liteagents 2.14.1 → 2.15.1

package/CHANGELOG.md

@@ -15,6 +15,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Enhanced testing capabilities
 - Performance optimizations
 
+## [2.15.1] - 2026-07-24
+
+### Security
+
+- **Bumped the bundled `live-canvas-channel` plugin's transitive deps to patched versions.** `fast-uri` 3.1.2 → 3.1.4 (clears a **high**-severity host-confusion advisory), `body-parser` 2.2.2 → 2.3.0 (DoS via a silently-disabled size limit), and `hono` 4.12.25 → 4.12.31 (moderate). These come in via the plugin's `@modelcontextprotocol/sdk` and ship in the tarball's `package-lock.json`. All sit on unused transport paths — the plugin server is stdio (`StdioServerTransport`) + raw `node:http`, with no `@hono/node-server`/express/Streamable-HTTP surface — so this is defense-in-depth hardening of the bundled lockfile, not a runtime fix. `npm audit` in the plugin drops from 4 findings (incl. 1 high) to 1 residual moderate (`@hono/node-server` serve-static), which is gated on the MCP SDK's own dependency range and has no upstream fix yet. 138 root tests green.
+
+### Fixed
+
+- **Publish workflow pinned to `npm@11` — npm 12.0.0's `npm publish --provenance` is broken.** The job ran `npm install -g npm@latest`, which started resolving to npm 12.0.0 (released 2026-07-09) on the Node 22 runner. npm 12's `libnpmpublish` provenance code does `require('sigstore')`, but the tarball bundles only the `@sigstore/*` scoped packages — so `--provenance` dies with `MODULE_NOT_FOUND` and the publish fails outright. npm@11 bundles `sigstore` and publishes fine. Pinned to the major rather than floating on `@latest`. Revisit once npm ships a provenance fix. CI only — no runtime or published-artifact change.
+
+### Changed
+
+- **Agent/IDE scratch is gitignored and de-tracked (`.claude/`, `.litectx/`, `.idea/`).** Per-machine agent and IDE state is no part of the package — it regenerates locally and only added noise and churn. Now ignored, and any already-committed copies removed from tracking (local files kept on disk). Functional dot-paths (`.github/`, `.gitignore`, `.npmignore`, `.mcp.json`) stay tracked. Repo hygiene only.
+
+---
+
+## [2.15.0] - 2026-07-13
+
+### Changed
+- `/stash` delegates the write-up to a mid-tier-model subagent, dispatched in the background
+  where the tool supports it, instead of writing inline on the top-tier session model —
+  drafting stays inline (only the running session has conversation context), but formatting
+  and file I/O move off the main turn. Falls back to inline writing if subagent/background
+  dispatch isn't available.
+
 ---
 
 ## [2.14.1] - 2026-07-10

package/README.md

@@ -80,7 +80,7 @@ Liteagents ships a two-command pipeline that turns Claude Code's session logs in
 capture    analyze + consolidate
 ```
 
-- **`/stash`** — snapshot the current session's context before compaction or handoff; nudges you to consolidate once a few stashes pile up
+- **`/stash`** — snapshot the current session's context before compaction or handoff; nudges you to consolidate once a few stashes pile up. The write-up runs on a mid-tier model, dispatched as a background subagent where your tool supports it, so the session isn't blocked on formatting/file I/O
 - **`/remember`** — runs friction analysis automatically (mining JSONL session logs across *all* your projects for frustration signals, failed flows, and abandonment patterns, clustered into antigen candidates), then consolidates stashes + friction antigens into `.claude/remember/MEMORY.md`; auto-injected into `CLAUDE.md` via `@MEMORY.md` so every future session benefits. Per-stash extraction runs as concurrent subagent calls on a mid-tier model — no model name hardcoded, so it works with whatever your tool has configured
 
 `/remember` also bootstraps a one-time `AGENT_RULES.md` coding-standards template into `.claude/remember/` on first run (never overwritten again after that), referenced separately in `CLAUDE.md` for the assistant to consult when building something new — a static guide, not something the pipeline learns or extracts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "2.14.1",
+  "version": "2.15.1",
   "description": "AI development toolkit with 11 specialized agents and 17 commands including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {

package/packages/ampcode/commands/stash.md

@@ -10,14 +10,25 @@ Save session context for compaction recovery or handoffs.
 **Guardrails**
 - Favor straightforward, minimal implementations first and add complexity only when requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
+- **Mid-tier model, not hardcoded.** The write-up subagent (step 2) uses a mid-tier model —
+  capable of semantic judgment, cheaper/faster than your top reasoning tier (e.g. Claude's
+  Sonnet vs Opus). Use whatever your tool designates as that balanced default; never hardcode
+  a vendor-specific model name.
+- **Background dispatch where supported.** Run the write-up subagent in the background
+  (non-blocking) so the session isn't held up waiting on formatting/file I/O. Fall back to
+  writing inline (today's behavior) if your tool has no subagent or background-dispatch
+  mechanism.
 
 **What it does**
-1. Captures current conversation context and key decisions
-2. Records active work in progress
-3. Stores important findings and insights
-4. Creates stash file in `.amp/stash/`
-5. Enables context restoration after compaction
-6. **Consolidation nudge** — after saving, count the unprocessed backlog:
+1. Drafts a compact brief of current conversation context, key decisions, active work in
+   progress, and findings/insights — done inline, since only the running session holds full
+   conversation context
+2. Hands the brief to a subagent on the mid-tier model (see Guardrails) to expand into the
+   full stash file at `.amp/stash/<name>.md`, dispatched in the background where the tool
+   supports it. Falls back to writing inline if subagent/background dispatch isn't available
+3. Enables context restoration after compaction
+4. **Consolidation nudge** — whichever actor wrote the file (the subagent, or the session
+   itself on the inline fallback) counts the unprocessed backlog after saving:
    `unprocessed = (files in .amp/stash/*.md) − (entries in .amp/remember/.processed)`
    (a missing `.processed` manifest means 0 processed). If `unprocessed >= 5`, end with one line:
    > 📝 N stashes since last consolidation — run `/remember` to fold them into memory.
@@ -50,3 +61,5 @@ cat .amp/stash/<name>.md
 - Stashes stored in `.amp/stash/` (project-local)
 - Automatically includes: timestamp, active plan, recent decisions
 - Maximum context retention with minimal token usage
+- When dispatched in the background, the "Stashed to X" confirmation and consolidation nudge
+  arrive as the subagent's completion notification rather than inline in the same turn

package/packages/claude/commands/stash.md

@@ -10,14 +10,25 @@ Save session context for compaction recovery or handoffs.
 **Guardrails**
 - Favor straightforward, minimal implementations first and add complexity only when requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
+- **Mid-tier model, not hardcoded.** The write-up subagent (step 2) uses a mid-tier model —
+  capable of semantic judgment, cheaper/faster than your top reasoning tier (e.g. Claude's
+  Sonnet vs Opus). Use whatever your tool designates as that balanced default; never hardcode
+  a vendor-specific model name.
+- **Background dispatch where supported.** Run the write-up subagent in the background
+  (non-blocking) so the session isn't held up waiting on formatting/file I/O. Fall back to
+  writing inline (today's behavior) if your tool has no subagent or background-dispatch
+  mechanism.
 
 **What it does**
-1. Captures current conversation context and key decisions
-2. Records active work in progress
-3. Stores important findings and insights
-4. Creates stash file in `.claude/stash/`
-5. Enables context restoration after compaction
-6. **Consolidation nudge** — after saving, count the unprocessed backlog:
+1. Drafts a compact brief of current conversation context, key decisions, active work in
+   progress, and findings/insights — done inline, since only the running session holds full
+   conversation context
+2. Hands the brief to a subagent on the mid-tier model (see Guardrails) to expand into the
+   full stash file at `.claude/stash/<name>.md`, dispatched in the background where the tool
+   supports it. Falls back to writing inline if subagent/background dispatch isn't available
+3. Enables context restoration after compaction
+4. **Consolidation nudge** — whichever actor wrote the file (the subagent, or the session
+   itself on the inline fallback) counts the unprocessed backlog after saving:
    `unprocessed = (files in .claude/stash/*.md) − (entries in .claude/remember/.processed)`
    (a missing `.processed` manifest means 0 processed). If `unprocessed >= 5`, end with one line:
    > 📝 N stashes since last consolidation — run `/remember` to fold them into memory.
@@ -50,3 +61,5 @@ cat .claude/stash/<name>.md
 - Stashes stored in `.claude/stash/` (project-local)
 - Automatically includes: timestamp, active plan, recent decisions
 - Maximum context retention with minimal token usage
+- When dispatched in the background, the "Stashed to X" confirmation and consolidation nudge
+  arrive as the subagent's completion notification rather than inline in the same turn

package/packages/claude/plugins/live-canvas-marketplace/plugins/live-canvas-channel/package-lock.json

@@ -114,21 +114,34 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
-      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "debug": "^4.4.3",
-        "http-errors": "^2.0.0",
-        "iconv-lite": "^0.7.0",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
         "on-finished": "^2.4.1",
-        "qs": "^6.14.1",
-        "raw-body": "^3.0.1",
-        "type-is": "^2.0.1"
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
       },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/body-parser/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
       "engines": {
         "node": ">=18"
       },
@@ -435,9 +448,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "funding": [
         {
           "type": "github",
@@ -572,9 +585,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.25",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
-      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
+      "version": "4.12.31",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz",
+      "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -1068,17 +1081,34 @@
       }
     },
     "node_modules/type-is": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
       "dependencies": {
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/unpipe": {

package/packages/droid/commands/stash.md

@@ -10,14 +10,25 @@ Save session context for compaction recovery or handoffs.
 **Guardrails**
 - Favor straightforward, minimal implementations first and add complexity only when requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
+- **Mid-tier model, not hardcoded.** The write-up subagent (step 2) uses a mid-tier model —
+  capable of semantic judgment, cheaper/faster than your top reasoning tier (e.g. Claude's
+  Sonnet vs Opus). Use whatever your tool designates as that balanced default; never hardcode
+  a vendor-specific model name.
+- **Background dispatch where supported.** Run the write-up subagent in the background
+  (non-blocking) so the session isn't held up waiting on formatting/file I/O. Fall back to
+  writing inline (today's behavior) if your tool has no subagent or background-dispatch
+  mechanism.
 
 **What it does**
-1. Captures current conversation context and key decisions
-2. Records active work in progress
-3. Stores important findings and insights
-4. Creates stash file in `.factory/stash/`
-5. Enables context restoration after compaction
-6. **Consolidation nudge** — after saving, count the unprocessed backlog:
+1. Drafts a compact brief of current conversation context, key decisions, active work in
+   progress, and findings/insights — done inline, since only the running session holds full
+   conversation context
+2. Hands the brief to a subagent on the mid-tier model (see Guardrails) to expand into the
+   full stash file at `.factory/stash/<name>.md`, dispatched in the background where the tool
+   supports it. Falls back to writing inline if subagent/background dispatch isn't available
+3. Enables context restoration after compaction
+4. **Consolidation nudge** — whichever actor wrote the file (the subagent, or the session
+   itself on the inline fallback) counts the unprocessed backlog after saving:
    `unprocessed = (files in .factory/stash/*.md) − (entries in .factory/remember/.processed)`
    (a missing `.processed` manifest means 0 processed). If `unprocessed >= 5`, end with one line:
    > 📝 N stashes since last consolidation — run `/remember` to fold them into memory.
@@ -50,3 +61,5 @@ cat .factory/stash/<name>.md
 - Stashes stored in `.factory/stash/` (project-local)
 - Automatically includes: timestamp, active plan, recent decisions
 - Maximum context retention with minimal token usage
+- When dispatched in the background, the "Stashed to X" confirmation and consolidation nudge
+  arrive as the subagent's completion notification rather than inline in the same turn

package/packages/opencode/command/stash.md

@@ -10,14 +10,25 @@ Save session context for compaction recovery or handoffs.
 **Guardrails**
 - Favor straightforward, minimal implementations first and add complexity only when requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
+- **Mid-tier model, not hardcoded.** The write-up subagent (step 2) uses a mid-tier model —
+  capable of semantic judgment, cheaper/faster than your top reasoning tier (e.g. Claude's
+  Sonnet vs Opus). Use whatever your tool designates as that balanced default; never hardcode
+  a vendor-specific model name.
+- **Background dispatch where supported.** Run the write-up subagent in the background
+  (non-blocking) so the session isn't held up waiting on formatting/file I/O. Fall back to
+  writing inline (today's behavior) if your tool has no subagent or background-dispatch
+  mechanism.
 
 **What it does**
-1. Captures current conversation context and key decisions
-2. Records active work in progress
-3. Stores important findings and insights
-4. Creates stash file in `.opencode/stash/`
-5. Enables context restoration after compaction
-6. **Consolidation nudge** — after saving, count the unprocessed backlog:
+1. Drafts a compact brief of current conversation context, key decisions, active work in
+   progress, and findings/insights — done inline, since only the running session holds full
+   conversation context
+2. Hands the brief to a subagent on the mid-tier model (see Guardrails) to expand into the
+   full stash file at `.opencode/stash/<name>.md`, dispatched in the background where the tool
+   supports it. Falls back to writing inline if subagent/background dispatch isn't available
+3. Enables context restoration after compaction
+4. **Consolidation nudge** — whichever actor wrote the file (the subagent, or the session
+   itself on the inline fallback) counts the unprocessed backlog after saving:
    `unprocessed = (files in .opencode/stash/*.md) − (entries in .opencode/remember/.processed)`
    (a missing `.processed` manifest means 0 processed). If `unprocessed >= 5`, end with one line:
    > 📝 N stashes since last consolidation — run `/remember` to fold them into memory.
@@ -50,3 +61,5 @@ cat .opencode/stash/<name>.md
 - Stashes stored in `.opencode/stash/` (project-local)
 - Automatically includes: timestamp, active plan, recent decisions
 - Maximum context retention with minimal token usage
+- When dispatched in the background, the "Stashed to X" confirmation and consolidation nudge
+  arrive as the subagent's completion notification rather than inline in the same turn

package/packages/subagentic-manual.md

@@ -156,7 +156,10 @@ and wiring the memory into your agent config file.
 ```
 
 1. **`/stash`** - Snapshot current session context to the tool's `…/stash/`. Use before
-   compaction, handoffs, or ending complex work. After saving it counts the unprocessed backlog
+   compaction, handoffs, or ending complex work. The session drafts the raw content inline
+   (only it holds conversation context), then a mid-tier-model subagent expands and writes the
+   file — dispatched in the background where the tool supports it, falling back to writing
+   inline otherwise. Whichever actor wrote the file counts the unprocessed backlog
    (`stash files − .processed entries`) and, at 5+, nudges you to run `/remember`. No counter is
    stored; running `/remember` clears the backlog.
 2. **`/remember`** - Runs friction analysis first (best-effort — scores sessions across *all* your