@hegemonart/get-design-done 1.59.6 → 1.59.8

package/scripts/lib/bandit-router.cjs

@@ -38,7 +38,9 @@
  *   - The `prior_class` value is persisted on the arm so subsequent
  *     reads + decay calculations preserve it (forward-compat).
  *
- * Atomic .tmp + rename. Discounted Thompson via per-arm time-decay
+ * Atomic per-pid-unique .tmp + rename (Phase 59-8 C2: unique tmp name per
+ * process so parallel waves never interleave writes on one scratch file).
+ * Discounted Thompson via per-arm time-decay
  * factor `rho^days_since_last_use` applied at sample time, not stored.
  *
  * Reward computation (D-06): two-stage lexicographic — UNCHANGED.
@@ -57,6 +59,17 @@ const path = require('node:path');
 const DEFAULT_POSTERIOR_PATH = '.design/telemetry/posterior.json';
 const SCHEMA_VERSION = '1.0.0';
 
+// C2 fix (Phase 59-8): monotonic per-process counter for tmp-file naming.
+// Combined with process.pid it guarantees that two concurrent writers — even
+// within the same process, even firing in the same millisecond — never target
+// the same `.tmp` path. The old fixed `p + '.tmp'` name let parallel agent
+// waves interleave partial writes on one tmp file, producing truncated JSON
+// that loadPosterior() then silently reset to an empty posterior (losing all
+// learned arms). Unique tmp + atomic rename makes a half-written file
+// invisible to readers: rename is atomic on the same filesystem, so a reader
+// sees either the old complete file or the new complete file, never a partial.
+let _tmpCounter = 0;
+
 // Decay factor — 60-day half-life.
 const DEFAULT_DECAY = 0.988;
 
@@ -136,6 +149,12 @@ function loadPosterior(opts = {}) {
     }
     return data;
   } catch {
+    // Corrupt-JSON recovery (preserved, Phase 59-8 C2): fall back to an empty
+    // posterior. With the per-pid unique-tmp + atomic-rename write discipline
+    // (see savePosterior), a reader can no longer observe a half-written file
+    // — rename publishes the complete file in one step — so this branch should
+    // now only fire on genuine on-disk corruption (e.g. external truncation),
+    // not on a write/read race during a parallel agent wave.
     return { schema_version: SCHEMA_VERSION, generated_at: new Date().toISOString(), arms: [] };
   }
 }
@@ -159,9 +178,19 @@ function savePosterior(posterior, opts = {}) {
   const p = resolvePath(opts);
   fs.mkdirSync(path.dirname(p), { recursive: true });
   posterior.generated_at = new Date().toISOString();
-  const tmp = p + '.tmp';
-  fs.writeFileSync(tmp, JSON.stringify(posterior, null, 2));
-  fs.renameSync(tmp, p);
+  // C2 fix (Phase 59-8): per-process-unique tmp name (pid + monotonic
+  // counter) so concurrent writers never collide on the same scratch file.
+  // The atomic rename then publishes the fully-written file in one step.
+  const tmp = `${p}.${process.pid}.${_tmpCounter++}.tmp`;
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(posterior, null, 2));
+    fs.renameSync(tmp, p);
+  } catch (err) {
+    // Best-effort cleanup of the orphaned tmp on failure so a crashed
+    // write never leaves stale scratch files behind. ENOENT is fine.
+    try { fs.unlinkSync(tmp); } catch { /* already gone */ }
+    throw err;
+  }
   return p;
 }
 
@@ -347,7 +376,20 @@ function decayArm(arm, opts = {}) {
   const factor = Math.pow(decay, days);
   // Decay shrinks both α and β toward the prior. We never go below the
   // initial prior strength — caller can rebuild a fresh prior via reset().
-  const { alpha: pa, beta: pb } = priorFor(arm.tier, opts.strength ?? PRIOR_STRENGTH);
+  //
+  // C1 fix (Phase 59-8): decay MUST target the SAME prior the arm was
+  // bootstrapped with. The arm persists `prior_class` (Phase 29 Plan 06 /
+  // D-04), so pass it through to priorFor — otherwise a promoted-incubator
+  // arm (Beta(2,8)) would drift back toward the informed TIER_PRIOR while
+  // idle, undoing the D-04 preferential-selection suppression. Default-class
+  // arms have no `prior_class` field, so `arm.prior_class` is undefined and
+  // priorFor falls through to the Phase 23.5 informed prior (byte-for-byte
+  // unchanged).
+  const { alpha: pa, beta: pb } = priorFor(
+    arm.tier,
+    opts.strength ?? PRIOR_STRENGTH,
+    arm.prior_class,
+  );
   return {
     alpha: pa + factor * Math.max(0, arm.alpha - pa),
     beta: pb + factor * Math.max(0, arm.beta - pb),

package/scripts/lib/detect/cli.cjs

@@ -45,13 +45,23 @@ function isUrl(p) {
   return /^https?:\/\//i.test(String(p || ''));
 }
 
-/** Select the detection engine. Returns { mode, warning }. Regex-fast is the dep-free default. */
+/**
+ * Select the detection engine. Returns { mode, warning }.
+ *
+ * There is exactly one engine path: regex over file text (see engine.cjs#run, which takes no
+ * jsdom/DOM parameter and is byte-identical whether or not jsdom is installed). So the truthful
+ * mode is always 'regex-fast'. We still probe jsdom (unless --fast) to surface a one-line hint
+ * that a DOM-aware path is not wired in this build — but we no longer claim a 'dom-aware' mode the
+ * engine does not have.
+ */
 function selectEngine(opts, requireFn) {
   if (opts.fast) return { mode: 'regex-fast', warning: null };
   let hasJsdom = false;
   try { requireFn('jsdom'); hasJsdom = true; } catch { hasJsdom = false; }
-  if (hasJsdom) return { mode: 'dom-aware', warning: null };
-  return { mode: 'regex-fast', warning: 'jsdom not installed — using regex-fast (install jsdom for DOM-aware mode, or pass --fast to silence this).' };
+  // jsdom presence does not change the engine — only emit a hint when it's absent, and never
+  // promise a mode we can't deliver.
+  const warning = hasJsdom ? null : 'jsdom not installed — running regex-fast (the only wired mode; a DOM-aware path is not implemented). Pass --fast to silence this.';
+  return { mode: 'regex-fast', warning };
 }
 
 function renderHuman(result, mode) {

package/scripts/lib/install/converters/cursor.cjs

@@ -25,25 +25,17 @@
  * Pure / side-effect-free: no fs, no env, no path. `convert` is a
  * deterministic string → string transform.
  *
- * KNOWN LIMITATION — sibling .md files (audit batch H6, 2026-06-04):
- *   The Cursor install drops ONLY `skills/<name>/SKILL.md`. Sibling
- *   `.md` files living next to SKILL.md (e.g. `discover-procedure.md`,
- *   `explore-procedure.md`, `cache-policy.md`) are NOT enumerated by
- *   `runtime-artifact-layout.cjs#skillsKind` and therefore NOT installed.
- *   Source SKILL.md files reference siblings via relative paths
- *   (e.g. `./discover-procedure.md`); on Cursor those links resolve to
- *   nothing.
- *
- *   This is a systemic limitation of the current `multi-artifact`
- *   pipeline, not a Cursor-specific bug — it affects every runtime that
- *   uses `skillsKind` (claude global, cursor, codex, copilot, antigravity,
- *   windsurf, augment, trae, qwen, codebuddy). Fix requires extending the
- *   StagedArtifact contract to emit multiple files per skill (one
- *   SKILL.md + N siblings), updating `computeDestPath`, the foreign-file
- *   detection in `detectMultiArtifactInstalled`, and the uninstall
- *   enumeration in `uninstallMultiArtifact`. Tracked as a follow-up
- *   beyond batch H6 scope. See `connections/cursor.md` for user-facing
- *   guidance.
+ * SIBLING .md FILES — RESOLVED (audit AR6, Phase 59.8):
+ *   The install now carries co-located sibling `*.md` reference files
+ *   (e.g. `discover-procedure.md`, `cache-policy.md`) alongside SKILL.md
+ *   for EVERY skillsKind runtime, not just Cursor. The carry happens in
+ *   `installer.cjs#installMultiArtifact` (gated on `kind.kind === 'skills'`
+ *   plus `item.srcPath`), with symmetric removal in `uninstallMultiArtifact`.
+ *   Siblings are passthrough copies fingerprinted via `fingerprintSiblingRef`
+ *   so foreign-file protection + uninstall treat them as plugin-owned. Only
+ *   top-level `*.md` siblings are carried; nested subdirectories are out of
+ *   scope. Previously this was a Batch-H6 cursor-only patch (the audit AR6
+ *   finding); it is now generalized across all skillsKind runtimes.
  */
 
 const shared = require('./shared.cjs');

package/scripts/lib/install/doctor-codex-plugin.cjs

@@ -20,7 +20,7 @@
  * path is COMPUTED (pure string composition via `os.homedir()`), NOT
  * verified. The maintainer verifies the cache after running the field-
  * test command on a Codex-installed machine (see
- * docs/codex-plugin-field-test.md).
+ * the maintainer field-test notes).
  *
  * Phase 28.8 D-14: the `.claude-plugin/marketplace.json` catalog file is
  * reused from Claude Code's marketplace per Codex's legacy-compatible

package/scripts/lib/install/doctor-cursor-marketplace.cjs

@@ -137,14 +137,14 @@ function readJsonFileSafe(filePath) {
 function buildGuidance(r) {
   switch (r.state) {
     case MARKETPLACE_STATES.NOT_SUBMITTED:
-      return 'submit publisher application at cursor.com/marketplace/publish; see docs/cursor-marketplace-field-test.md';
+      return 'submit publisher application at cursor.com/marketplace/publish';
     case MARKETPLACE_STATES.SUBMITTED_PENDING:
       return 'await Cursor team review approval; no published SLA per D-16';
     case MARKETPLACE_STATES.APPROVED_PUBLISHED:
       return 'plugin is live at ' + (r.marketplaceUrl || '<marketplace-url>');
     case MARKETPLACE_STATES.REJECTED:
       return 'address rejection reason: ' + (r.rejectionReason || '<unspecified>')
-        + '; re-submit per docs/cursor-marketplace-field-test.md';
+        + '; re-submit at cursor.com/marketplace/publish';
     default:
       return '';
   }

package/scripts/lib/install/installer.cjs

@@ -163,12 +163,17 @@ function installClaudeMarketplace(runtime, configDir, dryRun) {
       dryRun,
     };
   }
+  // B1 fix (Phase 59.8): decide created-vs-updated BEFORE the write. The
+  // settings.json file is written by atomicWrite below, so testing
+  // `existsSync(settingsPath)` afterwards always returned 'updated' (the file
+  // we just wrote exists). Capture the pre-write existence instead.
+  const existedBefore = fs.existsSync(settingsPath);
   const formatted = `${JSON.stringify(next, null, 2)}\n`;
   if (!dryRun) atomicWrite(settingsPath, formatted);
   return {
     runtime: runtime.id,
     path: settingsPath,
-    action: fs.existsSync(settingsPath) ? 'updated' : 'created',
+    action: existedBefore ? 'updated' : 'created',
     dryRun,
   };
 }
@@ -439,6 +444,20 @@ function installMultiArtifact(runtime, configDir, dryRun, opts) {
       continue;
     }
     for (const item of staged) {
+      // AR7 fix (Phase 59.8): never write a 0-byte / empty artifact. The old
+      // agents path staged `content: ''` for every skill name that had no
+      // matching agent file, producing empty `gdd-<name>.md` placeholders.
+      // Even with the layout-side enumeration fix, guard defensively here so
+      // no converter/kind can ever emit an empty file to disk.
+      if (!item.content || !String(item.content).trim()) {
+        perFile.push({
+          kind: kind.kind,
+          path: computeDestPath(configDir, kind, item.name),
+          action: 'skipped-empty',
+          reason: `Refusing to write empty artifact ${item.name}`,
+        });
+        continue;
+      }
       const destPath = computeDestPath(configDir, kind, item.name);
       const writeResult = writeFingerprinted(destPath, item.content, dryRun);
       perFile.push({
@@ -448,15 +467,16 @@ function installMultiArtifact(runtime, configDir, dryRun, opts) {
         ...(writeResult.reason ? { reason: writeResult.reason } : {}),
       });
 
-      // Batch H6: carry co-located sibling `*.md` reference files alongside
-      // SKILL.md. The skills layout only stages SKILL.md per skill, so
-      // reference siblings (e.g. `<name>-procedure.md`) are otherwise lost.
-      // Scoped to cursor (the audited flat-layout runtime); other runtimes
-      // keep their prior single-SKILL.md behavior. Siblings are passthrough
-      // copies fingerprinted so foreign-file protection + uninstall treat
-      // them as plugin-owned. Broader skillsKind-runtime carry is deferred
-      // (see converters/cursor.cjs KNOWN LIMITATION).
-      if (kind.kind === 'skills' && runtime.id === 'cursor' && item.srcPath) {
+      // AR6 fix (Phase 59.8): carry co-located sibling `*.md` reference files
+      // alongside SKILL.md for EVERY skillsKind runtime (cursor, codex,
+      // copilot, antigravity, windsurf, augment, trae, qwen, codebuddy, and
+      // claude global). The skills layout only stages SKILL.md per skill, so
+      // reference siblings (e.g. `<name>-procedure.md`) were otherwise lost on
+      // every runtime except cursor — shipping dead relative links. Siblings
+      // are passthrough copies fingerprinted so foreign-file protection +
+      // uninstall treat them as plugin-owned. Was previously scoped to cursor
+      // only (Batch H6); see converters/cursor.cjs former KNOWN LIMITATION.
+      if (kind.kind === 'skills' && item.srcPath) {
         const skillSrcDir = path.dirname(item.srcPath);
         const skillDestDir = path.dirname(destPath);
         for (const sibling of listSiblingRefFiles(skillSrcDir)) {
@@ -550,8 +570,27 @@ function uninstallMultiArtifact(runtime, configDir, dryRun, opts) {
   const skillDirsToTrim = [];
 
   for (const kind of layout.kinds) {
-    for (const bareName of skillNames) {
-      const itemName = (kind.prefix || '') + bareName;
+    // AR7 fix (Phase 59.8): derive the artifact names from the SAME staging
+    // pass install uses, so uninstall stays symmetric. The `agents` kind
+    // enumerates `agents/*.md` (real agent role names), NOT skill names — the
+    // old `gdd-<skillName>.md` derivation never matched any installed agent
+    // file and left every real agent on disk after `--uninstall`.
+    let stagedNames;
+    try {
+      const staged = kind.stage({
+        skillsRoot,
+        skillNames,
+        scope,
+        runtime: runtime.id,
+        configDir,
+      });
+      stagedNames = staged.map((item) => item.name);
+    } catch {
+      // Fall back to the prior skill-name derivation if staging fails (e.g.
+      // a converter throws); skills/commands kinds match this shape exactly.
+      stagedNames = skillNames.map((n) => (kind.prefix || '') + n);
+    }
+    for (const itemName of stagedNames) {
       const destPath = computeDestPath(configDir, kind, itemName);
       if (!fs.existsSync(destPath)) {
         perFile.push({ kind: kind.kind, path: destPath, action: 'unchanged' });
@@ -586,11 +625,12 @@ function uninstallMultiArtifact(runtime, configDir, dryRun, opts) {
         const skillDestDir = path.dirname(destPath);
         skillDirsToTrim.push(skillDestDir);
 
-        // Batch H6: symmetric cleanup for the sibling reference files the
-        // cursor install carries alongside SKILL.md. Remove only the
-        // plugin-owned siblings so a now-empty dir can be trimmed below;
-        // user-authored siblings are left in place (foreign-file discipline).
-        if (runtime.id === 'cursor') {
+        // AR6 fix (Phase 59.8): symmetric cleanup for the sibling reference
+        // files every skillsKind install carries alongside SKILL.md. Remove
+        // only the plugin-owned siblings so a now-empty dir can be trimmed
+        // below; user-authored siblings are left in place (foreign-file
+        // discipline). Was previously scoped to cursor only (Batch H6).
+        if (kind.kind === 'skills') {
           for (const sibling of listSiblingRefFiles(skillDestDir)) {
             const siblingPath = path.join(skillDestDir, sibling);
             let siblingContent;
@@ -682,11 +722,22 @@ function installCline(runtime, configDir, skillsRoot, skillNames, dryRun) {
   const cline = require('./converters/cline.cjs');
   ensureDir(configDir, dryRun);
 
-  const blocks = skillNames.map((name) => {
+  // B2 fix (Phase 59.8): wrap the per-skill read in try/catch. Previously a
+  // single unreadable SKILL.md threw out of `installCline`, aborting the
+  // entire cline install (and, when cline is one runtime in a multi-runtime
+  // batch, every runtime queued after it). Skip the unreadable skill and keep
+  // going, mirroring the best-effort sibling reads elsewhere in this file.
+  const blocks = [];
+  for (const name of skillNames) {
     const srcPath = path.join(skillsRoot, name, 'SKILL.md');
-    const raw = fs.readFileSync(srcPath, 'utf8');
-    return { name, block: cline.convert(raw, name, { runtime: 'cline' }) };
-  });
+    let raw;
+    try {
+      raw = fs.readFileSync(srcPath, 'utf8');
+    } catch {
+      continue; // unreadable skill — skip, don't abort the whole install
+    }
+    blocks.push({ name, block: cline.convert(raw, name, { runtime: 'cline' }) });
+  }
 
   const desired = cline.buildClinerulesFile(blocks);
   const target = path.join(configDir, '.clinerules');

package/scripts/lib/install/merge.cjs

@@ -111,11 +111,39 @@ function buildAgentsFileContent(runtime, payloadHeader) {
 const GDD_ADAPTER_FINGERPRINT = 'gdd: auto-generated from Claude SKILL.md';
 const CLINERULES_HEADER_FINGERPRINT = '# get-design-done rules';
 
+// B5/S4 fix (Phase 59.8): ownership detection is WHOLE-LINE anchored, not a
+// loose `String.includes` substring scan. The old substring match treated any
+// user-authored file that merely *mentioned* a marker string (e.g. a doc that
+// quotes "get-design-done plugin instructions", or a code fence containing
+// "gdd: auto-generated from Claude SKILL.md") as plugin-owned — so install
+// would overwrite it and uninstall would delete it. We now require the marker
+// to appear on a recognized GENERATED line:
+//
+//   - `<!-- ... <fingerprint> ... -->`  HTML-comment marker line. Both the
+//     Phase-24 plugin fingerprint and the per-runtime/sibling adapter header
+//     are emitted as a standalone HTML comment line; we accept the marker only
+//     when it sits inside an HTML comment that occupies the whole (trimmed)
+//     line. A bare prose mention of the same words no longer qualifies.
+//   - `# get-design-done rules`  cline rules header — must be the exact, whole
+//     trimmed line (a Markdown H1), matching converters/cline.cjs.
+//
+// Scanning line-by-line keeps detection of genuinely plugin-owned files intact
+// (the generated marker line is always present near the top) while refusing to
+// claim ownership of user files that merely contain the words somewhere.
+function isHtmlCommentMarkerLine(line, fingerprint) {
+  const t = line.trim();
+  if (!t.startsWith('<!--') || !t.endsWith('-->')) return false;
+  return t.includes(fingerprint);
+}
+
 function isPluginOwned(content) {
   if (!content || typeof content !== 'string') return false;
-  if (content.includes(PLUGIN_FINGERPRINT)) return true;
-  if (content.includes(GDD_ADAPTER_FINGERPRINT)) return true;
-  if (content.includes(CLINERULES_HEADER_FINGERPRINT)) return true;
+  const lines = content.split(/\r?\n/);
+  for (const line of lines) {
+    if (isHtmlCommentMarkerLine(line, PLUGIN_FINGERPRINT)) return true;
+    if (isHtmlCommentMarkerLine(line, GDD_ADAPTER_FINGERPRINT)) return true;
+    if (line.trim() === CLINERULES_HEADER_FINGERPRINT) return true;
+  }
   return false;
 }
 

package/scripts/lib/install/runtime-artifact-layout.cjs

@@ -226,9 +226,21 @@ function commandsKind(destSubpath, prefix, converterPath, runtime) {
 /**
  * Build an `agents` artifact-kind descriptor.
  *
- * claude local only — passthrough copy from `<repo>/agents/*` into
+ * claude local only — passthrough copy from `<repo>/agents/*.md` into
  * `<configDir>/agents/`. No converter.
  *
+ * AR7 fix (Phase 59.8): the agent set is ENUMERATED from the `agents/`
+ * directory on disk — NOT derived from `ctx.skillNames`. Real agent files
+ * are named after agent roles (`design-planner.md`, `a11y-mapper.md`, …),
+ * which never coincide with skill directory names. The old skill-name-derived
+ * path read `agents/<skillName>.md`, found nothing for any skill, and staged
+ * ~96 empty `gdd-<skillName>.md` artifacts while installing ZERO real agents.
+ *
+ * Enumeration rules:
+ *   - top-level `*.md` files in `agents/` only (no nested dirs),
+ *   - `README.md` is excluded (it is documentation, not an agent),
+ *   - empty / unreadable files are skipped (best-effort; never throws).
+ *
  * @param {string} destSubpath
  * @param {string} prefix
  * @returns {ArtifactKind}
@@ -243,13 +255,35 @@ function agentsKind(destSubpath, prefix) {
         path.dirname(ctx.skillsRoot),
         'agents'
       );
-      return ctx.skillNames.map((name) => {
-        const srcPath = path.join(agentsRoot, name + '.md');
-        const raw = fs.existsSync(srcPath)
-          ? fs.readFileSync(srcPath, 'utf8')
-          : '';
-        return { srcPath, content: raw, name: prefix + name };
-      });
+      let entries;
+      try {
+        entries = fs.readdirSync(agentsRoot, { withFileTypes: true });
+      } catch {
+        // No agents/ dir on disk — stage nothing (never throw).
+        return [];
+      }
+      const staged = [];
+      for (const ent of entries) {
+        if (!ent.isFile()) continue;
+        if (!ent.name.toLowerCase().endsWith('.md')) continue;
+        if (ent.name.toLowerCase() === 'readme.md') continue;
+        // Strip any pre-existing gdd-/gsd- prefix on the agent filename before
+        // re-applying `prefix`, so an agent already named `gdd-foo.md` does not
+        // become `gdd-gdd-foo.md`. Real agents ship un-prefixed
+        // (`a11y-mapper.md`); this guard keeps both shapes correct.
+        const fileBase = ent.name.slice(0, -'.md'.length);
+        const bareName = fileBase.replace(/^(gdd-|gsd-)/i, '');
+        const srcPath = path.join(agentsRoot, ent.name);
+        let raw = '';
+        try {
+          raw = fs.readFileSync(srcPath, 'utf8');
+        } catch {
+          continue;
+        }
+        if (!raw.trim()) continue; // skip empty agent files
+        staged.push({ srcPath, content: raw, name: prefix + bareName });
+      }
+      return staged;
     },
   };
 }

package/scripts/lib/manifest/harnesses.json

@@ -20,11 +20,13 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": true,
         "placeholder_substitution": true,
+        "agents_support": true,
+        "hooks_support": true,
         "install_path": "dist/claude-code/.claude/skills/",
         "status": "tested"
       },
       "last_verified": "2026-06-02",
-      "capability_notes": "Host runtime. Marketplace-registered, end-to-end documented, Phase 42 golden baseline.",
+      "capability_notes": "Host runtime. Marketplace-registered, end-to-end documented, Phase 42 golden baseline. Sole runtime that receives the 64 sub-agents (claude --local installs agents/) and the hook layer (SessionStart / PostToolUse / statusLine).",
       "fragment_links": [
         "reference/runtime-models.md#claude---claude-code"
       ]
@@ -44,6 +46,8 @@
         "command_syntax": "/gdd-<skill>",
         "mcp_support": true,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/codex/.codex/skills/",
         "status": "experimental"
       },
@@ -71,6 +75,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": true,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/gemini/.gemini/skills/",
         "status": "experimental"
       },
@@ -98,6 +104,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/qwen/.qwen/skills/",
         "status": "experimental"
       },
@@ -124,6 +132,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/kilo/.kilo/skills/",
         "status": "untested"
       },
@@ -148,6 +158,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/copilot/.copilot/skills/",
         "status": "experimental"
       },
@@ -174,6 +186,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/cursor/.cursor/skills/",
         "status": "experimental"
       },
@@ -200,6 +214,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/windsurf/.windsurf/skills/",
         "status": "untested"
       },
@@ -224,6 +240,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/antigravity/.antigravity/skills/",
         "status": "untested"
       },
@@ -248,6 +266,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/augment/.augment/skills/",
         "status": "untested"
       },
@@ -272,6 +292,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/trae/.trae/skills/",
         "status": "untested"
       },
@@ -296,6 +318,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/codebuddy/.codebuddy/skills/",
         "status": "untested"
       },
@@ -320,6 +344,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/cline/.cline/skills/",
         "status": "untested"
       },
@@ -344,6 +370,8 @@
         "command_syntax": "/gdd:<skill>",
         "mcp_support": false,
         "placeholder_substitution": true,
+        "agents_support": false,
+        "hooks_support": false,
         "install_path": "dist/opencode/.opencode/skills/",
         "status": "untested"
       },

package/scripts/lib/manifest/skills.json

@@ -541,7 +541,7 @@
     },
     {
       "name": "router",
-      "description": "Routes a /gdd command to fast|quick|full path + S|M|L|XL complexity_class and returns {path, complexity_class, model_tier_overrides, resolved_models, estimated_cost_usd, cache_hits}. Deterministic - no model call. Invoked once at command entry before any Agent spawn. Read by hooks/budget-enforcer.ts.",
+      "description": "Routes a /gdd command to fast|quick|full path + S|M|L|XL complexity_class and returns {path, complexity_class, model_tier_overrides, resolved_models, estimated_cost_usd, cache_hits}. A SKILL.md prompt the model executes to emit a routing-decision JSON from rule tables (no separate agent spawn). Optional/advisory - invoked only by the skills that opt into routing; the budget-enforcer hook tolerates its absence. Read by hooks/budget-enforcer.ts.",
       "argument_hint": "<intent-string> [<target-artifacts-csv>]",
       "tools": "Read, Bash, Grep"
     },

package/scripts/skill-templates/bandit-reset/SKILL.md

@@ -31,6 +31,8 @@ No posterior file found at `.design/telemetry/posterior.json` — nothing to res
 The next bandit pull with `adaptive_mode: full` will bootstrap a fresh posterior from informed priors. See `reference/bandit-integration.md`.
 ```
 
+> Note: the posterior only learns (updates from outcomes) on the SDK / headless `session-runner` path. In interactive Claude Code with `adaptive_mode: full`, the bandit samples from the configured priors but does not currently update them in-session. A reset therefore re-bootstraps the priors the SDK path will subsequently learn from. See `reference/bandit-integration.md` ("Where adaptive routing actually learns").
+
 If present, count the arms (`arms.length`, treating a missing/non-array `arms` as `0`) so the confirmation and receipt can report what will be cleared. A corrupted/unparseable file is still resettable - report `arms: unknown (file unparseable)` and continue.
 
 ### 2. Require explicit confirmation

package/scripts/skill-templates/bandit-status/SKILL.md

@@ -33,10 +33,13 @@ Possible reasons:
 - `adaptive_mode` is `static` or `hedge` (bandit silent — see `.design/budget.json`).
 - No spawns have fired since Phase 27.5 wiring landed.
 - Posterior was cleared via `{{command_prefix}}bandit-reset`.
+- You are running in interactive Claude Code: the posterior is updated (learns) only on the SDK / headless `session-runner` path. In interactive `adaptive_mode: full` the bandit samples from configured priors but does not learn from in-session outcomes.
 
-See `reference/bandit-integration.md` for setup guidance.
+See `reference/bandit-integration.md` ("Where adaptive routing actually learns") for setup guidance.
 ```
 
+> Note: the posterior only moves (learns) on the SDK / headless `session-runner` path. In interactive Claude Code with `adaptive_mode: full`, the bandit samples from the configured priors but does not currently update them in-session. See `reference/bandit-integration.md`.
+
 Skip to Section 4 (Record). Parse failure (truncated/corrupted) → emit `Posterior file exists but is unparseable. Run {{command_prefix}}bandit-reset to start fresh, or restore from a backup.`
 
 ### 2. Parse the posterior

package/scripts/skill-templates/darkmode/SKILL.md

@@ -29,7 +29,7 @@ Output artifact prefix `DARKMODE-AUDIT` is distinct from the pipeline namespace
 
 ## Pre-Flight
 
-Confirm source root exists. Try in order: `src/` (preferred), `app/` (Next.js App Router), `lib/` (libraries), `pages/` (Next.js Pages Router). Set `SRC_ROOT` to the first that exists. If none exist, abort: `"No source directory detected. Run /get-design-done scan first."`
+Confirm source root exists. Try in order: `src/` (preferred), `app/` (Next.js App Router), `lib/` (libraries), `pages/` (Next.js Pages Router). Set `SRC_ROOT` to the first that exists. If none exist, abort: `"No source directory detected. Run /get-design-done explore first."`
 
 Confirm `.design/` exists (create if absent: `mkdir -p .design/`).
 

package/scripts/skill-templates/graphify/SKILL.md

@@ -5,7 +5,7 @@ description: "Manage the Graphify knowledge graph for the current project. Build
 
 # gdd-graphify
 
-Thin command wrapper around the GSD graphify tools integration.
+Thin command wrapper around the get-design-done (GDD) graphify tools integration.
 
 ## Usage
 
@@ -30,10 +30,10 @@ Thin command wrapper around the GSD graphify tools integration.
    ```
    STOP.
 4. Execute the requested subcommand via the native CLI:
-   - build:  `node bin/gdd-graph build`
-   - query:  `node bin/gdd-graph query "<term>" --budget 2000`
-   - status: `node bin/gdd-graph status`
-   - diff:   `node bin/gdd-graph diff`
+   - build:  `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" build`
+   - query:  `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" query "<term>" --budget 2000`
+   - status: `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" status`
+   - diff:   `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" diff`
 5. After `build` completes, update `.design/STATE.md` `<connections>`: `graphify: available`
 
 ## Required Reading
@@ -43,7 +43,7 @@ Thin command wrapper around the GSD graphify tools integration.
 
 ## Notes
 
-- Graphify is optional. The native CLI ships in this repo at `bin/gdd-graph` (no external install - Node only).
+- Graphify is optional. The native CLI ships with the plugin at `${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph` (no external install - Node only).
 - Graph is stored at `.design/graph/graph.json` (Ajv-validated against `scripts/lib/graph/schema.json`).
 - Graph covers source code (`src/`, `components/`). It does NOT index `.design/` artifacts by default.
 - Use `query` with node IDs from the graph schema: `component:<name>`, `token:color/<name>`, `decision:D-<nn>`, etc.