create-merlin-brain 5.3.5 → 5.3.7

package/bin/install.cjs

@@ -1750,12 +1750,15 @@ ${colors.cyan}Universal Task Optimization (NEW in 5.3.0):${colors.reset}
   • ${colors.bright}/merlin:polish${colors.reset}           - Animation polish via animation-expert
   • ${colors.bright}/merlin:redesign${colors.reset}         - Full redesign via ui-builder
 
-${colors.cyan}Tier-2 cleanup (NEW in 5.3.5):${colors.reset}
-  • 4 new agents wired (android-expert, apple-swift-expert, desktop-app-expert, marketing-automation)
-  • Counter-reset bug diagnosed in duo-codex-call.sh (fix pending v5.3.6)
-  • MCP routing reads live agent list from disk (no drift)
-  • Concurrent codex calls protected by flock
-  • Malformed config files now backed up before overwrite
+${colors.cyan}Attribution hardening (NEW in 5.3.6):${colors.reset}
+  • All shipped agents now carry provenance frontmatter (source + license + import date)
+  • check-provenance.js now requires every agent to declare provenance
+  • Unknown-origin agents documented in NOTICE.md (attribution pending — see issue tracker)
+
+${colors.cyan}Discovery-first (NEW in 5.3.7):${colors.reset}
+  • Brain now proactively searches 1000+ community agents before routing
+  • ${colors.bright}/merlin:install <slug>${colors.reset} - One-keystroke install of any catalog agent
+  • smart_route + discover_agents wired into the orchestrator protocol
 
 ${colors.cyan}Merlin works with or without Sights:${colors.reset}
   • ${colors.green}With Sights${colors.reset}: Instant context, cross-session memory

package/files/CLAUDE.md

@@ -53,11 +53,23 @@ Do NOT spawn Explore agents or run Glob/Grep for codebase questions. Use Sights
 
 Never just dump an agent result and go silent. Always follow through.
 
+## Discovery-First Routing (1000+ community agents)
+
+Before routing any non-trivial task to a built-in specialist, proactively check the community catalog:
+
+1. Call `merlin_smart_route(task="<full user text>")` to score both built-in and catalog agents.
+2. If a catalog match (Grade A+ or A) scores higher than built-in options, surface it to the user.
+3. Example: "⟡🔮 MERLIN › Found a community agent: **Payment Integration** (Grade A). Install with `/merlin:install payment-integration`, or use built-in implementation-dev?"
+4. Wait for user choice — never auto-install without confirmation.
+5. Use `/merlin:install <slug>` to install, or the user can describe what they want and Merlin will auto-route.
+
+Skip discovery for: trivial edits (single file, comment, rename), debug runs, doc updates, or when user explicitly names an agent.
+
 ## Execution
 
 Run independent agents in PARALLEL. Never sequential when parallel is possible.
 NEVER run `claude --agent` via Bash. Always use `Skill("merlin:route")` or `merlin_route()`.
-For ANY routing, call `merlin_smart_route(task="...")` FIRST to check 500+ community agents.
+For ANY routing, call `merlin_smart_route(task="...")` FIRST to check community agents + built-ins.
 
 ## Learning
 

package/files/agents/android-expert.md

@@ -3,6 +3,15 @@ name: android-expert
 description: Full-lifecycle Android agent — implements, refactors, architects, tests, and hardens Kotlin, Jetpack Compose, Material Design 3, and Android apps.
 model: sonnet
 color: green
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/agents/animation-expert.md

@@ -3,6 +3,15 @@ name: animation-expert
 description: Full-lifecycle animation agent — builds, refactors, architects, tests, and hardens animations with Motion, GSAP, CSS, and 60fps performance.
 model: sonnet
 color: violet
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/agents/apple-swift-expert.md

@@ -3,6 +3,15 @@ name: apple-swift-expert
 description: Full-lifecycle Apple platform agent — implements, refactors, architects, tests, and hardens Swift 6, SwiftUI, AppKit, iOS and macOS code.
 model: sonnet
 color: blue
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/agents/desktop-app-expert.md

@@ -3,6 +3,15 @@ name: desktop-app-expert
 description: Full-lifecycle desktop app agent — implements, refactors, architects, tests, and hardens Electron and Tauri apps with IPC security and cross-platform distribution.
 model: sonnet
 color: cyan
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/agents/marketing-automation.md

@@ -3,6 +3,15 @@ name: marketing-automation
 description: Full-lifecycle marketing engineering agent — builds, refactors, architects, tests, and hardens email campaigns, drip sequences, A/B tests, and analytics.
 model: sonnet
 color: red
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/agents/orchestrator.md

@@ -3,6 +3,14 @@ name: orchestrator
 description: Master router for a vibe coder building serious, production-leaning systems. Always choose and coordinate the right specialist agent instead of doing work yourself.
 model: opus
 color: red
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-01-22"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-01-22. No modifications beyond Merlin integration."
+  note: "Imported on 2026-01-22 from an unidentified source (different style than the Feb 4 batch). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 You are the orchestrator for a very strong product thinker and vibe coder who uses Claude Code as their main dev environment.

package/files/agents/ui-builder.md

@@ -3,6 +3,15 @@ name: ui-builder
 description: Full-lifecycle UI engineering agent — builds, refactors, architects, tests, and hardens React components with Tailwind, shadcn/ui, and Radix.
 model: sonnet
 color: orange
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/agents/ui-designer.md

@@ -3,6 +3,15 @@ name: ui-designer
 description: Full-lifecycle design agent — creates, refactors, architects, audits, and hardens design systems, accessibility, tokens, and component specs.
 model: sonnet
 color: pink
+provenance:
+  upstream: unknown-origin/vendored-agents-feb2026
+  source: unknown
+  imported_date: "2026-02-04"
+  style_signature: "Full-lifecycle X agent — builds, refactors, architects, tests, and hardens"
+  license: unknown
+  license_verification: unconfirmed
+  adapted: "Vendored as-is from local cache on 2026-02-04. No modifications beyond Merlin integration."
+  note: "Imported in batch on 2026-02-04 from an unidentified source. Style is consistent with a single author/tool but no public catalog match was found (checked wshobson/agents, VoltAgent/awesome-claude-code-subagents). Curated, integrated, and shipped via create-merlin-brain. If you recognize this as your work, please open an issue at https://github.com/sandman66666/merlin and we'll update attribution."
 ---
 
 <role>

package/files/commands/merlin/install.md

@@ -0,0 +1,49 @@
+---
+name: merlin:install
+description: Install a community agent/skill from the Merlin catalog by slug. Wraps `npx skills add` and similar install commands per the agent's metadata.
+argument-hint: "<slug> — agent slug from merlin_discover_agents (e.g., 'payment-integration')"
+allowed-tools:
+  - Bash
+  - Read
+  - mcp__merlin__merlin_get_agent_detail
+---
+
+<objective>
+Install a community agent or skill from the Merlin catalog into the user's local Claude environment.
+</objective>
+
+## Steps
+
+1. Read the agent detail via `merlin_get_agent_detail(slug="$ARGUMENTS")` to get the install command and source.
+
+2. Show the user what's about to be installed:
+   - Name, grade, description
+   - Install command from agent metadata
+   - Source repo URL
+   Then ask explicit confirmation: "Install <name>? (Y/N)"
+
+3. On YES, run the install command:
+   - If it starts with `npx skills add`: `bash -c "<install_command>"`
+   - If it starts with `npm install`: `bash -c "<install_command>"` (in cwd or globally based on agent type)
+   - If unknown: surface the command and tell user to run it manually
+
+4. After install, verify the agent is now reachable:
+   - For Claude agents: check `~/.claude/agents/<slug>.md` exists
+   - For skills: check `~/.claude/skills/<slug>/SKILL.md` exists
+   - Otherwise: trust the install command's exit code
+
+5. Surface a usage hint: "Installed <name>. Use via `merlin_route(agent=\"<name>\", task=\"...\")` or just describe what you want — Merlin will route to it."
+
+## Safety
+
+- NEVER run install commands without explicit user Y confirmation.
+- NEVER pipe install commands through eval or shell injection unsafe channels.
+- If the install command from the catalog looks suspicious (contains `curl | sh`, sudo, etc.), refuse and surface the command for manual review.
+- Honor the user's deny list (`~/.claude/settings.json` permissions.deny).
+
+## Errors
+
+- Slug not found → "Slug `<x>` not found. Try `merlin_discover_agents(query=\"...\")` to search."
+- No install command in metadata → "This agent doesn't have an automated install. Visit <source_url> for instructions."
+- Install command failed → show stderr, suggest manual run.
+

package/files/merlin-system-prompt.txt

@@ -32,4 +32,6 @@ wait
 
 **Badge:** Always prefix every action with `⟡🔮↔🔮 MERLIN·DUO ›` when duo is on, `⟡🔮 MERLIN ›` when off.
 
-TASK OPTIMIZATION: Before EVERY routing decision (workflows, agents, specialists), run ~/.claude/scripts/task-optimize.sh --task "<user text>". It returns {intent, skills[], agent, score, matched_phrases}. If score>=25, ALWAYS announce "⟡🔮 MERLIN › Intent: <X>. Loading <skills> + routing to <agent>." then route with skills prepended to context. Registry: ~/.claude/merlin/skills/TASK-OPTIMIZER.json. Slash commands /merlin:optimize, /merlin:design-audit, /merlin:polish, /merlin:redesign wrap common flows.
+TASK OPTIMIZATION: Before EVERY routing decision (workflows, agents, specialists), run ~/.claude/scripts/task-optimize.sh --task "<user text>". It returns {intent, skills[], agent, score, matched_phrases}. If score>=25, ALWAYS announce "⟡🔮 MERLIN › Intent: <X>. Loading <skills> + routing to <agent>." then route with skills prepended to context. Registry: ~/.claude/merlin/skills/TASK-OPTIMIZER.json. Slash commands /merlin:optimize, /merlin:design-audit, /merlin:polish, /merlin:redesign wrap common flows.
+
+DISCOVERY-FIRST: Before routing any non-trivial task to a built-in specialist, call `merlin_smart_route(task="...")` and `merlin_discover_agents(query="...")` to check the community catalog (1000+ indexed agents/skills). If a catalog match scores a higher grade (A+/A++) than the best built-in for the task, surface it: "⟡🔮 MERLIN › I found a community agent that fits better: <name> (Grade: <X>). Install with /merlin:install <slug> or stick with built-in <built-in>?" — then wait for user choice. NEVER install without confirmation. Skip discovery only for: trivial single-file edits, debug runs, doc updates, or when the user explicitly names an agent.

package/files/rules/merlin-routing.md

@@ -55,6 +55,41 @@ Slash commands: `/merlin:optimize`, `/merlin:design-audit`, `/merlin:polish`, `/
 
 The optimizer is the AUTHORITY. Don't override its recommendations unless the user explicitly asks for a different agent.
 
+## Discovery-First Routing (1000+ community agents)
+
+The Merlin Sights server indexes 1000+ community agents/skills from GitHub, npm, skills.sh, and other sources. Before routing any non-trivial task to a built-in, ALWAYS check if a better community agent exists.
+
+### Protocol
+
+For tasks that are NOT trivial (i.e., > 5 minutes of work, or touching a new domain):
+
+1. Call `merlin_smart_route(task="<full user text>")` — returns the best match from BOTH installed local agents AND the community catalog.
+2. If the response includes a catalog match (source: catalog, grade A+/A++):
+   - Surface it to the user: `⟡🔮 MERLIN › Catalog match: <name> (Grade <X>). Install with /merlin:install <slug>, or use built-in <fallback>?`
+   - Wait for user choice. Never install without confirmation.
+3. If only built-in matches, proceed with normal routing.
+
+For tasks that ARE trivial (single-file edit, rename, comment fix, debug print):
+- Skip discovery. Use the optimizer + built-in directly.
+
+### When to use discover_agents vs smart_route
+
+- `merlin_smart_route(task)` — best for "what agent should I use" decisions (returns ranked recommendation)
+- `merlin_discover_agents(query)` — best for "what's available for X technology" exploration (returns 5-10 matches with install commands)
+
+### Examples
+
+Bad:
+> User: "build me a Stripe payments integration"
+> Merlin: routes to implementation-dev without checking catalog
+
+Good:
+> User: "build me a Stripe payments integration"
+> Merlin: `merlin_smart_route("build Stripe payments...")` → finds "Payment Integration" (Grade A) catalog agent
+> Merlin: "⟡🔮 MERLIN › Found a community agent: **Payment Integration** (Grade A) by ChatAndBuild. Install with `/merlin:install payment-integration`, or use built-in implementation-dev?"
+
+This is what makes the "1000+ skills on the server" actually useful.
+
 ## Agent Routing
 
 Call `merlin_smart_route(task="...")` FIRST (searches 500+ community agents). Then:

package/files/scripts/duo-mode-read.sh

@@ -33,8 +33,13 @@ pair=$(grep -o '"pair"[[:space:]]*:[[:space:]]*"[^"]*"' "$STATE_FILE" 2>/dev/nul
 [[ "$enabled" != "true" ]] && { if [[ "$PAIR_MODE" == "true" ]]; then echo "none"; else echo "disabled"; fi; exit 0; }
 [[ -z "$since" || "$since" == "null" ]] && { if [[ "$PAIR_MODE" == "true" ]]; then echo "none"; else echo "disabled"; fi; exit 0; }
 
-# Check 24h expiry using portable date commands (macOS has date -j, Linux has date -d)
-since_epoch=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$since" "+%s" 2>/dev/null || date -d "$since" "+%s" 2>/dev/null || echo "")
+# Check 24h expiry using portable date commands (macOS has date -j, Linux has date -d).
+# Normalize +00:00 / +0000 offsets to Z so the strict macOS parser accepts them.
+since_normalized=$(echo "$since" | sed 's/\+00:00$/Z/; s/\+0000$/Z/; s/\.[0-9][0-9][0-9]Z$/Z/; s/\.[0-9][0-9][0-9]\+00:00$/Z/')
+since_epoch=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$since_normalized" "+%s" 2>/dev/null \
+    || date -d "$since" "+%s" 2>/dev/null \
+    || date -d "$since_normalized" "+%s" 2>/dev/null \
+    || echo "")
 if [[ -z "$since_epoch" ]]; then
     # Unparseable timestamp — treat as expired
     if [[ "$PAIR_MODE" == "true" ]]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-merlin-brain",
-  "version": "5.3.5",
+  "version": "5.3.7",
   "description": "Merlin - The Ultimate AI Brain for Claude Code, Codex, and other AI CLIs. One install: workflows, agents, loop, and Sights MCP server.",
   "type": "module",
   "main": "./dist/server/index.js",