+  "batch",
+  "branch",
+  "btw",
+  "cd",
+  "chrome",
+  "claude-api",
+  "clear",
+  "code-review",
+  "color",
+  "compact",
+  "config",
+  "context",
+  "copy",
+  "cost",
+  "dataviz",
+  "debug",
+  "deep-research",
+  "design-login",
+  "design-sync",
+  "desktop",
+  "diff",
+  "doctor",
+  "effort",
+  "exit",
+  "export",
+  "fast",
+  "feedback",
+  "fewer-permission-prompts",
+  "focus",
+  "fork",
+  "goal",
+  "heapdump",
+  "help",
+  "hooks",
+  "ide",
+  "init",
+  "insights",
+  "install-github-app",
+  "install-slack-app",
+  "keybindings",
+  "login",
+  "logout",
+  "loop",
+  "mcp",
+  "memory",
+  "mobile",
+  "model",
+  "passes",
+  "permissions",
+  "plan",
+  "plugin",
+  "powerup",
+  "pr-comments",
+  "privacy-settings",
+  "radio",
+  "recap",
+  "release-notes",
+  "reload-plugins",
+  "reload-skills",
+  "remote-control",
+  "remote-env",
+  "rename",
+  "resume",
+  "review",
+  "rewind",
+  "run",
+  "run-skill-generator",
+  "sandbox",
+  "schedule",
+  "scroll-speed",
+  "security-review",
+  "setup-bedrock",
+  "setup-vertex",
+  "simplify",
+  "skills",
+  "stats",
+  "status",
+  "statusline",
+  "stickers",
+  "teleport",
+  "thinking",
+  "trust",
+  "upgrade",
+  "usage",
+  "verify",
+  "vim",
+  "web",
+  "whats-new",
+  "workflow",
+  "workflows",
+  "worktree"
+];
+var _LEGACY = [
+  "bashes",
+  "bug",
+  "migrate-installer",
+  "output-style",
+  "terminal-setup",
+  "theme",
+  "todos"
+];
+var CLAUDE_CODE_BUILTIN_NAMES = /* @__PURE__ */ new Set([
+  ..._CURRENT,
+  ..._LEGACY
+]);
+function is_claude_builtin_name(slug) {
+  return CLAUDE_CODE_BUILTIN_NAMES.has(slug.toLowerCase());
+}
+
 // src/scripts/_lib/installed_lock.ts
 import { randomBytes } from "node:crypto";
 import * as fs2 from "node:fs";
@@ -14078,8 +14194,8 @@ var settingsSchema = external_exports.object({
     enabled: external_exports.boolean().default(true).describe(
       "Global master switch for the subagent layer. true (default) = available; false = fully disabled (the canonical kill-switch \u2014 no auto-dispatch, no routing, everything runs in-session)."
     ),
-    auto: external_exports.enum(["off", "ask", "on"]).default("ask").describe(
-      "Automatic-dispatch mode. off = subagents only via explicit command. ask = classify the task and ask once before dispatching. on = auto-dispatch delegable tasks (surface the choice in one line). Shipped default is ask on subagent-capable hosts, off elsewhere; no-op where the host has no subagent primitive."
+    auto: external_exports.enum(["off", "ask", "on"]).default("on").describe(
+      "Automatic-dispatch mode. off = subagents only via explicit command. ask = classify the task and ask once before dispatching. on = auto-dispatch delegable tasks (surface the choice in one line). Shipped default is on on subagent-capable hosts (flipped from ask 2026-07-09, ADR-117), off elsewhere; no-op where the host has no subagent primitive."
     ),
     downshift: external_exports.boolean().default(true).describe(
       "Route delegable sub-tasks to the lowest-capable model tier (cost + speed via model downshift). false = every subagent runs on the session tier."
@@ -14153,6 +14269,9 @@ var settingsSchema = external_exports.object({
     ),
     redact_patterns: external_exports.array(external_exports.string()).default([]).describe(
       "Regex patterns (one per line) that scrub matches from chat-history transcripts and memory before they hit disk. Use for secrets, customer names, internal URLs. Patterns are anchored and case-insensitive."
+    ),
+    session_index: external_exports.enum(["on", "off"]).default("off").describe(
+      "Opt-in compact memory index at session start (road-to-memory-retrieval-economy P5). on = inject a compact id + title + ~tokens index of curated entries (hard cap 30 rows, bodies never included) through the hot-context hook; the agent fetches full entries via memory_get on demand. off (default) = no injection \u2014 the ship-criterion (measured hit-rate gain) is unproven, so off unless proven."
     )
   }),
   knowledge: external_exports.object({
@@ -18514,6 +18633,20 @@ var _CLAUDE_FLAT_WRAPPER_EXTRA = /* @__PURE__ */ new Set(["commit"]);
 function _apply_claude_flat_command_wrappers(anchor, package_root, current_files) {
   const wrapped = [];
   const collisions = [];
+  const reserved = [];
+  const commands_dir = path11.join(anchor, "commands");
+  let flat_entries = [];
+  try {
+    flat_entries = fs13.readdirSync(commands_dir).filter((f) => f.endsWith(".md"));
+  } catch {
+  }
+  for (const fname of flat_entries.sort()) {
+    const slug = fname.slice(0, -".md".length);
+    if (!is_claude_builtin_name(slug)) continue;
+    fs13.rmSync(path11.join(commands_dir, fname), { force: true });
+    current_files.delete(`commands/${fname}`);
+    reserved.push(slug);
+  }
   const eligible = new Set(_CLAUDE_FLAT_WRAPPER_EXTRA);
   try {
     const manifest = JSON.parse(
@@ -18547,7 +18680,7 @@ name: ${slug}
     current_files.add(`skills/${slug}/SKILL.md`);
     wrapped.push(slug);
   }
-  return { wrapped, collisions };
+  return { wrapped, collisions, reserved };
 }
 function _deploy_global_content(tools, force, package_root, lockfile_path2) {
   const results = {};
@@ -18591,6 +18724,11 @@ function _deploy_global_content(tools, force, package_root, lockfile_path2) {
           `  claude-code: ${res.wrapped.length} visible flat command(s) projected as skill wrappers (Claude Code flat-command discovery workaround)`
         );
       }
+      if (res.reserved.length > 0 && !state.QUIET) {
+        info(
+          `  claude-code: ${res.reserved.length} flat command(s) withheld \u2014 name is a Claude Code built-in (${res.reserved.join(", ")}); nested /cluster:sub commands remain available`
+        );
+      }
     }
     const missing_targets = _verify_deploy_targets(anchor, plan);
     if (missing_targets.length > 0) {

package/dist/mcp/awesome-mcp-servers.row.md

@@ -1 +1 @@
-| [@event4u/agent-config](https://github.com/event4u-app/agent-config#readme) | Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot). | 20 tools (stdio, worker) | `pip install agent-config[mcp] && ./agent-config mcp:run` |
+| [@event4u/agent-config](https://event4u-app.github.io/agent-config) | Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot). | 20 tools (stdio, worker) | `pip install agent-config[mcp] && ./agent-config mcp:run` |

package/dist/mcp/mcp-cloudflare-catalogue.json

@@ -1,6 +1,6 @@
 {
   "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
-  "homepage": "https://github.com/event4u-app/agent-config#readme",
+  "homepage": "https://event4u-app.github.io/agent-config",
   "install_hint_stdio": "pip install agent-config[mcp] && ./agent-config mcp:run",
   "name": "agent-config-mcp",
   "repository": "https://github.com/event4u-app/agent-config",

package/dist/mcp/registry-manifest.json

@@ -1,15 +1,15 @@
 {
   "discovery": {
-    "artefact_count": 533,
+    "artefact_count": 543,
     "scanner_version": "f36b5a348348"
   },
-  "generated_at": "2026-07-08",
+  "generated_at": "2026-07-10",
   "package": {
     "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
-    "homepage": "https://github.com/event4u-app/agent-config#readme",
+    "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "8.7.0"
+    "version": "8.9.0"
   },
   "registries": [
     {