@hybridlabor-api/aos 4.7.2 → 4.9.0

package/.agents/agents.md

@@ -93,7 +93,7 @@ next. This file defines *what each agent is*, not *what calls what*.
   - `godmode-media-creation`
   - `godmode-3d-creation`
   - `bdbmediastorm`
-  - `MCP_Manage`
+  - `mcp-manage`
   - `threejs-skills`
   - `spline-3d-integration`
 - **MCP Servers**:

package/.agents/nodes.json

@@ -94,7 +94,7 @@
         "godmode-media-creation",
         "godmode-3d-creation",
         "bdbmediastorm",
-        "MCP_Manage",
+        "mcp-manage",
         "threejs-skills",
         "spline-3d-integration"
       ],

package/.agents/vendor-manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "version": "1.0.0",
   "description": "Pinned upstream vendor repositories tracked for AOS skills and tools",
-  "updated_at": "2026-09-24T07:27:44Z",
+  "updated_at": "2026-09-25T19:27:14Z",
   "vendors": {
     "superdesign-skill": {
       "upstream": "https://github.com/superdesigndev/superdesign-skill",
@@ -51,6 +51,28 @@
       "pinned_commit": "e482e579415fde18357cafce70f177ae19fd7f03",
       "purpose": "Markdown-only fallback store for skills and auxiliary subagents",
       "target": "lib/ecc-store-index.json"
+    },
+    "superpowers": {
+      "upstream": "https://github.com/obra/superpowers",
+      "pinned_commit": "8ca22dba9a94f28898bbce59f2537ff4d87c747d",
+      "purpose": "Evidence-before-claims, code review dispatch, branch finishing, worktree isolation and parallel agent dispatch workflow skills",
+      "target_skill": "skills/global_config/{verification-before-completion,requesting-code-review,finishing-a-development-branch,using-git-worktrees,dispatching-parallel-agents}"
+    },
+    "cc-devops-skills": {
+      "upstream": "https://github.com/akin-ozer/cc-devops-skills",
+      "pinned_commit": "276af751e659315aaf56d3ad13d7c26f4e72e28a",
+      "purpose": "Generator/validator pairs for GitHub Actions, Dockerfile, bash scripts and Makefiles, with reference libraries",
+      "target_skill": "skills/global_config/{github-actions,dockerfile,bash-script,makefile}-{generator,validator}"
+    },
+    "claude-code-templates": {
+      "upstream": "https://github.com/davila7/claude-code-templates",
+      "pinned_commit": "691832ad9c2506d15a8b752826135f0afa83d197",
+      "purpose": "Conventional-commit enforcement and .env write protection, ported from Python to .mjs for both Claude Code and Antigravity",
+      "target": ".claude/hooks/{conventional-commits,env-file-protection}.mjs",
+      "source_commits": {
+        "conventional-commits.py": "92fdaa1f87b45cfc7b881f03ee69d2bad27b09d3",
+        "env-file-protection.json": "36fa6dbd5d8a45a62628b634aa48410f4d39682d"
+      }
     }
   }
 }

package/.claude/agents/godmode-media-eventtech.md

@@ -5,7 +5,7 @@ model: sonnet
 ---
 Creative-Tech & Show-Control Specialist. Governs 3D modeling, spatial design, TouchDesigner networks, Unreal Engine scenes, DaVinci Resolve color/edit, DMX/grandMA3 lighting, and Resolume media servers.
 
-**Primary skills:** godmode-eventtech, godmode-media-creation, godmode-3d-creation, bdbmediastorm, MCP_Manage, threejs-skills, spline-3d-integration
+**Primary skills:** godmode-eventtech, godmode-media-creation, godmode-3d-creation, bdbmediastorm, mcp-manage, threejs-skills, spline-3d-integration
 
 **MCP servers used:** bdb_td_minddesigner, bdb_unreal_mcp, bdb_davinci_mcp, bdb_grandma3_mcp, bdb_resolume_mcp, adobe_uxp_mcp, bdb_after_effects_mcp, bdb_rhino_mcp
 

package/.claude/hooks/conventional-commits.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// PreToolUse gate that enforces Conventional Commits on `git commit` across harnesses:
+// - Claude Code (.claude/hooks/conventional-commits.mjs)
+// - Antigravity / Gemini CLI (hooks.json PreToolUse)
+//
+// Why this exists: release-please (.github/workflows/release-please.yml) parses
+// commit subjects to compute the version bump and the changelog. It only reads
+// Conventional Commit prefixes, so an unprefixed subject is invisible to it —
+// exactly the prefix used for a user-facing addition decides a minor bump.
+//
+// Ported from davila7/claude-code-templates (MIT), which ships this as
+// conventional-commits.py. Ported to .mjs rather than vendored verbatim: every
+// other AOS hook is .mjs, node is already a hard install dependency, and
+// `python3` does not exist on a stock Windows install — where the AOS installer
+// does run — so a python hook would break every commit there.
+//
+// Deliberately fails OPEN, unlike go-gate. A regex that cannot read the message
+// must not block a legitimate commit; blocking a human's work is the worse
+// failure here, because the consequence (history AOS does not recognise) is
+// recoverable with a rebase, and a wedged commit flow is not.
+
+import { readFileSync } from "node:fs";
+
+const TYPES = ["feat", "fix", "docs", "style", "refactor", "perf", "test", "chore", "ci", "build", "revert"];
+
+const CONVENTIONAL = new RegExp(`^(${TYPES.join("|")})(\\(.+\\))?:\\s.+`);
+
+const COMMIT = /git\s+commit\b/;
+
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function respond(isAgy, allowed, reason = "", message = "") {
+  if (isAgy) {
+    if (allowed) {
+      console.log(JSON.stringify({ decision: "allow" }));
+    } else {
+      console.log(JSON.stringify({ decision: "deny", reason }));
+    }
+    process.exit(0);
+  } else {
+    if (allowed) {
+      process.exit(0);
+    } else {
+      process.stderr.write(`${reason}\n`);
+      process.exit(2);
+    }
+  }
+}
+
+// Returns the commit message, or null when it cannot be read. Null means
+// "cannot tell" and must be treated as allowed.
+function extractMessage(command) {
+  // -m "msg" / -m 'msg'
+  const inline = command.match(/git\s+commit[\s\S]*?-m\s+(?:"([^"]+)"|'([^']+)')/);
+  if (inline) return inline[1] ?? inline[2];
+
+  // -m "$(cat <<'EOF' ... EOF)"
+  const heredoc = command.match(/git\s+commit[\s\S]*?-m\s+"?\$\(cat\s+<<['"]?EOF['"]?\s*\n([\s\S]+?)\nEOF/);
+  if (heredoc) return heredoc[1].trim();
+
+  // Plain `git commit` (editor) or a message the hook cannot see: fail open.
+  return null;
+}
+
+function reasonFor(message) {
+  return [
+    "Blocked by conventional-commits hook: this commit subject is not in Conventional Commits format.",
+    "",
+    `Your message: ${message.slice(0, 120)}`,
+    "",
+    "Required: type(scope): description",
+    `Types: ${TYPES.join(", ")}`,
+    "",
+    "Good:  feat: add user authentication",
+    "Good:  fix(api): handle null responses",
+    "Bad:   Added new feature   (no type)",
+    "Bad:   feature: add login  (wrong type, use 'feat')",
+    "",
+    "AOS reserves feat: for user-facing additions -- it always bumps the minor",
+    "version, however small. Housekeeping belongs under chore: or fix:.",
+  ].join("\n");
+}
+
+function main() {
+  const rawInput = readStdin();
+  let input = {};
+  if (rawInput.trim()) {
+    try {
+      input = JSON.parse(rawInput);
+    } catch {
+      // Unparseable input: fail open, no stdout (isAgy unknown).
+      process.exit(0);
+    }
+  }
+
+  const isAgy = !!(input?.toolCall || input?.conversationId || input?.artifactDirectoryPath || input?.workspacePaths);
+
+  const command =
+    input?.toolCall?.args?.CommandLine ||
+    input?.toolCall?.args?.command ||
+    input?.tool_input?.command ||
+    input?.command ||
+    "";
+
+  if (typeof command !== "string" || !COMMIT.test(command)) {
+    respond(isAgy, true);
+    return;
+  }
+
+  const message = extractMessage(command);
+  if (message === null || CONVENTIONAL.test(message)) {
+    respond(isAgy, true);
+    return;
+  }
+
+  respond(isAgy, false, reasonFor(message), message);
+}
+
+main();

package/.claude/hooks/env-file-protection.mjs

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+// PreToolUse gate that refuses writes and edits to .env files, across harnesses:
+// - Claude Code (.claude/hooks/env-file-protection.mjs)
+// - Antigravity / Gemini CLI (hooks.json PreToolUse)
+//
+// Why: a .env is a live secret store. An agent that rewrites one to "add a
+// variable" routinely reorders it, drops a line, or writes an empty value
+// straight over a real credential — and the file is usually gitignored, so
+// nothing catches it until something fails to authenticate in production.
+//
+// Upstream (davila7/claude-code-templates, MIT) does this as an inline `echo`
+// guarded by a matcher `if` field. That is Claude-Code-only: Antigravity and
+// the Gemini CLI ignore `if`, so the same entry would fire on every single
+// Write and block all file creation. Implemented as a script with the path
+// check in code, so one implementation behaves correctly on both.
+//
+// Deliberately fails OPEN. A hook that cannot read its input must not wedge
+// every write in the session; missing a protection is recoverable, freezing
+// the agent is not.
+
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+
+// Templates are committed on purpose and hold no live secret. Blocking them
+// would contradict this hook's own advice below ("write it to .env.example").
+const TEMPLATE_FILE = /^\.env\.(example|sample|template|dist)$/i;
+const ENV_FILE = /^\.env(\..*)?$/i;
+
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function respond(isAgy, allowed, reason = "") {
+  if (isAgy) {
+    console.log(JSON.stringify(allowed ? { decision: "allow" } : { decision: "deny", reason }));
+    process.exit(0);
+  } else {
+    if (allowed) {
+      process.exit(0);
+    } else {
+      process.stderr.write(`${reason}\n`);
+      process.exit(2);
+    }
+  }
+}
+
+function reasonFor(filePath) {
+  return [
+    "Blocked by env-file-protection hook: writes to .env files are protected.",
+    "",
+    `Target: ${filePath}`,
+    "",
+    "A .env holds live credentials and is almost always gitignored, so an",
+    "overwrite fails silently and surfaces later as an auth error. To change",
+    "one anyway, either:",
+    "",
+    `  1. Edit it yourself outside the agent session, or`,
+    "  2. Ask for the new value to be written to .env.example (safe to commit)",
+    "     and set the real value from your own shell.",
+    "",
+    "If the repo keeps a checked-in env template with a different name, this",
+    "hook does not apply to it -- only to .env and .env.*.",
+  ].join("\n");
+}
+
+function main() {
+  const rawInput = readStdin();
+  let input = {};
+  if (rawInput.trim()) {
+    try {
+      input = JSON.parse(rawInput);
+    } catch {
+      process.exit(0);
+    }
+  }
+
+  const isAgy = !!(input?.toolCall || input?.conversationId || input?.artifactDirectoryPath || input?.workspacePaths);
+
+  const filePath =
+    input?.toolCall?.args?.filePath ||
+    input?.toolCall?.args?.file_path ||
+    input?.tool_input?.file_path ||
+    input?.file_path ||
+    "";
+
+  if (typeof filePath !== "string" || !filePath.trim()) {
+    respond(isAgy, true);
+    return;
+  }
+
+  // basename(), so a path like /srv/app/.env matches but /srv/app/env-notes.md does not.
+  const name = basename(filePath);
+  if (!ENV_FILE.test(name) || TEMPLATE_FILE.test(name)) {
+    respond(isAgy, true);
+    return;
+  }
+
+  respond(isAgy, false, reasonFor(filePath));
+}
+
+main();

package/.claude/hooks/go-gate.mjs

@@ -1,51 +1,32 @@
 #!/usr/bin/env node
-// PreToolUse gate for outward-facing / hard-to-reverse Bash commands.
+// PreToolUse gate for outward-facing / hard-to-reverse commands across harnesses:
+// - Antigravity / Gemini CLI (hooks.json PreToolUse)
+// - Claude Code (.claude/hooks/go-gate.mjs)
 //
-// Scope (deliberately narrow — see audit-agents.md F-01/F-03): git push, npm
-// publish, npm version, and recursive rm. Plain Write/Edit/git commit are NOT
-// gated here — Claude Code checkpoints those and they're locally reversible;
-// gating them too would just re-create the "over-scoped rule nobody reads"
-// problem this hook exists to fix.
+// Scope:
+// 1. git push
+// 2. npm publish
+// 3. npm version
+// 4. gh pr merge
+// 5. gh release create
+// 6. git reset --hard
+// 7. git clean -f (force clean untracked files)
+// 8. rm -r / rm -rf (recursive deletions)
 //
-// Gate validity: open only if the LAST human-typed user message in the
-// transcript is the literal word "GO" (case-insensitive, trimmed). Any other
-// message closes it again — matches "no silent retries" / "a fresh GO per
-// action" from CLAUDE.md.
-//
-// Transcript format (v3.13 audit BLOCKER-1): Claude Code transcript JSONL
-// entries carry the entry kind in a top-level `type` field ("user"), with the
-// payload nested under `message.content` — a top-level `role` exists on zero
-// lines of a real transcript, so matching on it blocked the gate forever.
-// Two traps the parser below handles explicitly:
-//   1. `message.content` is EITHER a plain string OR an array of typed blocks
-//      — always run it through extractText(), never assume one shape.
-//   2. Tool results are ALSO `type: "user"` entries (their blocks are
-//      `tool_result`), and subagent turns are user entries flagged
-//      `isSidechain: true`. Neither is the human: entries with no text block
-//      are skipped, and sidechain entries are skipped outright — so the scan
-//      lands on the last message a human actually typed.
-//
-// Fails closed: if the transcript can't be read or parsed, block rather than
-// guess.
-//
-// Why a PreToolUse hook and not a CLAUDE.md rule: per
-// code.claude.com/docs/en/hooks-guide, "PreToolUse hooks fire before any
-// permission-mode check, in every permission mode, including dontAsk. A hook
-// that returns permissionDecision: 'deny' blocks the tool even in
-// bypassPermissions mode or with --dangerously-skip-permissions." Exiting 2
-// blocks unconditionally the same way. So this gate cannot be sidestepped by
-// switching permission modes -- which prose in CLAUDE.md never could
-// guarantee. (Hooks can tighten restrictions but not loosen them: a hook
-// returning "allow" still can't override a deny rule from settings.)
+// Gate validity: open ONLY if the LAST human-typed user message in the transcript
+// is the literal word "GO" (case-insensitive, trimmed). Any other message closes it.
 
 import { readFileSync } from "node:fs";
 
 const GUARDED_PATTERNS = [
-  /^\s*git\s+push\b/i,
-  /^\s*npm\s+publish\b/i,
-  /^\s*npm\s+version\b/i,
-  // recursive rm in any flag order/style: -r, -R, -rf, -fr, --recursive
-  /^\s*rm\s+(-\w*[rR]\w*|--recursive)\b/i,
+  /(?:^|[;&|]\s*)git\s+push\b/i,
+  /(?:^|[;&|]\s*)npm\s+publish\b/i,
+  /(?:^|[;&|]\s*)npm\s+version\b/i,
+  /(?:^|[;&|]\s*)gh\s+pr\s+merge\b/i,
+  /(?:^|[;&|]\s*)gh\s+release\s+create\b/i,
+  /(?:^|[;&|]\s*)git\s+reset\s+--hard\b/i,
+  /(?:^|[;&|]\s*)git\s+clean\s+-[a-zA-Z]*f\b/i,
+  /(?:^|[;&|]\s*)rm\s+(?:-\w*[rR]\w*|--recursive)\b/i,
 ];
 
 function readStdin() {
@@ -56,16 +37,31 @@ function readStdin() {
   }
 }
 
-function block(reason) {
-  process.stderr.write(`Blocked by go-gate hook: ${reason}\n`);
-  process.exit(2);
-}
-
-function allow() {
-  process.exit(0);
+function respond(isAgy, allowed, reason = "", command = "") {
+  if (isAgy) {
+    if (allowed) {
+      console.log(JSON.stringify({ decision: "allow" }));
+    } else {
+      console.log(JSON.stringify({
+        decision: "deny",
+        reason: `[MECHANICAL GO-GATE BLOCKED] Der Befehl "${command.slice(0, 100)}" wurde blockiert. Er erfordert ein frisches, isoliertes "GO" als letzte Benutzereingabe. ${reason}`
+      }));
+    }
+    process.exit(0);
+  } else {
+    // Claude Code harness
+    if (allowed) {
+      process.exit(0);
+    } else {
+      process.stderr.write(
+        `Blocked by go-gate hook: command "${command.slice(0, 80)}" requires a fresh, literal "GO" as your last message. ${reason}\n`
+      );
+      process.exit(2);
+    }
+  }
 }
 
-function extractText(content) {
+function extractClaudeText(content) {
   if (typeof content === "string") return content;
   if (Array.isArray(content)) {
     return content
@@ -76,13 +72,15 @@ function extractText(content) {
   return "";
 }
 
-function isHumanUserEntry(entry) {
-  if (!entry || typeof entry !== "object") return false;
-  // `type` is the authoritative field in real transcripts; `role` kept as a
-  // defensive fallback in case a future/alternate export flattens it.
-  if (entry.type !== "user" && entry.role !== "user") return false;
-  if (entry.isSidechain === true) return false; // subagent turn, not the human
-  return true;
+function extractAgyText(rawContent) {
+  if (!rawContent || typeof rawContent !== "string") return "";
+  // Strip metadata tags if present
+  let text = rawContent.replace(/<ADDITIONAL_METADATA>[\s\S]*?<\/ADDITIONAL_METADATA>/gi, "");
+  const match = text.match(/<USER_REQUEST>([\s\S]*?)<\/USER_REQUEST>/i);
+  if (match) {
+    text = match[1];
+  }
+  return text.trim();
 }
 
 function lastUserMessageIsGo(transcriptPath) {
@@ -99,54 +97,76 @@ function lastUserMessageIsGo(transcriptPath) {
     try {
       entry = JSON.parse(lines[i]);
     } catch {
-      continue; // tolerate partial/trailing lines from an in-progress write
+      continue; // tolerate partial/trailing lines
+    }
+
+    // 1. Antigravity transcript entry format
+    if (entry.type === "USER_INPUT" || entry.source === "USER_EXPLICIT") {
+      const text = extractAgyText(entry.content);
+      if (!text) continue;
+      const isGo = /^GO$/i.test(text.trim());
+      return { ok: isGo, reason: `last user message was: ${JSON.stringify(text)}` };
+    }
+
+    // 2. Claude Code transcript entry format
+    if (entry.type === "user" || entry.role === "user") {
+      if (entry.isSidechain === true) continue;
+      const content = entry.message?.content ?? entry.content;
+      const text = extractClaudeText(content).trim();
+      if (!text) continue;
+      const isGo = /^GO$/i.test(text);
+      return { ok: isGo, reason: `last user message was: ${JSON.stringify(text)}` };
     }
-    if (!isHumanUserEntry(entry)) continue;
-    // Tool results are user-role entries with no text block; extractText()
-    // lifts only text blocks, so those yield "" and are skipped -- the scan
-    // lands on the last entry a human actually typed.
-    const content = entry.message?.content ?? entry.content;
-    const text = extractText(content).trim();
-    if (!text) continue;
-    return { ok: text.toUpperCase() === "GO", reason: `last user message was: ${JSON.stringify(text)}` };
   }
+
   return { ok: false, reason: "no user message found in transcript" };
 }
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readStdin());
-  } catch (e) {
-    block(`could not parse hook input (${e.message})`);
-    return;
+  const rawInput = readStdin();
+  let input = {};
+  if (rawInput.trim()) {
+    try {
+      input = JSON.parse(rawInput);
+    } catch (e) {
+      // If we cannot parse hook input, fail closed
+      respond(true, false, `could not parse hook input: ${e.message}`, "unknown");
+      return;
+    }
   }
 
-  const command = input?.tool_input?.command;
-  if (typeof command !== "string") {
-    allow(); // not a Bash call with a command string; nothing for this hook to check
+  // Detect harness
+  const isAgy = !!(input?.toolCall || input?.conversationId || input?.artifactDirectoryPath || input?.workspacePaths);
+
+  const command =
+    input?.toolCall?.args?.CommandLine ||
+    input?.toolCall?.args?.command ||
+    input?.tool_input?.command ||
+    input?.command ||
+    "";
+
+  if (typeof command !== "string" || !command.trim()) {
+    respond(isAgy, true);
     return;
   }
 
   const isGuarded = GUARDED_PATTERNS.some((re) => re.test(command));
   if (!isGuarded) {
-    allow();
+    respond(isAgy, true);
     return;
   }
 
-  const transcriptPath = input?.transcript_path;
+  const transcriptPath = input?.transcriptPath || input?.transcript_path;
   if (!transcriptPath) {
-    block("no transcript_path in hook input — cannot verify GO");
+    respond(isAgy, false, "no transcriptPath in hook input — cannot verify GO", command);
     return;
   }
 
   const result = lastUserMessageIsGo(transcriptPath);
   if (result.ok) {
-    allow();
+    respond(isAgy, true, "", command);
   } else {
-    block(
-      `command "${command.slice(0, 80)}" requires a fresh, literal "GO" as your last message. ${result.reason}.`
-    );
+    respond(isAgy, false, result.reason, command);
   }
 }
 

package/.claude/settings.json

@@ -7,6 +7,19 @@
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/go-gate.mjs\""
+          },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/conventional-commits.mjs\""
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/env-file-protection.mjs\""
           }
         ]
       },

package/.opencode/agents/godmode-media-eventtech.md

@@ -5,7 +5,7 @@ model: opencode/muse-spark-1.3-contributor-free
 ---
 Creative-Tech & Show-Control Specialist. Governs 3D modeling, spatial design, TouchDesigner networks, Unreal Engine scenes, DaVinci Resolve color/edit, DMX/grandMA3 lighting, and Resolume media servers.
 
-**Primary skills:** godmode-eventtech, godmode-media-creation, godmode-3d-creation, bdbmediastorm, MCP_Manage, threejs-skills, spline-3d-integration
+**Primary skills:** godmode-eventtech, godmode-media-creation, godmode-3d-creation, bdbmediastorm, mcp-manage, threejs-skills, spline-3d-integration
 
 **MCP servers used:** bdb_td_minddesigner, bdb_unreal_mcp, bdb_davinci_mcp, bdb_grandma3_mcp, bdb_resolume_mcp, adobe_uxp_mcp, bdb_after_effects_mcp, bdb_rhino_mcp
 

package/.opencode/plugins/bdb-aos.js

@@ -19,10 +19,14 @@ import os from 'node:os';
 import path from 'node:path';
 
 const GUARDED_PATTERNS = [
-  /^\s*git\s+push\b/i,
-  /^\s*npm\s+publish\b/i,
-  /^\s*npm\s+version\b/i,
-  /^\s*rm\s+(-\w*[rR]\w*|--recursive)\b/i,
+  /(?:^|[;&|]\s*)git\s+push\b/i,
+  /(?:^|[;&|]\s*)npm\s+publish\b/i,
+  /(?:^|[;&|]\s*)npm\s+version\b/i,
+  /(?:^|[;&|]\s*)gh\s+pr\s+merge\b/i,
+  /(?:^|[;&|]\s*)gh\s+release\s+create\b/i,
+  /(?:^|[;&|]\s*)git\s+reset\s+--hard\b/i,
+  /(?:^|[;&|]\s*)git\s+clean\s+-[a-zA-Z]*f\b/i,
+  /(?:^|[;&|]\s*)rm\s+(?:-\w*[rR]\w*|--recursive)\b/i,
 ];
 
 let lastHumanPrompt = '';
@@ -176,6 +180,29 @@ export default async function bdbAosPlugin(input) {
           });
         }
       } catch {}
+
+      // Recognize and wire /startcycle-graph workflow
+      const graphMatch = fullText.match(/^\/startcycle-graph(?:\s+(.*))?$/is);
+      if (graphMatch) {
+        const goal = (graphMatch[1] || '').trim();
+        const graphInstructions = [
+          `[AOS Autonomous Graph Workflow Engine - Active]`,
+          `Goal: "${goal || 'Execute planned architecture cycle'}"`,
+          `State Schema: .agents/state.schema.json`,
+          `Persisted State: production_artifacts/state.json`,
+          `Available Nodes: .agents/nodes.json (Architect -> TechLead -> Build [UI_UX, Engineering, Media] -> Reviewer -> Shipping)`,
+          `Rule: Nodes never call each other. Dispatch each node turn in sequence, evaluate state.json, and enforce Reviewer & Shipping gates before completion.`
+        ].join('\n');
+
+        msgOutput.parts.unshift({
+          id: `startcycle-${Date.now()}`,
+          sessionID: msgInput.sessionID,
+          messageID: msgInput.messageID || '',
+          type: 'text',
+          text: graphInstructions,
+          synthetic: true,
+        });
+      }
     },
 
     'tool.execute.before': async (toolInput, toolOutput) => {

package/README.de.md

@@ -164,7 +164,7 @@ Nachfolgend finden Sie die vollständige Übersicht aller in diesem Paket enthal
 #### 🎨 Frontend & UI/UX
 | Skill-Name | Beschreibung |
 |------------|-------------|
-| `MCP_Manage` | Manages the BDB specialized MCP servers including Unreal Engine, Rhino 7/8, DaVinci Resolve, grandMA3, Resolume, GitHub, Chrome DevTools, and TouchDesigner. |
+| `mcp-manage` | Manages the BDB specialized MCP servers including Unreal Engine, Rhino 7/8, DaVinci Resolve, grandMA3, Resolume, GitHub, Chrome DevTools, and TouchDesigner. |
 | `api-design-principles` | Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers and stand the test of time. |
 | `api-patterns` | API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination. |
 | `database-design` | Database design principles and decision-making. Schema design, indexing strategy, ORM selection, serverless databases. |

package/README.md

@@ -377,7 +377,7 @@ While heavily optimized for the creative tech industry, these skills are deeply
 
 | Skill | Description |
 |-------|-------------|
-| `MCP_Manage` | Manages the BDB specialized MCP servers including Unreal Engine, Rhino 7/8, DaVinci Resolve, grandMA3, Resolume, GitHub, Chrome DevTools, and TouchDesigner. |
+| `mcp-manage` | Manages the BDB specialized MCP servers including Unreal Engine, Rhino 7/8, DaVinci Resolve, grandMA3, Resolume, GitHub, Chrome DevTools, and TouchDesigner. |
 | `n8n-code-javascript` | Write JavaScript code in n8n Code nodes. `$input`/`$json`/`$node` syntax, HTTP requests, DateTime handling. |
 | `n8n-code-python` | Write Python code in n8n Code nodes. `_input`/`_json`/`_node` syntax and standard library. |
 | `n8n-expression-syntax` | Validate n8n expression syntax and fix common errors. `{{}}` syntax, `$json`/`$node` variables. |

package/README.pt.md

@@ -167,7 +167,7 @@ Abaixo está a visão geral completa de todas as skills curadas de agentes inclu
 #### 🎨 Frontend & UI/UX
 | Nome da Skill | Descrição |
 |------------|-------------|
-| `MCP_Manage` | Gerencia os servidores MCP especializados da BDB incluindo Unreal Engine, Rhino 7/8, DaVinci Resolve, grandMA3, Resolume, GitHub, Chrome DevTools e TouchDesigner. |
+| `mcp-manage` | Gerencia os servidores MCP especializados da BDB incluindo Unreal Engine, Rhino 7/8, DaVinci Resolve, grandMA3, Resolume, GitHub, Chrome DevTools e TouchDesigner. |
 | `api-design-principles` | Domine princípios de design de API REST e GraphQL para construir APIs intuitivas, escaláveis e de fácil manutenção que encantam os desenvolvedores e resistem ao teste do tempo. |
 | `api-patterns` | Princípios de design de API e tomada de decisões. Seleção entre REST vs GraphQL vs tRPC, formatos de resposta, versionamento, paginação. |
 | `database-design` | Princípios de design de banco de dados e tomada de decisões. Design de esquema, estratégia de indexação, seleção de ORM, bancos de dados serverless. |