bigpowers 2.83.4 → 2.84.1

package/.zcode/skills/wire-ci/SKILL.md

@@ -10,12 +10,12 @@ description: "CI pipeline setup with pre-built templates and local validation. G
 >
 > **HARD GATE** — CI that is untestable locally will break every cycle. Always run `--validate` after generating workflows and `--dry-run` before pushing.
 
-Generate, validate, and test CI workflows. Detects your project type, produces platform-appropriate GitHub Actions configurations, and provides local verification to catch auth, permissions, and syntax issues before they reach CI.
+Generate, validate, and test CI workflows. Detects your project type, copies org templates from `danielvm-git/.github/workflow-templates/`, and provides local verification to catch auth, permissions, and syntax issues before they reach CI.
 
 ## What this sets up
 
-1. **CI workflow** — `.github/workflows/ci.yaml` with test, lint, typecheck, build steps
-2. **Release workflow** — `.github/workflows/release.yaml` with semantic-release (if applicable)
+1. **Test Build Release workflow** — `.github/workflows/test-build-release.yml` with lint → test → build → release (single pipeline, `needs:` chain)
+2. **Deploy workflow** — `.github/workflows/deploy.yml` triggered via `workflow_run` (BigBase/Pages stacks only; CLI/library repos omit this)
 3. **`--validate` mode** — checks YAML syntax, workflow permissions, required secrets, and common pitfalls
 4. **`--dry-run` mode** — runs workflows locally via `act` or `gh workflow run` to prove correctness before push
 5. **Failure pattern documentation** — common CI failure categories and their fixes
@@ -24,45 +24,41 @@ Generate, validate, and test CI workflows. Detects your project type, produces p
 
 ### 1. Detect project type
 
-Read the project root for manifest files to determine which template to use:
+Read the project root for manifest files to determine which template pair to copy:
 
-| Manifest | Type | Template |
-|----------|------|----------|
-| `Cargo.toml` | Rust | Rust CI: test, clippy, fmt, build |
-| `package.json` | Node | Node CI: test, lint, typecheck, build |
-| `setup.py` / `pyproject.toml` | Python | Python CI: pytest, ruff/mypy/flake8, build |
-| `go.mod` | Go | Go CI: test, vet, staticcheck, build |
-| `CMakeLists.txt` | C/C++ | C/C++ CI: cmake build, ctest |
-| Multiple detected | Polyglot | Combined workflows or error if ambiguous |
+| Manifest | Type | Template pair (from `.github` repo) |
+|----------|------|-------------------------------------|
+| `Cargo.toml` | Rust | `test-build-release-monorepo.yml` + `deploy-monorepo.yml` (or monorepo subset) |
+| `package.json` | Node | `test-build-release-node.yml` + `deploy-node.yml` |
+| `setup.py` / `pyproject.toml` | Python | `test-build-release-python.yml` + `deploy-python.yml` |
+| `go.mod` | Go | `test-build-release-go.yml` + `deploy-go.yml` |
+| Static site (no server) | Static | `test-build-release-static.yml` + `deploy-static.yml` |
+| `Package.swift` | Swift | `test-build-release-swift.yml` only (no deploy yet) |
+| Multiple detected | Polyglot | `test-build-release-monorepo.yml` + `deploy-monorepo.yml` |
 
-If no manifest is found, prompt the user to specify the type or pass `--type <rust|node|python|go|cpp>`.
+**CLI/library repos** (no hosted target): copy only `test-build-release-<stack>.yml` → `test-build-release.yml`. The `release` job is terminal; skip `deploy.yml`. See `docs/how-to/migrate-ci-cd/migration-plan.md` § CLI and library repos.
 
-### 2. Generate CI workflow
+If no manifest is found, prompt the user to specify the type or pass `--type <rust|node|python|go|static|swift>`.
 
-Create `.github/workflows/ci.yaml` with standard steps derived from the project type and its manifest:
+### 2. Copy test-build-release template
 
-**Rust template (`Cargo.toml`):**
-See [REFERENCE.md](REFERENCE.md)
-
-**Node template (`package.json`):**
-See [REFERENCE.md](REFERENCE.md)
+Copy the matching template from `~/Developer/.github/workflow-templates/` to `.github/workflows/test-build-release.yml`. **Do not rename the workflow `name:` field** — deploy listens for `"Test Build Release"`.
 
-**Python template (`setup.py` / `pyproject.toml`):**
-See [REFERENCE.md](REFERENCE.md)
+Edit placeholders: `APP_TYPE`, `SITE_URL`, language versions.
 
-**Go template (`go.mod`):**
-See [REFERENCE.md](REFERENCE.md)
+See [REFERENCE.md](REFERENCE.md) for stack-specific job shapes.
 
-**C/C++ template (`CMakeLists.txt`):**
-See [REFERENCE.md](REFERENCE.md)
+### 3. Copy deploy template (hosted stacks only)
 
-### 3. Generate release workflow (if semantic-release detected)
+If the project deploys to BigBase or GitHub Pages:
 
-If the project has semantic-release configured (in `package.json`, `.releaserc`, or `release.config.js`), also generate `.github/workflows/release.yaml`:
+```bash
+cp ~/Developer/.github/workflow-templates/deploy-${STACK}.yml .github/workflows/deploy.yml
+```
 
-See [REFERENCE.md](REFERENCE.md)
+Configure `BIGBASE_SITE_ID`, `BIGBASE_DEPLOY_TOKEN`, and matching `SITE_URL`. Deploy runs via `workflow_run` after TBR succeeds on `main` with `cancel-in-progress: false`.
 
-> **NPM_TOKEN is required** for publishing to npm. Without it, semantic-release will fail at the publish step. See `--validate` to check this.
+Skip this step for CLI/library repos.
 
 ### 4. Validate workflows (`--validate`)
 
@@ -97,6 +93,8 @@ Add the following to the project's documentation or CLAUDE.md after setup:
 | `cargo clippy` errors | New lints in Rust nightly | `cargo clippy --fix` or allow specific lints |
 | `act` not found | Docker not running or act not installed | `brew install act` / `docker ps` to verify Docker |
 | Hardcoded Node version stale | `.nvmrc` exists but workflow uses hardcoded version | Use `node-version-file: .nvmrc` instead |
+| Deploy never runs | TBR workflow renamed | Keep `name: Test Build Release` in test-build-release.yml |
+| Release rebuilds binary | Artifact not downloaded | `release` job must `download-artifact` from `build` |
 
 ## Verify
 
@@ -120,26 +118,24 @@ Add the following to the project's documentation or CLAUDE.md after setup:
 
 ## Examples
 
-### Create CI for a Rust project
+### Create CI for a Go project (TBR + optional deploy)
 
 ```bash
-# Detect from Cargo.toml, generate workflows
-wire-ci
+# Copy org templates
+cp ~/Developer/.github/workflow-templates/test-build-release-go.yml .github/workflows/test-build-release.yml
+cp ~/Developer/.github/workflow-templates/deploy-go.yml .github/workflows/deploy.yml
 
-# Validate generated workflows
 wire-ci --validate
-
-# Run locally with act
 wire-ci --dry-run
 ```
 
-### Create CI for a Node project with semantic-release
+### Create CI for a CLI tool (TBR only, no deploy)
 
 ```bash
-wire-ci
+cp ~/Developer/.github/workflow-templates/test-build-release-go.yml .github/workflows/test-build-release.yml
+# Edit release job to download build artifact — see big-release dogfood
+
 wire-ci --validate
-# Expect warning: "npm publish step found but no NPM_TOKEN in secrets"
-# Fix: add NPM_TOKEN to repo secrets
 ```
 
 ### Validate existing workflows (no generation)
@@ -148,7 +144,6 @@ wire-ci --validate
 wire-ci --validate --check-only
 ```
 
-
 ---
 
 ## Options
@@ -160,8 +155,7 @@ wire-ci --validate --check-only
 | `--check-only` | Only validate, do not generate new files |
 | `--type <type>` | Force project type (skip auto-detection) |
 | `--force` | Overwrite existing workflow files |
-| `--no-release` | Skip release workflow generation even if semantic-release detected |
-
+| `--no-deploy` | Skip deploy.yml even for hosted stacks |
 
 ---
 
@@ -174,202 +168,191 @@ When `wire-ci` is used as part of `build-epic`:
 
 ---
 
-## Reference block 1
+## Reference block 1 — test-build-release.yml (Go, excerpt)
 
 ```yaml
-name: CI
-on: [push, pull_request]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions-rust/toolchain@v1
-        with:
-          toolchain: stable
-          components: clippy, rustfmt
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy -- -D warnings
-      - run: cargo test
-      - run: cargo build --release
-```
+name: Test Build Release
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
 
----
+permissions:
+  contents: read
 
-## Reference block 2
+concurrency:
+  group: pipeline-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-```yaml
-name: CI
-on: [push, pull_request]
 jobs:
-  test:
-    runs-on: ubuntu-latest
+  lint:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          node-version: 20
-          cache: npm
-      - run: npm ci
-      - run: npm test
-      - run: npm run lint 2>/dev/null || true
-      - run: npm run typecheck 2>/dev/null || true
-      - run: npm run build 2>/dev/null || true
-```
-
----
-
-## Reference block 3
+          go-version: '1.22'
+          cache: true
+      - uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84  # v6.5.2
+        with:
+          version: v1.64.8
 
-```yaml
-name: CI
-on: [push, pull_request]
-jobs:
   test:
-    runs-on: ubuntu-latest
+    needs: [lint]
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          python-version: "3.12"
-          cache: pip
-      - run: pip install -e ".[dev]" || pip install -e .
-      - run: pip install pytest ruff mypy
-      - run: ruff check .
-      - run: mypy . 2>/dev/null || true
-      - run: pytest
-```
-
----
-
-## Reference block 4
+          go-version: '1.22'
+          cache: true
+      - run: go vet ./...
+      - run: go test ./... -count=1
 
-```yaml
-name: CI
-on: [push, pull_request]
-jobs:
-  test:
-    runs-on: ubuntu-latest
+  build:
+    needs: [test]
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          go-version: stable
+          go-version: '1.22'
           cache: true
-      - run: go vet ./...
-      - run: go test ./...
       - run: go build ./...
+      - run: jq -n --arg sha "${{ github.sha }}" '{sha: $sha}' > deploy-meta.json
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: deploy-meta
+          path: deploy-meta.json
+
+  release:
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    needs: [build]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          fetch-depth: 0
+      - run: npx semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
 ---
 
-## Reference block 5
+## Reference block 2 — deploy.yml (BigBase, excerpt)
 
 ```yaml
-name: CI
-on: [push, pull_request]
+name: Deploy
+on:
+  workflow_run:
+    workflows: ["Test Build Release"]
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+env:
+  SITE_URL: "https://CHANGE-ME.bigbase.click"
+
 jobs:
-  test:
-    runs-on: ubuntu-latest
+  deploy:
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'main'
+    runs-on: ubuntu-22.04
+    environment: production
     steps:
-      - uses: actions/checkout@v4
-      - run: cmake -B build
-      - run: cmake --build build
-      - run: ctest --test-dir build
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: deploy-meta
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: deploy-meta
+      - uses: danielvm-git/.github/actions/bigbase-deploy@9c56ac10c629f3baa110ddb19136579e3c90d690  # v1
+        with:
+          site_id: ${{ secrets.BIGBASE_SITE_ID }}
+          app_type: go
+          site_url: ${{ env.SITE_URL }}
+          deploy_token: ${{ secrets.BIGBASE_DEPLOY_TOKEN }}
+          ref: ${{ steps.meta.outputs.ref }}
+          skip_health_check: true
+      - name: Health check
+        run: |
+          curl -sf "${{ env.SITE_URL }}" || exit 1
 ```
 
 ---
 
-## Reference block 6
+## Reference block 3 — CLI dogfood (big-release pattern)
 
 ```yaml
-name: Release
-on:
-  push:
-    branches: [main]
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-      id-token: write
+  build:
+    needs: [test]
     steps:
-      - uses: actions/checkout@v4
+      - run: make build
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
+          name: big-release-${{ github.sha }}
+          path: bin/big-release
+
+  release:
+    needs: [build]
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
-          node-version: 20
-          cache: npm
-      - run: npm ci
-      - run: npm run build 2>/dev/null || true
-      - run: npx semantic-release
-        env:
-          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: \${{ secrets.NPM_TOKEN }}
+          name: big-release-${{ github.sha }}
+          path: bin
+      - run: make release   # cross-compile assets only; host binary from artifact
+      - run: big-release release --verbose
 ```
 
+No `deploy.yml` — CLI publishes via the release job.
+
 ---
 
-## Reference block 7
+## Reference block 4 — validate script
 
 ```bash
-# Validate YAML syntax
-for f in .github/workflows/*.yaml; do
+for f in .github/workflows/*.yml .github/workflows/*.yaml; do
+  [ -f "$f" ] || continue
   python3 -c "import yaml; yaml.safe_load(open('$f'))" || echo "FAIL: $f has YAML syntax errors"
 done
 
-# Check permissions block presence
-for f in .github/workflows/*.yaml; do
+for f in .github/workflows/test-build-release.yml; do
   if grep -q "permissions:" "$f"; then
     echo "OK: $f has permissions block"
   else
-    echo "WARNING: $f missing permissions block — add one for security"
-  fi
-done
-
-# Check for npm publish without NPM_TOKEN
-for f in .github/workflows/*.yaml; do
-  if grep -q "npm publish\|npx semantic-release" "$f"; then
-    if ! grep -q "NPM_TOKEN" "$f"; then
-      echo "WARNING: $f has npm publish/semantic-release but no NPM_TOKEN secret"
-    fi
+    echo "WARNING: $f missing permissions block"
   fi
 done
 
-# Check for hardcoded Node versions
-for f in .github/workflows/*.yaml; do
-  if grep -q "node-version: [0-9]" "$f" && grep -qv "node-version-file\|\.nvmrc" "$f"; then
-    echo "NOTE: $f has hardcoded Node version — consider using .nvmrc instead"
+if grep -q 'workflows: \["Test Build Release"\]' .github/workflows/deploy.yml 2>/dev/null; then
+  if ! grep -q 'name: Test Build Release' .github/workflows/test-build-release.yml; then
+    echo "WARNING: deploy.yml listens for Test Build Release but TBR name may differ"
   fi
-done
-
-# Check for common secrets reference errors
-for f in .github/workflows/*.yaml; do
-  # Secrets referencing something that doesn't exist in the workflow
-  grep -oP 'secrets\.\w+' "$f" | sort -u | while read -r secret; do
-    echo "REF: $f references $secret"
-  done
-done
+fi
 ```
 
 ---
 
-## Reference block 8
+## Reference block 5 — dry-run
 
 ```bash
-# Option A: Use act (recommended)
 if command -v act &>/dev/null; then
-  act push --dry-run
-  echo "OK: act dry-run completed"
+  act push --dry-run -W .github/workflows/test-build-release.yml
 elif command -v gh &>/dev/null; then
-  # Option B: Use gh workflow run (remote test, no local docker)
-  gh workflow run ci.yaml --ref "$(git branch --show-current)"
-  echo "OK: CI workflow dispatched. Check status: gh run list"
+  gh workflow run test-build-release.yml --ref "$(git branch --show-current)"
 else
-  echo "NOTE: Install act (https://github.com/nektos/act) for full local dry-run"
-  echo "      Install gh CLI for remote dry-run"
+  echo "Install act or gh for dry-run"
 fi
 ```

package/CHANGELOG.md

@@ -1,3 +1,40 @@
+## [2.84.1](https://github.com/danielvm-git/bigpowers/compare/v2.84.0...v2.84.1) (2026-07-25)
+
+
+### Bug Fixes
+
+* close all open bugs and issues — consolidated fix session ([b02c7b9](https://github.com/danielvm-git/bigpowers/commit/b02c7b995b7baf8662a515f47350412a1add598b))
+
+# [2.84.0](https://github.com/danielvm-git/bigpowers/compare/v2.83.4...v2.84.0) (2026-07-24)
+
+
+### Bug Fixes
+
+* **install:** hub test dry-run grep SIGPIPE + OpenCode verify ([dd9ca99](https://github.com/danielvm-git/bigpowers/commit/dd9ca994534905efa1ec24a2afad5bbda5432d1b))
+
+
+### Features
+
+* **62:** OpenCode install hub wiring (Wave B) ([b768546](https://github.com/danielvm-git/bigpowers/commit/b76854632549912389b1ef575d2058c4482919f4))
+* **70:** Trae install hub wiring (Wave B) ([8183f3a](https://github.com/danielvm-git/bigpowers/commit/8183f3ab430941a3482caa1547c017dd02e781e1))
+* **71:** Copilot CLI install hub wiring (Wave B) ([d7d21f4](https://github.com/danielvm-git/bigpowers/commit/d7d21f4141b14eff18aebd9dc383ad0e719f93d9))
+* **73:** Windsurf install hub wiring (Wave B) ([9d5c758](https://github.com/danielvm-git/bigpowers/commit/9d5c75878215d8038df6de7f0d54ca7d32308248))
+* **e62:** OpenCode adapter (Wave A) ([7b508a9](https://github.com/danielvm-git/bigpowers/commit/7b508a9382c3ca00c3f24203da3a19ba70c38f33))
+* **e65:** Codex CLI adapter (Wave A) ([3475197](https://github.com/danielvm-git/bigpowers/commit/34751977adceb1765f1c30798d41f14730777143))
+* **e65:** Codex CLI install hub wiring (Wave B) ([4773ea3](https://github.com/danielvm-git/bigpowers/commit/4773ea303e82b963318ce2644d6c235e3cc7e9ad))
+* **e66:** Cline adapter (Wave A) ([908e5ac](https://github.com/danielvm-git/bigpowers/commit/908e5ac0cc21db1429ae0bbdb05c6d21a2366b7f))
+* **e66:** Cline install hub wiring (Wave B) ([d1bb38c](https://github.com/danielvm-git/bigpowers/commit/d1bb38c5112d8adeff2a04aec50d5130f272d8ce))
+* **e67:** Kilo adapter (Wave A) ([814cc01](https://github.com/danielvm-git/bigpowers/commit/814cc010143fcb7926e40b7c5cbd968996c7cd84))
+* **e67:** Kilo install hub wiring (Wave B) ([5cd40f2](https://github.com/danielvm-git/bigpowers/commit/5cd40f286e4bf6b8abedb0cc16584ded9cea09f9))
+* **e68:** Qwen Code adapter (Wave A) ([bdcd197](https://github.com/danielvm-git/bigpowers/commit/bdcd19791811b1c2a9853820aaf41cb7e2a4c6e8))
+* **e68:** Qwen Code install hub wiring (Wave B) ([96374ea](https://github.com/danielvm-git/bigpowers/commit/96374eaeeb61215b57a25143c99d323d8614980d))
+* **e70:** Trae adapter (Wave A) ([87d1350](https://github.com/danielvm-git/bigpowers/commit/87d1350696db421f3bf162bc0dc6cfb1eb780723))
+* **e71:** Copilot CLI adapter (Wave A) ([4b23263](https://github.com/danielvm-git/bigpowers/commit/4b23263fe585681957ebc022295566585865f7bf))
+* **e72:** CodeBuddy adapter (Wave A) ([73f69cd](https://github.com/danielvm-git/bigpowers/commit/73f69cd68bd0fd5e0f3b5388dfc19871df7b92c2))
+* **e72:** CodeBuddy install hub wiring (Wave B) ([f0d5304](https://github.com/danielvm-git/bigpowers/commit/f0d53044ae94ed5ee9d2322661f96e4121847622))
+* **e73:** Windsurf adapter (Wave A) ([beb47d7](https://github.com/danielvm-git/bigpowers/commit/beb47d71d093c7d429a58113a3ad7a18903258de))
+* **fleet:** complete 9 integration epics (e62, e65-e68, e70-e73) ([a34bfc9](https://github.com/danielvm-git/bigpowers/commit/a34bfc943babd399db9275e20455d195519e2510))
+
 ## [2.83.4](https://github.com/danielvm-git/bigpowers/compare/v2.83.3...v2.83.4) (2026-07-24)
 
 

package/CONVENTIONS.md

@@ -48,6 +48,7 @@ All changes to this repository MUST follow the [Conventional Commits 1.0.0](http
 - **State Commit Policy:** To minimize git history noise, intermediate `chore(state):` commits (e.g., tracking build-epic step transitions) should either be squashed locally using the `--squash-state` flag on `release-branch` before merging, or kept out-of-band using local cycle-state files.
 - Never call GitHub REST API directly (curl, fetch, etc.)
 - Never create GitHub issues from automated workflows — produce local .md files in specs/ instead
+- **Post-land branch cleanup:** `land-branch.sh` squash-merges the feature branch, so `git branch -d <branch>` afterward always fails ("not fully merged" — expected, since a squash doesn't create an ancestor relationship). `git branch -D <branch>` is the correct next step, but `guard-git`'s hook blocks agents from running `-D` directly. Leave the orphaned local branch for the human to delete, or fix `land-branch.sh` to delete its own branch under the `GIT_BIGPOWERS_LAND=1` exemption it already sets — don't spend a turn fighting the hook.
 
 ### Pre-Merge Verification Gates
 
@@ -265,6 +266,26 @@ Skill content is edited in `skills/*/SKILL.md` and auto-propagated to these targ
 
 **Never edit any of these targets directly.** Edit the SKILL.md sources and run rebuild scripts (`bash scripts/sync-skills.sh`, `npm run site:build`).
 
+### Packaging boundary — dev-repo tooling vs. end-user CLI
+
+bigpowers ships itself as an npm package (`bin/setup.js`) while also being a
+self-hosting monorepo that dogfoods its own skills. `.npmignore` excludes
+`specs/`, `docs/`, and `.git` from the published tarball — a real end-user
+install has none of them.
+
+**Any script invoked from `bin/*.js` (the end-user CLI surface) must not
+assume dev-only files exist.** `scripts/sync-skills.sh` conflates two
+concerns — skill distribution (render into `.cursor/rules/` etc., relevant
+to every user) and dev-repo maintenance (`sync_post_run`: regenerate
+`skills-lock.json`, `SKILL-INDEX.md`, `docs/references/model-profiles.md`,
+`specs/epics-wiki/`, `specs/adr-wiki/` — relevant only to bigpowers
+contributors). `bin/setup.js` calls it with `--distribute-only`, which skips
+`sync_post_run` entirely; the no-flag form remains the contributor
+dev-workflow. Before wiring any dev-maintenance script into an installer
+path, verify with `command npm pack --pack-destination <dir>` + extract
+what a real install actually contains, rather than assuming `specs/`/`docs/`
+are present (see `BUG-2026-07-24-installer-runs-dev-maintenance-pipeline`).
+
 ### Legacy paths (migrate away)
 
 | Old | New |
@@ -294,6 +315,7 @@ Skill content is edited in `skills/*/SKILL.md` and auto-propagated to these targ
 - **Verification mandate:** Every story must include runnable `verify:` commands (in epic shards or story files). No story is done until `verify-work` confirms it (or user explicitly waives with documented reason in `specs/state.yaml` handoff).
 - Exception messages must include the offending value, expected shape, and an actionable remediation hint for the agent.
 - SOLID beyond SRP: favor interfaces over concrete types (DIP) when injecting dependencies.
+- **`grep -E` portability:** never use `\d` or `\D` in a `grep -E` pattern — they are PCRE-only escapes, not GNU grep extensions (unlike `\s`/`\S`/`\w`/`\W`, which GNU grep does support). Real GNU grep on Linux CI treats `\d` as a literal `d`, silently matching nothing; this only "works" on macOS if the local `grep` happens to be a permissive BSD/GNU-compatible variant. Use `[0-9]` instead. This exact defect broke the traceability gate codebase-wide (`scripts/lib/trace-stories.py`, `scripts/lib/trace-matrix.py`) while passing every local check.
 
 ## Comments
 

package/README.md

@@ -52,6 +52,19 @@ npx bigpowers setup
 
 Both commands sync skill artifacts and link them to Claude Code, Gemini CLI, and Cursor (see [Prerequisites](#-prerequisites)).
 
+### Interactive Installer
+
+The `npx bigpowers setup` command launches an interactive menu where you can:
+
+1. **Choose install mode**: Setup/Update or Uninstall
+2. **Select location**: Global (available everywhere) or Local (current project only)
+3. **Pick tools**: Select which AI tools to install skills for (Claude Code, Cursor, Gemini, pi, etc.)
+4. **Confirm**: Review and confirm the installation
+
+Use **arrow keys** to navigate, **space** to select, and **Enter** to confirm.
+
+![Interactive Installer](docs/images/interactive-installer.png)
+
 ### From source (contributors)
 
 ```bash
@@ -173,7 +186,7 @@ Run `npm run compliance` to audit all features. Score < 94% = hard stop.
 
 ## 📁 Project Structure
 
-- `skills/[skill-name]/`: Source files for each of the 72 skills.
+- `skills/[skill-name]/`: Source files for each of the 80 skills.
 - `scripts/`: Installation, syncing, and compliance tools.
 - `specs/`: YAML cockpit — `state.yaml`, `release-plan.yaml`, `epics/`, `execution-status.yaml`, `requirements/`.
 - `specs/metrics/`: Cycle-time ledger (`cycle-times.yaml`) — per-story BCPs, timestamps, BCP/hr (v2.0.0).