bigpowers 2.88.16 → 2.88.18

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.16",
+  "version": "2.88.18",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.mcp.json

@@ -2,8 +2,8 @@
   "mcpServers": {
     "bigpowers-mcp": {
       "command": "node",
-      "args": ["${OMP_PLUGIN_ROOT}/bigpowers-mcp/build/index.js"],
-      "cwd": "${OMP_PLUGIN_ROOT}"
+      "args": ["${OMP_PLUGIN_ROOT:-.}/bigpowers-mcp/build/index.js"],
+      "cwd": "${OMP_PLUGIN_ROOT:-.}"
     }
   }
 }

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.16",
+  "version": "2.88.18",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## [2.88.18](https://github.com/danielvm-git/bigpowers/compare/v2.88.17...v2.88.18) (2026-11-02)
+
+
+### Bug Fixes
+
+* **dashboard:** bind the project dashboard to loopback ([#175](https://github.com/danielvm-git/bigpowers/issues/175)) ([b796b17](https://github.com/danielvm-git/bigpowers/commit/b796b17f3b077a36d725018d3ad6f2fb5cc0426f))
+* **dashboard:** escape project metadata before rendering HTML ([#178](https://github.com/danielvm-git/bigpowers/issues/178)) ([f905d5b](https://github.com/danielvm-git/bigpowers/commit/f905d5b30753e715d8675401aeceefa98d850476))
+* **mcp:** filter every diff before returning its contents ([#174](https://github.com/danielvm-git/bigpowers/issues/174)) ([d0b9f70](https://github.com/danielvm-git/bigpowers/commit/d0b9f70a7319d396858890e2abfa1253b68837ff))
+* **migrate:** treat version metadata and preview paths as data ([#177](https://github.com/danielvm-git/bigpowers/issues/177)) ([2b0649c](https://github.com/danielvm-git/bigpowers/commit/2b0649c0a8723695e2c1f078112bca3993b8b383))
+* **scripts:** escape AGENTS commands when emitting Bash exports ([#176](https://github.com/danielvm-git/bigpowers/issues/176)) ([1800dd5](https://github.com/danielvm-git/bigpowers/commit/1800dd5f682cb98afdbbdce06cbcc8cae2a6eb9f))
+
+## [2.88.17](https://github.com/danielvm-git/bigpowers/compare/v2.88.16...v2.88.17) (2026-10-30)
+
+
+### Bug Fixes
+
+* **compliance:** restore akita.feature to 0 FAIL — dedupe helpers, split oversized files ([#171](https://github.com/danielvm-git/bigpowers/issues/171)) ([4ed9a26](https://github.com/danielvm-git/bigpowers/commit/4ed9a2663c39689de04fd2ff796b09777a78cfcf)), closes [#118](https://github.com/danielvm-git/bigpowers/issues/118) [123/#125](https://github.com/danielvm-git/bigpowers/issues/125) [#161](https://github.com/danielvm-git/bigpowers/issues/161) [#155](https://github.com/danielvm-git/bigpowers/issues/155) [#161](https://github.com/danielvm-git/bigpowers/issues/161) [#168](https://github.com/danielvm-git/bigpowers/issues/168) [#169](https://github.com/danielvm-git/bigpowers/issues/169) [#168](https://github.com/danielvm-git/bigpowers/issues/168) [#168](https://github.com/danielvm-git/bigpowers/issues/168)
+
 ## [2.88.16](https://github.com/danielvm-git/bigpowers/compare/v2.88.15...v2.88.16) (2026-10-25)
 
 

package/bigpowers-mcp/build/lib/git-context.js

@@ -6,17 +6,15 @@ import { GIT_SCOPE_DIRS } from "../config.js";
 import { isSecretPath } from "./paths.js";
 function inScope(filePath) {
     const norm = filePath.replace(/\\/g, "/");
-    if (isSecretPath(norm))
-        return false;
-    return GIT_SCOPE_DIRS.some((d) => norm === d || norm.startsWith(`${d}/`));
+    if (isSecretPath(norm)) return false;
+    return GIT_SCOPE_DIRS.some((d)=>norm === d || norm.startsWith(`${d}/`));
 }
 function groupByDir(files) {
     const grouped = {};
-    for (const f of files) {
+    for (const f of files){
         const parts = f.split("/");
         const dir = parts.length > 1 ? parts[0] : ".";
-        if (!grouped[dir])
-            grouped[dir] = [];
+        if (!grouped[dir]) grouped[dir] = [];
         grouped[dir].push(f);
     }
     return grouped;
@@ -25,18 +23,20 @@ function git(repoRoot, args) {
     return execFileSync("git", args, {
         cwd: repoRoot,
         encoding: "utf8",
-        maxBuffer: 10 * 1024 * 1024,
+        maxBuffer: 10 * 1024 * 1024
     }).trim();
 }
 export function getGitContext(repoRoot, action) {
     if (action === "status") {
-        const out = git(repoRoot, ["status", "--porcelain"]);
-        const files = out
-            .split("\n")
-            .filter(Boolean)
-            .map((line) => line.slice(3).trim())
-            .filter(inScope);
-        return { action, changed_files: groupByDir(files) };
+        const out = git(repoRoot, [
+            "status",
+            "--porcelain"
+        ]);
+        const files = out.split("\n").filter(Boolean).map((line)=>line.slice(3).trim()).filter(inScope);
+        return {
+            action,
+            changed_files: groupByDir(files)
+        };
     }
     if (action === "log") {
         const out = git(repoRoot, [
@@ -45,48 +45,64 @@ export function getGitContext(repoRoot, action) {
             "--pretty=format:%H|%s",
             "--name-only",
             "--",
-            ...GIT_SCOPE_DIRS,
+            ...GIT_SCOPE_DIRS
         ]);
         const commits = [];
         let current = null;
-        for (const line of out.split("\n")) {
+        for (const line of out.split("\n")){
             if (line.includes("|")) {
-                if (current)
-                    commits.push(current);
+                if (current) commits.push(current);
                 const [hash, subject] = line.split("|");
-                current = { hash, subject, files: [] };
-            }
-            else if (line.trim() && current && inScope(line.trim())) {
+                current = {
+                    hash,
+                    subject,
+                    files: []
+                };
+            } else if (line.trim() && current && inScope(line.trim())) {
                 current.files.push(line.trim());
             }
         }
-        if (current)
-            commits.push(current);
-        return { action, changed_files: {}, commits };
+        if (current) commits.push(current);
+        return {
+            action,
+            changed_files: {},
+            commits
+        };
     }
-    const diffOut = git(repoRoot, ["diff", "--", ...GIT_SCOPE_DIRS]);
+    const diffOut = git(repoRoot, [
+        "diff",
+        "--",
+        ...GIT_SCOPE_DIRS
+    ]);
     const diffs = {};
     let currentFile = "";
     let buf = [];
-    for (const line of diffOut.split("\n")) {
+    const flushDiff = ()=>{
+        if (currentFile && buf.length && inScope(currentFile)) {
+            diffs[currentFile] = buf.join("\n");
+        }
+    };
+    for (const line of diffOut.split("\n")){
         if (line.startsWith("diff --git")) {
-            if (currentFile && buf.length)
-                diffs[currentFile] = buf.join("\n");
+            flushDiff();
             const match = / b\/(.+)$/.exec(line);
             currentFile = match?.[1] ?? "";
-            buf = [line];
-        }
-        else {
+            buf = [
+                line
+            ];
+        } else {
             buf.push(line);
         }
     }
-    if (currentFile && buf.length && inScope(currentFile) && !isSecretPath(currentFile)) {
-        diffs[currentFile] = buf.join("\n");
-    }
+    flushDiff();
     const changed = Object.keys(diffs);
-    return { action, changed_files: groupByDir(changed), diffs };
+    return {
+        action,
+        changed_files: groupByDir(changed),
+        diffs
+    };
 }
 export function isGitRepo(repoRoot) {
     return fs.existsSync(path.join(repoRoot, ".git"));
 }
-//# sourceMappingURL=git-context.js.map
+//# sourceMappingURL=git-context.js.map

package/bigpowers-mcp/build/lib/git-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/lib/git-context.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS1C,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAe;IACjC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,GAAG,CAAC,QAAgB,EAAE,IAAc;IAC3C,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAiC;IAC/E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG;aACd,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACnC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE;YACxB,KAAK;YACL,KAAK;YACL,uBAAuB;YACvB,aAAa;YACb,IAAI;YACJ,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,MAAM,OAAO,GAAgC,EAAE,CAAC;QAChD,IAAI,OAAO,GAA8D,IAAI,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,OAAO;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACzC,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM;gBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,WAAW,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"sources":["../../src/lib/git-context.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,SAAS,YAAY,QAAQ,qBAAqB;AAClD,OAAO,QAAQ,UAAU;AACzB,OAAO,UAAU,YAAY;AAC7B,SAAS,cAAc,QAAQ,eAAe;AAC9C,SAAS,YAAY,QAAQ,aAAa;AAS1C,SAAS,QAAQ,QAAgB;IAC/B,MAAM,OAAO,SAAS,OAAO,CAAC,OAAO;IACrC,IAAI,aAAa,OAAO,OAAO;IAC/B,OAAO,eAAe,IAAI,CAAC,CAAC,IAAM,SAAS,KAAK,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE;AAEA,SAAS,WAAW,KAAe;IACjC,MAAM,UAAoC,CAAC;IAC3C,KAAK,MAAM,KAAK,MAAO;QACrB,MAAM,QAAQ,EAAE,KAAK,CAAC;QACtB,MAAM,MAAM,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE;QACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACpB;IACA,OAAO;AACT;AAEA,SAAS,IAAI,QAAgB,EAAE,IAAc;IAC3C,OAAO,aAAa,OAAO,MAAM;QAC/B,KAAK;QACL,UAAU;QACV,WAAW,KAAK,OAAO;IACzB,GAAG,IAAI;AACT;AAEA,OAAO,SAAS,cAAc,QAAgB,EAAE,MAAiC;IAC/E,IAAI,WAAW,UAAU;QACvB,MAAM,MAAM,IAAI,UAAU;YAAC;YAAU;SAAc;QACnD,MAAM,QAAQ,IACX,KAAK,CAAC,MACN,MAAM,CAAC,SACP,GAAG,CAAC,CAAC,OAAS,KAAK,KAAK,CAAC,GAAG,IAAI,IAChC,MAAM,CAAC;QACV,OAAO;YAAE;YAAQ,eAAe,WAAW;QAAO;IACpD;IAEA,IAAI,WAAW,OAAO;QACpB,MAAM,MAAM,IAAI,UAAU;YACxB;YACA;YACA;YACA;YACA;eACG;SACJ;QACD,MAAM,UAAuC,EAAE;QAC/C,IAAI,UAAqE;QACzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAO;YAClC,IAAI,KAAK,QAAQ,CAAC,MAAM;gBACtB,IAAI,SAAS,QAAQ,IAAI,CAAC;gBAC1B,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC;gBACnC,UAAU;oBAAE;oBAAM;oBAAS,OAAO,EAAE;gBAAC;YACvC,OAAO,IAAI,KAAK,IAAI,MAAM,WAAW,QAAQ,KAAK,IAAI,KAAK;gBACzD,QAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;YAC9B;QACF;QACA,IAAI,SAAS,QAAQ,IAAI,CAAC;QAC1B,OAAO;YAAE;YAAQ,eAAe,CAAC;YAAG;QAAQ;IAC9C;IAEA,MAAM,UAAU,IAAI,UAAU;QAAC;QAAQ;WAAS;KAAe;IAC/D,MAAM,QAAgC,CAAC;IACvC,IAAI,cAAc;IAClB,IAAI,MAAgB,EAAE;IACtB,MAAM,YAAY;QAChB,IAAI,eAAe,IAAI,MAAM,IAAI,QAAQ,cAAc;YACrD,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC;QAChC;IACF;IACA,KAAK,MAAM,QAAQ,QAAQ,KAAK,CAAC,MAAO;QACtC,IAAI,KAAK,UAAU,CAAC,eAAe;YACjC;YACA,MAAM,QAAQ,YAAY,IAAI,CAAC;YAC/B,cAAc,OAAO,CAAC,EAAE,IAAI;YAC5B,MAAM;gBAAC;aAAK;QACd,OAAO;YACL,IAAI,IAAI,CAAC;QACX;IACF;IACA;IAEA,MAAM,UAAU,OAAO,IAAI,CAAC;IAC5B,OAAO;QAAE;QAAQ,eAAe,WAAW;QAAU;IAAM;AAC7D;AAEA,OAAO,SAAS,UAAU,QAAgB;IACxC,OAAO,GAAG,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU;AAC3C","file":"git-context.js","sourceRoot":""}

package/bigpowers-mcp/src/lib/git-context.ts

@@ -2,7 +2,7 @@
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { GIT_SCOPE_DIRS, SECRET_DENYLIST } from "../config.js";
+import { GIT_SCOPE_DIRS } from "../config.js";
 import { isSecretPath } from "./paths.js";
 
 export interface GitContextResult {
@@ -76,9 +76,14 @@ export function getGitContext(repoRoot: string, action: "status" | "log" | "diff
   const diffs: Record<string, string> = {};
   let currentFile = "";
   let buf: string[] = [];
+  const flushDiff = () => {
+    if (currentFile && buf.length && inScope(currentFile)) {
+      diffs[currentFile] = buf.join("\n");
+    }
+  };
   for (const line of diffOut.split("\n")) {
     if (line.startsWith("diff --git")) {
-      if (currentFile && buf.length) diffs[currentFile] = buf.join("\n");
+      flushDiff();
       const match = / b\/(.+)$/.exec(line);
       currentFile = match?.[1] ?? "";
       buf = [line];
@@ -86,9 +91,7 @@ export function getGitContext(repoRoot: string, action: "status" | "log" | "diff
       buf.push(line);
     }
   }
-  if (currentFile && buf.length && inScope(currentFile) && !isSecretPath(currentFile)) {
-    diffs[currentFile] = buf.join("\n");
-  }
+  flushDiff();
 
   const changed = Object.keys(diffs);
   return { action, changed_files: groupByDir(changed), diffs };
@@ -97,3 +100,4 @@ export function getGitContext(repoRoot: string, action: "status" | "log" | "diff
 export function isGitRepo(repoRoot: string): boolean {
   return fs.existsSync(path.join(repoRoot, ".git"));
 }
+

package/dashboard/src/web/client.html

@@ -218,6 +218,12 @@
     let eventSource = null;
     let pollInterval = null;
 
+    // Project metadata belongs in HTML text content, never in markup.
+    function escapeHtml(value) {
+      const entities = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+      return String(value).replace(/[&<>"']/g, char => entities[char]);
+    }
+
     function render(data) {
       if (!data) return;
       renderPipeline(data);
@@ -246,14 +252,14 @@
 
       let html = '';
       if (metrics) {
-        html += `<div class="metric-row"><span class="metric-label">Total BCPs</span><span class="metric-value">${metrics.totalBcps}</span></div>`;
+        html += `<div class="metric-row"><span class="metric-label">Total BCPs</span><span class="metric-value">${escapeHtml(metrics.totalBcps)}</span></div>`;
         html += `<div class="metric-row"><span class="metric-label">Avg BCP/Hour</span><span class="metric-value">${metrics.avgBcpPerHour.toFixed(2)}</span></div>`;
       }
       if (velocity) {
         html += `<div class="metric-row"><span class="metric-label">Current Velocity</span><span class="metric-value">${velocity.avgBcpPerHour.toFixed(2)} BCP/h</span></div>`;
       }
       if (data.state?.release?.version) {
-        html += `<div class="metric-row"><span class="metric-label">Version</span><span class="metric-value">${data.state.release.version}</span></div>`;
+        html += `<div class="metric-row"><span class="metric-label">Version</span><span class="metric-value">${escapeHtml(data.state.release.version)}</span></div>`;
       }
       if (timestamp) {
         html += `<div class="metric-row"><span class="metric-label">Updated</span><span class="metric-value" style="font-size: 10px;">${new Date(timestamp).toLocaleTimeString()}</span></div>`;
@@ -271,7 +277,7 @@
         { key: 'Git Branch', value: state.gitBranch }
       ];
       container.innerHTML = pairs.map(pair => {
-        const val = pair.value || '(none)';
+        const val = escapeHtml(pair.value || '(none)');
         return `<div class="state-pair"><span class="state-key">${pair.key}</span><span class="state-value">${val}</span></div>`;
       }).join('');
     }
@@ -288,8 +294,8 @@
         const storyCount = stories.length;
         return `
           <div class="epic-item">
-            <div class="epic-title">${epic.id || 'Unknown'}</div>
-            <div style="color: var(--ink-soft); font-size: 11px; margin-bottom: 0;">${epic.title || 'Untitled'}</div>
+            <div class="epic-title">${escapeHtml(epic.id || 'Unknown')}</div>
+            <div style="color: var(--ink-soft); font-size: 11px; margin-bottom: 0;">${escapeHtml(epic.title || 'Untitled')}</div>
             <div class="epic-stories">${storyCount} stories</div>
           </div>
         `;
@@ -308,10 +314,10 @@
         const end = row.end ? new Date(row.end).toLocaleDateString() : '(active)';
         return `
           <div class="ledger-row">
-            <div class="ledger-id">${row.id}</div>
+            <div class="ledger-id">${escapeHtml(row.id)}</div>
             <div style="text-align: right;">
-              <div class="ledger-value">${row.bcps} BCP</div>
-              <div class="ledger-meta">${row.cycleMin}min | ${row.bcpPerHour.toFixed(2)}/h</div>
+              <div class="ledger-value">${escapeHtml(row.bcps)} BCP</div>
+              <div class="ledger-meta">${escapeHtml(row.cycleMin)}min | ${row.bcpPerHour.toFixed(2)}/h</div>
             </div>
           </div>
         `;
@@ -417,3 +423,4 @@
   </script>
 </body>
 </html>
+

package/dashboard/src/web/server.js

@@ -104,9 +104,10 @@ function createServer(projectRoot, port = 7742) {
 
   return {
     listen(portNum = port, cb) {
-      return app.listen(portNum, cb);
+      return app.listen(portNum, '127.0.0.1', cb);
     }
   };
 }
 
 module.exports = { createServer };
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.16",
+  "version": "2.88.18",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/bp-read-agents.sh

@@ -53,9 +53,11 @@ if $PRINT_MODE; then
   if [ -n "$BP_LINT" ];      then echo "Lint:      $BP_LINT"; fi
   if [ -n "$BP_DEPLOY" ];    then echo "Deploy:    $BP_DEPLOY"; fi
 else
-  if [ -n "$BP_PREFLIGHT" ]; then echo "export BP_PREFLIGHT='$BP_PREFLIGHT'"; fi
-  if [ -n "$BP_TEST" ];      then echo "export BP_TEST='$BP_TEST'"; fi
-  if [ -n "$BP_BUILD" ];     then echo "export BP_BUILD='$BP_BUILD'"; fi
-  if [ -n "$BP_LINT" ];      then echo "export BP_LINT='$BP_LINT'"; fi
-  if [ -n "$BP_DEPLOY" ];    then echo "export BP_DEPLOY='$BP_DEPLOY'"; fi
+  # Bash %q preserves the command as data when the caller evaluates exports.
+  if [ -n "$BP_PREFLIGHT" ]; then printf 'export BP_PREFLIGHT=%q\n' "$BP_PREFLIGHT"; fi
+  if [ -n "$BP_TEST" ];      then printf 'export BP_TEST=%q\n' "$BP_TEST"; fi
+  if [ -n "$BP_BUILD" ];     then printf 'export BP_BUILD=%q\n' "$BP_BUILD"; fi
+  if [ -n "$BP_LINT" ];      then printf 'export BP_LINT=%q\n' "$BP_LINT"; fi
+  if [ -n "$BP_DEPLOY" ];    then printf 'export BP_DEPLOY=%q\n' "$BP_DEPLOY"; fi
 fi
+

package/scripts/lib/golden-suite-gates.sh

@@ -9,6 +9,7 @@ GOLDEN_GATES=(
   "compliance:npm run compliance:false"
   "g04-selftest:bash scripts/golden-g04-selftest.sh:true"
   "g06-migrate-version:bash tests/run-golden-migrate-version.sh:true"
+  "security-migration:node tests/security/migration.cjs:false"
   "g07-negative-path:bash scripts/golden-g07-negative-path.sh:false"
   "g08-anti-vacuity:bash scripts/golden-g08-anti-vacuity.sh:false"
   "g09-yaml-roundtrip:bash scripts/golden-g09-yaml-roundtrip.sh:false"
@@ -66,10 +67,14 @@ GOLDEN_GATES=(
   "golden-g11-worktree-venv:bash scripts/test-golden-g11-worktree-venv.sh:false"
   "install-helpers:bash scripts/test-install-helpers.sh:false"
   "project-runtime:bash scripts/test-project-runtime.sh:false"
+  "security-agents-import:node tests/security/agents-import.cjs:false"
   "omp-extension:bash scripts/validate-omp-extension.sh:false"
   "mcp-package:bash scripts/validate-mcp-package.sh:false"
+  "security-git-context:node tests/security/git-context.cjs:false"
   "docs-base-path:bash scripts/validate-docs-base-path.sh:false"
+  "security-dashboard-bind:node tests/security/dashboard-bind.cjs:false"
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
+  "security-dashboard-render:node tests/security/dashboard-render.cjs:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"
   "specs-parse:bash scripts/validate-specs-yaml.sh:false"
   # The runner itself: failing output is shown, skips are named and reasoned.
@@ -204,3 +209,4 @@ golden_run_deterministic_gates() {
     fi
   done
 }
+

package/scripts/lib/migrate-version-common.sh

@@ -21,23 +21,32 @@ EOF
 }
 
 migrate_installed_version() {
-  node -e "console.log(require('$BIGPOWERS_ROOT/package.json').version)" 2>/dev/null || echo "unknown"
+  node -e 'console.log(require(process.argv[1]).version)' "$BIGPOWERS_ROOT/package.json" 2>/dev/null || echo "unknown"
+}
+
+migrate_validate_version() {
+  local version="$1" label="$2"
+  local pattern='^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'
+  if [[ ! "$version" =~ $pattern ]]; then
+    echo "migrate-version: invalid $label version; expected major.minor.patch with optional prerelease/build metadata" >&2
+    return 4
+  fi
 }
 
 migrate_yaml_get() {
   local file="$1" key="$2"
-  $PYTHON -c "
+  "$PYTHON" -c "
 import yaml, sys
 try:
-    d = yaml.safe_load(open('$file'))
+    d = yaml.safe_load(open(sys.argv[1]))
     val = d
-    for k in '$key'.split('.'):
+    for k in sys.argv[2].split('.'):
         if not isinstance(val, dict): sys.exit(1)
         val = val.get(k)
     if val is None: sys.exit(1)
     print(val)
 except: sys.exit(1)
-" 2>/dev/null
+" "$file" "$key" 2>/dev/null
 }
 
 log_info()  { echo "  [INFO] $*"; }
@@ -111,3 +120,4 @@ migrate_detect_version() {
   fi
   return 0
 }
+

package/scripts/lib/migrate-version-plan.sh

@@ -8,15 +8,14 @@ MIGRATE_VERSION_PLAN_LOADED=1
 migrate_build_plan() {
   echo "migrate-version: building migration plan from $REGISTRY …"
 
-  MIGRATION_PLAN="$($PYTHON -c "
+  MIGRATION_PLAN="$("$PYTHON" -c "
 import yaml, json, sys
 
-with open('$REGISTRY') as f:
+with open(sys.argv[1]) as f:
     parts = f.read().split('---')
     fm = yaml.safe_load(parts[1])
 
-detected = '$DETECTED'
-installed = '$INSTALLED'
+detected, installed = sys.argv[2:4]
 
 plan = []
 for m in sorted(fm.get('migrations', []), key=lambda x: x.get('order', 99)):
@@ -30,7 +29,7 @@ for m in sorted(fm.get('migrations', []), key=lambda x: x.get('order', 99)):
 
 applicable = [m for m in plan if m['since_version'] > detected and m['since_version'] <= installed]
 print(json.dumps(applicable))
-" 2>/dev/null)"
+" "$REGISTRY" "$DETECTED" "$INSTALLED")"
 
   MIGRATION_COUNT="$(echo "$MIGRATION_PLAN" | $PYTHON -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null)"
 
@@ -79,7 +78,7 @@ for m in json.load(sys.stdin):
   echo "$MIGRATION_PLAN" | $PYTHON -c "
 import json, sys, os
 for m in json.load(sys.stdin):
-    bundle_path = os.path.join('$MIGRATIONS_DIR', m['file'])
+    bundle_path = os.path.join(sys.argv[1], m['file'])
     if not os.path.exists(bundle_path):
         print(f\"  WARN {m['id']}: bundle file not found ({m['file']})\")
         continue
@@ -112,8 +111,9 @@ for m in json.load(sys.stdin):
     for a in fm.get('actions_needed', []):
         v = a.get('verify', '')
         if v: print(f\"  verify: {v}\")
-" 2>/dev/null
+" "$MIGRATIONS_DIR" 2>/dev/null
 
   echo ""
   echo "Run without --dry-run to apply these migrations."
 }
+

package/scripts/lib/migrate-version-run.sh

@@ -28,6 +28,8 @@ migrate_version_main() {
 
   INSTALLED="$(migrate_installed_version)"
   migrate_detect_version || exit $?
+  migrate_validate_version "$DETECTED" detected || exit $?
+  migrate_validate_version "$INSTALLED" installed || exit $?
 
   echo "migrate-version: detected=$DETECTED installed=$INSTALLED"
 
@@ -51,3 +53,4 @@ migrate_version_main() {
   migrate_finalize
   exit 0
 }
+

package/scripts/lib/srp-engine.py

@@ -17,6 +17,7 @@ if _LIB_DIR not in sys.path:
 
 from link_utils import LINK_RE, EXTERNAL_RE  # noqa: E402
 from srp_engine_links import rewrite_links_for_pi  # noqa: E402
+from srp_engine_okf import render_okf_concept  # noqa: E402
 
 # End-user setup (bigpowers setup) may run on a python3 without PyYAML.
 # Prefer PyYAML for exact parsing; fall back to the dependency-free
@@ -133,66 +134,6 @@ def iterate_skills(repo_root):
                 skills.append(skill_md)
     return sorted(skills)
 
-def render_okf_concept(skill_data, okf_wiki_skills):
-    name = skill_data['name']
-    model = skill_data['model']
-    effort = skill_data['effort']
-    description = skill_data['description']
-    
-    os.makedirs(okf_wiki_skills, exist_ok=True)
-    okf_file = os.path.join(okf_wiki_skills, f"{name}.md")
-    
-    phase = "utility"
-    critical_path_skills = {
-        "survey-context", "elaborate-spec", "model-domain", "define-language",
-        "design-interface", "plan-work", "plan-release", "slice-tasks",
-        "kickoff-branch", "develop-tdd", "verify-work", "audit-code",
-        "commit-message", "release-branch", "security-review",
-        "assess-impact", "investigate-bug", "validate-fix", "dispatch-agents",
-        "request-review", "respond-review", "hook-commits", "guard-git",
-        "wire-observability", "wire-ci", "smoke-test", "deploy", "enforce-first"
-    }
-    if name in critical_path_skills:
-        phase = "critical-path"
-        
-    title = name.replace("-", " ").title()
-    desc_escaped = description.replace("\\", "\\\\").replace('"', '\\"')
-    
-    lines = [
-        "---",
-        "okf_kind: concept",
-        "type: Skill",
-        f"id: {name}",
-        f'title: "{title}"',
-        f"name: {name}",
-        "category: skills"
-    ]
-    if model:
-        lines.append(f"model: {model}")
-    lines.extend([
-        f"effort: {effort}",
-        f"phase: {phase}",
-        f'description: "{desc_escaped}"',
-        "references: []",
-        "---",
-        "",
-        f"# {title}",
-        "",
-        f"**Phase:** {phase}"
-    ])
-    if model:
-        lines.append(f"**Model:** {model}")
-    lines.extend([
-        f"**Effort:** {effort}",
-        "",
-        description,
-        "",
-        f"> Auto-generated by sync-skills.sh --okf (e39s04) from skills/{name}/SKILL.md"
-    ])
-    
-    with open(okf_file, 'w', encoding='utf-8') as f:
-        f.write('\n'.join(lines) + '\n')
-
 def resolve_bash():
     """Return an explicit path to a usable bash interpreter.
 

package/scripts/lib/srp_engine_okf.py

@@ -0,0 +1,65 @@
+"""OKF concept-page rendering for srp-engine (sync-skills.sh --okf)."""
+# story: e39s04
+# story: BUG-2026-10-30-compliance-akita-masked
+import os
+
+
+def render_okf_concept(skill_data, okf_wiki_skills):
+    name = skill_data['name']
+    model = skill_data['model']
+    effort = skill_data['effort']
+    description = skill_data['description']
+    
+    os.makedirs(okf_wiki_skills, exist_ok=True)
+    okf_file = os.path.join(okf_wiki_skills, f"{name}.md")
+    
+    phase = "utility"
+    critical_path_skills = {
+        "survey-context", "elaborate-spec", "model-domain", "define-language",
+        "design-interface", "plan-work", "plan-release", "slice-tasks",
+        "kickoff-branch", "develop-tdd", "verify-work", "audit-code",
+        "commit-message", "release-branch", "security-review",
+        "assess-impact", "investigate-bug", "validate-fix", "dispatch-agents",
+        "request-review", "respond-review", "hook-commits", "guard-git",
+        "wire-observability", "wire-ci", "smoke-test", "deploy", "enforce-first"
+    }
+    if name in critical_path_skills:
+        phase = "critical-path"
+        
+    title = name.replace("-", " ").title()
+    desc_escaped = description.replace("\\", "\\\\").replace('"', '\\"')
+    
+    lines = [
+        "---",
+        "okf_kind: concept",
+        "type: Skill",
+        f"id: {name}",
+        f'title: "{title}"',
+        f"name: {name}",
+        "category: skills"
+    ]
+    if model:
+        lines.append(f"model: {model}")
+    lines.extend([
+        f"effort: {effort}",
+        f"phase: {phase}",
+        f'description: "{desc_escaped}"',
+        "references: []",
+        "---",
+        "",
+        f"# {title}",
+        "",
+        f"**Phase:** {phase}"
+    ])
+    if model:
+        lines.append(f"**Model:** {model}")
+    lines.extend([
+        f"**Effort:** {effort}",
+        "",
+        description,
+        "",
+        f"> Auto-generated by sync-skills.sh --okf (e39s04) from skills/{name}/SKILL.md"
+    ])
+    
+    with open(okf_file, 'w', encoding='utf-8') as f:
+        f.write('\n'.join(lines) + '\n')