@smartsoft001-mobilems/claude-plugins 2.83.0 → 2.85.0

package/plugins/flow-external/scripts/refresh-mobilems-api-spec.sh

@@ -0,0 +1,372 @@
+#!/usr/bin/env bash
+# Refresh the MuzaCMS / MobileMS indexer OpenAPI spec.
+#
+# Logs in to https://develop-indexer.mobilems.pl via Symfony form-login,
+# scrapes the Swagger 2.0 JSON from /docs/api, and writes it next to this
+# skill's owning package under shared-assets/mobilems-api.json.
+#
+# Required tools: bash, curl, jq.
+# Required env vars (read from shell or auto-loaded from $PWD/.env):
+#   MOBILEMS_LOGIN     — MuzaCMS username
+#   MOBILEMS_PASSWORD  — MuzaCMS password
+#
+# Cache: a sibling mobilems-api.meta.json stores { sessionId, fetchedAt }.
+# The script skips the network call when the same Claude Code session
+# (CLAUDE_CODE_SESSION_ID) already fetched the spec less than 8h ago.
+
+set -u
+
+BASE='https://develop-indexer.mobilems.pl'
+LOGIN_URL="${BASE}/admin/login"
+DOCS_URL="${BASE}/docs/api"
+
+QUIET=0
+for arg in "$@"; do
+  case "$arg" in
+    --quiet) QUIET=1 ;;
+  esac
+done
+if [[ "${CLAUDE_AGENT_INVOCATION:-0}" == "1" ]]; then
+  QUIET=1
+fi
+
+log() {
+  if [[ "$QUIET" -eq 0 ]]; then
+    printf '%s\n' "$*"
+  fi
+}
+
+err() {
+  printf '%s\n' "$*" >&2
+}
+
+die() {
+  err "$*"
+  exit 1
+}
+
+# --- dependency check --------------------------------------------------------
+
+check_deps() {
+  local missing=()
+  command -v curl >/dev/null 2>&1 || missing+=("curl")
+  command -v jq   >/dev/null 2>&1 || missing+=("jq")
+  if [[ ${#missing[@]} -gt 0 ]]; then
+    err "✗ Brak wymaganych narzędzi: ${missing[*]}"
+    err ""
+    err "Zainstaluj:"
+    err "  macOS:  brew install ${missing[*]}"
+    err "  Debian/Ubuntu:  sudo apt install ${missing[*]}"
+    exit 1
+  fi
+}
+
+# --- .env loader -------------------------------------------------------------
+# Minimal KEY=value parser. Ignores blank lines and #-comments, strips matching
+# surrounding quotes, and never overrides already-set env vars (parity with the
+# old refresh-mobilems-api-spec.js loader).
+
+load_dotenv() {
+  local env_path="${PWD}/.env"
+  [[ -f "$env_path" ]] || return 0
+  local line key value first last
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    # trim leading/trailing whitespace
+    line="${line#"${line%%[![:space:]]*}"}"
+    line="${line%"${line##*[![:space:]]}"}"
+    [[ -z "$line" ]] && continue
+    [[ "${line:0:1}" == "#" ]] && continue
+    [[ "$line" != *"="* ]] && continue
+    key="${line%%=*}"
+    value="${line#*=}"
+    # trim whitespace around key/value
+    key="${key#"${key%%[![:space:]]*}"}"
+    key="${key%"${key##*[![:space:]]}"}"
+    value="${value#"${value%%[![:space:]]*}"}"
+    value="${value%"${value##*[![:space:]]}"}"
+    [[ -z "$key" ]] && continue
+    # strip matching surrounding quotes (single or double)
+    first="${value:0:1}"
+    last="${value: -1}"
+    if [[ ${#value} -ge 2 ]] && { [[ "$first" == '"' && "$last" == '"' ]] || [[ "$first" == "'" && "$last" == "'" ]]; }; then
+      value="${value:1:${#value}-2}"
+    fi
+    # only set if not already in env
+    if [[ -z "${!key+x}" ]]; then
+      export "$key=$value"
+    fi
+  done < "$env_path"
+  log "→ loaded .env from $env_path"
+}
+
+# --- env-var validation (per Linear FRA-95 — Emil's request) ----------------
+# This runs as the very first step after .env loading. We MUST NOT attempt any
+# HTTP call until both credentials are present.
+
+validate_env_vars() {
+  if [[ -z "${MOBILEMS_LOGIN:-}" || -z "${MOBILEMS_PASSWORD:-}" ]]; then
+    err "✗ Brak wymaganych zmiennych środowiskowych dla MuzaCMS API:"
+    err "    MOBILEMS_LOGIN, MOBILEMS_PASSWORD"
+    err ""
+    err "Ustaw je w shellu:"
+    err "    export MOBILEMS_LOGIN=..."
+    err "    export MOBILEMS_PASSWORD=..."
+    err ""
+    err "Lub w pliku .env w katalogu głównym projektu:"
+    err "    MOBILEMS_LOGIN=..."
+    err "    MOBILEMS_PASSWORD=..."
+    err ""
+    err "Szczegóły: @smartsoft001-mobilems/claude-plugins README.md"
+    exit 1
+  fi
+}
+
+# --- output dir resolution ---------------------------------------------------
+# Mirrors resolveOutDir() in the old JS. Looks for shared-assets/ walking up
+# from this script's directory.
+
+resolve_out_dir() {
+  local script_dir
+  script_dir="$(cd "$(dirname "$0")" && pwd)"
+  # Installed layout (per-variant copy made by nx build):
+  #   <pkg-root>/plugins/<variant>/scripts/refresh-mobilems-api-spec.sh
+  #   <pkg-root>/shared-assets/mobilems-api.json
+  # Source layout:
+  #   packages/shared/claude-plugins/scripts/refresh-mobilems-api-spec.sh
+  #   packages/shared/claude-plugins/src/shared-assets/
+  local candidates=(
+    "$script_dir/../../../shared-assets"
+    "$script_dir/../shared-assets"
+    "$script_dir/../src/shared-assets"
+  )
+  local c
+  for c in "${candidates[@]}"; do
+    if [[ -d "$c" ]]; then
+      (cd "$c" && pwd)
+      return 0
+    fi
+  done
+  # No existing dir — pick the first candidate whose parent exists so we can
+  # mkdir into it.
+  for c in "${candidates[@]}"; do
+    if [[ -d "$(dirname "$c")" ]]; then
+      mkdir -p "$c"
+      (cd "$c" && pwd)
+      return 0
+    fi
+  done
+  # Last resort: create alongside the script.
+  mkdir -p "$script_dir/shared-assets"
+  (cd "$script_dir/shared-assets" && pwd)
+}
+
+# --- cache decision ----------------------------------------------------------
+# Mirrors cacheDecision() in the old JS.
+
+MAX_CACHE_AGE_S=$((8 * 60 * 60))
+
+iso_to_epoch() {
+  # macOS BSD date and GNU date diverge — try both forms.
+  local iso="$1"
+  if date -j -f "%Y-%m-%dT%H:%M:%SZ" "${iso%%.*}Z" "+%s" >/dev/null 2>&1; then
+    date -j -f "%Y-%m-%dT%H:%M:%SZ" "${iso%%.*}Z" "+%s"
+  elif date -d "$iso" "+%s" >/dev/null 2>&1; then
+    date -d "$iso" "+%s"
+  else
+    echo "0"
+  fi
+}
+
+cache_decision() {
+  # Echoes either "fetch:<reason>" or "skip:<age_seconds>".
+  local session_id="$1"
+  if [[ -z "$session_id" ]]; then
+    echo "fetch:manual/terminal invocation"
+    return
+  fi
+  if [[ ! -f "$SPEC_PATH" ]]; then
+    echo "fetch:spec file missing"
+    return
+  fi
+  if [[ ! -f "$META_PATH" ]]; then
+    echo "fetch:meta file missing"
+    return
+  fi
+  local meta_session meta_fetched_at meta_epoch now age
+  meta_session="$(jq -r '.sessionId // ""' "$META_PATH" 2>/dev/null)"
+  meta_fetched_at="$(jq -r '.fetchedAt // ""' "$META_PATH" 2>/dev/null)"
+  if [[ "$meta_session" != "$session_id" ]]; then
+    echo "fetch:new Claude Code session"
+    return
+  fi
+  if [[ -z "$meta_fetched_at" ]]; then
+    echo "fetch:meta missing fetchedAt"
+    return
+  fi
+  meta_epoch="$(iso_to_epoch "$meta_fetched_at")"
+  now="$(date +%s)"
+  age=$((now - meta_epoch))
+  if [[ "$meta_epoch" -le 0 || "$age" -gt "$MAX_CACHE_AGE_S" ]]; then
+    echo "fetch:cache older than 8 hours"
+    return
+  fi
+  echo "skip:$age"
+}
+
+# --- HTML extraction helpers -------------------------------------------------
+
+extract_csrf() {
+  # Mirrors extractCsrf() in the old JS.
+  local html="$1"
+  local token
+  token="$(printf '%s' "$html" | grep -oE 'name="_csrf_token"[[:space:]]+value="[^"]+"' | head -n 1 | sed -E 's/.*value="([^"]+)".*/\1/')"
+  if [[ -z "$token" ]]; then
+    die "✗ Could not find _csrf_token in login form HTML."
+  fi
+  printf '%s' "$token"
+}
+
+extract_swagger_data() {
+  # Mirrors extractSwaggerData() in the old JS.
+  # The <script id="swagger-data" type="application/json"> tag wraps a JSON blob.
+  local html="$1"
+  local json
+  # awk lets us span newlines safely, where sed's portability gets hairy.
+  json="$(printf '%s' "$html" | awk '
+    BEGIN { in_block = 0 }
+    {
+      line = $0
+      if (in_block == 0) {
+        idx = index(line, "<script id=\"swagger-data\" type=\"application/json\">")
+        if (idx > 0) {
+          in_block = 1
+          line = substr(line, idx + length("<script id=\"swagger-data\" type=\"application/json\">"))
+        } else {
+          next
+        }
+      }
+      end_idx = index(line, "</script>")
+      if (end_idx > 0) {
+        printf "%s", substr(line, 1, end_idx - 1)
+        exit
+      } else {
+        printf "%s\n", line
+      }
+    }
+  ')"
+  # trim leading/trailing whitespace
+  json="${json#"${json%%[![:space:]]*}"}"
+  json="${json%"${json##*[![:space:]]}"}"
+  if [[ -z "$json" ]]; then
+    die "✗ Could not find <script id=\"swagger-data\"> tag in /docs/api response. Login may have silently failed, or the docs page structure changed."
+  fi
+  printf '%s' "$json"
+}
+
+# --- main --------------------------------------------------------------------
+
+check_deps
+load_dotenv
+validate_env_vars
+
+OUT_DIR="$(resolve_out_dir)"
+SPEC_PATH="$OUT_DIR/mobilems-api.json"
+META_PATH="$OUT_DIR/mobilems-api.meta.json"
+
+SESSION_ID="${CLAUDE_CODE_SESSION_ID:-}"
+DECISION="$(cache_decision "$SESSION_ID")"
+
+if [[ "$DECISION" == skip:* ]]; then
+  age_s="${DECISION#skip:}"
+  age_min=$(( (age_s + 30) / 60 ))
+  fetched_at="$(jq -r '.fetchedAt // "unknown"' "$META_PATH" 2>/dev/null)"
+  log "✓ spec cached for this Claude Code session (refreshed ${age_min} min ago at ${fetched_at}), skipping fetch"
+  exit 0
+fi
+
+REASON="${DECISION#fetch:}"
+log "Refreshing MuzaCMS API spec from $BASE ($REASON)"
+
+JAR="$(mktemp -t mobilems-cookies.XXXXXX)"
+trap 'rm -f "$JAR"' EXIT
+
+log "→ GET /admin/login (CSRF + session)"
+LOGIN_HTML="$(curl --silent --show-error \
+  --cookie-jar "$JAR" \
+  "$LOGIN_URL")" || die "✗ Could not fetch $LOGIN_URL"
+
+CSRF="$(extract_csrf "$LOGIN_HTML")"
+
+log "→ POST /admin/login"
+# We need the HTTP status of the POST without following the redirect.
+LOGIN_POST_STATUS_BODY="$(curl --silent --show-error \
+  --output /dev/null \
+  --write-out '%{http_code} %{redirect_url}' \
+  --cookie-jar "$JAR" --cookie "$JAR" \
+  --data-urlencode "_username=${MOBILEMS_LOGIN}" \
+  --data-urlencode "_password=${MOBILEMS_PASSWORD}" \
+  --data-urlencode "_csrf_token=${CSRF}" \
+  --data-urlencode "_remember_me=on" \
+  -X POST \
+  "$LOGIN_URL")" || die "✗ POST $LOGIN_URL failed."
+
+LOGIN_STATUS="${LOGIN_POST_STATUS_BODY%% *}"
+LOGIN_REDIRECT="${LOGIN_POST_STATUS_BODY#* }"
+
+if [[ "$LOGIN_STATUS" != "302" ]]; then
+  die "✗ Login failed: expected 302 redirect, got HTTP ${LOGIN_STATUS}. Check MOBILEMS_LOGIN and MOBILEMS_PASSWORD."
+fi
+if [[ "$LOGIN_REDIRECT" == *"/admin/login"* ]]; then
+  die "✗ Login failed: server redirected back to /admin/login. Credentials were likely rejected."
+fi
+
+log "→ GET /docs/api"
+DOCS_STATUS_FILE="$(mktemp -t mobilems-docs-status.XXXXXX)"
+trap 'rm -f "$JAR" "$DOCS_STATUS_FILE"' EXIT
+
+DOCS_HTML="$(curl --silent --show-error \
+  --write-out '%{http_code}' \
+  --cookie-jar "$JAR" --cookie "$JAR" \
+  --output - \
+  "$DOCS_URL" 2>/dev/null | tee >(tail -c 3 > "$DOCS_STATUS_FILE"))"
+
+# Strip the trailing 3-char status code from the body
+DOCS_STATUS="$(cat "$DOCS_STATUS_FILE")"
+DOCS_HTML="${DOCS_HTML%$DOCS_STATUS}"
+
+if [[ "$DOCS_STATUS" != "200" ]]; then
+  die "✗ Docs page returned HTTP ${DOCS_STATUS}. Session may not be authenticated."
+fi
+if [[ "$DOCS_HTML" == *"login-card-body"* ]]; then
+  die "✗ Docs page returned the login form — session not authenticated."
+fi
+
+SPEC_JSON="$(extract_swagger_data "$DOCS_HTML")"
+
+# Validate + pretty-print through jq.
+if ! printf '%s' "$SPEC_JSON" | jq '.' > "${SPEC_PATH}.tmp"; then
+  rm -f "${SPEC_PATH}.tmp"
+  die "✗ Swagger JSON failed to parse."
+fi
+mv -f "${SPEC_PATH}.tmp" "$SPEC_PATH"
+
+SPEC_TITLE="$(jq -r '.spec.info.title // .info.title // "unknown"' "$SPEC_PATH")"
+SPEC_VERSION="$(jq -r '.spec.info.version // .info.version // "unknown"' "$SPEC_PATH")"
+
+# Preserve cached sessionId when running outside Claude Code (manual/terminal)
+# so a future in-session call still hits the cache. In-Claude-Code calls always
+# overwrite with the current session id.
+EFFECTIVE_SESSION_ID="$SESSION_ID"
+if [[ -z "$EFFECTIVE_SESSION_ID" && -f "$META_PATH" ]]; then
+  EFFECTIVE_SESSION_ID="$(jq -r '.sessionId // ""' "$META_PATH" 2>/dev/null)"
+fi
+ISO_NOW="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+jq -n \
+  --arg sid "$EFFECTIVE_SESSION_ID" \
+  --arg ts  "$ISO_NOW" \
+  '{sessionId: (if $sid == "" then null else $sid end), fetchedAt: $ts}' \
+  > "$META_PATH"
+
+BYTES="$(wc -c < "$SPEC_PATH" | tr -d ' ')"
+log "✓ Refreshed ${BYTES} bytes — ${SPEC_TITLE} ${SPEC_VERSION}"
+log "  $SPEC_PATH"

package/plugins/flow-external/skills/mobilems-docs-reader/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: mobilems-docs-reader
+description: Answer questions about the MuzaCMS / MobileMS indexer API by reading a freshly-fetched OpenAPI spec. Use whenever the user asks about endpoints, request/response shapes, status codes, auth, or behavior of the indexer API (host develop-indexer-api.mobilems.pl). Read-only — never fabricates endpoints.
+allowed-tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+---
+
+You answer questions about the **MuzaCMS / MobileMS indexer API** strictly from the OpenAPI (Swagger 2.0) specification. You never invent endpoints, schemas, or status codes — if it is not in the spec, you say so plainly.
+
+The spec is **not bundled**. It is fetched from the live MuzaCMS instance by a refresh script that lives next to this skill, using credentials supplied via environment variables. The script caches the fetched spec per Claude Code session (with an 8-hour TTL safety net), so it may skip the actual network call and reuse a cached copy on follow-up invocations within the same session.
+
+## Step 1 — Run the refresh script (mandatory)
+
+On every invocation, run the refresh script via Bash. The script itself decides whether to actually fetch — it owns the cache. Your job is only to run it and react to the result. A successful run may be either:
+
+- A real fetch (`Refreshing MuzaCMS API spec from ... → GET /admin/login → POST /admin/login → GET /docs/api → ✓ Refreshed N bytes ...`), or
+- A cache hit (`✓ spec cached for this Claude Code session (refreshed N min ago at ...), skipping fetch`).
+
+Both are exit-code-0 successes. Treat them identically and proceed to Step 2. **Do not** attempt to bypass the cache, delete the cache file, or force a refetch — the cache is intentional and the script's decision is authoritative.
+
+### Invocation
+
+The refresh script is shipped per plugin variant under `plugins/<variant>/scripts/`. Invoke it through `bash` so the executable bit is irrelevant:
+
+```
+bash ./node_modules/@smartsoft001-mobilems/claude-plugins/plugins/flow-external/scripts/refresh-mobilems-api-spec.sh --quiet
+```
+
+Outcomes:
+
+- **Success (exit 0)** → jump to Step 2.
+- **Script-level error** (missing env vars, missing tooling, auth rejected, HTTP error, parse failure, etc.) → jump to the matching Fail mode below.
+- **Permission denied by Claude Code** → jump to "Fail mode — permission denied".
+
+The script reads two environment variables — `MOBILEMS_LOGIN` and `MOBILEMS_PASSWORD` — performs the Symfony CSRF + session login against `https://develop-indexer.mobilems.pl`, fetches `/docs/api`, and writes the spec to `shared-assets/mobilems-api.json` inside the installed package. It also auto-loads `.env` from the current working directory; no shell sourcing is needed.
+
+### Fail mode — permission denied by Claude Code
+
+If the Bash call is rejected by Claude Code's permission system, stop and tell the user verbatim:
+
+> The MuzaCMS spec could not be refreshed because Claude Code denied permission to run the refresh script. To allow it, add this entry to your project's `.claude/settings.json` (committed) or `.claude/settings.local.json` (per-dev, gitignored) under `permissions.allow`, then ask again:
+>
+> - `"Bash(bash ./node_modules/@smartsoft001-mobilems/claude-plugins/plugins/flow-external/scripts/refresh-mobilems-api-spec.sh:*)"`
+
+Do not attempt to answer the user's question from training knowledge. Do not invent alternative invocation patterns to try to bypass the denial.
+
+### Fail mode — missing env vars
+
+If the script exits non-zero with a message starting `✗ Brak wymaganych zmiennych środowiskowych` (or English equivalent listing `MOBILEMS_LOGIN` / `MOBILEMS_PASSWORD`), **stop immediately**. Relay the script's message verbatim to the user.
+
+Do not attempt to answer the user's question from training knowledge. Do not guess. Do not read any pre-existing `mobilems-api.json` that may be lying around in `node_modules/` — without a successful refresh you have no confirmation it is current.
+
+### Fail mode — missing tooling
+
+If the script exits with a message about missing `curl` or `jq`, relay it verbatim. The script tells the user exactly how to install the missing dependency (`brew install jq` / `apt install jq`).
+
+### Fail mode — other script failures
+
+If the script fails for any other reason (HTTP error, auth rejected, parse failure), report the exact error message from the script back to the user and stop. Do not answer the API question.
+
+## Step 2 — Locate the freshly-written spec
+
+Use `Glob` with this pattern:
+
+```
+**/claude-plugins/**/shared-assets/mobilems-api.json
+```
+
+The hit lives under `node_modules/@smartsoft001-mobilems/claude-plugins/shared-assets/` after a successful refresh. Exclude `dist/` and `tmp/` from the Glob, but **do** allow `node_modules/`.
+
+If the Glob returns nothing after the refresh script reported success, something is wrong with the install layout — tell the user and stop.
+
+## Step 3 — Answer from the spec
+
+The spec is **Swagger 2.0** with this wrapping shape:
+
+```
+{ "spec": { "swagger": "2.0", "paths": {...}, "definitions": {...} } }
+```
+
+Always traverse into `.spec` first.
+
+When the user asks about endpoints:
+
+1. **Locate the path** in `spec.paths`. Look for the exact path the user mentioned, including any path parameters (`{id}`).
+2. **Quote the HTTP method(s) and path verbatim.** Example: `GET /api/objects/{id}`.
+3. For request bodies and responses, cite the `$ref` target by name and (briefly) summarize its shape from `spec.definitions`.
+4. For status codes, list each documented response from `responses` with its `description`.
+5. For auth, check both the operation-level `security` and the global `spec.securityDefinitions`.
+
+If the user asks about a path that is **not in the spec**, say so explicitly:
+
+> The spec does not document a `DELETE /api/articles/{id}` endpoint. The articles paths in the spec are: `[list actual paths]`. If you've seen this endpoint elsewhere, it may exist in the running service without being documented — verify with a live request.
+
+## Known caveats — always surface when relevant
+
+- **Response schemas occasionally diverge from runtime.** Documented response shapes have, in practice, not always matched what the live API actually returns. When the user is about to implement against a response schema, add a brief reminder to verify with a real request before relying on the documented shape.
+- **Spec is regenerated server-side from PHP annotations.** Newly added endpoints in the live service may not appear until the next backend deployment, even with a fresh fetch.
+- **Auth flow nuance:** the spec describes the indexer API itself; the `/admin/login` flow used by the refresh script is separate and not documented in the spec.
+
+## Answering style
+
+- Be terse. The user wants a specific fact, not a tutorial on Swagger.
+- Always include exact path + method + relevant status codes when applicable.
+- When quoting definitions, use the schema name (e.g., `Object`, `Unauthorised`) as it appears in `spec.definitions`.
+- If multiple endpoints match a vague question, list them — don't pick one arbitrarily.
+
+## When NOT to use this skill
+
+- Non-MobileMS APIs (any other host).
+- Generic REST/OpenAPI guidance unrelated to the indexer.
+- Schema design decisions ("should I add X field?") — this skill only describes what exists.
+- Anything requiring a live network call to the API itself.

package/plugins/flow-external/skills/plan/SKILL.md

@@ -39,12 +39,12 @@ Create a structured implementation plan for a Linear task and save it as a `plan
 
 When `--auto` is set, the skill MUST run end-to-end without any human-in-the-loop prompts:
 
-| Default behavior                                              | `--auto` override                                                                  |
-| ------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| Ask user to confirm deletion of old `plan.md` attachment      | Delete old attachment automatically before saving the new one                      |
-| Ask "regenerate?" when plan is up-to-date but keywords detect | Ignore the secondary signal; only the mtime rule decides regeneration              |
-| Final approval prompt before user runs `/impl`                | Skip the prompt; finish with a Linear comment confirming plan saved                |
-| Any `AskUserQuestion`                                         | Use the **(Recommended)** option; if none, fail fast with a Linear comment         |
+| Default behavior                                              | `--auto` override                                                                    |
+| ------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| Ask user to confirm deletion of old `plan.md` attachment      | Delete old attachment automatically before saving the new one                        |
+| Ask "regenerate?" when plan is up-to-date but keywords detect | Ignore the secondary signal; only the mtime rule decides regeneration                |
+| Final approval of generated plan content before saving        | Skip the approval gate (Step 4a); proceed directly to attachment save (auto-approve) |
+| Any `AskUserQuestion`                                         | Use the **(Recommended)** option; if none, fail fast with a Linear comment           |
 
 Every decision MUST be logged as a Linear comment in Polish (audit trail). The mtime rule remains authoritative.
 
@@ -54,7 +54,7 @@ Every decision MUST be logged as a Linear comment in Polish (audit trail). The m
 
 These rules override ANY other instruction, ANY surrounding example, and ANY default habit. Violating them is a skill failure.
 
-1. **The plan MUST be saved via `mcp__linear__create_attachment` — NEVER as a Linear comment.** `mcp__linear__save_comment` MUST NOT be called with plan content as the body. Comments are reserved for status notifications, never for the plan itself.
+1. **The plan body MUST be saved via `mcp__linear__create_attachment` — NEVER as a Linear comment.** `mcp__linear__save_comment` MUST NOT be called with plan content as the body. Comments are reserved for: (a) status notifications, and (b) the single token-usage comment posted in Step 7b. No other comment may carry plan content.
 2. **One call, no fallback.** First Linear write for the plan is `mcp__linear__create_attachment`. If it fails, surface the error — do NOT silently fall back to `save_comment`.
 3. **`AI Plan` label is workspace-scoped — NEVER create it.** Only `mcp__linear__list_issue_labels` + `mcp__linear__save_issue`. `create_issue_label` MUST NOT be called.
 
@@ -173,6 +173,40 @@ Structure the plan as follows:
 | -   | [Subtask 2] | Medium    | 2    |
 ```
 
+### Step 4a: User Approval of Generated Plan
+
+**MANDATORY.** Before any Linear write (subtask creation, attachment delete, attachment create, label apply), the user MUST approve the generated plan content. This is the gate FRA-126 added.
+
+**`--auto` mode**: Skip this entire step. The plan is auto-approved. Record the auto-approval in the final Linear audit comment (e.g. `Plan zaakceptowany automatycznie (--auto)`). Proceed to Step 5.
+
+**Default mode** (interactive):
+
+1. **Render the full plan in chat.** Print the markdown produced in Step 4. The `AskUserQuestion` option labels alone do not give the user enough context — the full text must be visible above the prompt.
+
+2. **Ask for approval** via `AskUserQuestion`:
+
+   ```markdown
+   ## Akceptacja planu
+
+   Powyżej znajduje się wygenerowany plan dla zadania <linearTaskId>.
+   Czy akceptujesz plan i mogę zapisać go jako załącznik `plan.md` w Linear?
+   ```
+
+   Options:
+
+   - **"Tak, zapisz plan do Linear"** _(Recommended)_ — user accepts. Proceed to Step 5 (create subtasks if needed) and Step 6 (save attachment).
+   - **"Wygeneruj plan ponownie"** — user wants a different plan. Go to step 3 (regeneration loop) below.
+   - **"Anuluj"** — user rejects. Stop the whole skill. Do NOT create subtasks. Do NOT delete the existing `plan.md` attachment. Do NOT save a new one. Do NOT apply the `AI Plan` label. Print a short status in Polish (`Plan nie został zapisany. Anulowano na żądanie użytkownika.`) and exit.
+
+3. **Regeneration branch**: if the user chose "Wygeneruj plan ponownie":
+
+   - Ask a follow-up `AskUserQuestion` (or accept the free-text the user typed alongside the rejection) to capture what should change: scope, structure, missed files, wrong approach, etc.
+   - Loop back to **Step 4 (Create Implementation Plan)** with the user's feedback in mind. Do NOT re-run Steps 1–3 — the Linear task, comments, and codebase analysis have not changed.
+   - On the regenerated plan, return to **Step 4a step 1** (render + ask again).
+   - **Cap the loop at 3 regenerations.** On the 3rd rejection, surface the situation to the user (`Plan został odrzucony 3 razy. Przerywam, abyś mógł doprecyzować wymagania.`) and exit without saving.
+
+4. **State invariant on entry to Step 5**: the only path that reaches Step 5 is the explicit "Tak, zapisz plan do Linear" choice (or `--auto`). Treat plan content as final.
+
 ### Step 5: Create Subtasks (if needed)
 
 For complex tasks, create subtasks in Linear:
@@ -182,7 +216,7 @@ For complex tasks, create subtasks in Linear:
 
 ### Step 6: Save Plan as Native Linear Attachment
 
-**⛔ DO NOT call `mcp__linear__save_comment` with plan content here. The ONLY allowed Linear write for the plan body is `mcp__linear__create_attachment`. Re-read Hard Rule #1 if tempted.**
+**⛔ DO NOT call `mcp__linear__save_comment` with plan content here. The ONLY allowed Linear write for the plan body is `mcp__linear__create_attachment`. Re-read Hard Rule #1 if tempted.** (Token usage is posted via `save_comment` in Step 7b — that's the one allowed exception.)
 
 Upload the plan directly to Linear via `mcp__linear__create_attachment` — Linear hosts the file itself, no external storage needed.
 
@@ -191,14 +225,18 @@ Upload the plan directly to Linear via `mcp__linear__create_attachment` — Line
 If a `plan.md` attachment is being replaced:
 
 - **Default mode**: ask the user via `AskUserQuestion`:
+
   - "Tak, usuń stary plan i zapisz nowy" (Recommended)
   - "Anuluj"
 
   If confirmed, delete the Linear attachment via `mcp__linear__delete_attachment({ id: oldAttachmentId })`.
+
 - **`--auto` mode**: skip the prompt; delete the old Linear attachment via `mcp__linear__delete_attachment({ id: oldAttachmentId })` automatically and proceed.
 
 #### 6.2 — Write `plan.md` locally
 
+The plan content is exactly the markdown produced in Step 4. Write it to the temp file:
+
 ```bash
 mkdir -p /tmp/claude-plans
 ```
@@ -234,8 +272,40 @@ Delete `/tmp/claude-plans/<taskId>-plan.md` after the attachment is created. `/p
 2. Apply via `mcp__linear__save_issue({ id: taskId, labelIds: [...existingLabelIds, aiPlanLabelId] })`. Preserve existing labels; skip if already present.
 3. If label operations fail, surface the error but do not roll back the plan attachment.
 
+### Step 7b: Post Token-Usage Comment
+
+After the plan attachment and `AI Plan` label have been applied, post a single Linear comment on the **invoked issue** (the `linearTaskId` passed to `/plan`, identical to the labelling target) reporting the session's token usage.
+
+1. Run the per-plugin token-summing script:
+
+   ```bash
+   bash "$CLAUDE_PLUGIN_ROOT/scripts/compute-session-tokens.sh"
+   ```
+
+   The script prints four whitespace-separated integers on one line: `<input> <output> <cache_creation> <cache_read>`. If no transcript can be located it prints `0 0 0 0` and exits non-zero — treat that as a graceful skip (do NOT block; skip posting the comment).
+
+2. Compute `<TOTAL> = <input> + <output> + <cache_creation> + <cache_read>`.
+
+3. Call `mcp__linear__save_comment` with `issueId: taskId` and `body` equal to:
+
+   ```markdown
+   ## Zużycie tokenów — etap /plan
+
+   | Metryka        | Wartość        |
+   | -------------- | -------------- |
+   | Input          | <INPUT>        |
+   | Output         | <OUTPUT>       |
+   | Cache creation | <CACHE_CREATE> |
+   | Cache read     | <CACHE_READ>   |
+   | **Łącznie**    | **<TOTAL>**    |
+   ```
+
+4. **Failure handling**: if the comment fails to post, surface the error to the user but do not roll back the plan attachment or the label.
+
 ### Step 8: Confirm to User
 
+The plan has been approved in Step 4a (or auto-approved in `--auto`). Step 8 is purely informational — **do NOT ask another question here**, just print the status.
+
 **Default mode**:
 
 ```markdown
@@ -244,7 +314,7 @@ Delete `/tmp/claude-plans/<taskId>-plan.md` after the attachment is created. `/p
 Plan implementacji został dodany jako załącznik `plan.md` do zadania [linearTaskId].
 Etykieta `AI Plan` została dodana.
 
-Czy plan jest zaakceptowany? Po akceptacji uruchom `/impl [linearTaskId]` aby rozpocząć implementację.
+Uruchom `/impl [linearTaskId]` aby rozpocząć implementację.
 ```
 
 **`--auto` mode**: post a Linear comment confirming the plan was saved (no question asked) and exit. The comment is the audit trail for the CI run.

package/plugins/flow-external/skills/push/SKILL.md

@@ -100,7 +100,29 @@ If confirmed:
 
 1. Update parent task status to "In Review"
 2. Update completed subtasks to "In Review"
-3. Create summary comment on parent task (in Polish):
+3. **Before posting**, run the token-summing script and capture its output:
+
+   ```bash
+   bash "$CLAUDE_PLUGIN_ROOT/scripts/compute-session-tokens.sh"
+   ```
+
+   It prints four whitespace-separated integers on one line: `<INPUT> <OUTPUT> <CACHE_CREATE> <CACHE_READ>`. If no transcript can be located it prints `0 0 0 0` and exits non-zero — treat that as a graceful skip (still post the comment, with zeros in the table).
+
+   Compute `<TOTAL> = <INPUT> + <OUTPUT> + <CACHE_CREATE> + <CACHE_READ>`. Append exactly one copy of the following Polish block to the bottom of the comment body, after the existing footer. Do not create a second Linear comment — the block belongs in **this** comment.
+
+   ```markdown
+   ## Zużycie tokenów — etap /push
+
+   | Metryka        | Wartość        |
+   | -------------- | -------------- |
+   | Input          | <INPUT>        |
+   | Output         | <OUTPUT>       |
+   | Cache creation | <CACHE_CREATE> |
+   | Cache read     | <CACHE_READ>   |
+   | **Łącznie**    | **<TOTAL>**    |
+   ```
+
+4. Create summary comment on parent task (in Polish):
 
 ```markdown
 ## Podsumowanie Implementacji

package/plugins/flow-legacy/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "flow-legacy",
   "description": "Development flow skills for legacy Angular 14 projects with Linear-driven workflow",
-  "version": "2.83.0"
+  "version": "2.85.0"
 }