@hybridlabor-api/aos 4.2.0 → 4.4.0

package/README.pt.md

@@ -21,6 +21,7 @@
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![skills](https://img.shields.io/badge/skills-154%20curadas-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
 > **Potencializando agentes de código de IA com 154 skills hipercuradas, 21 wrappers MCP locais e um grafo dispatcher de multi-agentes executável.**
 
@@ -149,7 +150,6 @@ Abaixo está a visão geral completa de todas as skills curadas de agentes inclu
 | `github-repo` | Padrões e fluxos de trabalho para escrever, formatar, higienizar e publicar repositórios GitHub de alta qualidade, complementando a skill openwiki-skill. |
 | `github-workflow-automation` | Padrões para automatizar fluxos de trabalho do GitHub com assistência de IA, inspirados pelo [Gemini CLI](https://github.com/google-gemini/gemini-cli) e práticas modernas de DevOps. |
 | `go-playwright` | Capacidade especialista para automação de navegador robusta, furtiva e eficiente usando Playwright Go. |
-| `google-sheets-automation` | Integração leve com Google Sheets com autenticação OAuth autônoma. Não requer servidor MCP. Acesso completo de leitura/escrita. |
 | `n8n-code-javascript` | Escreva código JavaScript em nós Code do n8n. Use ao escrever JavaScript no n8n, usando sintaxe $input/$json/$node, fazendo requisições HTTP com $helpers, trabalhando com datas usando DateTime, solucionando erros de nó Code, ou escolhendo entre modos de nó Code. |
 | `n8n-code-python` | Escreva código Python em nós Code do n8n. Use ao escrever Python no n8n, usando sintaxe _input/_json/_node, trabalhando com a biblioteca padrão, ou quando precisar entender as limitações do Python em nós Code do n8n. |
 | `n8n-expression-syntax` | Valide a sintaxe de expressões n8n e corrija erros comuns. Use ao escrever expressões n8n, usando sintaxe {{}}, acessando variáveis $json/$node, solucionando erros de expressão, ou trabalhando com dados de webhook em fluxos de trabalho. |
@@ -297,7 +297,6 @@ Abaixo está a visão geral completa de todas as skills curadas de agentes inclu
 | `bdb-updater` | Verifique proativamente e instale atualizações no pacote BDB Antigravity Skills via NPM. |
 | `monorepo-management` | Construa monorepos eficientes e escaláveis que possibilitem compartilhamento de código, ferramentas consistentes e alterações atômicas em múltiplos pacotes e aplicações. |
 | `obsidian-markdown` | Crie e edite Obsidian Flavored Markdown com wikilinks, embeds, callouts, propriedades e outras sintaxes específicas do Obsidian. Use ao trabalhar com arquivos .md no Obsidian, ou quando o usuário mencionar wikilinks, callouts, frontmatter, tags, embeds ou notas Obsidian. |
-| `senior-fullstack` | Kit de ferramentas completo para fullstack sênior com ferramentas modernas e melhores práticas. |
 | `token-saver-config` | Motor de compressão de saída de janela de contexto para comandos CLI (60-99% de redução de tokens). |
 | `web-performance-optimization` | Otimize o desempenho de sites e aplicações web, incluindo velocidade de carregamento, Core Web Vitals, tamanho de bundle, estratégias de cache e desempenho de tempo de execução. |
 
@@ -494,18 +493,18 @@ Este repositório também contém 14 configurações profundas de sistema e dire
 <details>
 <summary><strong>Ver Lista de Skills do Sistema</strong></summary>
 
-- [`bdb-unreal-mcp.md`](skills/global_config/bdb-unreal-mcp.md)
-- [`bdb-rhino-mcp.md`](skills/global_config/bdb-rhino-mcp.md)
-- [`bdb-davinci-mcp.md`](skills/global_config/bdb-davinci-mcp.md)
-- [`bdb-blender-mcp.md`](skills/global_config/bdb-blender-mcp.md)
-- [`bdb-after-effects-mcp.md`](skills/global_config/bdb-after-effects-mcp.md)
-- [`bdb-vectorworks-mcp.md`](skills/global_config/bdb-vectorworks-mcp.md)
-- [`bdb-touchdesigner-mcp.md`](skills/global_config/bdb-touchdesigner-mcp.md)
-- [`bdb-computer-use-mcp.md`](skills/global_config/bdb-computer-use-mcp.md)
-- [`bdb-grandma3-mcp.md`](skills/global_config/bdb-grandma3-mcp.md)
-- [`bdb-resolume-mcp.md`](skills/global_config/bdb-resolume-mcp.md)
-- [`bdb-adobe-suite-mcp.md`](skills/global_config/bdb-adobe-suite-mcp.md)
-- [`bdb-memb-mcp.md`](skills/global_config/bdb-memb-mcp.md)
+- [`bdb-unreal-mcp`](skills/global_config/bdb-unreal-mcp/SKILL.md)
+- [`bdb-rhino-mcp`](skills/global_config/bdb-rhino-mcp/SKILL.md)
+- [`bdb-davinci-mcp`](skills/global_config/bdb-davinci-mcp/SKILL.md)
+- [`bdb-blender-mcp`](skills/global_config/bdb-blender-mcp/SKILL.md)
+- [`bdb-after-effects-mcp`](skills/global_config/bdb-after-effects-mcp/SKILL.md)
+- [`bdb-vectorworks-mcp`](skills/global_config/bdb-vectorworks-mcp/SKILL.md)
+- [`bdb-touchdesigner-mcp`](skills/global_config/bdb-touchdesigner-mcp/SKILL.md)
+- [`bdb-computer-use-mcp`](skills/global_config/bdb-computer-use-mcp/SKILL.md)
+- [`bdb-grandma3-mcp`](skills/global_config/bdb-grandma3-mcp/SKILL.md)
+- [`bdb-resolume-mcp`](skills/global_config/bdb-resolume-mcp/SKILL.md)
+- [`bdb-adobe-suite-mcp`](skills/global_config/bdb-adobe-suite-mcp/SKILL.md)
+- [`bdb-memb-mcp`](skills/global_config/bdb-memb-mcp/SKILL.md)
 - [`openwiki-skill`](skills/global_config/openwiki-skill/SKILL.md): Direct Gemini-native integration of OpenWiki for autonomous, high-agency documentation management and release notes maintenance.
 - [`memb-skill`](skills/global_config/memb-skill/SKILL.md): BDB local-first long-term memory engine (memB). Query, remember, and adapt preferences, code architectures, and developer patterns across tasks.
 </details>

package/THIRD_PARTY_NOTICES.md

@@ -139,6 +139,8 @@ The grilling family and the domain-modeling discipline it composes with:
 | `skills/global_config/grill-me/` | `skills/productivity/grill-me/` |
 | `skills/global_config/grill-with-docs/` | `skills/engineering/grill-with-docs/` |
 | `skills/global_config/domain-modeling/` | `skills/engineering/domain-modeling/` (incl. `ADR-FORMAT.md`, `CONTEXT-FORMAT.md`) |
+| `skills/global_config/triage/` | `skills/engineering/triage/` |
+| `skills/global_config/prototype/` | `skills/engineering/prototype/` |
 
 `grilling`'s interview protocol and `domain-modeling` are carried over
 essentially verbatim; `grill-me` and `grill-with-docs` are rewritten to name AOS's
@@ -177,6 +179,58 @@ SOFTWARE.
 
 ---
 
+## Other vendored skills
+
+Skills in `skills/` that were derived from an external project record that
+project in their own `source:` frontmatter. Every upstream named there is
+listed below. Licences were verified against each repository's own `LICENSE`
+file via the GitHub API on 2026-09-12; where a copyright line is quoted, it is
+quoted verbatim from that file.
+
+| Upstream | Licence | Copyright | Skills in AOS |
+|---|---|---|---|
+| [bitjaru/styleseed](https://github.com/bitjaru/styleseed) | MIT | Copyright (c) 2026 StyleSeed Contributors | `ui-component`, `ui-page`, `ui-pattern`, `ui-review`, `ui-tokens`, `ux-audit`, `ux-feedback`, `ux-flow` |
+| [firecrawl/skills](https://github.com/firecrawl/skills) | ISC | Copyright (c) Firecrawl | `firecrawl-build-scrape`, `firecrawl-build-search`, `firecrawl-build-interact`, `firecrawl-build-onboarding` |
+| [Dimillian/Skills](https://github.com/Dimillian/Skills) | MIT | Copyright (c) 2026 Thomas Ricouard | `github`, `react-component-performance`, `simplify-code` |
+| [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 (per-skill `LICENSE.txt`; the repo has no root licence) | Copyright 2026 Anthropic, PBC. | `webapp-testing`, `web-artifacts-builder` |
+| [AgriciDaniel/claude-seo](https://github.com/AgriciDaniel/claude-seo) | MIT | Copyright (c) 2026 agricidaniel | `seo`, `seo-technical` |
+| [neondatabase/agent-skills](https://github.com/neondatabase/agent-skills) | Apache-2.0 | template placeholder upstream; holder is Neon | `using-neon` |
+| [sanjay3290/ai-skills](https://github.com/sanjay3290/ai-skills) | Apache-2.0 | see upstream `LICENSE` | `deep-research` |
+| [shadcn-ui/ui](https://github.com/shadcn-ui/ui) | MIT | Copyright (c) 2023 shadcn | `shadcn` |
+| [kepano/obsidian-skills](https://github.com/kepano/obsidian-skills) | MIT | Copyright (c) 2026 Steph Ango | `obsidian-markdown` |
+| [alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) | MIT | Copyright (c) 2025 Alireza Rezvani | `senior-frontend`, `landing-page-generator` |
+| [playwright-community/playwright-go](https://github.com/playwright-community/playwright-go) | MIT | Copyright (c) 2020 Max Schmitt | `go-playwright` |
+| [wrsmith108/linear-claude-skill](https://github.com/wrsmith108/linear-claude-skill) | MIT | see upstream `LICENSE` | `linear-claude-skill` |
+| [langchain-ai/openwiki](https://github.com/langchain-ai/openwiki) | MIT | see upstream `LICENSE` | `openwiki-skill` |
+
+`webapp-testing` and `web-artifacts-builder` each ship upstream's own
+`LICENSE.txt` verbatim, as Apache-2.0 §4 requires. Note that `anthropics/skills`
+licenses its document skills (`docx`, `pdf`, `pptx`, `xlsx`) as
+**source-available, not open source** — neither skill vendored here comes from
+that set, and nothing from it may be vendored under this notice.
+
+Three further skills carry an in-tree provenance marker rather than a public
+upstream repository, recorded here so the claim is not lost:
+
+| Skill | Evidence in this repo |
+|---|---|
+| `react-best-practices` | `metadata.json` → `"organization": "Vercel Engineering"` |
+| `postgres-best-practices` | `metadata.json` → `"organization": "Supabase"` |
+| `playwright-skill` | `package.json` → `"author": "lackeyjb"`, `"license": "MIT"` |
+
+### Unresolved provenance
+
+These upstreams could not be cleared. They are recorded rather than hidden, and
+each needs a decision before the affected skills can be considered safely
+redistributable.
+
+| Upstream | Problem | Skills affected |
+|---|---|---|
+| `vibeforge1111/vibeship-spawner-skills` | Repository has **no `LICENSE` file**. Its README states "Apache 2.0", but a README statement is not a licence grant — absent a licence file the default is all rights reserved. | `agent-tool-builder`, `ai-product`, `browser-automation`, `crewai`, `neon-postgres`, `rag-engineer`, `vercel-deployment` |
+| `jackjin1997/ClawForge` | No `LICENSE` file; README claims MIT. | `clean-code` |
+| `CloudAI-X/threejs-skills` | No `LICENSE` file; README claims MIT. | `threejs-skills` |
+| `Shpigford/skills` | Repository returns **404** — deleted, renamed, or made private. Provenance cannot be verified at all. | `readme` |
+
 ## Note on `mcps/`
 
 Sub-repositories vendored under `mcps/` carry their own `LICENSE` files in

package/docs/skills_table.md

@@ -35,7 +35,6 @@
 | `github-repo` | Standards and workflows for writing, formatting, sanitizing, and publishing high-quality GitHub repositories, complementing openwiki-skill. |
 | `github-workflow-automation` | Patterns for automating GitHub workflows with AI assistance, inspired by [Gemini CLI](https://github.com/google-gemini/gemini-cli) and modern DevOps practices. |
 | `go-playwright` | Expert capability for robust, stealthy, and efficient browser automation using Playwright Go. |
-| `google-sheets-automation` | Lightweight Google Sheets integration with standalone OAuth authentication. No MCP server required. Full read/write access. |
 | `n8n-code-javascript` | Write JavaScript code in n8n Code nodes. Use when writing JavaScript in n8n, using $input/$json/$node syntax, making HTTP requests with $helpers, working with dates using DateTime, troubleshooting Code node errors, or choosing between Code node modes. |
 | `n8n-code-python` | Write Python code in n8n Code nodes. Use when writing Python in n8n, using _input/_json/_node syntax, working with standard library, or need to understand Python limitations in n8n Code nodes. |
 | `n8n-expression-syntax` | Validate n8n expression syntax and fix common errors. Use when writing n8n expressions, using {{}} syntax, accessing $json/$node variables, troubleshooting expression errors, or working with webhook data in workflows. |
@@ -188,7 +187,6 @@
 | `bdb-updater` | Proactively check for and install updates to the BDB Antigravity Skills package via NPM. |
 | `monorepo-management` | Build efficient, scalable monorepos that enable code sharing, consistent tooling, and atomic changes across multiple packages and applications. |
 | `obsidian-markdown` | Create and edit Obsidian Flavored Markdown with wikilinks, embeds, callouts, properties, and other Obsidian-specific syntax. Use when working with .md files in Obsidian, or when the user mentions wikilinks, callouts, frontmatter, tags, embeds, or Obsidian notes. |
-| `senior-fullstack` | Complete toolkit for senior fullstack with modern tools and best practices. |
 | `token-saver-config` | Context window output compression engine for CLI commands (60-99% token reduction). |
 | `web-performance-optimization` | Optimize website and web application performance including loading speed, Core Web Vitals, bundle size, caching strategies, and runtime performance |
 

package/installer.js

@@ -2021,17 +2021,19 @@ function resolveTargetPaths(platformValue, customPaths) {
 }
 
 function getTierExcludeSkills(tier) {
+    // Matched against directory entry names by copyDirRecursiveSync, so these
+    // carry no extension: the MCP guides became <name>/SKILL.md directories.
     return tier === '2' ? [
-        'bdb-adobe-suite-mcp.md',
-        'bdb-after-effects-mcp.md',
-        'bdb-blender-mcp.md',
-        'bdb-davinci-mcp.md',
-        'bdb-grandma3-mcp.md',
-        'bdb-resolume-mcp.md',
-        'bdb-rhino-mcp.md',
-        'bdb-touchdesigner-mcp.md',
-        'bdb-unreal-mcp.md',
-        'bdb-vectorworks-mcp.md',
+        'bdb-adobe-suite-mcp',
+        'bdb-after-effects-mcp',
+        'bdb-blender-mcp',
+        'bdb-davinci-mcp',
+        'bdb-grandma3-mcp',
+        'bdb-resolume-mcp',
+        'bdb-rhino-mcp',
+        'bdb-touchdesigner-mcp',
+        'bdb-unreal-mcp',
+        'bdb-vectorworks-mcp',
         'bdbmediastorm'
     ] : [];
 }
@@ -2729,26 +2731,37 @@ function injectHarnessRules() {
     }
 }
 
-// Merge the BDB gate hooks into a Claude Code settings.json without clobbering
+// Merge the BDB hooks -- the two gates plus the memB ambient-memory hook --
+// into a Claude Code settings.json without clobbering
 // user-owned keys (v3.13 audit BLOCKER-3: the harness-dir copy used to
 // overwrite the file wholesale, silently dropping e.g. enabledPlugins). Only
 // BDB-owned hook entries -- identified by their script name inside `command` --
 // are replaced or added; every other key and every foreign hook entry survives
 // untouched. With projectLocal, `${HOME}` hook paths are rewritten to
 // `$CLAUDE_PROJECT_DIR` so a project harness is self-contained on every
-// collaborator's checkout. If the existing file is not valid JSON(C), nothing
+// collaborator's checkout -- the shipped template already writes the gates
+// with `$CLAUDE_PROJECT_DIR` directly, so today that rewrite is a safety net
+// for a future `${HOME}`-written gate rather than machinery in active use. If the existing file is not valid JSON(C), nothing
 // is overwritten: the original is backed up as .corrupt_<ts>.bak and the
 // merged result goes to a .bdb-new.json sidecar -- the same recovery pattern
 // the MCP config merge in installMcpsForTarget uses.
 function mergeBdbSettingsHooks(settingsPath, { projectLocal = false } = {}) {
-    const bdbHookScripts = ['go-gate.mjs', 'graph-gate.mjs'];
+    const bdbHookScripts = ['go-gate.mjs', 'graph-gate.mjs', 'memb-inject.mjs'];
+    // memb-inject reads the machine-global memB store under $HOME and is
+    // installed once per machine, so it stays $HOME-anchored even inside a
+    // project harness -- unlike the two gate hooks, which are per-checkout by
+    // design. Pointing it at $CLAUDE_PROJECT_DIR would make it fail on every
+    // prompt in any project the harness was never installed into.
+    const machineGlobalHooks = ['memb-inject.mjs'];
     const isBdbEntry = (entry) => {
         const cmds = (entry && Array.isArray(entry.hooks) ? entry.hooks : [])
             .map((h) => (h && typeof h.command === 'string' ? h.command : ''))
             .join(' ');
         return bdbHookScripts.some((name) => cmds.includes(name));
     };
-    const localize = (cmd) => (projectLocal ? cmd.split('${HOME}').join('$CLAUDE_PROJECT_DIR') : cmd);
+    const localize = (cmd) => (projectLocal && !machineGlobalHooks.some((n) => cmd.includes(n))
+        ? cmd.split('${HOME}').join('$CLAUDE_PROJECT_DIR')
+        : cmd);
     const cloneBdbEntries = (entries) =>
         JSON.parse(JSON.stringify(entries)).map((e) => ({
             ...e,
@@ -2831,11 +2844,11 @@ function installProjectHarness() {
         }
     }, '/startcycle dispatch degrades to graph.md as a manual guide.');
 
-    installStep('copy gate hooks into project', () => {
+    installStep('copy hooks into project', () => {
         const hooksSrc = path.join(srcDir, '.claude', 'hooks');
         if (fs.existsSync(hooksSrc)) {
             copyDirRecursiveSync(hooksSrc, path.join(projectClaudeDir, 'hooks'));
-            log.step(`Copied gate hooks to ${path.join(projectClaudeDir, 'hooks')}`);
+            log.step(`Copied hooks to ${path.join(projectClaudeDir, 'hooks')}`);
         }
     }, 'go-gate / graph-gate enforcement stays inactive in this project.');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.2.0",
+  "version": "4.4.0",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "bin": {
@@ -11,6 +11,11 @@
     "setup-saas": "bin/setup-saas.mjs",
     "aos-plan-canvas": "skills/global_config/plan-canvas/scripts/plan-canvas.js"
   },
+  "scripts": {
+    "validate": "node scripts/validate-skills.mjs",
+    "validate:strict": "node scripts/validate-skills.mjs --strict",
+    "test": "node scripts/validate-skills.mjs --selftest && node scripts/validate-skills.mjs"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -40,7 +45,21 @@
     "skills/",
     "mcps/",
     "scripts/",
-    "vendor/"
+    "vendor/",
+    "!mcps/**/*.png",
+    "!mcps/**/*.jpg",
+    "!mcps/**/*.jpeg",
+    "!mcps/**/*.gif",
+    "!mcps/**/*.webp",
+    "!mcps/**/docs/**",
+    "!mcps/**/tests/**",
+    "!mcps/**/test/**",
+    "!mcps/**/__tests__/**",
+    "mcps/tdmcp/tests/**",
+    "mcps/touchdesigner-mcp/tests/**",
+    "!mcps/tdmcp/training/**/data/**",
+    "!assets/**/*.mp4",
+    "!assets/**/*.mov"
   ],
   "keywords": [
     "codex-plugin",