@luquimbo/bi-superpowers 4.1.4 → 4.1.6

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "AI-powered skills for Power BI Desktop development. Works with Claude Code, GitHub Copilot, Codex, Gemini CLI, and Kilo Code.",
-    "version": "4.1.4",
+    "version": "4.1.6",
     "repository": "https://github.com/luquimbo/bi-superpowers"
   },
   "plugins": [

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "bi-superpowers",
   "description": "Claude Code plugin for Power BI, Microsoft Fabric, and semantic model workflows powered by the official Microsoft MCP servers.",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "author": {
     "name": "Lucas Sanchez"
   },

package/.claude-plugin/skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "bi-superpowers",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "skillCount": 4,
   "skills": [
     {

package/.plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "spec": "open-plugin-spec@1",
   "name": "bi-superpowers",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "description": "Claude Code plugin for Power BI, Microsoft Fabric, and semantic model workflows powered by the official Microsoft MCP servers.",
   "author": {
     "name": "Lucas Sanchez"

package/AGENTS.md

@@ -12,41 +12,10 @@
 
 ## Project Entry Points
 - `AGENTS.md` (this file)
-- `library/`
+- `src/content/`
+- `bin/`
 - `config.json`
 
----
-
-## QA Codex Shortcut
-
-When the user says `qa codex` in a new session for this repo, treat it as activating the external QA review workflow.
-
-Role split:
-- **Codex** — external QA / code reviewer
-- **Claude Code** — primary implementer
-- **Lucas** — bridge between both agents
-
-Default review protocol:
-1. Read `coordination/ACTIVE_PLAN.md` first.
-2. Read `coordination/TO_CODEX_REVIEW.md` second.
-3. If `TO_CODEX_REVIEW.md` references an audit or follow-up review file, read that too.
-4. Review commits or staged diffs with focus on:
-   - functional bugs
-   - regressions
-   - reasonable missing tests
-   - drift between `src/content/...` and generated artifacts
-   - build/release risks
-   - Windows + Power BI Desktop risks
-5. Return prioritized findings first and a short summary second.
-
-Working rules:
-- Codex is a second opinion, not the implementation owner and not a release gate.
-- Do not assume you saw the whole previous session; rely on the coordination `.md` files.
-- If the user asks for a prompt for Claude, provide a copy-paste-ready prompt that explicitly references the coordination files above.
-- This shortcut is a repo convention for future sessions, not implicit model memory.
-
----
-
 ## Publishing to npm (for AI agents)
 
 When the user asks for things like **"publica una nueva versión"**, **"publish a patch"**, **"sube esto a npm"**, **"release v1.2.0"**, follow this flow.
@@ -72,14 +41,18 @@ The repo uses **GitHub Actions** to publish automatically. The `NPM_TOKEN` is st
    ```
 5. **Run the local validations** (these also run in CI, but fail fast locally):
    ```bash
+   npm test
    npm run build:plugin
    npm run lint
    npm run format:check
+   npm audit --omit=dev --audit-level=moderate
+   node bin/cli.js scan --verbose
+   npm pack --dry-run --ignore-scripts
    ```
 6. **Commit with conventional commit message:**
    ```bash
-   git add package.json package-lock.json [+ any regenerated files]
-   git commit -m "chore: bump version to X.Y.Z"
+   git add package.json package-lock.json [+ source, docs, tests, regenerated files]
+   git commit -m "fix: describe the release change"
    ```
 7. **Create the version tag:**
    ```bash
@@ -143,7 +116,7 @@ Agent-specific behavior:
 ### Claude Desktop
 
 ```bash
-super build-desktop
+super build-desktop --output dist
 # Double-click bi-superpowers.mcpb para instalar en Claude Desktop
 ```
 
@@ -197,6 +170,8 @@ Los 4 skills quedan disponibles como MCP prompts.
 
 BI Agent Superpowers installs skills and MCP configuration at the user level for all supported agents. It can also generate a native Claude Code plugin from the same source of truth when a user explicitly wants repo-local Claude Code plugin files.
 
+`super mcp-setup` is local-plugin maintenance only. It must run inside a repo already initialized by `super kickoff` (detected by `.bi-superpowers.json` or `.claude-plugin/plugin.json`). Do not use it for Codex, GitHub Copilot, Gemini CLI, Kilo Code, or normal Claude Code user-level setup; use `super install --all --yes` instead.
+
 ### Output Targets
 
 | Target | Format | Output |
@@ -213,8 +188,7 @@ project/
 ├── .mcp.json                    # Power BI Modeling + Microsoft Learn MCPs
 ├── commands/*.md                # 4 slash commands (bi-start, pbi-connect, project-kickoff, report-design)
 ├── skills/*/SKILL.md            # 4 skills (discoverable)
-├── config.json                  # User preferences
-└── library/ → symlink           # Snippets, templates, themes
+└── config.json                  # User preferences
 ```
 
 ### Desktop Extension (generated by build-desktop)
@@ -227,51 +201,15 @@ desktop-extension/
 └── skills/           # Bundled at build time
 ```
 
-Run `bi-superpowers recharge` after modifying skills to regenerate the plugin.
-
----
-
-## Library Resources
-
-The `library/` folder contains reusable assets:
-
-```
-library/
-├── snippets/           # Code patterns
-│   ├── dax/            # Time intelligence, rankings, CALCULATE
-│   ├── power-query/    # Transformations, error handling
-│   ├── excel-formulas/ # Dynamic arrays, lookups
-│   ├── report-design/  # Chart selection, accessibility, layouts
-│   └── governance/     # Naming conventions, review checklists
-├── templates/          # Project templates
-│   ├── power-bi/
-│   ├── excel/
-│   └── data-models/
-├── themes/             # Visual themes
-│   └── power-bi/       # JSON theme files
-└── examples/           # Reference implementations
-    ├── finance-reporting/
-    ├── hr-analytics/
-    ├── retail-analytics/
-    ├── supply-chain/
-    └── marketing-analytics/
-```
-
-Reference patterns in prompts:
-```
-"Using patterns from library/snippets/dax/time-intelligence.md,
-create a rolling 12-month average measure"
-```
-
----
+Run `npm run build:plugin` after modifying source skills, or `super recharge` when refreshing an initialized local Claude Code plugin in a user project.
 
 ## Configuration
 
-Project-local user preferences live in `config.json`:
+Optional project-local user preferences live in `config.json` when a local Claude Code plugin is initialized:
 
 - This file is meant to be read by your AI tool as **context** (experience level, language, domain terms).
-- `bi-superpowers kickoff` will create it automatically from the package template if it doesn't exist.
-- The CLI stores selected AI tools in `.bi-superpowers.json` (also project-local) so `bi-superpowers recharge` knows what to regenerate.
+- `super kickoff` creates it automatically from the package template if it doesn't exist.
+- The CLI stores local-plugin metadata in `.bi-superpowers.json` so `super recharge` and `super mcp-setup` can refresh the initialized plugin safely.
 
 ```json
 {

package/CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to BI Agent Superpowers will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.6] — 2026-04-24
+
+### Fixed
+
+- `super mcp-setup` now rejects every repo-local target, including legacy
+  `--tool cursor`, `--tool vscode`, `--tool kilocode`, `--tool open-code`, and
+  `--tool claude-code`, unless the target repo already has a BI Superpowers
+  local plugin marker from `super kickoff`.
+- `super mcp-setup` now refuses to overwrite corrupt existing JSON configs and
+  writes through the same atomic backup path used by the user-level MCP config
+  writer.
+- `super install` copy-mode refreshes now mirror managed skill directories, so
+  runtime scripts and references removed in a newer package cannot remain
+  installed from an older package.
+- `super build-desktop --output <path>` now honors the documented output path.
+
+### Changed
+
+- README, AGENTS, CLAUDE, Getting Started, Architecture, Security, Contributing,
+  and Roadmap docs now consistently describe the user-level install contract and
+  the optional local Claude Code plugin path.
+
+## [4.1.5] — 2026-04-24
+
+### Fixed
+
+- Removed the obsolete `coordination/` QA shortcut from `AGENTS.md`.
+- `super mcp-setup --tool claude-plugin` no longer creates `.mcp.json` in an
+  arbitrary directory without an existing local plugin marker.
+- User-level MCP config writes validate the final path, `.tmp`, and `.bak`
+  paths before writing, rejecting pre-existing symlinks.
+- `super upgrade` now points users to the canonical
+  `super install --all --yes` refresh command.
+- Kilo Code path documentation now consistently uses `~/.kilo/mcp_settings.json`.
+
 ## [4.1.4] — 2026-04-24
 
 ### Fixed
@@ -114,10 +149,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **README rewrite**: dual install paths clearly segmented by audience
   (Claude Code users → marketplace, everyone else → npm + `super install`),
   mirrored update instructions, and OQ-1 resolution explained inline.
-- **Opus 4.7 1M code review report** at
-  `coordination/CODE_REVIEW_OPUS_2026-04-21.md` — 3 blockers + 5 high +
-  8 medium + 7 low findings across the whole repo (all resolved in this
-  release, except 4 mediums/3 lows explicitly deferred as product calls).
+- **Opus 4.7 1M code review pass** — 3 blockers + 5 high + 8 medium +
+  7 low findings across the whole repo (all resolved in this release,
+  except 4 mediums/3 lows explicitly deferred as product calls).
 
 ### Changed
 
@@ -200,7 +234,7 @@ changes required. Recommended sequence:
 
 # Users on npm:
 super upgrade
-super install --yes    # propagate the new skills to all agents
+super install --all --yes    # propagate the new skills to all agents
 ```
 
 Session-opener users: when you previously said "empezar" / "arranco" /
@@ -388,7 +422,7 @@ The plugin has been simplified to its core: **Power BI Desktop local development
 - GitHub Copilot → `~/.copilot/mcp-config.json` (`servers` JSON)
 - Codex → `~/.codex/config.toml` (TOML `[mcp_servers.*]`)
 - Gemini CLI → `~/.gemini/settings.json` (`mcpServers` with `httpUrl`)
-- Kilo Code → `~/.kilocode/mcp_settings.json` (`mcpServers` JSON)
+- Kilo Code → `~/.kilo/mcp_settings.json` (`mcpServers` JSON)
 
 New module: `bin/lib/mcp-config.js` with per-agent writers and tests.
 

package/README.md

@@ -394,11 +394,14 @@ super recharge         # Regenerate optional local Claude Code plugin artifacts
 super powers           # List available skills
 super scan             # Compare source skills with generated artifacts
 super checkup          # Validate skill content
-super build-desktop    # Build the Claude Desktop .mcpb extension
+super build-desktop    # Build the Claude Desktop .mcpb extension in the current dir
+super build-desktop --output dist
 super upgrade          # Update the global CLI and print refresh steps
 super help             # Show full CLI help
 ```
 
+`super mcp-setup` is intentionally not part of normal setup. It only refreshes MCP config inside an existing local Claude Code plugin created by `super kickoff`; it refuses to write repo-local config in arbitrary projects. For Codex, GitHub Copilot, Gemini CLI, Kilo Code, and normal Claude Code user-level installs, use `super install --all --yes`.
+
 ---
 
 ## Plugin File Tree
@@ -539,6 +542,8 @@ super recharge
 
 `super upgrade` intentionally does not run `super install` or `super recharge` automatically. User-profile installs and project-local plugins are separate refresh targets.
 
+On Windows, if symlink creation is not available and the installer falls back to copying skills, each re-run mirrors the managed skill directories. Removed or renamed bundled scripts are deleted from the copied install during refresh.
+
 ---
 
 ## What Ships To npm
@@ -567,7 +572,6 @@ The npm package does not include:
 
 ```text
 examples/smoke-test/
-coordination/
 node_modules/
 *.test.js
 ```

package/bin/cli.js

@@ -185,6 +185,7 @@ Examples:
   super kickoff --dry-run          # Preview local Claude Code plugin files
   super recharge                   # Regenerate existing local Claude Code plugin
   super build-desktop              # Build .mcpb for Claude Desktop
+  super build-desktop --output dist
   super mcp-setup                  # Existing local Claude Code plugin only
 
 Open source — MIT licensed.
@@ -428,15 +429,12 @@ function ensurePluginTool(tools = []) {
 
 /**
  * Build the options object passed into individual generators.
- * If the target directory has its own local `library/` folder, skills
- * will reference that; otherwise they reference the library bundled
- * inside the installed npm package.
+ * `library/` is no longer shipped by this package. Keep local project
+ * library references unchanged only when the target repo provides them.
  */
 function getGenerationOptions(targetDir) {
   const usePluginRootLauncher = path.resolve(targetDir) === PACKAGE_DIR;
-  const libraryPrefix = fs.existsSync(path.join(targetDir, 'library'))
-    ? 'library'
-    : path.join(PACKAGE_DIR, 'library');
+  const libraryPrefix = fs.existsSync(path.join(targetDir, 'library')) ? 'library' : null;
 
   return {
     packageDir: PACKAGE_DIR,
@@ -581,9 +579,9 @@ function showCompletionMessage(targetDir, tools, skillCount) {
 
   To build the Desktop extension:
 
-    super build-desktop
+    super build-desktop --output dist
 
-  Then double-click bi-superpowers.mcpb to install.
+  Then double-click dist/bi-superpowers.mcpb to install.
 
 ────────────────────────────────────────────────────────────
 
@@ -657,7 +655,7 @@ function getUpgradeRefreshSteps() {
     },
     {
       label: 'Skills installed in your user profile (npm + super install):',
-      command: 'super install --yes',
+      command: 'super install --all --yes',
     },
     {
       label:

package/bin/commands/build-desktop.js

@@ -100,14 +100,48 @@ function shouldSkipRuntimeFile(filePath) {
   );
 }
 
+/**
+ * Parse build-desktop CLI arguments.
+ *
+ * @param {string[]} args - CLI arguments after `build-desktop`
+ * @returns {{outputDir: string}} Build options
+ */
+function parseArgs(args) {
+  const options = {
+    outputDir: process.cwd(),
+  };
+
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+
+    if (arg === '--output' || arg === '-o') {
+      const value = args[++index];
+      if (!value || value.startsWith('-')) {
+        throw new Error(`${arg} requires a path`);
+      }
+      options.outputDir = path.resolve(value);
+    }
+  }
+
+  return options;
+}
+
 /**
  * Build the .mcpb extension for Claude Desktop.
  *
  * @param {string[]} args - CLI arguments
  * @param {Object} config - Command config from CLI
  */
-function buildDesktop(_args, _config) {
-  const outputDir = process.cwd();
+function buildDesktop(args, _config) {
+  let options;
+  try {
+    options = parseArgs(args || []);
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+  const outputDir = options.outputDir;
+  fs.mkdirSync(outputDir, { recursive: true });
 
   console.log(`
 BI Agent Superpowers — Build Desktop Extension
@@ -239,3 +273,4 @@ module.exports = buildDesktop;
 module.exports.bundleSkills = bundleSkills;
 module.exports.copyRuntimeTree = copyRuntimeTree;
 module.exports.shouldSkipRuntimeFile = shouldSkipRuntimeFile;
+module.exports.parseArgs = parseArgs;

package/bin/commands/install.js

@@ -13,7 +13,8 @@
  * Everything is installed at the user level (~/) so it applies across
  * all projects without polluting any specific repo. Skills land in
  * ~/.agents/skills/ (universal path) and each agent's own skill dir is
- * symlinked to that universal copy. MCPs are written to each agent's
+ * symlinked to that universal copy when possible. Copy fallback mirrors
+ * managed skill directories on every run. MCPs are written to each agent's
  * expected config file in the format that agent requires (JSON for
  * most, TOML for Codex) — see `lib/mcp-config.js` for details.
  *
@@ -116,10 +117,31 @@ async function selectMultiple(rl, items, preselected = []) {
  * @param {string} destDir - Destination directory
  */
 function copySkillDir(srcDir, destDir) {
-  if (!fs.existsSync(destDir)) {
-    fs.mkdirSync(destDir, { recursive: true });
+  const resolvedSrc = path.resolve(srcDir);
+  const resolvedDest = path.resolve(destDir);
+  const destRoot = path.parse(resolvedDest).root;
+
+  if (
+    resolvedSrc === resolvedDest ||
+    resolvedSrc.startsWith(`${resolvedDest}${path.sep}`) ||
+    resolvedDest === destRoot
+  ) {
+    throw new Error(`Refusing to mirror skill directory into unsafe target: ${destDir}`);
   }
 
+  // Skill directories are package-managed. Remove the old managed copy first
+  // so upgrades cannot leave deleted scripts or references behind.
+  const existingDest = fs.lstatSync(destDir, { throwIfNoEntry: false });
+  if (existingDest) {
+    if (existingDest.isSymbolicLink()) {
+      fs.unlinkSync(destDir);
+    } else {
+      fs.rmSync(destDir, { recursive: true, force: true });
+    }
+  }
+
+  fs.mkdirSync(destDir, { recursive: true });
+
   const entries = fs.readdirSync(srcDir, { withFileTypes: true });
   for (const entry of entries) {
     const srcPath = path.join(srcDir, entry.name);
@@ -435,7 +457,7 @@ async function installCommand(args, config) {
       chalk.yellow(
         `\n  ⚠ ${copyFallbacks} agente(s) usaron copia en vez de symlink ` +
           '(probable Windows sin permisos de admin).\n' +
-          "    Re-ejecutá 'super install' tras cada upgrade para refrescar los archivos."
+          "    Re-ejecutá 'super install' tras cada upgrade; la copia se espeja y elimina runtimes viejos."
       )
     );
   }

package/bin/commands/mcp-setup.js

@@ -2,7 +2,8 @@
  * MCP Setup Command
  * =================
  * Configures the official Microsoft MCP servers for an existing project-local
- * Claude Code plugin and legacy adapter formats.
+ * BI Superpowers plugin. Normal multi-agent setup is user-level via
+ * `super install --all --yes`; this command refuses arbitrary repo-local writes.
  *
  * Usage:
  *   super mcp-setup
@@ -20,6 +21,7 @@ const {
   createMcpConfigForFormat,
   mergeMcpConfig,
 } = require('../lib/microsoft-mcp');
+const { readJsonStrict, writeJson } = require('../lib/mcp-config');
 
 const MCP_CONFIGS = {
   'claude-plugin': {
@@ -110,21 +112,7 @@ function hasLocalPluginMarker(targetDir) {
   );
 }
 
-function readJson(filePath) {
-  if (!fs.existsSync(filePath)) {
-    return {};
-  }
-
-  try {
-    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
-  } catch (error) {
-    return {};
-  }
-}
-
 function writeConfig(filePath, config, dryRun) {
-  const directory = path.dirname(filePath);
-
   if (dryRun) {
     tui.info(`Would write: ${tui.formatPath(filePath)}`);
     tui.muted(JSON.stringify(config, null, 2).slice(0, 220) + '...');
@@ -132,11 +120,7 @@ function writeConfig(filePath, config, dryRun) {
   }
 
   try {
-    if (!fs.existsSync(directory)) {
-      fs.mkdirSync(directory, { recursive: true });
-    }
-
-    fs.writeFileSync(filePath, JSON.stringify(config, null, 2) + '\n');
+    writeJson(filePath, config);
     return true;
   } catch (error) {
     tui.error(`Failed to write ${filePath}: ${error.message}`);
@@ -168,8 +152,14 @@ function mcpSetupCommand(args, config) {
     );
   }
 
-  if (!options.tool && !hasLocalPluginMarker(targetDir)) {
-    tui.warning('mcp-setup is only for project-local Claude Code plugin configs.');
+  if (options.tool && !MCP_CONFIGS[options.tool]) {
+    tui.error(`Unknown tool: ${options.tool}`);
+    tui.info(`Available tools: ${Object.keys(MCP_CONFIGS).join(', ')}`);
+    process.exit(1);
+  }
+
+  if (!hasLocalPluginMarker(targetDir)) {
+    tui.warning('mcp-setup is only for existing project-local BI Superpowers plugin configs.');
     tui.info(
       'For Codex, GitHub Copilot, Gemini CLI, Kilo Code, and Claude Code user-level installs, run:'
     );
@@ -178,7 +168,7 @@ function mcpSetupCommand(args, config) {
       'That writes user-level skills and MCP config under your home directory without creating files in this repo.'
     );
     tui.info(
-      'If you intentionally need a local Claude Code plugin, run `super kickoff` first or pass `--tool claude-plugin`.'
+      'If you intentionally need local Claude Code plugin files, run `super kickoff` first, then rerun `super mcp-setup` inside that initialized repo.'
     );
     process.exitCode = 2;
     return;
@@ -187,12 +177,6 @@ function mcpSetupCommand(args, config) {
   let configuredTools = loadConfiguredTools(targetDir);
 
   if (options.tool) {
-    if (!MCP_CONFIGS[options.tool]) {
-      tui.error(`Unknown tool: ${options.tool}`);
-      tui.info(`Available tools: ${Object.keys(MCP_CONFIGS).join(', ')}`);
-      process.exit(1);
-    }
-
     configuredTools = [options.tool];
   }
 
@@ -225,13 +209,19 @@ function mcpSetupCommand(args, config) {
   configuredTools.forEach((tool) => {
     const toolConfig = MCP_CONFIGS[tool];
     const filePath = path.join(targetDir, toolConfig.configPath);
-    const existingConfig = readJson(filePath);
-    const generatedConfig = createMcpConfigForFormat(toolConfig.format, {
-      packageDir: config.packageDir,
-      launcherMode: getLauncherMode(targetDir, config.packageDir, tool),
-    });
-    const mergedConfig = mergeMcpConfig(existingConfig, generatedConfig, toolConfig.format);
-    const ok = writeConfig(filePath, mergedConfig, options.dryRun);
+    let ok = false;
+
+    try {
+      const existingConfig = readJsonStrict(filePath) || {};
+      const generatedConfig = createMcpConfigForFormat(toolConfig.format, {
+        packageDir: config.packageDir,
+        launcherMode: getLauncherMode(targetDir, config.packageDir, tool),
+      });
+      const mergedConfig = mergeMcpConfig(existingConfig, generatedConfig, toolConfig.format);
+      ok = writeConfig(filePath, mergedConfig, options.dryRun);
+    } catch (error) {
+      tui.error(`Failed to prepare ${filePath}: ${error.message}`);
+    }
 
     if (ok) {
       results.success.push(toolConfig.name);

package/bin/commands/watch.js

@@ -238,7 +238,7 @@ async function regenerateConfigs(targetDir, specificTool, cliModule) {
     } else {
       // Fallback: just report what would be done
       spinner.succeed(`Would regenerate configs for: ${tools.join(', ')}`);
-      tui.muted('Note: Run "bi-superpowers recharge" manually to apply changes');
+      tui.muted('Note: Run "super recharge" manually to apply changes');
     }
   } catch (error) {
     spinner.fail(`Regeneration failed: ${error.message}`);

package/bin/lib/generators/shared.js

@@ -204,9 +204,9 @@ function getFormatFooter() {
 
 ## Resources
 
-- Library: \`library/snippets/\` - DAX, Power Query, Excel patterns
-- Themes: \`library/themes/power-bi/\` - JSON theme files
-- Examples: \`library/examples/\` - Reference implementations
+- Skills: \`skills/*/SKILL.md\` - BI workflow instructions
+- Report design references: \`skills/report-design/references/\` - PBIR layouts, themes, native visuals, and troubleshooting
+- Runtime scripts: \`skills/report-design/scripts/\` - PBIR visual, theme, and validation helpers
 
 ---
 

package/bin/lib/mcp-config.js

@@ -15,7 +15,7 @@
  *   | GitHub Copilot  | ~/.copilot/mcp-config.json            | JSON servers      |
  *   | Codex           | ~/.codex/config.toml                  | TOML mcp_servers  |
  *   | Gemini CLI      | ~/.gemini/settings.json               | JSON mcpServers   |
- *   | Kilo Code       | ~/.kilocode/mcp_settings.json         | JSON mcpServers   |
+ *   | Kilo Code       | ~/.kilo/mcp_settings.json             | JSON mcpServers   |
  *
  * The launcher path for the Power BI Modeling MCP is resolved to an
  * absolute path at install time so it works in agents that don't
@@ -121,10 +121,9 @@ function assertNotSymlink(filePath) {
  *
  * Known Windows gap: this uses `lstatSync().isSymbolicLink()`. NTFS
  * junctions are NOT classified as symlinks by Node, so a junction at
- * `~/.copilot` would pass this check. Documented as a residual risk
- * in `coordination/TO_CODEX_REVIEW.md`; addressing it needs
- * `fs.readlinkSync` with reparse-point inspection and is out of scope
- * for this commit.
+ * `~/.copilot` would pass this check. Addressing that needs
+ * `fs.readlinkSync` with reparse-point inspection and is tracked as
+ * a separate hardening task.
  *
  * @throws {Error} if any ancestor of filePath (up to home) is a symlink
  */
@@ -194,6 +193,11 @@ function assertPathSafeForWrite(filePath) {
  */
 function writeFileAtomic(filePath, content) {
   assertPathSafeForWrite(filePath);
+  const tmpPath = `${filePath}.tmp`;
+  const backupPath = `${filePath}.bak`;
+  assertPathSafeForWrite(tmpPath);
+  assertPathSafeForWrite(backupPath);
+
   const dir = path.dirname(filePath);
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true });
@@ -201,7 +205,7 @@ function writeFileAtomic(filePath, content) {
 
   if (fs.existsSync(filePath)) {
     try {
-      fs.copyFileSync(filePath, `${filePath}.bak`);
+      fs.copyFileSync(filePath, backupPath);
     } catch (err) {
       throw new Error(
         `Could not back up ${filePath} before writing: ${err.message}. ` +
@@ -210,7 +214,6 @@ function writeFileAtomic(filePath, content) {
     }
   }
 
-  const tmpPath = `${filePath}.tmp`;
   try {
     fs.writeFileSync(tmpPath, content);
     fs.renameSync(tmpPath, filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luquimbo/bi-superpowers",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "description": "Open-source Power BI Desktop toolkit for Claude Code, GitHub Copilot, Codex, Gemini CLI, and Kilo Code. Ships 4 skills and 2 official Microsoft MCP servers.",
   "main": "bin/cli.js",
   "bin": {

package/skills/bi-start/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "bi-start"
 description: "Use when the user asks about BI Start Skill, especially phrases like \"bi-start\", \"bi start\", \"/bi-start\", \"empezar\", \"comenzar\", \"arranco\"."
-version: "4.1.4"
+version: "4.1.6"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/bi-start.md instead. -->

package/skills/bi-start/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.4";
+const BUNDLED_INSTALLED_VERSION = "4.1.6";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/pbi-connect/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "pbi-connect"
 description: "Use when the user asks about Power BI MCP Connection Skill, especially phrases like \"connect Power BI\", \"PBI connection\", \"MCP connection\", \"Power BI MCP\", \"modeling mcp\", \"Power BI Modeling MCP\"."
-version: "4.1.4"
+version: "4.1.6"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/pbi-connect.md instead. -->

package/skills/pbi-connect/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.4";
+const BUNDLED_INSTALLED_VERSION = "4.1.6";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/project-kickoff/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "project-kickoff"
 description: "Use when the user asks about Project Kickoff Skill, especially phrases like \"I'm starting a brand-new BI project from scratch\", \"analizar proyecto\", \"analyze project\", \"project kickoff\", \"nuevo proyecto\", \"new project\"."
-version: "4.1.4"
+version: "4.1.6"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/project-kickoff.md instead. -->

package/skills/project-kickoff/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.4";
+const BUNDLED_INSTALLED_VERSION = "4.1.6";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/skills/report-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "report-design"
 description: "Use when the user asks about Report Design Skill, especially phrases like \"crear reportes\", \"armar el reporte\", \"diseñar reporte\", \"report design\", \"create reports\", \"build dashboard\"."
-version: "4.1.4"
+version: "4.1.6"
 ---
 
 <!-- Generated by BI Agent Superpowers. Edit src/content/skills/report-design.md instead. -->

package/skills/report-design/scripts/update-check.js

@@ -47,7 +47,7 @@ const HTTPS_TIMEOUT_MS = 5000;
 // Rewritten at generation time when this helper is copied into
 // `skills/<name>/scripts/update-check.js`. In the canonical source under
 // `bin/commands/`, it stays null and we fall back to package.json.
-const BUNDLED_INSTALLED_VERSION = "4.1.4";
+const BUNDLED_INSTALLED_VERSION = "4.1.6";
 
 // ---------------------------------------------------------------------------
 // Argument parsing

package/src/content/base.md

@@ -34,7 +34,7 @@ You are a **Business Intelligence Expert** with deep knowledge of:
 2. **Show examples** - Include code samples when relevant
 3. **Explain context** - Why something works, not just how
 4. **Suggest improvements** - Proactively identify optimizations
-5. **Reference patterns** - Point to relevant snippets in `library/`
+5. **Verify against shipped resources** - Use bundled skill references and scripts when available; do not invent paths that are not present in the repo
 
 ---
 
@@ -59,13 +59,14 @@ You are a **Business Intelligence Expert** with deep knowledge of:
 
 ---
 
-## Available Skills (3)
+## Available Skills (4)
 
 | Skill | Purpose | Trigger |
 |-------|---------|---------|
-| `/project-kickoff` | Analyze a BI project, build the semantic model, and write AGENTS.md | "analyze project", "get started", "kickoff" |
+| `/bi-start` | Open a BI session with update check, environment snapshot, and routing guidance | "bi-start", "start session", "empezar" |
+| `/project-kickoff` | Analyze and plan a BI project before implementation | "analyze project", "new project", "kickoff" |
 | `/pbi-connect` | Connect to Power BI Desktop via the official Modeling MCP | "connect Power BI", "MCP" |
-| `/report-design` | Generate 3-page PBIR report via `pbi-cli-tool` (cards, charts, matrix, slicers) | "crear reportes", "report design", "dashboard" |
+| `/report-design` | Generate PBIR report pages via bundled Node scripts and the current `pbi-cli-tool` runtime flow | "crear reportes", "report design", "dashboard" |
 
 ---
 

package/src/content/routing.md

@@ -60,13 +60,14 @@ Match user message against skill triggers:
 
 | Keywords | Skill |
 |----------|-------|
-| "kickoff", "analyze project", "analizar proyecto", "empezar", "qué tengo aquí?" | `/project-kickoff` |
+| "bi-start", "start session", "empezar", "what can you do here?" | `/bi-start` |
+| "kickoff", "analyze project", "analizar proyecto", "qué tengo aquí?" | `/project-kickoff` |
 | "connect Power BI", "MCP connection", "Power BI Desktop", "conectar Power BI", "modeling mcp" | `/pbi-connect` |
 | "crear reportes", "armar reporte", "report design", "dashboard", "páginas del reporte", "visualizaciones" | `/report-design` |
 
 ### 5. DEFAULT BEHAVIOR
 
-No skill activated → respond as general BI assistant using AGENTS.md context, referencing `library/` snippets when available in the user's project.
+No skill activated → respond as a general BI assistant using AGENTS.md context and the installed BI Superpowers skills. Do not reference `library/` snippets unless the user's project actually contains that folder.
 
 ---