@the-bearded-bear/claude-craft 8.22.0 → 8.23.0

package/README.md

@@ -21,12 +21,20 @@ Plus **11 stack-specific reviewers** (@symfony-reviewer, @react-reviewer, @pytho
 
 [![npm version](https://img.shields.io/npm/v/@the-bearded-bear/claude-craft)](https://www.npmjs.com/package/@the-bearded-bear/claude-craft)
 [![npm downloads](https://img.shields.io/npm/dm/@the-bearded-bear/claude-craft)](https://www.npmjs.com/package/@the-bearded-bear/claude-craft)
-[![Claude Code 2.1.97+](https://img.shields.io/badge/Claude%20Code-2.1.97%2B-blue)](https://code.claude.com)
+[![Claude Code 2.1.260+](https://img.shields.io/badge/Claude%20Code-2.1.260%2B-blue)](https://code.claude.com)
 [![CI](https://github.com/TheBeardedBearSAS/claude-craft/actions/workflows/npm-publish.yml/badge.svg)](https://github.com/TheBeardedBearSAS/claude-craft/actions/workflows/npm-publish.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Mutation testing badge](https://img.shields.io/endpoint?style=flat&url=https%3A%2F%2Fbadge-api.stryker-mutator.io%2Fgithub.com%2FTheBeardedBearSAS%2Fclaude-craft%2Fmain)](https://dashboard.stryker-mutator.io/reports/github.com/TheBeardedBearSAS/claude-craft/main)
 
-A comprehensive framework for AI-assisted development with [Claude Code](https://claude.ai/code). Install standardized rules, agents, and commands for your projects across multiple technology stacks — **33 specialized agents (+39 infra agents on-demand), 139 commands across 17 namespaces (233 total), 55 skills**, all token-optimized via `context: fork` and sub-agent model routing.
+A comprehensive framework for AI-assisted development with [Claude Code](https://claude.ai/code). Install standardized rules, agents, and commands for your projects across multiple technology stacks — **33 specialized agents (+39 infra agents on-demand), 140 commands across 17 namespaces (234 total), 55 skills**, all token-optimized via `context: fork` and sub-agent model routing.
+
+## What's New in v8.23.0
+
+**Audit de fraîcheur + alignement Claude (2026-10-13, v8.23.0) :**
+
+- **Sécurité** : classement OWASP Top 10:2025 officiel (A01–A10) dans la règle 11 et ses miroirs, avec test de régression ; FrankenPHP 1.13.0 et PgBouncer 1.26.0 (versions précédentes vulnérables) ; types de serveurs Hetzner et `datacenter` retirés corrigés.
+- **Versions vérifiées sur registres** : React 19.3, Flutter 3.47, React Native 0.87 / Expo 57, Pinia 4, Vite 8.3 (`rolldownOptions`), Vercel CLI 63, Python 3.15, Paperclip 2026.1012.0, Docker 29.9, Kubernetes 1.37 (Gateway API), Vitest 5, Pest 5, pytest 9, PER-CS 3.0.
+- **Claude Code** : minimum 2.1.260, recommandé 2.1.296, modèles 5.5. Détails : [CHANGELOG](CHANGELOG.md#8230---2026-10-13).
 
 ## What's New in v8.18.0
 
@@ -41,7 +49,7 @@ A comprehensive framework for AI-assisted development with [Claude Code](https:/
 **Revue documentation (2026-06-26, v8.17.2) :**
 
 - **Nouveau tutoriel phare** : `docs/guides/*/10-complete-workflow.md` réécrit en walkthrough narré de bout en bout (idée → backlog → sprint → livraison) pour grands débutants — glossaire, modes d'exécution, gates, discipline `/clear`, exemple *TaskFlow* + annexe multi-stack. Disponible en 5 langues, lié depuis le README et `guides/index.md`.
-- **Fraîcheur** : compteurs et versions réalignés sur le SSOT (125 core / 219 total commandes, 70 agents, 55 skills, 11 stacks ; Claude Code 2.1.97 min / 2.1.193 rec ; Flutter 3.44, RN 0.85, Symfony 8.1). Suppression de `/bmad:init` (→ `/workflow:init`).
+- **Fraîcheur** : compteurs et versions réalignés sur le SSOT (125 core / 219 total commandes, 70 agents, 55 skills, 11 stacks ; versions Claude Code min/recommandée ; Flutter 3.44, RN 0.85, Symfony 8.1). Suppression de `/bmad:init` (→ `/workflow:init`).
 - **Sans doublon** : index des guides de migration, en-têtes « narré vs full » (COMMANDS/AGENTS), bannière PLANNED sur MCP-SERVERS, cross-links entre docs concurrentielles, stub `docs/SECURITY.md` supprimé.
 
 ## What's New in v8.17.1
@@ -54,7 +62,7 @@ A comprehensive framework for AI-assisted development with [Claude Code](https:/
 
 - **Versions infra** : Docker 29.6.1, OpenTofu 1.12.2, Ansible 2.21.1, Helm 4.2.2, Node.js 24.x Active LTS.
 - **Sécurité** : OWASP Top 10:2025 complet (10/10 catégories dans la règle 11) ; RS256 marqué DEPRECATED ; guidance Argon2id précisée ; hook templates `protect-files.json` / `quality-gate.json` corrigés (anti-pattern `$TOOL_INPUT` → lecture stdin JSON).
-- **Modèles** : IDs canoniques dans la table d'effort (Opus 4.8 / **Sonnet 5** sorti 2026-06-30, intro $2/$10 / Haiku 4.5). Sonnet 5 remplace 4.6 comme Sonnet courant. Fable 5 / Mythos 5 suspendus (directive export-control US, 2026-06-12) — retirés des recommandations.
+- **Modèles** : IDs canoniques dans la table d'effort (Opus 4.8 / **Sonnet 5** sorti 2026-06-30, intro $2/$10 / Haiku 4.5). Sonnet 5 remplace 4.6 comme Sonnet courant. Fable 5 / Mythos 5 alors retirés des recommandations (note corrigée par l'audit d'alignement du 2026-10-13 : Fable 5.1 est courant, Mythos réservé au Cyber Verification Program).
 - **CLI** : `/goal`, `/usage`, `/workflows` documentés dans CLI-REFERENCE.md.
 - **Optimisation tokens** : `ENABLE_PROMPT_CACHING_1H` et `fallbackModel` activés dans `settings.json` distribué.
 - **Docs** : compteur commandes corrigé (133 → 125 core / 219 total) ; TROUBLESHOOTING, FAQ, CHEAT-SHEET, COMPETITIVE-ANALYSIS enrichis.
@@ -105,7 +113,7 @@ A comprehensive framework for AI-assisted development with [Claude Code](https:/
 - **Parité i18n stricte (v8.8.2)** -- la CI bloque désormais si un fichier traduit est à < 80 % de la taille de l'anglais. Dette i18n résorbée (gap 101 → 0).
 - **Branding the-bearded-bear.com (v8.10.1)** -- migration complète des domaines vers `the-bearded-bear.com`, normalisation de l'organisation GitHub.
 - **126 commandes sur 15 namespaces** (220 total avec infra/projet) -- namespace `/paperclip:*` (8 commandes) ajouté, 55 skills disponibles.
-- **Claude Code 2.1.193** -- version recommandée (Opus 4.8, Artifacts, `claude mcp login`, `/cd`, sous-agents imbriqués, `effort: ultracode`).
+- **Claude Code 2.1.296** -- version recommandée (minimum sécurité 2.1.260 ; Opus 5.5 / Sonnet 5.5 / Haiku 5.5, MCP 2026-07-28, hooks `onFailure: "block"`).
 
 > ← Versions antérieures (v8.0 → v8.7) : voir le [CHANGELOG](CHANGELOG.md) et [.claude/COMPATIBILITY.md](.claude/COMPATIBILITY.md).
 
@@ -153,27 +161,27 @@ Claude Code is powerful on its own. Claude Craft makes it **consistent and team-
 | Stack | Version | Install Command |
 |-------|---------|-----------------|
 | **Symfony / PHP** | 8.1 / PHP 8.4+ | `--tech=symfony` |
-| **React** | 19.2 + Compiler 1.0 | `--tech=react` |
-| **Flutter / Dart** | 3.44 / Dart 3.12 | `--tech=flutter` |
-| **Python** | 3.14+ / FastAPI | `--tech=python` |
+| **React** | 19.3 + Compiler 1.0 | `--tech=react` |
+| **Flutter / Dart** | 3.47 / Dart 3.13 | `--tech=flutter` |
+| **Python** | 3.15 / 3.14+ / FastAPI | `--tech=python` |
 | **Angular** | 22 | `--tech=angular` |
-| **Vue.js** | 3.5+ (3.6 beta Vapor) | `--tech=vuejs` |
-| **Vite** _(community)_ | 8.1 | `--tech=vite` |
-| **Vercel** _(community)_ | 56.5.0 | `--tech=vercel` |
-| **React Native** | 0.85 (New Architecture) | `--tech=reactnative` |
+| **Vue.js** | 3.5+ (3.6 RC Vapor) | `--tech=vuejs` |
+| **Vite** _(community)_ | 8.3 | `--tech=vite` |
+| **Vercel** _(community)_ | 63.1.2 | `--tech=vercel` |
+| **React Native** | 0.87 (New Architecture) | `--tech=reactnative` |
 | **C# / .NET** | 10 LTS / C# 14 | `--tech=csharp` |
 | **Laravel** | 13.x / PHP 8.3+ (8.5 recommandé) | `--tech=laravel` |
 | **PHP** | 8.5 | `--tech=php` |
-| **Paperclip** | 2026.609.0 | `--tech=paperclip` |
-
-| **Docker** | 29.6.1 (CVE-2026-33997) | `--tech=docker` |
-| **Coolify** | v4.1.2 | `--tech=coolify` |
-| **Kubernetes** | 1.36.1 | `--tech=kubernetes` |
-| **OpenTofu** | 1.12.2 | `--tech=opentofu` |
-| **Ansible** | 2.21.1 | `--tech=ansible` |
-| **Hcloud** | 1.61+ | `--tech=hcloud` |
-| **PgBouncer** | 1.25.2 (CVE-2026-6664/6665/6666/6667 patched) | `--tech=pgbouncer` |
-| **FrankenPHP** | 1.12.4 (CVE-2026-45062 patched) | `--tech=frankenphp` |
+| **Paperclip** | 2026.1012.0 | `--tech=paperclip` |
+
+| **Docker** | 29.9.0 | `--tech=docker` |
+| **Coolify** | v4.4.6 | `--tech=coolify` |
+| **Kubernetes** | 1.37.1 | `--tech=kubernetes` |
+| **OpenTofu** | 1.13.1 | `--tech=opentofu` |
+| **Ansible** | 2.21.5 | `--tech=ansible` |
+| **Hcloud** | provider 1.70+ / CLI 1.70.1 | `--tech=hcloud` |
+| **PgBouncer** | 1.26.0 (security fixes over 1.25.x) | `--tech=pgbouncer` |
+| **FrankenPHP** | 1.13.0 (security fixes over 1.12.4) | `--tech=frankenphp` |
 
 See [Technologies](docs/TECHNOLOGIES.md) for full details.
 

package/Tools/Ralph/.ralph/hooks/pre-tool-context.sh

@@ -59,8 +59,8 @@ get_tool_context() {
             fi
             ;;
 
-        # Task tool - remind about sprint context
-        Task)
+        # Agent tool (named Task before Claude Code 2.1.63) - remind about sprint context
+        Agent|Task)
             local progress_file="$RALPH_SESSION_BASE/sprint-progress.md"
             if [[ -f "$progress_file" ]]; then
                 local current_task

package/Tools/StatusLine/README.md

@@ -76,7 +76,7 @@ npm install -g ccusage
 bash ~/.claude/statusline.sh --version
 
 # Test with sample JSON
-echo '{"model":{"display_name":"Opus","id":"claude-opus-4-8"},"context_window":{"used_percentage":42},"cost":{"total_cost_usd":0.5},"workspace":{"current_dir":"/tmp/test","project_dir":"/tmp/test"}}' | bash ~/.claude/statusline.sh
+echo '{"model":{"display_name":"Opus","id":"claude-opus-5-5"},"context_window":{"used_percentage":42},"cost":{"total_cost_usd":0.5},"workspace":{"current_dir":"/tmp/test","project_dir":"/tmp/test"}}' | bash ~/.claude/statusline.sh
 ```
 
 ## Configuration

package/bundles/cursor/.cursorrules

@@ -8,9 +8,9 @@
 
 # Claude-Craft - Multi-Technology Framework
 
-**Version:** 8.22.0 | **Languages:** en, fr, es, de, pt
+**Version:** 8.23.0 | **Languages:** en, fr, es, de, pt
 
-A comprehensive AI-assisted development framework for Claude Code with 13 technology stacks, 33 specialized agents (+39 infra agents on-demand), 139 commands across 17 namespaces, and BMAD v6 project management.
+A comprehensive AI-assisted development framework for Claude Code with 13 technology stacks, 33 specialized agents (+39 infra agents on-demand), 140 commands across 17 namespaces, and BMAD v6 project management.
 
 ---
 
@@ -20,17 +20,17 @@ A comprehensive AI-assisted development framework for Claude Code with 13 techno
 |-------|---------|--------------|--------------|
 | **.NET / C#** | 10 LTS / C# 14 | Clean Architecture | CQRS, MediatR (ou alternative), EF Core |
 | **Symfony / PHP** | 8.1 / PHP 8.4+ | Clean Architecture | DDD, Hexagonal, API Platform, HTTP-less apps, JsonStreamer |
-| **Flutter / Dart** | 3.44 / Dart 3.12 | Clean Architecture | BLoC v9, Riverpod 3, Material 3, Impeller |
-| **React** | 19.2 + Compiler 1.0 | Feature-based | Hooks, Zustand, React Query, Server Components |
-| **React Native** | 0.85 (New Architecture) | Feature-based | Navigation 7, Reanimated 4, TurboModules |
+| **Flutter / Dart** | 3.47 / Dart 3.13 | Clean Architecture | BLoC v9, Riverpod 3, Material 3, Impeller |
+| **React** | 19.3 + Compiler 1.0 | Feature-based | Hooks, Zustand, React Query, Server Components |
+| **React Native** | 0.87 (New Architecture) — Expo SDK 57 | Feature-based | Navigation 7, Reanimated 4, TurboModules |
 | **Angular** | 22 | Domain-driven | Signals, Signal Forms (stable), Zoneless par défaut, OnPush défaut, httpResource (TS 6) |
-| **Vue.js** | 3.5+ (3.6 beta Vapor) | Composition API | Pinia 3, Vue Router 5, Vite 8, Vitest, Alien Signals |
-| **Vite** _(community, framework-agnostic)_ | 8.1 | Vanilla / Library / Multi-page | `build.lib`, `vite-plugin-dts`, `rollupOptions.input`, Workers/WASM |
-| **Vercel** _(community, deployment platform)_ | 56.5.0 | Platform config (framework-agnostic) | `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage |
-| **Laravel** | 13.x / PHP 8.3+ (8.5 recommandé) | Clean Architecture | Actions, Pest 4, Sanctum, AI SDK, Passkey |
-| **Python** | 3.14+ | Clean Architecture / Hexagonal | FastAPI, async/await, Pydantic, free-threading, JIT |
-| **PHP** | 8.5 (Property Hooks 8.4+) | Clean Architecture | PSR-12, PHPStan Level 10, Pest 4 |
-| **Paperclip** | 2026.609.0 | Two-layer (control plane + adapters) | Node.js 22+, TypeScript, Vitest, PostgreSQL, governance-first |
+| **Vue.js** | 3.5+ (3.6 RC Vapor) | Composition API | Pinia 4, Vue Router 5, Vite 8, Vitest, Alien Signals |
+| **Vite** _(community, framework-agnostic)_ | 8.3 | Vanilla / Library / Multi-page | `build.lib`, `vite-plugin-dts`, `input` multi-page, Workers/WASM |
+| **Vercel** _(community, deployment platform)_ | 63.1.2 | Platform config (framework-agnostic) | `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage |
+| **Laravel** | 13.x / PHP 8.3+ (8.5 recommandé) | Clean Architecture | Actions, Pest 4/5 (Pest 5 : PHP 8.4+), Sanctum, AI SDK, Passkey |
+| **Python** | 3.15 / 3.14+ | Clean Architecture / Hexagonal | FastAPI, async/await, Pydantic, free-threading, JIT |
+| **PHP** | 8.5 (Property Hooks 8.4+) | Clean Architecture | PER-CS 3.0 (ex-PSR-12), PHPStan Level 10, Pest 5 |
+| **Paperclip** | 2026.1012.0 | Two-layer (control plane + adapters) | Node.js 24.11+, TypeScript, Vitest, PostgreSQL, governance-first |
 
 ### Technology Quick Links
 
@@ -53,9 +53,9 @@ A comprehensive AI-assisted development framework for Claude Code with 13 techno
 
 > **Note:** Svelte/SvelteKit is **community-maintained** and hors-scope officiel. Voir `.claude/references/svelte/CLAUDE.md` pour le disclaimer complet.
 
-> **Note:** Vite (ce stack) couvre uniquement l'usage **framework-agnostic** de Vite — apps vanilla JS/TS, bibliothèques npm (`build.lib`), apps multi-pages (`rollupOptions.input`) et entrées Workers/WASM. Ce n'est **pas** un remplacement de la configuration Vite dev-server de React/Vue/Angular/Svelte, documentée dans le `tooling.md` propre à chacun de ces stacks.
+> **Note:** Vite (ce stack) couvre uniquement l'usage **framework-agnostic** de Vite — apps vanilla JS/TS, bibliothèques npm (`build.lib`), apps multi-pages (option top-level `input`) et entrées Workers/WASM. Ce n'est **pas** un remplacement de la configuration Vite dev-server de React/Vue/Angular/Svelte, documentée dans le `tooling.md` propre à chacun de ces stacks.
 
-> **Note:** Vercel couvre uniquement la **surface plateforme de déploiement agnostique au framework** — `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage (Blob natif ; Postgres/KV via Marketplace — Neon/Upstash). Ce n'est **pas** un stack Next.js (hors-périmètre, aucun namespace `/nextjs:*`). L'Edge Runtime (`export const runtime = 'edge'`) est **déprécié par Vercel depuis 2026** au profit de Fluid Compute — ce stack le documente uniquement à des fins de migration de code legacy.
+> **Note:** Vercel couvre uniquement la **surface plateforme de déploiement agnostique au framework** — `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage (Blob natif ; Postgres/KV via Marketplace — Neon/Upstash). Ce n'est **pas** un stack Next.js (hors-périmètre, aucun namespace `/nextjs:*`). Vercel recommande de migrer l'Edge Runtime (`export const runtime = 'edge'`) vers Node.js (Fluid Compute) — ce stack le documente uniquement à des fins de migration de code legacy.
 
 See `@.claude/INDEX.md` for condensed checklists and patterns.
 
@@ -63,7 +63,7 @@ See `@.claude/INDEX.md` for condensed checklists and patterns.
 
 ## Available Commands (15 namespaces, 126 commands)
 
-Core: `/common:*`, `/workflow:*`, `/team:*`, `/qa:*`, `/uiux:*` | Tech: `/symfony:*`, `/react:*`, `/flutter:*`, `/python:*`, `/angular:*`, `/vuejs:*`, `/laravel:*`, `/reactnative:*`, `/csharp:*`, `/php:*` _(et `/paperclip:*` via `--tech=paperclip`)_ | Infra (via `@devops-engineer`): Docker 29.6.1, Coolify v4.1.2, K8s 1.36.1, OpenTofu 1.12.2, Ansible 2.21.1, FrankenPHP 1.12.4, PgBouncer 1.25.2 | Project: `/sprint:*`, `/gate:*`, `/project:*`
+Core: `/common:*`, `/workflow:*`, `/team:*`, `/qa:*`, `/uiux:*` | Tech: `/symfony:*`, `/react:*`, `/flutter:*`, `/python:*`, `/angular:*`, `/vuejs:*`, `/laravel:*`, `/reactnative:*`, `/csharp:*`, `/php:*` _(et `/paperclip:*` via `--tech=paperclip`)_ | Infra (via `@devops-engineer`): Docker 29.9.0, Coolify v4.4.6, K8s 1.37.1, OpenTofu 1.13.1, Ansible 2.21.5, FrankenPHP 1.13.0, PgBouncer 1.26.0 | Project: `/sprint:*`, `/gate:*`, `/project:*`
 
 Full reference: [Commands](../docs/COMMANDS.md) | [CLI Reference](../docs/CLI-REFERENCE.md)
 
@@ -178,7 +178,7 @@ make install-symfony TARGET=. RULES_LANG=en
 
 ## Claude Code Compatibility
 
-**Minimum Version:** 2.1.97 (CVE-2025-59536 patched) | **Recommended:** 2.1.193 (Opus 4.8, Artifacts, `claude mcp login`, `/cd`, nested subagents — Week 26) — See `@.claude/COMPATIBILITY.md` for full changelog (v2.1.20+).
+**Minimum Version:** 2.1.260 (CVE-2026-86063 / CVE-2026-103435 / CVE-2026-103012 patched) | **Recommended:** 2.1.296 (Opus 5.5, Sonnet 5.5, Haiku 5.5, MCP 2026-07-28, hooks `onFailure: "block"`) — See `@.claude/COMPATIBILITY.md` for full changelog (v2.1.20+).
 
 ---
 
@@ -196,9 +196,9 @@ See `.claude/rules/12-context-management.md` for detailed guidance.
 | **Parallel worktrees** | Use `git worktree` for concurrent sessions |
 | **Hooks** | CLAUDE.md = suggestions. Hooks = requirements |
 | **`/memory`** | Persistent session learnings across conversations (v2.1.59+) |
-| **Pointers over copies** | Use `@path` references instead of copying code into CLAUDE.md |
+| **Pointers over copies** | Reference files instead of copying code; `@path` imports still load at launch — plain paths or `paths:` rules load on demand |
 | **Token optimization** | Use `/common:setup-rtk` for 55-65% token savings |
-| **Sub-agent model** | Set `CLAUDE_CODE_SUBAGENT_MODEL=claude-sonnet-5` for cost savings |
+| **Sub-agent model** | Set `CLAUDE_CODE_SUBAGENT_MODEL=claude-sonnet-5-5` for cost savings |
 
 See `.claude/templates/hooks/` for ready-to-use hook templates.
 
@@ -208,7 +208,7 @@ See `.claude/templates/hooks/` for ready-to-use hook templates.
 
 ## Stack Overview (2026)
 
-.NET 10 LTS / C# 14 | Symfony 8.1 / PHP 8.4+ | Flutter 3.44 / Dart 3.12 | React 19.2 | Angular 22 | Vue 3.5+ | Laravel 13 / PHP 8.3+ | Python 3.14+
+.NET 10 LTS / C# 14 | Symfony 8.1 / PHP 8.4+ | Flutter 3.47 / Dart 3.13 | React 19.3 | Angular 22 | Vue 3.5+ | Laravel 13 / PHP 8.3+ | Python 3.15 / 3.14+
 
 ## Architecture Layers
 
@@ -236,7 +236,7 @@ WebAPI/Presentation → Infrastructure → Application → Domain (← INWARD ON
 
 Unit 70% (< 1s) | Integration 20% (< 5s) | E2E 10% (< 30s) — **TDD**: RED → GREEN → REFACTOR
 
-**Stacks**: xUnit/FluentAssertions (C#), Pest 4 (PHP), Vitest 4 (JS/TS), pytest 8 (Python)
+**Stacks**: xUnit/FluentAssertions (C#), Pest 5 (PHP), Vitest 5 (JS/TS), pytest 9 (Python)
 
 ## Security Essentials
 
@@ -310,12 +310,12 @@ SRP | OCP | LSP | ISP | DIP — See full rules in .claude/rules/04-solid-princip
 | Profondeur d'indentation | 2 | 3 max |
 | Parametres par methode | 3 | 4 max |
 
+> **Seuils < 7 / < 10 = choix interne du projet**, volontairement plus strict que le défaut de la règle Sonar S3776 (15 par fonction) : à relâcher si le contexte de l'équipe l'exige.
+>
 > **Cognitive Complexity** (SonarQube, ReSharper) est la metrique dominante 2026 : elle mesure la difficulte humaine de comprehension. Elle prevaut sur la stricte limite de 20 lignes. Source : [Cognitive vs Cyclomatic](https://gilles-fabre.medium.com/what-is-the-difference-between-cyclomatic-complexity-and-cognitive-complexity-a87cef0e2851).
 
 **Regles :** Early returns (guard clauses), pas de else imbrique, nommage explicite, composition > heritage.
 
-## DRY — Don't Repeat Yourself
-
 ### Testing
 TDD: RED → GREEN → REFACTOR | Coverage >= 80% | Mutation testing
 
@@ -324,16 +324,16 @@ TDD: RED → GREEN → REFACTOR | Coverage >= 80% | Mutation testing
 
 | # | Menace | Defense |
 |---|--------|---------|
-| 1 | Broken Access Control (inclut **SSRF** consolide) | Verifier permissions a CHAQUE requete, deny by default |
-| 2 | Cryptographic Failures | TLS 1.3, **Argon2id** (128 MiB RAM, t>=3, p=1), secrets dans vault |
-| 3 | Injection | Requetes parametrees, validation/sanitization |
-| 4 | Insecure Design | Threat modeling, defense in depth, rate limiting |
-| 5 | Security Misconfiguration | Hardening, erreurs generiques en prod |
-| 6 | **Software Supply Chain Failures** (nouveau 2025) | SLSA 1.0, SBOM (CycloneDX 1.6+ / SPDX 3), Sigstore keyless signing, reproducible builds |
-| 7 | **Mishandling of Exceptional Conditions** (nouveau 2025) | Logger les erreurs, ne jamais exposer la stack trace en prod |
-| 8 | **Authentication Failures** | MFA obligatoire, brute-force protection, sessions invalidees a la deconnexion |
-| 9 | **Security Logging and Monitoring Failures** | Centraliser les logs, alertes sur anomalies, retention >= 1 an |
-| 10 | **Vulnerable and Outdated Components** | Dependabot/Renovate, `npm audit --audit-level=moderate`, Trivy, Grype |
+| A01 | Broken Access Control (inclut **SSRF** consolidé) | Vérifier les permissions à CHAQUE requête, deny by default |
+| A02 | Security Misconfiguration | Hardening, erreurs génériques en prod |
+| A03 | **Software Supply Chain Failures** (nouveau 2025) | SLSA 1.2, SBOM (CycloneDX 1.7 / SPDX 3), Sigstore keyless signing, reproducible builds, Dependabot/Renovate, `npm audit --audit-level=moderate`, Trivy, Grype |
+| A04 | Cryptographic Failures | TLS 1.3, **Argon2id** (minimum OWASP 19 MiB / t=2 / p=1 ; recommandation interne 128 MiB / t>=3 / p=1), secrets dans vault |
+| A05 | Injection | Requêtes paramétrées, validation/sanitization |
+| A06 | Insecure Design | Threat modeling, defense in depth, rate limiting |
+| A07 | **Authentication Failures** | MFA obligatoire, brute-force protection, sessions invalidées à la déconnexion |
+| A08 | **Software or Data Integrity Failures** | Vérification des signatures/checksums, CI/CD sécurisé, mises à jour signées |
+| A09 | **Security Logging and Alerting Failures** | Centraliser les logs, alertes sur anomalies, rétention >= 1 an |
+| A10 | **Mishandling of Exceptional Conditions** (nouveau 2025) | Logger les erreurs, ne jamais exposer la stack trace en prod |
 
 
 ### Git Workflow

package/bundles/windsurf/.windsurfrules

@@ -8,9 +8,9 @@
 
 # Claude-Craft - Multi-Technology Framework
 
-**Version:** 8.22.0 | **Languages:** en, fr, es, de, pt
+**Version:** 8.23.0 | **Languages:** en, fr, es, de, pt
 
-A comprehensive AI-assisted development framework for Claude Code with 13 technology stacks, 33 specialized agents (+39 infra agents on-demand), 139 commands across 17 namespaces, and BMAD v6 project management.
+A comprehensive AI-assisted development framework for Claude Code with 13 technology stacks, 33 specialized agents (+39 infra agents on-demand), 140 commands across 17 namespaces, and BMAD v6 project management.
 
 ---
 
@@ -20,17 +20,17 @@ A comprehensive AI-assisted development framework for Claude Code with 13 techno
 |-------|---------|--------------|--------------|
 | **.NET / C#** | 10 LTS / C# 14 | Clean Architecture | CQRS, MediatR (ou alternative), EF Core |
 | **Symfony / PHP** | 8.1 / PHP 8.4+ | Clean Architecture | DDD, Hexagonal, API Platform, HTTP-less apps, JsonStreamer |
-| **Flutter / Dart** | 3.44 / Dart 3.12 | Clean Architecture | BLoC v9, Riverpod 3, Material 3, Impeller |
-| **React** | 19.2 + Compiler 1.0 | Feature-based | Hooks, Zustand, React Query, Server Components |
-| **React Native** | 0.85 (New Architecture) | Feature-based | Navigation 7, Reanimated 4, TurboModules |
+| **Flutter / Dart** | 3.47 / Dart 3.13 | Clean Architecture | BLoC v9, Riverpod 3, Material 3, Impeller |
+| **React** | 19.3 + Compiler 1.0 | Feature-based | Hooks, Zustand, React Query, Server Components |
+| **React Native** | 0.87 (New Architecture) — Expo SDK 57 | Feature-based | Navigation 7, Reanimated 4, TurboModules |
 | **Angular** | 22 | Domain-driven | Signals, Signal Forms (stable), Zoneless par défaut, OnPush défaut, httpResource (TS 6) |
-| **Vue.js** | 3.5+ (3.6 beta Vapor) | Composition API | Pinia 3, Vue Router 5, Vite 8, Vitest, Alien Signals |
-| **Vite** _(community, framework-agnostic)_ | 8.1 | Vanilla / Library / Multi-page | `build.lib`, `vite-plugin-dts`, `rollupOptions.input`, Workers/WASM |
-| **Vercel** _(community, deployment platform)_ | 56.5.0 | Platform config (framework-agnostic) | `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage |
-| **Laravel** | 13.x / PHP 8.3+ (8.5 recommandé) | Clean Architecture | Actions, Pest 4, Sanctum, AI SDK, Passkey |
-| **Python** | 3.14+ | Clean Architecture / Hexagonal | FastAPI, async/await, Pydantic, free-threading, JIT |
-| **PHP** | 8.5 (Property Hooks 8.4+) | Clean Architecture | PSR-12, PHPStan Level 10, Pest 4 |
-| **Paperclip** | 2026.609.0 | Two-layer (control plane + adapters) | Node.js 22+, TypeScript, Vitest, PostgreSQL, governance-first |
+| **Vue.js** | 3.5+ (3.6 RC Vapor) | Composition API | Pinia 4, Vue Router 5, Vite 8, Vitest, Alien Signals |
+| **Vite** _(community, framework-agnostic)_ | 8.3 | Vanilla / Library / Multi-page | `build.lib`, `vite-plugin-dts`, `input` multi-page, Workers/WASM |
+| **Vercel** _(community, deployment platform)_ | 63.1.2 | Platform config (framework-agnostic) | `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage |
+| **Laravel** | 13.x / PHP 8.3+ (8.5 recommandé) | Clean Architecture | Actions, Pest 4/5 (Pest 5 : PHP 8.4+), Sanctum, AI SDK, Passkey |
+| **Python** | 3.15 / 3.14+ | Clean Architecture / Hexagonal | FastAPI, async/await, Pydantic, free-threading, JIT |
+| **PHP** | 8.5 (Property Hooks 8.4+) | Clean Architecture | PER-CS 3.0 (ex-PSR-12), PHPStan Level 10, Pest 5 |
+| **Paperclip** | 2026.1012.0 | Two-layer (control plane + adapters) | Node.js 24.11+, TypeScript, Vitest, PostgreSQL, governance-first |
 
 ### Technology Quick Links
 
@@ -53,9 +53,9 @@ A comprehensive AI-assisted development framework for Claude Code with 13 techno
 
 > **Note:** Svelte/SvelteKit is **community-maintained** and hors-scope officiel. Voir `.claude/references/svelte/CLAUDE.md` pour le disclaimer complet.
 
-> **Note:** Vite (ce stack) couvre uniquement l'usage **framework-agnostic** de Vite — apps vanilla JS/TS, bibliothèques npm (`build.lib`), apps multi-pages (`rollupOptions.input`) et entrées Workers/WASM. Ce n'est **pas** un remplacement de la configuration Vite dev-server de React/Vue/Angular/Svelte, documentée dans le `tooling.md` propre à chacun de ces stacks.
+> **Note:** Vite (ce stack) couvre uniquement l'usage **framework-agnostic** de Vite — apps vanilla JS/TS, bibliothèques npm (`build.lib`), apps multi-pages (option top-level `input`) et entrées Workers/WASM. Ce n'est **pas** un remplacement de la configuration Vite dev-server de React/Vue/Angular/Svelte, documentée dans le `tooling.md` propre à chacun de ces stacks.
 
-> **Note:** Vercel couvre uniquement la **surface plateforme de déploiement agnostique au framework** — `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage (Blob natif ; Postgres/KV via Marketplace — Neon/Upstash). Ce n'est **pas** un stack Next.js (hors-périmètre, aucun namespace `/nextjs:*`). L'Edge Runtime (`export const runtime = 'edge'`) est **déprécié par Vercel depuis 2026** au profit de Fluid Compute — ce stack le documente uniquement à des fins de migration de code legacy.
+> **Note:** Vercel couvre uniquement la **surface plateforme de déploiement agnostique au framework** — `vercel.json`, Functions (Node.js/Fluid Compute), ISR, Cron Jobs, Storage (Blob natif ; Postgres/KV via Marketplace — Neon/Upstash). Ce n'est **pas** un stack Next.js (hors-périmètre, aucun namespace `/nextjs:*`). Vercel recommande de migrer l'Edge Runtime (`export const runtime = 'edge'`) vers Node.js (Fluid Compute) — ce stack le documente uniquement à des fins de migration de code legacy.
 
 See `@.claude/INDEX.md` for condensed checklists and patterns.
 
@@ -63,7 +63,7 @@ See `@.claude/INDEX.md` for condensed checklists and patterns.
 
 ## Available Commands (15 namespaces, 126 commands)
 
-Core: `/common:*`, `/workflow:*`, `/team:*`, `/qa:*`, `/uiux:*` | Tech: `/symfony:*`, `/react:*`, `/flutter:*`, `/python:*`, `/angular:*`, `/vuejs:*`, `/laravel:*`, `/reactnative:*`, `/csharp:*`, `/php:*` _(et `/paperclip:*` via `--tech=paperclip`)_ | Infra (via `@devops-engineer`): Docker 29.6.1, Coolify v4.1.2, K8s 1.36.1, OpenTofu 1.12.2, Ansible 2.21.1, FrankenPHP 1.12.4, PgBouncer 1.25.2 | Project: `/sprint:*`, `/gate:*`, `/project:*`
+Core: `/common:*`, `/workflow:*`, `/team:*`, `/qa:*`, `/uiux:*` | Tech: `/symfony:*`, `/react:*`, `/flutter:*`, `/python:*`, `/angular:*`, `/vuejs:*`, `/laravel:*`, `/reactnative:*`, `/csharp:*`, `/php:*` _(et `/paperclip:*` via `--tech=paperclip`)_ | Infra (via `@devops-engineer`): Docker 29.9.0, Coolify v4.4.6, K8s 1.37.1, OpenTofu 1.13.1, Ansible 2.21.5, FrankenPHP 1.13.0, PgBouncer 1.26.0 | Project: `/sprint:*`, `/gate:*`, `/project:*`
 
 Full reference: [Commands](../docs/COMMANDS.md) | [CLI Reference](../docs/CLI-REFERENCE.md)
 
@@ -178,7 +178,7 @@ make install-symfony TARGET=. RULES_LANG=en
 
 ## Claude Code Compatibility
 
-**Minimum Version:** 2.1.97 (CVE-2025-59536 patched) | **Recommended:** 2.1.193 (Opus 4.8, Artifacts, `claude mcp login`, `/cd`, nested subagents — Week 26) — See `@.claude/COMPATIBILITY.md` for full changelog (v2.1.20+).
+**Minimum Version:** 2.1.260 (CVE-2026-86063 / CVE-2026-103435 / CVE-2026-103012 patched) | **Recommended:** 2.1.296 (Opus 5.5, Sonnet 5.5, Haiku 5.5, MCP 2026-07-28, hooks `onFailure: "block"`) — See `@.claude/COMPATIBILITY.md` for full changelog (v2.1.20+).
 
 ---
 
@@ -196,9 +196,9 @@ See `.claude/rules/12-context-management.md` for detailed guidance.
 | **Parallel worktrees** | Use `git worktree` for concurrent sessions |
 | **Hooks** | CLAUDE.md = suggestions. Hooks = requirements |
 | **`/memory`** | Persistent session learnings across conversations (v2.1.59+) |
-| **Pointers over copies** | Use `@path` references instead of copying code into CLAUDE.md |
+| **Pointers over copies** | Reference files instead of copying code; `@path` imports still load at launch — plain paths or `paths:` rules load on demand |
 | **Token optimization** | Use `/common:setup-rtk` for 55-65% token savings |
-| **Sub-agent model** | Set `CLAUDE_CODE_SUBAGENT_MODEL=claude-sonnet-5` for cost savings |
+| **Sub-agent model** | Set `CLAUDE_CODE_SUBAGENT_MODEL=claude-sonnet-5-5` for cost savings |
 
 See `.claude/templates/hooks/` for ready-to-use hook templates.
 
@@ -208,7 +208,7 @@ See `.claude/templates/hooks/` for ready-to-use hook templates.
 
 ## Stack Overview (2026)
 
-.NET 10 LTS / C# 14 | Symfony 8.1 / PHP 8.4+ | Flutter 3.44 / Dart 3.12 | React 19.2 | Angular 22 | Vue 3.5+ | Laravel 13 / PHP 8.3+ | Python 3.14+
+.NET 10 LTS / C# 14 | Symfony 8.1 / PHP 8.4+ | Flutter 3.47 / Dart 3.13 | React 19.3 | Angular 22 | Vue 3.5+ | Laravel 13 / PHP 8.3+ | Python 3.15 / 3.14+
 
 ## Architecture Layers
 
@@ -236,7 +236,7 @@ WebAPI/Presentation → Infrastructure → Application → Domain (← INWARD ON
 
 Unit 70% (< 1s) | Integration 20% (< 5s) | E2E 10% (< 30s) — **TDD**: RED → GREEN → REFACTOR
 
-**Stacks**: xUnit/FluentAssertions (C#), Pest 4 (PHP), Vitest 4 (JS/TS), pytest 8 (Python)
+**Stacks**: xUnit/FluentAssertions (C#), Pest 5 (PHP), Vitest 5 (JS/TS), pytest 9 (Python)
 
 ## Security Essentials
 
@@ -310,12 +310,12 @@ SRP | OCP | LSP | ISP | DIP — See full rules in .claude/rules/04-solid-princip
 | Profondeur d'indentation | 2 | 3 max |
 | Parametres par methode | 3 | 4 max |
 
+> **Seuils < 7 / < 10 = choix interne du projet**, volontairement plus strict que le défaut de la règle Sonar S3776 (15 par fonction) : à relâcher si le contexte de l'équipe l'exige.
+>
 > **Cognitive Complexity** (SonarQube, ReSharper) est la metrique dominante 2026 : elle mesure la difficulte humaine de comprehension. Elle prevaut sur la stricte limite de 20 lignes. Source : [Cognitive vs Cyclomatic](https://gilles-fabre.medium.com/what-is-the-difference-between-cyclomatic-complexity-and-cognitive-complexity-a87cef0e2851).
 
 **Regles :** Early returns (guard clauses), pas de else imbrique, nommage explicite, composition > heritage.
 
-## DRY — Don't Repeat Yourself
-
 ### Testing
 TDD: RED → GREEN → REFACTOR | Coverage >= 80% | Mutation testing
 
@@ -324,16 +324,16 @@ TDD: RED → GREEN → REFACTOR | Coverage >= 80% | Mutation testing
 
 | # | Menace | Defense |
 |---|--------|---------|
-| 1 | Broken Access Control (inclut **SSRF** consolide) | Verifier permissions a CHAQUE requete, deny by default |
-| 2 | Cryptographic Failures | TLS 1.3, **Argon2id** (128 MiB RAM, t>=3, p=1), secrets dans vault |
-| 3 | Injection | Requetes parametrees, validation/sanitization |
-| 4 | Insecure Design | Threat modeling, defense in depth, rate limiting |
-| 5 | Security Misconfiguration | Hardening, erreurs generiques en prod |
-| 6 | **Software Supply Chain Failures** (nouveau 2025) | SLSA 1.0, SBOM (CycloneDX 1.6+ / SPDX 3), Sigstore keyless signing, reproducible builds |
-| 7 | **Mishandling of Exceptional Conditions** (nouveau 2025) | Logger les erreurs, ne jamais exposer la stack trace en prod |
-| 8 | **Authentication Failures** | MFA obligatoire, brute-force protection, sessions invalidees a la deconnexion |
-| 9 | **Security Logging and Monitoring Failures** | Centraliser les logs, alertes sur anomalies, retention >= 1 an |
-| 10 | **Vulnerable and Outdated Components** | Dependabot/Renovate, `npm audit --audit-level=moderate`, Trivy, Grype |
+| A01 | Broken Access Control (inclut **SSRF** consolidé) | Vérifier les permissions à CHAQUE requête, deny by default |
+| A02 | Security Misconfiguration | Hardening, erreurs génériques en prod |
+| A03 | **Software Supply Chain Failures** (nouveau 2025) | SLSA 1.2, SBOM (CycloneDX 1.7 / SPDX 3), Sigstore keyless signing, reproducible builds, Dependabot/Renovate, `npm audit --audit-level=moderate`, Trivy, Grype |
+| A04 | Cryptographic Failures | TLS 1.3, **Argon2id** (minimum OWASP 19 MiB / t=2 / p=1 ; recommandation interne 128 MiB / t>=3 / p=1), secrets dans vault |
+| A05 | Injection | Requêtes paramétrées, validation/sanitization |
+| A06 | Insecure Design | Threat modeling, defense in depth, rate limiting |
+| A07 | **Authentication Failures** | MFA obligatoire, brute-force protection, sessions invalidées à la déconnexion |
+| A08 | **Software or Data Integrity Failures** | Vérification des signatures/checksums, CI/CD sécurisé, mises à jour signées |
+| A09 | **Security Logging and Alerting Failures** | Centraliser les logs, alertes sur anomalies, rétention >= 1 an |
+| A10 | **Mishandling of Exceptional Conditions** (nouveau 2025) | Logger les erreurs, ne jamais exposer la stack trace en prod |
 
 
 ### Git Workflow

package/cli/lib/doctor.js

@@ -13,29 +13,29 @@ import c from './colors.js';
 import { listDirs } from './fs-utils.js';
 import { assertSafeTarget } from './path-safety.js';
 
-// Single source of truth for the security baseline. Bumped from 2.1.47 in v8.3.0
-// after CVE-2025-59536 (CVSS 8.7) cumulative hardening completed in 2.1.97.
-const MIN_CLAUDE_CODE = '2.1.97';
-
 /**
- * Read the recommended Claude Code version from config/versions.yaml.
- * Falls back to hardcoded value if the file is unavailable.
+ * Read a Claude Code version from config/versions.yaml (`claudeCode.<key>`).
+ * Falls back to the given hardcoded value if the file is unavailable.
+ * @param {'minimum'|'recommended'} key
+ * @param {string} fallback
  * @returns {string}
  */
-function loadRecommendedClaudeCodeVersion() {
-  const FALLBACK = '2.1.193';
+function loadClaudeCodeVersion(key, fallback) {
   try {
     const __dirname = path.dirname(fileURLToPath(import.meta.url));
     const versionsPath = path.resolve(__dirname, '..', '..', 'config', 'versions.yaml');
-    if (!fs.existsSync(versionsPath)) return FALLBACK;
+    if (!fs.existsSync(versionsPath)) return fallback;
     const parsed = yaml.load(fs.readFileSync(versionsPath, 'utf8'));
-    return parsed?.claudeCode?.recommended ?? FALLBACK;
+    return parsed?.claudeCode?.[key] ?? fallback;
   } catch {
-    return FALLBACK;
+    return fallback;
   }
 }
 
-const RECOMMENDED_CLAUDE_CODE = loadRecommendedClaudeCodeVersion();
+// Security floor: plugin SHA-pin bypass (CVE-2026-86063, fixed 2.1.179), symlink
+// TOCTOU write (CVE-2026-103435, 2.1.129), managed settings bypass (CVE-2026-103012, 2.1.260).
+const MIN_CLAUDE_CODE = loadClaudeCodeVersion('minimum', '2.1.260');
+const RECOMMENDED_CLAUDE_CODE = loadClaudeCodeVersion('recommended', '2.1.296');
 
 /**
  * Compare two semver-ish version strings (`major.minor.patch`).
@@ -140,19 +140,19 @@ function runDoctor(targetPath, deps = {}) {
     failed++;
   }
 
-  // 3. Claude Code installed and >= 2.1.97 (CVE-2025-59536 baseline)
+  // 3. Claude Code installed and >= MIN_CLAUDE_CODE (security baseline)
   const claudeVerRaw = exec('claude --version');
   if (claudeVerRaw) {
     const semver = extractSemver(claudeVerRaw);
     if (semver && semverCmp(semver, MIN_CLAUDE_CODE) < 0) {
       console.log(
-        `  ${c.red}[FAIL]${c.reset} Claude Code ${semver} — requires >= ${MIN_CLAUDE_CODE} (CVE-2025-59536, CVSS 8.7)`
+        `  ${c.red}[FAIL]${c.reset} Claude Code ${semver} — requires >= ${MIN_CLAUDE_CODE} (security fixes: CVE-2026-86063, CVE-2026-103435, CVE-2026-103012)`
       );
       console.log(`         Upgrade: ${c.cyan}npm install -g @anthropic-ai/claude-code@latest${c.reset}`);
       failed++;
     } else if (semver && semverCmp(semver, RECOMMENDED_CLAUDE_CODE) < 0) {
       console.log(
-        `  ${c.yellow}[WARN]${c.reset} Claude Code ${semver} — recommended ${RECOMMENDED_CLAUDE_CODE} (Opus 4.8 + Dynamic Workflows)`
+        `  ${c.yellow}[WARN]${c.reset} Claude Code ${semver} — recommended ${RECOMMENDED_CLAUDE_CODE} (latest permission fixes)`
       );
       warned++;
     } else {

package/cli/lib/tech-registry.js

@@ -41,7 +41,7 @@ const TECH_REGISTRY = {
     namespace: 'flutter',
     i18nDir: 'Flutter',
     installScript: 'install-flutter-rules.sh',
-    version: '3.44 / Dart 3.12',
+    version: '3.47 / Dart 3.13',
     tier: 1,
   },
   react: {
@@ -51,7 +51,7 @@ const TECH_REGISTRY = {
     namespace: 'react',
     i18nDir: 'React',
     installScript: 'install-react-rules.sh',
-    version: '19.2 + Compiler 1.0',
+    version: '19.3 + Compiler 1.0',
     tier: 1,
   },
   reactnative: {
@@ -61,7 +61,7 @@ const TECH_REGISTRY = {
     namespace: 'reactnative',
     i18nDir: 'ReactNative',
     installScript: 'install-reactnative-rules.sh',
-    version: '0.85',
+    version: '0.87',
     tier: 2,
   },
   angular: {
@@ -87,7 +87,7 @@ const TECH_REGISTRY = {
   laravel: {
     name: 'laravel',
     displayName: 'Laravel',
-    desc: 'PHP backend with Actions, Pest 4, Sanctum, AI SDK, Passkey',
+    desc: 'PHP backend with Actions, Pest 5, Sanctum, AI SDK, Passkey',
     namespace: 'laravel',
     i18nDir: 'Laravel',
     installScript: 'install-laravel-rules.sh',
@@ -111,7 +111,7 @@ const TECH_REGISTRY = {
     namespace: 'vite',
     i18nDir: 'Vite',
     installScript: 'install-vite-rules.sh',
-    version: '8.1',
+    version: '8.3',
     tier: 3,
   },
   vercel: {
@@ -121,7 +121,7 @@ const TECH_REGISTRY = {
     namespace: 'vercel',
     i18nDir: 'Vercel',
     installScript: 'install-vercel-rules.sh',
-    version: '56.5.0',
+    version: '63.1.2',
     tier: 3,
   },
   php: {
@@ -145,7 +145,7 @@ const TECH_REGISTRY = {
     namespace: 'python',
     i18nDir: 'Python',
     installScript: 'install-python-rules.sh',
-    version: '3.14+',
+    version: '3.15 / 3.14+',
     tier: 1,
   },
   paperclip: {
@@ -155,7 +155,7 @@ const TECH_REGISTRY = {
     namespace: 'paperclip',
     i18nDir: 'Paperclip',
     installScript: 'install-paperclip-rules.sh',
-    version: '2026.609.0',
+    version: '2026.1012.0',
     tier: 2,
   },
   docker: {
@@ -165,7 +165,7 @@ const TECH_REGISTRY = {
     namespace: 'docker',
     i18nDir: 'Docker',
     installScript: 'install-docker-rules.sh',
-    version: '29.6.1',
+    version: '29.9.0',
     tier: null,
   },
   coolify: {
@@ -175,7 +175,7 @@ const TECH_REGISTRY = {
     namespace: 'coolify',
     i18nDir: 'Coolify',
     installScript: 'install-coolify-rules.sh',
-    version: '4.1.2',
+    version: '4.4.6',
     tier: null,
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-bearded-bear/claude-craft",
-  "version": "8.22.0",
+  "version": "8.23.0",
   "description": "A comprehensive framework for AI-assisted development with Claude Code. Install standardized rules, agents, and commands for your projects.",
   "type": "module",
   "main": "cli/index.js",
@@ -32,6 +32,7 @@
     "commitlint": "commitlint --edit",
     "prepublishOnly": "node -e \"import{readFileSync}from'node:fs';const p=JSON.parse(readFileSync('./package.json','utf8'));if(!/^\\d+\\.\\d+\\.\\d+(-[a-z0-9.]+)?$/i.test(p.version)){console.error('Invalid version format');process.exit(1)}\"",
     "metrics:adoption": "node scripts/track-adoption-metrics.mjs",
+    "audit:claude-signals": "node scripts/collect-claude-signals.mjs",
     "mutation": "stryker run",
     "mutation:ci": "stryker run --reporters progress,json",
     "test:e2e:tools": "cd tests/e2e/tools && docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from e2e-runner",