@raishin/vanguard-frontier-agentic 1.9.0 → 2.0.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "1.8.0",
+  "version": "2.0.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "1.8.0",
+  "version": "2.0.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",

package/.github/plugin/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/github/copilot-cli/main/schemas/marketplace.schema.json",
   "name": "vanguard-frontier-agentic",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
-  "version": "1.8.0",
+  "version": "2.0.0",
   "owner": {
     "name": "Raishin",
     "url": "https://github.com/Raishin"

package/README.md

@@ -465,6 +465,9 @@ Everything you can install, and exactly how to install it. One section, no hunti
 | `--force`      | —                                                     | ➕ optional                              | Overwrite files that already exist                   |
 | `--list`       | —                                                     | 🔍 standalone                            | Print all agent IDs, providers, and names; then exit |
 | `--list-roles` | —                                                     | 🔍 standalone                            | Print role IDs with agent counts; then exit          |
+| `--list-providers` | —                                                 | 🔍 standalone                            | List all providers with agent counts; then exit      |
+| `--dry-run`    | —                                                     | ➕ optional                              | Print the export plan without writing files          |
+| `--no-skills`  | —                                                     | ➕ optional                              | Skip companion skill bundling                        |
 
 ---
 
@@ -575,6 +578,7 @@ npx vfa-export-agents --platform copilot --role cloud-devops-engineer --provider
 | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
 | 🔍 See what agents exist                         | `npx vfa-export-agents --list`                                                                                        |
 | 🔍 See what roles exist                          | `npx vfa-export-agents --list-roles`                                                                                  |
+| 🔍 See what providers exist                      | `npx vfa-export-agents --list-providers`                                                                              |
 | 👤 Install for my job role (Claude Code)         | `npx vfa-export-agents --platform claude-code --role <role> --repo .`                                                 |
 | ☁️ Install for my job role, one cloud only       | `npx vfa-export-agents --platform claude-code --role <role> --provider aws --repo .`                                  |
 | ☸️ Install K8s admission security role           | `npx vfa-export-agents --platform claude-code --role kubernetes-admission-security-engineer --repo .`                 |

package/catalog/asset-integrity.json

@@ -15813,7 +15813,7 @@
     },
     {
       "tree": "scripts",
-      "aggregate_sha256": "4929ac32655bf6c754b54b8acd072408e2ecb4ca2df7e820670f6cba3ceea748",
+      "aggregate_sha256": "c7cf5fccd73f10c273ecee2c09137b1bc467c0df0dba30b30d6328934dfa6ee5",
       "files": [
         {
           "path": "scripts/apply-skill-allowed-tools.py",
@@ -15827,8 +15827,8 @@
         },
         {
           "path": "scripts/export-marketplace-agents.mjs",
-          "sha256": "6e20e183e850a24b20677d1106f07b4a8d74d8b47dc081bd47f029becd400b95",
-          "bytes": 21240
+          "sha256": "6b5c1a2558d02bac69e5cfd6d4c08b0c0d51b01b277da1f1200a0eac0443e3cc",
+          "bytes": 25376
         },
         {
           "path": "scripts/gen_azure_live_guards.py",
@@ -15840,6 +15840,11 @@
           "sha256": "62cfa89e9183c5625599f2973714cc94476de80a7f588b67190ffbb12fb09010",
           "bytes": 69191
         },
+        {
+          "path": "scripts/generate-changelog-counts.mjs",
+          "sha256": "3d31b02bf758fca65dd3ecefefc00e1242d160d3885931d396f912a136b4a2d0",
+          "bytes": 1404
+        },
         {
           "path": "scripts/generate-cursor-plugin.mjs",
           "sha256": "24c9b58afc6c55be80b8e701a5fd7a64b0330d0b2836a37fa8b7b2ce5943a68b",
@@ -15857,8 +15862,8 @@
         },
         {
           "path": "scripts/release-prepare.mjs",
-          "sha256": "7f91ce7071275081d8a0a1a7be609f77b34e29dbd130abc8e92859197957a214",
-          "bytes": 3580
+          "sha256": "ec33640391c4a45e6f7c2570c177152bdeb9612e3b47daf1a88e4b41732f9301",
+          "bytes": 7408
         },
         {
           "path": "scripts/update-catalog-new-agents.py",
@@ -15950,7 +15955,7 @@
     },
     {
       "tree": "plugins",
-      "aggregate_sha256": "68da1b895dc114ca71b3b64ec2c4081f67b9301c956f022873f348ab84efca2d",
+      "aggregate_sha256": "89dbb21f326d0ee511c8cdb5ef90dac61c82136e5308c0232cc5ffbec695ee6b",
       "files": [
         {
           "path": "plugins/cross-platform-agent-template/.codex-plugin/plugin.json",
@@ -15959,14 +15964,14 @@
         },
         {
           "path": "plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json",
-          "sha256": "d04cadc1b4cc4bbd8d85073d6f0642897c23f64cb10e79e4bc13b0b670ccdf8d",
+          "sha256": "f6d1f8638ea0893a1e6b0d26c0b1ae1c9243d15cd26001c28e03e8f0d3435b77",
           "bytes": 1850
         }
       ]
     },
     {
       "tree": ".claude-plugin",
-      "aggregate_sha256": "1ada7418d40d7c6e7cf36a832a6a7e435a2c934289a3717513bf5dbc9176b569",
+      "aggregate_sha256": "8f27d61aa6898b5a91d769060783a8db823e848b44815c8edcf8c16ef1de07c2",
       "files": [
         {
           "path": ".claude-plugin/README.md",
@@ -15980,14 +15985,14 @@
         },
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "4774403f7b4587a39c690040d0cb9c536c8cc60273101e2ddd2d365cd2f67f1d",
+          "sha256": "6c9dbfeaddf0283338afb2ddad73b1d82ff0035a1ae10e959962561664582e3d",
           "bytes": 31096
         }
       ]
     },
     {
       "tree": ".cursor-plugin",
-      "aggregate_sha256": "64d4b189312b626710517998378869747801ad7f916076337c554f2eec7327ab",
+      "aggregate_sha256": "68dfb3892cbd739a86537a4a0cfeca8515f8b5f1ff9530f9d99e5e30593f83de",
       "files": [
         {
           "path": ".cursor-plugin/README.md",
@@ -15996,14 +16001,14 @@
         },
         {
           "path": ".cursor-plugin/plugin.json",
-          "sha256": "9196493107b5df130ed5b4ef0ab792d34cd926a45684e4ee53c1408cca9f667f",
+          "sha256": "f3951243263966fce5a91571dc5091287fd9494d312f5d45aaa7e2b2833b63ed",
           "bytes": 29402
         }
       ]
     },
     {
       "tree": ".github/plugin",
-      "aggregate_sha256": "880548b543ab00b34853dea0e0b5433e8e53e8ee377dc3388ba929cea19bf82a",
+      "aggregate_sha256": "a9939490f08887d2cdc2b82427a4c41c349724b84bbba227e205fb86be306a89",
       "files": [
         {
           "path": ".github/plugin/README.md",
@@ -16012,7 +16017,7 @@
         },
         {
           "path": ".github/plugin/marketplace.json",
-          "sha256": "f9b3789a86f1e6ce483b293dfa127d79a414b83be410e58e5478c61f77379c74",
+          "sha256": "d49a4e31aaaf3651aeb26dabc876a114040da8b93d32079f03220a04f092c216",
           "bytes": 790
         }
       ]
@@ -16035,7 +16040,7 @@
     },
     {
       "tree": "tests",
-      "aggregate_sha256": "8ca46e860c605cabcb3df72cde9cdc12c8a81685552070453a5219a670c2618e",
+      "aggregate_sha256": "5c3188eb58b43b6bb930296e00cded5df10ee6373490cdb0b890bf05cb8418a4",
       "files": [
         {
           "path": "tests/AGENTS.md",
@@ -20144,8 +20149,8 @@
         },
         {
           "path": "tests/test-vfa-export-coverage.test.mjs",
-          "sha256": "7c162de47eecafc2443af85a1de86ef0c249df32618c5043ddb40e3d77e9873a",
-          "bytes": 8166
+          "sha256": "88e00f7980e54ba379b32e1e04df36db51ef825a17b8d326530737e7b76e9e54",
+          "bytes": 32204
         },
         {
           "path": "tests/validate-agent-frontmatter-schema.py",
@@ -20248,13 +20253,13 @@
   "root_files": [
     {
       "path": "README.md",
-      "sha256": "04694282dff1fc5f98d7f931882203178ad74a52b70822e99389a7f847a4a2f1",
-      "bytes": 65050
+      "sha256": "7390f5d68bfd01cf4cfae66348d2af28274b9b36b3f6204247291b48fa0c5d1c",
+      "bytes": 65754
     },
     {
       "path": "SECURITY.md",
-      "sha256": "aa9b4b923339b76fb9f23bad804af52ba8eb946009ccc157db061bb4a90b208c",
-      "bytes": 7074
+      "sha256": "fac0f794caa05509f12bb8a4a1c92bc5e15e715c9cc50d06e8dcc0c0c34df8e9",
+      "bytes": 7073
     },
     {
       "path": "LICENSE",
@@ -20288,14 +20293,14 @@
     },
     {
       "path": "package.json",
-      "sha256": "4d5e9beccfb91b44b81ef9d98537285e2ee475e7b3678e66bc0dee3e2d9bf539",
-      "bytes": 5058
+      "sha256": "179f7dc13d61d4a73da23fe686d5346654848e3172667b351fd805169cd4f3fd",
+      "bytes": 5072
     },
     {
       "path": ".releaserc.js",
-      "sha256": "8f7ae05ee74e08da68ed276927a9088e7fef2d11940928c5233e1f849a61f09d",
-      "bytes": 3765
+      "sha256": "467483143385a4c5ad9be41b36d210fdc6f366d84f9a8123562c421389ce23a3",
+      "bytes": 3976
     }
   ],
-  "aggregate_sha256": "07fca8114ca214fafb9f4634127c85016f2fdfaeec5b331d1109a706f0eb6baf"
+  "aggregate_sha256": "38dc90d9be4eb7e886237f9f887499fe95967386a9521e983008827d3965fa4c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "1.9.0",
+  "version": "2.0.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,7 +32,8 @@
     "rules/",
     "mcp/",
     "templates/",
-    "assets/"
+    "assets/",
+    "tests/"
   ],
   "scripts": {
     "agents:export": "node scripts/export-marketplace-agents.mjs",

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "1.9.0",
+  "version": "2.0.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/scripts/export-marketplace-agents.mjs

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
+import { parseArgs as utilParseArgs } from "node:util";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -119,8 +120,13 @@ Selectors (mutually exclusive):
 
   --provider <p> --role <r>  → narrow the role to agents whose provider == p.
   --provider <p>             → standalone; equivalent to --all filtered to p.
-  --dry-run            Print the export plan as "export agent: <id> [provider=<p>]"
-                       lines without copying any files. Exit 0 on success.
+
+Options:
+  --repo <path>          Target repository path (default: cwd).
+  --force                Overwrite existing files without prompting.
+  --list-providers        List all providers with agent counts; then exit.
+  --dry-run              Print the export plan without writing files.
+  --no-skills            Skip companion skill bundling.
 
 Companion skills:
   By default, when --platform supports skill bundling (claude-code, copilot, gemini),
@@ -137,8 +143,8 @@ Examples:
   vfa-export-agents --platform claude-code --agents azure-cosmosdb-platform-operator-agent
   vfa-export-agents --platform claude-code --role cloud-security-engineer
   vfa-export-agents --platform claude-code --role cloud-security-engineer --provider azure
-  vfa-export-agents --platform claude-code --provider nvidia
-  vfa-export-agents --platform claude-code --provider nvidia --dry-run
+  vfa-export-agents --platform claude-code --provider aws
+  vfa-export-agents --platform claude-code --provider azure --dry-run
   vfa-export-agents --platform claude-code --all --no-skills --repo /path/to/project
   vfa-export-agents --platform kiro --agents azure-cosmosdb-platform-operator-agent --repo ../consumer-repo
   vfa-export-agents --platform copilot --all --repo /path/to/project --force
@@ -148,79 +154,71 @@ Examples:
 }
 
 function parseArgs(argv) {
-  const args = {
-    repo: process.cwd(),
-    force: false,
-    list: false,
-    listRoles: false,
-    listProviders: false,
-    all: false,
-    dryRun: false,
-    agents: [],
-    platform: null,
-    role: null,
-    provider: null,
-    noSkills: false,
-  };
+  // Use Node.js built-in util.parseArgs (stable since v18.3, available in v22):
+  // - handles --key=value inline form natively
+  // - returns null-prototype values object (prototype pollution safe)
+  // - strict mode throws a real Error for unknown flags (not a silent usage() exit)
+  let parsed;
+  try {
+    parsed = utilParseArgs({
+      args: argv,
+      strict: true,
+      allowPositionals: false,
+      options: {
+        help:             { type: "boolean", short: "h", default: false },
+        list:             { type: "boolean", default: false },
+        "list-roles":     { type: "boolean", default: false },
+        "list-providers": { type: "boolean", default: false },
+        force:            { type: "boolean", default: false },
+        all:              { type: "boolean", default: false },
+        "dry-run":        { type: "boolean", default: false },
+        "no-skills":      { type: "boolean", default: false },
+        platform:         { type: "string" },
+        role:             { type: "string" },
+        provider:         { type: "string" },
+        repo:             { type: "string" },
+        agents:           { type: "string" },
+      },
+    });
+  } catch (err) {
+    // Unknown or mistyped flags surface here with a clear message.
+    console.error(err.message);
+    usage(1);
+  }
 
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === "--help" || arg === "-h") usage(0);
-    if (arg === "--list") {
-      args.list = true;
-      continue;
-    }
-    if (arg === "--list-roles") {
-      args.listRoles = true;
-      continue;
-    }
-    if (arg === "--list-providers") {
-      args.listProviders = true;
-      continue;
-    }
-    if (arg === "--force") {
-      args.force = true;
-      continue;
-    }
-    if (arg === "--all") {
-      args.all = true;
-      continue;
-    }
-    if (arg === "--dry-run") {
-      args.dryRun = true;
-      continue;
-    }
-    if (arg === "--no-skills") {
-      args.noSkills = true;
-      continue;
-    }
-    if (arg === "--repo") {
-      args.repo = path.resolve(argv[++i] ?? "");
-      continue;
-    }
-    if (arg === "--platform") {
-      args.platform = argv[++i] ?? "";
-      continue;
-    }
-    if (arg === "--agents") {
-      args.agents = (argv[++i] ?? "")
-        .split(",")
-        .map((value) => value.trim())
-        .filter(Boolean);
-      continue;
-    }
-    if (arg === "--role") {
-      args.role = argv[++i] ?? "";
-      continue;
-    }
-    if (arg === "--provider") {
-      args.provider = argv[++i] ?? "";
-      continue;
+  const v = parsed.values;
+  if (v.help) usage(0);
+
+  // Validate --provider: empty string and whitespace-only are rejected.
+  // unicode zero-width chars (e.g. U+200B) pass trim() in some engines so
+  // the downstream format regex /^[a-z0-9][a-z0-9-]*$/ acts as a second gate.
+  const providerRaw = v.provider ?? null;
+  if (providerRaw !== null) {
+    const provVal = providerRaw.trim();
+    if (!provVal) {
+      throw new Error(
+        "--provider requires a non-empty value. " +
+        "Run 'vfa-export-agents --list-providers' for valid options."
+      );
     }
-    usage(1);
   }
 
-  return args;
+  return {
+    repo:          v.repo ? path.resolve(v.repo) : process.cwd(),
+    force:         v.force ?? false,
+    list:          v.list ?? false,
+    listRoles:     v["list-roles"] ?? false,
+    listProviders: v["list-providers"] ?? false,
+    all:           v.all ?? false,
+    dryRun:        v["dry-run"] ?? false,
+    noSkills:      v["no-skills"] ?? false,
+    platform:      v.platform ?? null,
+    role:          v.role ?? null,
+    provider:      providerRaw !== null ? providerRaw.trim() : null,
+    agents:        v.agents
+      ? v.agents.split(",").map((s) => s.trim()).filter(Boolean)
+      : [],
+  };
 }
 
 function walk(dir, matcher, results = []) {
@@ -274,6 +272,16 @@ function ensurePlatform(platform) {
 }
 
 function assertWithin(parent, child, label) {
+  // Lexical containment check — path.resolve() is purely string-based and does
+  // NOT follow symlinks. This guards against traversal strings (../../) and
+  // metadata.json with absolute paths outside the repo.
+  //
+  // Residual TOCTOU: if an adversary races to create a symlink at `child`
+  // AFTER this check but BEFORE the actual write, the symlink target would be
+  // written to. copyFile()/copySkillTree() use lstatSync on source AND
+  // destination to detect pre-existing symlinks, which closes the window for
+  // the common case. A fully TOCTOU-proof solution requires O_NOFOLLOW at the
+  // kernel level, which is not exposed by Node.js fs APIs.
   const resolvedParent = path.resolve(parent);
   const resolvedChild = path.resolve(child);
   const sep = path.sep;
@@ -297,7 +305,7 @@ function loadSkills() {
       if (!skill.isDirectory()) continue;
       const skillDir = path.join(providerDir, skill.name);
       if (fs.existsSync(path.join(skillDir, "SKILL.md"))) {
-        byName.set(skill.name, skillDir);
+        byName.set(skill.name, { dir: skillDir, provider: provider.name });
       }
     }
   }
@@ -325,20 +333,38 @@ function copySkillTree(sourceDir, destDir, force) {
   }
 }
 
-function resolveCompanionSkills(selectedAgents, skillsByName, role, includeAll) {
+function resolveCompanionSkills(selectedAgents, skillsByName, role, includeAll, selectedProvider) {
   const skillNames = new Set();
   if (includeAll) {
-    for (const name of skillsByName.keys()) skillNames.add(name);
+    for (const [name, meta] of skillsByName.entries()) {
+      if (!selectedProvider || meta.provider === selectedProvider || meta.provider === "shared") {
+        skillNames.add(name);
+      }
+    }
   }
   if (role && Array.isArray(role.skills)) {
-    for (const id of role.skills) skillNames.add(id);
+    for (const id of role.skills) {
+      const meta = skillsByName.get(id);
+      // Exclude skills not found on disk — do not promote undefined through the
+      // provider gate (the old `!meta` branch made dry-run output lie about what
+      // would actually be written, masking catalog rot).
+      if (!meta) continue;
+      if (!selectedProvider || meta.provider === selectedProvider || meta.provider === "shared") {
+        skillNames.add(id);
+      }
+    }
   }
   const orphans = [];
   for (const agent of selectedAgents) {
     // Prefer explicit companion_skills if declared (even if empty — that means intentional no-pair)
     if (Array.isArray(agent.companion_skills)) {
       for (const skillId of agent.companion_skills) {
-        if (skillsByName.has(skillId)) skillNames.add(skillId);
+        const meta = skillsByName.get(skillId);
+        // Apply the same provider scope gate used for role.skills — prevents a
+        // cross-provider companion_skills declaration from leaking rival skills.
+        if (meta && (!selectedProvider || meta.provider === selectedProvider || meta.provider === "shared")) {
+          skillNames.add(skillId);
+        }
       }
       // companion_skills: [] is intentional no-pair — do NOT count as orphan
       continue;
@@ -347,7 +373,8 @@ function resolveCompanionSkills(selectedAgents, skillsByName, role, includeAll)
     const skillName = agent.id.endsWith("-agent")
       ? agent.id.slice(0, -"-agent".length)
       : agent.id;
-    if (skillsByName.has(skillName)) {
+    const meta = skillsByName.get(skillName);
+    if (meta && (!selectedProvider || meta.provider === selectedProvider || meta.provider === "shared")) {
       skillNames.add(skillName);
     } else if (!role) {
       orphans.push(agent.id);
@@ -361,8 +388,21 @@ function copyFile(source, destination, force) {
   if (sourceStat.isSymbolicLink()) {
     throw new Error(`Refusing to copy symbolic link as harness source: ${source}`);
   }
-  if (!force && fs.existsSync(destination)) {
-    throw new Error(`Refusing to overwrite existing file without --force: ${destination}`);
+  if (fs.existsSync(destination)) {
+    // Reject symlink destinations regardless of --force. A symlink at the
+    // destination would redirect the write outside the repo tree, bypassing
+    // assertWithin(). lstatSync does not follow the symlink — exactly what we
+    // want here to detect the link itself.
+    const destStat = fs.lstatSync(destination);
+    if (destStat.isSymbolicLink()) {
+      throw new Error(
+        `Refusing to write to symbolic link destination: ${destination}. ` +
+        `Remove the symlink and retry.`
+      );
+    }
+    if (!force) {
+      throw new Error(`Refusing to overwrite existing file without --force: ${destination}`);
+    }
   }
   fs.mkdirSync(path.dirname(destination), { recursive: true });
   fs.copyFileSync(source, destination);
@@ -533,7 +573,28 @@ function main() {
     for (const agent of selectedAgents) {
       console.log(`export agent: ${agent.id} [provider=${agent.provider}]`);
     }
-    process.stderr.write(`[vfa] --dry-run: ${selectedAgents.length} agent(s) planned, no files written.\n`);
+    const skillsDestRoot = SKILLS_PLATFORM_CONFIG[platform];
+    let dryRunSkillCount = 0;
+    if (!args.noSkills && skillsDestRoot) {
+      const skillsByName = loadSkills();
+      const includeAllSkills = args.all && !args.provider;
+      const { skillNames } = resolveCompanionSkills(
+        selectedAgents,
+        skillsByName,
+        selectedRole,
+        includeAllSkills,
+        args.provider ?? null
+      );
+      for (const skillName of skillNames) {
+        console.log(`export skill: ${skillName}`);
+        dryRunSkillCount += 1;
+      }
+    }
+    process.stderr.write(
+      `[vfa] --dry-run: ${selectedAgents.length} agent(s)` +
+      (dryRunSkillCount > 0 ? `, ${dryRunSkillCount} skill(s)` : "") +
+      ` planned, no files written.\n`
+    );
     return;
   }
 
@@ -581,11 +642,12 @@ function main() {
       selectedAgents,
       skillsByName,
       selectedRole,
-      includeAllSkills
+      includeAllSkills,
+      args.provider ?? null
     );
     let bundled = 0;
     for (const skillName of skillNames) {
-      const sourceDir = skillsByName.get(skillName);
+      const sourceDir = skillsByName.get(skillName)?.dir;
       if (!sourceDir) continue;
       const destDir = path.join(args.repo, skillsDestRoot, skillName);
       assertWithin(args.repo, destDir, "write skill destination");

package/scripts/generate-changelog-counts.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * Generate dynamic catalog counts for CHANGELOG.md and other versioning docs.
+ * Called by release-prepare.mjs to keep counts current across releases.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+// Count agents
+const agentDirs = fs.readdirSync(path.join(repoRoot, "agents"), { recursive: true });
+const agentCount = agentDirs.filter(f => String(f).endsWith("metadata.json")).length;
+
+// Count skills (on-disk SKILL.md files)
+const skillDirs = fs.readdirSync(path.join(repoRoot, "skills"), { recursive: true });
+const skillCount = skillDirs.filter(f => String(f).endsWith("SKILL.md")).length;
+
+// Count catalog providers (agents only, not skill-only dirs)
+const allProviders = new Set();
+for (const f of agentDirs) {
+  if (!String(f).endsWith("metadata.json")) continue;
+  const m = JSON.parse(fs.readFileSync(path.join(repoRoot, "agents", String(f)), "utf8"));
+  if (m.provider) allProviders.add(m.provider);
+}
+const providerCount = allProviders.size;
+
+// Count roles
+const roles = JSON.parse(fs.readFileSync(path.join(repoRoot, "catalog/install-roles.json"), "utf8"));
+const roleCount = Object.keys(roles.roles).length;
+
+console.log(`${agentCount} agents · ${skillCount} skills · ${providerCount} providers · ${roleCount} roles`);