memory-journal-mcp 7.7.1 → 8.0.0

package/dist/cli.js

@@ -1,5 +1,7 @@
-import { VERSION, DEFAULT_AUDIT_LOG_MAX_SIZE_BYTES, createServer } from './chunk-6LPTBIB6.js';
-import { logger } from './chunk-ARLYSFSI.js';
+import { createServer } from './chunk-MWNLAEHR.js';
+import './chunk-UHSO65A4.js';
+import { VERSION, DEFAULT_AUDIT_LOG_MAX_SIZE_BYTES } from './chunk-JFMITANR.js';
+import { logger } from './chunk-6OHRCNYW.js';
 import { Command } from 'commander';
 import * as path from 'path';
 import * as fs from 'fs';
@@ -80,6 +82,14 @@ program.name("memory-journal-mcp").description("Project context management for A
 ).option(
   "--codemode-internal-full-access",
   "Bypass tool filter constraints within the Code Mode sandbox (env: CODEMODE_INTERNAL_FULL_ACCESS)"
+).option(
+  "--prune-older-than-days <days>",
+  "Soft-delete entries older than N days with importance below threshold (env: PRUNE_OLDER_THAN_DAYS, 0 = disabled)",
+  "0"
+).option(
+  "--prune-importance-threshold <n>",
+  "Importance score threshold for pruning (env: PRUNE_IMPORTANCE_THRESHOLD, default: 0.15)",
+  "0.15"
 ).option(
   "--briefing-entries <count>",
   "Number of journal entries in briefing (env: BRIEFING_ENTRY_COUNT)",
@@ -401,7 +411,15 @@ program.name("memory-journal-mcp").description("Project context management for A
           const raw = options.flagVocabulary ?? process.env["FLAG_VOCABULARY"];
           if (!raw) return void 0;
           return raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
-        })()
+        })(),
+        pruneOlderThanDays: parseConfigIntRequired(
+          process.env["PRUNE_OLDER_THAN_DAYS"] ?? options.pruneOlderThanDays,
+          "prune-older-than-days",
+          0
+        ),
+        pruneImportanceThreshold: parseFloat(
+          process.env["PRUNE_IMPORTANCE_THRESHOLD"] ?? options.pruneImportanceThreshold
+        )
       });
     } catch (error) {
       logger.error("Failed to start server", {

package/dist/index.d.ts

@@ -22,7 +22,7 @@ interface AuditConfig {
 /**
  * Tool group definitions mapping group names to tool names
  *
- * All 70 tools are categorized here for filtering support.
+ * All 73 tools are categorized here for filtering support.
  */
 declare const TOOL_GROUPS: Record<ToolGroup, string[]>;
 /**
@@ -187,7 +187,7 @@ type EntryType = 'personal_reflection' | 'project_decision' | 'technical_achieve
 /**
  * Significance types for important entries
  */
-type SignificanceType = 'milestone' | 'breakthrough' | 'technical_breakthrough' | 'decision' | 'lesson_learned' | 'blocker_resolved' | 'release' | null;
+type SignificanceType = 'milestone' | 'breakthrough' | 'decision' | 'architecture' | 'lesson_learned' | 'blocker_resolved' | 'release' | 'security' | null;
 /**
  * Relationship types between entries
  *
@@ -553,18 +553,18 @@ interface IDatabaseAdapter {
         entryType?: EntryType;
         tags?: string[];
         isPersonal?: boolean;
-        significanceType?: string;
+        significanceType?: string | null;
         autoContext?: string | null;
-        projectNumber?: number;
-        projectOwner?: string;
-        issueNumber?: number;
-        issueUrl?: string;
-        prNumber?: number;
-        prUrl?: string;
-        prStatus?: string;
-        workflowRunId?: number;
-        workflowName?: string;
-        workflowStatus?: string;
+        projectNumber?: number | null;
+        projectOwner?: string | null;
+        issueNumber?: number | null;
+        issueUrl?: string | null;
+        prNumber?: number | null;
+        prUrl?: string | null;
+        prStatus?: string | null;
+        workflowRunId?: number | null;
+        workflowName?: string | null;
+        workflowStatus?: string | null;
     }): JournalEntry | null;
     deleteEntry(id: number, permanent?: boolean): boolean;
     searchEntries(query: string, options?: {
@@ -737,6 +737,7 @@ interface IDatabaseAdapter {
     clearVectors(): void;
     getVectorCount(): number;
     cleanupStaleVectors(): void;
+    pruneByImportance(olderThanDays: number, importanceThreshold: number): number;
     executeInTransaction<T>(cb: () => T): T;
 }
 
@@ -775,6 +776,8 @@ interface ServerOptions {
     flagVocabulary?: string[];
     allowedIoRoots?: string[];
     codemodeInternalFullAccess?: boolean;
+    pruneOlderThanDays?: number;
+    pruneImportanceThreshold?: number;
 }
 /**
  * Create and start the MCP server

package/dist/index.js

@@ -1,5 +1,7 @@
-export { VERSION, createServer } from './chunk-6LPTBIB6.js';
-export { META_GROUPS, TOOL_GROUPS, calculateTokenSavings, filterTools, getAllToolNames, getFilterSummary, getToolFilterFromEnv, getToolGroup, isToolEnabled, logger, parseToolFilter } from './chunk-ARLYSFSI.js';
+export { createServer } from './chunk-MWNLAEHR.js';
+import './chunk-UHSO65A4.js';
+export { VERSION } from './chunk-JFMITANR.js';
+export { META_GROUPS, TOOL_GROUPS, calculateTokenSavings, filterTools, getAllToolNames, getFilterSummary, getToolFilterFromEnv, getToolGroup, isToolEnabled, logger, parseToolFilter } from './chunk-6OHRCNYW.js';
 
 // src/types/index.ts
 var DEFAULT_CONFIG = {

package/dist/resources-IJVKDFGS.js

@@ -0,0 +1,2 @@
+export { getResources, readResource } from './chunk-JFMITANR.js';
+import './chunk-6OHRCNYW.js';

package/dist/tools-44DGXE3V.js

@@ -0,0 +1,2 @@
+export { callTool, getTools } from './chunk-UHSO65A4.js';
+import './chunk-6OHRCNYW.js';

package/dist/worker-script.js

@@ -46,18 +46,51 @@ function rpcCall(group, method, args) {
     rpcPort.postMessage(request);
   });
 }
-function buildApiProxy(methods) {
+function wrapResult(result) {
+  if (result !== null && result !== void 0 && typeof result === "object" && "success" in result && result["success"] === false) {
+    const failedResult = result;
+    return new Proxy(failedResult, {
+      get(target, prop) {
+        if (prop in target) return target[prop];
+        if (typeof prop === "string" && prop !== "then" && prop !== "catch" && prop !== "finally" && prop !== "constructor" && prop !== "prototype" && prop !== "toJSON") {
+          const errVal = target["error"];
+          const errorMsg = typeof errVal === "string" ? errVal : "Unknown error";
+          throw new Error(
+            `Attempted to access missing property '${prop}' on a failed operation. API Error: ${errorMsg}`
+          );
+        }
+        return void 0;
+      }
+    });
+  }
+  return result;
+}
+function buildApiProxy(methods, schemas, readonlyMode) {
   const api = {};
   for (const [group, methodNames] of Object.entries(methods)) {
     if (group === "_topLevel") {
       for (const methodName of methodNames) {
-        api[methodName] = (...args) => rpcCall("_topLevel", methodName, args);
+        const proxyFn = async (...args) => {
+          const result = await rpcCall("_topLevel", methodName, args);
+          return wrapResult(result);
+        };
+        Object.assign(proxyFn, {
+          schema: () => Promise.resolve(schemas?.["_topLevel"]?.[methodName] ?? "any")
+        });
+        api[methodName] = proxyFn;
       }
       continue;
     }
     const groupProxy = {};
     for (const methodName of methodNames) {
-      groupProxy[methodName] = (...args) => rpcCall(group, methodName, args);
+      const proxyFn = async (...args) => {
+        const result = await rpcCall(group, methodName, args);
+        return wrapResult(result);
+      };
+      Object.assign(proxyFn, {
+        schema: () => Promise.resolve(schemas?.[group]?.[methodName] ?? "any")
+      });
+      groupProxy[methodName] = proxyFn;
     }
     groupProxy["help"] = () => Promise.resolve({
       group,
@@ -70,14 +103,18 @@ function buildApiProxy(methods) {
         if (key in target) return target[key];
         if (key === "then") return void 0;
         const available = methodNames.join(", ") || "none";
-        const reason = methodNames.length === 0 ? `Operation '${key}' is not available \u2014 this group has no methods (read-only mode?). Available: ${available}.` : `Operation '${key}' is not found in group. Available: ${available}.`;
-        return (..._args) => Promise.reject(new Error(reason));
+        const reason = readonlyMode ? `Operation '${key}' is blocked in readonly mode. Read operations only.` : methodNames.length === 0 ? `Operation '${key}' is not available \u2014 this group has no methods (read-only mode?). Available: ${available}.` : `Operation '${key}' is not found in group. Available: ${available}.`;
+        return (..._args) => {
+          throw new Error(reason);
+        };
       }
     });
     api[group] = groupProxyWrapped;
   }
   api["help"] = () => {
-    const groups = Object.keys(methods).filter((g) => g !== "_topLevel");
+    const groups = Object.keys(methods).filter(
+      (g) => g !== "_topLevel" && g !== "memory" && g !== "entries"
+    );
     let totalMethods = 0;
     for (const group of groups) {
       totalMethods += methods[group]?.length ?? 0;
@@ -85,18 +122,115 @@ function buildApiProxy(methods) {
     return Promise.resolve({
       groups,
       totalMethods,
-      usage: "Use mj.<group>.help() for group details. Example: mj.core.help()"
+      usage: "Use mj.<group>.help() for group details. Use mj.<group>.<method>.schema() for parameter details."
     });
   };
-  return api;
+  return new Proxy(api, {
+    get(target, prop) {
+      if (typeof prop === "symbol") return void 0;
+      if (prop in target) return target[prop];
+      if (prop === "then") return void 0;
+      const available = Object.keys(methods).filter((k) => k !== "_topLevel").join(", ");
+      const reason = `Group or property '${prop}' is not found on 'mj'. Available groups: ${available}. Use mj.help() for more info.`;
+      return new Proxy(
+        () => {
+        },
+        {
+          apply() {
+            throw new Error(reason);
+          },
+          get(_t, subProp) {
+            if (typeof subProp === "symbol") return void 0;
+            if (subProp === "then") return void 0;
+            return (..._args) => {
+              throw new Error(
+                `${reason} (Attempted to access 'mj.${prop}.${subProp}')`
+              );
+            };
+          }
+        }
+      );
+    }
+  });
 }
-async function executeCode(code, methodList, timeoutMs) {
+async function executeCode(code, methodList, schemaList, timeoutMs, contextObj, readonlyMode) {
   const startCpu = process.cpuUsage();
   const startTime = performance.now();
   try {
-    const mjApi = buildApiProxy(methodList);
+    const mjApi = buildApiProxy(methodList, schemaList, readonlyMode);
+    const shimMj = new Proxy(mjApi, {
+      get(target, prop) {
+        if (prop === "mj" || prop === "journal" || prop === "memory") return shimMj;
+        if (prop === "executeCode") {
+          if ("codemode" in target) {
+            const codemodeGroup = target["codemode"];
+            return codemodeGroup["mjExecuteCode"] ?? codemodeGroup["executeCode"];
+          }
+          return () => Promise.reject(
+            new Error(
+              "You are already inside Code Mode execution. You do not need to call executeCode again. Just write your logic directly (e.g., return await mj.core.createEntry(...))."
+            )
+          );
+        }
+        if (prop === "readResource") {
+          return () => Promise.reject(
+            new Error(
+              "Code Mode cannot directly read MCP resources using mj.readResource(). Please use the appropriate mj.* tools (e.g., mj.team.teamListFlags) to query data, or read the resource via standard MCP resource requests outside of Code Mode."
+            )
+          );
+        }
+        if (prop === "addEntry" && "core" in target) {
+          const coreGroup = target["core"];
+          return coreGroup["createEntry"];
+        }
+        if (prop === "append" && "core" in target) {
+          const coreGroup = target["core"];
+          const createEntry = coreGroup["createEntry"];
+          return (arg1, arg2, arg3) => {
+            const tags = Array.isArray(arg1) ? arg1 : [typeof arg1 === "string" ? arg1 : "test"];
+            const content = typeof arg2 === "string" ? arg2 : arg2 != null ? JSON.stringify(arg2) : "";
+            const metadata = typeof arg3 === "object" && arg3 !== null ? { ...arg3 } : void 0;
+            const typeVal = metadata?.["type"];
+            const type = typeof typeVal === "string" && typeVal !== "" ? typeVal : "test_entry";
+            if (metadata && "type" in metadata) delete metadata["type"];
+            return createEntry({ type, tags, content, metadata });
+          };
+        }
+        if (typeof prop === "string") {
+          const DB_TO_JOURNAL = {
+            listTables: ["analytics", "getStatistics"],
+            describeTable: ["analytics", "getStatistics"],
+            count: ["analytics", "getStatistics"],
+            analyze: ["analytics", "getStatistics"],
+            vacuum: ["analytics", "getStatistics"],
+            integrityCheck: ["analytics", "getStatistics"],
+            exists: ["core", "getEntryById"],
+            upsert: ["core", "createEntry"],
+            batchInsert: ["core", "createEntry"],
+            readQuery: ["search", "searchEntries"]
+          };
+          const mapping = DB_TO_JOURNAL[prop];
+          if (mapping !== void 0) {
+            const [group, method] = mapping;
+            if (group in target) {
+              return target[group][method];
+            }
+          }
+        }
+        return Reflect.get(target, prop);
+      }
+    });
     const sandbox = {
-      mj: mjApi,
+      mj: shimMj,
+      journal: shimMj,
+      sqlite: shimMj,
+      postgres: shimMj,
+      mysql: shimMj,
+      db: shimMj,
+      memory: shimMj,
+      // Unified with shimMj to catch memory.append and memory.journal
+      sqlite_journal_add_entry: shimMj["core"]?.["createEntry"],
+      context: contextObj ?? {},
       console: {
         log: (...args) => args,
         warn: (...args) => args,
@@ -112,8 +246,16 @@ async function executeCode(code, methodList, timeoutMs) {
       __dirname: void 0,
       __filename: void 0,
       global: void 0,
-      globalThis: void 0
+      globalThis: void 0,
+      Proxy: void 0
     };
+    for (const key of Object.keys(mjApi)) {
+      if (key in sandbox) continue;
+      const val = shimMj[key];
+      if (typeof val === "function") {
+        sandbox[key] = val;
+      }
+    }
     const context = vm.createContext(sandbox, {
       name: "codemode-worker-sandbox",
       codeGeneration: {
@@ -121,6 +263,30 @@ async function executeCode(code, methodList, timeoutMs) {
         wasm: false
       }
     });
+    vm.runInContext(
+      `(function() {
+                "use strict";
+                const builtins = [
+                    Object, Function, Array, String, Number, Boolean, RegExp,
+                    Error, TypeError, RangeError, ReferenceError, SyntaxError,
+                    URIError, EvalError, Map, Set, WeakMap, WeakSet,
+                    Promise, Date, ArrayBuffer, DataView,
+                    Int8Array, Uint8Array, Uint8ClampedArray,
+                    Int16Array, Uint16Array, Int32Array, Uint32Array,
+                    Float32Array, Float64Array, BigInt64Array, BigUint64Array,
+                    JSON, Math,
+                ];
+                for (const B of builtins) {
+                    if (B && typeof B === "function" && B.prototype) {
+                        try { Object.freeze(B.prototype); } catch(e) {}
+                    }
+                    try { Object.freeze(B); } catch(e) {}
+                }
+                try { Object.freeze(Object.prototype); } catch(e) {}
+                try { Object.freeze(Function.prototype); } catch(e) {}
+            })()`,
+      context
+    );
     const wrappedCode = `(async () => { ${transformAutoReturn(code)} })()`;
     const script = new vm.Script(wrappedCode, {
       filename: "codemode-execution.js"
@@ -141,16 +307,18 @@ async function executeCode(code, methodList, timeoutMs) {
     const endTime = performance.now();
     const endCpu = process.cpuUsage(startCpu);
     const error = err instanceof Error ? err : new Error(String(err));
-    const metrics = {
-      wallTimeMs: Math.round(endTime - startTime),
-      cpuTimeMs: Math.round((endCpu.user + endCpu.system) / 1e3),
-      memoryUsedMb: 0
-    };
+    if (error instanceof SyntaxError && error.message.includes("missing ) after argument list")) {
+      error.message += "\n\n\u{1F4A1} Tip: When passing long multi-line strings or markdown with embedded quotes, use template literals (backticks `) instead of single/double quotes to avoid escaping SyntaxErrors.";
+    }
     return {
       success: false,
       error: error.message,
       stack: error.stack,
-      metrics
+      metrics: {
+        wallTimeMs: Math.round(endTime - startTime),
+        cpuTimeMs: Math.round((endCpu.user + endCpu.system) / 1e3),
+        memoryUsedMb: 0
+      }
     };
   }
 }
@@ -162,9 +330,12 @@ parentPort?.on("message", (msg) => {
         id,
         code,
         methodList,
+        schemaList,
         timeoutMs,
         maxResultSize,
-        rpcPort: newRpcPort
+        rpcPort: newRpcPort,
+        contextObj,
+        readonlyMode
       } = executeMsg;
       rpcPort = newRpcPort;
       rpcIdCounter = 0;
@@ -180,7 +351,14 @@ parentPort?.on("message", (msg) => {
           }
         }
       });
-      const result = await executeCode(code, methodList, timeoutMs ?? 3e4);
+      const result = await executeCode(
+        code,
+        methodList,
+        schemaList,
+        timeoutMs ?? 3e4,
+        contextObj,
+        readonlyMode
+      );
       if (result.success) {
         try {
           const egressLimit = maxResultSize ?? 100 * 1024;
@@ -211,6 +389,9 @@ parentPort?.on("message", (msg) => {
             if (byteLength > egressLimit) {
               throw new Error(`EgressLimitExceeded:${byteLength}`);
             }
+            result.result = JSON.parse(resultJson);
+          } else {
+            result.result = void 0;
           }
         } catch (err) {
           result.success = false;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "memory-journal-mcp",
-    "version": "7.7.1",
+    "version": "8.0.0",
     "description": "Project context management for AI-assisted development - Persistent knowledge graphs and intelligent context recall across fragmented AI threads",
     "type": "module",
     "main": "dist/index.js",
@@ -20,14 +20,16 @@
         "lint": "eslint src/ tests/",
         "lint:fix": "eslint src/ tests/ --fix",
         "typecheck": "tsc --noEmit",
-        "check": "npm run lint && npm run typecheck",
+        "check": "tsx scripts/run-checks.ts",
         "test": "vitest run",
         "test:watch": "vitest",
         "test:coverage": "vitest run --coverage && npx tsx scripts/update-badges.ts",
         "bench": "vitest bench --run",
         "pretest:e2e": "node -e \"fs.rmSync('.test-output/e2e', { recursive: true, force: true })\"",
         "test:e2e": "playwright test",
+        "test:scheduler": "node test-server/scripts/test-scheduler.mjs",
         "generate:instructions": "node scripts/generate-server-instructions.ts",
+        "backfill:metadata": "tsx scripts/backfill-metadata.ts",
         "prepublishOnly": "npm run check && npm run test && npm run build"
     },
     "keywords": [
@@ -65,7 +67,7 @@
         "@octokit/graphql": "^9.0.3",
         "@octokit/rest": "^22.0.1",
         "better-sqlite3": "^12.8.0",
-        "commander": "^14.0.3",
+        "commander": "^15.0.0",
         "express": "^5.2.1",
         "jose": "^6.2.1",
         "simple-git": "^3.35.2",
@@ -83,7 +85,7 @@
         "eslint": "^10.2.0",
         "globals": "^17.4.0",
         "tsup": "^8.5.1",
-        "tsx": "4.22.0",
+        "tsx": "4.22.4",
         "typescript": "^6.0.2",
         "typescript-eslint": "^8.58.1",
         "vitest": "^4.1.3"

package/skills/README.md

@@ -18,9 +18,10 @@ This command will automatically download and synchronize the latest `SKILL.md` f
 skills/
 └── <skill-name>/
     ├── SKILL.md          # Main instruction file (required)
+    ├── references/       # Progressive disclosure docs to reduce token bloat
     ├── scripts/          # Helper scripts and utilities
     ├── examples/         # Reference implementations
-    └── resources/        # Templates, assets, reference docs
+    └── resources/        # Templates, assets, external docs
 ```
 
 ### SKILL.md Format
@@ -38,33 +39,60 @@ The markdown body contains the full instructions the agent follows once the skil
 
 ## Inventory
 
-| Skill                  | Description                                                                                                           |
-| ---------------------- | --------------------------------------------------------------------------------------------------------------------- |
-| `adversarial-planner`  | Multi-pass adversarial planning — iterative plan drafting, structured critique, and Copilot validation                |
-| `autonomous-dev`       | Harness for autonomous software development — alignment gates, adversarial agents, Git workflows, and CI/CD pipelines |
-| `bun`                  | Master the Bun all-in-one toolkit — runtime, package manager, test runner, and bundler                                |
-| `docker`               | Production-grade Docker — multi-stage builds, security hardening, Compose v2, BuildKit, and CI/CD integration         |
-| `github-actions`       | GitHub Actions CI/CD — SHA pinning, reusable workflows, caching, matrix strategies, and artifacts v4                  |
-| `github-commander`     | GitHub pipeline workflows for orchestrating issues, regressions, and deployments                                      |
-| `github-copilot-cli`   | Adversarial pre-push validation and full repository code audits driven by the @github/copilot terminal harness        |
-| `gitlab`               | Specialized assistant skill for managing repositories, code search, and CI/CD in GitLab                               |
-| `golang`               | Master Go development with production-grade best practices from Google and Uber style guides                          |
-| `mysql`                | Enterprise MySQL production rules — query safety, connection pooling, strict schema configurations                    |
-| `playwright-standard`  | Opinionated guidance for Playwright E2E/API tests, Page Object Models, and CI/CD resilience                           |
-| `postgres`             | Advanced PostgreSQL patterns — indexing layouts, JSONB querying, transactional guardrails, and RLS                    |
-| `python`               | Modern Python engineering — uv, ruff, type hints, pytest, Pydantic v2, and src/ layout project structure              |
-| `react-best-practices` | Vercel engineering guidelines for React/Next.js performance, hooks, and bundle optimization                           |
-| `rust`                 | Master Rust development using a layer-based "meta-cognition" framework for borrowing, lifetimes, and architecture     |
-| `shadcn-ui`            | Deep knowledge of shadcn/ui components, patterns, forms, and best practices                                           |
-| `skill-builder`        | Guide for creating, evaluating, and refining agent skills — progressive disclosure, triggers, and testing             |
-| `sqlite`               | Production configurations for concurrency (WAL), typing (STRICT), and data integrity                                  |
-| `tailwind-css`         | Tailwind CSS v4 — CSS-first configuration, @theme directive, dark mode, responsive design, and v3 migration           |
-| `typescript`           | Enterprise-grade TypeScript development with type-safe patterns, Zod validation, and modern tooling                   |
-| `vitest-standard`      | Comprehensive unit testing expertise covering Vitest, TDD, mocking strategies, and test architecture                  |
+| Skill                        | Description                                                                                                                           |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `adversarial-performance`    | Multi-pass adversarial performance audit — iterative profiling, stress-testing critique, and Copilot validation                       |
+| `adversarial-planner`        | Multi-pass adversarial planning — iterative plan drafting, structured critique, and Copilot validation                                |
+| `adversarial-security`       | Multi-pass adversarial security audit — iterative threat modeling, attack surface analysis, and Copilot validation                    |
+| `adversarial-skill-audit`    | Multi-pass adversarial skill audit — iterative quality evaluation, trigger stress-testing, and Copilot validation                     |
+| `adversarial-workflow-audit` | Multi-pass adversarial workflow audit — sequential clarity, HITL safety gates, loop prevention, and Copilot validation                |
+| `agents-sdk`                 | Build AI agents on Cloudflare Workers using the Agents SDK                                                                            |
+| `auth-identity`              | Standards for Authentication and Identity management (OAuth, JWTs, RBAC)                                                              |
+| `autonomous-dev`             | Harness for autonomous software development — alignment gates, adversarial agents, Git workflows, and CI/CD pipelines                 |
+| `aws`                        | Comprehensive AWS best practices — IAM, Serverless, S3, RDS, networking, and IaC                                                      |
+| `azure`                      | Microsoft Azure best practices — Entra ID, App Service, AKS, Cosmos DB, networking, and Bicep                                         |
+| `bun`                        | Master the Bun all-in-one toolkit — runtime, package manager, test runner, and bundler                                                |
+| `cloudflare`                 | Comprehensive Cloudflare platform skill — decision trees, product index, retrieval sources                                            |
+| `docker`                     | Production-grade Docker — multi-stage builds, security hardening, Compose v2, BuildKit, and CI/CD integration                         |
+| `docs-marketer`              | Documentation marketability audit — feature visibility, first impressions, competitive differentiation, and cross-surface consistency |
+| `drizzle-orm`                | Drizzle ORM best practices — database configuration, schemas, relational queries, migrations                                          |
+| `durable-objects`            | Create and review Durable Objects — RPC, SQLite storage, alarms, WebSockets                                                           |
+| `gcp`                        | Google Cloud Platform best practices — IAM, Cloud Run, BigQuery, VPC SC, and Terraform                                                |
+| `github-actions`             | GitHub Actions CI/CD — SHA pinning, reusable workflows, caching, matrix strategies, and artifacts v4                                  |
+| `github-commander`           | GitHub pipeline workflows for orchestrating issues, regressions, and deployments                                                      |
+| `github-copilot-cli`         | Adversarial pre-push validation and full repository code audits driven natively by the `gh copilot` CLI                               |
+| `github-repo-setup`          | Scaffold public TypeScript/Node.js repos under `{{ORG_NAME}}`                                                                         |
+| `gitlab`                     | Specialized assistant skill for managing repositories, code search, and CI/CD in GitLab                                               |
+| `golang`                     | Master Go development with production-grade best practices from Google and Uber style guides                                          |
+| `graphql`                    | GraphQL best practices — schema design, resolvers, DataLoader for N+1 issues, and mutations                                           |
+| `hono`                       | Hono framework best practices — edge runtimes, RPC, middleware, validation                                                            |
+| `journal-optimizer`          | Guided database pruning and optimization — importance audits, orphan cleanup, duplicate detection, and safe soft-delete               |
+| `llm-app-engineering`        | Master modern LLM application engineering patterns — prompt chains, token management, streaming                                       |
+| `multi-agent-orchestration`  | Patterns for multi-agent systems and agentic workflows (e.g. Plan-and-Execute, Supervisor)                                            |
+| `mysql`                      | Enterprise MySQL production rules — query safety, connection pooling, strict schema configurations                                    |
+| `next-best-practices`        | Next.js file conventions, RSC boundaries, data patterns, metadata, error handling                                                     |
+| `opentelemetry`              | Observability standards using OpenTelemetry — tracing, spans, metrics, exporters                                                      |
+| `playwright-standard`        | Opinionated guidance for Playwright E2E/API tests, Page Object Models, and CI/CD resilience                                           |
+| `postgres`                   | Advanced PostgreSQL patterns — indexing layouts, JSONB querying, transactional guardrails, and RLS                                    |
+| `python`                     | Modern Python engineering — uv, ruff, type hints, pytest, Pydantic v2, and src/ layout project structure                              |
+| `rag-pipelines`              | Best practices for Retrieval-Augmented Generation (RAG) pipelines — embeddings, chunking, retrieval                                   |
+| `redis`                      | Redis best practices — caching strategies, connection pooling, TTLs, and data structures                                              |
+| `render`                     | Render deployment best practices — Blueprints, Web Services, databases, and persistent disks                                          |
+| `rust`                       | Master Rust development using a layer-based "meta-cognition" framework for borrowing, lifetimes, and architecture                     |
+| `sandbox-sdk`                | Sandboxed code execution — interpreters, CI/CD, untrusted code                                                                        |
+| `shadcn-ui`                  | Deep knowledge of shadcn/ui components, patterns, forms, and best practices                                                           |
+| `skill-builder`              | Guide for creating, evaluating, and refining agent skills — progressive disclosure, triggers, and testing                             |
+| `sqlite`                     | Production configurations for concurrency (WAL), typing (STRICT), and data integrity                                                  |
+| `tailwind-css`               | Tailwind CSS v4 — CSS-first configuration, @theme directive, dark mode, responsive design, and v3 migration                           |
+| `typescript`                 | Enterprise-grade TypeScript development with type-safe patterns, Zod validation, and modern tooling                                   |
+| `vitest-standard`            | Comprehensive unit testing expertise covering Vitest, TDD, mocking strategies, and test architecture                                  |
+| `web-perf`                   | Chrome DevTools MCP performance auditing — Core Web Vitals, network, accessibility                                                    |
+| `workers-best-practices`     | Cloudflare Workers production patterns — streaming, bindings, secrets, observability                                                  |
+| `wrangler`                   | Cloudflare Workers CLI for deploying and managing Workers and bindings                                                                |
 
 ## GitHub Commander Workflows
 
-This package natively bundles the `github-commander` skill, which equips your AI agent with 8 autonomous DevOps workflows for repository stewardship:
+This package natively bundles the `github-commander` skill, which equips your AI agent with 4 autonomous DevOps workflows for repository stewardship:
 
 - **`issue-triage`**: End-to-end bug replication, PR submission, and Kanban lifecycle linking.
 - **`milestone-sprint`**: Sequential traversal of all open issues mapped to a specific release target.
@@ -76,6 +104,15 @@ This package natively bundles the `github-commander` skill, which equips your AI
 - **`roadmap-kickoff`**: Parses implementation specifications to sequentially scaffold Epic hierarchies across issues and milestones.
 - **`update-deps`**: Dependency constraint tracking, security patching, and major bump safety tests.
 
+## Automated Auditing
+
+The `adversarial-skill-audit` skill includes automated scripts for evaluating the skills directory:
+
+- `skills/adversarial-skill-audit/scripts/check-skills.ps1`: Generates an inventory of all skills, checking line counts, trigger lengths, and frontmatter compliance.
+- `skills/adversarial-skill-audit/scripts/run-copilot.ps1`: Runs independent validation against the Copilot CLI.
+
+> **Latest Audit**: May 26, 2026. The 59 skills in this repository were audited via a multi-pass GitHub Copilot validation sweep, evaluating Trigger Reliability, Instruction Clarity, Completeness, Token Efficiency, and Security. Key improvements identified: consolidating overlapping Next.js and testing skills, enhancing security gating on broad skills, and addressing Cloudflare product-specific coverage gaps.
+
 ## Adding a Skill
 
 1. Create a new directory: `skills/<skill-name>/`