githits 0.11.0 → 0.11.2

package/.claude-plugin/marketplace.json

@@ -6,12 +6,12 @@
   },
   "metadata": {
     "description": "The code context layer for AI coding agents",
-    "version": "0.11.0"
+    "version": "0.11.2"
   },
   "plugins": [
     {
       "name": "githits",
-      "version": "0.11.0",
+      "version": "0.11.2",
       "description": "The code context layer for AI coding agents",
       "author": {
         "name": "GitHits"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

package/.plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

package/AGENTS.md

@@ -27,6 +27,7 @@ Philosophy: "Create architecture that is performant and easy to test"
 - Use dependency injection for external services (REST client, etc.)
 - Do not eagerly validate network/proxy/environment configuration while constructing command dependencies when the command has local-only or no-network paths. Defer validation until the first network operation and add regression tests for malformed env values on local paths.
 - For MCP/agent-facing tools, avoid coupled optional flags and default-true booleans. Design schemas for real agent calls, including empty strings, empty arrays, and explicit `false` values.
+- For MCP tool discovery, treat the tool name plus the first 80 description characters as a standalone selection surface. A verified Claude Desktop connector session exposed only that context during unguided tool selection; connector descriptions and MCP server instructions did not reach it. Lead with the natural user question and the tool's distinct job, treat 80 characters as a ceiling rather than a target, and keep registry counts/lists, argument mechanics, and follow-up routing after that boundary. Do not rely on neighboring tools for context. Add first-80 contract tests and run descriptor-only agent evals for description changes.
 - For GraphQL/API-backed tools, treat minimal data fetching as part of the tool contract. Before adding or changing selected fields, compare the query against every consumer (text, verbose, JSON, MCP, CLI, and internal callers), use conditional fields or separate queries for mode-specific data, and add tests that assert the wire variables/selections for compact and detailed modes.
 
 See `docs/guidelines/ARCHITECTURAL_GUIDELINES.md` for detailed planning checklist and design principles.
@@ -81,6 +82,7 @@ See `docs/guidelines/TESTING.md` for comprehensive patterns.
 - Root `skills/` and `AGENTS.md` are the only authored shared agent guidance. `CLAUDE.md` and `GEMINI.md` must remain symlinks to `AGENTS.md`.
 - Use the repository-internal `githits-plugin-maintenance` skill when changing skills, agent guidance, plugin/marketplace/extension manifests, MCP transport metadata, root release metadata, generator behavior, or agent-facing setup/auth behavior. It must remain under `.agents/skills/` and must not be published with the public root `skills/` tree.
 - Do not edit generated plugin assets directly. Change their canonical inputs, run `bun run plugins:generate`, inspect the diff, and run `bun run plugins:check`.
+- `packages/mcp/src/mcp/instructions.ts` owns the stable `buildMcpQuickStart()` guide. When it or the terminal guide section in `skills/githits-mcp/SKILL.md` changes, update both in the same PR; `src/skills-packaging.test.ts` exact-parity coverage is the contract. `buildLocalMcpQuickStart()` runtime appendices are excluded from the public skill copy. Behavior-dependent guide changes follow the public Agent Skill lifecycle.
 - `server.json` owns the canonical plugin keyword list used by generated manifests; keep `package.json` aligned with it.
 - All plugin and extension packages use hosted remote MCP. Direct `githits init` configuration retains local stdio except for Cursor, which is remote-only. Claude and Gemini direct setup remove legacy plugin or extension state before installing the user-scoped stdio server.
 
@@ -109,12 +111,12 @@ See `docs/guidelines/TESTING.md` for comprehensive patterns.
 
 ## Workspace Boundaries
 
-- Root `src/**` is still the published `githits` CLI implementation until the CLI package move completes. It owns Commander commands, local auth storage, browser login, init/setup flows, local stdio MCP startup, and plugin/assistant packaging assets.
-- `packages/core-internal` is private source. It owns transport-neutral service clients, service interfaces, shared request/header/telemetry primitives, neutral service errors, PKCE helpers, and `TokenProvider`. Never publish or leak `@githits/core-internal` into public artifacts.
-- `packages/mcp` is the public `@githits/mcp` package. Its public tool/server API is `packages/mcp/src/index.ts`: transport-neutral MCP server creation, tool registration, descriptors, instructions, request-scoped service provider types, and MCP service types. Its public runtime/client API is `packages/mcp/src/client.ts`, exported as `@githits/mcp/client`, for remote MCP servers that need concrete service implementations and token/header/config helpers.
+- Root `src/**` is still the published `githits` CLI implementation until the CLI package move completes. It owns Commander commands, local auth storage, browser login, init/setup flows, local stdio MCP startup, plugin/assistant packaging assets, and the diagnostics implementation/lifecycle (environment, process, and output destinations).
+- `packages/core-internal` is private source. It owns transport-neutral service clients, service interfaces, shared request/header primitives, the host-supplied `ServiceDiagnostics` contract, neutral service errors, PKCE helpers, and `TokenProvider`. It must not discover diagnostics environment settings or own diagnostics process/output destinations. Never publish or leak `@githits/core-internal` into public artifacts.
+- `packages/mcp` is the public `@githits/mcp` package. Its public tool/server API is `packages/mcp/src/index.ts`: transport-neutral MCP server creation, tool registration, descriptors, instructions, request-scoped service provider types, and MCP service types. Its public runtime/client API is `packages/mcp/src/client.ts`, exported as `@githits/mcp/client`, for remote MCP servers that need concrete service implementations, token/header/config helpers, and optional injected `ServiceDiagnostics`.
 - `@githits/mcp/smoke-test` is a public validation helper entrypoint for remote MCP servers. It exports smoke assertions and `runMcpSmoke()` without depending on local CLI startup.
 - `@githits/mcp/internal` is a workspace-only alias for root CLI transition helpers. External packages and the future remote MCP server repo must never import it. If remote server work needs something internal, promote the smallest stable API through `@githits/mcp` instead.
-- Public package artifacts for both root `githits` and `@githits/mcp` must not contain `@githits/core-internal`, `workspace:*`, `@githits/mcp/internal`, or private source aliases in JS, declarations, or manifests.
+- Public package artifacts for both root `githits` and `@githits/mcp` must not contain `@githits/core-internal`, `workspace:*`, `@githits/mcp/internal`, or private source aliases in JS, declarations, or manifests. The public-package validator also rejects static `fs`, `node:fs`, `fs/promises`, and `node:fs/promises` imports in core source and packed MCP artifacts, and rejects direct core `process.stderr`/`process.stdout` access. These checks cover statically resolved string-literal module edges; they do not claim browser compatibility.
 
 ## Release Boundaries