@pulsarinteractive/geniustasker 0.1.0-beta.2 → 0.1.0-beta.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.0-beta.3 — 2026-09-30
+
+- MIT license for the client, skills and documentation; third-party license notices.
+- Consistent source formatting, ESLint checks and pinned CI actions.
+- Architecture, testing and contribution guides.
+- Canonical Pulsar Interactive repository links.
+
 ## 0.1.0-beta.2 — 2026-09-30
 
 - Public standalone repository, synthetic tests and CI.

package/CONTRIBUTING.md

@@ -1,17 +1,72 @@
 # Contributing
 
-Use Node.js 22.13+ and `npm ci`. Run `npm test` and `npm run check` before a change.
-Tests run with synthetic data. Never add real account records or credentials.
+Thanks for helping improve GeniusTasker's agent integrations. This repository
+contains the CLI, local MCP server, skills and integration documentation.
 
-Keep authentication, scope boundaries, immutable journals, bounded reads and
-structured errors intact. Feature availability comes from live capabilities;
-no CLI command may bypass service admission or permissions.
+## Development setup
 
-`src/command-catalog.mjs` is a reviewed public contract snapshot. It is generated
-upstream, not hand edited here. Contract changes arrive as a bounded client-facing
-snapshot; no private backend, configuration or internal generator belongs in this
-repository. Runtime, packaging and skill changes are maintained here.
+Use Node.js 22.13 or newer and npm:
 
-Do not add install/postinstall hooks, credential collection, telemetry, background
-polling or automatic public publishing as part of an unrelated contribution.
-See [Releasing](docs/RELEASING.md) for the explicit release workflow.
+```sh
+npm ci
+npm run verify
+```
+
+Local tests need no GeniusTasker account. They use temporary files, synthetic
+identities, loopback servers and the official MCP client SDK.
+
+## Code conventions
+
+- Use ECMAScript modules and explicit `node:` imports for Node built-ins.
+- Format with `npm run format`; ESLint enforces recommended checks, strict
+  equality, unused-variable detection and braces on control statements.
+- Choose names that explain the operation. Keep parsing, authentication, HTTP
+  transport, persistence and MCP presentation in their respective modules.
+- Document exported entry points and invariants. Explain why a failure needs
+  special treatment; comments should not repeat the next line of code.
+- Inject clocks, network calls and cancellation signals where behavior needs
+  deterministic tests. Avoid new global state, background daemons or polling.
+- Prefer a focused helper when it clarifies responsibility. Avoid abstraction
+  that hides credential ownership, lock lifetime or retry decisions.
+
+The [architecture guide](docs/ARCHITECTURE.md) describes module responsibilities
+and the authentication, write and change-feed lifecycles.
+
+## Behavioral compatibility
+
+CLI JSON output, exit codes, MCP tool names and command envelopes are public
+interfaces. Changes must preserve existing callers or be documented as a breaking
+change. Keep stdout reserved for protocol output; diagnostics belong on stderr.
+
+Validate input at the boundary. Surface errors through `AgentError` with a stable
+code and useful remediation. Never relay raw provider exceptions or credentials.
+A command must preserve origin, account, profile and operation identity. An
+uncertain write may only retry its saved immutable request; a revision conflict
+requires rereading the resource. Access and quotas remain server-enforced.
+
+`src/command-catalog.mjs` is a generated interface snapshot. Submit contract
+updates with their generation provenance and review the client-facing diff;
+do not hand-edit generated schemas. Third-party schemas also remain unchanged.
+
+## Tests and documentation
+
+Add regression coverage for observable changes, including relevant failures and
+cancellation. Use synthetic data; live account exports do not belong in fixtures.
+Read [Testing](docs/TESTING.md) for the suite boundaries and focused commands.
+
+Update command help, examples, skills and relevant guides when behavior changes.
+Examples must run against documented capabilities, with placeholders for resource
+IDs and without access tokens. Keep project and Memory permissions independent.
+
+## Pull requests
+
+Describe the user-visible problem, the behavior after the change and the checks
+performed. Keep unrelated changes separate. Run `npm run verify` and review the
+archive inventory before proposing distribution changes. Security reports belong
+in the repository's private reporting channel, as described in [Security](SECURITY.md).
+
+## Licensing
+
+Contributions to the client, skills and documentation are accepted under the
+[MIT license](LICENSE). Third-party material retains its original license and
+must have clear provenance and notices. See [Third-party notices](THIRD_PARTY_NOTICES.md).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pulsar Interactive
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/LICENSES/Apache-2.0.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -3,6 +3,7 @@
 Keep project progress, collaborators and your own AI agents in one place.
 This repository contains the public **CLI, local MCP server and agent skills**.
 The GeniusTasker application and service implementation are separate.
+Canonical repository: [PulsarInteractive/geniustasker-agent-tools](https://github.com/PulsarInteractive/geniustasker-agent-tools).
 
 [Install](#install-and-connect) · [Codex and Claude](docs/INTEGRATIONS.md) ·
 [CLI reference](docs/CLI.md) · [OpenAI plugin](docs/OPENAI.md) · [Releases](CHANGELOG.md)
@@ -28,7 +29,7 @@ Production agent access is not open in this beta.
 After logging in with the `work` context:
 
 ```sh
-codex mcp add geniustasker -- npx -y @pulsarinteractive/geniustasker@0.1.0-beta.2 mcp --context work
+codex mcp add geniustasker -- npx -y @pulsarinteractive/geniustasker@0.1.0-beta.3 mcp --context work
 ```
 
 Other stdio MCP hosts can use [examples/mcp.json](examples/mcp.json).
@@ -57,13 +58,13 @@ plugin. The hosted HTTPS MCP/OAuth integration remains a separate milestone in
 
 ```sh
 npm ci
-npm test
-npm run check
+npm run verify
 ```
 
 Tests use synthetic fixtures and local mock servers. CI has no production credentials.
 `npm run check` checks the public file boundary, package contents and plugin schema.
-See [Contributing](CONTRIBUTING.md) and [Release process](docs/RELEASING.md).
+See [Contributing](CONTRIBUTING.md), [Architecture](docs/ARCHITECTURE.md),
+[Testing](docs/TESTING.md) and [Release process](docs/RELEASING.md).
 
 ## Privacy and source boundary
 
@@ -72,5 +73,9 @@ private product documents belong here. Only the agent client and its public
 interface contract are included. Credentials stay in the user's private local
 store; never paste them into an issue. See [Security](SECURITY.md).
 
-Source is visible; package licensing remains `UNLICENSED`. No general open-source
-reuse license or license to the separate GeniusTasker application is implied.
+## License
+
+The CLI, MCP server, skills and documentation are available under the
+[MIT license](LICENSE). See [third-party notices](THIRD_PARTY_NOTICES.md) for
+vendor components. The separately hosted GeniusTasker application and backend
+are not part of this repository.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,15 @@
+# Third-party notices
+
+## Agent Plugins JSON schemas
+
+`tools/schemas/plugin.schema.json` and `tools/schemas/mcp.schema.json` are
+unmodified Agent Plugins 1.0.0 JSON schemas, used for development validation.
+
+- Project: [Agent Plugins specification](https://github.com/agentplugins/agent-plugins-spec)
+- Source: [version 1.0.0 schemas](https://github.com/agentplugins/agent-plugins-spec/tree/main/schemas/1.0.0)
+- License: Apache-2.0, as stated in the [upstream licensing notice](https://github.com/agentplugins/agent-plugins-spec/blob/main/LICENSE.md)
+- Full license: [LICENSES/Apache-2.0.txt](LICENSES/Apache-2.0.txt)
+
+These schemas retain their original license. The MIT license for GeniusTasker's
+client does not replace their terms. npm dependencies retain the licenses
+included in their respective packages.

package/docs/ARCHITECTURE.md

@@ -0,0 +1,104 @@
+# Client architecture
+
+The CLI and MCP server share one delegated client. The client communicates with
+the GeniusTasker service; it does not execute an agent's external workflow.
+Projects and account memories are independent resources with explicit grants.
+
+```mermaid
+flowchart LR
+  CLI[CLI commands] --> Client[AgentClient]
+  Host[Agent host] --> MCP[Local stdio MCP]
+  MCP --> Client
+  CLI --> Journal[CommandJournal]
+  MCP --> Journal
+  Journal --> Client
+  Client --> Store[Private context store]
+  Client --> HTTP[Bounded HTTP transport]
+  HTTP --> API[GeniusTasker API]
+```
+
+## Module responsibilities
+
+| Module                | Responsibility                                                              |
+| --------------------- | --------------------------------------------------------------------------- |
+| `cli.mjs`             | Argument validation, context/environment selection, output and exit status  |
+| `login.mjs`           | Browser PKCE consent, loopback callback validation and optional device flow |
+| `store.mjs`           | Private local files, atomic replacement and inter-process locking           |
+| `client.mjs`          | Origin-bound sessions, serialized renewal, profile selection and reads      |
+| `transport.mjs`       | Allowed origins/routes, timeouts, size limits and sanitized API failures    |
+| `commands.mjs`        | Validated command envelopes and durable immutable operation journals        |
+| `profiles.mjs`        | Bounded profile discovery, creation, restriction and selection              |
+| `changes.mjs`         | Validated incremental reads and bounded, cancellable waits                  |
+| `mcp.mjs`             | Strict tool schemas and protocol-safe responses over stdio                  |
+| `errors.mjs`          | Stable errors, safe serialization and CLI exit codes                        |
+| `command-catalog.mjs` | Generated public interface definitions and limits                           |
+
+## Authentication and renewal
+
+1. The user starts `auth login` outside the MCP process. Browser consent selects
+   resources and permissions; the CLI receives a one-use code through a validated
+   loopback callback and exchanges it using PKCE.
+2. Credentials are validated against the expected origin and identity before being
+   written. Local storage uses a dedicated context and restrictive permissions.
+3. Before renewal, the client acquires the context lock and persists a
+   `refreshPending` marker. Concurrent processes cannot renew the same credential
+   family simultaneously.
+4. A successful, validated response replaces both tokens atomically. An uncertain
+   response leaves the marker intact and requires reconnecting. It must not replay
+   a possibly consumed refresh token.
+5. Logout revokes the server session before deleting local credentials. A failed
+   revoke retains the local state for recovery.
+
+Separate contexts give terminals independent consented sessions. Sharing a context
+shares its identity and locks. Profile selection can narrow access; it cannot
+restore a broader grant or extend the server's absolute session lifetime.
+
+## Writes and recovery
+
+A domain command carries its scope, epoch, current revision, operation ID and
+issue time. `prepare` validates and saves the complete request locally without
+performing a domain write. The journal binds it to an origin, connection, profile
+and session.
+
+```mermaid
+stateDiagram-v2
+  [*] --> prepared: save validated draft
+  prepared --> uncertain: persist before sending
+  uncertain --> confirmed: validate and save receipt
+  uncertain --> uncertain: explicit identical retry
+  confirmed --> confirmed: return saved receipt
+```
+
+A timeout or malformed receipt does not establish whether the server committed.
+The operation stays uncertain. The caller can retry the same saved request; it
+cannot replace the body under the same ID or replay it after an identity change.
+A conflict requires a fresh read and a new operation. The journal never stores
+authentication tokens.
+
+Profile changes use a separate lifecycle: creation keeps the caller's UUID,
+restriction uses a current revision, and selection rotates credentials while
+holding the context lock. They are not domain-journal operations.
+
+## Reads and change cursors
+
+Resource reads are bounded and permission-filtered. Callers preserve inventory
+epoch/checkpoint fields while paging and follow continuation even when a page is
+empty. A cursor does not grant access. Change pages validate scope, collection,
+revision and shape before advancing saved state.
+
+`watch` performs one bounded wait. It honors the server's polling interval and
+cancellation; quota errors, expired history and revocation stop the wait. There is
+no background subscription daemon or automatic monthly-limit retry loop.
+
+## Transport and extension points
+
+Requests are confined to delegated API routes and approved origins. Redirects
+are refused. Requests and responses are size-bounded; raw network exceptions
+never become user-facing diagnostic text. CLI stdout and MCP stdout stay free of
+logging and browser-authentication prompts.
+
+Add a public capability by updating its generated contract, boundary validation,
+client operation, CLI/MCP adapter, failure tests and user documentation together.
+Prefer existing transport and storage primitives. A future remote MCP adapter is
+a separate integration described in [OpenAI integration](OPENAI.md); the current
+local plugin manifest must not imply that endpoint already exists.

package/docs/CLI.md

@@ -1,4 +1,4 @@
-# GeniusTasker CLI & MCP · private beta
+# GeniusTasker CLI and MCP reference
 
 Connect your own AI tools to your projects: read progress, work on tickets,
 comment, ask questions and keep a useful handoff. Your account and project
@@ -156,7 +156,6 @@ Protocol references: [OAuth device authorization](https://www.rfc-editor.org/rfc
 [OAuth metadata](https://www.rfc-editor.org/rfc/rfc8414), and the
 [official MCP TypeScript SDK](https://github.com/modelcontextprotocol/typescript-sdk).
 
-
 ## Prepare, execute and recover writes
 
 Request the relevant permissions when connecting, for example:
@@ -222,8 +221,7 @@ record bodies; read them separately if your grant permits it.
 Local validation includes separate processes sharing one write, immutable retry
 after lost responses, strict inputs, receipt validation and an official MCP
 client communicating through stdio to actual Worker/SQLite domain services.
-Hosted owner acceptance and named product integrations remain separate gates.
-
+Compatibility with each agent host requires its own connection test.
 
 ## Agent profiles and terminal identity
 
@@ -267,7 +265,6 @@ the previous usable credentials; read the profile list again. An unknown rotatio
 outcome requires logout/login, just like an unknown refresh. Credentials never
 appear in selection results, CLI output, MCP tool results or package artifacts.
 
-
 ## Ask a human on a ticket
 
 Request `questions:write` explicitly when connecting; an existing comments grant
@@ -314,7 +311,6 @@ an open anonymous question's public checkpoint.
 profile can close only questions it created. It cannot answer on behalf of its
 owner, impersonate another profile, or use a poll result as new authorization.
 
-
 ## Work updates and handoffs
 
 Prepare `task.report` through the normal command journal with the current task
@@ -329,7 +325,6 @@ comment. Completing/reopening a ticket clears its current phase. A report is
 progress information, not approval or proof independently verified by Tasker.
 Correct published reports with a new report; never rewrite an older receipt.
 
-
 ## Ask for approval of one precise action
 
 Connect with `approvals:write` explicitly, alongside the read grants needed to
@@ -374,8 +369,8 @@ Only the CLI/MCP source, its generated public command catalog, bundled agent ski
 and the selected guide/plugin files are distributed. Application source, infrastructure configuration,
 private product documents, test identities and credentials are excluded. No
 installation script runs and no background daemon or telemetry is installed.
-The package is distributed for the GeniusTasker beta; no open-source license has
-been granted. The public agent-tools repository contains only the standalone client.
+The standalone client and skills are distributed under the MIT license.
+Third-party components retain their original licenses.
 
 ## Independent memories
 

package/docs/INTEGRATIONS.md

@@ -7,8 +7,8 @@ are selected in the browser and enforced by the service on every request.
 ## Codex: direct MCP
 
 ```sh
-npx -y @pulsarinteractive/geniustasker@0.1.0-beta.2 auth login --context work
-codex mcp add geniustasker -- npx -y @pulsarinteractive/geniustasker@0.1.0-beta.2 mcp --context work
+npx -y @pulsarinteractive/geniustasker@0.1.0-beta.3 auth login --context work
+codex mcp add geniustasker -- npx -y @pulsarinteractive/geniustasker@0.1.0-beta.3 mcp --context work
 ```
 
 Restart the host as needed, then inspect its MCP list. Ask the agent to read its
@@ -43,7 +43,7 @@ available in the execution environment. Authenticate the `work` context first.
 The repository also has `.agents/plugins/marketplace.json` for local distribution:
 
 ```sh
-codex plugin marketplace add alexisnaud/geniustasker-agent-tools
+codex plugin marketplace add PulsarInteractive/geniustasker-agent-tools
 ```
 
 Use the host's Plugins interface to select and enable GeniusTasker. This local

package/docs/OPENAI.md

@@ -9,20 +9,19 @@ Nothing here is an OpenAI directory approval or a hosted remote MCP endpoint.
 
 ## Hosted plugin milestone
 
-| Work | Acceptance |
-| --- | --- |
-| HTTPS Streamable HTTP MCP adapter | Real initialize, tools/list and tool calls; reuse existing product commands and quotas |
-| MCP OAuth compatibility | Protected-resource and authorization discovery, audience/resource binding, supported client registration, allowed callbacks, PKCE, expiry and revocation |
-| Host authentication | Real browser consent, resource-limited reads, denied access and reauthentication |
-| Writes | Explicit grants, correctly annotated tools, immutable retries and conflicts; no blanket approval |
-| Optional company-knowledge search | Authorized search/fetch with user-openable citations and bounded results |
-| Plugin review | Accurate install copy, privacy/terms links, domain verification, real test account, honest limitations |
+| Work                              | Acceptance                                                                                                                                               |
+| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| HTTPS Streamable HTTP MCP adapter | Real initialize, tools/list and tool calls; reuse existing product commands and quotas                                                                   |
+| MCP OAuth compatibility           | Protected-resource and authorization discovery, audience/resource binding, supported client registration, allowed callbacks, PKCE, expiry and revocation |
+| Host authentication               | Real browser consent, resource-limited reads, denied access and reauthentication                                                                         |
+| Writes                            | Explicit grants, correctly annotated tools, immutable retries and conflicts; no blanket approval                                                         |
+| Optional company-knowledge search | Authorized search/fetch with user-openable citations and bounded results                                                                                 |
+| Plugin review                     | Accurate install copy, privacy/terms links, domain verification, real test account, honest limitations                                                   |
 
 The current CLI OAuth flow is a foundation; it is not proof that every hosted
 MCP client's registration and resource-discovery requirements are implemented.
-Do not add a pretend `/mcp` URL or registered OpenAI application ID to manifests.
-Only map a registered server after it exists and passes host acceptance. Embedded
-UI is optional and should follow actual product tasks.
+A hosted manifest requires a deployed and tested MCP server and a registered
+application identifier. Embedded UI is optional.
 
 The remotely hosted backend can remain private. A public source repository is a
 client distribution and review surface, not an access grant to user data.

package/docs/RELEASING.md

@@ -1,7 +1,7 @@
 # Release process
 
 1. Update package, lockfile, MCP server version, plugin version and example pins together.
-2. Review public contract/skill changes and run `npm ci`, `npm test`, `npm run check` and `npm audit`.
+2. Review public contract/skill changes and run `npm ci`, `npm run verify` and `npm audit`.
 3. Inspect `git diff` and the complete `npm pack --dry-run --json` list. No private repository history or product files may enter this repo.
 4. Pack and inspect the actual archive. `npm publish <archive> --access public --tag beta` requires the maintainer's npm authentication.
 5. Confirm registry version/tag/integrity, install using a fresh cache and exercise real MCP through an explicitly authorized beta account. Keep private results outside this repository.
@@ -11,5 +11,6 @@ CI runs tests and package/privacy checks. It never publishes npm or deploys the
 service. Future trusted publishing should use a reviewed OIDC setup rather than
 committing an npm token; it is not configured by this repository.
 
-The `v0.1.0-beta.1` tag preserves the original published runtime. Its informational
-`doctor.publication` text is outdated; beta.2 corrects it. npm versions are immutable.
+Published npm versions are immutable. Use a new version for package changes.
+
+Canonical repository: https://github.com/PulsarInteractive/geniustasker-agent-tools