optbrew 0.1.3 → 0.2.0

package/.claude-plugin/marketplace.json

@@ -2,5 +2,5 @@
   "name": "optbrew",
   "description": "optbrew: search, Naver and AI-answer readiness audit skill",
   "owner": { "name": "nowwcastle-sudo", "url": "https://github.com/nowwcastle-sudo" },
-  "plugins": [{ "name": "optbrew", "source": "./", "version": "0.1.3", "description": "Audit a site, fix approved local files, re-check under the same conditions and write a scored report" }]
+  "plugins": [{ "name": "optbrew", "source": "./skills", "description": "Audit a site, fix approved local files, re-check under the same conditions and write a scored report" }]
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "optbrew",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Pinned search audit and improvement skill bundle",
   "author": { "name": "nowwcastle-sudo", "url": "https://github.com/nowwcastle-sudo" },
   "skills": ["./skills/optbrew"]

package/.codex-plugin/plugin.json

@@ -1,13 +1,13 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "optbrew",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Pinned search audit and improvement skill bundle",
   "license": "MIT",
   "extensions": {
     "com.openai": {
       "skills": ["./skills/optbrew"],
-      "release_version": "0.1.3"
+      "release_version": "0.2.0"
     }
   }
 }

package/AGENT_INSTALL.md

@@ -2,12 +2,12 @@
 
 You are an AI coding agent installing the optbrew skill for a user. Follow the steps in order. Each step has a command and a check. Stop and ask the user when a step says so. Do not skip a check.
 
-Package: `optbrew@0.1.3` on npm. Source: https://github.com/nowwcastle-sudo/optbrew
+Package: `optbrew@0.2.0` on npm. Source: https://github.com/nowwcastle-sudo/optbrew
 
 ## Rules
 
 - Install only what the user asked for. Do not change other skills, settings or accounts.
-- Never delete `.optbrew/runs` (the user's audit evidence) or a whole `.optbrew` folder. The only deletions in this guide are the paths that the reinstall check in [Update](#update) prints.
+- Never delete `.optbrew/runs` or an `optbrew-audit` folder (the user's audit evidence) or a whole `.optbrew` folder (it also holds the user's Google key file). The only deletions in this guide are the paths that the reinstall check in [Update](#update) prints.
 - Do not call paid APIs, submit sites to search engines or publish anything. optbrew itself does none of these without the user's approval.
 - Show the user the planned changes (step 3) before you install.
 - On Windows in PowerShell, write `npx.cmd` wherever this guide says `npx`. Plain `npx` runs `npx.ps1`, which the default execution policy blocks with "running scripts is disabled".
@@ -32,13 +32,13 @@ Check: the major version is 22 or higher. If Node.js is missing or older, stop a
 User scope:
 
 ```text
-npx --yes optbrew@0.1.3 install --agents AGENTS --scope user --dry-run --json
+npx --yes optbrew@0.2.0 install --agents AGENTS --scope user --dry-run --json
 ```
 
 Project scope:
 
 ```text
-npx --yes optbrew@0.1.3 install --agents AGENTS --scope project --project PROJECT --dry-run --json
+npx --yes optbrew@0.2.0 install --agents AGENTS --scope project --project PROJECT --dry-run --json
 ```
 
 Check: exit code 0 and `"status": "dry_run"`. Show the user `decision.targets[].path` from the output and ask for approval before step 4.
@@ -54,7 +54,7 @@ Check: exit code 0 and `"status": "installed"` (or `"unchanged"` when the same r
 ## 5. Verify
 
 ```text
-npx --yes optbrew@0.1.3 doctor --agents AGENTS --scope SCOPE --json
+npx --yes optbrew@0.2.0 doctor --agents AGENTS --scope SCOPE --json
 ```
 
 Add `--project PROJECT` for project scope. Check: every entry in `targets` has `file_present: true`, `hash_ok: true` and `registered: true`. `session_discovery` and `invocation_verified` are always `not_verified`: doctor checks files, not whether the agent loaded them. A new agent session in step 6 confirms that.
@@ -65,19 +65,21 @@ Tell the user:
 
 - The skill is installed for AGENTS (SCOPE scope).
 - Start a new agent session. Then say "run optbrew" (or "optbrew 실행해") with the site URL and the goal, for example search traffic, Naver visibility, or AI answer citations.
-- optbrew asks for the URL and the goal first if they are missing.
+- optbrew asks for the URL first if it is missing. Then it checks the setup and sends all start questions in one message. The user can answer each number or reply "시작" (start) to accept the defaults.
+- The audit then runs in one go and writes `report.html`, `report.md` and `report.json` to `optbrew-audit/<site>-<date>` in the working folder. The user opens `report.html` first.
+- A Google API key is optional. It fills the real-visitor speed scores. The user saves it from their own terminal with `optbrew key set google` (or the `key.mjs` command that the key guide shows). Never ask the user to paste a key into the chat, and never read the key file.
 
 ## Update
 
-1. Find the installed release: run `npx --yes optbrew@0.1.3 doctor --agents AGENTS --scope SCOPE --json` (add `--project PROJECT` for project scope) and read `release_version`.
+1. Find the installed release: run `npx --yes optbrew@0.2.0 doctor --agents AGENTS --scope SCOPE --json` (add `--project PROJECT` for project scope) and read `release_version`.
 2. Find the latest release: `npm view optbrew version`.
 3. If they are equal, stop: nothing to update.
 4. Otherwise run `npx --yes optbrew@latest update --scope SCOPE --json` (add `--project PROJECT` for project scope). Check: `"status": "updated"`. Then repeat step 5 with `optbrew@latest`.
 
-If `update` stops with `migration_required`, the installed release scores with an older evaluation version and cannot be updated in place. Its scores are not comparable with the new release. Reinstall it:
+If `update` stops with `migration_required`, the installed release scores with an older evaluation version and cannot be updated in place. Its scores are not comparable with the new release. Every managed 0.1.x install ends here when it is updated to 0.2.0. Tell the user that an output folder from a 0.1.x audit cannot be reused: the new release refuses it with one sentence, and the audit has to run again in a new folder. Reinstall it:
 
-1. `git clone --depth 1 --branch v0.1.3 https://github.com/nowwcastle-sudo/optbrew optbrew-src` (needs git; use the tag of the release you install).
-2. In `optbrew-src`, run the read-only check from https://github.com/nowwcastle-sudo/optbrew/blob/v0.1.3/docs/platforms.md#reinstall-after-a-migration_required-update: `node bin/optbrew.mjs reinstall-plan --scope SCOPE` (add `--project PROJECT` for project scope).
+1. `git clone --depth 1 --branch v0.2.0 https://github.com/nowwcastle-sudo/optbrew optbrew-src` (needs git; use the tag of the release you install).
+2. In `optbrew-src`, run the read-only check from https://github.com/nowwcastle-sudo/optbrew/blob/v0.2.0/docs/platforms.md#reinstall-after-a-migration_required-update: `node bin/optbrew.mjs reinstall-plan --scope SCOPE` (add `--project PROJECT` for project scope).
 3. Show the user the printed `delete-link` and `delete-dir` paths and ask for approval. If the check refuses the install record, stop and show the user the message.
 4. After approval, run the block from that section that matches the user's shell (PowerShell or Bash) and scope, from `optbrew-src`. It deletes only the printed paths, installs again and runs doctor.
 
@@ -89,4 +91,4 @@ If `update` stops with `migration_required`, the installed release scores with a
 | `npx` cannot find `optbrew` | Check network access to the npm registry, then retry once. |
 | `unmanaged optbrew target exists` | Stop. Show the path to the user and ask. |
 | `bundle integrity failed` | Stop. Report the full message to the user. |
-| `doctor` shows `hash_ok: false` | Read the doctor `warnings`. If one says `migration_required`, the install is an older release: follow [Update](#update). Otherwise someone edited the installed files: ask the user before you run `npx --yes optbrew@0.1.3 update --scope SCOPE --local-changes backup-and-replace --json`, which keeps a backup of the edited files. |
+| `doctor` shows `hash_ok: false` | Read the doctor `warnings`. If one says `migration_required`, the install is an older release: follow [Update](#update). Otherwise someone edited the installed files: ask the user before you run `npx --yes optbrew@0.2.0 update --scope SCOPE --local-changes backup-and-replace --json`, which keeps a backup of the edited files. |

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## 0.2.0
+
+The beginner audit in one call. You answer one set of start questions, the agent runs the whole audit, and you get an HTML report in Korean with the fixes in order and the blanks explained.
+
+### What you see
+
+- **One call.** The agent checks your setup (`preflight.mjs`), sends the start questions in one message (one setup guide at most when something blocks the audit, plus up to three one-line offers), runs the audit with one command (`run.mjs`), judges the page text that code cannot judge, runs the same command again with `--judgments`, and hands you three reports: `report.html`, `report.md` and `report.json`. You answer once. The questions, guides and report are in Korean, and "시작" (start) takes every default.
+- **Which pages.** The audit takes pages from the sitemap and from links on the start page, up to the limit you choose: 50 pages by default, up to 200. The limit counts every request, including redirects and the robots and sitemap files. The same site gives the same pages every time. An address that redirects to its `www` or `https` twin is followed, and the report says so. A redirect to a different site stops the run with one sentence.
+- **Pages the site keeps out of the index.** A page with `noindex` that is not the home page and is missing from the site's own sitemap (a contact form, a thank-you page) is treated as meant that way: it gets no index, sitemap, crawler, title, canonical or Naver markup check and is no blocker. The run conditions list these pages. Without a sitemap that lists pages, a `noindex` stays a blocker.
+- **Which engines.** Google is always a target. Naver is a target when a goal names it, when you give a Naver export, or when the site is Korean (`lang="ko"` or an address ending in `.kr`).
+- **One fix per problem.** Pages with the same problem are one fix that lists how many pages it affects, instead of one finding per page. The fixes are sorted by what to do first.
+- **Fixes the model judged.** A missing date, an unnamed operator or a claim with no source is worded in Korean from the message catalog, one fix per page: the problem (an answer-clarity fail names its question), the page, the text it cites, where to look, what to do, how much work, and how to check. The model's own reason stays in `report.json` as evidence.
+- **Questions.** A page may answer several of your start questions, and a line every page repeats (a footer phone number) counts for a question when the model cites it for that question. A question with no answering page reads "not found within the pages read", never "the site lacks it".
+- **Korean report.** Every sentence in `report.md` and `report.html` is Korean: the fixes and the remaining work. A few ids in the run conditions stay English, and so do JSON keys and ids. The HTML report is one self-contained file with no script and no outside request. Runbook steps are a plain numbered list. A step shows a screen drawing only where a runbook names the position, and no runbook does yet.
+- **Speed scores.** Core Web Vitals of real visitors (LCP, INP, CLS) come from Google's Chrome UX Report and PageSpeed Insights when they have data. A free Google API key makes this work; without one those cells can stay blank, with the steps to get a key in the report. The lab values measured in your Chrome are shown as a run condition and are never scored.
+- **Google key command.** `optbrew key set google`, `optbrew key status` and `optbrew key remove google` (or `node <skill folder>/scripts/key.mjs ...`). You run it in your own terminal with hidden input. The key is saved in `.optbrew/credentials.json` in your home folder, outside every project; `OPTBREW_GOOGLE_API_KEY` takes priority. It is sent to Google only in a request header and is never written to a report, a log or the evidence. The agent never asks for it in the chat.
+- **Chrome.** The audit renders up to 10 pages, one of each kind, in a headless Chrome of its own, with a temporary profile that it removes at the end. Your running Chrome is never touched. The audit works through a proxy (`HTTPS_PROXY`); proxy credentials are never recorded. Without Chrome the render checks are blank, with the steps to install it.
+- **Owner exports.** A Search Console zip and a Naver Search Advisor text file are read when you give their paths. Their numbers appear as actual outcomes and do not enter the score.
+- **Setup guides (runbooks).** Step-by-step guides cover what needs your account or your machine: a Google API key and where to save it (your terminal, Codex, Claude Code cloud), Chrome, the two export files, network permission for Codex and Claude Code cloud, collecting visitor speed data inside your site, and the optional Anthropic and SE Ranking connections. The agent shows a full guide unasked only when something blocks the audit; every other guide appears when you ask for it, at the guidance level you picked.
+- **Old output folders.** A folder or evidence packet from a 0.1.x run is refused with one sentence: run the audit again in a new folder. A finished folder, or one that holds files the audit did not write, is refused too.
+
+### Versions
+
+Release 0.2.0, evaluation 0.4.0 (was 0.3.0), audit protocol 0.2.0 (was 0.1.0), contract schema 2.0.0. Scores of different evaluation versions are not comparable: `compare` reports `not_comparable` against a 0.1.x baseline.
+
+### Upgrading from 0.1.x
+
+- A managed install of any 0.1.x release (0.1.2 and 0.1.3 were tested) stops `optbrew update` with `migration_required` and changes nothing. Replace it with the blocks in `docs/platforms.md`, "Reinstall after a migration_required update". They run the read-only `optbrew reinstall-plan` first and never touch your evidence.
+- A plugin install from the marketplace follows `main`; the plugin update commands of your host are enough.
+- Run the baseline audit again with 0.2.0 before you compare.
+
+### Known limitations
+
+- The one-call audit refuses private and local addresses; a local target can no longer be declared from the start questions.
+- The fix step writes a change record for each edited file, but the 0.2.0 report does not read it, and a re-check after deploy does not update its `verification`; it stays `pending`. The re-check compares two audits (`cli.mjs compare`) and says what is resolved.
+- Core Web Vitals field data can stay unknown: a site with few visitors has no Google data, and the `cwv-site-collection` guide explains how to collect it in the site itself.
+- A runbook shows no screen drawing yet. A drawing appears only for a step that carries an explicit position tag.
+
+### Release checks that stay with the owner
+
+- The wording of the eli5 notice in `skills/optbrew/THIRD_PARTY_NOTICES.md`: its licence text was reconstructed because upstream has no licence file and no year. Decide the wording before the release is published. The caveman notice is copied from the installed 4.0.1 package.
+- After the merge: the claude.ai copy shows the merge commit (a check that waits for the sync). A directory review result does not block the release.
+- The steps in `docs/release.md`: CI on the merge commit, the tag, the GitHub Release and `npm publish` are run by the owner, not by an agent.
+
+### Carried over from the unreleased 0.1.4
+
+- The Claude marketplace now serves the `skills/` folder (new `skills/.claude-plugin/plugin.json`) instead of the repository root, because claude.ai, Claude Desktop and Cowork refuse a plugin with a top-level `bin/` folder and the marketplace sync failed. The marketplace entry and the served manifest pin no version, so every commit is picked up by marketplace sync. Claude Code installs keep the name `optbrew@optbrew` and the skill `/optbrew:optbrew`.
+- No `.gitattributes` at the repository root or inside `skills/`. The Claude plugin directory refuses one there whatever its lines say, `* -text` included, so the root file is gone. `tests/` and `docs/` keep their own `* -text`, because the test fixtures, evidence hashes and the documented shell blocks need exact bytes. A test rejects a `.gitattributes` at the root or inside `skills/`, and every file is still committed with LF.
+- Bundle hashes ignore the line endings a checkout adds. With `core.autocrlf=true` (the Git for Windows default) a Claude Code plugin install from the marketplace checks the skill out with CRLF. `bundle.mjs` and `score.mjs` now hash a file without a NUL byte as its LF form, so `doctor`, `install` and scoring accept that copy; LF files keep their old hashes and binary files hash as is. The ZIP and npm verifiers still compare exact bytes, so releases are built from a `core.autocrlf=false` clone (`docs/release.md`).
+- `docs/release.md` adds two steps: publish a GitHub Release for each tag and read it back, and confirm that the webhook got a push for `refs/heads/main` with the merge commit (a branch deletion is answered `ignored_delete` and does not sync).
+- The served `skills/` folder is a complete directory plugin: `skills/README.md` describes what the plugin runs, reads and sends, and `skills/.claude-plugin/plugin.json` adds `displayName`, `homepage`, `repository`, `license`, `keywords` and a 1024 px icon (`skills/.claude-plugin/icon.png`). Submit to the Claude directory with plugin path `skills`, so the scan reads only the plugin and not the repository's CLI, tests and npm files. A test checks the directory's README, license, icon, file-size and file-count rules.
+
 ## 0.1.3
 
 Resolves the seven known limitations listed under 0.1.2.

package/README.ko.md

@@ -8,6 +8,7 @@
 코딩 에이전트용 검색 준비도 감사 스킬입니다. optbrew는 구글·네이버·AI 답변 엔진 기준으로 사이트를 점검합니다. 승인한 로컬 파일만 고치고, 같은 조건으로 다시 확인한 뒤, 다시 계산할 수 있는 근거로 점수 보고서를 씁니다.
 
 - 스킬 하나로 다섯 가지를 봅니다: **SEO**, **NEO**(네이버), **AEO**, **GEO**, **LLMO**.
+- 초보자도 한 번에 끝냅니다. 시작 질문에 한 번 답하면 에이전트가 감사 전체를 돌리고 HTML 보고서를 건네 줍니다.
 - 고정된 감사 가이드 묶음 5개를 점검 항목 22개로 합쳤습니다. 여러 가이드가 같은 문제를 짚어도 한 번만 셉니다.
 - 보고서의 판정은 모두 수집한 원본 응답(해시 기록)에서 다시 계산할 수 있습니다.
 - 근거가 모자라면 대표 점수를 내지 않습니다. 측정 범위가 80% 미만이면 잰 부분과 그 범위만 보여 줍니다.
@@ -21,10 +22,11 @@ optbrew는 다섯 기준 모두에 같은 작업 순서와 같은 채점 규칙
 
 ## 동작 방식
 
-1. **감사.** URL, 목표, 범위를 알려 주면 수집기가 최대 50번 요청합니다. 페이지, 리다이렉트, robots·사이트맵 파일을 모두 합친 수이며, 깊이 3, 동시에 2개까지입니다. 응답마다 해시와 함께 저장합니다.
-2. **수정.** 에이전트가 로컬 파일 수정안을 냅니다. 승인 없이 고치거나 배포하거나 검색엔진에 제출하지 않습니다.
-3. **재확인.** 같은 조건으로 다시 수집합니다. 그래서 수정 전후를 비교할 수 있습니다.
-4. **보고.** 기준별 점수와 측정 범위, 막는 문제, 미확인 핵심 항목을 적습니다. 준비도·수정·실제 성과·남은 일은 표를 나눠 씁니다.
+1. **질문.** URL을 알려 주면 optbrew가 시작 쪽, 사이트맵, 사용자의 환경(크롬, 구글 키, 네트워크)을 읽습니다. 그다음 시작 질문을 한 메시지로 보냅니다. 안내 수준, 목표, 사람들이 찾을 질문, 사이트에서 읽은 사실, 쪽수 상한을 묻습니다. 번호마다 답하거나 「시작」만 답하면 기본값으로 갑니다. 네트워크가 막혀 있는 것처럼 감사를 막는 일이 하나 있으면 설정 안내를 먼저 보여 줍니다. 그 밖의 안내는 한 줄짜리 제안으로 최대 세 개까지 나오고, 그 단어로 답하면 열립니다.
+2. **감사.** 명령 한 번으로 수집, 페이지 종류마다 한 쪽씩 최대 10쪽을 전용 헤드리스 크롬으로 렌더링, 속도 측정, 코드 판정을 끝냅니다. 사이트맵과 시작 쪽의 링크에서 쪽을 골라 상한까지 감사합니다. 기본은 50쪽이고 올리면 최대 200쪽입니다. 상한은 모든 요청을 세므로 리다이렉트와 robots·사이트맵 파일도 한도를 씁니다. 주소가 `www`나 `https` 쌍둥이 주소로 넘어가면 따라가고, 보고서에 그렇게 적습니다. 응답마다 해시와 함께 저장합니다.
+3. **판정.** 코드가 판정할 수 없는 글 내용(주장, 답의 명확성, 최신성 등)은 에이전트가 읽고 판정합니다. 근거로 삼은 문장을 인용하고, 같은 명령을 한 번 더 실행하면 인용한 글이 증거 안에 실제로 있는지 확인한 뒤 점수를 냅니다.
+4. **보고.** 내용이 같은 파일 셋이 나옵니다. `report.html`(먼저 여십시오. 파일 하나로 완결됩니다), `report.md`, `report.json`입니다. 글은 한국어입니다. 문제마다 고칠 것이 하나이고 영향을 주는 쪽수가 붙습니다. 구글 키가 없을 때처럼 비어 있는 칸은 번호를 매긴 단계로 채우는 법을 알려 줍니다. 비어 있는 칸은 통과가 아니라 「알 수 없음」으로 보입니다.
+5. **수정과 재확인(선택).** 에이전트가 로컬 파일 수정안을 냅니다. 승인 없이 고치거나 배포하거나 검색엔진에 제출하지 않습니다. 배포한 뒤에는 같은 조건으로 다시 수집합니다. 그래서 수정 전후를 비교할 수 있습니다.
 
 스크립트가 직접 재는 것과 가이드·에이전트 판단에 맡기는 것은 이렇게 나뉩니다.
 
@@ -34,8 +36,9 @@ optbrew는 다섯 기준 모두에 같은 작업 순서와 같은 채점 규칙
 | NEO | 네이버 | Yeti용 robots.txt, Open Graph, description, canonical, viewport, 제목 반복, 막힌 CSS·JS | 네이버 콘텐츠 가이드 |
 | AEO, GEO | 답변 엔진과 AI 검색 | [ai-crawlers.md](skills/optbrew/references/ai-crawlers.md)에 적은 AI 검색 봇용 robots.txt(학습용 봇은 채점하지 않음) | 답변 구조, 주장, 작성자, 최신성 |
 | LLMO | AI가 우리를 설명하는 방식 | 상호·주소·전화·설립 연도가 페이지끼리 일치하는지, 페이지들이 한 업체를 설명하는지 | 그 사실이 맞는지 |
+| 전체 | 속도와 스크립트 | 자바스크립트가 돈 뒤에도 글이 보이는지(크롬). 구글 Chrome UX Report와 PageSpeed Insights의 방문자 실측 점수(LCP, INP, CLS) | 없음. 크롬으로 잰 실험실 값은 실행 조건으로만 보이고 채점하지 않습니다 |
 
-엔진별 검사는 대상으로 밝힌 엔진에만 적용됩니다. 네이버가 중요하다고 말하거나, ChatGPT·Claude·Perplexity처럼 신경 쓰는 AI 답변 엔진을 알려 주십시오. 채점 규칙은 [scoring.md](skills/optbrew/references/scoring.md)에 있습니다. 측정 범위 80% 기준은 optbrew가 정한 규칙이며, 검색엔진 표준이 아닙니다.
+엔진별 검사는 대상으로 밝힌 엔진에만 적용됩니다. ChatGPT·Claude·Perplexity처럼 신경 쓰는 AI 답변 엔진을 알려 주십시오. 목표에 네이버가 들어 있거나, 네이버 내보내기 파일을 주었거나, 사이트가 한국어(`lang="ko"` 또는 `.kr`로 끝나는 주소)이면 네이버는 저절로 대상이 됩니다. 구글은 항상 대상입니다. 채점 규칙은 [scoring.md](skills/optbrew/references/scoring.md)에 있습니다. 측정 범위 80% 기준은 optbrew가 정한 규칙이며, 검색엔진 표준이 아닙니다.
 
 ## 설치
 
@@ -46,7 +49,7 @@ Windows PowerShell에서 `npx`나 `optbrew`가 「스크립트를 실행할 수
 ### 1. npm
 
 ```bash
-npm install -g optbrew@0.1.3
+npm install -g optbrew@0.2.0
 optbrew install --agents codex,claude-code --scope user --dry-run
 optbrew install --agents codex,claude-code --scope user
 optbrew doctor --agents codex,claude-code --scope user
@@ -59,20 +62,20 @@ optbrew doctor --agents codex,claude-code --scope user
 전역 설치 없이 같은 CLI를 실행합니다.
 
 ```bash
-npx optbrew@0.1.3 install --agents codex,claude-code --scope user
-npx optbrew@0.1.3 doctor --agents codex,claude-code --scope user
+npx optbrew@0.2.0 install --agents codex,claude-code --scope user
+npx optbrew@0.2.0 doctor --agents codex,claude-code --scope user
 ```
 
 ### 3. PowerShell (Windows)
 
 ```powershell
-irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.1.3/install.ps1 | iex
+irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.2.0/install.ps1 | iex
 ```
 
 이 스크립트는 이번 버전에 고정돼 있습니다. Node.js를 확인하고, 설치할 폴더를 보여 주고, Codex와 Claude Code에 설치합니다. `doctor`가 문제를 찾으면 오류로 멈춥니다. 먼저 읽어 보거나 에이전트·프로젝트 폴더를 고르려면 이렇게 실행합니다.
 
 ```powershell
-irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.1.3/install.ps1 -OutFile install.ps1
+irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.2.0/install.ps1 -OutFile install.ps1
 powershell -ExecutionPolicy Bypass -File .\install.ps1 -Agents codex,claude-code,cursor
 ```
 
@@ -94,14 +97,16 @@ codex plugin marketplace add nowwcastle-sudo/optbrew
 codex plugin add optbrew@optbrew
 ```
 
-플러그인은 이 저장소의 `main` 브랜치를 따르며, 업데이트는 각 호스트의 플러그인 명령으로 합니다.
+claude.ai, Claude Desktop, Cowork: Customize > Plugins에서 Add > Add marketplace를 고르고 `nowwcastle-sudo/optbrew`를 입력한 뒤 `optbrew`를 추가합니다.
+
+플러그인은 이 저장소의 `main` 브랜치를 따르며, 업데이트는 각 호스트의 플러그인 명령이나 마켓플레이스 동기화로 합니다.
 
 ### 5. 에이전트에게 맡기기
 
 Codex, Claude Code 같은 코딩 에이전트에 아래 글을 붙여 넣으십시오.
 
 ```text
-optbrew 스킬을 설치해 줘. https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.1.3/AGENT_INSTALL.md 를 읽고 단계대로 따라 해. 어느 에이전트에, 어느 범위로 설치할지 먼저 묻고, 설치 전에 바뀔 내용을 보여 줘.
+optbrew 스킬을 설치해 줘. https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.2.0/AGENT_INSTALL.md 를 읽고 단계대로 따라 해. 어느 에이전트에, 어느 범위로 설치할지 먼저 묻고, 설치 전에 바뀔 내용을 보여 줘.
 ```
 
 [AGENT_INSTALL.md](AGENT_INSTALL.md)는 단계마다 실행할 명령과 통과 기준, 멈추고 사용자에게 물어야 할 경우를 적어 둔 에이전트용 안내서입니다.
@@ -116,7 +121,21 @@ optbrew 스킬을 설치해 줘. https://raw.githubusercontent.com/nowwcastle-su
 https://example.com 에 optbrew 돌려 줘. 목표: 네이버 노출, AI 답변 인용.
 ```
 
-빠진 정보가 있으면 optbrew가 먼저 묻습니다. 사이트 소유나 접근 권한, 허용할 로컬 수정, 이미 가진 근거 같은 것입니다. 원본 근거는 `.optbrew/runs`에 쌓입니다. 사설 네트워크 주소는 로컬 대상으로 명시했을 때만 가져옵니다.
+optbrew는 환경을 점검한 뒤 시작 질문을 한 메시지로 보냅니다. 번호마다 답하거나 「시작」만 답하면 기본값으로 갑니다. 구글 키, 크롬, 내보내기 파일이 없어도 감사는 멈추지 않습니다. 빈 칸은 채우는 방법과 함께 보고서에 적힙니다.
+
+감사에는 몇 분이 걸립니다. 결과는 작업 폴더의 `optbrew-audit/<사이트>-<날짜>`에 쌓입니다. 원본 근거(응답마다 해시)와 보고서 셋이 들어 있습니다. `report.html`을 먼저 여십시오. 같은 이름의 폴더가 있으면 `-2`, `-3`을 붙입니다. 사설·내부·로컬 주소(`localhost`, `192.168.x.x` 등)는 감사하지 않습니다. 공개 주소로 감사하십시오.
+
+### 구글 API 키(선택)
+
+무료 구글 API 키가 있으면 실제 방문자가 겪는 속도 점수(LCP, INP, CLS)가 안정적으로 채워집니다. optbrew가 권하면 「키」라고 답하십시오. 발급 방법이 나옵니다. 키는 대화창이 아니라 본인 터미널에서 저장하십시오. Codex나 Claude Code 클라우드에서는 키 안내가 저장할 곳을 대신 알려 줍니다.
+
+```bash
+optbrew key set google
+optbrew key status
+optbrew key remove google
+```
+
+`set`은 숨겨진 입력 창으로 키를 받습니다. `status`는 키가 있는지와 해시 앞 8자만 보여 줍니다. `remove`는 키를 지웁니다. npm으로 설치하지 않았다면 `npx optbrew@0.2.0 key set google`을 쓰거나, 「키」라고 답해 안내에 나온 명령을 그대로 복사하십시오. 스킬 폴더에도 같은 명령이 있습니다: `node <스킬 폴더>/scripts/key.mjs set google`. 키는 홈 폴더의 `.optbrew/credentials.json`에 저장되며 어느 프로젝트 안에도 들어가지 않습니다. 환경 변수 `OPTBREW_GOOGLE_API_KEY`가 있으면 그것이 먼저입니다. optbrew는 키를 요청 헤더로만 구글에 보내고, 보고서·로그·근거에는 쓰지 않습니다.
 
 ## 업데이트
 
@@ -127,11 +146,17 @@ optbrew update --scope user
 
 npx를 쓴다면 `npx optbrew@latest update --scope user`를 실행합니다. `optbrew check-updates --package optbrew`는 아무것도 바꾸지 않고, 지금 실행한 CLI보다 새 버전이 npm에 있는지 알려 줍니다. 에이전트 폴더에 설치된 버전은 `optbrew doctor --json`의 `release_version`에 나옵니다. `npm update`만으로는 에이전트 폴더에 이미 놓인 사본이 바뀌지 않습니다. 사본은 `update` 명령이 바꿉니다.
 
-0.1.2 이하 설치본은 `migration_required`로 멈춥니다. 0.1.3은 새 평가 버전으로 채점하기 때문입니다. 평가 버전이 다른 점수끼리는 비교할 수 없습니다. [migration_required 뒤 재설치](docs/platforms.md#reinstall-after-a-migration_required-update) 절차를 따르십시오. 이 절차는 읽기 전용 검사가 출력한 경로만 지우며, 감사 근거는 건드리지 않습니다.
+### 0.1.x에서 올리기
+
+0.2.0은 평가 버전(0.4.0), 감사 프로토콜(0.2.0), 계약 스키마(2.0.0)를 바꿨습니다. 그래서 이렇습니다.
+
+- 0.1.x 설치본(managed install)은 `migration_required`로 멈추며, `optbrew update`는 아무것도 바꾸지 않습니다. [migration_required 뒤 재설치](docs/platforms.md#reinstall-after-a-migration_required-update) 절차를 따르십시오. 이 절차는 읽기 전용 검사가 출력한 경로만 지우며, 감사 근거는 건드리지 않습니다.
+- 플러그인 설치(Claude Code, Codex, claude.ai)는 `main`을 따라가므로, 쓰는 도구의 플러그인 업데이트 명령이 그대로 됩니다.
+- 0.1.x 실행이 남긴 결과 폴더와 근거 묶음은 한 문장으로 거부됩니다. 새 폴더에서 감사를 다시 실행하십시오. 평가 버전이 다른 점수끼리는 비교할 수 없어서, 0.1.x 기준선과 `compare`하면 `not_comparable`이 나옵니다. 기준선 감사를 0.2.0으로 다시 돌리십시오.
 
 ## API와 비용
 
-유료 계정 없이 쓸 수 있습니다. Anthropic API나 [SE Ranking](https://seranking.com/api.html)을 직접 호출하려면 먼저 사용자 승인, 예산 기록, 중단 조건이 있어야 합니다. Claude 구독에는 API 요금이 포함되지 않습니다. 키는 환경 변수에만 두며 보고서에는 넣지 않습니다. 자세한 내용은 [API 경계](skills/optbrew/references/api.md)를 보십시오.
+유료 계정 없이 쓸 수 있습니다. Anthropic API나 [SE Ranking](https://seranking.com/api.html)을 직접 호출하려면 먼저 사용자 승인, 예산 기록, 중단 조건이 있어야 합니다. Claude 구독에는 API 요금이 포함되지 않습니다. 위의 구글 키는 본인 키이고, 그 키로 부르는 구글 속도 서비스는 무료입니다. 키는 환경 변수나 키 파일에만 두며 보고서에는 넣지 않습니다. 자세한 내용은 [API 경계](skills/optbrew/references/api.md)를 보십시오.
 
 ## 문서
 

package/README.md

@@ -8,6 +8,7 @@
 A search-readiness audit skill for coding agents. optbrew checks a site for Google, Naver and AI answer engines, fixes the local files you approve, checks again under the same conditions, and writes a scored report built from replayable evidence.
 
 - One skill for five profiles: **SEO**, **NEO** (Naver), **AEO**, **GEO** and **LLMO**.
+- One call for a beginner: answer one set of start questions, then the agent runs the whole audit and hands you an HTML report.
 - Five pinned audit guide bundles merged into 22 check families. An issue that several guides report is counted once.
 - Every verdict in the report can be recomputed from the raw responses that were collected and hashed.
 - No headline score when the evidence is thin: below 80% coverage the report shows the measured part and its bounds.
@@ -21,10 +22,11 @@ optbrew gives the agent one workflow and one scoring rule for all five profiles.
 
 ## How it works
 
-1. **Audit.** You give the URL, the goal and the scope. A collector makes at most 50 requests (pages, redirects and robots or sitemap files together; depth 3, two at a time) and stores every response with its hash.
-2. **Fix.** The agent proposes changes to local files. Nothing is edited, deployed or submitted without your approval.
-3. **Re-check.** The same collection runs again under the same conditions, so the before and after are comparable.
-4. **Report.** A score per profile with its coverage, blockers, open core checks, and separate tables for readiness, fixes, real outcomes and remaining work.
+1. **Ask.** You give the URL. optbrew reads the start page, the sitemap and your setup (Chrome, a Google key, network access). Then it sends one message with the start questions: your guidance level, the goal, the questions people search for, the facts it read from the site, and the page limit. The questions, the guides and the report are in Korean. Reply with an answer for each number, or just "시작" (start) to take the defaults. If one thing blocks the audit, such as a network that is closed, you get one setup guide first. Up to three more guides appear as one-line offers; you open one by answering with its word, such as "키" (key).
+2. **Audit.** One command collects the pages, renders up to 10 of them (one of each kind of page) in a headless Chrome of its own, measures speed and runs the code checks. It audits pages from the sitemap and from links on the start page, up to your limit: 50 pages by default, up to 200 if you raise it. The limit counts every request, so redirects and the robots and sitemap files use part of it. It follows a redirect to the `www` or `https` twin of your address and says so in the report. It stores every response with its hash.
+3. **Judge.** The agent reads the page text that code cannot judge, such as claims, answer clarity and freshness. It cites the sentences it relied on. A second call of the same command checks that the cited text exists in the evidence, then scores.
+4. **Report.** You get three files with the same content: `report.html` (open this one; it is a single self-contained file), `report.md` and `report.json`. The text is in Korean. Each problem has one fix with the number of pages it affects. A numbered list of steps tells you how to fill each blank, such as a missing Google key. Blanks are shown as unknown, never as a pass.
+5. **Fix and re-check (optional).** The agent proposes changes to local files. Nothing is edited, deployed or submitted without your approval. After you deploy, the same collection runs again under the same conditions, so the before and after are comparable.
 
 What the script measures by itself, and what still needs the guides and the agent's judgment:
 
@@ -34,8 +36,9 @@ What the script measures by itself, and what still needs the guides and the agen
 | NEO | Naver | robots.txt for Yeti, Open Graph, description, canonical, viewport, title repetition, blocked CSS or JS | Naver-specific content guidance |
 | AEO, GEO | Answer engines and AI search | robots.txt for the AI search bots in [ai-crawlers.md](skills/optbrew/references/ai-crawlers.md) (training bots are never scored) | Answer structure, claims, authorship, freshness |
 | LLMO | How models describe you | Whether name, address, phone and founding year agree across pages, and whether the pages describe one business | Whether those facts are true |
+| All | Speed and scripts | Whether the text still shows after JavaScript runs in Chrome. Field Core Web Vitals (LCP, INP, CLS) from Google's Chrome UX Report and PageSpeed Insights | Nothing. The Chrome lab values are shown as a run condition and are never scored |
 
-Engine-specific checks run for the engines you name as targets. Say that Naver matters, or name the AI answer engines you care about, such as ChatGPT, Claude or Perplexity. The scoring rule is in [scoring.md](skills/optbrew/references/scoring.md). The 80% coverage threshold is optbrew's own rule, not a search engine standard.
+Engine-specific checks run for the engines you name as targets. Name the AI answer engines you care about, such as ChatGPT, Claude or Perplexity. Naver is added on its own when the goal names it, you give a Naver export, or the site is Korean (`lang="ko"` or an address ending in `.kr`). Google is always a target. The scoring rule is in [scoring.md](skills/optbrew/references/scoring.md). The 80% coverage threshold is optbrew's own rule, not a search engine standard.
 
 ## Install
 
@@ -46,7 +49,7 @@ In Windows PowerShell, if `npx` or `optbrew` reports that running scripts is dis
 ### 1. npm
 
 ```bash
-npm install -g optbrew@0.1.3
+npm install -g optbrew@0.2.0
 optbrew install --agents codex,claude-code --scope user --dry-run
 optbrew install --agents codex,claude-code --scope user
 optbrew doctor --agents codex,claude-code --scope user
@@ -59,20 +62,20 @@ The dry run prints the folders it will write. `doctor` checks the files and thei
 Runs the same CLI without a global install:
 
 ```bash
-npx optbrew@0.1.3 install --agents codex,claude-code --scope user
-npx optbrew@0.1.3 doctor --agents codex,claude-code --scope user
+npx optbrew@0.2.0 install --agents codex,claude-code --scope user
+npx optbrew@0.2.0 doctor --agents codex,claude-code --scope user
 ```
 
 ### 3. PowerShell (Windows)
 
 ```powershell
-irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.1.3/install.ps1 | iex
+irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.2.0/install.ps1 | iex
 ```
 
 The script is pinned to this release. It checks Node.js, shows the target folders, installs for Codex and Claude Code, and stops with an error if `doctor` finds a problem. To read it first, or to choose agents or a project folder:
 
 ```powershell
-irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.1.3/install.ps1 -OutFile install.ps1
+irm https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.2.0/install.ps1 -OutFile install.ps1
 powershell -ExecutionPolicy Bypass -File .\install.ps1 -Agents codex,claude-code,cursor
 ```
 
@@ -94,14 +97,16 @@ codex plugin marketplace add nowwcastle-sudo/optbrew
 codex plugin add optbrew@optbrew
 ```
 
-Plugins follow this repository's `main` branch and update through the host's plugin commands.
+claude.ai, Claude Desktop and Cowork: open Customize > Plugins, choose Add > Add marketplace, enter `nowwcastle-sudo/optbrew`, then add `optbrew`.
+
+Plugins follow this repository's `main` branch and update through the host's plugin commands or marketplace sync.
 
 ### 5. Ask your agent
 
 Paste this into Codex, Claude Code or another coding agent:
 
 ```text
-Install the optbrew skill for me. Read https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.1.3/AGENT_INSTALL.md and follow it step by step. Ask me which agents and which scope to use, and show me the planned changes before you install.
+Install the optbrew skill for me. Read https://raw.githubusercontent.com/nowwcastle-sudo/optbrew/v0.2.0/AGENT_INSTALL.md and follow it step by step. Ask me which agents and which scope to use, and show me the planned changes before you install.
 ```
 
 [AGENT_INSTALL.md](AGENT_INSTALL.md) gives the agent a command and a pass check for each step, and the cases where it must stop and ask you.
@@ -116,7 +121,21 @@ Start a new agent session and ask, for example:
 Run optbrew on https://example.com. Goal: show up in Naver and get cited in AI answers.
 ```
 
-optbrew asks for anything it is missing: site ownership or access, which local changes are allowed, and which evidence you already have. Raw evidence goes to `.optbrew/runs`. Private network addresses are fetched only when you declare a local target.
+optbrew then checks your setup and sends the start questions in one message. Answer each number, or reply "시작" (start) to accept the defaults. A missing Google key, Chrome or export file does not stop the audit. The blank is listed in the report with the steps to fill it.
+
+The audit takes a few minutes. Everything it writes goes to `optbrew-audit/<site>-<date>` in your working folder: the evidence (every response with its hash) and the three reports. Open `report.html` first. The same name with a number added (`-2`, `-3`) is used when the folder already exists. Private, internal and local addresses (such as `localhost` or `192.168.x.x`) are refused, so audit the public address of the site.
+
+### Google API key (optional)
+
+A free Google API key makes the real-visitor speed scores (LCP, INP, CLS) fill reliably. When optbrew offers it, answer "키" (key) to see how to get one. Then save it from your own terminal, never in the chat. In Codex and Claude Code cloud, the key guide shows where to save it instead.
+
+```bash
+optbrew key set google
+optbrew key status
+optbrew key remove google
+```
+
+`set` asks for the key with hidden input. `status` shows only whether a key exists and the first 8 characters of its hash. `remove` deletes it. If you did not install with npm, use `npx optbrew@0.2.0 key set google`, or answer "키" and copy the exact command from the guide. The skill folder has the same command too: `node <skill folder>/scripts/key.mjs set google`. The key is saved in `.optbrew/credentials.json` in your home folder, outside every project, and the environment variable `OPTBREW_GOOGLE_API_KEY` takes priority if it is set. optbrew sends the key to Google only in a request header, and never writes it to a report, a log or the evidence.
 
 ## Update
 
@@ -127,11 +146,17 @@ optbrew update --scope user
 
 With npx, run `npx optbrew@latest update --scope user`. `optbrew check-updates --package optbrew` tells you, without changing anything, whether npm has a newer release than the CLI you are running; `optbrew doctor --json` shows the `release_version` installed in your agent folders. `npm update` alone does not touch copies already placed in agent folders; the `update` command does.
 
-An install from 0.1.2 or earlier stops with `migration_required`, because 0.1.3 scores with a new evaluation version. Scores from different evaluation versions are not comparable. Follow [Reinstall after a migration_required update](docs/platforms.md#reinstall-after-a-migration_required-update); the steps delete only paths that a read-only check printed and never touch your audit evidence.
+### Upgrading from 0.1.x
+
+0.2.0 changes the evaluation version (0.4.0), the audit protocol (0.2.0) and the contract schema (2.0.0). So:
+
+- A managed install of any 0.1.x release stops with `migration_required`, and `optbrew update` changes nothing. Follow [Reinstall after a migration_required update](docs/platforms.md#reinstall-after-a-migration_required-update); the steps delete only paths that a read-only check printed and never touch your audit evidence.
+- A plugin install (Claude Code, Codex, claude.ai) follows `main`, so the plugin update commands of your host work as before.
+- An output folder or evidence packet from a 0.1.x run is refused with one sentence: run the audit again in a new folder. Scores from different evaluation versions are not comparable, so `compare` reports `not_comparable` against a 0.1.x baseline. Run the baseline audit again with 0.2.0.
 
 ## APIs and cost
 
-Nothing here requires a paid account. A direct Anthropic API call or an [SE Ranking](https://seranking.com/api.html) call needs your approval, a recorded budget and a stop condition first; a Claude subscription does not include API billing. Keys stay in your environment variables and never go into a report. Details: [API boundaries](skills/optbrew/references/api.md).
+Nothing here requires a paid account. A direct Anthropic API call or an [SE Ranking](https://seranking.com/api.html) call needs your approval, a recorded budget and a stop condition first; a Claude subscription does not include API billing. The Google key above is your own, and the Google speed services it calls are free. Keys stay in your environment variables or the key file and never go into a report. Details: [API boundaries](skills/optbrew/references/api.md).
 
 ## Documentation
 

package/THIRD_PARTY_NOTICES.md

@@ -8,3 +8,91 @@ The files below retain their upstream copyright and permission notices. Service
 - **magnus-seo** — magnus919/agent-skills at 2e8fb962819b2b01b270620f92f0cc7213d77ef1; MIT; Git license blob 9745e19f4b20d77c134964ae1bf0af0ace5c4db7; exact notice: [licenses/magnus-seo.txt](skills/optbrew/licenses/magnus-seo.txt). Exclusions: Unselected agent skills.
 - **seranking-seo** — seranking/seo-skills at fd6d1408f2e6a06454d81c07c29e0f04342eb9ba; MIT; Git license blob ca6b9a33c8234bf47cdcfb2dc157b308195845c5; exact notice: [licenses/seranking-seo.txt](skills/optbrew/licenses/seranking-seo.txt). Exclusions: extensions/google/install.sh and extensions/firecrawl/install.sh: upstream installers disabled; scripts/google_auth.py and root scripts: upstream authentication and provider execution disabled; optbrew capability adapters replace active commands; Unselected campaign, ad, social and other upstream skills.
 - **marketing-search** — coreyhaines31/marketingskills at 5b2c0007766c6a1cf1d53fd8fc73e979e0821022; MIT; Git license blob 7c48dd638a9ebed49a8ef0c0c4eea90105381cdf; exact notice: [licenses/marketing-search.txt](skills/optbrew/licenses/marketing-search.txt). Exclusions: Unselected marketing skills, installers and authoring utilities.
+
+## Borrowed text
+
+These two works are not vendored code. SKILL.md, section "진행 보고", adapts the output rules of caveman. The top sections of the HTML report, added in the same release, follow the approach of eli5 (big picture, few words).
+
+### caveman
+
+Source: https://github.com/JuliusBrussee/caveman, `skills/caveman/SKILL.md`, version 4.0.1. No upstream commit is recorded: the text was copied from the installed 4.0.1 plugin. License: Apache License, Version 2.0, https://www.apache.org/licenses/LICENSE-2.0. Changes: the rules were translated into Korean, shortened, and rewritten for progress sentences during an audit; SKILL.md marks the paragraph "변경함". Upstream keeps the pre-3.0.0 MIT text in its `LICENSE-MIT` file for contributions made before 3.0.0; that file is not redistributed here. The upstream NOTICE file follows word for word.
+
+```text
+Caveman
+Copyright 2026 Julius Brussee
+
+Before Caveman 3.0.0, the parts of this repository outside the Engine-linked
+runtime were licensed under the MIT License (see LICENSING.md). Contributions
+made to those parts before 3.0.0 were received under the MIT License and remain
+available under it. Its copyright and permission notice is retained in
+LICENSE-MIT.
+
+This product includes third-party software:
+
+- engine/pixel/ is a Go port of pxpipe (https://github.com/teamchong/pxpipe),
+  used under the MIT License.
+  Copyright (c) 2026 claude-image-proxy contributors
+
+- The glyph atlases embedded in engine/pixel/assets/ are rasterized from:
+  - Spleen 5x8, Copyright (c) 2018-2026, Frederic Cambus.
+    BSD 2-Clause License.
+  - GNU Unifont 16.0.04, dual-licensed under the SIL Open Font License 1.1 and
+    the GNU GPL version 2 (or later) with the GNU font-embedding exception.
+
+- browse/ links these MIT-licensed Go modules:
+  - github.com/chromedp/chromedp, Copyright (c) 2016-2025 Kenneth Shaw
+  - github.com/chromedp/cdproto, Copyright (c) 2016-2025 Kenneth Shaw
+  - github.com/chromedp/sysutil, Copyright (c) 2016-2017 Kenneth Shaw
+
+- The runtime binaries and the container image link third-party Go modules
+  under the MIT, BSD-3-Clause and Apache-2.0 licenses. Their license texts, and
+  the Go runtime's, ship with every binary release as
+  THIRD_PARTY_GO_LICENSES.tar.gz and in the image under /licenses/third_party/.
+
+- packages/cli/src/index.ts contains a port, with changes, of Qwen Code
+  0.22.3's MCP server and permission-rule matchers and its tool-name
+  normalization (https://github.com/QwenLM/qwen-code), used under the Apache
+  License, Version 2.0.
+  Copyright 2025 Google LLC
+  Copyright 2025 Qwen
+
+- The @caveman-ai/cli package bundles MIT-licensed npm packages
+  (@clack/prompts, @clack/core, sisteransi, fast-string-width,
+  fast-string-truncated-width, fast-wrap-ansi); see packages/cli/NOTICE.
+
+- extension/fonts/ holds the Geist and Geist Mono fonts,
+  Copyright (c) 2023 Vercel, in collaboration with basement.studio,
+  under the SIL Open Font License 1.1.
+
+Full license texts: engine/pixel/NOTICE, engine/pixel/assets/SPLEEN_LICENSE.txt,
+engine/pixel/assets/UNIFONT_LICENSE.txt, browse/NOTICE, packages/cli/NOTICE, and
+extension/fonts/GEIST_LICENSE.txt.
+```
+
+### eli5
+
+Source: the `eli5` plugin version 1.0.0 by Thariq Shihipar, from the claude-community plugin marketplace. Its `plugin.json` declares `"license": "MIT"`; the plugin ships no separate license file and states no copyright year. Use: only the approach "big pictures, few words" is followed; no upstream text is copied. The text below is the standard MIT License text with the author name taken from `plugin.json`. It is not copied from an upstream file.
+
+```text
+MIT License
+
+Copyright (c) Thariq Shihipar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```