@outsidestudio/agent-kit 0.2.3 → 0.3.1

package/README.md

@@ -14,6 +14,8 @@ bunx @outsidestudio/agent-kit add product-backend web-frontend
 
 Installs **stack**: every run is additive, so installing one profile never removes another profile's entries — run them in any order, as often as you like. `agent-kit remove <target>` takes something out again.
 
+**Auto-update.** bunx caches its copy of the kit. From **0.2.3** a cached copy checks npm's `latest` on startup and transparently reruns the new version with your arguments, so bare commands stay current (`AGENT_KIT_NO_UPDATE_CHECK=1` to opt out). Copies older than 0.2.3 cannot self-update: run `bunx @outsidestudio/agent-kit@latest update` once; the bare form updates itself from then on.
+
 That command:
 
 1. Detects which tools are installed (`opencode`, `omp`). Use `--tool` to choose.
@@ -56,11 +58,11 @@ src/adapters/        one adapter per tool (opencode.ts, omp.ts)
 {
   "description": "Product backend developers",
   "extends": ["shared"],
-  "include": ["context-mode", "outside/product-backend-skills"]
+  "include": ["outside/product-backend-skills", "security-audit"]
 }
 ```
 
-`shared` is the base every department extends: the LLM provider, company skills, Superpowers, Context7 and Anthropic's document skills (docx, pdf, pptx, xlsx).
+`shared` is the base every department extends: the LLM provider, company skills, Superpowers, Context7, context-mode and Anthropic's document skills (docx, pdf, pptx, xlsx).
 
 ### Registry item kinds
 
@@ -92,16 +94,16 @@ src/adapters/        one adapter per tool (opencode.ts, omp.ts)
   "fallback": { "type": "git", "repo": "https://github.com/obra/superpowers.git", "path": "skills" } }
 ```
 
-**`provider`**: an OpenAI-compatible model endpoint (our vast.ai models). The provider id in each tool is the registry id with `/` replaced by `-`, so the model id `nvidia/Qwen2.8-Flash-Next-NVFP4` in `outside/llm` appears as `outside-llm/nvidia/Qwen2.8-Flash-Next-NVFP4`.
+**`provider`**: an OpenAI-compatible model endpoint (our vast.ai models). The provider id in each tool is the registry id with `/` replaced by `-`, so the model id `nvidia/Qwen3.8-Flash-Next-NVFP4` in `outside/llm` appears as `outside-llm/nvidia/Qwen3.8-Flash-Next-NVFP4`.
 
 ```json
 { "kind": "provider", "name": "Outside LLM",
   "baseURL": "${OUTSIDE_LLM_BASE_URL}", "apiKey": "${OUTSIDE_LLM_API_KEY}",
-  "models": { "nvidia/Qwen2.8-Flash-Next-NVFP4": {
-    "name": "Qwen2.8 Flash Next (NVFP4)", "contextWindow": 131072, "maxTokens": 32768,
+  "models": { "nvidia/Qwen3.8-Flash-Next-NVFP4": {
+    "name": "Qwen3.8 Flash Next (NVFP4)", "contextWindow": 131072, "maxTokens": 32768,
     "reasoning": true, "input": ["text", "image"],
     "thinking": { "mode": "effort", "efforts": ["low", "medium", "high"], "defaultLevel": "medium" } } },
-  "defaultModel": "nvidia/Qwen2.8-Flash-Next-NVFP4" }
+  "defaultModel": "nvidia/Qwen3.8-Flash-Next-NVFP4" }
 ```
 
 Model metadata is endpoint-specific — the same model id behind a different gateway has different limits — so each provider item carries the numbers for the server it points at. The kit maps `contextWindow`/`maxTokens` to OMP's `contextWindow`/`maxTokens` and OpenCode's `limit.context`/`limit.output`, `input` to OpenCode `modalities.input`, and passes `thinking` through to OMP.
@@ -121,27 +123,12 @@ Model metadata is endpoint-specific — the same model id behind a different gat
 
 **JSONC.** If `opencode.json` has comments, they are removed when the kit rewrites it (the backup keeps them).
 
+**Caveats.** OMP also reads other tools' configs (`opencode.json`, `.claude`, …): same-named MCP servers dedupe (OMP's own `mcp.json` wins), but a skill installed in several places may appear twice. OpenCode caches git plugins — if an update doesn't show up, clear OpenCode's plugin cache and restart it.
+
 ## Adding things
 
 - **Custom skill**: `agent-kit new skill product-backend/rate-limiting`, write the SKILL.md, open a PR. Everyone gets it on their next `update`.
 - **New department**: add `profiles/<dept>.json` and `skills/<dept>/` (`new skill <dept>/<name>` creates the registry entry for you).
 - **Third-party item**: add a `registry/<id>.json` (put your own under `registry/outside/`), then add the id to profiles.
 - **New tool** (Codex, Cursor…): write `src/adapters/<tool>.ts` implementing `Adapter` and list it in `src/adapters/index.ts`.
-
-## Publishing
-
-Pick one:
-
-- **Private npm registry** (GitHub Packages, Verdaccio): `npm publish`, then devs run `bunx @outsidestudio/agent-kit add <profile>`. Point the `@outsidestudio` scope at your registry in `~/.npmrc` or `bunfig.toml`.
-- **Straight from GitHub**, no registry: `bunx github:madebyoutside/agent-kit <profile>`.
-
-**Auto-update.** bunx reuses its cached copy of the kit; from **0.2.3** a cached copy checks npm's `latest` on startup and transparently reruns the new version with your arguments — bare commands stay current, no `@latest` needed. Set `AGENT_KIT_NO_UPDATE_CHECK=1` to opt out. Copies older than 0.2.3 cannot self-update: if a new command errors (e.g. `Unknown target "add"`), run `bunx @outsidestudio/agent-kit@latest update` once; from then on the bare form updates itself.
-
-## Things to verify for your setup
-
-- **Base URL.** Put a stable gateway (LiteLLM, Cloudflare Tunnel) in front of vast.ai so `OUTSIDE_LLM_BASE_URL` doesn't change when instances are recreated.
-- **Model list.** Replace `qwen3-coder` in `registry/outside/llm.json` with the model ids your server actually serves (`curl $OUTSIDE_LLM_BASE_URL/models`).
-- **Document skills.** Anthropic's docx/pdf/pptx/xlsx skills shell out to `python3` (and LibreOffice/pandoc for some conversions). `agent-kit doctor` warns when `python3` is missing; install the rest only if you use those flows.
-- **OMP plugins.** Superpowers has no `omp` entry yet, so OMP gets its skills via the fallback. Add `"omp": { "plugin": "..." }` if `omp plugin install` supports it.
-- **OpenCode plugin cache.** OpenCode caches git plugins. If an update doesn't show up, clear OpenCode's plugin cache and restart it.
-- **Duplicates in OMP.** OMP also reads other tools' configs (`opencode.json`, `.claude`, …). Same-named MCP servers dedupe (OMP's own `mcp.json` wins), but a skill installed in several places may appear twice.
+- **Release**: bump `version` in `package.json`, commit, `npm publish --access public`, push. `latest` propagates in ~1-2 min; machines on 0.2.3+ pick it up on their next bare `bunx` run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outsidestudio/agent-kit",
-  "version": "0.2.3",
+  "version": "0.3.1",
   "description": "One-command setup of skills, MCP servers and model providers for OpenCode and OMP",
   "type": "module",
   "bin": {

package/profiles/pm.json

@@ -1 +1,9 @@
-{"description":"Product managers","extends":["shared"],"include":["outside/pm-skills"]}
+{
+  "description": "Product managers",
+  "extends": [
+    "shared"
+  ],
+  "include": [
+    "outside/pm-skills"
+  ]
+}

package/profiles/product-backend.json

@@ -1 +1,10 @@
-{"description":"Product backend developers","extends":["shared"],"include":["context-mode","outside/product-backend-skills"]}
+{
+  "description": "Product backend developers",
+  "extends": [
+    "shared"
+  ],
+  "include": [
+    "outside/product-backend-skills",
+    "security-audit"
+  ]
+}

package/profiles/shared.json

@@ -1 +1,11 @@
-{"description":"Base setup every profile extends","include":["outside/llm","outside/shared-skills","superpowers","context7","anthropic/document-skills"]}
+{
+  "description": "Base setup every profile extends",
+  "include": [
+    "outside/llm",
+    "outside/shared-skills",
+    "superpowers",
+    "context7",
+    "context-mode",
+    "anthropic/document-skills"
+  ]
+}

package/profiles/web-frontend.json

@@ -1 +1,9 @@
-{"description":"Web / frontend developers","extends":["shared"],"include":["context-mode","outside/web-frontend-skills"]}
+{
+  "description": "Web / frontend developers",
+  "extends": [
+    "shared"
+  ],
+  "include": [
+    "outside/web-frontend-skills"
+  ]
+}

package/registry/security-audit.json

@@ -0,0 +1,7 @@
+{
+  "kind": "skills",
+  "description": "Cloudflare's security-audit skill: security guidance, focused reviews and full multi-agent codebase audits",
+  "source": { "type": "git", "repo": "https://github.com/cloudflare/security-audit-skill.git", "path": "skills" },
+  "only": ["security-audit"],
+  "requires": ["node"]
+}

package/skills/pm/outside-prd-writer/SKILL.md

@@ -15,5 +15,3 @@ Structure every PRD as:
 6. Open questions and risks
 
 Ask for missing evidence instead of inventing it.
-
-<!-- Placeholder content. Replace with your real PRD template. -->

package/skills/product-backend/outside-db-migrations/SKILL.md

@@ -10,5 +10,3 @@ description: Use when creating, editing or reviewing database migrations in Outs
 3. Add indexes concurrently on large tables.
 4. Split schema changes and data backfills into separate migrations.
 5. Run the migration locally up and down before opening a PR.
-
-<!-- Placeholder content. Replace with your real migration rules. -->