@luquimbo/bi-superpowers 4.1.1 → 4.1.3

package/desktop-extension/server.js

@@ -25,25 +25,58 @@ const server = new McpServer({
   version: '0.0.0-template',
 });
 
-// Load all skill markdown files from the bundled skills/ directory.
-const skillFiles = fs.existsSync(skillsDir)
-  ? fs.readdirSync(skillsDir).filter((f) => f.endsWith('.md'))
-  : [];
+function loadBundledSkills(directory) {
+  if (!fs.existsSync(directory)) {
+    return [];
+  }
+
+  const skills = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const entryPath = path.join(directory, entry.name);
+
+    if (entry.isFile() && entry.name.endsWith('.md')) {
+      skills.push({
+        name: path.basename(entry.name, '.md'),
+        bundleDir: directory,
+        content: fs.readFileSync(entryPath, 'utf8'),
+      });
+      continue;
+    }
+
+    if (entry.isDirectory()) {
+      const skillPath = path.join(entryPath, 'SKILL.md');
+      if (fs.existsSync(skillPath)) {
+        skills.push({
+          name: entry.name,
+          bundleDir: entryPath,
+          content: fs.readFileSync(skillPath, 'utf8'),
+        });
+      }
+    }
+  }
+
+  return skills.sort((a, b) => a.name.localeCompare(b.name));
+}
 
 // Register each skill as an MCP prompt that Claude Desktop can invoke.
-for (const file of skillFiles) {
-  const name = path.basename(file, '.md');
-  const content = fs.readFileSync(path.join(skillsDir, file), 'utf8');
+for (const skill of loadBundledSkills(skillsDir)) {
+  const { name, bundleDir, content } = skill;
 
   // Use the first non-header line as a short description for the prompt.
   const firstLine = content.split('\n').find((l) => l.trim() && !l.startsWith('#'));
   const description = firstLine ? firstLine.slice(0, 120).trim() : `BI Superpowers: ${name}`;
+  const promptText = [
+    `Bundled skill directory: ${bundleDir}`,
+    'Resolve this skill\'s references/ and scripts/ paths relative to that directory.',
+    '',
+    content,
+  ].join('\n');
 
   server.prompt(name, { description }, () => ({
     messages: [
       {
         role: 'user',
-        content: { type: 'text', text: content },
+        content: { type: 'text', text: promptText },
       },
     ],
   }));
@@ -73,7 +106,7 @@ into Claude Desktop, add the following to your \`claude_desktop_config.json\`
 \`\`\`json
 {
   "mcpServers": {
-    "powerbi-modeling": {
+    "powerbi-modeling-mcp": {
       "command": "node",
       "args": ["<absolute path to powerbi-modeling-launcher.js>"]
     },
@@ -85,7 +118,7 @@ into Claude Desktop, add the following to your \`claude_desktop_config.json\`
 }
 \`\`\`
 
-The \`powerbi-modeling\` server requires Power BI Desktop on Windows
+The \`powerbi-modeling-mcp\` server requires Power BI Desktop on Windows
 with a model open. If you prefer automated setup, run
 \`super install\` from the bi-superpowers CLI — it configures both
 servers across all 5 supported AI agents.

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@luquimbo/bi-superpowers",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "description": "Open-source Power BI Desktop toolkit for Claude Code, GitHub Copilot, Codex, Gemini CLI, and Kilo Code. Ships 4 skills and 2 official Microsoft MCP servers.",
   "main": "bin/cli.js",
   "bin": {
-    "bi-superpowers": "bin/cli.js"
+    "bi-superpowers": "bin/cli.js",
+    "super": "bin/cli.js"
   },
   "scripts": {
     "build:plugin": "node bin/build-plugin.js",
@@ -23,10 +24,9 @@
     "adm-zip": "^0.5.17",
     "boxen": "^5.1.2",
     "chalk": "^4.1.2",
-    "chokidar": "^3.6.0",
+    "chokidar": "^4.0.3",
     "cli-table3": "^0.6.5",
-    "ora": "^5.4.1",
-    "update-notifier": "^5.1.0"
+    "ora": "^5.4.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",

package/skills/bi-start/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "bi-start"
 description: "Use when the user asks about BI Start Skill, especially phrases like \"bi-start\", \"bi start\", \"/bi-start\", \"empezar\", \"comenzar\", \"arranco\"."
-version: "4.1.1"
+version: "4.1.3"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/bi-start.md instead. -->
@@ -57,7 +57,7 @@ Interpret the single-line output:
     ```bash
     super upgrade
     ```
-    After it finishes, remind: _"Corré `super install --yes` cuando puedas para propagar las skills nuevas a tus agentes."_
+    After it finishes, remind: _"Si instalaste skills en el perfil del agente, corré `super install --yes`. Si además usás un plugin local generado con `super kickoff`, corré `super recharge` dentro de ese repo."_
 
   On `no` — respect it, continue to PHASE 1 silently. The update-state.json already tracks the user's snooze per `update-check.js` semantics.
 
@@ -182,7 +182,7 @@ Stop. Don't hover. The user will tell you what they want next.
 - **Project analysis or setup**: that's `/project-kickoff`. If the user says "analizar mi proyecto", "armar el modelo base", "arrancar uno nuevo desde cero", delegate.
 - **MCP wiring details**: that's `/pbi-connect`. bi-start just offers to dispatch it; the actual configuration work is in that skill.
 - **Report authoring**: that's `/report-design`. Same pattern.
-- **Running the update**: bi-start offers + dispatches `super upgrade`; the actual npm install + subsequent `super install --yes` chain is owned by `/bin/cli.js`.
+- **Running the update**: bi-start offers + dispatches `super upgrade`; the actual refresh path after eso (`/plugin update bi-superpowers`, `super install --yes`, o `super recharge`) is owned by `/bin/cli.js`.
 
 ## Related Skills
 

package/skills/bi-start/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.1";
+const BUNDLED_INSTALLED_VERSION = "4.1.3";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/pbi-connect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "pbi-connect"
 description: "Use when the user asks about Power BI MCP Connection Skill, especially phrases like \"connect Power BI\", \"PBI connection\", \"MCP connection\", \"Power BI MCP\", \"modeling mcp\", \"Power BI Modeling MCP\"."
-version: "4.1.1"
+version: "4.1.3"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/pbi-connect.md instead. -->
@@ -17,7 +17,7 @@ node "{skillBundleDir}/scripts/update-check.js" --silent-if-uptodate --silent-if
 
 - Empty output or `UPTODATE` — proceed with the skill silently. No message.
 - `UPDATE_AVAILABLE <installed> <latest>` — tell the user exactly once this conversation, before diving into the skill:
-  > "Hay **bi-superpowers v{latest}** disponible (estás en v{installed}). Actualizá con `super upgrade` (o `/plugin update bi-superpowers` en Claude Code) cuando te venga bien."
+  > "Hay **bi-superpowers v{latest}** disponible (estás en v{installed}). Actualizá con `super upgrade` (o `/plugin update bi-superpowers` en Claude Code) cuando te venga bien. Si estás usando un plugin local generado con `super kickoff`, después corré `super recharge` en ese repo."
 
   Then continue with the skill below.
 - `SNOOZED <iso>` — proceed silently.

package/skills/pbi-connect/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.1";
+const BUNDLED_INSTALLED_VERSION = "4.1.3";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/project-kickoff/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "project-kickoff"
 description: "Use when the user asks about Project Kickoff Skill, especially phrases like \"I'm starting a brand-new BI project from scratch\", \"analizar proyecto\", \"analyze project\", \"project kickoff\", \"nuevo proyecto\", \"new project\"."
-version: "4.1.1"
+version: "4.1.3"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/project-kickoff.md instead. -->
@@ -17,7 +17,7 @@ node "{skillBundleDir}/scripts/update-check.js" --silent-if-uptodate --silent-if
 
 - Empty output or `UPTODATE` — proceed with the skill silently. No message.
 - `UPDATE_AVAILABLE <installed> <latest>` — tell the user exactly once this conversation, before diving into the skill:
-  > "Hay **bi-superpowers v{latest}** disponible (estás en v{installed}). Actualizá con `super upgrade` (o `/plugin update bi-superpowers` en Claude Code) cuando te venga bien."
+  > "Hay **bi-superpowers v{latest}** disponible (estás en v{installed}). Actualizá con `super upgrade` (o `/plugin update bi-superpowers` en Claude Code) cuando te venga bien. Si estás usando un plugin local generado con `super kickoff`, después corré `super recharge` en ese repo."
 
   Then continue with the skill below.
 - `SNOOZED <iso>` — proceed silently.
@@ -594,11 +594,11 @@ Once the model has at least 1 fact, 1 dim, and 3 measures in place, propose movi
 
 El siguiente paso lógico es armar los 3 reportes con `/report-design`. Ese skill va a:
   1. Usar el dominio que ya definimos ({domain})
-  2. Inspeccionar tu modelo vía el pbi CLI para las medidas/dimensiones exactas
-  3. Generar 3 páginas con visuales vía CLI (card, line, bar, matrix)
+  2. Inspeccionar tu modelo vía el Modeling MCP (o `pbi-cli-tool` si hace falta) para las medidas/dimensiones exactas
+  3. Generar 3 páginas con scripts Node + comandos `pbi report` (card, line, bar, matrix)
   4. Cerrar y reabrir PBI Desktop para que renderice
 
-Requisito: necesitás pbi-cli-tool instalado (si no lo tenés el skill te guía).
+Requisito: necesitás Windows + Power BI Desktop + Python 3.10+ + `pipx` + `pbi-cli-tool` (si te falta algo, el skill te guía).
 
 ¿Arrancamos con /report-design, o preferís agregar más medidas al modelo primero?
 ```
@@ -610,7 +610,7 @@ If the user opts for reports, load `/report-design` and let it run. If they want
 ## What this skill does NOT do
 
 - **No scoring / benchmarking** of an existing model. For that, the user can ask "audit this model" separately.
-- **Report authoring** is delegated to `/report-design` which orchestrates the `pbi-cli-tool` CLI — don't write `.Report/` files from here.
+- **Report authoring** is delegated to `/report-design` which uses bundled Node scripts plus the `pbi` CLI runtime flow — don't write `.Report/` files from here.
 
 ---
 

package/skills/project-kickoff/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.1";
+const BUNDLED_INSTALLED_VERSION = "4.1.3";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/report-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "report-design"
 description: "Use when the user asks about Report Design Skill, especially phrases like \"crear reportes\", \"armar el reporte\", \"diseñar reporte\", \"report design\", \"create reports\", \"build dashboard\"."
-version: "4.1.1"
+version: "4.1.3"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/report-design.md instead. -->
@@ -17,7 +17,7 @@ node "{skillBundleDir}/scripts/update-check.js" --silent-if-uptodate --silent-if
 
 - Empty output or `UPTODATE` — proceed with the skill silently. No message.
 - `UPDATE_AVAILABLE <installed> <latest>` — tell the user exactly once this conversation, before diving into the skill:
-  > "Hay **bi-superpowers v{latest}** disponible (estás en v{installed}). Actualizá con `super upgrade` (o `/plugin update bi-superpowers` en Claude Code) cuando te venga bien."
+  > "Hay **bi-superpowers v{latest}** disponible (estás en v{installed}). Actualizá con `super upgrade` (o `/plugin update bi-superpowers` en Claude Code) cuando te venga bien. Si estás usando un plugin local generado con `super kickoff`, después corré `super recharge` en ese repo."
 
   Then continue with the skill below.
 - `SNOOZED <iso>` — proceed silently.
@@ -38,13 +38,13 @@ Activate this skill when the user mentions:
 - Explicit invocation: `/report-design`
 
 ## Identity
-You are **BI Report Architect**, an orchestrator that turns a finished semantic model into a Power BI report. You author PBIR via **bundled Node scripts** — not via `pbi-cli-tool` upstream:
+You are **BI Report Architect**, an orchestrator that turns a finished semantic model into a Power BI report. You author the PBIR visual/theme layer via **bundled Node scripts** — not via the old `pbi visual` / `pbi report set-theme` path:
 
 - `scripts/create-visual.js` — creates any of the 28 native PBI visualTypes with a canonical `visual.json` shape (allowlist-driven, validated). **This replaces `pbi visual add` + `pbi visual bind`.**
 - `scripts/apply-theme.js` — registers a custom theme with the canonical `report.json` shape. **This replaces `pbi report set-theme`** (which writes invalid metadata for PBI Desktop March 2026).
 - `scripts/validate-pbir.js` — allowlist + bind-role validator. **Complements `pbi report validate`**, which passes `valid: True` even on non-native types like `stackedBarChart`.
 
-The `pbi-cli-tool` (MIT, by MinaSaad1) is kept around for **one purpose only**: model introspection via XMLA (`pbi connect`, `pbi measure list`, `pbi table list`, `pbi column list`). Prefer the Microsoft Modeling MCP when available — same capability, better integrated.
+The `pbi-cli-tool` (MIT, by MinaSaad1) is still required today for **three parts of the flow**: model introspection via XMLA (`pbi connect`, `pbi measure list`, `pbi table list`, `pbi column list`), report page management (`pbi report add-page`, `pbi report list-pages`), and schema validation (`pbi report validate`). Prefer the Microsoft Modeling MCP when available for the introspection part — same capability, better integrated.
 
 Full rationale: `references/native-visuals.md` → section "Lo que este skill YA no hace via CLI".
 
@@ -295,7 +295,7 @@ Do NOT hand-author `report.json` theme metadata. The canonical PBIR shape (for r
 - `resourcePackages` includes a `{name: "RegisteredResources", type: "RegisteredResources"}` package whose `items[]` has `{name: "<file>.json", path: "<file>.json", type: "CustomTheme"}`
 - the theme file itself lives at `<reportPath>/StaticResources/RegisteredResources/<file>.json`
 
-**Conditional formatting (variance KPI green/red, diverging matrix gradients, signed-color bars) is DEFERRED to v4.1.** The layouts mention conditional color in design notes; in v4.0.0 the agent renders those visuals with default theme colors and skips the formatting step. Do not call `pbi format` from this skill in v4.0.0 — the `pbi format` syntax is not yet documented or tested for our use cases. Better a plain report that renders than a fancy one that breaks.
+**Conditional formatting note.** Layout notes may describe variance colors, diverging matrix gradients, or signed-color bars as design intent. The current `report-design` flow does not author those formatting rules. Render those visuals with theme/default colors unless you have a tested PBIR formatting implementation. Do not invent `pbi format` calls from this skill.
 
 ### 4.4 Validate (two layers)
 
@@ -370,8 +370,8 @@ Cuando guardes desde Desktop, commiteá el .pbip a git para versionar.
 **References** (`references/`):
 - `native-visuals.md` — **canonical reference**: 28 native visualTypes, their roles, shape canonical, copy-paste examples (read this before authoring)
 - `pbi-desktop-installation.md` — why the standalone installer build is required (not Microsoft Store), install + uninstall steps
-- `cli-setup.md` — how to install Python + pipx + pbi-cli-tool + pywin32 (only needed for model introspection via XMLA; scripts don't require it)
-- `cli-commands.md` — cheatsheet of the `pbi` commands still used by this skill (mostly `pbi connect` / `pbi measure list` for model introspection; authoring commands are superseded by the Node scripts)
+- `cli-setup.md` — how to install Python + pipx + pbi-cli-tool + pywin32 (required because this skill still uses `pbi` for connect, page operations, and validation)
+- `cli-commands.md` — cheatsheet of the `pbi` commands still used by this skill (`pbi connect`, `pbi measure list`, `pbi report add-page`, `pbi report list-pages`, `pbi report validate`)
 - `textbox.md` — historical manual-write pattern for textboxes (superseded by `create-visual.js --type textbox`; kept for reference)
 - `slicer.md` — historical manual-write pattern for slicers (superseded by `create-visual.js --type slicer --slicer-mode ...`; kept for reference)
 - `close-write-open-pattern.md` — why and how to handle the Desktop restart cycle
@@ -385,7 +385,7 @@ Cuando guardes desde Desktop, commiteá el .pbip a git para versionar.
 - `layouts/generic.md` — fallback 3-page composition
 
 **Scripts** (`scripts/`):
-- `ensure-pbi-cli.sh` — idempotent installer for the pbi-cli-tool (only needed for model introspection via XMLA)
+- `ensure-pbi-cli.sh` — idempotent installer for the pbi-cli-tool (required for this skill's current runtime flow)
 - `apply-theme.js` — registers a custom PBIR theme with the canonical shape Desktop accepts (replaces the broken `pbi report set-theme` in PBI Desktop March 2026)
 - `create-visual.js` — creates any of the 28 native PBI visualTypes with a canonical `visual.json` shape (replaces `pbi visual add` + `pbi visual bind`; enforces allowlist)
 - `validate-pbir.js` — allowlist + role-checks validator that catches non-native visualTypes and missing/invalid bindings (complements `pbi report validate`)
@@ -402,4 +402,4 @@ Cuando guardes desde Desktop, commiteá el .pbip a git para versionar.
 
 ## Credit
 
-This skill orchestrates the [`pbi-cli-tool`](https://github.com/MinaSaad1/pbi-cli) CLI by MinaSaad1 (MIT License). The CLI does the heavy lifting of PBIR JSON generation; we handle the teaching journey, planning, and Desktop lifecycle.
+This skill integrates with the [`pbi-cli-tool`](https://github.com/MinaSaad1/pbi-cli) CLI by MinaSaad1 (MIT License) for model introspection, page operations, and schema validation. Visual and theme authoring are handled by the bundled Node scripts; we orchestrate the teaching journey, planning, and Desktop lifecycle.

package/skills/report-design/references/layouts/finance.md

@@ -28,7 +28,7 @@ Roles used below (to be resolved via the MCP):
 | Scenario slicer | slicer (manual JSON — see `references/slicer.md`) | 848, 312, 336, 80 | `Scenario[Scenario]` |
 
 **Design notes:**
-- Variance KPI: conditional formatting (green positive, red negative) is deferred to v4.1 — render as plain card for v4.0.0.
+- Variance KPI: green/red conditional coloring is design intent only. Render as a plain card with theme/default colors unless a tested PBIR formatting implementation is available.
 - Year slicer default: current year (single-select).
 
 ---
@@ -61,5 +61,5 @@ Roles used below (to be resolved via the MCP):
 | Account × Month matrix | matrix | 16, 512, 1168, 144 | rows: `account-dim-column`, cols: `'Date'[Month]`, values: `variance-measure` with diverging gradient |
 
 **Design notes:**
-- Variance-sign coloring (diverging palette) is deferred to v4.1 — render bars/matrix with default theme colors for v4.0.0.
+- Variance-sign coloring (diverging palette) is design intent only. Render bars/matrix with theme/default colors unless a tested PBIR formatting implementation is available.
 - The bottom matrix is short (144px) so it acts as a "heatmap strip" rather than a scrollable table.

package/skills/report-design/references/native-visuals.md

@@ -311,7 +311,7 @@ Si PBI Desktop introduce un visualType nuevo (o encontrás uno nativo que falta
 
 ## Features de `visual.json` que `create-visual.js` NO soporta todavía
 
-Descubiertos al regenerar la smoke-test "Galería de Visuales" end-to-end con el script (backlog item 2, cycle v4.1). No bloquean el authoring — la shape que emite el script pasa `pbi report validate` y `validate-pbir.js` — pero sí dejan regresiones visuales si el `visual.json` hand-written aprovechaba alguno de estos features:
+Descubiertos al regenerar la smoke-test "Galería de Visuales" end-to-end con el script. No bloquean el authoring — la shape que emite el script pasa `pbi report validate` y `validate-pbir.js` — pero sí dejan regresiones visuales si el `visual.json` hand-written aprovechaba alguno de estos features:
 
 1. **`query.sortDefinition`** — sort explícito por medida/columna con dirección. `create-visual.js` no lo emite, así que un visual "ranking" tipo barChart ordenado descendente por una medida pierde el orden en la regeneración. **Workaround**: ordenar en Desktop manualmente después del `.pbip` abrir, o hand-extender el `visual.json` con `sortDefinition` post-creación. **Fix futuro**: `--sort-by "Role:Field" --sort-dir descending` en `create-visual.js`.
 
@@ -319,7 +319,7 @@ Descubiertos al regenerar la smoke-test "Galería de Visuales" end-to-end con el
 
 3. **`queryState.<Role>.projections[].active`** — las columnas siempre salen con `active: true`, las medidas nunca. Si un visual hand-written tenía `active: true` en una medida (para indicar que la medida es la "default Y") o `active: false` en una columna (hidden projection), el script normaliza. Rara vez significativo para el render pero cambia el shape JSON.
 
-4. **Formato condicional**: colores signados (positivo verde / negativo rojo), gradientes en matriz, data bars en tabla. Ninguno de estos expresa shape via `create-visual.js`. Quedó deferido a v4.1+ en `SKILL.md` PHASE 4.3.
+4. **Formato condicional**: colores signados (positivo verde / negativo rojo), gradientes en matriz, data bars en tabla. Ninguno de estos expresa shape via `create-visual.js`; tratarlos como diseño previsto hasta que exista una implementación PBIR testeada.
 
 Cualquier cambio en el script que cubra estos gaps debe: (a) agregar el flag a `parseArgs`, (b) cubrirlo con tests en `create-visual.test.js`, (c) documentarlo en este archivo, (d) regenerar la Galería para que ejercite el feature.
 

package/skills/report-design/references/slicer.md

@@ -86,4 +86,4 @@ cat > "<reportPath>/definition/pages/<pageName>/visuals/<visualName>/visual.json
 EOF
 ```
 
-A reusable helper script (`scripts/write-slicer.sh`) is a v4.1 candidate; v4.0.0 ships with the heredoc pattern.
+Prefer `scripts/create-visual.js --type slicer` for new slicers. Keep the heredoc pattern above only as a fallback when the helper script is unavailable.

package/skills/report-design/references/textbox.md

@@ -98,4 +98,4 @@ cat > "<reportPath>/definition/pages/<pageName>/visuals/<visualName>/visual.json
 EOF
 ```
 
-A reusable helper script (`scripts/write-textbox.sh`) is a v4.1 candidate; v4.0.0 ships with the heredoc pattern.
+Prefer `scripts/create-visual.js --type textbox` for new textboxes. Keep the heredoc pattern above only as a fallback when the helper script is unavailable.

package/skills/report-design/scripts/create-visual.js

@@ -679,6 +679,66 @@ function nextInt(existing, key) {
   return max + 1;
 }
 
+function validateVisualName(name) {
+  if (typeof name !== 'string' || name.trim() === '') {
+    fail('--name must be a non-empty visual folder name');
+  }
+
+  if (name !== name.trim()) {
+    fail(`--name must not have leading or trailing whitespace (got: ${JSON.stringify(name)})`);
+  }
+
+  if (
+    name === '.' ||
+    name === '..' ||
+    /[\\/]/.test(name) ||
+    path.basename(name) !== name ||
+    path.win32.basename(name) !== name ||
+    path.posix.basename(name) !== name
+  ) {
+    fail(`--name must be a single visual folder name, not a path (got: ${JSON.stringify(name)})`);
+  }
+
+  if (/[\u0000-\u001f<>:"|?*]/.test(name)) {
+    fail(`--name contains characters that are not valid in a Windows folder name (got: ${JSON.stringify(name)})`);
+  }
+}
+
+function validateNumericOptions(args) {
+  const numericOptions = [
+    ['x', '--x'],
+    ['y', '--y'],
+    ['z', '-z'],
+    ['width', '--width'],
+    ['height', '--height'],
+    ['tabOrder', '--tab-order'],
+  ];
+
+  for (const [key, flag] of numericOptions) {
+    if (args[key] != null && !Number.isFinite(args[key])) {
+      fail(`${flag} must be a finite number`);
+    }
+  }
+
+  for (const [key, flag] of [
+    ['width', '--width'],
+    ['height', '--height'],
+  ]) {
+    if (args[key] != null && args[key] <= 0) {
+      fail(`${flag} must be greater than 0`);
+    }
+  }
+}
+
+function assertPathInside(childPath, parentPath, label) {
+  const parent = path.resolve(parentPath);
+  const child = path.resolve(childPath);
+  const relative = path.relative(parent, child);
+  if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+    fail(`${label} resolved outside the expected directory: ${child}`);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // main()
 // ---------------------------------------------------------------------------
@@ -698,6 +758,7 @@ function main() {
   if (!args.reportPath) fail('--report-path is required');
   if (!args.page) fail('--page is required');
   if (!args.type) fail('--type is required (use --list-types to see options)');
+  validateNumericOptions(args);
 
   // ---- type validation with friendly errors for known non-native aliases
   if (KNOWN_NON_NATIVE_TYPES[args.type]) {
@@ -727,8 +788,11 @@ function main() {
     } while (existing.some((v) => v.name === candidate));
     name = candidate;
   }
+  validateVisualName(name);
 
-  const visualDir = path.join(pageDir, 'visuals', name);
+  const visualsDir = path.join(pageDir, 'visuals');
+  const visualDir = path.join(visualsDir, name);
+  assertPathInside(visualDir, visualsDir, '--name');
   const visualJsonPath = path.join(visualDir, 'visual.json');
   if (fs.existsSync(visualJsonPath)) {
     fail(

package/skills/report-design/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.1";
+const BUNDLED_INSTALLED_VERSION = "4.1.3";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/report-design/scripts/validate-pbir.js

@@ -130,6 +130,33 @@ function boundRoles(visualData) {
   return bound;
 }
 
+function validatePosition(position) {
+  const errors = [];
+  const requiredFields = ['x', 'y', 'z', 'height', 'width', 'tabOrder'];
+
+  if (!position || typeof position !== 'object') {
+    return requiredFields.map((field) => ({
+      severity: 'error',
+      rule: 'position-number',
+      field,
+      message: `position.${field} must be a finite number`,
+    }));
+  }
+
+  for (const field of requiredFields) {
+    if (!Number.isFinite(position[field])) {
+      errors.push({
+        severity: 'error',
+        rule: 'position-number',
+        field,
+        message: `position.${field} must be a finite number`,
+      });
+    }
+  }
+
+  return errors;
+}
+
 function validateVisual(visual) {
   const errors = [];
   const { data, path: filePath } = visual;
@@ -148,6 +175,8 @@ function validateVisual(visual) {
     errors.push({ severity: 'error', rule: 'name', message: 'missing "name"' });
   }
 
+  errors.push(...validatePosition(data.position));
+
   const vt = data.visual && data.visual.visualType;
   if (!vt) {
     errors.push({ severity: 'error', rule: 'visual-type', message: 'missing visualType' });

package/src/content/skills/bi-start.md

@@ -49,7 +49,7 @@ Interpret the single-line output:
     ```bash
     super upgrade
     ```
-    After it finishes, remind: _"Corré `super install --yes` cuando puedas para propagar las skills nuevas a tus agentes."_
+    After it finishes, remind: _"Si instalaste skills en el perfil del agente, corré `super install --yes`. Si además usás un plugin local generado con `super kickoff`, corré `super recharge` dentro de ese repo."_
 
   On `no` — respect it, continue to PHASE 1 silently. The update-state.json already tracks the user's snooze per `update-check.js` semantics.
 
@@ -174,7 +174,7 @@ Stop. Don't hover. The user will tell you what they want next.
 - **Project analysis or setup**: that's `/project-kickoff`. If the user says "analizar mi proyecto", "armar el modelo base", "arrancar uno nuevo desde cero", delegate.
 - **MCP wiring details**: that's `/pbi-connect`. bi-start just offers to dispatch it; the actual configuration work is in that skill.
 - **Report authoring**: that's `/report-design`. Same pattern.
-- **Running the update**: bi-start offers + dispatches `super upgrade`; the actual npm install + subsequent `super install --yes` chain is owned by `/bin/cli.js`.
+- **Running the update**: bi-start offers + dispatches `super upgrade`; the actual refresh path after eso (`/plugin update bi-superpowers`, `super install --yes`, o `super recharge`) is owned by `/bin/cli.js`.
 
 ## Related Skills
 

package/src/content/skills/project-kickoff.md

@@ -565,11 +565,11 @@ Once the model has at least 1 fact, 1 dim, and 3 measures in place, propose movi
 
 El siguiente paso lógico es armar los 3 reportes con `/report-design`. Ese skill va a:
   1. Usar el dominio que ya definimos ({domain})
-  2. Inspeccionar tu modelo vía el pbi CLI para las medidas/dimensiones exactas
-  3. Generar 3 páginas con visuales vía CLI (card, line, bar, matrix)
+  2. Inspeccionar tu modelo vía el Modeling MCP (o `pbi-cli-tool` si hace falta) para las medidas/dimensiones exactas
+  3. Generar 3 páginas con scripts Node + comandos `pbi report` (card, line, bar, matrix)
   4. Cerrar y reabrir PBI Desktop para que renderice
 
-Requisito: necesitás pbi-cli-tool instalado (si no lo tenés el skill te guía).
+Requisito: necesitás Windows + Power BI Desktop + Python 3.10+ + `pipx` + `pbi-cli-tool` (si te falta algo, el skill te guía).
 
 ¿Arrancamos con /report-design, o preferís agregar más medidas al modelo primero?
 ```
@@ -581,7 +581,7 @@ If the user opts for reports, load `/report-design` and let it run. If they want
 ## What this skill does NOT do
 
 - **No scoring / benchmarking** of an existing model. For that, the user can ask "audit this model" separately.
-- **Report authoring** is delegated to `/report-design` which orchestrates the `pbi-cli-tool` CLI — don't write `.Report/` files from here.
+- **Report authoring** is delegated to `/report-design` which uses bundled Node scripts plus the `pbi` CLI runtime flow — don't write `.Report/` files from here.
 
 ---
 

package/src/content/skills/report-design/SKILL.md

@@ -9,13 +9,13 @@ Activate this skill when the user mentions:
 - Explicit invocation: `/report-design`
 
 ## Identity
-You are **BI Report Architect**, an orchestrator that turns a finished semantic model into a Power BI report. You author PBIR via **bundled Node scripts** — not via `pbi-cli-tool` upstream:
+You are **BI Report Architect**, an orchestrator that turns a finished semantic model into a Power BI report. You author the PBIR visual/theme layer via **bundled Node scripts** — not via the old `pbi visual` / `pbi report set-theme` path:
 
 - `scripts/create-visual.js` — creates any of the 28 native PBI visualTypes with a canonical `visual.json` shape (allowlist-driven, validated). **This replaces `pbi visual add` + `pbi visual bind`.**
 - `scripts/apply-theme.js` — registers a custom theme with the canonical `report.json` shape. **This replaces `pbi report set-theme`** (which writes invalid metadata for PBI Desktop March 2026).
 - `scripts/validate-pbir.js` — allowlist + bind-role validator. **Complements `pbi report validate`**, which passes `valid: True` even on non-native types like `stackedBarChart`.
 
-The `pbi-cli-tool` (MIT, by MinaSaad1) is kept around for **one purpose only**: model introspection via XMLA (`pbi connect`, `pbi measure list`, `pbi table list`, `pbi column list`). Prefer the Microsoft Modeling MCP when available — same capability, better integrated.
+The `pbi-cli-tool` (MIT, by MinaSaad1) is still required today for **three parts of the flow**: model introspection via XMLA (`pbi connect`, `pbi measure list`, `pbi table list`, `pbi column list`), report page management (`pbi report add-page`, `pbi report list-pages`), and schema validation (`pbi report validate`). Prefer the Microsoft Modeling MCP when available for the introspection part — same capability, better integrated.
 
 Full rationale: `references/native-visuals.md` → section "Lo que este skill YA no hace via CLI".
 
@@ -266,7 +266,7 @@ Do NOT hand-author `report.json` theme metadata. The canonical PBIR shape (for r
 - `resourcePackages` includes a `{name: "RegisteredResources", type: "RegisteredResources"}` package whose `items[]` has `{name: "<file>.json", path: "<file>.json", type: "CustomTheme"}`
 - the theme file itself lives at `<reportPath>/StaticResources/RegisteredResources/<file>.json`
 
-**Conditional formatting (variance KPI green/red, diverging matrix gradients, signed-color bars) is DEFERRED to v4.1.** The layouts mention conditional color in design notes; in v4.0.0 the agent renders those visuals with default theme colors and skips the formatting step. Do not call `pbi format` from this skill in v4.0.0 — the `pbi format` syntax is not yet documented or tested for our use cases. Better a plain report that renders than a fancy one that breaks.
+**Conditional formatting note.** Layout notes may describe variance colors, diverging matrix gradients, or signed-color bars as design intent. The current `report-design` flow does not author those formatting rules. Render those visuals with theme/default colors unless you have a tested PBIR formatting implementation. Do not invent `pbi format` calls from this skill.
 
 ### 4.4 Validate (two layers)
 
@@ -341,8 +341,8 @@ Cuando guardes desde Desktop, commiteá el .pbip a git para versionar.
 **References** (`references/`):
 - `native-visuals.md` — **canonical reference**: 28 native visualTypes, their roles, shape canonical, copy-paste examples (read this before authoring)
 - `pbi-desktop-installation.md` — why the standalone installer build is required (not Microsoft Store), install + uninstall steps
-- `cli-setup.md` — how to install Python + pipx + pbi-cli-tool + pywin32 (only needed for model introspection via XMLA; scripts don't require it)
-- `cli-commands.md` — cheatsheet of the `pbi` commands still used by this skill (mostly `pbi connect` / `pbi measure list` for model introspection; authoring commands are superseded by the Node scripts)
+- `cli-setup.md` — how to install Python + pipx + pbi-cli-tool + pywin32 (required because this skill still uses `pbi` for connect, page operations, and validation)
+- `cli-commands.md` — cheatsheet of the `pbi` commands still used by this skill (`pbi connect`, `pbi measure list`, `pbi report add-page`, `pbi report list-pages`, `pbi report validate`)
 - `textbox.md` — historical manual-write pattern for textboxes (superseded by `create-visual.js --type textbox`; kept for reference)
 - `slicer.md` — historical manual-write pattern for slicers (superseded by `create-visual.js --type slicer --slicer-mode ...`; kept for reference)
 - `close-write-open-pattern.md` — why and how to handle the Desktop restart cycle
@@ -356,7 +356,7 @@ Cuando guardes desde Desktop, commiteá el .pbip a git para versionar.
 - `layouts/generic.md` — fallback 3-page composition
 
 **Scripts** (`scripts/`):
-- `ensure-pbi-cli.sh` — idempotent installer for the pbi-cli-tool (only needed for model introspection via XMLA)
+- `ensure-pbi-cli.sh` — idempotent installer for the pbi-cli-tool (required for this skill's current runtime flow)
 - `apply-theme.js` — registers a custom PBIR theme with the canonical shape Desktop accepts (replaces the broken `pbi report set-theme` in PBI Desktop March 2026)
 - `create-visual.js` — creates any of the 28 native PBI visualTypes with a canonical `visual.json` shape (replaces `pbi visual add` + `pbi visual bind`; enforces allowlist)
 - `validate-pbir.js` — allowlist + role-checks validator that catches non-native visualTypes and missing/invalid bindings (complements `pbi report validate`)
@@ -373,4 +373,4 @@ Cuando guardes desde Desktop, commiteá el .pbip a git para versionar.
 
 ## Credit
 
-This skill orchestrates the [`pbi-cli-tool`](https://github.com/MinaSaad1/pbi-cli) CLI by MinaSaad1 (MIT License). The CLI does the heavy lifting of PBIR JSON generation; we handle the teaching journey, planning, and Desktop lifecycle.
+This skill integrates with the [`pbi-cli-tool`](https://github.com/MinaSaad1/pbi-cli) CLI by MinaSaad1 (MIT License) for model introspection, page operations, and schema validation. Visual and theme authoring are handled by the bundled Node scripts; we orchestrate the teaching journey, planning, and Desktop lifecycle.

package/src/content/skills/report-design/references/layouts/finance.md

@@ -28,7 +28,7 @@ Roles used below (to be resolved via the MCP):
 | Scenario slicer | slicer (manual JSON — see `references/slicer.md`) | 848, 312, 336, 80 | `Scenario[Scenario]` |
 
 **Design notes:**
-- Variance KPI: conditional formatting (green positive, red negative) is deferred to v4.1 — render as plain card for v4.0.0.
+- Variance KPI: green/red conditional coloring is design intent only. Render as a plain card with theme/default colors unless a tested PBIR formatting implementation is available.
 - Year slicer default: current year (single-select).
 
 ---
@@ -61,5 +61,5 @@ Roles used below (to be resolved via the MCP):
 | Account × Month matrix | matrix | 16, 512, 1168, 144 | rows: `account-dim-column`, cols: `'Date'[Month]`, values: `variance-measure` with diverging gradient |
 
 **Design notes:**
-- Variance-sign coloring (diverging palette) is deferred to v4.1 — render bars/matrix with default theme colors for v4.0.0.
+- Variance-sign coloring (diverging palette) is design intent only. Render bars/matrix with theme/default colors unless a tested PBIR formatting implementation is available.
 - The bottom matrix is short (144px) so it acts as a "heatmap strip" rather than a scrollable table.