@mmerterden/multi-agent-pipeline 20.34.0 → 20.36.0

package/CHANGELOG.md

@@ -16,6 +16,75 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.36.0] - 2026-10-31
+
+### Added
+
+- `/multi-agent:office-pair`: one command for pairing a phone with the office. It opens the QR page, waits for the phone, asks the user whether both screens show the same comparison code, and enrols or cancels. `office-pair.mjs start --terminal` draws the QR in a terminal window, only when its output is a terminal, so captured output never holds the one-time secret.
+
+### Fixed
+
+- `office-pair.mjs start` without a relay names the missing setting (`global.office.remote.relayUrl` or `--relay`) instead of reporting that the relay URL is not a URL.
+
+### Security
+
+- Development tooling resolves `minimatch` 11.0.3 and `glob` 14.0.3 through npm `overrides` (GHSA-g3hv-75wg-m249, GHSA-3g3m-2fjr-6pw4). Both are pulled in by eslint and c8 only; nothing in the published package depends on them.
+
+## [20.35.0] - 2026-10-27
+
+### Added
+
+- Office: each person wears their own sheet, recoloured at build time from the CC0 character sheets (`office-art/employees.json`), with a name, agent and model tier; clicking a person opens their card, and a Building window lists every room and who works there.
+- Office remote layer, first part: `features/office-remote-protocol.md` (the end-to-end layer, relay, pairing and passkey tiers around the existing signed phone routes) and `lib/office-remote.mjs`, the machine side of its cryptography: P-256 ECDH with HKDF into one AES-256-GCM key per direction, counter nonces that refuse replays, the pairing envelope keyed with the one-time secret, the comparison code, and the WebAuthn assertion check.
+- Office remote client: `office-remote-client.mjs` polls the relay, opens each frame with the paired device's key, applies the passkey tier (read session, low-risk window, per-request for launch), forwards only phone routes to the loopback server without an `Authorization` header and seals the reply; one audit line per frame without bodies or header values. `office-on` starts it only when a device is paired, `office-off` stops it.
+- Office pairing: `office-pair.mjs start | wait | confirm <code> | cancel` registers a pairing with the relay (only the SHA-256 of the machine's relay token leaves the machine), shows the QR code on the local screen through the dependency-free encoder in `lib/qr-code.mjs`, opens the phone's sealed pairing message with the one-time secret carried in the link fragment, and enrols the device with scopes `read,answer` only after the comparison code is typed back. `phone-devices.mjs revoke` also drops the device's remote keys; `office-status` reports remote access as off, configured or paired.
+
+- `answer-check.sh`, a PostToolUse hook on AskUserQuestion: a question the user submitted without a choice is named back to the model, so it is asked again instead of resolved to the Recommended option. Registered by `install` in every session; it only adds context.
+- `worktree-prepare-all.mjs` creates a multi-repo task's worktrees in one step and, when a repo fails, rolls back what it created: worktrees without `--force`, and a branch only when it created that branch and it still points at `origin/<base>`. Phase 0 uses it for multi-repo runs; `worktree-prepare.sh` reports `newBranch`.
+- `test-stability-gate.mjs` compares the repeated runs (`.pipeline/repeat-<k>.junit.xml`) of the new and changed tests: a test whose outcome differs across runs, a missing run or a test that failed every time is not GREEN.
+
+### Changed
+
+- agent-guard asks on a `git commit` from the session driving an attended run (where prompts are off it denies until `confirm-command.mjs` records the user's yes), and inside that run refuses a commit subject with no conventional type or over 72 characters, and a PR, issue or Jira body with a literal `\n` or an HTML entity outside code.
+- `prefs.global.attendedCommitGate.mode` defaults to `auto`: a commit by the session driving the run is refused without the run's build and test evidence, and from Phase 4 on without a passing `review-decision`, which attended runs now record. Other sessions are warned as before; `warn`, `block` and `off` still apply when set.
+- Triage judges anonymized findings end to end: the verdict carries each finding's `foundBy` label (or a gate `tag`) instead of a reviewer name, `validate-triage.mjs --anonymized` refuses a verdict that names a reviewer, and `anonymize-findings.mjs --restore` writes the reviewer family back from the label map after validation.
+- `scope-check-gate.mjs --rejected <triage> --rework-base <rev>` lists `rejectedTouched[]`: findings triage rejected whose lines a rework hunk changed. Phase 2 records the reviewed commit per review round with `rework-base.mjs record` (`.pipeline/rework-base-<N>`).
+- `validate-planning.mjs --spec` checks UI tasks against the analysis Section 6 inventory: a task touching a view file names its component in the new `design` field, and the name must be a Section 6 row.
+- `update-issue-progress.sh` exits 5 without editing the issue unless the account has commented on it since the run started with the template's `Ref: #N` footer: the comment and the Progress flags go together. `--comment-file` posts the comment first through the outbound gate; the unattended runner's issue update uses it with the PR link. Issue coordinates that are not an owner/repo and a number exit 6.
+- `write-state.mjs` refuses to leave Phase 2 of an attended run with a tracked issue unless `phases["2"].trackerStatus` is `verified`, `declined` or `not-tracked`. A run already in Phase 2 when this lands records the status once before it moves on.
+- `task-mirror.sh` records a phase tile's id as its `tasklist_id` and notes a tile created after a higher-numbered phase's tile.
+- `write-state.mjs` refuses to leave Phase 1 of an attended full run without `phases["1"].planApprovedAt`, and refuses to change a `sessionId` already set (exit 6, nothing written). Autopilot, background launches and analysis mode are not asked for a plan approval.
+- A run cannot complete while a repo's commit has no recorded push: `projects[].pushStatus` must be `pushed`, `rebase-pushed` or `skipped`, or the repo has a pull request. `pushStatus` is declared in the state schema.
+- agent-guard: a closing keyword in a `gh pr create/edit --title` or in a commit message asks first; AI attribution in a gh pull request or issue title, body, body file or comment is blocked; `vercel` with `--token` is refused; `purge.sh`, `prune-logs.sh --yes` and `run-kill.mjs apply` ask first; a stored secret read with nothing capturing or consuming its output is refused.
+- `pre-commit-check.sh` refuses signing material and keystores (`.p12`, `.p8`, `.mobileprovision`, `.jks`, `.keystore` ...) and `Pods/`, `.build/`, `DerivedData/` paths by name, binaries included; `.DerivedData/` joins the clone-local exclude list.
+- `run-scope-guard` also registers on `Bash|WebFetch`: a Figma read over HTTP (figma.com, api.figma.com) after analysis is denied under the same phase rule, and a direct write to `agent-state.json` or `tracker-state.json` (Edit/Write, a redirect or `tee`) is denied in any session. The wrapper starts node only when the payload mentions Figma or a state file.
+- The test-integrity gate flags a test switched off (`XCTSkip`, `.skip(`, `xit(`, `@Disabled`, `@Ignore`, `@pytest.mark.skip`, `t.Skip(`, a `.disabled` trait) as a blocking `disabled-test` finding; a conditional skip is left alone.
+- `worktree-prepare.sh` refuses a worktree outside `<project>/.worktrees/` and a new branch outside `feature/`, `bugfix/`, `hotfix/`, `release/`; an existing branch, local or on origin, is re-entered as it is.
+- agent-guard asks before a POST or PUT to a Jira comment, a Confluence page or a Slack webhook, and refuses a Bitbucket pull request PUT whose body has no reviewers, fromRef or toRef (the PUT replaces the record and would wipe them).
+- agent-guard refuses a side effect from a read-only subagent (one whose definition denies it Write), identified by the hook's `agent_type`: run-state writes, git commit or push, write requests with curl-like clients, and gh pull request, issue and api writes. Reads stay open.
+- `run-scope-guard` denies `AskUserQuestion` from a bound autopilot run (it derives or records a halt) and `git add -A`, `--all` or `.` inside a bound run (files are staged by name); it now registers on `Bash|WebFetch|AskUserQuestion`.
+- `validate-planning.mjs --spec` refuses a raw pixel or point value in a task when the spec carries a Figma design; values are named by design token.
+- `gate-ledger.mjs append` pauses the run on the fourth consecutive failing `evidence-gate/build` or `evidence-gate/test` verdict (status `paused`, `haltReason <phase>:retry-cap`, exit 5): the three-attempt fix loop ends on a record.
+- A commit inside a live pipeline run is refused when its author (`--author`, `-c user.email=`, or the repository's config) is not the identity Phase 0 chose (`run-commit-check.mjs`, called from the commit hook; silent outside a bound run).
+- `phase-tracker.sh init` refuses to re-initialize a tracker that already holds phases; `--force` starts it over.
+- `phase0-exit-gate.mjs` fails below the published version floor, reading the answer Step 0.6 cached (`update-check.sh --cache-only`, any age, never the network).
+
+### Fixed
+
+- File locks (`json-file-lock.mjs`, `write-state.mjs`) read a lock's PID and its identity through one descriptor, and reclaim a dead holder's lock by moving it aside first. Read by path twice, a lock released and re-acquired in between looked like a dead holder's, and the live one was deleted, so two writers held it and one update was lost.
+
+### Added
+
+- Office: the pull request window ranks open pull requests by graph reach, the number of files that depend on what each one changes, read from that repository's own code graph. A repository with no graph says so instead of ranking. Served by a new local-only route `GET /v1/prs/reach` (`work-items.mjs reach`); contract 1.7.0 adds `pr-reach.schema.json`.
+
+### Changed
+
+- Every skill companion file over 100 lines (references, patterns, templates beside a `SKILL.md`) now opens with a generated table of contents, as the multi-agent-refs already did. `gen-ref-toc.mjs` covers `pipeline/skills/` and takes `--dir <skills-tree>` for the plugin marketplace; a file with fewer than three sections at its section depth lists the depth below as well.
+- Skill text that aged with the calendar no longer does: `app-store-review` drops "As of May 2026", and `google-play-compliance` points at its Rule 1 for the target API level instead of quoting a number in prose. `google-play-compliance` and `channels` name the MCP server and say when they apply.
+- `google-play-compliance` Rule 1 carries the current target API requirement: 36 for new apps and updates on phones and tablets from 31 Aug 2026 (extension to 1 Nov 2026), 35 on Wear OS and Automotive, 34 on TV and XR.
+- The bulk reader and Phase 3 triage write terse machine fields (a short phrase per `why` / `reason`), keeping every negation, number and path; the explorer already did.
+- `test/project.test.mjs` also holds optional, peer and bundled dependencies at zero and the development tooling to its recorded set.
+
 ## [20.34.0] - 2026-10-26
 
 ### Added
@@ -157,7 +226,6 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 - `prefs.global.readOnlyRepos[]`: checkouts that may not be edited, committed or pushed.
 - `/multi-agent:doctor` reports template hooks that are not registered or not executable and preferences that no registered hook enforces. The installer registers the run hooks itself, records them in `multi-agent-hook-manifest.json` after settings.json is written, and does not re-add a hook the user removed.
 
-
 ## [20.28.0] - 2026-10-24
 
 ### Added

package/README.md

@@ -158,7 +158,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 69 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 70 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -392,6 +392,7 @@ the page with a one-time code; the server runs until `/multi-agent:office-off`.
 | ---------------------------- | --------------------------------------------------------------- |
 | `/multi-agent:office-on`     | Start or reuse the server and open the page                     |
 | `/multi-agent:office-status` | Whether it runs, its URL (never the token) and its last actions |
+| `/multi-agent:office-pair`   | Pair a phone: QR, wait, compare the code, enrol                 |
 | `/multi-agent:office-off`    | Stop the server; it runs until you do                           |
 
 Security model: [office threat model](pipeline/multi-agent-refs/features/office-threat-model.md).
@@ -452,17 +453,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 69 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 70 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + the enforcement hooks (secret scan, agent-guard, read-size gate, run-scope guard, run-stop guard) |
-| Copilot CLI | `--copilot`          | instructions + 69 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 69 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 70 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 70 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 69.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 70.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single
@@ -504,6 +505,7 @@ The **secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a co
 | `run-stop-guard.sh` (no silent stop mid-run) | Stop | none: halts stay the phase's own write | none |
 | `task-mirror.sh` (native task list into the run tracker, so the office shows it) | PostToolUse `TaskCreate`/`TaskUpdate` | none: the phase calls `phase-tracker.sh task` itself | none: the phase calls `phase-tracker.sh task` itself |
 | `file-context.sh` (what the repo's memory says about a file, after it is read) | PostToolUse `Read` | none | none |
+| `answer-check.sh` (an AskUserQuestion submitted without a choice is asked again, not defaulted) | PostToolUse `AskUserQuestion` | none | none |
 | `edit-syntax-gate.sh` | PostToolUse file edits | PostToolUse `apply_patch` | none: Copilot discards postToolUse output |
 | `check-read-size.sh`, capture hooks | registered | none | none |
 

package/README.tr.md

@@ -157,7 +157,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 69 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 70 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -392,6 +392,7 @@ başlatır ve sayfayı tek kullanımlık bir kodla açar; sunucu
 | ---------------------------- | -------------------------------------------------------- |
 | `/multi-agent:office-on`     | Sunucuyu başlatır ya da var olanı kullanır, sayfayı açar |
 | `/multi-agent:office-status` | Çalışıyor mu, adresi (token asla) ve son işlemleri       |
+| `/multi-agent:office-pair`   | Telefonu eşle: QR, bekle, kodu karşılaştır, kaydet       |
 | `/multi-agent:office-off`    | Sunucuyu durdurur; sen durdurana kadar çalışır           |
 
 Güvenlik modeli: [ofis tehdit modeli](pipeline/multi-agent-refs/features/office-threat-model.md).
@@ -452,17 +453,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 69 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 70 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 69 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 69 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 70 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 70 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 69 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 70 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te

package/docs/architecture.md

@@ -113,7 +113,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>69 command files]
+        CMD[commands/<br/>70 command files]
         AGT[agents/<br/>11 agent personas]
         RUL[rules/<br/>13 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -204,8 +204,8 @@ repo and the website, plus the two independently shipped repos
 ```mermaid
 graph TD
     CC["Claude Code<br/>(source of truth)"]
-    COP["Copilot CLI<br/>(instructions + 69 sub-command skills)"]
-    COD["Codex CLI<br/>(1 router skill + 69 refs)"]
+    COP["Copilot CLI<br/>(instructions + 70 sub-command skills)"]
+    COD["Codex CLI<br/>(1 router skill + 70 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(6 plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 69 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 70 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 6 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 197 MCP tools across 21 categories (simulator/emulator control, end-to-end locators and assertions, memory, crash diagnostics, accessibility audit, store compliance, web automation and scraping, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index with text-to-image rendering, provider-backed research, verified hand-off of simple text tasks to free models, video key frames, offline security scoring, read-only access to related repositories at their latest branch, travel document fixtures, a voice channel, App Store Connect and Play Console APIs, virtual iPhones) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 69 commands"]
+        PHASES["6 phases · 70 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>69 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 69 refs<br/>+ 11 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>70 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 70 refs<br/>+ 11 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -161,7 +161,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 69 slash-command skills, native | 69 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 69 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 70 slash-command skills, native | 70 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 70 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-26",
-  "version": "20.34.0",
+  "generatedAt": "2026-10-31",
+  "version": "20.36.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -35,9 +35,9 @@
     "autopilot": [0, 1, 2, 3, 4, 5],
     "analysis": [0, 1, 2, 3, 4, 5]
   },
-  "commandCount": 69,
+  "commandCount": 70,
   "skillCount": 165,
-  "skillCountAll": 237,
+  "skillCountAll": 238,
   "agentCount": 11,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
   "toolCount": 213,