@salesforce/afv-skills 1.44.0 → 1.45.0

package/skills/service-itsm-agentic-setup-agent-runtime-access-assign/scripts/resolve-target-user.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// Deterministic target-user resolver for the agent-runtime-access-assign flow.
+//
+// Reads the `GET /services/data/v67.0/` capture (or an equivalent versions-list
+// response the CLI writes when hitting the API root), and extracts the running
+// user's Id from the `identity` URL. The URL shape is:
+//     https://<mydomain>.my.salesforce.com/id/<orgId 00D…>/<userId 005…>
+// so we take the LAST path segment and require it to start with `005` and be
+// 15 or 18 chars (case-preserving).
+//
+// This exists so no prose step ever tries to parse the identity URL by hand
+// (A9 — deterministic decisions belong in scripts).
+//
+// Usage:
+//   node resolve-target-user.mjs <api-root.json>
+//
+// Emits a single JSON object to stdout:
+//   { userId: "005…" | null,
+//     identity: "<full URL>" | null,
+//     verdict: "RESOLVED" | "CANNOT-CONFIRM",
+//     reasons: [...] }
+// Exit is always 0 on parseable bodies; verdict carries the decision.
+
+import { readFileSync } from 'node:fs';
+
+const [rootPath] = process.argv.slice(2);
+if (!rootPath) {
+  process.stderr.write('usage: node resolve-target-user.mjs <api-root.json>\n');
+  process.exit(2);
+}
+
+function fail(reasons) {
+  process.stdout.write(JSON.stringify({
+    userId: null, identity: null, verdict: 'CANNOT-CONFIRM', reasons,
+  }, null, 2) + '\n');
+  process.exit(0);
+}
+
+let text;
+try {
+  text = readFileSync(rootPath, 'utf8').trim();
+} catch (e) {
+  fail([`unreadable file at ${rootPath}: ${e?.message ?? e}`]);
+}
+if (!text) fail([`empty file: ${rootPath}`]);
+
+let data;
+try {
+  data = JSON.parse(text);
+} catch (e) {
+  fail([`invalid JSON at ${rootPath}: ${e?.message ?? e}`]);
+}
+if (!data || typeof data !== 'object') fail([`non-object JSON at ${rootPath}`]);
+if (typeof data.status === 'number' && data.status !== 0) {
+  fail([`sf api request at ${rootPath} failed with status ${data.status}`]);
+}
+
+// `sf api request rest` returns the raw body directly; the API root response
+// contains `identity`, `rest`, and version fields at the top level.
+const identity = typeof data.identity === 'string'
+  ? data.identity
+  : (typeof data.result?.identity === 'string' ? data.result.identity : null);
+
+if (!identity) {
+  fail(['response body has no `identity` field — cannot resolve the running user without it. Confirm the org is reachable and re-run `sf api request rest "/services/data/v67.0/"`.']);
+}
+
+const segments = identity.split('/').filter(Boolean);
+const last = segments[segments.length - 1] ?? '';
+
+// Salesforce user Ids: 15-char case-sensitive or 18-char case-insensitive, prefix `005`.
+if (!/^005[A-Za-z0-9]{12}([A-Za-z0-9]{3})?$/.test(last)) {
+  fail([
+    `identity URL trailing segment "${last}" does not match the expected user-Id shape (005 + 12 or 15 alphanum chars).`,
+    `full identity URL: ${identity}`,
+  ]);
+}
+
+process.stdout.write(JSON.stringify({
+  userId: last,
+  identity,
+  verdict: 'RESOLVED',
+  reasons: [
+    `Extracted running-user Id "${last}" from identity URL trailing path segment.`,
+  ],
+}, null, 2) + '\n');

package/skills/service-itsm-agentic-setup-agentforce-coordinate/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: service-itsm-agentic-setup-agentforce-coordinate
-description: "Orchestrator for setting up Agentforce in Salesforce Service Cloud ITSM — Agentforce Studio enablement, the IT Service Fulfiller agent, and the IT Service Employee agent. Use when the user asks to set up Agentforce for ITSM, enable Studio and the Fulfiller/Employee agents together, wants a guided Agentforce ITSM walkthrough, or asks what Agentforce features are available for IT Service. Presents available Agentforce capabilities and delegates each selection to a specialized child skill while tracking progress. Triggers on: set up agentforce for itsm, configure agentforce studio and fulfiller, agentforce itsm walkthrough, what agentforce features for it service. DO NOT TRIGGER when: the user asks to enable Agentforce Studio alone, asks to create or activate the Fulfiller or Employee agent alone, or asks about CMDB, Incident Management, Teams, or general ITSM setup without Agentforce intent."
+description: "Orchestrator for setting up Agentforce in Salesforce Service Cloud ITSM — Agentforce Studio enablement, the IT Service Fulfiller agent, the IT Service Employee agent, and specialized employee agents. Use when the user asks to set up Agentforce for ITSM, enable Studio and the Fulfiller/Employee agents together, wants a guided Agentforce ITSM walkthrough, or asks what Agentforce features are available for IT Service. Presents available Agentforce capabilities and delegates each selection to a specialized child skill while tracking progress. Triggers on: set up agentforce for itsm, configure agentforce studio and fulfiller, agentforce itsm walkthrough, what agentforce features for it service. DO NOT TRIGGER when: the user asks to enable Agentforce Studio alone, asks to create or activate the Fulfiller or Employee agent alone, or asks about CMDB, Incident Management, Teams, or general ITSM setup without Agentforce intent."
 metadata:
-  version: "1.6"
+  version: "1.7"
   domains: ["Service", "Agentforce"]
   relatedSkills:
     - "service-itsm-agentic-setup-agentforce-studio-configure"
@@ -20,7 +20,7 @@ allowed-tools: Read Bash Write AskUserQuestion
 
 # Agentforce for ITSM Setup Orchestrator
 
-Guide the user through setting up Agentforce Studio, the IT Service Fulfiller agent, and the IT Service Employee agent in Salesforce Service Cloud ITSM by presenting the available capabilities, delegating to specialized child skills, and tracking progress.
+Guide the user through setting up Agentforce Studio, the IT Service Fulfiller agent, the IT Service Employee agent, and specialized employee agents in Salesforce Service Cloud ITSM by presenting the available capabilities, delegating to specialized child skills, and tracking progress.
 
 ## Goal
 
@@ -52,21 +52,37 @@ activate agent templates** (the Fulfiller and Employee agents). This separation
 Stage 1 *enables* org-level platform toggles/preferences, while Stage 2 *installs and activates*
 agents from a template — they are distinct kinds of action and must read as distinct stages, not one
 undifferentiated list. Only features with a working child skill appear in the menu — use the
-**Feature menu** template in `examples/output-templates.md`. Collect the user's selections through a single multi-select prompt (use `AskUserQuestion` with `multiSelect: true` when tooling permits, otherwise ask the user to reply with a list of numbers such as `1, 2`). Use the **exact Item names from the Feature menu table** as the multi-select option labels — verbatim, including each item's parenthetical note and the word "Agent" and its capitalization (`Agentforce Studio enablement (Foundation for both agents)`, `IT Service Fulfiller Agent`, `IT Service Employee Agent`) — so the picker options and the table never diverge. Each item's **Description column matches the wording on the Salesforce Setup → Agentforce for IT Service page** (the Fulfiller and Employee agent-template descriptions are used verbatim) so a user evaluating which template to install reads the same purpose/scope here as they would in Setup — do not paraphrase or shorten that product copy. For the two Stage 2 agent templates, follow the verbatim product copy with one short trailing `Setup:` line stating what installing does (`Setup: creates the agent from this template and activates a version.`) so a single row carries purpose, scope, and the install action together. When raising `AskUserQuestion`, put that same Description text (product copy + the `Setup:` line) in each option's `description` field so the picker carries the detail too. Do NOT show placeholder features that cannot be executed.
+**Feature menu** template in `examples/output-templates.md`. Collect the user's selections through a single multi-select prompt (use `AskUserQuestion` with `multiSelect: true` when tooling permits, otherwise ask the user to reply with a list of numbers such as `1, 2`). Use the **exact Item names from the Feature menu table** as the multi-select option labels — verbatim, including each item's parenthetical note and the word "Agent" and its capitalization (`Agentforce Studio enablement (Foundation for all agents)`, `IT Service Fulfiller Agent`, `IT Service Employee Agent`, `Specialized Agents for Employee`) — so the picker options and the table never diverge. Each item's **Description column matches the wording on the Salesforce Setup → Agentforce for IT Service page** (the Fulfiller and Employee agent-template descriptions and the Specialized Agents for Employee text are used verbatim) so a user evaluating which template to install reads the same purpose/scope here as they would in Setup — do not paraphrase or shorten that product copy. For the three Stage 2 agent items, follow the verbatim product copy with one short trailing `Setup:` line stating what installing does (`Setup: creates the agent from this template and activates a version.` for the Fulfiller and Employee agents; `Setup: pick one specialized template (e.g. Password Manager, Onboarding), then create and activate that standalone agent. Re-run this item to add more.` for Specialized Agents for Employee, for which you first ask the user which specialized template they want and pass that name to the child skill) so a single row carries purpose, scope, and the install action together. The Stage 1 row (Agentforce Studio enablement) is a platform-enablement toggle, not a template install, so it carries no `Setup:` line. When raising `AskUserQuestion`, put that same Description text (product copy + the `Setup:` line) in each option's `description` field so the picker carries the detail too. Do NOT show placeholder features that cannot be executed.
 
 **Report file (harness / non-interactive runs).** If a `${outputDir}` is provided (via the harness's generated-file location directive), write the menu emission (attribution header + feature table with status + delegation targets + dependency signal + the multi-select prompt itself) to `${outputDir}/report.md` **before** raising `AskUserQuestion` — so the report file always exists even when the harness parks at the confirmation gate. Overwrite the same file after each feature completes with the updated status table. Skip these writes when running interactively for a user in a chat surface — write only when `${outputDir}` was passed as an explicit destination.
 
 ### 4. Delegate to child skills in dependency order
 
-**Studio-first rule (unconditional).** If Agentforce Studio enablement (#1) is in the user's selection and not already done, run it **first**, always — regardless of the order the user listed their numbers in. Both the Fulfiller Agent (#2) and Employee Agent (#3) depend on Studio being enabled and will fail if attempted first. Reorder the queue silently so Studio runs before either agent. This rule is non-negotiable and applies whether the user selected two features (Studio + one agent) or all three.
-
-**User-order rule (between #2 and #3 only).** Fulfiller Agent (#2) and Employee Agent (#3) are independent of each other — neither depends on the other. If **both** are selected, run them in the order the user listed them (default 2 → 3 when unspecified). This rule applies **only** to the ordering between #2 and #3; it never overrides the Studio-first rule above.
-
-| # | Feature | Child Skill |
-|---|---------|-------------|
-| 1 | Agentforce Studio enablement (Foundation for both agents) | `service-itsm-agentic-setup-agentforce-studio-configure` |
-| 2 | IT Service Fulfiller Agent | `service-itsm-agentic-setup-fulfiller-agent-configure` |
-| 3 | IT Service Employee Agent | `service-itsm-agentic-setup-employee-agent-configure` |
+**Studio-first rule (unconditional).** If Agentforce Studio enablement (#1) is in the user's selection and not already done, run it **first**, always — regardless of the order the user listed their numbers in. The Fulfiller Agent (#2), Employee Agent (#3), and Specialized Agents for Employee (#4) all depend on Studio being enabled and will fail if attempted first. Reorder the queue silently so Studio runs before any agent. This rule is non-negotiable and applies whether the user selected two features (Studio + one agent) or everything.
+
+**User-order rule (among #2, #3, and #4 only).** The Fulfiller Agent (#2), Employee Agent (#3), and Specialized Agents for Employee (#4) are independent of each other — none depends on the others. If more than one is selected, run them in the order the user listed them (default 2 → 3 → 4 when unspecified). This rule applies **only** to the ordering among #2, #3, and #4; it never overrides the Studio-first rule above.
+
+| # | Feature | Stage | Child Skill |
+|---|---------|-------|-------------|
+| 1 | Agentforce Studio enablement (Foundation for all agents) | 1 | `service-itsm-agentic-setup-agentforce-studio-configure` |
+| 2 | IT Service Fulfiller Agent | 2 | `service-itsm-agentic-setup-fulfiller-agent-configure` |
+| 3 | IT Service Employee Agent | 2 | `service-itsm-agentic-setup-employee-agent-configure` |
+| 4 | Specialized Agents for Employee | 2 | `service-itsm-agentic-setup-employee-agent-configure` |
+
+**How #3 and #4 relate.** Both #3 and #4 delegate to the same child skill,
+`service-itsm-agentic-setup-employee-agent-configure` — the difference is which template it installs.
+#3 (IT Service Employee Agent) installs the **broad, ready-to-go** employee agent, which is the child
+skill's default whenever no specialization is named. #4 (Specialized Agents for Employee) installs a
+**specialized** employee agent instead — but the child skill only takes the specialized path when it
+is handed the name of a specialized template; handed nothing, it silently falls back to the broad
+agent, which would just re-create #3. So when the user selects #4, **ask which specialized employee
+agent they want before delegating** — offer common examples (Password Manager, Certificate Management,
+Onboarding, Hardware Request) and note that more are available; the child skill holds the full catalog
+and will disambiguate a partial or ambiguous name. Then delegate to the child skill **with that named
+specialization**, and it will pin the matching template (the chosen template names the agent it
+creates). **Never delegate #4 without a named specialization** — that is the one case that produces a
+duplicate broad agent. The specialized templates themselves are turned on in Stage 1 (Agentforce
+Studio enablement); #4 is where an agent is built and activated from one of them.
 
 `service-itsm-agentic-setup-agentforce-studio-configure` performs its own read-and-classify
 preflight (reading live toggle state before writing) rather than delegating to
@@ -104,19 +120,22 @@ Stage 2 (install & activate agent templates).
 
 ```text
 Stage 1 — Foundation: enable platform features
-  1. Agentforce Studio enablement (Foundation for both agents)   (turn ON org-level Agentforce + Einstein GenAI feature toggles)
+  1. Agentforce Studio enablement (Foundation for all agents)   (turn ON org-level Agentforce + Einstein GenAI feature toggles)
 
 Stage 2 — Agent templates: install & activate   (only after Stage 1)
-  2. IT Service Fulfiller Agent     (install from template, commit, and activate the agent)
-  3. IT Service Employee Agent      (install from template, commit, and activate the agent)
+  2. IT Service Fulfiller Agent          (install from template, commit, and activate the agent)
+  3. IT Service Employee Agent           (install the broad employee agent from its template and activate it)
+  4. Specialized Agents for Employee     (install a specialized employee agent — user picks the template — and activate it)
 ```
 
 Stage 1 (Agentforce Studio enablement) is the **foundation**: it turns on the org-level Agentforce
-and Einstein GenAI feature toggles that both the Fulfiller and Employee agents are **built on top
-of**. Enable it first — attempting to install or activate either agent before this foundation is
-enabled will fail. The two Stage 2 items (Fulfiller and Employee) are independent siblings (neither
-depends on the other) — both can be selected together and installed in either order once Stage 1 is
-done.
+and Einstein GenAI feature toggles that all the agents are **built on top of** (including the
+specialized employee templates). Enable it first — attempting to install or activate any agent
+before this foundation is enabled will fail. The three Stage 2 items (Fulfiller, Employee, and
+Specialized Agents for Employee) are independent siblings (none depends on the others) — they can be
+selected together and installed in any order once Stage 1 is done. Specialized Agents for Employee
+is listed right after the IT Service Employee Agent because both build employee agents from the same
+child skill: #3 the broad default, #4 a specialized template the user chooses.
 
 ---
 
@@ -129,6 +148,7 @@ done.
 - NEVER show features that do not have a working child skill
 - If the user says "set up everything" or "all", walk through each available feature sequentially in the recommended order, confirming between each step
 - Track progress across the conversation — do not re-present completed features as "Not done"
+- Specialized Agents for Employee (#4) is **re-selectable** — each run builds a *different* specialized employee agent from a template the user picks. Mark the agent just built as `Done`, but keep #4 available to run again for additional specialized agents; do not treat a completed #4 as permanently finished the way #1–#3 are. If the user picks #4 again, ask which specialized template to use next
 - NEVER advance to the next feature in the queue if the current one failed or only partially
   succeeded — stop and surface the failure in plain language instead
 - If Agentforce Studio enablement reports the org lacks the Agentforce license (`accessCheck`), STOP
@@ -154,10 +174,11 @@ Before emitting any menu or summary in this skill, mentally confirm each of the
 - [ ] Only features with a working child skill are shown; placeholder features are hidden
 - [ ] The feature menu is presented as a multi-select (single-select only if the user has already named a specific feature)
 - [ ] Each feature row's `Status` column reflects the actual tracked state from the conversation (`Not done`, `In progress`, or `Done`) — not a hard-coded default
-- [ ] Each feature row's `Description` matches the Salesforce Setup → Agentforce for IT Service page wording (Fulfiller and Employee agent-template descriptions verbatim, not paraphrased), the two Stage 2 rows end with the short `Setup:` install line, and the `AskUserQuestion` option descriptions carry the same text
+- [ ] Each feature row's `Description` matches the Salesforce Setup → Agentforce for IT Service page wording (Fulfiller and Employee agent-template descriptions verbatim, not paraphrased), the three Stage 2 rows each end with a short `Setup:` install line, and the `AskUserQuestion` option descriptions carry the same text
+- [ ] The Specialized Agents for Employee row is present as a Stage 2 item shown right after the IT Service Employee Agent, and #4 is never delegated to `service-itsm-agentic-setup-employee-agent-configure` without first asking the user which specialized template they want (handed no name, the child skill defaults to the broad agent and duplicates #3), and it carries its `Setup:` install line
 - [ ] For a completion summary, the header line and closing line are chosen by the rubric in `examples/output-templates.md` (all `Done` → *Complete*; any `Not done`/`In progress` → *Finished*)
 - [ ] A feature is being configured only because the user explicitly selected it (or is being walked through sequentially with confirmation under an "all" / "everything" request)
-- [ ] Studio enablement is verified done before delegating to the Fulfiller Agent or Employee Agent child skill
+- [ ] Studio enablement is verified done before delegating to any Stage 2 agent (Fulfiller, Employee, or Specialized Agents for Employee)
 - [ ] The next action delegates to a child skill, never configures a feature inline
 - [ ] No Salesforce record IDs appear in the output — human-readable names only
 

package/skills/service-itsm-agentic-setup-agentforce-coordinate/examples/output-templates.md

@@ -16,7 +16,7 @@ Stage 1 (enable) must finish before Stage 2 (install & activate):
 │ # │ Stage   │ Item                         │ Description                                            │ Status   │
 ├───┼─────────┼──────────────────────────────┼────────────────────────────────────────────────────────┼──────────┤
 │ 1 │ Stage 1 │ Agentforce Studio enablement │ Turn on org-level Agentforce, Einstein GenAI, and IT   │ Not done │
-│   │         │ (Foundation for both agents) │ Service agent features                                 │          │
+│   │         │ (Foundation for all agents)  │ Service agent features                                 │          │
 │ 2 │ Stage 2 │ IT Service Fulfiller Agent   │ Automate actions and simplify critical asks for IT     │ Not done │
 │   │         │                              │ service fulfillers who work with incidents, problems,  │          │
 │   │         │                              │ change requests and more to resolve issues and         │          │
@@ -27,6 +27,12 @@ Stage 1 (enable) must finish before Stage 2 (install & activate):
 │   │         │                              │ service requests, and track their incidents with ease. │          │
 │   │         │                              │ Setup: creates the agent from this template and        │          │
 │   │         │                              │ activates a version.                                   │          │
+│ 4 │ Stage 2 │ Specialized Agents           │ Use the specialized templates and build agents that    │ Not done │
+│   │         │ for Employee                 │ power your employee agent. Refine the agent logic, as  │          │
+│   │         │                              │ necessary, and then activate them.                     │          │
+│   │         │                              │ Setup: pick one specialized template (e.g. Password    │          │
+│   │         │                              │ Manager, Onboarding), then create and activate that    │          │
+│   │         │                              │ standalone agent. Re-run this item to add more.        │          │
 └───┴─────────┴──────────────────────────────┴────────────────────────────────────────────────────────┴──────────┘
 
 Reply with the numbers of the features you want to set up (one or more, e.g. `1` or `1, 2`).
@@ -34,8 +40,20 @@ If you pick a Stage 2 template without Stage 1, I'll enable the Stage 1 foundati
 ```
 
 Stage 1 (Agentforce Studio enablement) is the **foundation** — it enables the org-level platform
-features both agents are built on. Stage 2 items (the Fulfiller and Employee agents) are **installed
-from a template and activated**; they can be set up in either order once Stage 1 is done.
+features every agent is built on. Stage 2 items (the Fulfiller agent, the Employee agent, and
+Specialized Agents for Employee) are **installed from a template and activated**; they can be set up
+in any order once Stage 1 is done.
+
+**Specialized Agents for Employee** is a third Stage 2 item, shown right after the IT Service
+Employee Agent to keep the two employee options together. Both use the same child skill
+(`service-itsm-agentic-setup-employee-agent-configure`): the IT Service Employee Agent installs the
+broad, ready-to-go employee agent, while Specialized Agents for Employee starts from one of the
+specialized employee templates (for example Password Manager, Certificate Management, Onboarding, or
+Hardware Request). Ask which specialized template the user wants **before** delegating this item —
+the child skill defaults to the broad agent when handed no name (which would just re-create the IT
+Service Employee Agent), and once given a name it disambiguates a partial or ambiguous match. The
+chosen template names the agent it creates. The specialized templates themselves are turned on in
+Stage 1; this item is where you build and activate an agent from them.
 
 ## Post-feature progress (Behavior step 5)
 
@@ -49,16 +67,20 @@ Agentforce Studio — enabled successfully
 │ # │ Stage   │ Item                         │ Status      │
 ├───┼─────────┼──────────────────────────────┼─────────────┤
 │ 1 │ Stage 1 │ Agentforce Studio enablement │ Done        │
-│   │         │ (Foundation for both agents) │             │
+│   │         │ (Foundation for all agents)  │             │
 │ 2 │ Stage 2 │ IT Service Fulfiller Agent   │ Not done    │
 │ 3 │ Stage 2 │ IT Service Employee Agent    │ Not done    │
+│ 4 │ Stage 2 │ Specialized Agents           │ Not done    │
+│   │         │ for Employee                 │             │
 └───┴─────────┴──────────────────────────────┴─────────────┘
 
 Stage 1 (foundation) is enabled. On to Stage 2 — install and activate the IT
-Service Fulfiller and/or Employee agents from their templates. The Fulfiller
-agent gives IT technicians an assistant for triage, case summaries, and record
-automations; the Employee agent gives requesters self-service help with their
-own requests.
+Service Fulfiller agent, the IT Service Employee agent, and/or a specialized
+employee agent from their templates. The Fulfiller agent gives IT technicians an
+assistant for triage, case summaries, and record automations; the Employee agent
+gives requesters self-service help with their own requests; and Specialized
+Agents for Employee builds a focused employee agent (such as Password Manager or
+Onboarding) from a specialized template you pick.
 ```
 
 ## Completion summary (Behavior step 6)
@@ -85,9 +107,11 @@ Agentforce for ITSM Setup — Finished
 │ # │ Stage   │ Item                         │ Status      │
 ├───┼─────────┼──────────────────────────────┼─────────────┤
 │ 1 │ Stage 1 │ Agentforce Studio enablement │ Done        │
-│   │         │ (Foundation for both agents) │             │
+│   │         │ (Foundation for all agents)  │             │
 │ 2 │ Stage 2 │ IT Service Fulfiller Agent   │ Not done    │
 │ 3 │ Stage 2 │ IT Service Employee Agent    │ Not done    │
+│ 4 │ Stage 2 │ Specialized Agents           │ Not done    │
+│   │         │ for Employee                 │             │
 └───┴─────────┴──────────────────────────────┴─────────────┘
 
 You have finished the items you selected. The remaining items can be

package/skills/service-itsm-agentic-setup-agentforce-studio-configure/SKILL.md

@@ -2,7 +2,7 @@
 name: service-itsm-agentic-setup-agentforce-studio-configure
 description: "Enable the Agentforce for IT Service Salesforce Go feature toggles (Agentforce Studio, Einstein Generative AI, the parent umbrella, and the Fulfiller/Employee agent templates) using the Salesforce CLI (sf). Turns ON org prefs via the Setup Discovery feature/{apiName}/enable Connect API route. Write-capable, idempotent, dependency-ordered, confirm-to-write required. Use when asked to enable Agentforce Studio, turn on Agentforce for IT Service, enable Einstein generative AI, or configure the org-level Agentforce for IT Service prerequisites. Triggers: enable agentforce studio, turn on agentforce for it service, enable einstein generative ai, configure agentforce org prefs. DO NOT TRIGGER: read-only prerequisite check (service-itsm-agentic-setup-agentforce-studio-validate), create/activate an agent (service-itsm-agentic-setup-fulfiller-agent-configure), or assigning permission sets."
 metadata:
-  version: "1.3"
+  version: "1.4"
   domains: ["Service", "Agentforce"]
   minApiVersion: "67.0"
   relatedSkills:
@@ -239,31 +239,30 @@ Substitute `<alias>` with the target org alias. `<agentType>` is `fulfiller` or
 
 ## Output Format
 
-Present the enablement report as a **table** — this is **Stage 1 (Foundation)**, the platform
-enablement that Stage 2 (install & activate the agent) is built on. Each Status is one of
-ENABLED / ALREADY-ENABLED / FAILED / CANNOT-CONFIRM:
+Emit the report as **live Markdown — never inside a code fence** (a fenced table shows raw
+`|` pipes, not a table). This is **Stage 1 (Foundation)** that Stage 2 (install & activate the
+agent) builds on; each Status is ENABLED / ALREADY-ENABLED / FAILED / CANNOT-CONFIRM. Lay it
+out exactly like this:
 
-```text
-Agentforce for IT Service — Stage 1: Enable Platform Features (via service-itsm-agentic-setup-agentforce-studio-configure)
+**Agentforce for IT Service — Stage 1: Enable Platform Features** (via `service-itsm-agentic-setup-agentforce-studio-configure`)
 
-Org:          <org-alias> (API v67.0)
-Agent path:   fulfiller | employee
+- **Org:** `<org-alias>` (API v67.0)
+- **Agent path:** fulfiller | employee
 
 | # | Platform feature | Status |
 | --- | --- | --- |
-| 1 | Einstein Generative AI | <status> |
-| 2 | Agentforce Studio | <status> |
-| 3 | Agentforce for IT Service | <status> |
-| 4 | <path-specific toggle(s)> | <status> |
+| 1 | Einstein Generative AI | `<status>` |
+| 2 | Agentforce Studio | `<status>` |
+| 3 | Agentforce for IT Service | `<status>` |
+| 4 | `<path-specific toggle(s)>` | `<status>` |
 
-Verdict: SUCCESS | PARTIAL | FAILED | CANNOT-CONFIRM | ERROR
+**Verdict:** SUCCESS | PARTIAL | FAILED | CANNOT-CONFIRM | ERROR
 
-Next steps:
-  - <If SUCCESS: "Stage 1 (foundation) complete — proceed to Stage 2: install + activate the <path> agent via service-itsm-agentic-setup-fulfiller-agent-configure (fulfiller) / the employee-agent skill.">
-  - <If PARTIAL/FAILED/CANNOT-CONFIRM/ERROR: list the affected toggle(s) + reason (enableBlockedReasons, unconfirmed status, or read error) + remediation steps>
-```
+**Next steps:**
+- If SUCCESS: "Stage 1 (foundation) complete — proceed to Stage 2: install + activate the `<path>` agent via `service-itsm-agentic-setup-fulfiller-agent-configure` (fulfiller) / the employee-agent skill."
+- If PARTIAL/FAILED/CANNOT-CONFIRM/ERROR: list the affected toggle(s) + reason (`enableBlockedReasons`, unconfirmed status, or read error) + remediation steps
 
-Render `overall` and each feature's `finalStatus` from `scripts/classify-final-report.mjs` verbatim (substitute into each `<status>` cell) — do not recompute them. No files are produced beyond the temporary response captures used by the classifiers.
+Substitute `overall` and each feature's `finalStatus` from `scripts/classify-final-report.mjs` into the `<status>` cells verbatim — do not recompute. No files are produced beyond the classifiers' temporary response captures.
 
 Label rows exactly as the classifier emits them — never add `Requestor`, `Specialized`, or `parent`.
 

package/skills/service-itsm-agentic-setup-cmdb-coordinate/SKILL.md

@@ -61,6 +61,8 @@ Before presenting options, scan chat history for:
 - Which layers are already done (skip or mark as done)
 - Any constraints the user mentioned (e.g. "just enable it, we'll assign users later")
 
+Derive layer status from the **most recent** layer activity in the transcript. On a long or **resumed** conversation (e.g. a headless session continued later), do not treat an earlier-highlighted layer as still current — re-derive which layer is active from the latest child-skill result, and if it is ambiguous, re-confirm with the user before re-presenting the menu.
+
 ### 2. Confirm the target org
 
 CMDB enablement performs **writes against a real org** (tenant provisioning, feature enable,
@@ -179,7 +181,7 @@ cannot succeed until Layer 1 reaches `PROVISIONED`. Present them as one step.
   license/edition prerequisite that no API can grant
 - If a child skill reports a prerequisite gap or a failure, relay it to the user in friendly,
   actionable terms — do not bury the error
-- Track progress across the conversation — do not re-present completed layers as "Pending"
+- Track progress across the conversation — do not re-present completed layers as "Pending". Re-derive the current layer from the latest child-skill activity, not from a previously rendered highlight; on a resumed or long conversation, do not assume the last-highlighted layer is still current — if ambiguous, re-confirm with the user
 - Do NOT expose internal technical jargon in user-facing output. This includes Salesforce record
   IDs and org IDs, raw HTTP status codes (403, 500, …), API error codes (`FUNCTIONALITY_NOT_ENABLED`,
   `DUPLICATE_VALUE`, …), internal endpoint/API names (`bundleListView`, `tenantProvisioningStatus`, …),

package/skills/service-itsm-agentic-setup-configure/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: service-itsm-agentic-setup-configure
-description: "Top-level orchestrator for setting up IT Service Management (ITSM) in Salesforce Service Cloud. Use when the user asks to set up ITSM, configure service management, enable ITSM capabilities, wants a guided walkthrough, or asks what is needed to get ITSM running. Presents a multi-select track menu and delegates to domain sub-orchestrators — Incident Management, Agentforce for ITSM (Studio + Fulfiller), CMDB, and Channels (Portal, Notifications, Microsoft Teams, Slack). Any prerequisites (such as the Incident Management master switch for Track 1) are owned and enforced inside the relevant sub-orchestrator, not at this level. Triggers on: set up ITSM, configure service management, ITSM setup, get ITSM running, walkthrough, set up CMDB / channels / Teams / Slack / Agentforce for ITSM. DO NOT TRIGGER when: the user asks about a specific feature directly (e.g., the priority matrix alone), asks only about Case management, wants to create a single user, or asks general ITSM questions without setup intent."
+description: "Top-level orchestrator for setting up IT Service Management (ITSM) in Salesforce Service Cloud. Use when the user asks to set up ITSM, configure service management, wants a guided walkthrough, or asks what is needed to get ITSM running. Presents a paged multi-select track menu and delegates to domain sub-orchestrators — Incident Management, Agentforce for ITSM, CMDB, Channels (Portal, Notifications, Microsoft Teams, Slack), and Unified Catalog (find and deploy Service Process templates). Prerequisites (e.g., the Incident Management master switch) are owned inside the relevant sub-orchestrator, not at this level. Triggers on: set up ITSM, configure service management, ITSM setup, get ITSM running, set up CMDB / channels / Teams / Slack / Agentforce for ITSM / Unified Catalog templates. DO NOT TRIGGER when: the user asks about a specific feature directly (e.g., the priority matrix alone), asks only about Case management, wants to create a single user, or asks general ITSM questions without setup intent."
 metadata:
-  version: "1.3"
+  version: "1.6"
   domains: ["Service"]
   relatedSkills:
+    - "service-catalog-template-coordinate"
     - "service-itsm-agentic-setup-agentforce-coordinate"
     - "service-itsm-agentic-setup-cmdb-coordinate"
     - "service-itsm-agentic-setup-incident-management"
@@ -32,6 +33,7 @@ Only tracks with a working sub-orchestrator appear in the menu — use the **Tra
 | 2 | Agentforce for ITSM | `service-itsm-agentic-setup-agentforce-coordinate` | Agentforce Studio enablement, Fulfiller Agent, Employee Agent |
 | 3 | CMDB (Configuration Management Database) | `service-itsm-agentic-setup-cmdb-coordinate` | CMDB feature enablement, CMDB Foundation bundle, User CMDB access |
 | 4 | Channels | `service-itsm-channels-coordinate` | Employee Service channel setup — Portal, Notifications, Microsoft Teams (IT Desk / IT Service / embedded agent), and Slack |
+| 5 | Unified Catalog | `service-catalog-template-coordinate` | Find and deploy Unified Catalog Service Process templates (search / rank, then install / activate) |
 
 Additional ITSM setup tracks (e.g. employee provisioning) will be added here as their sub-orchestrators become available.
 
@@ -47,11 +49,15 @@ Before presenting tracks, scan chat history for:
 - The target org (if mentioned)
 - Any specific features mentioned that narrow the scope
 
-### 2. Present the available tracks as a multi-select
+Derive each track's status from the **most recent** sub-orchestrator activity in the transcript, not from the last-rendered menu — a track is only the "active" one if it is the latest track actually being worked. On a long or **resumed** conversation (e.g. a headless session continued later), the earlier transcript can still prominently show a prior track: do not treat the last highlighted row as current. If it is ambiguous which track is active, re-confirm with the user (`AskUserQuestion`) before rendering the menu rather than carrying a stale highlight forward.
 
-Emit the **Track menu** template from `examples/output-templates.md` AND, in the same response, a single `AskUserQuestion` call with `multiSelect: true` whose options mirror the rendered rows — the table is the visual view; the tool call is how the selection is collected. Both MUST appear together, never one without the other. Do NOT show tracks that have no working sub-orchestrator. Selecting one track is valid; selecting several enqueues them for sequential handling in step 3.
+### 2. Present the available tracks as a paged multi-select
 
-The menu MUST also include a **"Full guided setup"** option in addition to the per-track rows. Selecting it expands to *every* available track (all rows currently rendered in the table, in dependency order — see the "Sub-Orchestrators" table above). Treat it as if the user had selected every track in one interaction; step 3's sequential-confirmation loop still runs per-track, so the user can bail between any two tracks. Full guided setup is mutually exclusive with per-track selections — if the user picks it alongside individual tracks, treat it as "Full guided setup" and ignore the per-track picks. Emitting only per-track rows without the Full guided setup option violates this rule.
+Emit the **Track menu** table from `examples/output-templates.md` (visual map — every available track and `Full guided setup`). In the SAME response, dispatch the first page of a multi-select `AskUserQuestion`. `Full guided setup` is a first-class pickable option in the same multi-select — not a separate mode selector. The user picks any combination of tracks in one flow.
+
+**`AskUserQuestion` accepts at most 4 options per call.** With today's 5 tracks + `Full guided setup` = 6 options, the menu is paged. Each page has up to **3 tracks (or `Full guided setup` + 2 tracks on page 1) + `Show more tracks →` as the 4th option** when more content follows. Selections **accumulate across pages** — a pick on page 1 stays picked when the user moves to page 2. Stop paging when the user submits a page without `Show more tracks →`, or the last page has been dispatched (no `Show more tracks →` sentinel needed on the last page). Strip `Show more tracks →` from the final accumulated selection before delegating.
+
+**Selection resolution.** If the accumulated set contains `Full guided setup`, run every available track in dependency order (per-track confirmation from step 3 still applies — the user can stop between any two tracks). Otherwise, run only the picked tracks, in dependency order (or track number order if unspecified).
 
 Do NOT run any org-level prerequisites at this level — each sub-orchestrator owns its own prerequisites (e.g., the Incident Management sub-orchestrator handles the master-switch confirmation internally). Delegating without pre-checking keeps this orchestrator agnostic about domain-specific dependencies and avoids prompting the user to change org state for a track they did not select.
 
@@ -79,13 +85,14 @@ When the user says they're finished (or every available track is `Done`), presen
 ## Rules
 
 - ALWAYS show "(via service-itsm-agentic-setup-configure)" in the setup header
-- ALWAYS present the track menu as a multi-select — accept a set of one or more tracks in a single interaction
-- ALWAYS pair the rendered track-menu table with an `AskUserQuestion` (`multiSelect: true`) call in the same response — the table is the visual view; the tool call is the selection channel. Emitting the table alone breaks the selection channel; emitting the tool call alone hides the visual view
-- ALWAYS include a **"Full guided setup"** option in the track menu (in addition to the per-track rows). It expands to every available track in dependency order — the sequential-confirmation loop still runs per-track so the user can stop between any two tracks. Full guided setup is mutually exclusive with per-track selections; if picked with individual tracks, treat it as Full guided setup and ignore the per-track picks
+- ALWAYS present the track menu as a **paged multi-select** — a single `AskUserQuestion` per page with `multiSelect: true`. `Full guided setup` is a first-class option in the multi-select (page 1, first slot) — NEVER split it into a separate mode-selector stage. NEVER render more than 4 options in a single `AskUserQuestion` — the tool schema hard-caps `options` at 4 and the dispatch fails with an "invalid parameter" error before the user sees the menu
+- WHEN the total options (tracks + `Full guided setup`) exceed 4, PAGE the menu. The algorithm is **scale-free** — more tracks produce more pages automatically without changing the shape: page 1 = `Full guided setup` + up to 2 tracks + `Show more tracks →` (4 slots); each middle page = up to 3 tracks + `Show more tracks →` (4 slots), repeated as many times as needed until ≤ 4 tracks remain; last page = the remaining ≤ 4 tracks with NO sentinel. Concrete page counts: 4 tracks → 2 pages, 7 tracks → 3 pages, 10 tracks → 4 pages (the count grows by one page for every ~3 new tracks). **Accumulate selections across pages** — a pick on page 1 stays picked when the user pages forward. Strip `Show more tracks →` from the final accumulated selection before delegating
+- ALWAYS emit the ASCII table AND the page-1 `AskUserQuestion` in the same response — the table is the visual map (all tracks + `Full guided setup`); the multi-select is the selection channel. Emitting the table alone breaks the selection channel; emitting the multi-select alone hides the visual view
+- WHEN the accumulated selection contains `Full guided setup`, expand to every available track in dependency order (step 3's per-track confirmation still runs so the user can stop between any two tracks). Otherwise, run only the picked tracks. `Full guided setup` picked alongside individual tracks means "run everything" — treat it as Full guided setup and ignore the per-track picks
 - NEVER run domain-level prerequisites (such as the Incident Management master switch) at this level — each sub-orchestrator owns and runs its own prerequisites, so users who did not select the relevant track are never prompted for unrelated org-level changes
 - NEVER show a track that has no working sub-orchestrator
 - NEVER configure a feature directly — always delegate to the sub-orchestrator (delegating through the domain orchestrator ensures its menu, progress tracking, and per-feature confirmations are applied; configuring directly bypasses that state and leaves the setup inconsistent)
-- Track progress across the conversation
+- Track progress across the conversation — re-derive each track's status from the latest sub-orchestrator activity in the transcript, not from the previously rendered highlight. On a resumed or long conversation, do not assume the last-highlighted track is still current; if ambiguous, re-confirm the active track with the user before rendering the menu
 - Do not show Salesforce record IDs in any output — use human-readable names only
 - If the user asks about a specific feature directly (e.g., "set up the priority matrix", "just enable CMDB"), you may skip the Behavior step 2 track menu and delegate directly to the corresponding sub-orchestrator; the sub-orchestrator will handle its own prerequisites as needed
 - If the user asks for a setup area that is not yet available (e.g. employee provisioning, major incident management), tell them it is not yet available in this orchestrator and will be added as its sub-orchestrator merges
@@ -98,9 +105,10 @@ Before emitting any menu or summary in this skill, mentally confirm each of the
 
 - [ ] The header line ends with `(via service-itsm-agentic-setup-configure)`
 - [ ] Only tracks with a working sub-orchestrator are shown; placeholder tracks are hidden
-- [ ] The track menu is presented as a multi-select (single-select is only acceptable when the user has already named a specific track directly)
-- [ ] The track menu emitted BOTH the ASCII table AND an `AskUserQuestion` (`multiSelect: true`) presenting the same options in the same response — never one without the other
-- [ ] The track menu included a **"Full guided setup"** option in addition to the per-track rows; if the user selected it, all available tracks were enqueued in dependency order with per-track confirmation between them
+- [ ] The track menu was emitted as a **single-stage paged multi-select** — `Full guided setup` is a first-class option in the multi-select (page 1, first slot), NOT a separate mode-selector stage
+- [ ] The ASCII table AND the page-1 `AskUserQuestion` were emitted in the same response — never one without the other
+- [ ] When total options (tracks + `Full guided setup`) > 4, pages followed the shape: page 1 = `Full guided setup` + up to 2 tracks + `Show more tracks →`; middle pages = up to 3 tracks + `Show more tracks →`; last page = remaining ≤ 4 tracks with no sentinel. Selections were accumulated across pages and `Show more tracks →` was stripped from the final selection
+- [ ] If the accumulated selection contained `Full guided setup`, every available track was enqueued in dependency order with per-track confirmation between them (per-track picks were ignored when `Full guided setup` was included)
 - [ ] Each track row's `Status` column reflects the actual tracked state from the conversation (`Not done`, `In progress`, or `Done`) — not a hard-coded default
 - [ ] For a completion summary, the header line and closing line are chosen by the rubric in `examples/output-templates.md` (all `Done` → *Complete*; any `Not done`/`In progress` → *Finished*)
 - [ ] No org-level prerequisites are being run at this level — the selected sub-orchestrator handles its own prerequisites

package/skills/service-itsm-agentic-setup-configure/examples/output-templates.md

@@ -5,6 +5,14 @@ working sub-orchestrator appear.
 
 ## Track menu (Behavior step 2)
 
+Emit the ASCII table first (visual map — every track and `Full guided setup` visible up
+front), then dispatch a **single-stage paged multi-select** `AskUserQuestion`. `Full guided
+setup` is a first-class pickable option in the same multi-select — NOT a separate mode
+selector. `AskUserQuestion` accepts at most **4 options per call**, so when the total
+(tracks + `Full guided setup`) > 4 the menu is paged.
+
+### ASCII table (part of the response body)
+
 ```text
 ITSM Setup (via service-itsm-agentic-setup-configure)
 
@@ -22,14 +30,73 @@ ITSM Setup (via service-itsm-agentic-setup-configure)
 │ 4 │ Channels                 │ Set up Employee Service channels — Portal,           │ Not done │
 │   │                          │ Notifications, Microsoft Teams (IT Desk / IT         │          │
 │   │                          │ Service), and Slack                                  │          │
-│ A │ Full guided setup        │ Run every available track in dependency order —      │ —        │
-│   │                          │ per-track confirmation between them so you can stop  │          │
-│   │                          │ any time. Mutually exclusive with per-track picks.   │          │
+│ 5 │ Unified Catalog          │ Find and deploy Unified Catalog Service Process      │ Not done │
+│   │                          │ templates (search / rank, then install / activate)   │          │
+│ A │ Full guided setup        │ Run every available track in dependency order with a │ —        │
+│   │                          │ per-track confirmation between them. Pickable in the │          │
+│   │                          │ same multi-select as the individual tracks. Wins if  │          │
+│   │                          │ picked alongside individual tracks.                  │          │
 └───┴──────────────────────────┴──────────────────────────────────────────────────────┴──────────┘
-
-Reply with the numbers of the tracks you want to set up (one or more, e.g. `1` or `1, 3`), or `A` for the full guided setup.
 ```
 
+### Paged multi-select `AskUserQuestion`
+
+**Paging rule.** `AskUserQuestion` caps `options` at 4 per call.
+
+- **Page 1** always leads with `Full guided setup` in slot 1 so it's visible immediately
+  without paging. If total options > 4, page 1 = `Full guided setup` + up to 2 tracks +
+  `Show more tracks →` (4 slots).
+- **Middle pages** (only reached if more content follows after middle) = up to 3 tracks +
+  `Show more tracks →` (4 slots).
+- **Last page** = the remaining ≤ 4 tracks with NO `Show more tracks →` sentinel — submitting
+  the last page ends the selection loop naturally.
+- **Small case** (total options ≤ 4): a single page holds `Full guided setup` + all tracks
+  with no sentinel.
+
+**Selection accumulation.** A track picked on page 1 stays picked when the user pages
+forward — the skill maintains an accumulator across page dispatches. `Show more tracks →` is
+stripped from the final selection before delegating.
+
+**Selection resolution.** If the accumulated set contains `Full guided setup`, run every
+available track in dependency order (per-track confirmation still runs so the user can stop
+between any two tracks). Otherwise, run only the picked tracks in dependency order (or track
+number order if unspecified). `Full guided setup` alongside individual tracks means "run
+everything" — per-track picks are ignored.
+
+### Scaling — how the page count grows with more tracks
+
+The algorithm is scale-free: page 1 always fits `Full guided setup` + 2 tracks + `Show more
+tracks →`, each middle page fits 3 tracks + `Show more tracks →`, and the last page fits
+the remaining ≤ 4 tracks with no sentinel. So the page count grows by one page for every
+~3 new tracks. Same shape at every scale — the skill does not need to change as new
+sub-orchestrators land.
+
+| Available tracks | Total options (incl. `Full guided setup`) | Pages | Shape |
+|---|---|---|---|
+| 3  | 4  | 1 (no paging) | `Full guided setup` + T1 + T2 + T3 |
+| 4  | 5  | 2 | P1: `FGS` + T1 + T2 + `Show more →` · P2: T3 + T4 |
+| 5  | 6  | 2 | P1: `FGS` + T1 + T2 + `Show more →` · P2: T3 + T4 + T5 |
+| 7  | 8  | 3 | P1: `FGS` + T1 + T2 + `Show more →` · P2: T3 + T4 + T5 + `Show more →` · P3: T6 + T7 |
+| 10 | 11 | 4 | P1: `FGS` + T1 + T2 + `Show more →` · P2: T3 + T4 + T5 + `Show more →` · P3: T6 + T7 + T8 + `Show more →` · P4: T9 + T10 |
+
+### Today's 5 tracks (6 total with `Full guided setup`) — 2 pages
+
+Page 1 (4 options):
+
+- `Full guided setup`
+- `Incident Management`
+- `Agentforce for ITSM`
+- `Show more tracks →`
+
+Page 2 (fires only after `Show more tracks →` was picked on page 1; 3 options, no sentinel):
+
+- `CMDB`
+- `Channels`
+- `Unified Catalog`
+
+Never try to render >4 options in one `AskUserQuestion` — the tool schema hard-caps `options`
+at 4 and the dispatch fails with an "invalid parameter" error before the user sees the menu.
+
 ## Completion summary (Behavior step 6)
 
 The completion summary fires either (a) after every track completes, or (b) when the user says
@@ -57,6 +124,7 @@ ITSM Setup — Finished
 │ Agentforce for ITSM      │ Done     │
 │ CMDB                     │ Not done │
 │ Channels                 │ Not done │
+│ Unified Catalog          │ Not done │
 └──────────────────────────┴──────────┘
 
 You have finished the tracks you selected. The remaining tracks can be resumed