codymaster 4.8.0 → 7.0.0

package/scripts/update-changelog.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# update-changelog.sh — Auto-update CHANGELOG.md from git commits
+#
+# Usage:
+#   bash scripts/update-changelog.sh          # Update CHANGELOG.md
+#   bash scripts/update-changelog.sh --dry-run # Preview without writing
+#
+# Follows conventional commits format:
+#   feat: → 🚀 Features
+#   fix: → 🐛 Bug Fixes
+#   security: → 🔒 Security
+#   improve/refactor/perf: → 🚀 Improvements
+
+set -e
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CHANGELOG="$REPO_ROOT/CHANGELOG.md"
+DRY_RUN=false
+
+if [[ "$1" == "--dry-run" ]]; then
+  DRY_RUN=true
+fi
+
+# Get last tag
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+
+# Get commits since last tag
+if [ -z "$LAST_TAG" ]; then
+  COMMITS=$(git log --oneline -20 --no-merges)
+else
+  COMMITS=$(git log --oneline "$LAST_TAG"..HEAD --no-merges)
+fi
+
+if [ -z "$COMMITS" ]; then
+  echo "No commits found since last tag."
+  exit 0
+fi
+
+# Categorize commits
+FEATURES=$(echo "$COMMITS" | grep -iE "^[a-f0-9]+ feat:" | sed 's/^[a-f0-9]* /- /' || true)
+FIXES=$(echo "$COMMITS" | grep -iE "^[a-f0-9]+ fix:" | sed 's/^[a-f0-9]* /- /' || true)
+SECURITY=$(echo "$COMMITS" | grep -iE "^[a-f0-9]+ (security|sec):" | sed 's/^[a-f0-9]* /- /' || true)
+IMPROVEMENTS=$(echo "$COMMITS" | grep -iE "^[a-f0-9]+ (improve|refactor|perf):" | sed 's/^[a-f0-9]* /- /' || true)
+OTHER=$(echo "$COMMITS" | grep -ivE "^[a-f0-9]+ (feat|fix|security|sec|improve|refactor|perf):" | sed 's/^[a-f0-9]* /- /' || true)
+
+# Generate changelog entry
+DATE=$(date +%Y-%m-%d)
+VERSION=$(node -p "require('$REPO_ROOT/package.json').version" 2>/dev/null || echo "unreleased")
+
+ENTRY="## [$VERSION] - $DATE\n\n"
+
+if [ -n "$FEATURES" ]; then
+  ENTRY+="### 🚀 Features\n$FEATURES\n\n"
+fi
+
+if [ -n "$FIXES" ]; then
+  ENTRY+="### 🐛 Bug Fixes\n$FIXES\n\n"
+fi
+
+if [ -n "$SECURITY" ]; then
+  ENTRY+="### 🔒 Security\n$SECURITY\n\n"
+fi
+
+if [ -n "$IMPROVEMENTS" ]; then
+  ENTRY+="### 🚀 Improvements\n$IMPROVEMENTS\n\n"
+fi
+
+if [ -n "$OTHER" ]; then
+  ENTRY+="### 📦 Other\n$OTHER\n\n"
+fi
+
+if [ "$DRY_RUN" = true ]; then
+  echo "=== DRY RUN — would add to CHANGELOG.md ==="
+  echo -e "$ENTRY"
+  exit 0
+fi
+
+# Prepend to CHANGELOG.md
+if [ -f "$CHANGELOG" ]; then
+  TEMP=$(mktemp)
+  echo -e "$ENTRY" > "$TEMP"
+  cat "$CHANGELOG" >> "$TEMP"
+  mv "$TEMP" "$CHANGELOG"
+else
+  echo -e "# Changelog\n\nAll notable changes to this project will be documented in this file.\n\nCategories: 🚀 **Improvements** | 🐛 **Bug Fixes** | 🔒 **Security**\n\n---\n\n$ENTRY" > "$CHANGELOG"
+fi
+
+echo "✅ CHANGELOG.md updated (version: $VERSION)"

package/scripts/validate-skills.mjs

@@ -1,6 +1,20 @@
 #!/usr/bin/env node
 /**
- * Ensures each skill folder under skills/ has SKILL.md with a title line.
+ * Validates skills under skills/.
+ *
+ * Always-required (errors, fail build):
+ *   - SKILL.md exists with H1 title and YAML frontmatter (`name`, `description`)
+ *
+ * Opt-in v2 rules (errors only when frontmatter `compressed: true`):
+ *   - `token_budget` integer in [100, 6000]
+ *   - `## TL;DR` section present, ≤8 non-empty lines (≤5 recommended)
+ *   - SKILL.md ≤200 lines (warning only)
+ *
+ * Skills with `deprecated: true` are exempt from v2 rules.
+ *
+ * Migration: as skills are refactored to the new template
+ * (skills/_shared/SKILL_TEMPLATE.md), set `compressed: true` to enforce
+ * v2 quality. Once all core skills are migrated, the opt-in becomes default.
  */
 import fs from 'fs';
 import path from 'path';
@@ -9,32 +23,115 @@ import { fileURLToPath } from 'url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const root = path.join(__dirname, '..', 'skills');
 
-/** Directories under skills/ that are not standalone skills (assets, packs). */
 const SKIP_DIRS = new Set(['profiles', 'extensions', 'scripts']);
 
 let errors = 0;
+let warnings = 0;
+
+function parseFrontmatter(text) {
+  const m = text.match(/^---\n([\s\S]*?)\n---\n/);
+  if (!m) return null;
+  const out = {};
+  for (const line of m[1].split('\n')) {
+    const mm = line.match(/^([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$/);
+    if (!mm) continue;
+    let v = mm[2].trim();
+    if (v.startsWith('"') && v.endsWith('"')) v = v.slice(1, -1);
+    if (v === 'true') v = true;
+    else if (v === 'false') v = false;
+    else if (/^-?\d+$/.test(v)) v = parseInt(v, 10);
+    out[mm[1]] = v;
+  }
+  return out;
+}
+
+function extractTldr(text) {
+  const m = text.match(/^##\s+TL;DR\s*\n([\s\S]*?)(?=\n##\s|$)/m);
+  if (!m) return null;
+  return m[1].split('\n').filter((l) => l.trim().length > 0);
+}
+
 if (!fs.existsSync(root)) {
   console.error('No skills/ directory');
   process.exit(1);
 }
 
+let migratedCount = 0;
+let totalCount = 0;
+
 for (const name of fs.readdirSync(root, { withFileTypes: true })) {
   if (!name.isDirectory()) continue;
   if (name.name.startsWith('_') || name.name.startsWith('.')) continue;
   if (SKIP_DIRS.has(name.name)) continue;
+
   const md = path.join(root, name.name, 'SKILL.md');
   if (!fs.existsSync(md)) {
-    console.error(`Missing SKILL.md: ${name.name}`);
+    console.error(`✗ ${name.name}: missing SKILL.md`);
     errors++;
     continue;
   }
+  totalCount++;
+
   const text = fs.readFileSync(md, 'utf8');
+  const fm = parseFrontmatter(text);
+
   if (!/^#\s+\S/m.test(text)) {
-    console.error(`SKILL.md missing H1 title: ${name.name}`);
+    console.error(`✗ ${name.name}: missing H1 title`);
+    errors++;
+  }
+
+  if (!fm) {
+    console.error(`✗ ${name.name}: missing YAML frontmatter`);
+    errors++;
+    continue;
+  }
+  if (!fm.name) {
+    console.error(`✗ ${name.name}: frontmatter missing 'name'`);
+    errors++;
+  }
+  if (!fm.description) {
+    console.error(`✗ ${name.name}: frontmatter missing 'description'`);
     errors++;
   }
+
+  const isDeprecated = fm.deprecated === true;
+  const isCompressed = fm.compressed === true;
+
+  if (isCompressed && !isDeprecated) {
+    migratedCount++;
+
+    if (typeof fm.token_budget !== 'number') {
+      console.error(`✗ ${name.name}: compressed skill missing 'token_budget' (number)`);
+      errors++;
+    } else if (fm.token_budget < 100 || fm.token_budget > 6000) {
+      console.error(`✗ ${name.name}: token_budget ${fm.token_budget} out of range [100, 6000]`);
+      errors++;
+    }
+
+    const tldr = extractTldr(text);
+    if (!tldr) {
+      console.error(`✗ ${name.name}: compressed skill missing '## TL;DR' section`);
+      errors++;
+    } else {
+      if (tldr.length > 8) {
+        console.error(`✗ ${name.name}: TL;DR has ${tldr.length} non-empty lines (max 8)`);
+        errors++;
+      } else if (tldr.length > 5) {
+        console.warn(`⚠ ${name.name}: TL;DR has ${tldr.length} non-empty lines (recommend ≤5)`);
+        warnings++;
+      }
+    }
+
+    const totalLines = text.split('\n').length;
+    if (totalLines > 200) {
+      console.warn(`⚠ ${name.name}: SKILL.md is ${totalLines} lines (recommend ≤200)`);
+      warnings++;
+    }
+  }
 }
 
+console.log(`validate-skills: ${migratedCount}/${totalCount} skills migrated to v2 (compressed:true)`);
+if (warnings) console.warn(`validate-skills: ${warnings} warning(s)`);
 if (errors) {
   console.error(`validate-skills: ${errors} error(s)`);
   process.exit(1);

package/skills/CLAUDE.md

@@ -129,11 +129,6 @@ The YAML frontmatter `description` field is critical for skill discovery: includ
 /plugin install systems-architecture@wondelai-skills # DDIA, System Design, Clean Architecture, Release It!, High Performance Browser Networking
 ```
 
-### Via skills.sh
-```bash
-npx skills add wondelai/skills              # All skills
-npx skills add wondelai/skills/{skill-name} # Individual skill
-```
 
 ## Versioning Policy
 

package/skills/_shared/SKILL_TEMPLATE.md

@@ -0,0 +1,62 @@
+---
+name: cm-<name>
+description: "<one-line trigger sentence: when to use this skill>"
+token_budget: 1500
+compressed: true
+deprecated: false
+---
+
+# cm-<name> — <short title>
+
+## TL;DR
+- **Use when**: <trigger condition, 1 line>
+- **Output**: <what artifact/state changes>
+- **Handoff**: reads `.cm/handoff/<prev>.json` (if any), writes `.cm/handoff/<this>.json` (if any)
+- **Chain**: typically follows `cm-<prev>`, precedes `cm-<next>`
+- **Budget**: 1500 tokens (loaded full only when needed)
+
+## When to Use
+<2-4 bullets describing concrete situations. Skip if TL;DR is sufficient.>
+
+## Adaptive Depth
+
+Read `.cm/project-tier.md` (written by `cm tier classify`) and pick a rendering depth:
+
+- **LITE / STANDARD** → stop after TL;DR. Skip "Full Protocol" unless the task explicitly requires deep instructions.
+- **PROFESSIONAL / ENTERPRISE** → load the full protocol below.
+
+If the tier file is absent, default to STANDARD.
+
+## Full Protocol
+<Detailed instructions, examples, rules. Agent loads this only when TL;DR is insufficient or tier ≥ PROFESSIONAL.>
+
+### Step 1: <name>
+<...>
+
+### Step 2: <name>
+<...>
+
+## Integration
+
+| After this skill... | Use skill |
+|---|---|
+| <situation> | `cm-<next>` |
+
+## Persona Dispatch (optional)
+
+For complex tasks, dispatch via persona subagents in `agents/`:
+
+| Need | Persona |
+|------|---------|
+| Clarify scope/intent | `pm` |
+| Design / trade-offs | `architect` |
+| Write code | `engineer` |
+| Independent review | `reviewer` |
+| Threat model / scan | `security` |
+
+## Anti-Patterns
+- ❌ <thing not to do>
+- ❌ <thing not to do>
+
+## The Bottom Line
+**<one-sentence rule>**

package/skills/_shared/helpers.md

@@ -35,11 +35,6 @@ Read .cm/skeleton-index.md    (~500 tokens) — modules, entry points, config fi
 Query: cm_query(scope="learnings", query="{current module or error type}", limit=5)
    OR read .cm/memory/learnings.json filtered to scope == "global" | "module:X"
 
-# OpenViking backend (if storage.backend: viking in .cm/config.yaml):
-Query: cm_query(query="{current module or error type}", limit=5)
-→ OpenViking uses VECTOR SEMANTIC SEARCH — no need for exact keyword match.
-   "i18n locale update" will also match "translation missing" and "locale fallback"
-
 Rules:
   NEVER  load status = "invalidated"   (proven wrong)
   CAUTION status = "corrected"         (verify before applying)
@@ -64,9 +59,8 @@ cm continuity budget  (or: loadBudget + checkBudget in code)
 > L0 indexes + context bus + scope filter make this possible.
 > Only escalate to L2 when L0/L1 explicitly flag the need.
 >
-> **Viking bonus:** With OpenViking backend, L0/L1 indexes are auto-generated by the engine —
-> no manual `cm continuity index` needed. Vector search also improves Step 3 recall by ~40%.
-> Switch: set `storage.backend: viking` in `.cm/config.yaml`.
+> **Legacy note:** Some older projects may still keep `storage.backend: viking` in config.
+> CodyMaster now routes that back to SQLite, so do not design workflows around a separate Viking backend.
 
 ---
 

package/skills/cm-autopilot/scripts/autopilot.py

@@ -15,9 +15,26 @@ import subprocess
 import threading
 from pathlib import Path
 
-# Add cm-content-factory to sys.path to reuse the dispatcher and state manager
+# Reuse dispatcher and state manager from the content-factory plugin.
+# After the 2026-05-09 plugin split, content-factory lives in a separate plugin.
+# Resolution order: env override → sibling extracted-plugins (dev) → installed plugin paths.
 SKILLS_DIR = Path(__file__).resolve().parent.parent.parent
-CF_SCRIPTS = SKILLS_DIR / "cm-content-factory" / "scripts"
+REPO_ROOT = SKILLS_DIR.parent
+
+def _find_cf_scripts() -> Path:
+    env = os.environ.get("CONTENT_FACTORY_SCRIPTS")
+    if env and Path(env).exists():
+        return Path(env)
+    candidates = [
+        REPO_ROOT / "extracted-plugins" / "content-factory" / "skills" / "content-factory" / "scripts",
+        Path.home() / ".claude" / "plugins" / "cache" / "content-factory" / "skills" / "content-factory" / "scripts",
+    ]
+    for c in candidates:
+        if c.exists():
+            return c
+    return SKILLS_DIR / "cm-content-factory" / "scripts"  # legacy fallback
+
+CF_SCRIPTS = _find_cf_scripts()
 sys.path.append(str(CF_SCRIPTS))
 
 try:

package/skills/cm-brainstorm-idea/SKILL.md

@@ -1,10 +1,19 @@
 ---
 name: cm-brainstorm-idea
 description: "Strategic analysis gate for existing products — multi-dimensional evaluation (tech, product, design, business) using Design Thinking + 9 Windows (TRIZ) + Double Diamond. Outputs 2-3 qualified options with recommendations. Use BEFORE cm-planning for complex initiatives and enhancements on existing codebases."
+token_budget: 1500
+compressed: true
+deprecated: false
 ---
 
 # Brainstorm Idea — Strategic Analysis Gate
 
+## TL;DR
+- **Use before** cm-planning for complex/ambiguous initiatives
+- **Frameworks**: Design Thinking + 9 Windows (TRIZ) + Double Diamond
+- **Output**: 2-3 qualified options + recommendation
+- **Writes**: handoff/intent.json
+
 > **Understand deeply. Evaluate multi-dimensionally. Propose qualified options. Then — and only then — plan.**
 > This skill is the BRIDGE between an existing product and its next evolution.
 

package/skills/cm-browse/SKILL.md

@@ -1,5 +1,11 @@
+---
+name: cm-browse
+description: "Use when you need visual QA, screenshots, or post-deploy smoke testing through a real browser with Playwright."
+---
 # cm-browse — local Playwright daemon
 
+> **Full runbook:** [docs/browse-daemon.md](../../docs/browse-daemon.md) (install Chromium, token, troubleshooting).
+
 ## When to use
 
 - Visual QA, screenshots, post-deploy smoke through a **real browser** (not only Stitch/Pencil).

package/skills/cm-clean-code/SKILL.md

@@ -1,10 +1,19 @@
 ---
 name: cm-clean-code
 description: "Code hygiene gate — detect and eliminate dead code, duplicates, naming mess, and code smells. TRIZ-powered. Run after features, before PRs, during debt sprints."
+token_budget: 1200
+compressed: true
+deprecated: false
 ---
 
 # Clean Code — Code Hygiene Gate
 
+## TL;DR
+- **Use after** a feature lands, before PR review
+- **Detects**: dead code, duplicates, naming smells, dependency drift
+- **Powered by** TRIZ contradictions and Boy Scout rule
+- **Next**: cm-code-review
+
 > **Code that works is not enough. Code must be CLEAN.**
 > Inspired by Clean Code (Robert C. Martin) + Refactoring (Martin Fowler) + TRIZ.
 
@@ -295,6 +304,17 @@ cm-execution → cm-clean-code → cm-code-review → cm-quality-gate → cm-saf
    (build)      (hygiene)        (review)          (verify)         (ship)
 ```
 
+## Karpathy Discipline — Simplicity First
+
+Combat over-engineering at the source, not after the fact:
+- **No features beyond what was asked.** No "while I'm here" additions.
+- **No abstractions for single-use code.** Three similar lines beats a premature interface.
+- **No flexibility/configurability that wasn't requested.** YAGNI is the default.
+- **No error handling for impossible scenarios.** Trust internal callers; validate at boundaries.
+- **200 lines that should be 50 → rewrite, don't ship.**
+
+**Senior-engineer test:** "Would a senior call this overcomplicated?" If yes, simplify before commit.
+
 ## The Bottom Line
 
 **Clean code = investment. Dirty code = debt. Pay as you go, or pay with interest later.**

package/skills/cm-code-review/SKILL.md

@@ -1,10 +1,20 @@
 ---
 name: cm-code-review
 description: "Full review lifecycle — request reviews, handle feedback with technical rigor, and complete branch integration. Use when completing tasks, receiving feedback, or finishing feature branches."
+token_budget: 1500
+compressed: true
+deprecated: false
 ---
 
 # Code Review — Request + Receive + Complete
 
+## TL;DR
+- **Use when** task complete, before/during PR review
+- **Pre-review**: lint, tests, diff scan, blast radius
+- **Reads**: handoff/exec.json — **Writes**: handoff/review.json
+- **Severity**: info | warn | error | critical
+- **Next**: cm-quality-gate
+
 > **Full review lifecycle in one skill:** Request → Receive → Integrate.
 
 ## Part A: Requesting Code Review
@@ -146,6 +156,17 @@ After processing review feedback, ALWAYS update `.cm/CONTINUITY.md`:
 | `cm-identity-guard` | Before git push |
 | `cm-git-worktrees` | Cleanup worktree after completion |
 
+## Karpathy Discipline — Review Checklist
+
+Block any PR/diff that violates these regardless of green tests:
+- **Scope creep:** changed line that doesn't trace to the task → request removal.
+- **Bloat:** new abstraction with one caller, premature config, error paths for impossible inputs → request simplification.
+- **Side-effect edits:** unrelated formatting, renamed identifiers, "improved" comments not in scope → revert.
+- **Hidden assumptions:** logic that depends on an unstated invariant → require it surfaced (test or doc) or rejected.
+- **Weak goals:** PR description says "make it work" with no verifiable criterion → send back to planning.
+
+**Review heuristic:** if you can't answer "what task forced this line?" for every changed line, the diff is too wide.
+
 ## The Bottom Line
 
 **Review early. Verify feedback. Ship with evidence, not hope.**

package/skills/cm-codeintell/SKILL.md

@@ -1,10 +1,19 @@
 ---
 name: cm-codeintell
 description: "Unified code intelligence — Skeleton Index (zero-dep, <4s) + AST knowledge graph (CodeGraph) + architecture diagrams (Mermaid) + smart context builder. Pre-indexes code structure so AI agents understand any codebase instantly. 95% token compression for onboarding. 30% fewer tokens for deep analysis."
+token_budget: 1500
+compressed: true
+deprecated: false
 ---
 
 # Code Intelligence — Structural Understanding for AI Agents
 
+## TL;DR
+- **Use to** index codebase for fast structural understanding
+- **Outputs**: skeleton index, AST graph, Mermaid diagrams
+- **Token saving**: ~95% for onboarding, ~30% for deep analysis
+- **Next**: cm-planning or cm-debugging
+
 > **Stop scanning. Start querying.** Skeleton Index (<4s, zero deps) + AST graph + architecture diagrams = instant code understanding.
 > Inspired by [CodeGraph](https://github.com/colbymchenry/codegraph) + [GitDiagram](https://github.com/ahmedkhaleel2004/gitdiagram).
 > TRIZ-optimized: 10 inventive principles applied.

package/skills/cm-conductor-worktrees/SKILL.archive.md

@@ -0,0 +1,28 @@
+---
+name: cm-conductor-worktrees
+description: "Use when you need to manage parallel git worktrees for isolated feature development."
+---
+# cm-conductor-worktrees — parallel worktrees
+
+## CLI
+
+```bash
+cm conductor add --at ../my-feature-wt --branch feat/my-feature --base main
+cm conductor list
+```
+
+## Practice
+
+- One **branch + worktree** per parallel agent/session.
+- Reconcile with `git merge` / PR; avoid two agents editing the same files without coordination.
+
+## ELI16 (3+ sessions)
+
+When running **three or more** parallel sessions, re-ground each session with:
+
+- Current branch name + worktree path.
+- Last artifact from `cm sprint status` or `.cm/context-bus.json`.
+
+## Future
+
+Dashboard UI for active sprints is **not** in CLI yet — use `cm dashboard` / Hamster UI where available.

package/skills/cm-conductor-worktrees/SKILL.md

@@ -1,24 +1,26 @@
-# cm-conductor-worktrees — parallel worktrees
+---
+name: cm-conductor-worktrees
+description: "[Deprecated] parallel execution mode. Use `cm-execution` instead."
+deprecated: true
+merged_into: cm-execution
+---
 
-## CLI
+# cm-conductor-worktrees — Deprecated
 
-```bash
-cm conductor add --at ../my-feature-wt --branch feat/my-feature --base main
-cm conductor list
-```
-
-## Practice
-
-- One **branch + worktree** per parallel agent/session.
-- Reconcile with `git merge` / PR; avoid two agents editing the same files without coordination.
+> ⚠️ This skill is deprecated as of CodyMaster v6.0.0 and will be removed in v6.1.0.
+>
+> **Use `cm-execution` instead.** parallel execution mode.
+>
+> See [docs/migration-v2.md](../../docs/migration-v2.md) for the full mapping.
 
-## ELI16 (3+ sessions)
+The original content is preserved at [SKILL.archive.md](SKILL.archive.md) for reference.
 
-When running **three or more** parallel sessions, re-ground each session with:
+## Migration
 
-- Current branch name + worktree path.
-- Last artifact from `cm sprint status` or `.cm/context-bus.json`.
-
-## Future
+```bash
+# Old:           cm <use this skill>
+# New (v6.0+):   cm execution <equivalent action>
+```
 
-Dashboard UI for active sprints is **not** in CLI yet — use `cm dashboard` / Hamster UI where available.
+If you depend on a capability that didn't carry over, please file an issue:
+https://github.com/tody-agent/codymaster/issues