cue-ai 0.9.2 → 0.9.4

package/profiles/gstack/profile.yaml

@@ -1,6 +1,6 @@
 name: gstack
 icon: "🏭"
-description: "gstack (lean) — core + the high-value gstack roles: ship/deploy, design & real-browser QA, plan-design/devex review, spec, safety rails. Trimmed from the full 23-role suite to cut always-on overhead."
+description: "gstack (full) — 58-role virtual engineering team: ship/deploy, design & real-browser QA, planning, safety rails, iOS, browser tools, gbrain, and openclaw variants."
 playbooks:
   - gstack-workflow  # role-routing dev flow: spec → plan-review → careful → review → qa → ship → land
 persona: |
@@ -8,23 +8,67 @@ persona: |
   of a blank prompt, you route work to the right specialist role and run it with
   rigor. Each role is a skill (a slash command). Pick the role the task calls for.
 
-  This is the lean cut: the long tail of gstack roles (iOS, benchmark, scrape,
-  gbrain, etc.) was dropped. Everything below is either a kept gstack role or a
-  capability inherited from core.
+  This is the full suite: all 58 roles from garrytan/gstack plus cue-specific
+  extras. Route to the highest-signal role for the task — don't freestyle when
+  a specialist role exists.
 
   (Integrity Protocol is included via core's persona_includes.)
 
   ## Route to the right role
 
-  - **Shape an idea** → `/spec` (vague intent → executable spec); `/office-hours` soft-loads via `/smart-loader`.
-  - **Plan a feature** → `/plan-design-review`, `/plan-devex-review`, then `/autoplan` (via core)
-    to compose the pipeline — it soft-loads office-hours → ceo → eng on demand.
-  - **Build carefully** → `/careful`, `/investigate` (root-cause debugging, via core).
-  - **Review a diff** → `/code-review-deep` (via core), `/devex-review`, `/design-review`,
-    `/design-shotgun`; `/cso` (OWASP + STRIDE security audit) soft-loads via `/smart-loader`.
-  - **QA in a real browser** → `/qa`, `/qa-only`.
-  - **Ship it** → `/ship`, `/land-and-deploy`, `/setup-deploy`, `/canary`, `/document-release`.
-  - **Freeze / protect work** → `/freeze`, `/unfreeze`, `/guard` (via core), `/health`.
+  ### Shape & plan
+  - **Shape an idea** → `/spec`, `/office-hours`
+  - **CEO scope review** → `/plan-ceo-review`
+  - **Engineering review** → `/plan-eng-review`, `/plan-tune`
+  - **Design review** → `/plan-design-review`
+  - **DX review** → `/plan-devex-review`
+  - **Full plan pipeline** → `/autoplan` (soft-loads office-hours → ceo → eng on demand)
+
+  ### Build
+  - **Debug / root cause** → `/investigate`
+  - **Build carefully** → `/careful`
+  - **Pair session** → `/pair-agent`
+  - **Learn a codebase** → `/learn`
+
+  ### Review & QA
+  - **Code review** → `/review`, `/cso` (security/OWASP+STRIDE)
+  - **Design QA** → `/design-review`, `/design-shotgun`, `/design-consultation`, `/design-html`
+  - **DX QA** → `/devex-review`
+  - **Real-browser QA** → `/qa`, `/qa-only`
+
+  ### Ship & deploy
+  - **Ship** → `/ship`, `/land-and-deploy`, `/setup-deploy`
+  - **Monitor** → `/canary`, `/landing-report`
+  - **Docs** → `/document-release`, `/document-generate`
+  - **Upgrade gstack** → `/gstack-upgrade`
+
+  ### Safety rails
+  - **Freeze / protect** → `/freeze`, `/unfreeze`, `/guard`, `/health`
+  - **Retrospective** → `/retro`
+
+  ### Browser & scraping
+  - **Browse** → `/browse`, `/open-gstack-browser`, `/connect-chrome`
+  - **Scrape** → `/scrape`, `/skillify`, `/hackernews-frontpage`
+  - **Setup cookies** → `/setup-browser-cookies`
+
+  ### Context
+  - **Save/restore** → `/context-save`, `/context-restore`
+
+  ### iOS
+  - **iOS design** → `/ios-design-review`
+  - **iOS QA** → `/ios-qa`
+  - **iOS fix** → `/ios-fix`
+  - **iOS sync** → `/ios-sync`
+  - **iOS clean** → `/ios-clean`
+
+  ### Tooling & benchmarks
+  - **Benchmark** → `/benchmark`, `/benchmark-models`
+  - **Codex** → `/codex`
+  - **Make PDF** → `/make-pdf`
+
+  ### GBrain
+  - **Setup** → `/setup-gbrain`
+  - **Sync** → `/sync-gbrain`
 
   ## Operating principles
 
@@ -47,37 +91,81 @@ recommends:
   - vercel        # the platform the ship / deploy roles push Next.js + functions to
 skills:
   local:
-    # ── gstack (lean) — high-value roles vendored from garrytan/gstack (MIT) ──
-    # Dropped vs full gstack: skills already provided by core (autoplan, cso,
-    # office-hours, plan-ceo/eng-review, context-save/restore, investigate),
-    # the safety-rail duplicates that core ships as commands (careful, freeze,
-    # guard, unfreeze), plus the long tail (iOS×5, benchmark×2, browse, scrape,
-    # codex, learn, pair-agent, retro, skillify, gbrain×2, etc.).
-    #
-    # Ship & deploy
+    # ── Ship & deploy ──────────────────────────────────────────────────────────
     - gstack/ship
     - gstack/land-and-deploy
     - gstack/setup-deploy
     - gstack/canary
     - gstack/document-release
-    # Design & real-browser QA
+    - gstack/document-generate
+    - gstack/landing-report
+    - gstack/gstack-upgrade
+
+    # ── Design & real-browser QA ───────────────────────────────────────────────
     - gstack/design-review
     - gstack/design-shotgun
+    - gstack/design-consultation
+    - gstack/design-html
     - gstack/devex-review
     - gstack/qa
     - gstack/qa-only
-    # Plan & spec (beyond what core already provides)
+
+    # ── Planning & spec ────────────────────────────────────────────────────────
     - gstack/spec
+    - gstack/autoplan
+    - gstack/office-hours
+    - gstack/plan-ceo-review
     - gstack/plan-design-review
     - gstack/plan-devex-review
-    # Safety rails (only the one with no core command equivalent)
+    - gstack/plan-eng-review
+    - gstack/plan-tune
+
+    # ── Safety rails & review ──────────────────────────────────────────────────
     - gstack/health
-    # gitguardex (gx) — worktree/lock/PR safety + the gated auto-ship flow
+    - gstack/careful
+    - gstack/freeze
+    - gstack/unfreeze
+    - gstack/guard
+    - gstack/investigate
+    - gstack/review
+    - gstack/retro
+    - gstack/cso
+
+    # ── Browser & scraping ─────────────────────────────────────────────────────
+    - gstack/browse
+    - gstack/open-gstack-browser
+    - gstack/setup-browser-cookies
+    - gstack/scrape
+    - gstack/skillify
+    - gstack/hackernews-frontpage
+
+    # ── Context ────────────────────────────────────────────────────────────────
+    - gstack/context-save
+    - gstack/context-restore
+
+    # ── iOS ────────────────────────────────────────────────────────────────────
+    - gstack/ios-design-review
+    - gstack/ios-qa
+    - gstack/ios-fix
+    - gstack/ios-sync
+    - gstack/ios-clean
+
+    # ── Tooling & benchmarks ───────────────────────────────────────────────────
+    - gstack/benchmark
+    - gstack/benchmark-models
+    - gstack/codex
+    - gstack/make-pdf
+    - gstack/pair-agent
+    - gstack/learn
+
+    # ── GBrain ─────────────────────────────────────────────────────────────────
+    - gstack/setup-gbrain
+    - gstack/sync-gbrain
+
+    # ── GitHub / worktree safety ───────────────────────────────────────────────
     - github/gitguardex
-    # gx mcp agent radar — see who's on which branch/PR/file, avoid collisions
-    - github/gx-agents
-# MCPs: cue-tty-watch + lightpanda inherited from core. gbrain dropped along
-# with the setup-gbrain / sync-gbrain skills.
+
+# MCPs: cue-tty-watch + lightpanda inherited from core.
 rules:
   - common/code-review
   - common/coding-style

package/profiles/marketing/profile.yaml

@@ -85,7 +85,6 @@ skills:
     - repo: affaan-m/everything-claude-code
       skills: [seo]
 mcps:
-  - google-ads-mcp
   - mapi-devdocs
   - Higgsfield
   - trendradar

package/profiles/media/README.md

@@ -0,0 +1,70 @@
+# 🎬 media
+
+Generative media profile — generate, edit, and remix AI **images, video, and audio**
+via the [muapi](https://muapi.ai) model catalog (100+ models: Flux, Midjourney v7,
+Kling 3.0, Veo3, Seedance 2.0, Suno V5).
+
+Vendored from [SamurAIGPT/Generative-Media-Skills](https://github.com/SamurAIGPT/Generative-Media-Skills)
+— 4 core primitives + 56 ready-to-run creative recipes, wired flat into the
+`media/` skill namespace.
+
+## Prerequisites (the bundled scripts need these)
+
+```bash
+# 1. Install the muapi CLI (engine for the core scripts)
+npm install -g muapi-cli        # or: pip install muapi-cli
+
+# 2. Configure your API key (get one at https://muapi.ai)
+muapi auth configure --api-key "YOUR_MUAPI_KEY"
+# ...or export it. Most engine scripts read MUAPI_KEY; ai-clipping and
+#    platform setup read MUAPI_API_KEY — set BOTH to be safe:
+export MUAPI_KEY="YOUR_MUAPI_KEY"
+export MUAPI_API_KEY="YOUR_MUAPI_KEY"
+
+# 3. jq and curl must be on PATH (the core scripts use them directly)
+```
+
+The **`kdenlive`** skill is local and needs no muapi key — just its own tools:
+
+```bash
+sudo apt-get install -y kdenlive melt ffmpeg mediainfo fonts-montserrat
+```
+
+Generated files default to `./media_outputs/` in your current working directory.
+
+## What's inside
+
+| Group | Count | Examples |
+|---|---|---|
+| **Core primitives** | 4 | `core-media` (generate image/video/music, upload), `core-edit` (edit/enhance/lipsync/effects), `core-platform` (auth + polling), `workflow` (recipe runner) |
+| **Motion / video** | 21 | `cinema-director`, `seedance-2`, `ugc-video-factory`, `product-ad-cinematic`, `music-video` |
+| **Social** | 7 | `instagram-post`, `youtube-shorts`, `product-campaign`, `social-pack` |
+| **Edit / clipping** | 1 | `ai-clipping` (long video → ranked vertical shorts) |
+| **Visual / design** | 27 | `nano-banana`, `logo-creator`, `ui-design`, `ad-creative`, `youtube-thumbnail`, `brand-kit` |
+| **Local edit / render** | 1 | `kdenlive` — headless NLE via melt+ffmpeg: stitch, crossfade, title, score, render `.kdenlive` projects, reframe to 9:16. **No API key.** |
+
+Use the recipes over the raw primitives — they bake in cinematography, atomic
+design, and branding logic. Browse them with the `workflow` skill.
+
+## Note on the import
+
+The upstream repo is a single intact tree where library scripts reach back into
+`../../../../core/media/*.sh` and read `../../schema_data.json` from the repo root.
+cue uses a **flat 2-level** skill layout (`media/<slug>`), and the runtime
+materializes every profile skill as a flat sibling under `runtime/skills/`. So the
+cross-tree references were mechanically repointed to flat-sibling form
+(`$SCRIPT_DIR/../../core-media/…`, `$SKILLS_ROOT/<slug>/…`), and `schema_data.json`
+was vendored into `core-media/`. Recipe content (the SKILL.md prompts/logic) is
+unchanged — only the helper-script paths were rewritten so they resolve in both the
+source tree and the materialized runtime.
+
+Descriptions are kept verbatim from upstream (feature-first), so the skills are
+**invokable by name** but don't yet auto-trigger on natural-language prompts. Run
+`/description-optimizer` on a skill to add `Use when user says "…"` trigger phrases.
+
+## Activate
+
+```bash
+cue use media        # pin to the current directory
+cue summon media     # soft-load into the live session (no restart)
+```

package/profiles/media/profile.yaml

@@ -0,0 +1,104 @@
+name: media
+icon: "🎬"
+description: Generate, edit, and remix AI images, video, and audio via muapi — 100+ models (Flux, Midjourney v7, Kling 3.0, Veo3, Seedance 2.0, Suno V5) plus 56 ready-to-run creative recipes.
+inherits: core
+recommends:
+  - creative-media   # Higgsfield + design-system generation
+  - video            # video production workflows
+  - marketing        # distribute the assets you generate
+  - designer         # premium UI/UX taste for visual skills
+persona: |
+  You're a generative media director. You turn a brief into finished images,
+  video, and audio using the muapi model catalog, and you pick the right model
+  and the right recipe for the job instead of brute-forcing one tool.
+
+  - **Recipe over raw call.** Reach for a library skill (cinema-director,
+    ugc-video-factory, logo-creator, ad-creative) before hand-rolling a raw
+    core primitive. The recipes bake in cinematography, atomic design, and
+    branding logic the raw API doesn't.
+  - **Pick the model on purpose.** 100+ models live in the schema. Match the
+    model to the output — Flux/Midjourney for stills, Kling/Veo3/Seedance for
+    motion, Suno for audio. State why you chose it.
+  - **Clarify the spec before generating.** Platform, aspect ratio, mood,
+    subject, and call-to-action decide the output. Nail them in one question,
+    then generate.
+  - **Iterate fast, polish last.** Generate 3-5 variants quickly, pick the
+    direction, refine one to final quality.
+  - **Generated media is a real artifact.** Save outputs, report the path, and
+    offer the obvious next step (animate the still, crop for each platform,
+    assemble the campaign pack).
+
+  Engine prerequisites (the bundled scripts need these — tell the user if missing):
+  - `npm install -g muapi-cli`  (or `pip install muapi-cli`)
+  - `export MUAPI_KEY=...` and `export MUAPI_API_KEY=...`  (or run
+    `muapi auth configure --api-key "<key>"`). Most engine scripts read
+    `MUAPI_KEY`; ai-clipping and platform setup read `MUAPI_API_KEY` — set both.
+  - `jq` and `curl` on PATH.
+skills:
+  local:
+    # --- Core primitives (the engine the recipes call) ---
+    - media/core-media        # generate image/video, image-to-video, music, upload
+    - media/core-edit         # prompt-based image edit, enhance, lipsync, video effects
+    - media/core-platform     # auth setup + async result polling
+    - media/workflow          # discover/list/run the recipe library
+    - media/kdenlive          # headless NLE: stitch/title/score/render via melt+ffmpeg
+    # --- Motion / video ---
+    - media/3d-logo-animation
+    - media/ai-fight-scene
+    - media/animal-video-generator
+    - media/award-ceremony-video
+    - media/cartoon-dance-animation
+    - media/character-story-video
+    - media/cinema-director
+    - media/drone-style-video
+    - media/freeze-effect-video
+    - media/giant-product-showcase
+    - media/jewelry-product-video
+    - media/music-video
+    - media/one-shot-video
+    - media/product-ad-cinematic
+    - media/product-showcase-video
+    - media/product-video-ad-maker
+    - media/seedance-2
+    - media/storyboard-to-cooking-video
+    - media/talking-baby-video
+    - media/ugc-lifestyle-try-on
+    - media/ugc-video-factory
+    # --- Social ---
+    - media/instagram-post
+    - media/product-campaign
+    - media/rednote-cover
+    - media/social-media-video
+    - media/social-pack
+    - media/ugc-ads-workflow
+    - media/youtube-shorts
+    # --- Edit / clipping ---
+    - media/ai-clipping
+    # --- Visual / images & design ---
+    - media/action-figure-generator
+    - media/ad-creative
+    - media/amazon-product-listing
+    - media/blog-header
+    - media/brand-kit
+    - media/brochures
+    - media/chibi-collage-effect
+    - media/color-analysis-board
+    - media/couple-grid-creator
+    - media/design-guide
+    - media/fashion-try-on
+    - media/floor-plan-rendering
+    - media/interior-design
+    - media/interior-design-visualizer
+    - media/keyboard-art-maker
+    - media/logo-branding
+    - media/logo-creator
+    - media/logo-generator
+    - media/multi-angle-reshoot
+    - media/multi-angle-shots
+    - media/nano-banana
+    - media/photo-pack-generator
+    - media/selfie-with-celebrities
+    - media/storyboard
+    - media/ui-design
+    - media/url-to-design
+    - media/youtube-thumbnail

package/profiles/nano-banana/profile.yaml

@@ -0,0 +1,52 @@
+name: nano-banana
+icon: "🍌"
+description: "Nano Banana — AI image generation Creative Director on Google Gemini (nanobanana MCP), text-to-image, editing, batch, and brand presets"
+inherits: core
+recommends:
+  - creative-media  # broader image/video/brand asset pipeline
+  - designer        # premium UI/UX design skills
+env:
+  # Google AI Studio key for the nanobanana MCP. Get one free at
+  # https://aistudio.google.com/apikey — export it in your shell or secret store.
+  GOOGLE_AI_API_KEY: "${GOOGLE_AI_API_KEY}"
+skills:
+  local:
+    - design/banana
+mcps:
+  - nanobanana-mcp
+persona: |
+  You are a **Creative Director** for AI image generation, powered by Google's
+  Gemini "Nano Banana" image models through the `nanobanana-mcp` server. The
+  `design/banana` skill is your operating manual — follow it exactly.
+
+  ## Bootstrap, every session
+
+  - Confirm the MCP is live: the `gemini_generate_image` / `gemini_edit_image`
+    tools should be available. If they error on auth, `GOOGLE_AI_API_KEY` is
+    unset — tell the user to export it (free key at
+    https://aistudio.google.com/apikey) and restart Claude Code. Don't paste
+    keys into chat or config.
+  - Generated images land in `~/Documents/nanobanana_generated/` by default.
+
+  ## Non-negotiable workflow (from the skill)
+
+  Before constructing ANY prompt or calling ANY tool, read:
+  1. `design/banana/references/gemini-models.md` — pick the right model + params
+  2. `design/banana/references/prompt-engineering.md` — build a compliant prompt
+
+  Never pass raw user text to the API. Always interpret intent, select the
+  domain mode, and construct an optimized prompt with the 5-Component Formula
+  (the Reasoning Brief). Load `references/presets.md` for brand presets and
+  `references/post-processing.md` when output needs cleanup.
+
+  ## Money discipline
+
+  Every generation debits the user's Gemini quota. For iteration, do **one**
+  generation, show the result, then ask before re-rolling. Don't auto-loop
+  variants. Log spend with `scripts/cost_tracker.py` when the user wants
+  tracking (`references/cost-tracking.md`).
+
+  ## Output discipline
+
+  Save finals into the project's asset directory, not /tmp. Reference images by
+  their saved path so edits (`gemini_edit_image`) can target them.

package/profiles/ops/profile.yaml

@@ -17,7 +17,6 @@ skills:
     - github/github
     - github/gh-fix-ci
     - review/security-review
-    - secrets/envoult
     - gstack/setup-deploy
     - private/myvps
     - hostinger/dns
@@ -98,7 +97,7 @@ persona: |
   | DNS, domains, VPS firewall, shared hosting, TLS       | hostinger/*           |
   | Self-hosted VPS schema and server ops                 | private/myvps         |
   | Repo automation, Actions, CI failures                 | github/*              |
-  | Secrets and env injection                             | secrets/envoult       |
+  | Secrets and env injection                             | Coolify env + envoult MCP |
   | One-shot deploy bootstrap                             | gstack/setup-deploy   |
   | Diff and dependency security audit                    | review/security-review|
   | Drive, Docs, Sheets, Slides, Calendar                 | google-workspace/*    |

package/profiles/secops/profile.yaml

@@ -40,6 +40,9 @@ skills:
       skills: [ctf-osint]
     - repo: davila7/claude-code-templates
       skills: [red-team-tools-and-methodology]
+    # Discovered 2026-06-08: CI guardrail for prompt-injection paths in agentic workflows.
+    - repo: CheekyCodexConjurer/prompttaint-ci
+      skills: [prompttaint-ci]
 plugins:
   - claude-mem@thedotmack
   - oh-my-claudecode@omc

package/profiles/skill-writer/profile.yaml

@@ -94,6 +94,16 @@ skills:
     - meta/soul                      # soul identity management
     - meta/upgrade-stack             # upgrade cue stack
     - meta/cue-dashboard             # query/drive the live cue studio dashboard (cue dash CLI + cue-dashboard MCP)
+  npx:
+    # Discovered 2026-06-08: typed/contracts/tests layer for productionizing skills.
+    - repo: e01n0/skillspec
+      skills: [skillspec]
+    # Discovered 2026-06-08: context-budget and compaction hygiene.
+    - repo: gerrict/ghost-token-hunter
+      skills: [ghost-token-hunter]
+    # Discovered 2026-06-08: maintainability pressure for agent-authored code.
+    - repo: ScienceIsNeato/slop-mop
+      skills: [slop-mop]
 
 playbooks:
   - write-skill-from-scratch
@@ -122,6 +132,11 @@ hooks:
   # and (with the live critic) judges the gap, feeding `cue profile self-improve`.
   # OFF until `touch ~/.config/cue/.auto-improve-enabled`. See docs/self-learner.md.
   - profile-self-improve.json
+  # SessionStart hook: surface the most recent cross-session learnings (from
+  # bin/cue-learnings) into context so the model reads them automatically — the
+  # read-back half of the learnings loop. Read-only, fail-open, no-op when none
+  # exist. Disable with CUE_LEARNINGS_SURFACE_OFF=1.
+  - learnings-surface.json
 
 mcps:
   - gbrain

package/profiles/video/profile.yaml

@@ -33,6 +33,9 @@ skills:
       skills: [ffmpeg]                       # 3.6K installs — top ffmpeg skill
     - repo: mindmorass/reflex
       skills: [ffmpeg-patterns]              # 269 installs — pattern library complement
+    # Discovered 2026-06-08: Gemini-backed video understanding.
+    - repo: sandypoli-boop/claude-gemini-video
+      skills: [claude-gemini-video]
 plugins:
   - claude-video-vision@jordanrendric
 mcps:

package/profiles/web-frontend-base/profile.yaml

@@ -13,3 +13,9 @@ skills:
     # Ref-based snapshot → click/fill → screenshot. The only browser stack here;
     # use it for visual verification of frontends.
     - browser/agent-browser
+  npx:
+    # Addy Osmani's production-grade agent skills (addyosmani/agent-skills, 48K★).
+    # Cherry-picked the two highest-signal, framework-agnostic skills; they
+    # propagate to frontend/nextjs/vite/medusa storefronts via inheritance.
+    - repo: addyosmani/agent-skills
+      skills: [frontend-ui-engineering, performance-optimization]

package/profiles/webshop/profile.yaml

@@ -85,7 +85,6 @@ skills:
     - higgsfield/higgsfield-soul-id
     - medusa/higgsfield-to-medusa-products
     # --- coolify deploy + secrets + myvps ---
-    - secrets/envoult
     - gstack/setup-deploy
     - private/myvps
     # --- hostinger DNS/domains/VPS/hosting ---

package/profiles/webshop-google/profile.yaml

@@ -13,6 +13,7 @@ skills:
   local:
     - content/pdf       # PDF report generation for stakeholder deliverables
   npx:
+    # google/skills inherited via bundled google-ads + google-analytics
     # --- Official Google Ads MCP skill ---
     - repo: googleads/google-ads-mcp
       skills: [account-performance-diagnostics]

package/profiles/x-growth-bot/profile.yaml

@@ -9,11 +9,13 @@ skills:
   local:
     # The operator surface: routes each request to the xbot MCP / botctl / cli
     # and enforces the loop-vs-MCP live-write safety rule.
+    - xbot/operate
 
 # The bot's MCP control surface (~27 tools: xbot_status, xbot_think, xbot_reply,
 # xbot_dm, xbot_cycle, xbot_pause, xbot_control, ...). core already contributes
 # cue-tty-watch + lightpanda.
 mcps:
+  - xbot
 
 # Quality rules read on-demand (indexed in CLAUDE.md, not inlined).
 rules: