@hybridlabor-api/aos 4.13.1 → 4.14.0

package/.claude/settings.json

@@ -23,6 +23,16 @@
           }
         ]
       },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$HOME/.claude/hooks/trail-autostart.mjs\"",
+            "timeout": 3
+          }
+        ]
+      },
       {
         "hooks": [
           {
@@ -105,6 +115,14 @@
       }
     ],
     "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/go-token.mjs\""
+          }
+        ]
+      },
       {
         "hooks": [
           {

package/.claude/workflows/startcycle-dispatch.mjs

@@ -545,15 +545,20 @@ function reviewerStateNote() {
   );
 }
 
-// Injects each node's registry-declared skills as an explicit allowlist.
+// Skills every node should know about (registry `common`), set once the registry is loaded.
+let commonSkills = [];
+
+// Injects the node's registry-declared skills plus the shared `common` set as
+// the preferred skills. Other installed skills stay usable when they fit.
 // Applies to every node, build and sequential alike.
 function skillsNote(node) {
-  const skills = Array.isArray(node?.skills) ? node.skills : [];
+  const own = Array.isArray(node?.skills) ? node.skills : [];
+  const skills = [...new Set([...commonSkills, ...own])];
   const parts = [];
   if (skills.length > 0) {
     parts.push(
-      ` Use these skills for this work: ${skills.join(', ')}. ` +
-      'Do not reach for skills outside this list unless the task genuinely requires it.'
+      ` Prefer these skills for this work: ${skills.join(', ')}. ` +
+      'Any other installed skill may be used when the task genuinely calls for it.'
     );
   }
   // A --skill flag is a hard requirement from the user, not the registry's
@@ -693,6 +698,7 @@ const REGISTRY_SCHEMA = {
   properties: {
     version: { type: 'number' },
     description: { type: 'string' },
+    common: { type: 'array', items: { type: 'string' } },
     nodes: {
       type: 'object',
       minProperties: 1,
@@ -733,6 +739,7 @@ const registryResult = await agent(
 );
 
 const registryNodes = registryResult?.nodes ?? {};
+commonSkills = Array.isArray(registryResult?.common) ? registryResult.common.filter((s) => typeof s === 'string') : [];
 const missingNodeIds = REQUIRED_NODE_IDS.filter((id) => !registryNodes[id]);
 if (missingNodeIds.length > 0) {
   return await escalate(

package/.opencode/plugins/bdb-aos.js

@@ -4,7 +4,8 @@
  * Implements:
  * 1. tool.execute.before: Releases gatekeeper (go-gate). Guards outward-facing
  *    or hard-to-reverse actions (git push, npm publish, npm version, rm -rf)
- *    unless the user explicitly authorized it with the literal word "GO".
+ *    unless the user explicitly authorized it with the literal word "GO", or a
+ *    master session issued a GO token for this session (~/.aos/go/<name>.token).
  * 2. chat.message: Ambient memory injection (memB). Injects relevant project & user
  *    memories as ephemeral context from ~/.MemBDB/memb.db via node:sqlite.
  * 3. tool.execute.before/after: Best-effort live-map telemetry for the AOS
@@ -15,21 +16,15 @@
  */
 
 import { existsSync, readFileSync } from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 
-const GUARDED_PATTERNS = [
-  /(?:^|[;&|]\s*)git\s+push\b/i,
-  /(?:^|[;&|]\s*)npm\s+publish\b/i,
-  /(?:^|[;&|]\s*)npm\s+version\b/i,
-  /(?:^|[;&|]\s*)gh\s+pr\s+merge\b/i,
-  /(?:^|[;&|]\s*)gh\s+release\s+create\b/i,
-  /(?:^|[;&|]\s*)git\s+reset\s+--hard\b/i,
-  /(?:^|[;&|]\s*)git\s+clean\s+-[a-zA-Z]*f\b/i,
-  /(?:^|[;&|]\s*)rm\s+(?:-\w*[rR]\w*|--recursive)\b/i,
-];
-
-let lastHumanPrompt = '';
+// Decision logic lives in the shared hooks: installed copy next to this file
+// (plugins/aos-hooks), else the repo's .claude/hooks. existsSync, not try/catch,
+// so a broken installed hook fails loudly instead of silently falling back.
+const HOOKS = existsSync(new URL('./aos-hooks/go-gate.mjs', import.meta.url)) ? './aos-hooks/' : '../../.claude/hooks/';
+const hook = (f) => import(new URL(HOOKS + f, import.meta.url).href);
+const [{ GUARDED_PATTERNS, tokenGrantsGo }, { issueGoToken }, { checkConventionalCommit }, { envFileReason }, { buildMemoryBlock }] =
+  await Promise.all(['go-gate.mjs', 'go-token.mjs', 'conventional-commits.mjs', 'env-file-protection.mjs', 'memb-inject.mjs'].map(hook));
 
 // ---------------------------------------------------------------------------
 // Graph gate (W-5, W-6)
@@ -125,14 +120,14 @@ function matchPipelineCommand(text) {
     return PIPELINE_COMMANDS.find(c => c.name === m[1].toLowerCase()) || null;
 }
 
-function isGuardedCommand(cmd) {
-  if (typeof cmd !== 'string') return false;
-  return GUARDED_PATTERNS.some((re) => re.test(cmd));
-}
-
-function verifyGoAuthorized(lastPrompt) {
-  const trimmed = (lastPrompt || '').trim();
-  return trimmed.toUpperCase() === 'GO';
+// This session's name for the token: env (set by aos-acp / the user), else the
+// OpenCode session title.
+async function ownSessionName(client, sessionID) {
+  if (process.env.AOS_SESSION_NAME) return process.env.AOS_SESSION_NAME;
+  try {
+    const res = await client?.session?.get?.({ path: { id: sessionID } });
+    return res?.data?.title || '';
+  } catch { return ''; }
 }
 
 // Best-effort fire-and-forget telemetry for the AOS live map (agenttrail daemon).
@@ -179,83 +174,51 @@ function mapTrailToolInput(args, directory) {
   return mapped;
 }
 
-// Extract ambient memory from local memB database
-async function getMembContext(prompt, currentDir) {
-  const home = os.homedir();
-  const dbPath = path.join(home, '.MemBDB', 'memb.db');
-  if (!existsSync(dbPath)) return null;
-
+// Live-map autostart: on the first subagent spawn per session, ensure the agenttrail map runs
+// and show its URL. Best-effort; never affects the gate logic.
+const trailSeen = new Set();
+async function trailAutostart(toolInput, directory, client) {
   try {
-    const { DatabaseSync } = await import('node:sqlite');
-    const db = new DatabaseSync(dbPath, { readOnly: true });
-    db.exec('PRAGMA busy_timeout = 3000;');
-
-    const contextItems = [];
-
-    // Standing persona facts
-    const personaFile = path.join(home, '.MemBDB', 'ambient-persona.txt');
-    if (existsSync(personaFile)) {
-      try {
-        for (const line of readFileSync(personaFile, 'utf8').split('\n')) {
-          const t = line.trim();
-          if (t && !t.startsWith('#')) contextItems.push(`- ${t}`);
-        }
-      } catch {}
-    }
-
-    // Resolve project ID candidate
-    let projectName = path.basename(currentDir);
-    const pkgPath = path.join(currentDir, 'package.json');
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-        if (pkg?.name) projectName = pkg.name;
-      } catch {}
-    }
-
-    // Query project memories
-    try {
-      const sql = `
-        SELECT payload FROM memb_vectors
-        WHERE collection = 'bdb_agent_memory'
-          AND (
-            json_extract(payload, '$.project_id') = ?
-            OR json_extract(payload, '$.metadata.project_id') = ?
-            OR json_extract(payload, '$.project') = ?
-            OR json_extract(payload, '$.metadata.project') = ?
-          )
-        ORDER BY rowid DESC
-        LIMIT 3
-      `;
-      const rows = db.prepare(sql).all(projectName, projectName, projectName, projectName);
-      for (const r of rows) {
-        try {
-          const p = JSON.parse(r.payload);
-          const text = (p.memory || p.data || '').trim().replace(/\s+/g, ' ');
-          if (text.length > 10) {
-            contextItems.push(`- Project [${projectName}]: ${text.slice(0, 180)}`);
-          }
-        } catch {}
-      }
-    } catch {}
-
-    db.close();
-
-    if (contextItems.length === 0) return null;
-    return `[AOS Ambient Memory - memB]\n${contextItems.join('\n')}`;
-  } catch {
-    return null;
-  }
+    const lib = await import('./lib/trail-autostart.js');
+    if (!lib.isSpawnTool(toolInput.tool) || trailSeen.has(toolInput.sessionID)) return;
+    const r = lib.trailEnsure({ cwd: directory, sessionId: toolInput.sessionID });
+    if (!r) return;
+    trailSeen.add(toolInput.sessionID);
+    await client?.tui?.showToast?.({
+      body: { title: 'AOS agenttrail', message: r.url, variant: 'info' },
+    });
+  } catch {}
 }
 
 export default async function bdbAosPlugin(input) {
   const directory = input.directory || process.cwd();
 
+  // ponytail: entries live for the process lifetime (a few bytes per session); add cleanup if sessions ever pile up.
+  const sessions = new Map();
+  const sess = (id) => {
+    if (!sessions.has(id)) sessions.set(id, { prompt: '', parentID: null, identitySent: false });
+    return sessions.get(id);
+  };
+  const trail = (hook_event_name, session_id, extra = {}) =>
+    void postTrail({ hook_event_name, session_id, cwd: directory, agent: 'opencode', ...extra });
+
   return {
     // W-6 loop-keeper. Fires whenever a session goes idle. Reads the graph
     // state and, while work is still open, prompts the session to continue.
     // Never throws: a graph that cannot be read must not wedge the session.
     event: async ({ event }) => {
+      try {
+        const props = (event && event.properties) || {};
+        if (event?.type === 'session.created' && props.info?.id) {
+          sess(props.info.id).parentID = props.info.parentID ?? null;
+          trail('SessionStart', props.info.id);
+        } else if (event?.type === 'permission.updated') {
+          trail('Notification', props.sessionID, { message: props.title });
+        } else if (event?.type === 'session.idle' && props.sessionID) {
+          trail(sess(props.sessionID).parentID ? 'SubagentStop' : 'Stop', props.sessionID);
+        }
+      } catch {}
+
       try {
         if (!event || event.type !== 'session.idle') return;
         const sessionID = event.properties && event.properties.sessionID;
@@ -283,16 +246,19 @@ export default async function bdbAosPlugin(input) {
     },
 
     'chat.message': async (msgInput, msgOutput) => {
-      // Capture the user prompt text for GO-gate verification
-      const textParts = (msgOutput.parts || []).filter((p) => p && p.type === 'text' && typeof p.text === 'string');
+      const textParts = (msgOutput.parts || []).filter((p) => p && p.type === 'text' && typeof p.text === 'string' && !p.synthetic);
       const fullText = textParts.map((p) => p.text).join('\n').trim();
-      if (fullText) {
-        lastHumanPrompt = fullText;
-      }
+      const s = sess(msgInput.sessionID);
+      s.prompt = fullText;
+
+      try {
+        if (!s.parentID) issueGoToken(fullText, { session_id: msgInput.sessionID, message_id: msgInput.messageID || msgOutput.message?.id });
+      } catch {}
 
-      // Inject memB ambient memory
       try {
-        const membContext = await getMembContext(fullText, directory);
+        const event = s.identitySent || s.parentID ? 'UserPromptSubmit' : 'SessionStart';
+        s.identitySent = true;
+        const membContext = await buildMemoryBlock({ event, prompt: fullText, cwd: directory });
         if (membContext) {
           msgOutput.parts.unshift({
             id: `memb-${Date.now()}`,
@@ -336,47 +302,65 @@ export default async function bdbAosPlugin(input) {
         const tool_name = mapTrailToolName(toolInput.tool);
         const tool_input = mapTrailToolInput(toolOutput?.args, directory);
         pendingArgs.set(toolInput.callID, tool_input);
-        postTrail({
-          hook_event_name: 'PreToolUse',
-          session_id: toolInput.sessionID,
-          cwd: directory,
-          agent: 'opencode',
-          tool_name,
-          tool_input,
-        });
+        trail('PreToolUse', toolInput.sessionID, { tool_name, tool_input });
       } catch {}
+      await trailAutostart(toolInput, directory, input.client);
       const toolName = (toolInput.tool || '').toLowerCase();
       // Intercept bash, terminal, or command execution tools
       if (toolName === 'bash' || toolName === 'terminal' || toolName === 'shell' || toolName === 'exec' || toolName === 'run_command') {
         const cmd = toolOutput?.args?.command || toolOutput?.args?.cmd || toolOutput?.args?.script || '';
-        if (isGuardedCommand(cmd)) {
-          let authorized = verifyGoAuthorized(lastHumanPrompt);
+        if (typeof cmd === 'string' && GUARDED_PATTERNS.some((re) => re.test(cmd))) {
+          const s = sess(toolInput.sessionID);
+          // An unanswered lookup is not proof of a root session: token-only for this call, not cached.
+          let tokenOnly = !!s.parentID;
+          if (!tokenOnly && input.client && toolInput.sessionID) {
+            try {
+              const res = await input.client.session.get({ path: { id: toolInput.sessionID } });
+              if (res?.data) s.parentID = res.data.parentID ?? null;
+              else tokenOnly = true;
+            } catch { tokenOnly = true; }
+            tokenOnly = tokenOnly || !!s.parentID;
+          }
+          // Subagent prompts are agent-written, so only a token can open their gate.
+          let authorized = !tokenOnly && s.prompt.toUpperCase() === 'GO';
 
-          // If last cached prompt wasn't GO, query recent session messages via OpenCode client as fallback
-          if (!authorized && input.client && toolInput.sessionID) {
+          // If this session's cached prompt wasn't GO, query recent session messages via OpenCode client as fallback
+          if (!authorized && !tokenOnly && input.client && toolInput.sessionID) {
             try {
               const res = await input.client.session.messages({ path: { id: toolInput.sessionID } });
               const msgs = res?.data || [];
               for (let i = msgs.length - 1; i >= 0; i--) {
                 const m = msgs[i];
-                if (m.role === 'user') {
+                if ((m.info?.role ?? m.role) === 'user') {
                   const parts = m.parts || [];
-                  const text = parts.filter((p) => p.type === 'text').map((p) => p.text).join('\n').trim();
-                  if (text) {
-                    authorized = (text.toUpperCase() === 'GO');
-                    break;
-                  }
+                  const text = parts.filter((p) => p.type === 'text' && !p.synthetic).map((p) => p.text).join('\n').trim();
+                  authorized = text.toUpperCase() === 'GO';
+                  break;
                 }
               }
             } catch {}
           }
 
+          if (!authorized) {
+            authorized = tokenGrantsGo(await ownSessionName(input.client, toolInput.sessionID)).ok;
+          }
+
           if (!authorized) {
             throw new Error(
               `Blocked by BDB go-gate: Command "${cmd.slice(0, 80)}" is guarded and requires explicit authorization with the literal word "GO" before proceeding.`
             );
           }
         }
+        const reason = checkConventionalCommit(cmd);
+        if (reason) throw new Error(reason);
+      } else if (['write', 'edit', 'multiedit', 'patch', 'apply_patch'].includes(toolName)) {
+        const args = toolOutput?.args || {};
+        const paths = [args.filePath ?? ''];
+        for (const m of String(args.patchText ?? '').matchAll(/^\*\*\* (?:(?:Add|Update) File|Move to): (.+)$/gm)) paths.push(m[1].trim());
+        for (const f of paths) {
+          const reason = envFileReason(f);
+          if (reason) throw new Error(reason);
+        }
       }
     },
 
@@ -384,14 +368,7 @@ export default async function bdbAosPlugin(input) {
       try {
         const tool_input = pendingArgs.get(toolInput.callID);
         pendingArgs.delete(toolInput.callID);
-        postTrail({
-          hook_event_name: 'PostToolUse',
-          session_id: toolInput.sessionID,
-          cwd: directory,
-          agent: 'opencode',
-          tool_name: mapTrailToolName(toolInput.tool),
-          tool_input,
-        });
+        trail('PostToolUse', toolInput.sessionID, { tool_name: mapTrailToolName(toolInput.tool), tool_input });
       } catch {}
     },
   };

package/.opencode/plugins/lib/trail-autostart.js

@@ -0,0 +1,38 @@
+/**
+ * OpenCode counterpart of the Claude PreToolUse agenttrail autostart.
+ * Pure and injectable so it is testable without OpenCode. Never throws.
+ * Tool args/prompts are deliberately not an input: nothing user-authored
+ * can reach the command line.
+ */
+
+import { spawnSync as realSpawnSync } from 'node:child_process';
+
+export const TRAIL_TIMEOUT_MS = 1800;
+export const SPAWN_TOOLS = new Set(['task']);
+
+export function isSpawnTool(tool) {
+  return SPAWN_TOOLS.has(String(tool || '').toLowerCase());
+}
+
+// Returns { url, hint } or null (no URL, binary missing, timeout, bad output).
+export function trailEnsure({ spawnSync = realSpawnSync, env = process.env, cwd, sessionId } = {}) {
+  try {
+    const args = ['--ensure'];
+    if (cwd) args.push('--cwd', String(cwd));
+    if (sessionId) args.push('--session', String(sessionId));
+    args.push('--json');
+    const res = spawnSync(env.AOS_TRAIL_BIN || 'aos-trail', args, {
+      encoding: 'utf8',
+      timeout: TRAIL_TIMEOUT_MS,
+      killSignal: 'SIGKILL',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      env,
+    });
+    if (!res || res.error || res.status !== 0) return null;
+    const out = JSON.parse(String(res.stdout || '').trim());
+    if (!out || typeof out.url !== 'string' || !out.url) return null;
+    return { url: out.url, hint: typeof out.hint === 'string' ? out.hint : null };
+  } catch {
+    return null;
+  }
+}

package/CLAUDE.md

@@ -23,7 +23,7 @@ These ship as Claude Code plugins and are the preferred path over shelling out
 to the underlying CLI, because they already handle wrapper flags, cost
 discipline, and the digest contract:
 
-- `antigravity:antigravity-delegate` — agy / Gemini
+- `antigravity:delegate` — agy / Gemini
 - `opencode:opencode-rescue`
 - `codex:codex-rescue`
 

package/README.de.md

@@ -1,4 +1,4 @@
-![AOS — BDB Agent OS](assets/header-v4.jpg)
+![AOS — BDB Agent OS](assets/header-v5.png)
 
 🌐 **Language / Sprache / Idioma**: [ 🇬🇧 English ](README.md) | **Deutsch** | [ 🇵🇹 Português ](README.pt.md)
 
@@ -11,7 +11,7 @@
 [![CI](https://github.com/hybridlabor-api/aos/actions/workflows/ci.yml/badge.svg)](https://github.com/hybridlabor-api/aos/actions)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![node](https://img.shields.io/badge/node-%3E%3D20-blue.svg)](package.json)
-[![skills](https://img.shields.io/badge/skills-214%20curated-brightgreen.svg)](#skills)
+[![skills](https://img.shields.io/badge/skills-224%20curated-brightgreen.svg)](#skills)
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](#mcp-server)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#unterstützte-harnesses)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
@@ -27,7 +27,7 @@ Entwickelt für Nutzer, die bereits **Claude Code, Google Antigravity, Codex CLI
 
 Nach der Installation hast du:
 
-- **<!-- count:skills -->214<!-- /count --> Skills** in sechs Kategorien, von jedem Harness als `<name>/SKILL.md` auffindbar.
+- **<!-- count:skills -->224<!-- /count --> Skills** in sechs Kategorien, von jedem Harness als `<name>/SKILL.md` auffindbar.
 - **<!-- count:agents -->13<!-- /count --> Subagents** (Architect, TechLead, Reviewer, die Godmodes, Security- und Silent-Failure-Reviewer) als natives Agenten-Format jedes Harness kompiliert.
 - **<!-- count:mcps -->21<!-- /count --> MCP-Server** für Creative Software, Betriebssystemsteuerung, Memory und Harness-übergreifende Delegation.
 - **Drei Pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user` — und ein **GO-Gate**, das `git push`, `npm publish`, `npm version` und rekursive `rm` mechanisch blockiert.
@@ -208,7 +208,7 @@ Installiere es durch den AOS Installer mit dem AOS CLI Target: `npx -y @hybridla
 npx skills add hybridlabor-api/aos
 ```
 
-Dies entdeckt alle <!-- count:skills -->214<!-- /count --> kuratierten Skills und installiert sie in das universelle `~/.agents/skills` Verzeichnis (verwendet von allen Harnesses und dem AOS CLI).
+Dies entdeckt alle <!-- count:skills -->224<!-- /count --> kuratierten Skills und installiert sie in das universelle `~/.agents/skills` Verzeichnis (verwendet von allen Harnesses und dem AOS CLI).
 
 ---
 
@@ -249,7 +249,7 @@ Der Dispatcher-Graph kompiliert diese Agents, verfügbar als Claude Code Subagen
 
 ### Skills nach Kategorie
 
-<!-- count:skills -->214<!-- /count --> kuratierte Skills, von jedem Harness auffindbar:
+<!-- count:skills -->224<!-- /count --> kuratierte Skills, von jedem Harness auffindbar:
 
 - **bdb-core** (31 Skills): Core AOS Infrastruktur, Pipelines, Tools und Utilities — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill` und mehr.
 - **design-ui-ux** (19 Skills): Frontend, UI Design, Barrierefreiheit, Tokens, Motion, Anti-Slop — `senior-frontend`, `ui-component`, `ui-review`, `tailwind-patterns`, `shadcn`, `wcag-audit-patterns` und mehr.
@@ -264,7 +264,7 @@ Der vollständige Katalog mit detaillierten Beschreibungen: [docs/skills_table.m
 
 ## Skills
 
-<!-- count:skills -->214<!-- /count --> Skills, kuratiert aus Open-Source- und proprietären Sammlungen, die die gesamte Software-Entwicklung und Creative-Pipeline abdecken. Jeder Skill ist ein Verzeichnis mit einem `SKILL.md` Frontmatter, das `name`, `description` und eine `category` erklärt: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
+<!-- count:skills -->224<!-- /count --> Skills, kuratiert aus Open-Source- und proprietären Sammlungen, die die gesamte Software-Entwicklung und Creative-Pipeline abdecken. Jeder Skill ist ein Verzeichnis mit einem `SKILL.md` Frontmatter, das `name`, `description` und eine `category` erklärt: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
 
 **Persona Layer:** Die **Godmode** Skills sind spezialisierte Personas, die direkt den Build- und Shipping-Knoten des Dispatcher-Graphs zugeordnet sind:
 
@@ -411,10 +411,6 @@ flowchart LR
 
 `@hybridlabor-api/heimdall-token-saver`: komprimiert wiederholte CLI-Ausgabe über Ambient Hooks auf jedem Harness. Reduziert Token-Overhead bei großen Projekten. Skill: `token-saver-config`.
 
-![Token savings with Heimdall Token Saver](assets/bdb_savings_graph_sketch.jpg)
-
-*Illustrative Skizze aus v3.x. Die Prozentwerte sind Schätzungen des Projekts, keine für dieses README durchgeführten Messungen.*
-
 ---
 
 ## Aktualisierung

package/README.md

@@ -1,4 +1,4 @@
-![AOS — BDB Agent OS](assets/header-v4.jpg)
+![AOS — BDB Agent OS](assets/header-v5.png)
 
 🌐 **Language / Sprache / Idioma**: **English** | [ 🇩🇪 Deutsch ](README.de.md) | [ 🇵🇹 Português ](README.pt.md)
 
@@ -11,7 +11,7 @@
 [![CI](https://github.com/hybridlabor-api/aos/actions/workflows/ci.yml/badge.svg)](https://github.com/hybridlabor-api/aos/actions)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![node](https://img.shields.io/badge/node-%3E%3D20-blue.svg)](package.json)
-[![skills](https://img.shields.io/badge/skills-214%20curated-brightgreen.svg)](#skills)
+[![skills](https://img.shields.io/badge/skills-224%20curated-brightgreen.svg)](#skills)
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](#mcp-servers)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#supported-harnesses)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
@@ -27,7 +27,7 @@ Built for people who already run **Claude Code, Google Antigravity, Codex CLI, O
 
 After install you have:
 
-- **<!-- count:skills -->214<!-- /count --> skills** in six categories, discoverable by every harness as `<name>/SKILL.md`.
+- **<!-- count:skills -->224<!-- /count --> skills** in six categories, discoverable by every harness as `<name>/SKILL.md`.
 - **<!-- count:agents -->13<!-- /count --> subagents** (Architect, TechLead, Reviewer, the Godmodes, security and silent-failure reviewers) compiled into each harness's native agent format.
 - **<!-- count:mcps -->21<!-- /count --> MCP servers** for creative software, OS control, memory and cross-harness delegation.
 - **Three pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user` — and a **GO gate** that mechanically blocks `git push`, `npm publish`, `npm version` and recursive `rm`.
@@ -208,7 +208,7 @@ Install it through the AOS installer with the AOS CLI target: `npx -y @hybridlab
 npx skills add hybridlabor-api/aos
 ```
 
-This discovers all <!-- count:skills -->214<!-- /count --> curated skills and installs them into the universal `~/.agents/skills` directory (used by all harnesses and the AOS CLI).
+This discovers all <!-- count:skills -->224<!-- /count --> curated skills and installs them into the universal `~/.agents/skills` directory (used by all harnesses and the AOS CLI).
 
 ---
 
@@ -249,7 +249,7 @@ The dispatcher graph compiles these agents, available as Claude Code subagents a
 
 ### Skills by Category
 
-<!-- count:skills -->214<!-- /count --> curated skills, discoverable by every harness:
+<!-- count:skills -->224<!-- /count --> curated skills, discoverable by every harness:
 
 - **bdb-core** (31 skills): Core AOS infrastructure, pipelines, tools, and utilities — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill`, and more.
 - **design-ui-ux** (19 skills): Frontend, UI design, accessibility, tokens, motion, anti-slop — `senior-frontend`, `ui-component`, `ui-review`, `tailwind-patterns`, `shadcn`, `wcag-audit-patterns`, and more.
@@ -264,7 +264,7 @@ The full catalog with detailed descriptions: [docs/skills_table.md](docs/skills_
 
 ## Skills
 
-<!-- count:skills -->214<!-- /count --> skills, curated from open-source and proprietary collections, covering the full software development and creative pipeline. Every skill is a directory with a `SKILL.md` frontmatter declaring `name`, `description`, and one `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
+<!-- count:skills -->224<!-- /count --> skills, curated from open-source and proprietary collections, covering the full software development and creative pipeline. Every skill is a directory with a `SKILL.md` frontmatter declaring `name`, `description`, and one `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
 
 **Persona Layer:** The **Godmode** skills are specialized personas that directly map to the build and ship nodes of the dispatcher graph:
 
@@ -411,10 +411,6 @@ flowchart LR
 
 `@hybridlabor-api/heimdall-token-saver`: compresses repeated CLI output via ambient hooks on every harness. Reduces token overhead on large projects. Skill: `token-saver-config`.
 
-![Token savings with Heimdall Token Saver](assets/bdb_savings_graph_sketch.jpg)
-
-*Illustrative sketch from v3.x. The percentages are the project's own estimates, not measurements made for this README.*
-
 ---
 
 ## Updating

package/README.pt.md

@@ -1,4 +1,4 @@
-![AOS — BDB Agent OS](assets/header-v4.jpg)
+![AOS — BDB Agent OS](assets/header-v5.png)
 
 🌐 **Language / Sprache / Idioma**: [ 🇬🇧 English ](README.md) | [ 🇩🇪 Deutsch ](README.de.md) | **Português**
 
@@ -11,7 +11,7 @@
 [![CI](https://github.com/hybridlabor-api/aos/actions/workflows/ci.yml/badge.svg)](https://github.com/hybridlabor-api/aos/actions)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![node](https://img.shields.io/badge/node-%3E%3D20-blue.svg)](package.json)
-[![skills](https://img.shields.io/badge/skills-214%20curated-brightgreen.svg)](#skills)
+[![skills](https://img.shields.io/badge/skills-224%20curated-brightgreen.svg)](#skills)
 [![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](#servidores-mcp)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#harnesses-suportados)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
@@ -27,7 +27,7 @@ Construído para pessoas que já executam **Claude Code, Google Antigravity, Cod
 
 Após a instalação, você tem:
 
-- **<!-- count:skills -->214<!-- /count --> skills** em seis categorias, descobríveis por cada harness como `<name>/SKILL.md`.
+- **<!-- count:skills -->224<!-- /count --> skills** em seis categorias, descobríveis por cada harness como `<name>/SKILL.md`.
 - **<!-- count:agents -->13<!-- /count --> subagentes** (Architect, TechLead, Reviewer, os Godmodes, revisores de segurança e falhas silenciosas) compilados em cada formato nativo de agente do harness.
 - **<!-- count:mcps -->21<!-- /count --> servidores MCP** para software criativo, controle de SO, memória e delegação entre harnesses.
 - **Três pipelines** — `/startcycle`, `/startcycle-graph`, `/startcycle-graph-user` — e um **portão GO** que bloqueia mecanicamente `git push`, `npm publish`, `npm version` e `rm` recursivo.
@@ -208,7 +208,7 @@ Instale através do instalador AOS com o alvo AOS CLI: `npx -y @hybridlabor-api/
 npx skills add hybridlabor-api/aos
 ```
 
-Isto descobre todas as <!-- count:skills -->214<!-- /count --> skills curadas e as instala no diretório universal `~/.agents/skills` (usado por todos os harnesses e o AOS CLI).
+Isto descobre todas as <!-- count:skills -->224<!-- /count --> skills curadas e as instala no diretório universal `~/.agents/skills` (usado por todos os harnesses e o AOS CLI).
 
 ---
 
@@ -249,7 +249,7 @@ O grafo do dispatcher compila estes agentes, disponíveis como subagentes Claude
 
 ### Skills por Categoria
 
-<!-- count:skills -->214<!-- /count --> skills curadas, descobríveis por todo harness:
+<!-- count:skills -->224<!-- /count --> skills curadas, descobríveis por todo harness:
 
 - **bdb-core** (31 skills): Infraestrutura AOS principal, pipelines, ferramentas e utilidades — `startcycle`, `startcycle-graph`, `startcycle-graph-user`, `agent-orchestrator`, `agenttrail`, `plan-canvas`, `aos-doctor`, `aos-store`, `bdb-dev-os-skill` e mais.
 - **design-ui-ux** (19 skills): Frontend, design UI, acessibilidade, tokens, movimento, anti-slop — `senior-frontend`, `ui-component`, `ui-review`, `tailwind-patterns`, `shadcn`, `wcag-audit-patterns` e mais.
@@ -264,7 +264,7 @@ O catálogo completo com descrições detalhadas: [docs/skills_table.md](docs/sk
 
 ## Skills
 
-<!-- count:skills -->214<!-- /count --> skills, curadas de coleções de código aberto e proprietárias, cobrindo o pipeline completo de desenvolvimento de software e criativo. Cada skill é um diretório com um `SKILL.md` frontmatter declarando `name`, `description` e uma `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
+<!-- count:skills -->224<!-- /count --> skills, curadas de coleções de código aberto e proprietárias, cobrindo o pipeline completo de desenvolvimento de software e criativo. Cada skill é um diretório com um `SKILL.md` frontmatter declarando `name`, `description` e uma `category`: `bdb-core`, `design-ui-ux`, `engineering-method`, `engineering-hardware`, `media-eventtech`, `library`.
 
 **Camada de Persona:** As skills **Godmode** são personas especializadas que mapeiam diretamente para os nós de compilação e envio do grafo do dispatcher:
 
@@ -411,10 +411,6 @@ flowchart LR
 
 `@hybridlabor-api/heimdall-token-saver`: comprime saída CLI repetida via hooks ambiente em todo harness. Reduz sobrecarga de token em projetos grandes. Skill: `token-saver-config`.
 
-![Token savings with Heimdall Token Saver](assets/bdb_savings_graph_sketch.jpg)
-
-*Esboço ilustrativo da v3.x. Os percentuais são estimativas do próprio projeto, não medições feitas para este README.*
-
 ---
 
 ## Atualizando