@jaybeeuu/agent-cortex 1.20.0 → 1.38.1

package/.agents/skills/style-versioning/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: style-versioning
+description: Automated release workflow using changesets. Use when completing work that needs a release, asking "how do I version this?", or when any change needs to be shipped to npm.
+---
+
+# style-versioning
+
+This repo uses **changesets** for fully automated versioning and publishing. No manual version bumps, no manual releases.
+
+## When to use
+
+Trigger this skill when:
+- Completing work that needs a release
+- Asking "how do I version this change?"
+- Creating a PR that changes shipped behaviour
+
+## Creating a changeset (agent instructions)
+
+**Do NOT run `pnpm changeset`** — it is interactive and will waste tokens on prompts and ANSI codes. Instead, write the changeset file directly.
+
+### File format
+
+A changeset is a markdown file in `.changeset/` with YAML frontmatter:
+
+```markdown
+---
+"@jaybeeuu/agent-cortex": <bump>
+---
+
+<Short description of the change>
+```
+
+Where `<bump>` is one of: `patch`, `minor`, or `major`.
+
+### How to create one
+
+1. Choose a descriptive kebab-case filename (e.g., `fix-status-bug.md`, `add-webhook-skill.md`)
+2. Choose the bump type:
+   - `patch` — bug fix, clarification, no behaviour change
+   - `minor` — new skill, agent, feature, or meaningful behaviour change
+   - `major` — breaking change (removed skill, renamed agent, incompatible workflow)
+3. Write the file directly using the `write` tool:
+
+```
+write(".changeset/fix-status-bug.md", `---
+"@jaybeeuu/agent-cortex": patch
+---
+
+Fix status bead showing wrong priority after update
+`)
+```
+
+4. Commit the changeset file along with the code changes
+
+### Rules
+
+- The frontmatter package name must match exactly: `"@jaybeeuu/agent-cortex"`
+- The description should be one or two sentences, user-facing (it goes into CHANGELOG.md)
+- One changeset per PR. If a PR has multiple unrelated changes, use multiple changeset files.
+- The filename doesn't matter to changesets — only the frontmatter and description do.
+
+## After merge to main
+
+The `release` job in `.github/workflows/ci.yml` handles everything automatically:
+
+1. **Detects new changesets** on main
+2. **Creates a "Version Packages" PR** — the `version` step runs `pnpm version-packages`, which bumps `package.json`, syncs `plugin.json` (via `scripts/sync-plugin-version.sh`), updates `CHANGELOG.md`, and regenerates the committed generated output (`pnpm build:claude`, `pnpm build:copilot`) so the drift gates never fail on a version bump
+3. **When "Version Packages" is merged**:
+   - Creates a git tag
+   - Publishes to npm — `pnpm publish-package` packs with `pnpm pack` and publishes with `npm publish --provenance --access public`. Authenticates via npm Trusted Publishing (OIDC): the release job's `id-token` permission lets npm exchange a GitHub OIDC token for a short-lived npm token at publish time, so no `NPM_TOKEN` secret or `.npmrc` auth config is required — only the one-time npm-side Trusted Publishing setup on npmjs.com (package → Access → Trusted Publishing → GitHub repo `jaybeeuu/agent-cortex` + workflow `.github/workflows/ci.yml`)
+   - Creates a GitHub release automatically
+
+`changesets/action` execs the `version`/`publish` inputs without a shell, so each
+must be a single unquoted command token — keep release logic in pnpm scripts
+(`version-packages`, `publish-package`), never inline shell strings.
+
+### Version lockstep
+
+All version numbers stay in lockstep automatically:
+
+1. `package.json` → bumped by changesets
+2. `plugin.json` → synced by `scripts/sync-plugin-version.sh`
+3. `CHANGELOG.md` → generated by changesets
+
+**Never bump versions manually.** Always create a changeset file.
+
+## Common mistakes
+
+- **Running `pnpm changeset`**: Interactive, wastes tokens. Write the file directly.
+- **Bumping versions manually**: Don't touch `"version"` in `package.json` or `plugin.json`. Create a changeset.
+- **Skipping the changeset**: A PR without a changeset won't trigger a release. The changesets bot will remind you.
+- **Wrong bump type**: `patch` for fixes, `minor` for additions, `major` for breakage. When in doubt, ask the user.
+- **Wrong package name in frontmatter**: Must be `"@jaybeeuu/agent-cortex"` exactly.
+
+## What changed from the old workflow
+
+| Before (manual) | After (changesets) |
+|---|---|
+| Agent bumps versions locally | Agent writes a changeset file |
+| Manual GitHub release creation | Automated by the `release` job in `ci.yml` |
+| `publish.yml` triggered by release | `ci.yml` release job on push to main |
+| Version sync was manual | `sync-plugin-version.sh` runs automatically |

package/.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets).
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md).

package/.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

package/.github/workflows/ci.yml

@@ -7,29 +7,250 @@ on:
   pull_request:
 
 jobs:
-  checks:
+  setup:
+    name: Setup
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: 10
           run_install: false
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+
+  changeset-check:
+    name: Changeset check
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check for changeset
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          # Paths that require a changeset when modified
+          VERSIONED_PATHS='extensions/|skills/|agents/|package\.json|plugin\.json'
+
+          changed=$(git diff --name-only "origin/${BASE_REF}...HEAD")
+          echo "Changed files:"
+          echo "$changed"
+
+          versioned=$(echo "$changed" | grep -E "$VERSIONED_PATHS" || true)
+          if [ -z "$versioned" ]; then
+            echo "No versioned paths changed — skipping changeset check."
+            exit 0
+          fi
+
+          changesets=$(echo "$changed" | grep -E '^\.changeset/.*\.md$' | grep -v 'README.md' || true)
+          if [ -z "$changesets" ]; then
+            echo ""
+            echo "::error::This PR modifies versioned paths but does not include a changeset."
+            echo "Run 'pnpm changeset' to add one. See: style-versioning skill."
+            echo ""
+            echo "Versioned paths changed:"
+            echo "$versioned"
+            exit 1
+          fi
+
+          echo "Changeset found: $changesets"
+
+  lint:
+    name: Lint
+    needs: setup
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: Lint
         run: pnpm lint
+
+  test:
+    name: Test
+    needs: setup
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: Test
         run: pnpm test
-      - name: Build
-        run: pnpm build
+
+  claude-plugin-check:
+    name: Claude plugin check
+    needs: setup
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # `pnpm build:claude` is an alias of `agent-cortex install claude` (both run
+      # bin/installers/claude.mjs), so this drift check proves the committed subtree
+      # equals the installer's output — stale output or hand-edits to generated
+      # files fail the build. The subtree stays committed because the marketplace
+      # install flow reads it straight from the working tree (fresh clone installs
+      # as-is).
       - name: Check generated Claude plugin is up to date
         run: |
           pnpm build:claude
-          git diff --exit-code claude/agents/ claude/skills/
+          git diff --exit-code claude/agents/ claude/skills/ claude/.claude-plugin/plugin.json claude/hooks.json claude/hooks/
+
+      - name: Check generated Copilot agent files are up to date
+        run: |
+          pnpm build:copilot
+          git diff --exit-code -- 'agents/*.agent.md'
+
+  release:
+    name: Release
+    needs: [lint, test, claude-plugin-check]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      # npm Trusted Publishing (OIDC): npm exchanges this id-token for a
+      # short-lived npm token at publish time — no token config or secret.
+      id-token: write
+    concurrency: ${{ github.workflow }}-${{ github.ref }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Create Release Pull Request or Publish
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          # changesets/action execs these inputs via @actions/exec with NO shell:
+          # the string is split by argStringToArray on whitespace (single quotes
+          # survive literally), so each must be a single unquoted command token
+          # that runs a pnpm script. version-packages bumps versions, syncs
+          # plugin.json, THEN regenerates the committed generated output
+          # (build:claude writes claude/.claude-plugin/plugin.json with the NEW
+          # version, build:copilot re-derives agents/*.agent.md) before the action
+          # commits, so the Version Packages PR always passes the drift gates.
+          version: pnpm version-packages
+          publish: pnpm publish-package
+          commit: "chore: version packages"
+          title: "chore: version packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Publish authenticates via npm Trusted Publishing (OIDC token
+          # exchange at publish time) — no NPM_TOKEN secret, no token config.
+          # Requires the one-time npm-side setup: npmjs.com → @jaybeeuu/
+          # agent-cortex → Access → Trusted Publishing, tied to GitHub repo
+          # jaybeeuu/agent-cortex + workflow .github/workflows/ci.yml.

package/AGENTS.md

@@ -4,9 +4,10 @@ Instructions for agents working on this repository.
 
 ## What This Repo Is
 
-A personal Copilot CLI plugin containing custom agents and skills, plus PI extensions for
-enhancing the coding agent runtime. Changes here affect the behaviour of every agent, skill,
-and PI extension available in the author's coding sessions.
+A personal Copilot CLI plugin containing custom agents and skills, shipped to Copilot, pi,
+and Claude Code, plus PI extensions and Claude hooks for enhancing the coding agent
+runtime. Changes here affect the behaviour of every agent, skill, and PI extension
+available in the author's coding sessions.
 
 ## Structure
 
@@ -14,8 +15,12 @@ and PI extension available in the author's coding sessions.
 agent-cortex/
 ├── package.json           # PI package manifest (pi: { extensions, skills })
 ├── plugin.json            # GitHub Copilot plugin manifest — agents, skills, MCP servers
-├── agents/                # Custom agents (*.agent.md)
-│   └── ralph.agent.md
+├── agents/                # Custom agents — canonical composable <name>/ dirs
+│   ├── *.agent.md         #   generated from <name>/ by scripts/build-copilot-agents.mjs
+│   ├── ralph/             #   composable format — see agents/README.md
+│   ├── plan/              #   "
+│   ├── ralph-plan/        #   "
+│   └── strategy/          #   "
 ├── skills/               # Grouped by domain, discovered recursively
 │   ├── planning/         # Scope, spec, decompose
 │   ├── engineering/      # The coding loop
@@ -27,32 +32,20 @@ agent-cortex/
 │   └── skill-stats/
 │       ├── README.md      # Installation & usage
 │       └── index.ts       # Extension entrypoint
+├── hooks/                # Canonical Claude Code hooks (hooks.json + scripts — see docs/claude-hooks.md)
+│   └── claude/           #   generated into claude/hooks.json + claude/hooks/ by bin/installers/claude.mjs
 └── package.json          # PI package manifest (pi: { extensions, skills })
 ```
 
 ## Versioning
 
-**Always bump `plugin.json` version** when making any change to agents or skills. Follow
-semantic versioning:
-
-| Change type | Bump |
-|---|---|
-| New skill or agent added | `minor` |
-| Existing skill or agent meaningfully changed (new behaviour, new steps, restructured workflow) | `minor` |
-| Bug fix or clarification with no behaviour change | `patch` |
-| Breaking change (removed skill, renamed agent, incompatible workflow change) | `major` |
-
-The version bump must be included in the same commit as the change — do not leave it for a
-follow-up commit.
+Use `pnpm changeset` for all version bumps. Never edit versions manually.
+`package.json`, `plugin.json`, and `CHANGELOG.md` stay in lockstep automatically.
+See the `style-versioning` skill for the full workflow.
 
 ## Changelog
 
-- Keep a root `CHANGELOG.md` for repository changes.
-- When making any repo change (agents, skills, docs, scripts, or workflow rules), update
-  `CHANGELOG.md` in the same commit.
-- Write entries under a version header that matches the bumped `plugin.json` version
-  (e.g. `## 0.40.0`). Add a new version section on every change.
-- Keep entries user-facing and outcome-focused (what changed and why it matters).
+Generated automatically by changesets. Do not edit `CHANGELOG.md` manually.
 
 ## Skill Conventions
 
@@ -66,7 +59,17 @@ follow-up commit.
 
 ## Agent Conventions
 
-- Agent files are named `<name>.agent.md` and live in `agents/`.
+- Agents live in composable `<name>/` directories under `agents/`: a shared `agent.md` body plus
+  per-harness subdirectories `pi/`, `copilot/`, `claude/` (frontmatter.json and optional section
+  files) per the spec in `agents/README.md`. `ralph`, `plan`, `ralph-plan`, and `strategy` all use
+  the composable layout. The flat `agents/*.agent.md` files are **generated output** — composed
+  from the canonical directories by the shared `bin/installers/copilot.mjs` code path behind both
+  `agent-cortex install copilot` and `scripts/build-copilot-agents.mjs` (thin wrapper), and
+  committed for Copilot CLI (plugin.json `agents: "agents/"` scans for `*.agent.md`); never edit
+  them by hand. The `claude/` subtree is generated by the install-time generator
+  `bin/installers/claude.mjs` (`pnpm build:claude` aliases `agent-cortex install claude`; `ralph`
+  is authored natively in `agents-native/` and copied verbatim; the other agents compose from their
+  `claude/` harness dirs).
 - Keep orchestration logic in the agent file; extract shared per-task workflow into a skill
   so it can be reused (e.g. ralph delegates per-task stage execution to `run-pipeline-stage`).
 
@@ -79,6 +82,8 @@ follow-up commit.
   commands — they should not add token overhead.
 - Extensions that persist data should write to `~/.pi/agent-cortex/` (global, cross-project)
   and tag records with the project path for per-project slicing.
+- PI extensions with Claude Code equivalents are ported to `hooks/claude/`; the port/reject
+  audit with rationale lives in `docs/claude-hooks.md`.
 
 ## User preferences
 

package/CHANGELOG.md

@@ -1,7 +1,121 @@
 # Changelog
 
+## 1.38.1
+
+### Patch Changes
+
+- 5def727: Fix generate-progress parser for current bd list format
+- 735f083: Fix Release CI npm publish (ENEEDAUTH): the release job now publishes via npm Trusted Publishing (OIDC) — no `NPM_TOKEN` secret or `.npmrc` auth config. The `release` job's `id-token: write` permission is the only workflow-side requirement; npm exchanges the GitHub OIDC token for a short-lived npm token at publish time.
+
+  **One-time npm-side setup required** (no GitHub secret): on npmjs.com, open the package `@jaybeeuu/agent-cortex` → Access → Trusted Publishing → Add new publisher → GitHub, select the `jaybeeuu/agent-cortex` repository and the `.github/workflows/ci.yml` workflow. Publishing then needs no token configuration.
+
+## 1.38.0
+
+### Minor Changes
+
+- fbc6fa5: Add the Copilot CLI harness installer (`agent-cortex install copilot`), sharing the generator with `pnpm build:copilot`. It regenerates the flat `agents/*.agent.md` files the Copilot plugin loads (plugin.json `agents: "agents/"`), with the same `--dry-run` / `--output` contract as the claude and pi installers.
+- 42d3a33: Add central token-map.json mapping tool names, paths, and agent naming across the copilot, claude, and pi harnesses, with the token substitution contract for the install-time generation system. Use {{TOOL:...}} / {{PATH:...}} tokens in canonical sources; installers substitute per-harness names from the map.
+- 3a7e896: Add using-agent-skills meta-skill with 8 core operating behaviors and skill routing tree. Routes incoming work to the right skill, enforces scope discipline, and flags persistent failures to the user instead of working around them.
+- 4f5b134: Add a `wait_for_agents` tool to the subagent extension: it blocks until at least one background sub-agent (spawned with `task`) completes and returns its result, with `read_agent` kept as a fallback. Ralph's PI completion detection now waits on `wait_for_agents` instead of a `sleep 120` poll loop.
+- e1180d5: Update the agent-modes extension to discover agents from the composable directory format (`agents/<name>/` + per-harness `pi/frontmatter.json`). The PI system prompt is composed from `agent.md`, resolving `{{SECTION:...}}` includes from the agent's `pi/` directory and substituting `{{TOOL:...}}` / `{{PATH:...}}` tokens via token-map.json, so tool restrictions now translate to real PI tool names (e.g. `view` → `read`, `web_fetch` → `fetch_content`, null-mapped tools dropped). Flat `*.agent.md` files remain supported as a fallback for agents that have not been migrated to composable directories yet.
+- 603679a: Make the composable agent directories (`agents/<name>/`) canonical: the hand-authored flat `agents/*.agent.md` sources are removed and the flat Copilot/pi agent files are now generated output, composed from the canonical dirs by `scripts/build-copilot-agents.mjs` (`pnpm build:copilot`). `claude/agents/*.md` is composed from the same dirs' `claude/` harness by `scripts/build-claude-agents.mjs` (ralph stays native via `agents-native/ralph.md`). Agent names, descriptions, and tool sets are unchanged; agent bodies now carry the composable (tokenized) content. CI verifies both generated outputs never drift.
+- 60d498f: Port the pi extensions with Claude equivalents to the Claude Code plugin's hooks:
+  SessionStart now also injects the using-agent-skills / bd-tool / git-workflow skill
+  policy, and a Notification hook matched on documented notification types
+  (`agent_completed|agent_needs_input|permission_prompt`) raises desktop notifications
+  via the bundled `hooks/scripts/notify.mjs`. Hook support scripts are now bundled
+  into `claude/hooks/` by the shared installer, and the audit (auto-name, skill-stats,
+  subagent, agent-modes rejected with rationale) is recorded in `docs/claude-hooks.md`.
+- 6863b0e: Add `agent-cortex install claude` — install-time generator for the Claude Code plugin
+  subtree, sharing one code path with `pnpm build:claude` so the outputs can never diverge.
+  `claude/.claude-plugin/plugin.json` (version now tracked from `package.json`) and
+  `claude/hooks.json` (from the new canonical `hooks/claude/` source) are generated rather
+  than hand-maintained, and the committed `claude/skills/` gains the previously-missing
+  `using-agent-skills` symlink. Root tests (`test/`) are now included in `pnpm test`.
+- f2b441e: Add the pi harness installer (`agent-cortex install pi`): composes agents from the canonical composable directories plus `pi/` sections, substitutes `{{TOOL:...}}` / `{{PATH:...}}` tokens against token-map.json's pi column (null-mapped tools dropped with warnings, paths resolved against the plugin root), and writes `<output>/agents/<name>.agent.md` plus token-substituted skill copies to `<output>/skills` (default `~/.pi/agent`). Supports `--dry-run`, `--output <dir>`, and an optional `--plugin-root <dir>` override. The shared composer gains pi-friendly options (`dropNullTools`, `pluginRoot`, `resolveRelativePaths`, `warn`) with the copilot/claude build defaults unchanged, and the root test suite is now wired into `pnpm test`.
+
+### Patch Changes
+
+- 99fcc9a: Complete the move to install-time Claude code generation: the standalone `scripts/build-claude-agents.mjs` build script is removed and `pnpm build:claude` is now a pure alias of `agent-cortex install claude` — both invoke the shared `bin/installers/claude.mjs` generator, so there is a single code path for the committed `claude/` plugin subtree and install-time vs regenerated output can never diverge. Generated agents carry installer provenance headers, and CI's drift check (regenerate + `git diff --exit-code`) validates the committed subtree byte-for-byte against installer output. `agents-native/` remains the canonical source for Claude-native agents (`ralph`), copied verbatim by the installer.
+- 9b0c4fc: Fix the release pipeline so Version Packages PRs regenerate generated output. `changesets/action` execs the `version`/`publish` inputs without a shell, so quoted multi-command strings crash (`bash -c '...'` split on whitespace → unterminated quote, exit 2). The chain now lives in exec-safe single-command pnpm scripts: `pnpm version-packages` bumps versions, syncs `plugin.json`, then regenerates the committed Claude/Copilot agent output so the drift gates never fail on the bumped version; `pnpm publish-package` performs the pack + provenance publish.
+- f1b8a25: Add composable agent directory structures for the plan, ralph-plan, and strategy agents (`agents/plan/`, `agents/ralph-plan/`, `agents/strategy/` with per-harness `pi/`, `copilot/`, and `claude/` frontmatter). The existing flat `*.agent.md` files are retained until the composer/installer migration lands, so no shipped behaviour changes yet.
+- d83a7cf: Add composable agent directory structure for the ralph agent (`agents/ralph/` with per-harness `pi/`, `copilot/`, and `claude/` frontmatter and polling sections). The existing flat `agents/ralph.agent.md` is retained until the composer/installer migration lands, so no shipped behaviour changes yet.
+- c4728c5: Migrate hardcoded tool names in skill files to `{{TOOL:name}}` tokens (task, read_agent, bash, view, rg, glob) so installers can substitute per-harness names.
+
+## 1.37.1
+
+### Patch Changes
+
+- 62bfbfe: Fix OIDC publishing by using custom publish script instead of changeset publish
+
+  Changesets doesn't natively support OIDC trusted publishing - it tries to use
+  `changeset publish` which requires an NPM_TOKEN. Replace with a custom script
+  that uses `pnpm pack` + `npm publish` directly, which properly picks up OIDC
+  tokens in GitHub Actions.
+
+## 1.37.0
+
+### Minor Changes
+
+- 75e2111: Switch to changesets for automated releases
+
+  Replace manual version bumping and GitHub release creation with changesets automation:
+
+  - Added `@changesets/cli` for intent-based versioning
+  - Added `release.yml` workflow that creates "Version Packages" PRs and auto-publishes via OIDC
+  - Added `scripts/sync-plugin-version.sh` to keep `plugin.json` in lockstep with `package.json`
+  - Updated `style-versioning` skill to document the new workflow
+  - Removed old `publish.yml` (release-triggered) workflow
+
+  Going forward: run `pnpm changeset` to describe changes, merge to main, and the rest is automatic.
+
+### Patch Changes
+
+- ad7ac8d: **Enforce changeset requirement in CI** — PRs that modify `extensions/`, `skills/`, `agents/`, `package.json`, or `plugin.json` now fail CI unless they include a `.changeset/*.md` file. Prevents merges that the release pipeline can't pick up.
+- 1ad1920: Fix changesets workflow by adding root package to workspace
+
+  Changesets couldn't find @jaybeeuu/agent-cortex because pnpm-workspace.yaml
+  only listed skills/_/scripts and extensions/_. Adding "." makes the root
+  a workspace member so changesets can version it.
+
+- 75e2111: Trim AGENTS.md versioning section to reference style-versioning skill instead of duplicating detail
+
 All notable changes to this repository are documented in this file.
 
+## 1.37.0
+
+### Added
+
+- **Changesets for automated releases** — replaced manual version bumping and GitHub
+  release creation with `@changesets/cli` and `release.yml` workflow. PRs include
+  changeset files, merging to main triggers automatic "Version Packages" PRs, and
+  publishing to npm via OIDC happens automatically. `plugin.json` stays in lockstep
+  via `scripts/sync-plugin-version.sh`.
+
+### Removed
+
+- **`publish.yml`** — old release-triggered publish workflow. Replaced by `release.yml`.
+
+## 1.36.1
+
+### Added
+
+- **`.agents/skills/style-versioning/`** — new repo-local skill enforcing
+  version lockstep across `package.json`, `plugin.json`, and `CHANGELOG.md`.
+  Discovered by pi, Copilot CLI, and Claude Code when working in this repo;
+  not distributed with the plugin.
+
+### Changed
+
+- **Version alignment** — `package.json` version aligned to match `plugin.json`
+  (both now `1.36.1`). Going forward, all versions (`package.json`, `plugin.json`,
+  and `CHANGELOG.md` top header) must stay in lockstep. See AGENTS.md versioning
+  section for rules.
+- **AGENTS.md** — versioning section updated to require lockstep across all
+  three version files (package.json, plugin.json, CHANGELOG.md).
+- **First npm release via Trusted Publishing** — this is the first version
+  published to npm using OIDC (no `NPM_TOKEN` secret).
+
 ## 1.36.0
 
 ### Added
@@ -21,11 +135,11 @@ All notable changes to this repository are documented in this file.
 
 - **`.github/workflows/publish.yml`** — replaced `NPM_TOKEN` secret auth with
   npm Trusted Publishing (OIDC). The publish job now grants `contents: read`
-  + `id-token: write` permissions and runs Node 24 / setup-node v6
-  (npm >= 11.5.1, required for OIDC). The publish step packs with
-  `pnpm pack` and uploads the tarball with `npm publish` (pnpm 11's OIDC
-  publish path is broken — pnpm#11513). Publishing no longer needs a
-  long-lived npm token in repository secrets.
+  - `id-token: write` permissions and runs Node 24 / setup-node v6
+    (npm >= 11.5.1, required for OIDC). The publish step packs with
+    `pnpm pack` and uploads the tarball with `npm publish` (pnpm 11's OIDC
+    publish path is broken — pnpm#11513). Publishing no longer needs a
+    long-lived npm token in repository secrets.
 - **`.github/workflows/ci.test.ts`** — updated publish-workflow assertions to
   expect the OIDC shape: `contents: read` + `id-token: write` permissions,
   `pnpm pack` + `npm publish`, and no `NPM_TOKEN` / `NODE_AUTH_TOKEN`