@pilotspace/add 1.7.1 → 1.7.3

package/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to the ADD method (`@pilotspace/add` on npm,
 `pilotspace-add` on PyPI) are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/); versions follow semver.
 
+## [1.7.3] — 2026-06-18
+
+Multi-agent installer reach (`multi-agent-installer`). Additive; no breaking
+changes — the non-interactive byte stream is unchanged for existing agents and
+the engine (`add.py`) is byte-identical.
+
+### Added
+- **Seven new agent profiles in the installer** — `add init` now detects and
+  onboards **Cursor, Windsurf, Trae, GitHub Copilot, Cline, Aider, and Gemini
+  CLI** (best-effort env detection, overridable in the interactive picker), in
+  addition to Claude Code, Codex, and OpenCode. Each gets the context file it
+  actually auto-loads: `AGENTS.md` for most, `.clinerules` for Cline. Unknown
+  agents still degrade to the generic `AGENTS.md`. Mirrored byte-for-decision
+  across both installer twins (`bin/cli.js` + `src/add_method/_installer.py`).
+- **Gemini CLI settings wiring (`.gemini/settings.json`)** — because Gemini CLI
+  auto-loads `GEMINI.md` (not `AGENTS.md`), the installer now performs a
+  fail-soft, idempotent, key-preserving merge of `.gemini/settings.json` so its
+  `context.fileName` includes `AGENTS.md` — the installer's first JSON-config
+  write. Re-running is a no-op; a malformed or unwritable settings file warns and
+  is skipped without aborting the install.
+
+### Changed
+- **Onboarding docs name the full agent set** — the README ("Works with your
+  agent") and `GETTING-STARTED.md` now list all ten supported agents and how
+  each loads ADD; only Claude Code runs the `/add` skill natively, every other
+  agent follows the same loop through the phase guides via the CLI.
+
+## [1.7.2] — 2026-06-18
+
+Test-coverage and project-hygiene patch. Additive; no breaking changes.
+
+### Added
+- **PTY harness for clack interactive coverage (`installer-smarts-polish`)** — a
+  reusable PTY test helper (`tooling/pty_clack.py`) drives the clack
+  select/confirm prompts, so the agent-select step and the interactive
+  happy-path are exercised under a real pseudo-terminal in CI (previously
+  node-syntax-checked and logic-unit-tested only).
+- **`SECURITY.md` security policy** — supported-version table, private
+  vulnerability reporting via GitHub Security Advisories, and response SLAs;
+  shipped in both the npm tarball and the PyPI sdist/wheel.
+
+### Changed
+- **Brand tagline** — refreshed to *"One skill. Eight steps. Five disciplines.
+  Every feature ships through the loop."* across the README, the npm/PyPI
+  package descriptions, and the Claude Code plugin manifest.
+
 ## [1.7.1] — 2026-06-18
 
 Installer depth and method quality release: the onboarding installer gains

package/GETTING-STARTED.md

@@ -135,8 +135,11 @@ python3 .add/tooling/add.py status
 `add.py status` is the resume point: project stage, active task, current phase.
 And `add.py guide` tells you what the current phase needs — its `guide  :` line
 names the exact phase-guide file to read (`.claude/skills/add/phases/…` — plain
-markdown), which is how **any** agent — Claude, Cursor, Copilot, Codex — follows
-ADD through the CLI alone.
+markdown), which is how **any agent** — Claude Code, Codex, OpenCode, Cursor,
+Windsurf, Trae, Gemini CLI, GitHub Copilot, Cline, Aider — follows ADD through the
+CLI alone. The installer detects which one you're in and drops the file it reads
+(`CLAUDE.md`, `AGENTS.md`, or `.clinerules`; for Gemini CLI it also wires
+`.gemini/settings.json`).
 
 > Tip: shorten typing with an alias — `alias add="python3 .add/tooling/add.py"` —
 > then you can run `add status`, `add guide`, etc. These are override and resume

package/README.md

@@ -1,5 +1,7 @@
 # ADD — AI-Driven Development
 
+**One skill. Eight steps. Five disciplines. Every feature ships through the loop.**
+
 > A minimal, state-tracked Claude Code skill for building software when the AI
 > writes the code and **you** own the two things it cannot do alone: decide *what*
 > to build, and *verify* it is correct.
@@ -115,6 +117,13 @@ ADD is AI-first: you talk to the agent; it drives the method. In Claude Code, ru
 
 > `/add` — *"I want to let users transfer money between their own accounts."*
 
+**Works with your agent.** The installer detects which coding agent you're in and
+drops the context file it reads — so ADD drives through the CLI under **Claude Code,
+Codex, OpenCode, Cursor, Windsurf, Trae, Gemini CLI, GitHub Copilot, Cline, and
+Aider** (anything else falls back to a generic `AGENTS.md`). Only Claude Code runs
+the `/add` skill natively; every other agent follows the same loop through the
+phase guides via `add.py status` / `guide`.
+
 The agent orients from `state.json`, **sizes your request into a milestone** (you
 confirm the shape), then drafts each feature's **specification bundle** — Spec +
 Scenarios + Contract + Tests as one bundle — and you give **one approval at the
@@ -149,6 +158,13 @@ be upset to lose is "the code," you're still working the old way.
 Start at [`docs/README.md`](./docs/README.md) — Foundations → the six steps →
 operating it across a team → templates, prompts, and a full worked example.
 
+## What's next
+
+**Dynamic Agent Skills** — the next scope: skills that adapt at runtime to the
+project's current state, stage, and active phase rather than loading a static
+guide. The agent picks the right depth and tooling automatically as the project
+evolves.
+
 ## Develop
 
 ```bash

package/SECURITY.md

@@ -0,0 +1,48 @@
+# Security Policy
+
+ADD (AI-Driven Development) ships as [`@pilotspace/add`](https://www.npmjs.com/package/@pilotspace/add)
+on npm and [`pilotspace-add`](https://pypi.org/project/pilotspace-add/) on PyPI. This policy
+covers both distributions and the engine/tooling in this repository.
+
+## Supported Versions
+
+Security fixes land on the latest minor release line. Older lines are not
+back-patched — upgrade to the latest `1.7.x` to receive fixes.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.7.x   | :white_check_mark: |
+| < 1.7   | :x:                |
+
+To check your installed version: `python3 .add/tooling/add.py status` (project),
+`pip show pilotspace-add`, or `npm ls @pilotspace/add`.
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security reports.**
+
+Report privately through one of:
+
+- **GitHub Security Advisories** (preferred) — open a private report via the
+  repository's **Security → Report a vulnerability** tab. This keeps the details
+  confidential until a fix ships.
+- **Email** — `tindang.ht97@gmail.com` with subject `SECURITY: <short summary>`.
+
+Please include:
+
+- the affected version, platform, and install channel (npm / PyPI / source);
+- a description of the issue and its impact;
+- reproduction steps or a proof of concept, if available.
+
+### What to expect
+
+- **Acknowledgement** within **3 business days** of your report.
+- **Triage assessment** (accepted / needs-info / declined, with rationale)
+  within **10 business days**.
+- For **accepted** reports: a coordinated fix and release, with credit to you in
+  the release notes unless you prefer to remain anonymous. We will keep you
+  updated on remediation progress.
+- For **declined** reports: an explanation of why the issue falls outside the
+  project's threat model.
+
+Please give us a reasonable window to release a fix before any public disclosure.

package/bin/cli.js

@@ -91,6 +91,27 @@ const AGENT_PROFILES = [
   { id: "opencode", label: "OpenCode", integration_file: "AGENTS.md",
     env: ["OPENCODE"], envPrefix: "OPENCODE",
     next_step: "Open OpenCode — it reads AGENTS.md; say what you want to build." },
+  { id: "cursor", label: "Cursor", integration_file: "AGENTS.md",
+    env: ["CURSOR_AGENT", "CURSOR_TRACE_ID"], envPrefix: "CURSOR_",
+    next_step: "Open Cursor — it reads AGENTS.md; say what you want to build." },
+  { id: "windsurf", label: "Windsurf", integration_file: "AGENTS.md",
+    env: ["WINDSURF", "WINDSURF_ENV"], envPrefix: "WINDSURF_",
+    next_step: "Open Windsurf — Cascade reads AGENTS.md; say what you want to build." },
+  { id: "trae", label: "Trae", integration_file: "AGENTS.md",
+    env: ["TRAE_AI_IDE"], envPrefix: "TRAE_",
+    next_step: "Open Trae — it reads AGENTS.md; say what you want to build." },
+  { id: "copilot", label: "GitHub Copilot", integration_file: "AGENTS.md",
+    env: ["COPILOT_AGENT"], envPrefix: null,   // NOT a GITHUB_ prefix — too broad (CI sets GITHUB_*)
+    next_step: "Open GitHub Copilot — it reads AGENTS.md; say what you want to build." },
+  { id: "cline", label: "Cline", integration_file: ".clinerules",
+    env: ["CLINE_ACTIVE"], envPrefix: "CLINE_",
+    next_step: "Open Cline — it reads .clinerules; say what you want to build." },
+  { id: "aider", label: "Aider", integration_file: "AGENTS.md",
+    env: [], envPrefix: "AIDER_",
+    next_step: "Open Aider — add AGENTS.md to its context (`.aider.conf.yml` `read:` or `--read AGENTS.md`), then say what you want to build." },
+  { id: "gemini", label: "Gemini CLI", integration_file: "AGENTS.md",
+    env: ["GEMINI_CLI", "GEMINI_SANDBOX"], envPrefix: "GEMINI_",
+    next_step: "Open Gemini CLI — ADD wired .gemini/settings.json to load AGENTS.md; say what you want to build." },
   { id: "generic", label: "your AI agent", integration_file: "AGENTS.md",
     env: [], envPrefix: null, next_step: GENERIC_NEXT },
 ];
@@ -151,7 +172,7 @@ function detectAgentEnriched(env, target, which) {
   try {
     if (target && fs.existsSync(path.join(target, "CLAUDE.md"))) return byId.claude;   // repo signal
   } catch (_e) { /* fall through */ }
-  for (const id of ["claude", "codex", "opencode"]) {
+  for (const id of ["claude", "codex", "opencode", "cursor", "windsurf", "trae", "copilot", "cline", "aider"]) {
     try { if (which(id)) return byId[id]; } catch (_e) { /* probe absent */ }   // machine signal
   }
   return base;                                         // generic
@@ -376,6 +397,48 @@ function writeIntentNote(target, intent) {
   } catch (_e) { return false; }
 }
 
+// Merge <target>/.gemini/settings.json so context.fileName includes "AGENTS.md" — the pointer
+// ADD writes for the gemini profile. Gemini CLI defaults to GEMINI.md and lets it win when both
+// exist, so AGENTS.md must be named in the config to load. Read-merge-write: preserves every other
+// key; idempotent; fail-soft (an unparsable/unwritable file warns + skips, never aborts the drop).
+// Returns created|updated|unchanged|skipped. Twin of _installer.py:_write_gemini_settings.
+function writeGeminiSettings(target) {
+  const geminiDir = path.join(target, ".gemini");
+  const settings = path.join(geminiDir, "settings.json");
+  try {
+    let data = {};
+    let created = true;
+    if (fs.existsSync(settings)) {
+      created = false;
+      let raw;
+      try { raw = fs.readFileSync(settings, "utf8"); data = JSON.parse(raw); }
+      catch (_e) {
+        warn("could not parse " + settings + " — leaving it untouched; skipped");
+        return "skipped";
+      }
+      if (data === null || typeof data !== "object" || Array.isArray(data)) {
+        warn(settings + " is not a JSON object — leaving it untouched; skipped");
+        return "skipped";
+      }
+    }
+    let context = data.context;
+    if (context === null || typeof context !== "object" || Array.isArray(context)) context = {};
+    let names = context.fileName;
+    if (typeof names === "string") names = [names];
+    else if (!Array.isArray(names)) names = [];
+    if (names.includes("AGENTS.md")) return "unchanged";   // idempotent
+    names = names.concat(["AGENTS.md"]);
+    context.fileName = names;
+    data.context = context;
+    fs.mkdirSync(geminiDir, { recursive: true });
+    fs.writeFileSync(settings, JSON.stringify(data, null, 2) + "\n");
+    return created ? "created" : "updated";
+  } catch (e) {
+    warn("could not write " + settings + " — " + (e && e.message ? e.message : e) + "; skipped");
+    return "skipped";                                      // design-for-failure: never abort the install
+  }
+}
+
 // The drop — now a RECONCILE: restore missing managed trees + refresh present ones
 // (sweep orphans) + report per-tree status. Byte-compatible handoff with the prior
 // installer. The interactive path resolves a target then calls straight into this.
@@ -389,6 +452,10 @@ function dropFiles(args, target, profile, intent) {
   // Best-effort + fail-soft — never aborts the successful drop above.
   writeAgentPointer(target, profile);
 
+  // Gemini CLI auto-loads GEMINI.md, not AGENTS.md — so for the gemini profile we ALSO merge
+  // .gemini/settings.json (context.fileName) to load the AGENTS.md pointer. Fail-soft + idempotent.
+  if (profile.id === "gemini") writeGeminiSettings(target);
+
   // Optional build-intent NOTE for `/add` to read — "" (skip / non-interactive) -> no-op.
   writeIntentNote(target, intent);
 
@@ -779,4 +846,5 @@ module.exports = {
   whichSync: whichSync,
   scopeOptions: scopeOptions,
   writeIntentNote: writeIntentNote,
+  writeGeminiSettings: writeGeminiSettings,
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pilotspace/add",
-  "version": "1.7.1",
-  "description": "ADD (AI-Driven Development) — a minimal, state-tracked Claude Code skill that drives every feature through Specify → Scenarios → Contract → Tests → Build → Verify → Observe. Ships the AIDD book as its trust layer.",
+  "version": "1.7.3",
+  "description": "ADD (AI-Driven Development). One skill. Eight steps. Five disciplines. Every feature ships through the loop — a minimal, state-tracked Claude Code skill that ships the AIDD book as its trust layer.",
   "bin": {
     "add": "bin/cli.js"
   },
@@ -23,7 +23,8 @@
     "docs/",
     "README.md",
     "GETTING-STARTED.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "keywords": [
     "ai-driven-development",

package/skill/add/SKILL.md

@@ -85,7 +85,9 @@ unsharp intent? **Interview before you size** — explore and suggest first (`in
 Once a request is classified `new-major`/`sub-milestone`, drafting the actual
 `MILESTONE.md` (goal · scope · exit criteria · breadth-first tasks) is the second
 half of intake: read `scope.md` for how to fill it well, the per-outcome behavior,
-and the confirm-before-create rule. You propose the draft; the human confirms.
+and the confirm-before-create rule. Or if it's classified `task`/`change-request`, 
+create the task with `add.py new-task` and then read the phase guide for the first phase (probably `0-setup.md`).
+You propose the draft; the human confirms.
 
 ## The flow and which file to load