bigpowers 2.93.1 → 2.93.2

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.93.1",
+  "version": "2.93.2",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.93.1",
+  "version": "2.93.2",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [2.93.2](https://github.com/danielvm-git/bigpowers/compare/v2.93.1...v2.93.2) (2026-11-03)
+
+
+### Bug Fixes
+
+* **deps:** clear the production dependency advisories ([#200](https://github.com/danielvm-git/bigpowers/issues/200)) ([1ff6dea](https://github.com/danielvm-git/bigpowers/commit/1ff6dea73d7fdc06ebb3172839758f7a1be995c4))
+
 ## [2.93.1](https://github.com/danielvm-git/bigpowers/compare/v2.93.0...v2.93.1) (2026-11-03)
 
 

package/README.md

@@ -67,6 +67,8 @@ Use **arrow keys** to navigate, **space** to select, and **Enter** to confirm.
 
 ![Interactive Installer](docs/images/interactive-installer.png)
 
+*Screenshot from an earlier release; the current installer may differ.*
+
 ### From source (contributors)
 
 ```bash

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "bigpowers",
-  "version": "2.93.1",
+  "version": "2.93.2",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {
     "setup": "node bin/setup.js",
     "compliance": "bash scripts/audit-compliance.sh specs/verifications/features && bash scripts/validate-doctrine.sh && python3 scripts/check-skill-links.py",
+    "audit:prod": "npm audit --omit=dev",
     "doctrine": "bash scripts/validate-doctrine.sh",
     "sync": "bash scripts/sync-skills.sh",
     "validate-specs": "bash scripts/validate-specs-yaml.sh",
@@ -65,7 +66,7 @@
     "remark-frontmatter": "^5.0.0",
     "remark-parse": "^11.0.0",
     "unified": "^11.0.5",
-    "zod": "^3.24.2"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@ctxo/lang-typescript": "^0.11.0",

package/scripts/lib/golden-suite-gates.sh

@@ -53,6 +53,9 @@ GOLDEN_GATES=(
   "target-contracts:bash scripts/test-target-contracts.sh:false"
   # Registry-driven replacements for the 25 hand-written per-target scripts.
   "install-hub:bash scripts/test-install-hub.sh:false"
+  # Whether the package *builds* was gated; whether its tree is *safe* was not.
+  # `npm audit --omit=dev` was 10 advisories (1 critical) with nothing watching.
+  "prod-dependency-audit:bash scripts/test-prod-dependency-audit.sh:false"
   # `bigpowers update` runs `npm install -g @latest` inside a live process; a
   # version captured by require() at startup then reports the release that was
   # just replaced (BUG-2026-11-03-cli-update-stale-version).

package/scripts/test-prod-dependency-audit.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# story: BUG-2026-11-03-prod-dependency-advisories
+# test-prod-dependency-audit.sh — the shipped dependency graph must stay advisory-free.
+#
+# `npm audit --omit=dev` covers what users actually install. It was 10 advisories
+# (1 critical) on 2.93.1 with nothing watching it: the only dependency gates were
+# about whether the package *builds*, not whether its tree is safe.
+#
+# Two failure modes, both loud:
+#   1. any advisory in the production tree        → FAIL, listing package + severity
+#   2. the audit could not run (no registry)      → FAIL, naming the escape hatch
+#
+# Nothing here passes silently. To skip it deliberately (offline work), the golden
+# runner's own mechanism is the documented path:
+#   GOLDEN_SKIP_GATES=prod-dependency-audit bash scripts/run-verification-gates.sh
+# ...which records the gate as SKIPPED in the report rather than green.
+#
+# Dev-tree advisories are out of scope: they are concentrated in the npm bundle
+# inside @semantic-release/npm and need major release-tool upgrades
+# (BUG-2026-11-03-dev-dependency-advisories).
+#
+# Usage: bash scripts/test-prod-dependency-audit.sh
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+source scripts/lib/test-assertions.sh
+TA_PASS=0
+TA_FAIL=0
+TA_TMPDIR="$(mktemp -d)"
+trap ta_cleanup EXIT
+
+echo "=== test-prod-dependency-audit.sh ==="
+
+if ! command -v npm >/dev/null 2>&1; then
+  ta_fail "npm is unavailable — cannot audit the production dependency graph"
+  echo "$TA_PASS passed, $TA_FAIL failed"
+  exit 1
+fi
+
+AUDIT_JSON="$TA_TMPDIR/audit-prod.json"
+# npm audit exits 1 when it finds advisories — capture, do not abort.
+npm audit --omit=dev --json >"$AUDIT_JSON" 2>"$TA_TMPDIR/audit-prod.err" || true
+
+REPORT="$(
+  python3 - "$AUDIT_JSON" <<'PY'
+import json, sys
+
+path = sys.argv[1]
+try:
+    data = json.load(open(path, encoding="utf-8"))
+except Exception:
+    print("UNPARSEABLE")
+    sys.exit(0)
+
+meta = data.get("metadata") or {}
+counts = meta.get("vulnerabilities")
+if counts is None:
+    print("UNPARSEABLE")
+    sys.exit(0)
+
+total = counts.get("total", 0)
+rows = []
+for name, info in sorted((data.get("vulnerabilities") or {}).items()):
+    severity = info.get("severity", "?")
+    via = info.get("via") or []
+    title = ""
+    for entry in via:
+        if isinstance(entry, dict) and entry.get("title"):
+            title = entry["title"]
+            break
+    rows.append(f"{severity:<9} {name}  {title[:70]}")
+print(f"TOTAL={total}")
+for row in rows:
+    print(f"  {row}")
+PY
+)"
+
+if [[ "$REPORT" == UNPARSEABLE* ]]; then
+  ta_fail "npm audit produced no parseable report — the registry was probably unreachable:"
+  sed -n '1,5p' "$TA_TMPDIR/audit-prod.err" | sed 's/^/    /' >&2
+  ta_fail "run with network, or skip deliberately: GOLDEN_SKIP_GATES=prod-dependency-audit"
+else
+  TOTAL="$(grep -oE 'TOTAL=[0-9]+' <<< "$REPORT" | cut -d= -f2)"
+  if [[ "${TOTAL:-0}" -eq 0 ]]; then
+    ta_pass "no advisories in the production dependency tree (npm audit --omit=dev)"
+  else
+    ta_fail "$TOTAL advisor$([[ "$TOTAL" -eq 1 ]] && echo 'y' || echo 'ies') in the production dependency tree:"
+    sed -n '2,$p' <<< "$REPORT" | sed 's/^/    /' >&2
+  fi
+fi
+
+echo "$TA_PASS passed, $TA_FAIL failed"
+[[ "$TA_FAIL" -eq 0 ]]