@mutmutco/kilo-plugin 3.125.0 → 3.127.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "3.125.0",
+  "version": "3.127.0",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/hook-run.mjs

@@ -343,7 +343,7 @@ export async function runPolicyGate({ surface, gate: gateId, input = Buffer.allo
   hookSurface(surface);
   const root = pluginRoot(surface, env, here);
   const target = join(root, 'scripts', gate.script);
-  const normalizedInput = normalizeInput(surface, gateId, input);
+  const normalizedInput = normalizeInput(surface, gateId, stripUtf8Bom(input));
   const effectiveEnv = childEnv(surface, normalizedInput, env);
   let result;
 
@@ -395,6 +395,16 @@ export async function runPolicyGate({ surface, gate: gateId, input = Buffer.allo
   };
 }
 
+/** #4878: Cursor's Windows payload transport pipes the hook payload through PowerShell with
+ *  `$OutputEncoding = [System.Text.Encoding]::UTF8` — the BOM-EMITTING encoder — so the JSON arrives
+ *  prefixed with EF BB BF. JSON.parse refuses a BOM, every parse in this chain (normalizeInput,
+ *  payloadMeta, the gate scripts) came back empty, and the fail-open no-payload arm (#2992) silently
+ *  waved the call through. Stripped once at the gate entry so every consumer parses the same bytes. */
+function stripUtf8Bom(input) {
+  const buffer = Buffer.from(input);
+  return buffer[0] === 0xef && buffer[1] === 0xbb && buffer[2] === 0xbf ? buffer.subarray(3) : buffer;
+}
+
 function readStdin() {
   try {
     return readFileSync(0);

package/skills/bootstrap/SKILL.md

@@ -3,6 +3,8 @@ name: bootstrap
 description: Provision a repo into the org with board, registry, rules, and plugin setup.
 ---
 
+**Host-native invocation:** Claude `/mmi:bootstrap` · Codex `$mmi:bootstrap` · jervcode/Kimi `/skill:bootstrap` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /bootstrap — provision a repo into the org
 
 The one-time onboarding that turns a repo into a first-class org citizen. **Master-admin only, run from

package/skills/browser-automation/SKILL.md

@@ -3,6 +3,8 @@ name: browser-automation
 description: Use DOM-first Playwright MCP for browser work.
 ---
 
+**Host-native invocation:** Claude `/mmi:browser-automation` · Codex `$mmi:browser-automation` · jervcode/Kimi `/skill:browser-automation` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # Browser automation — DOM-first Playwright MCP
 
 Org standard for agent browser work on Claude Code. **Playwright** is the engine; agents interact through **structure-first** MCP tools, not pixels-first defaults.

package/skills/hotfix/SKILL.md

@@ -3,6 +3,8 @@ name: hotfix
 description: Promote an already-merged development fix to main and production through the gated Hub train.
 ---
 
+**Host-native invocation:** Claude `/mmi:hotfix` · Codex `$mmi:hotfix` · jervcode/Kimi `/skill:hotfix` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /hotfix — promote a development fix to main + prod
 
 A hotfix is promotion, not authoring. The fix must land on `development` through a normal issue,

package/skills/mmi-doctor/SKILL.md

@@ -3,6 +3,8 @@ name: mmi-doctor
 description: One hygiene pass — mmi-cli doctor heals and cleans by default.
 ---
 
+**Host-native invocation:** Claude `/mmi:mmi-doctor` · Codex `$mmi:mmi-doctor` · jervcode/Kimi `/skill:mmi-doctor` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /mmi-doctor — one hygiene pass
 
 One command. Run it when a session opens messy or before a handoff.

package/skills/onboard/SKILL.md

@@ -3,6 +3,8 @@ name: onboard
 description: Guided first session — readiness check, repo status, and the first command to run.
 ---
 
+**Host-native invocation:** Claude `/mmi:onboard` · Codex `$mmi:onboard` · jervcode/Kimi `/skill:onboard` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /onboard — guided first session
 
 For a developer's first session in a repo (or a fresh checkout): confirm the repo is wired into the org,

package/skills/rcand/SKILL.md

@@ -3,6 +3,8 @@ name: rcand
 description: Promote development to a release-candidate branch.
 ---
 
+**Host-native invocation:** Claude `/mmi:rcand` · Codex `$mmi:rcand` · jervcode/Kimi `/skill:rcand` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /rcand — promote development to release-candidate
 
 Merge `development → rc`, tag `vX.Y.0-rc.N`, push (the GitHub authority gate), then dispatch the rc deploy

package/skills/release/SKILL.md

@@ -3,6 +3,8 @@ name: release
 description: Ship rc or direct-track development to main and production.
 ---
 
+**Host-native invocation:** Claude `/mmi:release` · Codex `$mmi:release` · jervcode/Kimi `/skill:release` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /release — ship to main + prod
 
 Full-track repos ship **exactly what is on `rc`** (never pulls `development`): merge `rc → main`, tag

package/skills/resume/SKILL.md

@@ -3,6 +3,8 @@ name: resume
 description: Open a session — self-check, repo status, and the next actionable board item in one pass.
 ---
 
+**Host-native invocation:** Claude `/mmi:resume` · Codex `$mmi:resume` · jervcode/Kimi `/skill:resume` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /resume — start of session
 
 One flow to re-anchor at the top of a session: is the toolchain sound, what does this repo/worktree look

package/skills/secrets/SKILL.md

@@ -3,6 +3,8 @@ name: secrets
 description: Manage the full own-project vault and granted org-infra secret names.
 ---
 
+**Host-native invocation:** Claude `/mmi:secrets` · Codex `$mmi:secrets` · jervcode/Kimi `/skill:secrets` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /secrets — two-tier project secrets
 
 **Authority:** a project-admin self-serves their own product repo's full vault tree (`mmi-cli oracle org access

package/skills/stage/SKILL.md

@@ -3,6 +3,8 @@ name: stage
 description: Run a local test stage, or a personal cloud dev stage with --live.
 ---
 
+**Host-native invocation:** Claude `/mmi:stage` · Codex `$mmi:stage` · jervcode/Kimi `/skill:stage` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /stage — local test environment
 
 A throwaway **local** environment to exercise the current branch — a dev server / local stack, plus

package/skills/worktree/SKILL.md

@@ -3,6 +3,8 @@ name: worktree
 description: Orchestrate a worktree from create to landed PR, tied to board status.
 ---
 
+**Host-native invocation:** Claude `/mmi:worktree` · Codex `$mmi:worktree` · jervcode/Kimi `/skill:worktree` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+
 # /worktree — create → work → land
 
 Drive an item through an isolated worktree: cut it from latest `development`, claim the board item, do the